Pause, audit and redaction
Connecto gives agents more reach, not less: they can drive each other. This page says plainly what that means and what you control.
What agents can do
There is no sandbox. Agents run as your user, with your files and your network. In the default launch mode, the tools' own approval checks are off. An agent can change anything your account can change.
Text on one screen can steer an agent that reads it. With the connecto command, that agent can type into the other terminals.
If you want the tools' own checks back, choose Auto or Prompt in How agents are launched.
Pause
Agents → Pause All Agents, or ⌘ ., or the switch at the bottom of the sidebar.
Pause is a full brake on everything that is not you:
- agents sending text or keys to other terminals;
- agents adding, starting or closing terminals, and being woken;
- automations checking screens and typing;
- remote users typing, resizing, changing terminals, and pairing.
A turn that is already running continues: Pause does not kill anything. You can still type into any terminal yourself. An agent cannot lift Pause.
Stop
- Close Terminal (⌘ W) ends one terminal and moves it to the history.
- Agents → Stop Everything pauses first, then ends every terminal.
Connecto ends the processes it can find. A process that detached itself before you clicked Stop can outlive it.
The audit log
Every action that one terminal takes on another is recorded: who did it (you, an agent, an automation, or a remote user), what it was, and the text, with secrets redacted.
The log is in Connecto's data folder under audit/, with a new file for each launch. Each record is chained to the one before it by a hash, so an edited record can be found:
connecto-app audit verify <file>
The check finds a changed record. It cannot tell that the end of a file was deleted.
Redaction
Before text leaves a terminal for anywhere else, Connecto removes what looks like a secret and writes [REDACTED] in its place:
- known token formats and private-key blocks;
- values after names such as
password=; - long random-looking strings.
It applies to messages between agents, the audit log, history transcripts, the text sent to the automation classifier, and the text used to title a terminal. If redaction fails, the content is withheld instead of passed on.
Your own terminal is never redacted: you see exactly what the tool printed.
Redaction is best effort. It lowers the chance that a secret travels; it is not proof that none did.
What Connecto does to limit damage
- It refuses your home folder, its own data folder and the tools' state folders as projects.
- A terminal inherits only
USER,LOGNAME,PATHandLANGfrom your environment. - Isolated projects (an advanced option) keep their logins and settings apart from yours.
- Sessions outside Connecto cannot message a Connecto Claude terminal.
- Automations have rate limits and a per-terminal cutoff.
- Remote access is off until you turn it on.