Known limits

Moontors’ known limits are what it can’t do yet, or does differently from each agent in a terminal, gathered in one place: by platform, sign-in, folder, session, configuration, file, attachment and the phone.

Platforms

Moontors runs on macOS, Windows and Linux.
Until Moontors’ macOS builds are signed, with a Developer ID, the first open is blocked: allow it in System Settings, Privacy & Security, Open Anyway. Until Moontors’ Windows builds are signed, SmartScreen warns: choose More info, then Run anyway. On Windows 11, Smart App Control, when it's on, blocks unsigned apps, Moontors among them. It has no Run anyway: it’s Windows’ own setting, in Windows Security under App & browser control, where Windows says what it does. The Linux packages aren’t signed.
On Linux systems that block the user namespaces Chromium’s sandbox needs, such as Ubuntu 24.04, the AppImage runs with Chromium’s sandbox off, and says so once. The .deb keeps the sandbox on.
The AppImage needs FUSE. Without it, start it with --appimage-extract-and-run.
The AppImage updates by deleting itself, then moving the new version into its place. If the move fails, such as on a full disk, or the machine stops in between, no AppImage is left: download it again.
The .deb isn’t signed, so its update installs the download with no package signature check; only the download’s checksum, from the release, is checked. If the install is missing a package it needs, the update has apt fix that, which can add or remove packages without asking.
On Windows, Claude Code needs Git for Windows. Moontors uses git, 2.23 or newer, for worktree sessions and the Git view on every system.
Moontors’ own git commands never start git’s automatic maintenance (git gc), as its detached run can race a fetch or a commit beside it and lose a commit. Your own git, and your agents’, still run it as your settings say.
Until Moontors’ macOS builds are signed, macOS can’t update the app: Moontors offers the new version’s download instead. After each update, macOS asks again before Moontors can read its keychain items.
Spell checking is on macOS only, with macOS’s own checker. On Windows and Linux it’s off, as Chromium’s checker would download its dictionaries from Google.
On Windows, a terminal whose shell ends by itself, as when you type exit, leaves one console host process behind (Console Window Host, in Task Manager) until Moontors’ background service stops.

Gemini CLI’s browser sign-in: what a personal Google account does instead is in Signing in.
One sign-in per agent. Several accounts per agent come later.
Switching between two real accounts isn’t tested yet, as the recordings have one account per agent. When each agent takes a new account, under Accounts, is read from the agent’s own code: Claude Code taking a new Claude subscription in the middle of a turn, Codex taking a new API key in the middle of a turn, and a Codex session going on after a switch from ChatGPT to a key.
A switch an agent can’t take in the middle of a turn leaves a busy session on the old account until its turn ends.
Gemini CLI shows no tier or usage limits, Codex no organization, and Codex with an API key no usage limits.
With a Claude API-key sign-in, a project’s own settings can set ANTHROPIC_API_KEY in their env, and Claude then uses and bills that key instead of yours.
Claude Code keeps its device keys in your own ~/.claude folder, even for Moontors’ sessions.

Folders

Your home folder itself can’t be a session’s folder: not when you create the session, not with /add-dir, and not with /cd. A folder inside your home is fine, and so is a worktree session of a repository in your home, as its worktree is elsewhere.
A session made in your home folder before this rule doesn’t start its agent again, and can’t ask /btw. With Claude Code or Codex, move it with /cd. Gemini CLI has no /cd, so archive the session and create a new one in a folder inside your home.
With Gemini CLI, the folder you set as Gemini CLI’s own home counts as your home folder too.
With Claude Code or Codex, if you moved its folder with CLAUDE_CONFIG_DIR or CODEX_HOME and kept its name, .claude or .codex, the folder that holds it counts as your home folder too.
Some agent prompts suggest edits to your own configuration, such as Claude’s /init suggesting a personal instructions file in ~/.claude. These are ordinary edits, asked about first, except in Bypass mode and in Auto, where the agent’s own check decides: Claude Code’s auto mode or Codex’s review can let such an edit through without asking you.
Moontors doesn’t read your system’s own proxy settings (PAC); it uses the proxy variables of your shell.

Sessions

/branch works with Claude Code only. /cd works with Claude Code and Codex.
A /subtask that Moontors’ background service restarted during comes back to its session as stopped, with no answer, and the agent hears only that. Open the subtask’s own session to see how far it got.
Deleting a Gemini CLI session leaves your prompts in Gemini CLI’s own log for that folder, which holds every session’s prompts there.
After resuming, Claude Code and Codex use the model of the last turn, so switching back to the default model, with no turn after it, resumes on the old model.
After a launch on a named model, default in Codex and Gemini CLI means the vendor’s listed default, not your own.
Gemini CLI can’t fork, rewind, compact on request, answer /btw, or report its context.
If the browser can’t open, Gemini CLI’s sign-in can’t continue inside Moontors.

Configuration

claude.ai’s connectors, the plugins Claude Code syncs from your claude.ai account, and Codex’s apps aren’t tested against real accounts yet: the recordings have none of them. That covers their switches, the connectors’ tools, and a synced plugin’s switch.
A plugin your organization requires Claude Code to run shows on or off as the settings say, though Claude Code runs it either way.
Codex’s apps come with a ChatGPT sign-in only, and are listed only once a session has run.
What a plugin saves for itself starts fresh in Moontors: what it saved in your own agent isn’t there, and what it saves in Moontors stays in Moontors.
A Claude Code plugin’s secrets need macOS’s approval to read your keychain. Declined, or where they can’t be read, the session’s plugins start without them.
Codex can’t switch a plugin whose id has a dot, an app or an experimental feature whose id its configuration can’t hold, or one of a plugin’s MCP servers on its own.
A Codex plugin from a git marketplace can run at the marketplace’s newest version on its first launch in Moontors. Codex’s own plugin startup tasks run in Moontors’ home, and use the network.
A plugin you install in your own Codex arrives from the agent’s next start.
A ChatGPT-account plugin’s own on and off is the account’s, which Moontors doesn’t change, so switching it off turns off its parts instead. An app two plugins bring goes off with either.
If Codex can’t list its MCP servers, Moontors doesn’t start it, as it couldn’t keep off the ones you switched off.
A Gemini CLI MCP server that asks to sign in is turned off for the run, and asked in the middle of a turn, the turn ends there.
A Gemini CLI extension’s excluded tools and settings reach Gemini CLI, but aren’t listed.
A command Moontors couldn’t test, as no account it records with has it, says so on its agent’s commands page, in /help and in the / list.
A Codex MCP server whose name Codex’s settings can’t address can’t be switched on or off. While one is on, /recap and /btw are refused, as neither could keep it from starting.
With Claude Code, switching a skill off before a command of the same name appears still hides both, as Claude Code itself would.
Changes an agent makes to its own copied settings or instruction files (such as Gemini editing GEMINI.md) last only until the agent next starts. Make lasting changes in your own files.

Files

A save writes the file in place, as most editors do. While it’s being written, another program reading the file can briefly see the new start with the old rest.
A crash in the few milliseconds of a save, of Moontors or of the whole machine, can leave that file partly written. If Moontors can’t put the old contents back, the save says the file may be partly written.
Moontors can’t keep a file’s mixed line endings: saving makes them all one kind.
A path with a double quote can’t be named with @.

Git

The Git view doesn’t sign in for you: there’s no password or passphrase prompt, so sign-ins are set up in a terminal. Links to a commit or a branch are built only for github.com, gitlab.com and bitbucket.org.
A file’s Inline, Split, File and Blame read its whole text, which opens only as UTF-8 and at most 10 MB. Its History lists the newest 1,000 commits that changed it.
Staged changes have no blame.
A conflict is finished in the session’s terminal; the view has no conflict editor.
Not in the Git view: interactive rebase, moving or dropping older commits, undo and redo, and pull requests and issues.
A tag is never pushed: the view makes tags here, and deletes one here, or here and on a remote.
On Linux, Open in the text editor needs an app set for plain text files; without one it says “There’s no app set for plain text files. Show the file in its folder instead.”

Attachments

A file can be at most 5 MB.
A message’s files together are held to what the agent takes in one request, counted as it sends them: about 32 MB for Claude Code, with an image counted at most 5 MB once Claude Code fits it and a PDF as base64, and about 20 MB for Gemini CLI. Codex counts text files toward its limit on a message’s characters. These are the vendors’ own limits, not tested by Moontors.
The earlier messages’ files the agent sends again count too, so a long conversation with many files can still be refused by the agent’s service.
Claude Code and Gemini CLI take images, PDFs and text files. Codex takes images and text files, but no PDFs. No agent takes any other kind of file.
A text file is known by its extension, by a name such as Dockerfile, Makefile or LICENSE, or as a dotfile; any other goes as text when its first 8,000 bytes hold no binary data. An SVG image goes as text.
Images are PNG, JPEG, GIF and WebP, and all three agents take a GIF.
Files can’t go with a built-in command the agent runs itself, and with Gemini CLI, with a message starting with / or $, which it takes as its own command.
Once sent, Claude Code can end the turn on a PDF too large or password-protected, or leave a file out of the conversation from then on, and the transcript says so.
Only images and text files have a preview yet: a PDF, or a file of any other kind, shows its icon and name. A file over 5 MB has no preview.
Files added but not sent are let go when you switch to another session or quit.
Codex gets a text file’s contents in the message, under its name. Gemini CLI shows each file in the message as @ and its name.
An exported conversation leaves the files out.

The phone

The phone app’s own limits, such as what it leaves to the computer and how it reaches it, are in The phone.