Termic vs Orca

the real split

A worktree is a concurrency boundary, not a security one

Both apps put each agent in its own git worktree, and both call that isolation. It is, for one specific problem: two agents editing the same file at the same time. That is the problem a worktree solves.

It is not the problem you have at 2am when an agent is running unattended with permission prompts disabled. A worktree does not stop a process reading ~/.ssh/id_ed25519, or ~/.aws/credentials, or your Keychain. It does not stop an outbound request to a host you have never heard of. Every agent in every worktree runs as you, with everything you can reach.

Orca is explicit about this. Its docs say "the intent is that the worktree itself is the sandbox", and it pre-applies each agent's full-autonomy flag at launch across roughly 26 agents. For Codex that flag is --dangerously-bypass-approvals-and-sandbox, which turns off the sandbox Codex ships with. Their own docs carry the caveat: filesystem isolation does not stop harmful shell commands, install scripts or secret access, so override the launch arguments before running on machines with shared credentials or production access.

That caveat is the whole argument on this page. It is correct, and it puts the work on you to remember it, per machine, per agent, forever.

Termic's sandbox is a separate boundary underneath that one. Writes are confined to the worktree plus agent config and package caches. Credential paths are denied outright. Network egress goes through an in-process CONNECT proxy with a hostname allowlist, so the agent reaches the vendor API, GitHub, npm, PyPI and crates.io, and nothing else unless you add it per project.

That is what makes --dangerously-skip-permissions a reasonable default rather than a shrug. The Seatbelt profile is the thing holding the line, so the agent's own prompts are redundant and Termic turns them off inside the cage. Outside the cage, the toolbar icon goes red, because at that point the agent really can do anything you can.

Read the design: docs/sandbox.md.

pick termic

Use Termic when the boundary matters

If your laptop holds production access, the question is not which app has more panes. It is what an agent can touch when it goes wrong, and whether you can answer that in a sentence your security lead accepts. Termic's answer is a Seatbelt profile and a network allowlist. Orca's is a git worktree.

The rest is the runtime and a handful of workflow pieces. Tauri and Rust instead of Electron, because the agents are already the expensive part. No telemetry at all. Spotlight, so a worktree's changes show up live in your checkout without a branch switch. Multi-repo tasks, where one task holds backend, frontend and infra and the search and diffs span all of them.

Feature for feature, Orca has more. It has a team, four months of daily releases and a bigger surface in almost every direction. This page is not going to pretend otherwise. The case for Termic is that a smaller tool with a real boundary around the agent is the right trade when the machine you run it on matters.

Termic did not start as an answer to Orca. It started as a replacement for Conductor, which is closed source and routes through the Claude Agent SDK, and the goal was to drive the real CLI binaries so a vendor pricing change could not reprice the workflow. Most of what is in the list above is something that annoyed me first.

sources

What I checked

Orca's public site, repo and releases, reviewed on 2026-08-11. Where a feature is marked as not documented, that means I could not find it in public sources, not that I proved it absent.