They all have pros and cons. Pick the one that suits you best. Then you're also agent harness flexible (I use opencode).

Sandboxing a GUI is typically more operational overhead than sandboxing a cli (mounting compositor sockets, GPU access, etc).

Casual mode [3]: > Your home directory is mounted as a copy-on-write overlay. The jailed process sees your real files, but writes go to $HOME/.jai/default.changes instead of modifying originals, except in the directory where you ran jai. Your current working directory grants full read/write access to code in the jail (unless suppressed with -D). So files deleted there are really gone. /tmp and /var/tmp are private. The rest of the filesystem is read-only.

Strict mode [4]: > The process runs as the unprivileged jai system user, not as you. Home directory is an empty private directory at $HOME/.jai/<name>.home. Granted directories (via -d or cwd) are exposed with id-mapped mounts — files look like they are owned by jai inside the jail. Because the process has a different UID, it cannot read files outside your home directory that are only accessible to your user — this is where confidentiality comes from.

Bare mode [5]: > Home directory is an empty private directory, like strict mode. But the process runs as your user, not as jai. This means it cannot provide confidentiality — the process can still read any file accessible to your UID outside the home directory.

I've always ran my stuff in casual so far just so my whole computer doesn't get rimraffed :P. but I'm thinking of switching to just strict mode, but haven't really vibe coded in a while so I haven't tried it yet.

[1]: https://jai.scs.stanford.edu/

[2]: https://jai.scs.stanford.edu/modes.html

[3]: https://jai.scs.stanford.edu/modes.html#casual-mode

[4]: https://jai.scs.stanford.edu/modes.html#strict-mode

[5]: https://jai.scs.stanford.edu/modes.html#bare-mode

This is one of the first things I “fixed” with skills and hooks. I index every conversation in SQLite and have a skill which knows what to do when I ask it to search the index. I had to avoid the word memory because it’s too tied up in other parts of the context. It even indexes across my different machines. I set this up because I have terrible context discipline. I’ll go off on a tangent in one context and start planning and sometimes implementing something based on that thread which really deserves its own context. Afterward I can create the new context and move relevant bits to it, but I’d lose that initial starting conversation which inherently has more data than the summary in the new context.

I also use a few different related contexts. One where I’m building a game engine in zig and another talking about game ideas. There’s a lot of back and forth going on there which needs some shared context. I solve this with a combination of Claude.md references and that searchable session index.

Everything I do with scheduled tasks are just wired up with systemd and simple scripts. No LLM in the critical execution path. Again a skill tells CC how I manage those scheduled things so I just have to say something like “run this every day at midnight” and CC has reliably taken care of the rest.

What do people do with these? I don't use Claude but when I did I couldn't think of anything useful to do with the routines. I'm probably not being imaginative enough.

Also, I can't break the swipe keyboard habit either. It's the worst, but still better than the alternatives. Someday I hope physical keyboard makes a return (but I"m not holding my breath)