CalypsoCode

CalypsoCode is a Linux launcher for coding agents. It removes a defined set of identifiers (network address, git identity, locale and timezone, the agent's own config) from what the agent transmits, and on exit it reports what it removed and what it did not. I built it over a few weeks in July 2026.

The problem

Whether a model provider can read your code is a property of the provider you pick. Whether they can tell it was you asking is a separate problem, and I found nobody serving it. My first design rotated API keys per request over one shared Tor circuit. Working through it, I realised that rotates the credential while holding the network constant, which hands the provider proof that all those accounts are one person. Identity is the set of signals that link two requests, so every signal has to change at the same boundary.

Approach: configure, don't rewrite

The unit is a profile: one file per compartment, naming the network, the provider endpoint, the model, a git identity, and the name of the environment variable that holds the key, never the key itself. One compartment is one key, one config, one identity, and nothing crosses between compartments.

The launcher never inspects or rewrites traffic. It controls the environment the agent starts in: oniux seals the agent in a Tor network namespace that fails closed at the kernel, LC_ALL=C and TZ=UTC remove locale and timezone, git author variables are fixed, and XDG_CONFIG_HOME points at the compartment so my global agent config never loads. Removing a signal at its source is more reliable than scrubbing it afterwards, and it cannot corrupt code.

Measured, not assumed

Most of the work was testing the stack's actual behaviour, and the repo records it as numbered findings. Several invalidated my plan: a host process cannot reach a port bound inside the namespace, so my LiteLLM proxy design was unimplementable and I deleted it. oniux silently injects ALL_PROXY, which breaks loopback. XDG_CONFIG_HOME alone does not isolate an agent, because data and state live elsewhere.

My first leak test could not fail, so I rewrote it to run from inside the namespace against targets confirmed reachable from the host first. A real coding session over Tor on the shipped agent took 4 round trips at 3.6 s mean with 0 failures. The suite is shell scripts covering egress, leak, profiles and receipts, plus a security mutation runner, checked with shellcheck in CI.

The receipt and the agent

On exit the launcher writes a receipt: Tor exit, leak-test result, session timing, and an explicit list of what was not removed. The agent it runs is a rebranded fork of OpenCode, changed so it no longer sends a client-identifying User-Agent.

Limits and next

That session is one task, one provider, one day. How providers react to Tor traffic over weeks, and latency on a large repository, are untested. Tor rotates exits inside a session (three in 27 minutes), and whether to pin one is an open question. Two things cannot be removed: the account you pay with, and your writing style. The code is AGPL-3.0; I am currently working on the remaining roadmap step.