{"slug": "describe-review-approve-inspect-a-coding-agent-loop-built-for-control", "title": "Describe Review Approve Inspect: A Coding Agent Loop Built for Control", "summary": "A developer released Cue, an MIT-licensed Windows 11 Electron coding agent that uses Codex CLI for its model path and runs workspace actions under AppContainer workers. Cue freezes a human-readable \"execution envelope\" — the approved worktree and allowed actions — before any file mutation begins, then lets users inspect a ledger of provenance and outcomes or hit Stop to terminate the controller and workers. The project targets small, inspectable file-changing goals and explicitly does not claim syscall-enforced network isolation or nested worker child processes in v0.1.", "body_md": "Most local coding agents force a false choice: **YOLO the desktop**, or **approve every tool call until you give up**.\n\nCue is built for a third path. It is a Windows 11 Electron coding agent (MIT) that uses Codex CLI for the model path on the host, runs workspace actions under AppContainer workers, and freezes a human-readable **execution envelope** *before* anything mutates your files. You describe a goal, review the scope, approve once, then inspect a ledger — or hit Stop.\n\nThis post is about that control loop. If you want the sandbox-primitive deep dive (why AppContainer is Cue’s floor), that lives in Day1 — one link at the end. Here we stay on what using it feels like.\n\nTwo failure modes dominate desktop agents today.\n\n**YOLO desktop.** The agent gets a wide trust surface because “real developer work” needs shells, helpers, caches, and whatever the next step invents. You move fast until something lands outside the folder you thought you meant. The product rarely shows a frozen boundary you can point at later.\n\n**Approval fatigue.** The other extreme asks you to click through every tool, every path, every spawn. It feels safer for an afternoon, then you start auto-approving because the friction is the product. Control collapses into ritual.\n\nNeither mode is “wrong” for every threat model. But both leave a gap for people who want **one human decision that actually bounds the run** — not unlimited trust, and not infinite micro-prompts.\n\nCue does not claim to “solve agent security forever.” It claims a narrower product contract: freeze the envelope before workers run, keep mutation inside the approved worktree, and make outcomes inspectable.\n\nCue’s loop is deliberately short:\n\nFail-closed matters as much as the happy path. If you cancel at the workspace picker, execution does not start. Cue retains cancel evidence under README Verification (P12 cancel) for that fail-closed behavior — this post will not reprint those tables.\n\nThe security story is not “trust the model, then restrict whatever it tried.” It is “freeze the envelope, then run only inside it.”\n\n**An execution envelope, in Cue, is the human-approved scope for a coding run: the worktree and allowed actions frozen before workspace workers start. After approval, the envelope does not expand.**\n\nThat definition is the product. Everything else is implementation detail.\n\nPractically:\n\n`cwd`; the server fixes it to that worktree.\nAdjacent honesty from README Current limits: Cue does not remove Windows UAC/elevation friction, does not claim syscall-enforced network isolation for all paths (P3-16 is detect-and-stop, not syscall forcing), and does not support nested worker child processes in v0.1.\n\nSo “envelope” is not marketing fog. It is a freeze point you can review, then a hard refusal to grow after you click Approve.\n\nA control loop without an honest ending is just a prettier YOLO.\n\nCue’s ledger surfaces provenance and outcome classes you can inspect:\n\nThat triad is how Cue answers “did it stay inside what I approved?” without asking you to scrub raw logs for every run.\n\n**Stop** is part of the same contract. Hitting Stop terminates the active **controller and workers** — not a soft UI pause that leaves orphans chewing your worktree. If you care about mid-run kill-switches for coding agents, that is the behavior to verify against the README’s Stop evidence path, not a marketing slide.\n\nWatch the clip: [cue-demo-en.mp4](https://github.com/zenovis2-create/cue/blob/main/docs/assets/cue-demo-en.mp4)\n\nIt is a **34-second edited** recording of a real small file-changing flow (checklist-style generation). You should see goal → envelope review → approve → ledger. That is the proof this post leans on: the control UX, not a wall of isolation tables.\n\nWhat it does **not** prove:\n\nv0.1 is aimed at **small, inspectable file-changing goals** on Windows 11:\n\nWrong-fit (for now):\n\nThose limits are intentional coherence, not temporary bashfulness. If your first experiment needs nested tooling or open-ended YOLO scope, Cue will feel frustrating — correctly. Start with a disposable worktree and a one-file goal.\n\nThis article intentionally does **not** re-litigate OpenAI’s AppContainer rejection for Codex-shaped workloads. Cue’s isolation floor (capability-zero AppContainer workers, approved worktree, host vs worker split) is covered here:\n\n[Why Cue still uses AppContainer after Codex rejected it for Windows agents](https://dev.to/_76dca2218d5cc98e685ca/why-cue-still-uses-appcontainer-after-codex-rejected-it-for-windows-agents-5h1b)\n\nFor verification entry points without a Day2 evidence dump, see the README Verification section in the repo.\n\nIf your pain is “I want to approve before a coding agent runs — once, with a real envelope — then inspect what happened,” Cue is for that moment.\n\n`npm install` then `npm start`\n**Star if you want more envelope-first Windows agent work. Open an issue if an approved envelope was exceeded.**\n\nThat feedback is more useful than applause. The product bet only holds if the freeze point stays frozen.", "url": "https://wpnews.pro/news/describe-review-approve-inspect-a-coding-agent-loop-built-for-control", "canonical_source": "https://dev.to/_76dca2218d5cc98e685ca/describe-review-approve-inspect-a-coding-agent-loop-built-for-control-lai", "published_at": "2026-09-10 08:14:37+00:00", "updated_at": "2026-09-10 08:22:18.094231+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "developer-tools", "ai-safety"], "entities": ["Cue", "Codex CLI", "Electron", "AppContainer", "Windows 11", "GitHub"], "alternates": {"html": "https://wpnews.pro/news/describe-review-approve-inspect-a-coding-agent-loop-built-for-control", "markdown": "https://wpnews.pro/news/describe-review-approve-inspect-a-coding-agent-loop-built-for-control.md", "text": "https://wpnews.pro/news/describe-review-approve-inspect-a-coding-agent-loop-built-for-control.txt", "jsonld": "https://wpnews.pro/news/describe-review-approve-inspect-a-coding-agent-loop-built-for-control.jsonld"}}