agent6 0.0.15

A coding agent that jails model commands and uses editable state machines for long-running tasks.

agent6

A coding agent that jails model commands and uses editable state machines for long-running tasks.

The model can write code and ask to run commands, but those commands go through a jail with restricted filesystem and network access. Long-running workflows can be written, reviewed, edited, resumed, and replayed as declarative state machines instead of being left to an open-ended agent loop.

Full documentation: agent6.dev

Features

• Sandboxed execution for every LLM-chosen child process, jailed individually (Landlock + seccomp + pivot_root), with .git rebound read-only and egress confined to your provider
• Works with Anthropic and any OpenAI-compatible endpoint (OpenAI, OpenRouter, Ollama, vLLM, llama.cpp, LM Studio)
• Per-step git commits, snapshot-resumable runs, per-turn forkable checkpoints, USD and token budgets with hard stops
• Plan, run, review, and ask modes; a live terminal dashboard; persistent transcripts and a searchable run history
• State machines (agent6 machine) for long-running automated tasks: LLM-drafted, operator-reviewed, journaled, and replayable
• Small, fixed LLM tool surface; the only extension point is operator-configured MCP servers, off by default
• Eight runtime dependencies, no telemetry, no auto-update

Install

From PyPI with uv or pipx:

uv tool install agent6        # or: pipx install agent6

agent6 needs Linux for the sandbox (kernel 6.7+ for TCP rules), Python 3.12+, and an API key for at least one provider. macOS and Windows run unsandboxed behind a warning. See installation for the full requirements and building from source.

Quick start

# Connect a provider once (stored in ~/.config/agent6/, key in a 0600 secrets file).
agent6 connect                # interactive: pick provider, paste API key
agent6 model worker anthropic claude-sonnet-4-6

# Run the agent on a task. agent6 infers a verify command if you haven't set one.
cd your-repo
agent6 run "add a --json output mode to the CLI"

# Audit the effective config, pre-flight the sandbox, resume or fork a run.
agent6 config show
agent6 check
agent6 resume <run-id>
agent6 fork <run-id> --at-turn 7

That is the whole loop. See getting started for the full command tour, configuration for every field, and the security model for what the sandbox enforces.

Config is layered: built-in secure defaults, then the global ~/.config/agent6/config.toml, then the per-repo config (out of the workspace, per-machine, not committed), then an explicit --config FILE. Every field has a default; security-sensitive fields default to the safe value (agent_network = "providers", tool_network = "block", run_commands = "ask", protect_git = true, git.allow_* = false), and git_ops.py refuses push, --force, and history rewrites unconditionally.

Benchmarks

Reproducible harnesses live under bench/: real-world SWE-bench-Lite-style tasks, head-to-head runs against Claude Code / opencode / aider, machine create validation, and a perf-optimization harness. See each directory's README for recorded numbers (single runs, no variance measured; re-run before quoting).

Contributing

Read AGENTS.md first. The repo's verify command decides whether a change is landable:

uv run ruff check && uv run ruff format --check && \
  uv run pyright && uv run tach check && uv run pytest

Changes under sandbox/, tools/, git_ops.py, providers/, or graph/curator must include a security review note in the commit message.

License

Apache-2.0.