For the technical
The architecture
Strazh is a desktop application, not a hosted proxy sitting between you and your agent. It runs its own local database and its own local dispatch gate. The agent you’re already using does the work, and Strazh decides whether it gets to start.
The shell
A Tauri v2 desktop app (Rust + React + TypeScript) wraps a local Python core running on your machine. The two talk over a local HTTP bridge secured by a per-launch random token and a host-header guard, so a stray webpage in some other tab can’t drive your own backend.
The data plane
SQLite
Dispatch history, rejections, and allow-list config: a single local database file, not a hosted table you don't control.
OS keychain
The license token is routed through your operating system's own credential store, never a plaintext database column.
Durable rejection log
Every rejected dispatch, not just approved runs, gets a permanent record: reason, path, timestamp, and the entry point that triggered it.
Four agents, one gate
Claude Code, Codex, and Cursor dispatch as local subprocesses; Devin is API-backed: it has no local execution model, so Strazh derives a repo/branch identity from your local working directory and dispatches against Cognition’s hosted session API instead. All four resolve through the identical safety gate before dispatch, so which agent you use never changes what’s enforced.
Trust controls, specifically
The gate claims on the homepage aren’t a mission statement, they map to specific, checkable controls in the code.
Allow-listed cwd
Every dispatch resolves its working directory against your configured allow-list before anything runs, including traversal-escape attempts: outside the list, nothing spawns.
Scrubbed subprocess environment
Dispatched agents run with a filtered environment, not your full shell: a case-insensitive keep-list so nothing platform-critical gets silently dropped either.
Process-tree-aware kill
Stop kills the entire process group, not just the top-level PID: no orphaned child processes left running after a cancel.
Approval-gated dispatch
Nothing runs without an explicit approval, and editing the prompt, repo, or agent after approving automatically revokes it, so stale approvals can't fire on changed input.
Tiered daily caps
Free, Individual Pro, and Enterprise each get a different rolling 24-hour dispatch cap, counted identically whether the call came from the UI or an MCP client: no double-dipping between entry points.
Offline verification
License tokens are Ed25519-signed and verified entirely offline against a public key baked into the build: no runtime phone-home required to know what tier you're on.