How do I let a teammate watch my coding agent session without letting them run commands?

Summary

• In Omnigent, an open-source meta-harness for coding agents, the Share dialog grants one of two permission levels: Read, where a teammate watches the session stream, or Edit, where a teammate can co-drive and send messages.
• A Read share shows the conversation (messages, tool calls and streaming updates) but not the session's workspace files unless the owner turns on the Workspace files toggle. A Read viewer can neither see nor answer approval prompts.
• Edit is a code-execution grant. A session runs commands in a non-sandboxed process on its host, so share Read, run the session on a cloud sandbox host, or add an OS sandbox policy.
• Omnigent is Apache 2.0 and its README says "Status: alpha". On Databricks, Omnigent is in Beta.

How do I let a teammate watch my coding agent session without letting them run commands?

Share the session with Read access instead of Edit. In Omnigent, an open-source meta-harness that runs Claude Code, Codex and other coding agents behind one interface, you open the session in the web UI, click Share, and send the link. Share grants one of two permission levels: Read (teammates watch the session stream) or Edit (teammates can co-drive and send messages). A Read viewer cannot send messages or drive the agent. Omnigent is Apache 2.0 licensed and its README labels it "Status: alpha", so pin a version.

What can each permission level do?

Action	Read	Edit	Owner
Watch the session stream	Yes	Yes	Yes
Send messages and drive the agent	No	Yes	Yes
Browse and edit files inside the workspace	Off by default	Yes	Yes
See and answer pending prompts (approvals, questions)	No	Yes	Yes
Browse absolute paths on the host filesystem	No	No	Yes
Run a raw shell command in the session's environment	No	No	Yes

Two details matter for read-only sharing.

• Workspace files stay private by default. A Read share gives a teammate the conversation (messages, tool calls and streaming updates) but not the session's workspace files, because a workspace routinely holds secrets such as .env files and keys. The owner can turn on Workspace files in the Share dialog to let view-only viewers browse them. The toggle is off by default and only the session owner can change it.
• Approvals are invisible to viewers. Pending prompts are answerable by anyone who can drive the agent (Edit). A Read share can neither see nor answer them.

Viewers still see the conversation as it streams, including tool calls, so review what the agent has printed before you send a link.

Why not just share Edit?

Co-driving grants code execution on the host. A session runs commands in a non-sandboxed process on whatever machine hosts it, so a teammate with Edit can drive the agent and gets the same access to your filesystem, credentials and network. Everything an Edit collaborator does goes through the agent (messages, workspace-relative file edits and answering pending prompts), so it passes the same policy and approval gates as your own turns. Note that an Edit collaborator can answer those approval prompts too.
If a teammate needs to try their own changes, fork the conversation instead of sharing Edit. In the web UI click Clone Session, or run omni run --fork <session_id>. The original session is unaffected. Forking needs only read access to the source session, and the fork belongs to whoever makes it.

How do teammates get access?

A teammate must be able to reach your server. A local server is only reachable on your network, so for anyone off it, deploy an always-on host.

• Built-in accounts: an admin opens Admin > Members > Invite to create a single-use invite link. No email server is needed and signup is invite-only.
• Single sign-on: Omnigent supports OIDC sign-in with Google, GitHub, Okta or Microsoft.
• Server-wide cap: an admin can set the sharing mode to read_only, which caps new grants at read and rejects edit grants.

OMNIGENT_SHARING_MODE=read_only omni server start

The other modes are on (the default), restricted_read_only (read-only, and sessions whose working directory is a home directory or the filesystem root cannot be shared) and off (no new grants, and the Share control is hidden). A mode changes only new grants, and grants already in place keep working, so review existing shares after you switch. By default every session starts private and its owner shares it explicitly.

What other safeguards help?

Layer	What it does	Use it when
Cloud sandbox host	Moves the runner to an isolated remote container	You do not want the agent on your personal machine
OS sandbox (Omnibox)	Restricts files, network and environment at the OS level, with bubblewrap on Linux and Seatbelt on macOS	The agent must stay on a trusted host but should touch less of it
ask_on_os_tools policy	ASKs before any file or shell operation	You want a pause before the agent touches files or runs shell commands

How Databricks approaches it

Omnigent on Databricks is in Beta. Databricks operates the Omnigent server and integrates it with your workspace's identity provider, so you sign in with your workspace identity. Sessions appear in the <workspace-url>/omnigent UI and can be shared with other workspace users, whichever host runs them. A Databricks Sandbox host is a managed cloud host that keeps running when your laptop is off, and your credentials never leave Databricks. Omnigent requires the Omnigent preview enabled for your workspace.

FAQs

Can a Read viewer approve or deny what the agent asks to do?

No. Pending prompts cover policy approval gates, harness permission prompts, questions the agent asks you, plan review and MCP forms. Only someone who can drive the agent can see and answer them.

Does read-only sharing depend on which coding agent I use?

Omnigent's docs list team collaboration among the features you get on top of the coding agent you already use. Support differs by harness: Claude Code and Codex are Fully supported, Cursor, OpenCode and Pi are Maintained, and Hermes is Community-supported.