One Rust CLI for running capable coding agents inside a controlled environment—with deliberate access to your repo, tools, secrets, browser, and host UI.
ags --agent codex --lockdown
Bring the agent you already use
Coding agents need compilers, package managers, Git, databases, browsers, and the freedom to change a project. They do not need your entire home directory.
AGS creates a useful middle ground: a full development environment whose connections to the host are visible, configurable, and—in hardened mode—easy to cut.
Every capability below maps to a concrete AGS runtime path—not a future roadmap.
Work inside a Fedora toolchain image with Git, Rust, Node, Python, Go, Java, PostgreSQL tooling, tmux, and more—under Podman’s rootless user namespace.
Launch Pi, Claude, Codex, Gemini, OpenCode, or an interactive shell from the same project. Agent profiles keep commands, state mounts, and integration details tidy.
ags --agent codexDeclare files and directories as read-only or read-write. Add temporary same-path directories per run. Repo-local overlays can extend a trusted global config.
Resolve values from host environment variables or the system secret store, then inject only the configured names at runtime. Lockdown mode disables them entirely.
API_TOKEN=••••••••Open OAuth flows with approval, paste clipboard images through a permissioned socket, and show host-owned Glimpse windows without handing over the compositor.
Opt into PSP mode when tests need containers. Docker-compatible clients reach a per-session proxy socket with image allowlists and bind-mount restrictions—not the raw Podman API.
ags --agent pi --pspStart with the agent and add only the runtime powers this task needs.
ags --agent codex --tmux
Keep your agent state, dedicated SSH identity, selected secrets, and configured bridges. Tmux leaves a shell behind when the agent finishes, ready for inspection.
AGS does not improvise access. It validates configuration, prepares scoped host services, builds a typed launch plan, renders Podman arguments, and cleans up the session when the container exits.
Explore the LaunchPlan type ↗Global config, trusted repo overlay, CLI flags
ValidatedConfig
Mounts, secrets, SSH, runtime sockets
RuntimeState
Workdir, security, env, entrypoint
LaunchPlan
Render arguments and execute Podman
podman run
--lockdown keeps the exact workspace and network access, then removes
secret injection, SSH forwarding, generic mounts, host bridges, and real agent home
state. A sanitized per-run home disappears with the session.
ags --agent claude --lockdown
agents at play / host at peace
Keep long-running work in tmux. Paste an image without exposing Wayland. Open OAuth on
the host and relay localhost callbacks back in. Let a sandbox-local app appear in a
host-owned Glimpse window. Connect to a host database through
host.containers.internal.
ags doctor
04 Bash, Zsh, and Fish completions
Clone the project, then compile the optimized binary.
cargo build -p ags --release
Materialize the bundled assets and link the CLI into your local bin.
./target/release/ags install --link-self
Create agent keys, build the image, then check the whole environment.
ags setup && ags update-image && ags doctor
Read the prerequisites and follow the complete setup guide.