{"slug": "show-hn-5dive-run-a-company-of-claude-code-codex-agents-written-in-bash", "title": "Show HN: 5dive – Run a Company of Claude Code/Codex Agents (Written in Bash)", "summary": "5dive, a new open-source tool written in Bash, lets users run a company of AI coding agents (Claude, Codex, and others) on their own Linux server, with each agent as a separate Linux user managed by systemd and coordinated through a shared SQLite task queue. The tool, released under MIT license, aims to minimize human intervention by having agents escalate only when a decision is needed, and it has already been used to ship releases of 5dive.ai itself.", "body_md": "**run a company of AI agents on a server you own**\n\n**English** ｜ [简体中文](/5dive-ai/5dive/blob/main/README.zh-CN.md)\n\n[Quickstart](#quickstart) ·\n[Why 5dive](#why-5dive) ·\n[Zero-human proof](/5dive-ai/5dive/blob/main/docs/zero-human.md) ·\n[Use from your AI agent](#for-your-ai-agent) ·\n[Security](#security--isolation) ·\n[Full CLI docs](https://5dive.ai/docs/5dive-cli?utm_source=github&utm_medium=owned&utm_campaign=5dive-readme) ·\n[Managed VM](https://5dive.ai?utm_source=github&utm_medium=owned&utm_campaign=5dive-readme)\n\n**A company of AI agents, and the orchestrator is just bash.** No framework, no protocol, no broker: each agent is its own Linux user running an official coding CLI (claude, codex, a few others) as a systemd service, coordinating through one bash CLI they all call. Isolation is unix users, supervision is systemd, logs are journald. **I used the OS instead of building a platform.**\n\nThey take work off a shared SQLite task queue, hand it to each other while you sleep, and ping your phone over Telegram only when a human has to decide. Works with every major agent CLI.\n\nWe run our own company on this.The agents that build 5dive.ai cut this repo's releases, and only ask a human when they're stuck. The badge up top is that claim, measured: releases shipped versus decisions escalated to a human. Same binary you're installing. MIT, no open-core. Run it yourself, or skip the ops with the[managed VM].\n\n**Run your whole company in plain language**, from the AI agent you already have. Add the [ 5dive-cli skill](#for-your-ai-agent): create agents, assign work, read the org chart.\n\n[One-line setup ↓](#for-your-ai-agent)\n\n```\n# 1. install\ncurl -fsSL https://install.5dive.ai | sudo bash\n\n# 2. create your first agent, the wizard wires Telegram too:\n#    paste a bot token (BotFather gives you one), send the bot /start,\n#    and it pairs itself. No codes.\nsudo 5dive init\n```\n\nScripting it instead (CI, provisioning)? The non-interactive path needs one extra step, the bot replies to your first DM with a pairing code:\n\n```\nsudo 5dive agent create my-agent --type=claude --channels=telegram --telegram-token=<token>\nsudo 5dive agent pair   my-agent --code=<pairing-code>\n```\n\n**Requirements:** a Linux box with `systemd`\n\nand your own agent-CLI subscription or API key (Claude Pro/Max, OpenAI, …), no account with us.\n\n“Fair question. The installer only apt-installs deps and drops the CLI + systemd units (every file it fetches is listed at the top of`curl | sudo bash`\n\n, and agents with`sudo`\n\n?”[). Each agent is then its own Linux user, and you choose its blast radius, a]`install.sh`\n\n`sandboxed`\n\nagent gets its own home, no sudo, and resource limits. Details:[Security & isolation ↓].\n\n**They escalate, you decide.** Agents work autonomously and only ping your phone, as tap-to-answer buttons, when a human has to make the call: spend, publishing, anything destructive.\n\n**A company that runs itself.** Named agents on one host, reporting up an org chart, handing each other work off a shared backlog.\n\n**A subscription that's yours.** Official CLIs on your own Pro/Max or keys. No middleman, no OAuth proxy.\n\n**Runs as a service, not a session.** Agents stay alive when you close the terminal. Message them from Telegram any time.\n\n**Every major agent CLI.** `claude`\n\n, `codex`\n\n, `antigravity`\n\n, `grok`\n\n, `openclaw`\n\n, `hermes`\n\n, `opencode`\n\n, `pi`\n\n, all under one team.\n\n**Safe by default.** Each agent is its own Linux user under one of three isolation tiers. MIT, no open-core split.\n\nEach agent is its own Linux user running an official agentic AI CLI session (`claude`\n\n, `codex`\n\n, `antigravity`\n\n, `grok`\n\n, …) as a systemd service. Multiple agents can share the same CLI binary and subscription. Agents reach each other by invoking the same `5dive`\n\nCLI, that *is* the bus. Channels like Telegram attach per agent.\n\nNo broker, no protocol, no framework. Shared filesystem, shared CLI.\n\n| Type | Model family | Auth | Channels |\n|---|---|---|---|\n`claude` |\nAnthropic Claude, or any Anthropic-compatible endpoint | OAuth / API key / `--provider` |\nTelegram, Discord |\n`codex` |\nOpenAI Codex | OAuth / API key | Telegram |\n`antigravity` |\nGoogle Antigravity | Google OAuth | Telegram |\n`grok` |\nxAI Grok | OAuth (xAI) / API key | Telegram |\n`hermes` |\nthird-party multi-provider harness | API key | Telegram, Discord |\n`openclaw` |\nthird-party multi-provider harness | API key | Telegram, Discord |\n`opencode` |\nOpenCode | API key | Telegram |\n`pi` |\nthird-party multi-provider harness | API key / `--provider` |\nTelegram |\n\n**About **`hermes`\n\n/ `openclaw`\n\n(third-party multi-provider harnesses)\n\n`hermes`\n\n/ `openclaw`\n\n(third-party multi-provider harnesses)`hermes`\n\nand `openclaw`\n\nare community-built harnesses that can route to many providers (OpenRouter, Anthropic, Google, Moonshot, DeepSeek, Z.ai, etc.). As of April 4, 2026, Anthropic no longer permits routing consumer Claude Pro/Max OAuth through third-party harnesses. For that work, use the official `claude`\n\ntype with your own API key. Background: [We Ditched OpenClaw for Claude →](https://blog.5dive.ai/blog/we-ditched-openclaw-for-claude/?utm_source=github&utm_medium=owned&utm_campaign=5dive-readme).\n\nThe `claude`\n\ntype can also run the official Claude Code harness against a third-party Anthropic-compatible endpoint, bring your own key:\n\n```\nsudo 5dive agent create cheap-coder --type=claude --provider=deepseek --api-key=<key> --auth-profile=deepseek\n# providers: openrouter (any model), deepseek (DeepSeek), moonshot (Kimi), zai (GLM)\n# claude BYO requires --auth-profile=<name> (the account the key is saved under; reuse it to share the key across agents)\n\n# Pick the model too. --model overrides the primary tiers with any slug the\n# provider serves (OpenRouter translates every family); the background model\n# stays on the provider's cheap default. Omit it to use the per-provider default.\nsudo 5dive agent create glm-coder --type=claude --provider=openrouter --api-key=<key> --auth-profile=openrouter --model=z-ai/glm-5.2\n```\n\nSwitch the model on a running agent (persists across restarts):\n\n```\nsudo 5dive agent config glm-coder set model=z-ai/glm-5.2\n```\n\nIn-session, Claude Code's built-in `/model <slug>`\n\nalso accepts any custom slug live (session-scoped).\n\nIf you already use Claude Code / Codex / Antigravity / Grok / opencode, paste this prompt. Your agent installs 5dive, learns the skill, then keeps managing agents through chat:\n\n```\nInstall 5dive on this Linux host so I can use you to manage 5dive agents.\n\n1. Run the installer (idempotent, safe to rerun):\n   curl -fsSL https://install.5dive.ai | sudo bash\n2. Confirm: `5dive --version` prints a version string (e.g. \"5dive 0.5.x\").\n3. Install the 5dive-cli skill. Replace <runtime> with one of\n   claude-code, codex, antigravity, grok, hermes-agent, openclaw, opencode:\n   npx -y skills add https://github.com/5dive-ai/skills --skill 5dive-cli --agent <runtime> --yes\n4. Tell me to restart so the skill loads, then ask which agent to create first.\n```\n\n**Installing onto a remote VM over SSH?** Same prompt, prefix the install line with `ssh -t <user@host>`\n\n. Install the skill on the laptop where you're issuing `ssh`\n\nfrom, not the remote. Use `ssh -t`\n\nfor anything needing a TTY (e.g. `5dive agent auth login`\n\n).\n\nEach agent is one Linux user under one of three isolation tiers:\n\n| Tier | Access |\n|---|---|\n`standard` (default) |\nshared read, limited write |\n`admin` |\nfull host; auto-granted to the first agent on a fresh box |\n`sandboxed` |\nown home only, no sudo, systemd resource limits |\n\n```\nsudo 5dive agent create my-agent --type=claude --isolation=sandboxed\n```\n\n**No middlemen.** 5dive runs on your server. Auth tokens go to model providers directly, never to us. No telemetry, no error reporting, no usage data leaves the box. Long form: [your auth tokens don't touch us →](https://blog.5dive.ai/blog/your-auth-tokens-dont-touch-us/?utm_source=github&utm_medium=owned&utm_campaign=5dive-readme).\n\n**More team ops: accounts, a shared bot, commands, characters**\n\nDon't assemble a team agent by agent. Import a whole org in one call:\n\n``` python\nsudo 5dive team import solo-founder\n# spins up the agents, their roles, the org chart, and seeds their starting backlog\n```\n\nBrowse templates with `5dive team ls`\n\n, or define your own in a `5dive.yaml`\n\nand\n`5dive up`\n\n. A template is a company you can fork: engineering pod, research desk,\ncontent engine, support crew. Clone it, point it at your keys and bots, done.\n\nAgents on a box share a task queue (sqlite, no server). File work, assign it, and let the heartbeat wake the assignee only when there's something to do. Recurring templates materialize on a cron schedule:\n\n```\n5dive task add \"triage overnight CI failures\" --assignee=ops --recurring=\"0 7 * * *\"\nsudo 5dive heartbeat on ops --every=30m\n```\n\nWhen an agent hits something only a human can decide, it parks the task on you:\n\n```\n5dive task need DIVE-42 --type=approval --ask=\"Ship pricing v2?\" --options=\"ship|hold\" --recommend=ship\n```\n\nThat arrives on your Telegram as tap-to-answer buttons. Tap one, and the owning agent is unblocked and resumes. `5dive task inbox`\n\nlists everything waiting on a human, and `5dive org`\n\nkeeps a reporting chart so you can see who works for whom.\n\nOne sign-in, many agents:\n\n```\nsudo 5dive account add   work\nsudo 5dive account login work --type=claude\nsudo 5dive agent create agent-a --type=claude --auth-profile=work\nsudo 5dive agent create agent-b --type=claude --auth-profile=work\n```\n\nRename or rotate the account, every bound agent rebinds automatically. `5dive account usage`\n\nshows each account's rate-limit headroom.\n\nPer-agent bots are optional. Point one shared bot at a Telegram group (topics enabled) and every agent gets its own forum topic:\n\n```\nsudo 5dive agent team-bot shared --group=<chat_id> --agents=coder,writer,pm --token=<bot-token>\n```\n\nNew agents auto-attach with their own topic (opt out per agent with `--no-team-bot`\n\n). `team-bot discover`\n\nfinds the group id for you, and `team-bot intercom`\n\nmirrors inter-agent chatter into a dedicated topic so you can watch the team coordinate.\n\nA template gives you roles. A **character pack** gives you a personality, a ready-made persona with its own voice, model, effort, and bundled skills:\n\n```\nsudo 5dive agent marketplace ls            # browse the character-pack registry\nsudo 5dive agent import olivia --as=ceo    # spin up a named agent from a pack\n```\n\n`--as`\n\nis the agent's name on your box; the pack supplies the persona, model, and skills. Add `--channels=telegram`\n\nto wire a bot at import time. Packs live in the [ 5dive-ai/character-packs](https://github.com/5dive-ai/character-packs) registry, and a\n\n`5dive.yaml`\n\ncan reference one with `pack: <slug>`\n\n.\n\n```\n5dive agent list / create / start / stop / restart / rm\n5dive agent send <name> <text>\n5dive agent ask  <name> <text> [--timeout=120]\n5dive agent logs <name> [--follow]\n5dive agent config <name> set model=<id> / effort=<low|medium|high|xhigh|max>\n5dive agent <name> tui\n\n5dive task      add / ls / assign / start / done / need / inbox / answer\n5dive heartbeat on / off / ls / tick     # wake agents that have queued work\n5dive org       set / tree               # who reports to whom\n\n5dive account   add / login / list / show / usage / rename / remove\n5dive auth      set / login / status     # lower-level; account is the human path\n5dive skill     add / list / remove\n5dive doctor [--repair] [--json]\n5dive watch                              # htop-style live view\n5dive up / down / ps / export            # declarative agents via 5dive.yaml\n5dive team import <slug>                 # provision a whole team template in one call\n5dive push <task> [--branch=<b>]         # delegated git push via your own GitHub App (see below)\n5dive self-update                        # update CLI + plugins, then restart agents\n```\n\nFull flag reference: `5dive --help`\n\n(or `5dive <verb> --help`\n\n), or the searchable docs at [5dive.ai/docs/5dive-cli](https://5dive.ai/docs/5dive-cli). Machine-readable output on any command via `--json`\n\n.\n\n**Self-hosting, hardening & other install paths**\n\n5dive runs agents with shell access. Standard hygiene applies:\n\n- patch the OS (\n`unattended-upgrades`\n\n) - SSH key-only, no root login\n- firewall default-deny\n- per-agent isolation tiers\n- Telegram bot allowlists\n\nBaselines: [devsec.os_hardening](https://github.com/dev-sec/ansible-collection-hardening) · [Lynis](https://github.com/CISOfy/lynis) · [fail2ban](https://www.fail2ban.org/). Or skip the checklist; [5dive.ai](https://5dive.ai?utm_source=github&utm_medium=owned&utm_campaign=5dive-readme) handles it.\n\nAgents can read and edit a repo, but shouldn't hold a Git credential they could exfiltrate. `5dive push`\n\ngives a team ONE scoped push identity, your own GitHub App, that the control plane holds and lends for a single gated push, never handing the agent a token.\n\n```\nsudo 5dive push setup                              # scaffold + verify the credential\n5dive push <task> --branch=<feature-branch>        # push, once the task's gate clears\n```\n\nHow it works, and why it's safe to give an agent:\n\n**Your GitHub App, your key.** You create a GitHub App in your org (`contents:write`\n\n), install it on the repos you ship, and drop its key at`/etc/5dive/connectors/github-app.{pem,env}`\n\n(root-600). The code is generic, point it at any App. No per-agent seats, no long-lived PAT.**Gate-gated.** A push runs only after the task carries a ship gate cleared by a human or its designated routed reviewer. The root path verifies the signed closure; no gate, open/rejected gate, auto-clear, unrelated-agent answer, or tampered record → refused.**One branch only.** It pushes exactly the branch named in the task (`--branch`\n\nor a`Branch: <name>`\n\nline in the body); protected branches (`main`\n\n/`master`\n\n) are refused.**Author stays yours (optional).** Configure a committer (`GITHUB_APP_COMMIT_AUTHOR`\n\n) and a fail-closed scan requires every pushed commit to match it, so provider team-checks (e.g. Vercel) stay green; leave it unset for no restriction. The App is transport auth only, decoupled from commit authorship.**The agent never holds a token.** Gate re-verify, author scan, a repo-scoped short-lived token mint, the push, and token discard all happen atomically in a root-only helper. The token is scoped to just the one target repo, so even a captured token can't reach the rest of your org. Every push is audit-logged.\n\nFull walkthrough (create the App, install it, drop the credential, wire the grant, first push): ** docs/delegated-push.md**.\n\n** Docker.** Kick the tires without a host install:\n\n```\ndocker build -f docker/Dockerfile -t 5dive .\ndocker run -d --name 5dive-demo --privileged 5dive\ndocker exec -it 5dive-demo bash\n```\n\n**Offline / air-gapped.** `install.sh`\n\nreads from `$REPO`\n\n(default GitHub raw). Override with `REPO=file:///path/to/local/tree`\n\nand pre-install apt deps. The fetched files are listed at the top of `install.sh`\n\n.\n\n**Updating.** 5dive doesn't auto-update, you stay in control of when code changes land:\n\n```\nsudo 5dive self-update\n```\n\nThis refreshes the CLI, hooks, skills, and plugins, then restarts each running agent so the new versions load. Want it on a schedule?\n\n```\n0 4 * * * /usr/local/bin/5dive self-update >/dev/null 2>&1\n```\n\n**Context rot.** Long sessions degrade, the daily `self-update`\n\nabove also restarts agents, giving each a fresh session. Claude-runtime agents keep project memory under `~/.claude/projects/<dir>/memory/`\n\nacross restarts. Session resets, knowledge stays.\n\n- Linux with\n`systemd`\n\n(Ubuntu 22.04+ recommended) - root for install (installer apt-installs\n`jq`\n\n,`tmux`\n\n, and other deps)\n\nNo systemd / no root / not Linux? Use the Docker image above.\n\nUse GitHub's private reporting: ** Report a vulnerability →**. Don't open a public issue. We acknowledge within 3 business days. Scope is the\n\n`5dive`\n\nCLI, `install.sh`\n\n, shipped systemd units, and `5dive-ai/*`\n\nworkflows; upstream coding CLIs (`claude`\n\n, `codex`\n\n, ...) and apt/Node go to their respective maintainers.**JSON / machine-readable output**\n\nEvery command accepts `--json`\n\n. Output is `{ok:true,data:...}`\n\non success or `{ok:false,error:{code,class,message}}`\n\non failure. Exit code matches `error.code`\n\nso shell pipelines branch without parsing. Progress lines stay on stderr; stdout is always valid JSON.\n\n```\n{ \"ok\": true,  \"data\": [ {\"name\": \"main\", \"type\": \"claude\", \"active\": \"active\"} ] }\n{ \"ok\": false, \"error\": { \"code\": 4, \"class\": \"not_found\", \"message\": \"no agent named 'foo'\" } }\n```\n\n**Prefer a managed dashboard instead of ssh?**\n\nThe CLI is the OSS surface. Every verb here, every agent, every host, all driven from `/usr/local/bin/5dive`\n\n.\n\nIf you'd rather click than `ssh`\n\n, [5dive.ai](https://5dive.ai?utm_source=github&utm_medium=owned&utm_campaign=5dive-readme) is the managed version: same CLI under the hood, but the VM, hardening, updates, and dashboard are run for you.\n\nSee [CONTRIBUTING.md](/5dive-ai/5dive/blob/main/CONTRIBUTING.md). The `5dive`\n\nbundle at the repo root is built from `src/`\n\nvia `./build.sh`\n\n; CI enforces no drift.\n\nMIT. See [LICENSE](/5dive-ai/5dive/blob/main/LICENSE).", "url": "https://wpnews.pro/news/show-hn-5dive-run-a-company-of-claude-code-codex-agents-written-in-bash", "canonical_source": "https://github.com/5dive-ai/5dive", "published_at": "2026-07-23 14:45:26+00:00", "updated_at": "2026-07-23 14:52:42.484798+00:00", "lang": "en", "topics": ["ai-agents", "developer-tools", "ai-infrastructure"], "entities": ["5dive", "Claude", "Codex", "OpenAI", "Telegram", "Linux", "systemd", "SQLite"], "alternates": {"html": "https://wpnews.pro/news/show-hn-5dive-run-a-company-of-claude-code-codex-agents-written-in-bash", "markdown": "https://wpnews.pro/news/show-hn-5dive-run-a-company-of-claude-code-codex-agents-written-in-bash.md", "text": "https://wpnews.pro/news/show-hn-5dive-run-a-company-of-claude-code-codex-agents-written-in-bash.txt", "jsonld": "https://wpnews.pro/news/show-hn-5dive-run-a-company-of-claude-code-codex-agents-written-in-bash.jsonld"}}