Agents that build agents.

It ships the other agents.preview

Give it a repo and a change. It clones into a sandbox, edits, runs the tests, and opens a pull request, then loads the result as a Dynamic Worker with only the bindings you granted.

1. Clone. Into a Linux sandbox keyed on the caller, not the task, so a follow-up request lands in a warm checkout with its dependencies already installed. It refuses to start on a dirty tree, because those changes are a previous task's work.
2. Change. It edits, runs the suite, and iterates until the tests pass or the turn budget is spent. The budget is metered across rounds, not per call.
3. Review. It opens a pull request. A human merges it. Nothing reaches your default branch because an agent decided it should.
4. Load. env.LOADER.load() starts the new agent as a Dynamic Worker, sandboxed, with only the bindings and the network access you granted it.

It runs on a different model provider than its siblings. That is the point: the round loop never learns which provider produced its LanguageModel, which is what makes ModelRuntime a seam rather than a config field.

Nothing is frozen at import.

Three things most frameworks settle when the module loads, this one settles while it runs.

export const plugins = (host: PluginHost): AgentPlugin[] => [
  general({
    primaryModelId: host.primaryModelId,
    fallbackModelId: host.fallbackModelId
  }),
  browser({ binding: host.env.BROWSER }),
  workspace(),
  recall({
    ai: host.env.AI,
    index: host.env.VECTORIZE,
    // A thunk: the verified caller does not exist yet when onStart runs.
    namespace: host.callerKey
  })
];

Delete a line and that module leaves your bundle entirely. Nothing in core imports a plugin and there is no root barrel, so the guarantee is structural rather than a tree-shaker's opinion, and CI asserts it on the built module graph.

Available today: browser, recall, workspace, repo, computer, triage, arc-agi. A plugin is not a package; it is an object satisfying a contract, so writing your own is a file, not a release.

What ships, and what stays yours.

The framework holds the parts that are identical for every agent and easy to get subtly wrong. It ships none of the words your agent says.

Core ships no prompt copy. Not a soul, not a round contract, not a user-facing failure message, because a run must never execute under an identity nobody chose.

The part that survives a refactor.

Agentic code rots quietly. A prompt drifts, a plugin leaks into a bundle that should never have carried it, and nothing fails until it matters. So the checks run on structure, not on good intentions, and a full agent turn is drivable in a test, the way a gateway would send it.

const harness = createAgentHarness({ worker, env, tenant: "reactive" });
using _ = harness.interceptGateway();

const accepted = await harness.send("what's the weather?");
expect(accepted.status.state).toBe(TaskState.TASK_STATE_SUBMITTED);