Termic vs Orca

sandboxing

A worktree is a concurrency boundary, not a security one

Both apps put each agent in its own git worktree, and both call that isolation. It isolates you from one thing: two agents editing the same file at once.

At 2am, with an agent running unattended and permission prompts disabled, you have a different problem. A worktree does not stop a process reading ~/.ssh/id_ed25519, or ~/.aws/credentials, or your Keychain. It does not stop an outbound request to a host you have never heard of. Every agent in every worktree runs as you, with everything you can reach.

Orca is explicit about this. Its docs say "the intent is that the worktree itself is the sandbox", and it pre-applies each agent's full-autonomy flag at launch across roughly 26 agents. For Codex that flag is --dangerously-bypass-approvals-and-sandbox, which turns off the sandbox Codex ships with. Their own docs carry the caveat: filesystem isolation does not stop harmful shell commands, install scripts or secret access, so override the launch arguments before running on machines with shared credentials or production access.

The caveat is correct, and it leaves you to remember it on every machine, for every agent.

Termic's sandbox is a separate boundary underneath that one. Writes are confined to the worktree plus agent config and package caches. Credential paths are denied outright. Network egress goes through an in-process CONNECT proxy with a hostname allowlist, so the agent reaches the vendor API, GitHub, npm, PyPI and crates.io, and nothing else unless you add it per project.

That is what makes --dangerously-skip-permissions a reasonable default. The Seatbelt profile enforces the boundary, so the agent's own prompts are redundant and Termic turns them off inside the cage. Outside the cage, the toolbar icon goes red, because there the agent can do anything you can.

Read the design: docs/sandbox.md.

pick termic

Use Termic when the boundary matters

If your laptop holds production access, what matters is what an agent can touch when it goes wrong, and whether you can answer that in a sentence your security lead accepts. Termic's answer is a Seatbelt profile and a network allowlist. Orca's is a git worktree.

The rest is the runtime and a handful of workflow pieces. Tauri and Rust instead of Electron. No telemetry at all. Spotlight, so a worktree's changes show up live in your checkout without a branch switch. Multi-repo tasks, where one task holds backend, frontend and infra and the search and diffs span all of them.

Feature for feature, Orca has more. It has a team, four months of daily releases and a bigger surface in almost every direction. The case for Termic is that a smaller tool with an OS sandbox around the agent is worth it when the machine holds credentials you care about.

Termic did not start as an answer to Orca. It started as a replacement for Conductor, which is closed source and routes through the Claude Agent SDK, and the goal was to drive the real CLI binaries so a vendor pricing change could not reprice the workflow. Most of what is in the list above is something that annoyed me first.

sources

What I checked

Orca's public site, repo and releases, reviewed on 2026-08-11. Where the table says Orca lacks something, that means I could not find it in public sources.