Skip to main content
The shape: a session is a real Linux machine, not a transcript. While the agent works on it, you can log into the same machine from your own terminal, read the files it changed, fix what it got wrong, and give it back. The agent carries on from your change, because there is only one machine. This is the answer to “the agent says it’s done — is it?”. Don’t read its summary. Log in and look.

Once: register a key

Add an ed25519 public key in the Console under Settings › SSH keys. Keys are per user, and only ed25519 is accepted.
Paste the .pub line into the Console. Registering a key is a Console step; there is no /v1 endpoint for it yet.

1. Give the agent something to leave half-done

Wait for the turn as usual — see the quickstart.

2. Log in

The login name is the session id with s- in front:
You arrive as user, with passwordless sudo. The agent works as root, so the files it made are root’s: git refuses to touch its repository (“detected dubious ownership”), and a plain edit fails with Permission denied. Become the same user the agent is before you do anything:

3. Look, then change something

In the run behind this guide, the agent had put the repository at /workspace/greet-repo rather than in /workspace itself — the kind of detail its summary does not always mention and the filesystem always does.

4. Hand it back

The agent’s reply, from that run:
Last two commits:
  • 18f3838 — human: “human: greet with Hey”
  • df764a8 — Agent: “Initial commit: greet returns Hello”
greet("Ada") currently returns "Hey, Ada" … I added test.js asserting greet('Ada') === 'Hey, Ada', it passes, and I committed it.
It saw your commit, read your change, and built on it. Nothing was copied anywhere.

What the gateway gives you

For files, use the workspace itself: ask the agent to write them under /workspace/outputs, or read them with GET /v1/sessions/{id}/files/content. See sessions.

What was verified

Run against production on 2026-09-27 with a key registered for the acceptance account and a stock OpenSSH client: the login string above, the user identity with passwordless sudo, the root-owned repository and the two refusals before sudo -i, the edit and commit, the agent’s reply reading the human commit, the refused exec request, and a paused session woken by logging in. The session was deleted and the key revoked afterwards.

Next