Skip to main content

Coding Agents

Running many concurrent coding-agent sessions on research and development work

On my workstation, dozens of coding-agent sessions run at once (Claude Code, Codex, OMP, Kimi, and others), working on research projects and on the tools that support them. The tools on this page keep that workable. Each session's git, ssh, and uv commands pass through wrappers that enforce workstation rules. Sessions send each other mail and claim files before editing them. A reviewer from a different model family checks each change, and heavy work runs on another machine.

Most of these tools are optional to one another, and some, such as Weft and with-limits, are useful without any agent.

One change, from failing check to reviewed fix

A representative path from a failing check to a reviewed fix. These tools can be used separately; this sequence shows where they meet.

  1. Start a session

    A coding agent is asked to fix a failing check. The launcher gives the session an identity and puts the command guards first on PATH.

    Local agent

    agent-launcher

    Starts the native agent CLI. Claude sessions also pass through claude-wrapper.

    Coordination

    No action in this step

    Remote host

    No action in this step

    Handoff Shell → agent: session identity and guarded PATH

  2. Claim the files, then edit

    Before changing the code, the agent checks who is working on it. If another session owns an overlapping claim, they coordinate before proceeding.

    Local agent

    Authoring agent

    Requests the paths it needs, then makes the change.

    Coordination

    agent-loom

    Records the file claim and carries mail between sessions.

    Remote host

    No action in this step

    Handoff Agent ↔ agent-loom: file claim or ownership conflict. Claims coordinate editors; they do not lock the filesystem.

  3. Check commands before they run

    The agent asks to inspect the diff and run checks. A connected pre-tool hook checks the shell request; PATH guards intercept supported executables when the shell runs them.

    Local agent

    agent-tool-policy · agent-command-guards

    Apply workstation conventions. with-limits contains heavy local commands.

    Coordination

    No action in this step

    Remote host

    No action in this step

    Handoff Agent → shell: checked command request. A denial returns guidance to the agent instead of executing the command.

  4. Send heavy checks to another machine

    The agent uses a leased remote workspace for a build or test run. The source snapshot moves to the remote host; the laptop session stays local.

    Local agent

    Authoring agent

    Chooses the project’s check command and inspects its output.

    Coordination

    No action in this step

    Remote host

    agent-host-sync

    Syncs the source to a leased workspace and runs the check there.

    Handoff Local → remote: source snapshot and command. Remote → local: check output and exit status.

  5. Review an exact revision

    A reviewer from a different model family examines the change and its evidence. The review records the version it actually saw.

    Local agent

    agent-review

    Submits a revision and supporting evidence for independent review.

    Coordination

    No action in this step

    Remote host

    Weft · agent-execution

    Run the reviewer as a remote job and retain its output.

    Handoff Local → remote: review request, revision, and evidence. Remote → local: findings tied to that revision.

  6. Resolve findings and release the claim

    The author addresses the findings, reruns affected checks, and obtains review of the changed version as needed. When editing is finished, the file claim is released.

    Local agent

    Authoring agent

    Verifies fixes. An earlier review is not automatically evidence about later edits.

    Coordination

    agent-loom

    Releases the paths so another session can claim them.

    Remote host

    Independent reviewer

    Reviews the updated revision when another review is needed.

    Handoff Findings → edits → checks → review, as needed. Agent → agent-loom: claim release.

Starting an agent

Each layer sets up the next and then hands over its process (exec), so the agent runs as a direct child of the shell. Ctrl-C, exit status, and terminal handling behave as if the agent had been started directly, and no wrapper process stays behind.

  1. Shell command

    claude, codex, or a model name such as fable or kimi. A model name starts whichever agent is configured to run that model.

  2. agent-launcher

    Puts the agent-command-guards wrappers for git, ssh, uv, and other commands ahead of the real ones on PATH, gives the session an ID that survives resuming, and finds the session to resume when you name one.

  3. claude-wrapper Claude only

    Applies a profile, a saved choice of model, provider, and extra arguments, and sets up notifications and the exit receipt.

  4. Native agent CLI

    Claude Code, Codex, OMP, Kimi, opencode, or agy.

While the agent runs

  • agent-tool-policy

    Sees each shell command the agent asks to run and refuses ones that break local rules, such as a git write in a Jujutsu repository.

  • agent-command-guards

    Wrappers for git, jj, ssh, scp, rsync, and uv. They apply the same rules to commands that scripts and build tools run, which the hook never sees.

  • with-limits

    Caps the memory and CPU of uv run and other heavy commands, so one agent's test run cannot exhaust the memory every other session needs.

A command meets three different checks

The hook checks the request before execution. A PATH guard intercepts a particular executable. A resource limiter stays with the running process tree. Select a command to follow these boundaries.

Illustrative traces, not a live policy checker. No command is executed.

cat README.md

A shell request in a session with the pre-tool hook and command guards installed.

  1. Pre-tool check

    agent-tool-policy

    No objection

    No workstation rule blocks this read. The request still goes through the agent’s native permission system.

  2. Executable lookup

    PATH

    Ordinary executable

    There is no cat wrapper among the command guards. The shell resolves cat normally.

  3. Resource limits

    with-limits

    Not added

    This command does not trigger the automatic uv run resource guard.

Result If native permissions allow it, cat reads README.md and returns its contents.

The hook applies workstation conventions. It does not replace the agent’s sandbox or approval system.

git reset --hard

A Jujutsu repository, with the pre-tool hook connected and no explicit policy override.

  1. Pre-tool check

    agent-tool-policy

    Denied

    The hook recognizes a Git mutation in a jj repository and returns a denial before the shell starts.

  2. Executable lookup

    agent-command-guards

    Not reached

    The shell does not run, so this request never reaches the git wrapper.

  3. Resource limits

    with-limits

    Not reached

    There is no child command to supervise.

Result The request stops at the hook. No reset is performed.

Without the hook, a git invocation that resolves to the PATH guard is still refused for this command. The wrapper checks the executable boundary, including calls made inside scripts. Calling the real binary by absolute path bypasses that wrapper.

uv run python analysis.py

A Kimi session with the pre-tool hook and the uv PATH guard. Assume analysis.py has cleared any required research review and other checks.

  1. Pre-tool check

    agent-tool-policy

    Checked; no rewrite

    Kimi’s hook can check the request but cannot replace the command. Resource wrapping is left to the PATH guard.

  2. Executable lookup

    agent-command-guards

    Intercepted

    The shell finds the uv wrapper before the real uv. For uv run, the wrapper starts the workload through with-limits.

  3. Resource limits

    with-limits

    Supervised

    The real uv and its descendants run under a process-tree memory limit. with-limits monitors the workload and terminates its process group if the limit is reached.

Result The workload runs under resource supervision, subject to permissions and available resources. Its result still needs verification.

Hosts that support command rewriting can apply the limit in the pre-tool hook instead, including for an absolute uv path that bypasses PATH lookup. A resource limit contains resource use; it is not a security sandbox.

Behavior described in the hook documentation, command-guard documentation, and with-limits documentation.

How the pieces fit

Each layer sits above the layers it depends on. Within a layer, tools are grouped as general development tools, tools built for agent sessions, and research tools. Tools marked unpublished have no public repository; the others link to theirs.

For the notebook conventions that connect research questions, experiments, and claims, see Research Notebook.

Dashboards

What I look at.

General development

  • Weft Status

    A macOS menu bar item and floating panel showing Weft's running jobs and rented cloud machines.

Coding agents

  • Agent Dispatch unpublished

    A macOS dashboard of agent sessions: which ones are working in which project, what each did recently, and the plans and reviews in progress.

  • Review Explorer unpublished

    A local web app for browsing past agent-review reviews: what was reviewed, by which model, and what it found.

  • workflow-state unpublished

    The shared data layer and activity feed behind Agent Dispatch and Research Rounds.

Research

  • Research Rounds unpublished

    A macOS app for making rounds of my research projects. One window shows each active project's plans, experiments, and the agent sessions working on it.

Sessions and commands

How each agent starts, and what constrains the commands it runs.

General development

  • with-limits

    Runs a command with limits on memory (counting every process it starts), sustained CPU, and running time, and can wait to start until the machine has memory to spare. Agents reach it through the guards and the pre-tool hook; people can run it from any shell.

Coding agents

  • agent-launcher

    Starts Claude Code, Codex, OMP, Kimi, opencode, and agy with the agent-command-guards wrappers ahead of the real commands. Typing a model name, such as fable, starts whichever agent runs that model. A session can be resumed by its name or by a phrase from its conversation, carried over to a different agent (from Claude Code to Codex, say), or recovered after a crash. When an agent exits, the next shell prompt prints an exit receipt: the session's name and the command that resumes it.

  • claude-wrapper unpublished

    Sits between the launcher and Claude Code. A profile saves a model, a provider, and extra arguments under one name. Besides the providers Claude Code configures itself, it sets up the endpoint and API key for OpenRouter and Moonshot. It sends desktop and phone notifications when a session finishes or needs input, serves a page listing live sessions, and prints the exit receipt for Claude Code sessions.

  • agent-command-guards

    Wrappers that run ahead of the real git, jj, ssh, scp, rsync, and uv, so their rules apply however a command was started, including from scripts. In a Jujutsu repository, git commit and git worktree become their jj equivalents, and other git writes are refused because they would confuse jj. jj refuses commands that would open a text editor, which an agent cannot operate and which would hang the session. For hosts that need a VPN, ssh, scp, and rsync check the host is reachable first, and if it is not, ask me once and remember a refusal, so later attempts fail at once instead of timing out. uv run runs under with-limits.

  • agent-tool-policy

    A hook that Claude Code, Codex, Kimi, and opencode call before running each shell command an agent requests. It refuses commands that break rules an agent's own permission system cannot know about: changing Git state in a Jujutsu repository, bypassing a project's build command, or running a new research script before it has been reviewed. It also wraps uv run in with-limits.

Review

Independent checks on changes and research claims.

Coding agents

  • agent-review unpublished

    Sends a commit, a document, or a research result to a reviewer from a different model family than the one that wrote it, so code Claude wrote might be reviewed by Codex. Each review records the exact version examined, the evidence the reviewer was given, and its findings, which shows when a later edit has made a review out of date. Reviews run as Weft jobs on another machine.

Research

  • research-spec unpublished

    A block in each experiment's lab-notebook record declaring which data the experiment uses and which scripts and code revision produced its results, in a form a tool can check.

  • code-provenance unpublished

    Checks whether two sets of numerical results were produced by equivalent code and dependencies.

Execution

Heavy work, on another machine.

General development

  • Weft

    Runs jobs such as experiments and test suites on whichever machine fits: a workstation, a shared server, or a rented cloud GPU. It copies the source tree to that machine and keeps each job's logs and outputs.

Coding agents

  • agent-offload

    Sends a coding task to an agent on another machine. The agent edits a snapshot of the source tree, and its work comes back as a diff to verify and apply.

  • agent-execution

    Runs a coding agent as a Weft job with restricted permissions, and records what the agent was given and what it did. agent-review and agent-offload both use it.

  • agent-host-sync unpublished

    Installs these tools on the remote machine, and lends agents reusable workspaces there for builds and test runs.

Research

  • research-site unpublished

    Hands a research project between the laptop and a remote machine, so only one of them writes to it at a time and an experiment plan can run where there is spare CPU.

Coordination and records

Used by every layer above.

General development

  • issue-ledger

    A local issue tracker where agents file a report when one of my tools misbehaves. Repeat reports of the same fault become one issue with a count, and an issue closes only once its fix is installed everywhere the fault can occur.

Coding agents

  • agent-loom

    Lets separate sessions coordinate. They send each other mail, claim files before editing them so two sessions do not edit the same file at once, and record who owes whom a decision or a fix.

  • agent-lore

    A knowledge base that agent sessions write. A session records a fact it had to work out, and later sessions in any project find it by searching.

Published projects

agent-command-guards

Language: Python
Updated: Aug 2026

PATH-level command wrappers that apply workstation policy to ssh, scp, rsync, git, and uv inside coding-agent sessions, including Jujutsu interoperability and a memory ceiling for uv run.

ⓘ
Repository

agent-execution

Language: Python
Updated: Oct 2026

Runs a coding agent as a job under an explicit tool policy (no tools, read-only, or confined writes), with process containment, cost limits, and a record of what the agent was given and what it did. Optionally submits the work as a Weft job.

ⓘ
Repository

agent-launcher

Language: Python
Updated: Oct 2026

Launchers for Claude Code, Codex, Kimi, opencode, OMP, and agy that start each agent under agent-command-guards, with stable session identity, model-first commands, resume by name or transcript text, cross-harness continuation, crash recovery, and exit receipts.

ⓘ
Repository

agent-loom

Language: TypeScript
Updated: Aug 2026

Local coordination for coding-agent sessions across projects and harnesses: durable mail, path claims, work leases, and obligations that record who owes whom a decision, a fix, or a finished job. Formerly agent-mail.

ⓘ
Repository

agent-lore

Language: TypeScript
Updated: Aug 2026

A machine-local, agent-writable knowledge base where coding-agent sessions record and search hard-won facts about tools and workflows, with git provenance, talk pages, and a session ledger.

ⓘ
Repository

agent-offload

Language: Python
Updated: Oct 2026

Sends a coding task to an agent on another machine. The agent edits a snapshot of the source tree as a Weft job, and its work comes back as a diff to verify and apply.

ⓘ
Repository

agent-tool-policy

Language: Python
Updated: Aug 2026

A PreToolUse hook for Claude Code, Codex, Kimi, and opencode that decides Bash tool requests against local development and research conventions, denying what a general permission system cannot infer.

ⓘ
Repository

issue-ledger

Language: Go
Updated: Sep 2026

A local issue ledger for locally developed tools: file defects against any component, deduplicated by fingerprint, with occurrence counts and recurrence tracking after close.

ⓘ
Repository

Weft

Language: Go
Updated: Aug 2026
Screenshot of Weft

A terminal-native control plane for placing and running GPU research jobs across workstations, shared servers, and cloud rentals.

ⓘ
Repository

Weft Status

Language: Swift
Updated: Aug 2026
Screenshot of Weft Status

A macOS menu bar companion and floating HUD that displays current Weft job, rental, and autopilot activity.

ⓘ
Repository

with-limits

Language: Rust
Created: 2026

Runs a command with portable process-tree limits on memory, sustained CPU use, and wall-clock runtime.

ⓘ 
with-limits --memory 8GiB --cpu 2 --time 30m -- python train.py
# more...
Repository