AI 編程工具
Coderlet Open-Sources a Readable Control Layer for Coding Agents, but Lacks Sandboxing and Automated Tests
Coderlet separates model calls, tool validation and execution results, and persistent memory into three explicit boundaries, providing an executable Python implementation under the MIT License. It is suited to studying agent control flow and failure recovery—not a higher-performing coding agent—and currently operates directly with the user’s operating-system permissions.
Released on August 10, Coderlet does not introduce a new model. Instead, it distills one of the most frequently overlooked parts of a coding agent—the harness control layer—into a readable, executable Python project. It connects to model endpoints that support the Responses API, streaming, and function calling; includes tools for file reads and writes, precise edits, search, shell commands, and the web; and explicitly sequences each request as context creation, model invocation, tool-argument validation, execution or rejection, returning an observation, saving the record, and only then signaling completion.
The design centers on three boundaries of responsibility. The model boundary only turns context and tool descriptions into API requests, then decodes text and structured calls. The execution boundary validates tool names and arguments, then runs valid actions in generation order. The state boundary stores sessions as JSONL, compresses older context into `PENDING_MEMORY.md`, and later consolidates it into the long-term `MEMORY.md`. Each tool result retains its original call ID, allowing developers to distinguish among three separate completion states: “the model proposed the action,” “the tool modified the environment,” and “the request record was saved.” If an action succeeds but subsequent persistence fails, recovery can resume from the last confirmed stage instead of blindly replaying commands that may have side effects.
The implementation’s main value is as an inspectable reference scaffold, not as an attempt to set a new SWE-bench record. The author explicitly makes no claim of improved task performance. The repository currently has only two commits, no automated tests, and support for just one user and one terminal session. More importantly, its tools read and write files and execute shell commands with the current account’s full permissions, without an operating-system sandbox, command-approval gate, filesystem boundaries, or multi-tenant isolation. Engineering teams using it for prototyping should first add permission policies, traceable side-effect state, secret redaction, and tests rather than connecting it directly to critical workspaces.