agent6

• Runs the model's commands in a Linux sandbox with the file and network access you set.
• Saves conversations, tool activity, and Git checkpoints so you can inspect, resume, or fork a session from an earlier turn.
• Shows the task graph, token usage and compaction as they happen.
• Pinned instructions survive compaction; repository memory carries facts across runs.
• Verifies work with a configured or inferred command, checking the starting tree by default, and reports whether the result passed, failed, or remains unverified.
• Reviews the diff with a panel of models you configure, keeps each finding open until you resolve it, and refuses to merge over an open blocking finding.
• Runs parallel attempts in isolated clones with --parallel N or a list of models, then ranks the results for you to choose which to merge.
• Defines long-running workflows in editable TOML state machines, combining agent runs, tool calls, waits, and branches with offline tests, crash recovery, and replay from recorded results.
• Supports repository AGENTS.md instructions, SKILL.md packs, MCP servers, and background commands for development servers and watchers.
• Shows the repository in the browser: the commit graph, each commit's diff, a compare of two revisions, and the files at any revision with blame.
• Eight runtime dependencies, no telemetry unless you configure an export, and no automatic updates.

agent6 tui terminal interface

agent6 web browser interface for desktop or phone

Also available as a streaming CLI and through ACP editor integration.

Installation

Sandboxing supports Linux on x86_64 and aarch64; macOS runs without it, and Windows users should use WSL.

Install with uv or pipx, then connect a provider and select a model:

uv tool install agent6      # or pipx install agent6
agent6 connect              # configure a provider
agent6 model worker         # choose a model

Use Anthropic or any OpenAI-compatible endpoint, including OpenAI, OpenRouter, Ollama, vLLM, llama.cpp, and LM Studio. A provider entry can also use the Responses API (providers.<name>.api_format = "responses") or sign in at a configured OAuth issuer. For subscriptions, replace agent6 connect with agent6 connect chatgpt or agent6 connect claude; the latter uses your installed, signed-in Claude Code binary. agent6 completions installs tab completion for your shell.

Usage

A run edits your current checkout. Checkpoint commits go on a separate agent6/<id> branch; checkpointing leaves your current branch's history and index in place. For a separate checkout, use agent6 run --worktree "your task", which starts from committed HEAD without copying uncommitted changes or untracked dependencies.

cd your-repo
agent6 check                # check configuration and sandbox support
agent6 run "your task here"

Commands ask for approval by default. After the task finishes, enter another instruction or type /exit.

Inspect the latest session, then merge its recorded changes when ready:

agent6 sessions show        # status and verification result
agent6 sessions diff        # recorded changes
agent6 sessions merge       # merge into the run's starting branch

Other commands:

To give a finished run more work, use agent6 resume <id> --steer "next task".

Configuration

agent6 config show prints effective settings and where each value came from. Changes are global unless you add --repo for a repository override, for example:

agent6 config set --repo harness.verify_command '["uv", "run", "pytest"]'

The worker, planner, and reviewer can use different models and reasoning effort; unset planner and reviewer roles use the worker. Budgets limit spending, tokens for unpriced calls, and supported subscription usage.

Security

agent6 confines only the model's commands, in a jail on your host; the agent6 process stays trusted, holds your provider credentials, and connects to your configured providers. The repository stays at its real path, and the jail sees your system toolchains and ~/.local/bin read-only.

sandbox.isolation = "auto" picks the strongest level the host allows and warns when it falls back:

• full: commands cannot read your provider keys or the secrets file, .git is read-only to them (sandbox.protect_git = "auto", git.control = "agent6"), and they get a private network (sandbox.network = "auto").
• partial: commands cannot read your keys or the secrets file, but they share agent6's network and can write .git.
• none: no confinement.

Commands ask for approval by default (sandbox.run_commands = "ask"). agent6's own git never pushes, rewrites history or runs reset --hard, and no config key turns that on. MCP is off by default, and locally spawned servers use the command sandbox unless explicitly configured otherwise. agent6 check sandbox shows the effective file and command boundaries, network and approval settings, and live probe results.

In a container

• Docker gives partial by default and allows full with both --security-opt seccomp=unconfined and --security-opt apparmor=unconfined.
• Rootless Podman allows full with no flags (rootful Podman).

On Ubuntu, full under Docker also needs the host to allow the jail launcher to use unprivileged user namespaces (Installation).