The Codex-style coding agent, as a library.

Q: How do I review an agent's commands without a sandbox?

Add reviewPlugin({ llm }): hard rules decide the clear cases, a reviewer model the rest, a circuit breaker stops a run that keeps being refused. It is a judgement, not a wall.

Own the loop. One agent for one job, or a fleet of them, in a few lines.

GitHub

npm install sakura-agent

import { createAgent } from "sakura-agent";

const agent = await createAgent({ model });   // read, write, edit, bash, sessions, compaction, goals
const run = agent.run("Add tests for parse() and make them pass.");

Codex-like, in code

You know the shape: a loop with read, write, edit and bash, resumable sessions, compaction, goals, review. Sakura is that loop as a library you import, so nothing in it is closed.

Parameters, not switches

A specific agent is a few parameters.

await createAgent({ model, tools: ["read"], rules: ["Review only; change nothing."] });
await createAgent({ model, goal: { objective: "Make all tests pass", verify: "npm test" } });
await createAgent({ model, subAgents: {} });

Anywhere it should run

Tools can run on another machine; every risky call can be reviewed.

const environment = await createSshEnvironment({ host: "agent@box", cwd: "/srv/job" });
await createAgent({ model, environment, plugins: [...corePlugins(), reviewPlugin({ llm: reviewerModel })] });

A fleet is an array

Each agent has its own directory, environment and session.

const results = await Promise.all(jobs.map(async (job) => {
  const agent = await createAgent({ model, cwd: job.dir, confine: true, tools: job.tools, rules: job.rules, sessionFile: job.session });
  return (await agent.run(job.task).result).reason;
}));

Runnable example in the repository: examples/fleet.ts (offline).

Safety

Sakura ships no sandbox. confine bounds the file tools, not a shell; give an agent a shell only together with the review, or run untrusted work in an isolation you provide.

Measured

Real runs, with their conditions. Not guarantees.

What	Result	Conditions
Prompt cache	median request 98.8 % of input from the provider's cache; 95.7 % of all input tokens	One real coding session, `deepseek-v4.1-flash` via OpenCode Go, 20.8 hours, 1,817 requests; compaction and review requests not counted; caching is the provider's
Unattended	20.8 hours, 1,817 requests, 1,766 tool calls, no provider error, no crash, about 160 MB	Same session, first 20.8 hours
Review	445 reviewed calls, 0 technical failures of the reviewer, 2 refusals	The next 15 hours of the same session, after the reviewer's conversation was bounded
Benchmark	no complete score yet, so none is published	—

Install

sakura-agent is the library, published on npm.

npm install sakura-agent

sakuracode is a Codex-like terminal built on the same SDK: Markdown, slash commands, resume, fork, goals, MCP, exec --json. Not sandboxed; every tool call goes through the review.

npm install -g sakuracode

needs Node 26 or newer

FAQ

How do I run many coding agents in parallel?

Each agent is an object with its own directory, environment and session file; start them with Promise.all. See examples/fleet.ts.

How do I review an agent's commands without a sandbox?

Add reviewPlugin({ llm }): hard rules decide the clear cases, a reviewer model the rest, a circuit breaker stops a run that keeps being refused. It is a judgement, not a wall.

Which models work?

Anything that speaks Chat Completions with streaming and tool calls (tried with DeepSeek, Kimi and OpenCode Go).

How does it recover from a crash?

The session file is append-only and a message is written only when complete; run the agent again on the same file.