Join Discord -- Website: thresher.sh
autoloom
Autoloom is a tiny self-learning autonomous agent wrapper built on top of tinyloom.
The core runtime is only about ~225 lines of code. The entire core library is ~900 lines of code and the entire plugins and all is about ~1500 lines of code.
It keeps its state in ~/.autoloom, uses plain files for sessions/tasks/memories, manages heartbeat runs with cron, and ships a minimal Textual TUI plus a small webhook server.
Safety
Autoloom inherits tinyloom's ability to run shell commands and edit files. It is not a sandbox by itself.
If you want isolation, run it inside a container or microVM. See the sandbox docs below.
If you run it on your root machine you risk destroying it, do not run it outside an isolated environment. You have been warned!
Install
End user (after the first PyPI release):
uv tool install autoloom # or pip install autoloom
autoloom setup
Developer (from source):
git clone <repo-url>
cd autoloom
uv sync --extra dev
End-user examples in this README use autoloom directly. Developers should prefix with uv run (e.g. uv run autoloom setup).
Quick start
autoloom setup
autoloom
autoloom "review pending work and update tasks"
autoloom heartbeat run
autoloom webhook serve
Update your heartbeat:
tinyloom "update my heartbeat.md with ... <whatever you want>"
Create a new scheduled task:
tinyloom "create a new cron job with <interval> and launch yourself on that cron job for a task of <whatever your task is>"
Files
Autoloom stores its data in:
~/.autoloom/SOUL.md~/.autoloom/heartbeat.md~/.autoloom/tasks/~/.autoloom/skills/~/.autoloom/knowledgegraph/memories/~/.autoloom/sessions/
Commands
autoloomopens the TUIautoloom "..."runs a persisted headless session and streams JSONL eventsautoloom setupwalks an interactive setup that configures agent identity, model provider/credentials/tuning, safety limits, compaction, heartbeat schedule, plugins, and webhook — the API key is written to~/.autoloom/.env, neverconfig.yamlautoloom heartbeat runexecutes one heartbeat sessionautoloom cron install|show|removemanages the heartbeat cron blockautoloom webhook serveruns the local-first webhook server
Docs
- Getting Started
- State and Heartbeats
- Self-Learning
- Plugins
- Webhooks
- Design Decisions
- Docker Sandbox Guide
- Podman Sandbox Guide
- microsandbox Guide
- Kata Containers Guide
- Docker Sandbox microVM Guide
Verification
uv run ruff check
uv run pytest
Case Study - tinyloom auto plugin development
I have a autoloom that is running ever 10 minutes in a vps. It's goal is to research popular trends and identify plugins for tinyloom or autoloom and then plan, implement, and test them.
it... just... works...
It's ran for 24 hours and it's built 15 plugins... all passing tests...
Now a lot of them are throw away... but this is with one line of "direction".
After starting up, the TUI detected that git was missing, so it automatically installed it before proceeding to clone repositories.
Within two heartbeat cycles, it cloned the repo, began planning plugins, and started building its own knowledge graph.
The system self learns, self directs, and has full autonomy.
Metadata
Release files for autoloom 0.1.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| autoloom-0.1.0.tar.gz | 1.9 MB | With provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| autoloom-0.1.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 1.9 MB
Release files / autoloom-0.1.0.tar.gz
| Download URL | autoloom-0.1.0.tar.gz |
|---|---|
| Size | 1.9 MB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
2bf9a6a3fadb620155d4a230287d46b096b262b5c4fce554f8efc3979d6c75fe
|
|
BLAKE2b-256 checksum How to use checksums |
886266a17cdea0806785cee201927c74a3fdbcc0a0e8aa6475b4ec38fd69b4e8
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.13
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Apr 18, 2026.
Transparency logRelease files / autoloom-0.1.0-py3-none-any.whl
| Download URL | autoloom-0.1.0-py3-none-any.whl |
|---|---|
| Size | 29.0 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
f8880ef4a12c6689558e78deeb7f032d38cb9862eb55cbe6fa55491421a2fea0
|
|
BLAKE2b-256 checksum How to use checksums |
07b057400f07634c010866a0adbdb8914d4a600d4bf2920d0e52281a83dc1fbd
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.13
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Apr 18, 2026.
Transparency logSecurity for autoloom 0.1.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for autoloom-0.1.0.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Apr 18, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.