Banteg Agent Workflows
Isolate Codex and Claude coding tasks with worktrees, sandboxes, and devcontainers.
- Source repo
- banteg/agents
- Stars
- ★ 372
- Last updated
- 4mo ago
- Primary language
- Python
- FA score
- 47/100 · Major gaps
At a glance
- Works with
- Universal · cross-platformCodex · Claude CodeChatGPT · Claude.ai (Partial support)
- You'll need
- Typical use
- A developer running several coding assistants concurrently can assign each task its own worktree so their changing files do not interfere.
- Main limitation
- This is a personal workflow collection rather than a cohesive agent with one entry point, configuration contract, or stable API.
- Source review
- 47/100 · Major gaps 2 safety controls not found
What does this agent do, and when should you use it?
This repository is a personal collection of workflows and helper scripts for coding assistants such as Codex and Claude Code, not a standalone general-purpose agent. Its central pattern is to create a separate Git worktree for each task, commit the result there, and then either discard the branch or open a pull request. It also documents macOS Seatbelt sandboxing, unattended devcontainer execution, archive-based code review, Telegram control, and completion notifications. The interfaces are command-line tools including Git, git-wt, Worktrunk, GitHub CLI, devc, and takopi, with outputs such as commits, branches, pull requests, ZIP archives, Git bundles, and notification messages. Its deployment boundary is primarily a local repository and shell, with Docker available for isolation; each workflow has its own dependencies rather than a single installation entry point.
A typical flow starts from a local Git repository and uses git wt feat/branch or wt switch -c -x codex feat/branch to create and enter an isolated worktree where a coding assistant edits files. The user can then run wt step commit to prepare a commit from the diff and prior commit style, or gh pr create to open a pull request. Afterward, wt merge can squash, rebase, merge into master, and remove the worktree and branch; git wt -d, git wt -D, and wt remove provide other cleanup paths. Claude Code can be placed inside the macOS Seatbelt sandbox through ~/.claude/settings.json, limiting writes outside the project and restricting network access. For unattended work, the included devcontainer/install.sh installs devc, which opens a tmux environment with Claude and Codex. Review inputs are produced with git archive as ZIP files or git bundle create repo.bundle --all when commit history is needed; takopi supplies Telegram control and resumable sessions, while the Codex notify script provides completion messages.
- A developer running several coding assistants concurrently can assign each task its own worktree so their changing files do not interfere.
- A macOS Claude Code user facing repeated permission prompts can enable Seatbelt and automatically allow Bash commands that are already sandboxed.
- A developer who wants Codex or Claude to run unattended can place the session in the documented Docker devcontainer and tmux environment.
- A maintainer requesting architecture, refactoring, debugging, or next-fix analysis from GPT, Claude, or Gemini can upload a Git-generated ZIP or bundle.
- A user who wants to monitor and resume coding sessions from a phone can adopt takopi, while someone needing only completion alerts can use the Telegram notify script.
How do you install or deploy this agent?
There is no single package, global installer, or complete dependency manifest for the repository; each workflow is configured separately. For the lightweight worktree option on a Homebrew system, run brew install k1LoW/tap/git-wt, add .worktrees to ~/.gitignore_global, and run git config wt.basedir .worktrees. Relative worktree paths require Git 2.48 or newer: enable them with git config --global worktree.useRelativePaths true and migrate existing worktrees with git worktree repair. The devcontainer path requires Docker—the author prefers OrbStack—and installs devc from the repository with ./devcontainer/install.sh self-install. Full Telegram control is installed with uv tool install takopi. The supplied material does not give a unified installation procedure for Worktrunk, the Codex notify script, or every runtime dependency.
How do you use this agent?
Run git wt feat/branch to create or switch to an isolated task, then clean it up with git wt -d feat/branch for a soft deletion or git wt -D feat/branch for a hard deletion of the worktree and branch. With Worktrunk, use wt switch -c -x codex feat/branch to create the worktree and launch Codex, wt step commit to prepare a commit, wt merge to merge and clean up, or wt remove to remove and prune. After installing the devcontainer helper, invoke devc /path/to/repo to enter tmux with Claude and Codex. For model review, create a repository snapshot with git archive HEAD -o code.zip, limit it to src with git archive HEAD:src -o src.zip, or preserve history with git bundle create repo.bundle --all. A pull request can be opened with gh pr create; this requires GitHub access and authentication, although credential setup is not documented in the supplied material.
What are this agent's strengths and limitations?
- Separate Git worktrees give concurrent coding tasks concrete filesystem isolation and reduce collisions between assistants.
- It offers both the small git-wt wrapper and the more complete Worktrunk lifecycle covering creation, commits, merging, and cleanup.
- The workflows span local sandboxing, container isolation, remote Telegram control, and simple notifications, allowing different levels of automation.
git archiveandgit bundleprovide compact, Git-native ways to deliver either a tracked snapshot or repository history for review.
- This is a personal workflow collection rather than a cohesive agent with one entry point, configuration contract, or stable API.
- Different features depend on Git, Homebrew, Docker, GitHub CLI, uv, takopi, or third-party worktree wrappers that adopters must assemble themselves.
- The Seatbelt setup is specific to Claude Code on macOS and is not a cross-platform sandbox solution.
- The supplied material documents no test coverage, compatibility matrix, release policy, or failure-recovery procedure.
- Commands such as
git wt -D,wt merge, and cleanup operations remove worktrees or branches, so uncommitted work must be handled carefully.
How does this agent compare with similar options?
git-wt is presented as a simple wrapper for common worktree operations, while Worktrunk is the fuller option aligned with the create → pull request → merge → cleanup cycle and adds features such as install hooks and commit generation through the llm CLI. For repository review, the workflow favors native git archive or git bundle output over large XML or Markdown exports from repomix or code2prompt. For notifications, takopi provides streamed progress and resumable remote sessions, whereas the Codex notify script only sends a simple completion message.
Key facts side by side with the most closely related agents.
| Agent | Source review | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|
| Banteg Agent Workflows This agent | 47 · Major gaps | ★ 372 | 4mo ago | Python | Codex · Claude Code |
| SWE-AF Engineering Factory | 53 · Major gaps | ★ 1k | 2d ago | Go | ChatGPT · Codex · Claude Code · OpenAI API · Claude API |
| Pi Dynamic Workflows | 88 · Good | ★ 531 | 9d ago | TypeScript | — |
| Happier | 82 · Good | ★ 1.7k | today | TypeScript | Codex · Claude Code |
How does FollowAgents rate this agent?
Why each dimension lost points
The README explicitly recommends worktrees, macOS Seatbelt, and devcontainers to isolate agents, showing meaningful least-privilege intent. Disposable branches and worktrees provide a practical rollback path, and third-party tools and Git documentation are attributed. Deductions apply because it also recommends sandboxed auto-approval and unattended “yolo mode” without per-action confirmation. Source-archive uploads, Telegram notifications, and remote bridging are mentioned without explaining destinations, retention, or credential handling. There is no evidence of dependency security controls, secret-handling guidance, or version pinning. Destructive and externally visible operations such as hard deletion, merging, and branch removal are documented but lack explicit warnings or confirmation safeguards.
The sections form a reasonably consistent personal workflow covering isolation, execution, review, and notification, with no obvious contradictions between commands and prose. Prerequisites such as Git 2.48+, Docker, OrbStack, Homebrew, Claude, and Codex are named, and a repair command is supplied for relative-worktree issues. Scores are reduced because there is no dependency validation, compatibility matrix, version pinning, systematic recovery guidance, or defined failure-message behavior.
The material addresses concrete scenarios including parallel agent development, the pull-request lifecycle, architecture review, unattended execution, and notifications. It distinguishes macOS Seatbelt, devcontainers, alternative worktree wrappers, and several model environments. Capability boundaries are fairly clear because this is presented as a collection of personal workflows and external-tool combinations, not a complete autonomous-agent framework. Deductions reflect the absence of precise activation rules, a platform decision matrix, and broader environment-specific adaptation guidance.
The README is organized into clear sections for worktrees, sandboxing, devcontainers, review, and notifications, with copyable installation, configuration, and usage commands. Terminology and command naming are mostly stable. It lacks a formal FAQ, while limitations are only mentioned incidentally. No license, version policy, or changelog is supplied. Maintenance responsibility is only weakly inferable from first-person authorship and repository ownership; support channels, release practices, and responsibility boundaries are unspecified.
The workflows provide directly usable commands and configurations that can improve parallel-agent isolation, cleanup, review inputs, and notifications. Combining established Git, container, and sandbox tools offers practical marginal value at a seemingly moderate base cost. Full marks are not justified because the source provides no output examples, measured benefits, supported comparisons, or complete end-to-end evidence, and some recommendations introduce operational costs through Docker, third-party CLIs, and messaging services.
Most recommendations are tied to concrete commands, configuration snippets, or specifically named external tools, and personal preferences are generally distinguishable from technical statements. Deductions apply because the supplied evidence consists solely of one README: there is no repository code, test evidence, included configuration content, or second internal source for corroboration. Evaluative claims such as calling another practice “outdated” or describing a mode as “best” are unsupported.
- Not found in source: sensitive-data handlingUse dedicated, low-privilege, revocable API keys — never production credentials — and keep secrets out of logs.
- Not found in source: dependency securityPin versions and run a dependency audit (npm audit, pip-audit) before installing; prefer running it in a container.
- Before enabling `autoAllowBashIfSandboxed` or unattended operation, independently verify the sandbox boundary; the README does not establish that every invoked tool is constrained identically.
- `git wt -D`, `wt merge`, and `wt remove` can delete worktrees or branches and may rewrite or merge history. Confirm targets and retain recoverable references first.
- Uploading source archives, creating an all-reference Git bundle, or enabling Telegram/takopi notifications may expose code, history, message content, or credentials. The material does not document retention or secret protection.
- The license is unknown, so authorization should be confirmed before reuse or redistribution. Installation provenance, versions, and supply-chain risks of third-party tools also remain unevaluated.
FAQ
Is this a deployable autonomous agent?
Is Docker mandatory?
Which steps require network access or accounts?
gh pr create requires GitHub access and authentication, while takopi and the notify script communicate through Telegram. Local worktree, archive, and bundle operations can run against the local repository.Will these workflows work on Windows or Linux?
What is the main operational risk?
git wt -D path. No automatic backup or recovery mechanism is documented.