Solutions
What Forkbench solves
The real problems of running a fleet of AI coding agents — and how Forkbench handles each.
Stop coding agents reading your .env file
You cannot reliably stop an agent from reading a file sitting in the project, so the fix is to stop the value being in the file: keep the secret in Vault and let the agent run the command that needs it, without the value ever entering its context.
Does my code get sent to the model provider?
Yes. Any file the agent reads becomes part of the context it sends to its model provider, and no terminal can change that, because the agent makes that request itself. What a terminal does decide is the second question, which is what ELSE on your machine ends up in that context.
Why .gitignore and .claudeignore do not hide a secret
An ignore file is a request, not a boundary. It asks a tool to skip a path, and it works exactly as far as that tool chooses to honour it, which is why coding agents have been reported reading .env files despite entries in both .claudeignore and .gitignore.
An agent read my API keys. What do I do now?
Rotate the credential first and investigate afterwards. Once a value has entered an agent's context it has been transmitted to the model provider and it is sitting in that conversation's history, so the only reliable remedy is to make the value worthless.
Prompt injection and coding agents: what it can actually reach
You cannot reliably prevent prompt injection, so the useful question is what a successful one can reach. An agent can only exfiltrate what is in its context or what its credentials let it do, which makes limiting both far more practical than trying to filter hostile text.
Limit which folders a coding agent can touch
Bound the agent at the filesystem rather than in the prompt. On macOS the kernel does this through a Seatbelt profile applied when a shell starts, which denies reads and writes outside the folders you allowed and is inherited by every process that shell spawns, including build scripts, dependency install hooks and the agent's own tool calls. Unlike an instruction in a config file, it cannot be talked out of, and unlike a container it does not ask you to rebuild your development environment somewhere else.
Give an agent push or deploy access without giving it the credential
The agent needs the command to succeed, not the credential to be readable. Give the command the secret and the agent takes the outcome, while the value never enters its context.
Keep your API keys away from AI coding agents
Vault lets an agent run commands that use your API keys and tokens without ever holding the value: the secret stays on your Mac and reaches only the command that needs it. Vault is part of Pro.
Is it worth it if you only run one agent?
Half of it genuinely is not worth it at one agent, and the half that is has nothing to do with how many agents you run: a single agent still reads whatever your shell can read, and a single agent still marks its own homework.
Run your AI coding agents across multiple Macs
Forkbench brings every Mac paired to your account onto one Thread board, so agents on different machines claim from a single backlog and never touch the same task. What actually travels is the scope: a secret added on one Mac is usable from another without the value ever being readable on either, sealed under a key we do not hold, and removing a Mac rotates that key and re-seals, so revocation is real rather than a delisting.
Stop parallel agents from undoing each other's work
Collisions have two causes and both need answering. On disk, give every agent its own git worktree, so they are editing different files and physically cannot overwrite each other. On the plan, put the work on a board that leases a task to one agent at a time, so two never pick up the same thing. Forkbench does both, free. The reason it exists, though, is the collision nobody counts: separate worktrees still share one environment, so every agent you started can read the same tokens, and that is the one failure that does not get better when you notice it.
Hand off tasks between AI coding agents
Forkbench's task board is a durable per-Thread file, not a chat transcript, so a task one agent writes today, complete with its plan, notes, and any discussion that resolved a question, can be claimed and finished tomorrow by a different agent from a different vendor entirely. The board is free on every plan, which is deliberate: it is how agents sharing a job keep out of each other's way, not the thing Forkbench is for. What it is for is the scope around it, where the keys and notes one job needs are the ones an agent working that job can reach, and no others.
Answer a blocked agent from your phone
Two things fix it, and they are separate. First, the app has to tell you which agent is waiting rather than leaving you to check. Second, answering has to be possible from wherever you are, which means a browser or a phone rather than the Mac the agent is running on. If the agent is Claude Code, start with Anthropic's own Remote Control, which connects claude.ai and the Claude mobile app to a session running on your machine and is included on paid plans. Forkbench's Talk does the same attaching for whatever is in the pane, which is what you need when the one that stopped to ask you something is Codex, Gemini CLI or Aider, and a Thread shows you which of its panes is blocked rather than leaving you to check each one.
Stop sitting there waiting for your quota to reset
Write the prompt while you still have it in your head, hand it to a terminal pane on a countdown set for when your quota comes back, and walk away: Forkbench delivers it to that pane at the time you chose, so the agent starts the moment the limit lifts rather than whenever you next sit down.
Switch terminal without rebuilding your setup
Almost nothing you are afraid of losing lives in your terminal. Your shell, prompt, aliases, functions, PATH, tmux configuration and dotfiles all belong to the shell, not the emulator, so any terminal that opens a real login shell inherits every one of them on first launch with nothing to port.
Stop hunting through terminal tabs
The fix is to group terminal sessions by the piece of work they belong to rather than by window position, so each group carries its own folder, its own notes and its own credentials, and switching context becomes switching group instead of reading tab titles.