{"slug": "show-hn-agent6-coding-agent-with-jailed-commands-and-editable-state-machines", "title": "Show HN: Agent6 – coding agent with jailed commands and editable state machines", "summary": "Agent6, a new coding agent that jails model commands and uses editable state machines for long-running tasks, has been released. The agent restricts filesystem and network access via Landlock and seccomp, supports multiple AI providers including Anthropic and OpenAI-compatible endpoints, and offers features such as per-step commits, budget caps, and parallel fan-out. It is available for installation via uv or pipx, requires Python 3.12+, and runs on Linux with sandbox support.", "body_md": "A coding agent that jails model commands and uses editable state machines for long-running tasks.\n\nThe model can write code and ask to run commands, but those commands go through a jail with restricted filesystem and network access. Long-running workflows can be written, reviewed, edited, resumed, and replayed as declarative state machines instead of being left to an open-ended agent loop.\n\n**Full documentation: agent6.dev**\n\n|\nthe TUIthe full agent, as a live dashboard |\n\nthe full agent, in any terminal**the CLI** the full agent, in any terminal\n\nthe full agent, desktop or phone**the web UI** the full agent, desktop or phone\n\n**Jailed commands**: Landlock + seccomp, and under`strict`\n\n(what the default`auto`\n\npicks when the host allows it) user namespaces,`pivot_root`\n\n, read-only`.git`\n\n, no route off the box ([Security](https://agent6.dev/security/))**Providers**: Anthropic and any OpenAI-compatible endpoint (OpenAI, OpenRouter, Ollama, vLLM, llama.cpp, LM Studio); model + thinking level per role ([Config](https://agent6.dev/config/))**Clean checkout**: per-step commits on a detached ref,`sessions merge`\n\nto land them, snapshot resume, fork at any turn**Verify gate**: inferred when unset, pinned for the run, green/red on every surface; a worker can propose a replacement gate instead of reverting**Budget**: hard`max_usd`\n\ncap, token cap for calls the provider does not price**Sessions**: run, plan, ask (plan and ask never edit);`--from <id>`\n\nseeds from another, cross-session reads,`/btw`\n\nasks beside a live run**Four front-ends, one engine**: CLI, TUI,[browser](https://agent6.dev/web/)(stdlib server, no JS deps, phone), and[editor over ACP](https://agent6.dev/acp/);`attach`\n\n,`exec`\n\n,`forward`\n\n,`history`\n\n**Background commands**:`background: true`\n\nhands back a handle,`read_background`\n\npolls,`/shells`\n\nlists them; none outlive the run**Context control**: compaction visible on every surface,`/compact [focus]`\n\n,`/pin`\n\n, repo memory injected per run**State machines**: LLM-drafted, operator-reviewed, journaled, replayable; they pause for input, take events, steer from any front-end ([State machines](https://agent6.dev/state-machines/))**Task graph**: the worker keeps its plan in a persistent DAG (dependencies, acceptance criteria, statuses) journaled with the run; it survives crash and compaction restarts, shows live on every surface, and`decompose = \"auto\"`\n\nfront-loads it for models measured to need it**Code review**:`agent6 review`\n\non any diff, plus an in-loop panel of adversarial reviewers where only blocking-category findings gate**Parallel fan-out**:`--parallel N|model-a,model-b`\n\nclone-based lanes, auto-compared into a ranked report;`sessions compare`\n\nfor past runs,`/parallel`\n\nmid-run ([Architecture](https://agent6.dev/architecture/#parallel-runs))**Skills**: SKILL.md packs (the format Claude Code and most agents share) index into the prompt, load on demand, fire as`/name`\n\nor`--skill`\n\n; repo instructions from`AGENTS.md`\n\n**Fixed tool surface**: extended only by operator-configured MCP servers, off by default, jailed by default** Eight runtime dependencies**, no telemetry, no auto-update\n\n```\nuv tool install agent6        # or: pipx install agent6\n```\n\nIf `agent6`\n\nis not found, you can add the uv or pipx bin dir (`~/.local/bin`\n\n) to your PATH with `uv tool update-shell`\n\nor `pipx ensurepath`\n\n.\n\nEnable shell completion with `agent6 completions`\n\n(supports bash, zsh, fish, and xonsh).\n\nagent6 requires **Python 3.12+** and the sandbox only supports **Linux** (x86_64/aarch64).\nOther platforms run without the sandbox behind a warning.\nSee [installation](https://agent6.dev/installation/) for the full requirements and building from source.\n\n```\n# Connect a provider (stored in ~/.config/agent6/, key in a 0600 secrets file).\n# If already connected, skip both; `agent6 check` verifies it.\nagent6 connect                # interactive: pick provider, paste API key\nagent6 model worker anthropic claude-sonnet-5\n\n# Run the agent on a task, create a plan, or ask a question.\ncd your-repo\nagent6 run \"add a --json output mode to the CLI\"\nagent6 plan \"how to add a --json output mode to the CLI\"\nagent6 ask \"how to add a --json output mode to the CLI\"\n\n# Watch and drive runs from a terminal, a TUI, a browser, or an editor.\nagent6 attach <session-id>    # follow + answer a run live (--raw for events)\nagent6 tui                    # full-screen dashboard hub\nagent6 web                    # browser UI on http://127.0.0.1:7658\nagent6 acp                    # speak ACP on stdio; an editor spawns this\n\n# Audit the effective config, check the sandbox, resume or fork a run.\nagent6 config show\nagent6 check\nagent6 resume <session-id>\nagent6 fork <session-id> --at-turn 7\n\n# See all commands with `agent6 --help` or `agent6 <command> --help`.\n```\n\nSee [usage](https://agent6.dev/usage/) for the full command tour, [the web UI](https://agent6.dev/web/) for driving runs from a phone, [configuration](https://agent6.dev/config/) for every field, and the [security model](https://agent6.dev/security/) for what the sandbox enforces.\n\nConfig is layered, lowest precedence first: built-in defaults, the global `~/.config/agent6/config.toml`\n\n, the per-repo config (in the state dir, out of the workspace, per-machine, never committed), then `--config FILE`\n\n.\n`agent6 config show`\n\nprints every effective value with the layer that set it.\nEvery field has a default, and security-sensitive fields default to the safe value: `isolation = \"auto\"`\n\n, `network = \"auto\"`\n\n, `run_commands = \"ask\"`\n\n, `protect_git = true`\n\n.\nUnder `\"auto\"`\n\nthe sandbox picks the most secure option available on the host and warns if it cannot enforce the full policy; an explicitly set value it cannot enforce refuses to run.\n`protect_git = true`\n\nre-binds `.git`\n\nread-only, which needs `strict`\n\n; on `hardened`\n\nthe default warns and an explicitly set `true`\n\nrefuses to run.\nagent6 itself does not push, rewrite history, or `reset --hard`\n\n, and no config key can enable them.", "url": "https://wpnews.pro/news/show-hn-agent6-coding-agent-with-jailed-commands-and-editable-state-machines", "canonical_source": "https://github.com/agent6-dev/agent6", "published_at": "2026-08-16 18:55:47+00:00", "updated_at": "2026-08-16 19:10:34.405314+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "developer-tools", "ai-safety"], "entities": ["Agent6", "Anthropic", "OpenAI", "OpenRouter", "Ollama", "vLLM", "llama.cpp", "LM Studio"], "alternates": {"html": "https://wpnews.pro/news/show-hn-agent6-coding-agent-with-jailed-commands-and-editable-state-machines", "markdown": "https://wpnews.pro/news/show-hn-agent6-coding-agent-with-jailed-commands-and-editable-state-machines.md", "text": "https://wpnews.pro/news/show-hn-agent6-coding-agent-with-jailed-commands-and-editable-state-machines.txt", "jsonld": "https://wpnews.pro/news/show-hn-agent6-coding-agent-with-jailed-commands-and-editable-state-machines.jsonld"}}