Yu sandboxes AI coding agents so they can use credentials without holding them. No permission popups. Auto-snapshot for fearless rollback.
How It Works
Filesystem — macOS sandbox-exec hides everything except the project directory. No containers.
Env vars — Default-deny whitelist. Secrets (KEY, TOKEN, SECRET, PASSWORD) get dummy values.
API proxy — For custom BASE_URL setups (e.g. LiteLLM), a localhost reverse proxy swaps dummy keys for real ones. No MITM, no certificates.
Command proxy — git, ssh, gh, aws intercepted by shims. Real commands run outside sandbox with credentials from .yu/env.
Permission bypass — Agents launch with --dangerously-skip-permissions (Claude) / --dangerously-bypass-approvals-and-sandbox (Codex). The sandbox is the security boundary.
How should an AI agent access the capabilities of a complex system? Not by exposing tools or credentials — but by talking to another agent that lives inside it. EaaS puts an AI agent at the environment boundary as the interface.The caller sends natural language; the agent handles orchestration, knowledge, and security inside. Nothing crosses the boundary but language.
General-purpose AI agents can reason, plan, and execute — but they cannot perform well in a specific operational domain without local knowledge. We argue that the gap between general intelligence and domain effectiveness is filled entirely by knowledge, and that the scaffolding commonly built for domain agents — skills, routes, SOPs, policies — are all knowledge encoded in different forms.
We present the Self-Evolving Knowledge Engine (SEKE), an architecture that enables an agent to autonomously learn, organize, and refine domain knowledge through real-world work. SEKE consists of three elements: a filesystem-based semantic tree as the knowledge storage model; two evolutionary loops — the Knowledge Evolution Loop (KEL) for continuous knowledge capture and refinement, and the Meta Evolution Loop (MEL) for improving the learning process itself; and a governance layer through which humans provide constitutional structural decisions that the system cannot override.
Our core thesis: General Intelligence + Capabilities + Domain Knowledge = Domain Intelligence. Given a reasoning engine, access to domain systems, and a Self-Evolving Knowledge Engine, an agent can bootstrap itself into Domain Intelligence without custom training or hand-crafted knowledge bases. Once bootstrapped, the accumulated knowledge — particularly the organizational structure it has evolved and the knowledge-learning capability it has developed — creates a compounding competitive barrier that is extremely difficult for competitors to cross.
We ground SEKE in several foundational ideas: knowledge defined as anything that changes agent behavior (not mere information storage); domains defined as the set of tasks that general-purpose models like Claude or Codex cannot perform well out of the box (a dynamic, not fixed, boundary); and a negative feedback argument for why the system self-corrects rather than amplifying errors.
These ideas emerged from building and operating a production domain intelligence system. SEKE is not a theoretical proposal — it is a working architecture refined through real-world deployment.
Domain Intelligence (The Intelligence that works in real world) is General Intelligence equipped with domain knowledge --- And domain knowledge can and should be learned from interaction with AI agents --- not trained and given. Here I proposed A Self-Evolving Knowledge Engine, I believe it's the answer to the question of how AI agents become Domain Intelligence.
How It Works
Filesystem — macOS sandbox-exec hides everything except the project directory. No containers.
Env vars — Default-deny whitelist. Secrets (KEY, TOKEN, SECRET, PASSWORD) get dummy values.
API proxy — For custom BASE_URL setups (e.g. LiteLLM), a localhost reverse proxy swaps dummy keys for real ones. No MITM, no certificates.
Command proxy — git, ssh, gh, aws intercepted by shims. Real commands run outside sandbox with credentials from .yu/env.
Permission bypass — Agents launch with --dangerously-skip-permissions (Claude) / --dangerously-bypass-approvals-and-sandbox (Codex). The sandbox is the security boundary.