2 min lesson
Know what each CLI boundary protects
Separate worktree isolation, sandbox reach, command approval and sudo password handling.
Step 1 of 3
A worktree separates checkouts. It does not isolate a database, service, network request or elevated host command.
Interactive diagram. Step through it with the Next and Previous controls below, or Tab to a region to read its detail.
diagram: flow
Each control answers a different question about the run.