T3 Code 0.1.7: Lock Down Your AI Coding Agent Fleet

T3 Code 0.1.7 landed on November 4 with one addition that reframes who the tool is actually for: a managed policy system. Until now, T3 Code was a personal cockpit for developers juggling Claude Code, Codex, Cursor, and friends. With 0.1.7, it becomes something IT departments can control — a machine-wide JSON file that sets defaults and locks settings for every developer in an organization before any agent touches a line of code. The missing piece was never more features. It was governance.

What T3 Code Is (If You Haven’t Used It)

T3 Code is not a coding agent. It has no AI model of its own. It is an open-source (MIT) control surface — a local server with Electron, browser, iOS, and Android clients — that drives the agent CLIs you already have installed and authenticated. Claude Code, Codex, OpenCode, Cursor, Grok, Vercel fx, and now Kiro: one interface, your existing subscriptions, no token resale. Install it in under a minute with npx t3@latest or brew install --cask t3-code on macOS.

The Managed Policy: What It Does

A managed policy is a JSON file deployed by an administrator to a system-level path. T3 Code reads it at startup and enforces it server-side — clients cannot bypass it. The policy sets two categories of values: defaults (applied if the user hasn’t configured something) and locks (the value is set and the user cannot change it). Remove the policy file and each developer’s personal settings.json takes over immediately.

The policy lives at:

• Linux: /etc/t3code/policy.json
• macOS: /Library/Application Support/T3Code/policy.json
• Windows: C:\ProgramData\T3Code\policy.json or via Group Policy (Computer Configuration > Administrative Templates > T3 Code)

What you can control:

• Permission mode — lock every developer to Supervised (agent asks before acting) and prevent silent switches to Auto
• Allowed providers — whitelist exactly which agents (Claude Code, Codex, Kiro, etc.) can be used; unlisted providers do not appear in the UI
• Browser cookie import — disable this to remove a known prompt injection vector
• Updates policy — set to “managed” so IT controls version rollouts
• Usage data — toggle telemetry reporting

A Minimal Policy File

T3 Code publishes a JSON Schema for policy files, so editors with schema support give you autocomplete and validation before you deploy anything.

{
  "": "https://t3.codes/policy-schema.json",
  "organization": "Acme Corp",
  "permissionMode": { "default": "supervised", "locked": true },
  "allowedProviders": {
    "value": ["claude-code", "codex", "opencode"],
    "locked": true
  },
  "browserCookieImport": { "value": false, "locked": true },
  "updates": { "value": "managed", "locked": true }
}

Drop that file in the system path and every T3 Code instance on the machine enforces it. No agent in your organization runs in Auto mode without you explicitly unlocking it.

New Providers: Kiro and Vercel fx

0.1.7 also adds Amazon Kiro as an Early Access (beta) provider. Kiro is AWS’s spec-driven coding agent — the one that generates a full technical spec before writing any code, then stays anchored to it. If your team has been evaluating Kiro alongside Claude Code and Codex, you can now run all three from the same T3 Code interface.

Vercel’s open-source terminal agent fx became a built-in provider a week earlier (October 28) and is now fully stable in 0.1.7. It supports both Supervised and Auto modes and works with your existing models and skills. T3 Code now spans seven providers in a single control plane.

Why This Week, Specifically

Thoughtworks published Tech Radar Vol. 35 on the same day 0.1.7 shipped. The finding relevant here: Agent Sandboxing moved from Trial to Adopt. It is no longer a forward-looking recommendation — it is a baseline expectation. The Radar specifically warns against “human-in-the-loop theater,” where approval checks become rubber stamps. A managed policy that locks agents to Supervised mode across a team is a concrete implementation of that recommendation, not just a checkbox.

The security argument is real too. Prompt injection attacks against Claude Code, Codex, and Copilot were confirmed in production environments earlier this year. Restricting which providers can run and disabling browser cookie import are small configuration changes with meaningful attack surface reduction.

Get Started

# macOS
brew install --cask t3-code

# Windows
winget install T3Tools.T3Code

# Any platform (Node 22.16+)
npx t3@latest

Create your policy.json using the schema at https://t3.codes/policy-schema.json, drop it in the appropriate system path, and restart T3 Code. The setup wizard finds existing agent projects and threads and imports them in one click. Full release notes are on the GitHub releases page.