Pasting code into a chat window and getting code back is a request-response tool. Whatever comes out is a suggestion, you read it, and nothing happens until you act.
An agent reads files, edits several at once, runs commands, and loops on the results. The generation quality may be identical. Everything around it is a different engineering problem, and the difference is entirely in what happens when it is wrong.
Four things that stop mattering, and four that start
Copy-paste tools worry about prompt quality, context window size, output formatting, and how much you have to explain.
Agents worry about: what it is allowed to touch, how you approve, how you get back, and what it costs before you find out. None of those exist when the output is text on a screen.
Approval is the surface
The central design question is not "how good is the model" but "at what granularity do you say yes".
Too coarse — approve the whole task — and you are reviewing a twelve-file diff after the fact, which is the thing everyone says they will read carefully and does not.
Too fine — approve every edit — and you are a slow autocomplete, which defeats the point.
Codoro's answer is the approved diff: multi-file edits are proposed as one reviewable change, and allowlisted build and test commands run against them. The allowlist matters more than the diff. An agent that can run arbitrary shell in your repository is an agent that can be told to run arbitrary shell in your repository, by a merged branch, a dependency, or a file it read.
There is a related decision that goes further: a repository cannot start a program. MCP servers
and scoped rules in .codoro/rules/*.md are consent-gated rather than picked up automatically. The
alternative — cloning a repo and having its config launch something — is a supply-chain hole with a
nice user experience.
Undo has to be real
In a chat tool, undo is not pasting. In an agent, a bad change is already spread across files.
Codoro does optimistic edits with undo, which covers the case where you approved something and immediately regretted it. It does not cover the case where you approved four things over an hour and the second was wrong. Nothing in an editor does. Commit before you start anything ambitious — that is not a Codoro rule, it is the cost of letting software edit software.
Cost has to be reserved, not measured
A chat turn costs what it costs and you see it afterwards. An agent loops, and each pass re-sends the whole accumulated conversation as input — turn twelve carries turns one through eleven. That is a curve. Discovering it afterwards is discovering it too late.
So an agent needs to hold money before spending it, and that turns out to be genuinely hard. A model's published price is often not one number: the same model can differ between the US and the EU, some price by whichever provider endpoint serves the request, and some have long-context tiers where crossing a threshold reprices the whole request rather than the excess. The gateway picks the region and the endpoint, after we send.
The resolution is two prices. The reservation is taken at the dearest price the request could
possibly attract — a distinct reserveRates field in the catalogue, present only where it differs
from the headline. The settlement is the vendor's real rate for what happened. Under-reserving
defeats the cap; over-settling charges a premium the request may never have incurred. A hold is not a
charge.
Caps: $2.00 per run by default, editable per task; $25.00 per developer per day, set by the team owner; 0% markup on your own key. At the cap the run pauses and offers a cheaper model rather than downgrading silently — a run that changed models mid-task would hand you one diff with an invisible seam in it.
The four things it will not do
Constraints rather than gaps, and the reasoning is the same each time — an editor that will do anything a file tells it to is an exfiltration surface.
- No Ollama, no OpenRouter, no arbitrary OpenAI-compatible base URL. The provider list is an allowlist. A config file naming an endpoint is a config file a teammate or a template can change.
- No arbitrary command execution. Build and test commands are allowlisted.
- No repository-initiated processes. MCP and rules are consent-gated.
- No reselling a provider's consumer subscription. Every provider row is
subscription: false. There is no path where a Claude Pro plan powers the editor.
What is around the editor
Four surfaces, and worth being accurate about the last one: Editor (multi-file edits behind an approved diff, allowlisted checks, optimistic undo), Design (manifest-declared frame previews bound to repo paths, tokens read from the stylesheet, apply-to-code that quotes an estimate before writing a diff), Plan (a project board with repository evidence attached), and Chat (repo-scoped channels, threads, search, reactions, mentions, unread cursors).
Chat is not a Slack replacement and should not be sold as one: no server push — it polls — no DMs, no presence, no typing indicators, no attachments, no notification policy. It is a place to discuss a repository next to the repository, which is a smaller claim.
Status
There is no public download. The macOS build is in preview and the download page renders a waitlist until a signed release manifest says otherwise. The landing page's own eyebrow says "product preview", and the interactive mock on it is labelled as a mock rather than a build you can run.
Everything above is implemented and tested; what is not open is the checkout and the download.