Yours by default, and sharing a web preview

To share a sandbox preview link with a teammate, run /share on the session, or click the link on the web view. What you get is a public address, https://<slug>.isolation.cc/, that anyone with it can open. That is the one thing about a session that is built to be handed to someone else. Everything else, the workspace and the session itself, is yours and stays yours.

What belongs to you

A workspace is created inside an organization but scoped to the member who made it. Another member asking for it gets a 404, the same answer as for a workspace that does not exist. Every session launched from it is the launcher's in the same way: only you open its terminals, its code view, its files, its agent conversations. A session on a shared server does not make the session shared.

Owners and admins have exactly one right over sessions that are not theirs: they can list every session on the organization's servers and stop any of them. That is the ops right that lets whoever pays for a metered server end a forgotten session. It never includes opening one. There is no visibility setting to get wrong; this is the one behavior. Roles are described in organizations, roles and invites.

Every stop, launch and share is written to the activity log with who did it and from which door, so an admin stopping a teammate's session is on the record.

Sharing a web preview

A web view names the port your app listens on. Its public address is a hostname of twenty characters under isolation.cc:

https://k7m2q4x9pbw3e5r8ay6n.isolation.cc/
       └─ 10 chars ─┘└─ 10 chars ─┘
       routes to      the secret
       your server

The first ten characters route the request to the server running the session. The last ten are random, 50 bits, and they are the access secret: a guesser working one hostname per request cannot walk them, and only the doorman on your server knows which suffixes are live, so a wrong one answers "unknown app". There is no login page in front of a preview; the link is the key.

/share
/share checkout-preview

/share answers with the link when the session has one web view and asks which when it has several. Send it to a reviewer, paste it in a pull request, open it on your phone. The bytes go from their browser to your server's doorman to the sandbox, through the private tunnel, and are served from the preview domain, never from the origin that holds your login. What is public and what is not is spelled out in tunnels, the doorman and what is public.

To revoke a link, delete the web view. Its suffix stops resolving at once. A new web view on the same port gets a new suffix, so a link you regret never comes back by accident. Finishing the session revokes every link it had.

Sharing an ssh route

A terminal view has an ssh door: /connect answers with ssh <routeId>@ssh.isolation.cc, which attaches that very shell. The route works for the public keys the session authorizes, which by default are yours. To let a teammate in, add their key to the running session:

/allow-key ssh-ed25519 AAAAC3... colleague@laptop

It takes effect immediately, no restart. They can ssh, scp, ssh -L a port, or open the session in VS Code, Cursor, Windsurf or Zed over the same route, as described in work from your IDE. The route is a door into the sandbox's shell, so give it to someone you would hand your keyboard to.

Sharing an agent conversation

The third thing you can share is a conversation with one of the session's agents, and you do it in a chat app rather than in Isolation. Launch a session from a Slack or Teams thread, or attach a running one to it, and the session's agents are in the room. /agents lists them, /agent Isla picks who the thread talks to, and from then on everyone in the thread types normally and Isla answers under her own name. The conversation belongs to the session and outlives it: when the session ends the thread says so and the agents go quiet; a new launch reconnects them.

From a terminal, ssh -s <route>@ssh.isolation.cc acp joins the same agent conversation the browser shows, live, so two people can watch and steer one agent. Setting up the chat side is in Slack.

None of this opens the session to the room. A teammate in the thread talks to the agent; they still cannot open your terminals, your files or your code view.