Codemini CLI
An extremely restrained terminal-first coding + tasks CLI with a built-in Web UI, handling refactoring, Git workflows, pipelines, and research locally.
Per-dimension scores and reasoning
Approval policy, sandbox modes, outside-workspace write approvals and sandbox-escalation approvals are implemented with targeted tests (approval-policy.test.js) and fail closed rather than silently falling back; however 'danger-full-access' mode and unrestricted in-sandbox network access show least privilege is not the enforced default, so least_privilege gets 2. user_confirmation earns 3 on the strength of layered, tested approval flows. Data-flow transparency documents local paths and that only model requests go to the configured provider, but key storage/transport details are absent (2). Sensitive-data handling is only a generic 'stored locally' claim with no encryption/redaction detail (1). The long dependency list (node-pty, microsandbox, sharp, etc.) shows no audit, lockfile policy or vulnerability mitigation evidence (1). Outside writes and network-visible actions have approval gates, but in-sandbox network is unrestricted (2). Checkpoints and Git-aware recovery are described (2). Skill install sources and research artifacts are mentioned without source-verification mechanisms (1).
README, package. and tests are mutually consistent; commands, config keys and tested modules line up (3). doctor plus sandbox/search fallbacks show dependency-availability handling, though the long chain with optional deps is not fully evidenced (2). Fail-closed behavior and explicit failure reasons like evaluator_error are test-backed (2).
Windows/macOS/Linux, TUI plus Web UI, multiple providers and multiple scenarios (code, pipelines, research) are all explicitly covered (3). Boundaries are partly documented (no Windows sandbox fallback, unauthenticated LAN exposure) but not systematically stated (2). Risk-tiered approval triggers and role tool policies are precise in tests, but real-world coverage of trigger rules is only sampled (2). Per-platform data paths with env override follow OS conventions (3).
README is well structured, bilingual, with command and data-path tables and links to OPERATIONS/deployment (3). Install notes include the Node version floor and quick-start commands (3). Two bin names (codemini, coder) are registered — an explainable legacy alias, not drift (2). Many examples but no FAQ (2). Known limitations (Windows sandbox, no-auth LAN) are mentioned but incomplete (2). LICENSE is a complete MIT text consistent with package. (3). Version 0.9.5 with npm badge and bump scripts exists, but no CHANGELOG file is present in the source set (1). The publisher is an unverified individual account with no governance, maintenance or update-path documentation (1).
Output is organized via a structured tool runtime, diff previews, artifacts and reviewable workflows — usability is well designed (3). The feature set (project indexing, microsandbox, memory, research) is differentiated among CLI agents, but comparative advantage is not quantified (2). Tiered approvals and lazy loading reduce interaction and context cost, though token/cost benefits lack data (2).
Core safety claims in the README (approvals, fail-closed sandboxing) map onto test files, but many feature claims (Dream/Reflect, Deep Research, CodeWiki) have no corresponding inspectable material (2). Tests corroborate the approval-policy claims; other claims lack a second source (2). Factual descriptions are mostly separable from promotional phrasing ('minimal by design' is a slogan but not misleading) (2).
- Publisher identity is not verified by any enterprise registry; verify maintenance activity and release history independently before adoption.
- 'danger-full-access' sandbox mode and unrestricted in-sandbox network access are high risk; prefer workspace-write with reviewed network policy in production.
- The Web UI exposes no authentication when bound with --host 0.0.0.0; never use this on untrusted networks.
- The dependency tree includes several native and high-privilege packages (node-pty, microsandbox, sharp); the repository shows no audit or mitigation notes — run npm audit and pin dependencies independently.
- Protection of sensitive data (API keys, session memory) is only a 'stored locally' claim; no encryption measures are documented.
- No CHANGELOG exists and version 0.9.5 is pre-1.0; APIs and behavior may change frequently.
- This is a static source review; no tests were executed and actual 'npm test' pass status is unverified.
What does this agent do, and when should you use it?
Codemini is a coding + tasks CLI for Windows, macOS, and Linux that talks to OpenAI-compatible and Anthropic APIs while keeping sessions, memories, indexes, and checkpoints on your machine. It ships two interfaces on the same runtime: a keyboard-first terminal TUI and a browser Web UI with concurrent sessions, file browsing, diffs, real PTY terminals, and CodeWiki. Its execution model keeps prompts small via context compaction, lazy-loaded skills, and project-aware retrieval built on Tree-sitter ASTs and dependency graphs, with approvals proportional to risk. Sandboxing prefers a Microsandbox Linux microVM, falls back to Landlock/Seatbelt on Linux/macOS, and fails closed when no isolation is available. It also bundles Deep Research, Memory (Dream/Reflect), Claude-compatible hooks, and MCP extensions, and is distributed via npm as codemini-cli.
After installation, run codemini for an interactive terminal session or codemini --web to start the local Web UI (bound to 127.0.0.1 by default). It incrementally indexes project files and symbols, performs Tree-sitter AST queries, maintains dependency and knowledge graphs, and presents them through CodeWiki. codemini run turns a natural-language request into a one-off workflow, with --harness for role constraints and --pipeline for staged workflows with artifact passing. Command execution can run inside a Microsandbox microVM or Landlock/Seatbelt OS confinement, with read-only / workspace-write / danger-full-access modes plus independent risk approvals, file-change previews, and checkpoints. Slash commands like /inbox, /dream, /reflect, and /compact consolidate work evidence into memory and reusable Skills; Skills are lazy-loaded, Hooks observe or gate lifecycle events in Claude-compatible format, and MCP connects external tools.
- A developer refactoring a codebase and driving a Git workflow from the terminal, using a codemini session with previews and approvals.
- An engineer running multi-step automation outside CI, using codemini run --pipeline "Run tests, fix failures, and summarize the result".
- A maintainer who needs a review role, using codemini run --harness reviewer "Review the current changes" to constrain execution.
- A user managing concurrent sessions, diffs, and a real PTY terminal in the browser via codemini web.
- An architect assessing change impact before edits using the knowledge graph and CodeWiki impact queries.
- A researcher who wants sources retained with the task, using Deep Research scouts, artifacts, and the research library.
What are this agent's strengths and limitations?
- Dual interfaces share one runtime: the terminal TUI and the Web UI (concurrent sessions, PTY terminals, CodeWiki) are interchangeable.
- Small-prompt design: lazy-loaded skills, context compaction, and evidence-first retrieval via Tree-sitter ASTs and project graphs keep long sessions usable.
- Explicit security model: Microsandbox microVM preferred, Landlock/Seatbelt OS fallback, fail-closed when sandboxing cannot start, with approvals and sandbox policy kept independent.
- Concrete, reviewable self-evolution: /dream curates evidence into memory and /reflect turns repeatable workflows into inspectable Skills.
- Provider freedom: works with any OpenAI-compatible endpoint or Anthropic API, with an optional separately configured fast model.
- Requires Node.js 22.19+ and manual gateway URL, API key, and model configuration; it is not usable out of the box.
- Windows has no OS-level sandbox fallback; if sandboxing is enabled but cannot start, commands are refused.
- The Web UI has no authentication; --host 0.0.0.0 LAN exposure is safe only on trusted networks.
- The microVM sandbox depends on the external Microsandbox msb binary, and optional accelerators like fff-mcp require extra setup.
- Network access is allowed inside the sandbox and a danger-full-access mode exists, so teams must define their own approval and sandbox policies.
How do you install or deploy this agent?
Requires Node.js 22.19 or newer. Install globally: npm install -g codemini-cli. Then configure an OpenAI-compatible or Anthropic endpoint:
codemini config set gateway.base_url http://127.0.0.1:8000/v1
codemini config set gateway.api_key your_api_key
codemini config set model.name your_model_nameRun codemini doctor to verify the runtime and provider. Optionally install Playwright and run playwright install chromium for JavaScript-heavy pages, and install the Microsandbox msb binary for microVM sandboxing.
How do you use this agent?
Start an interactive session: codemini (or codemini chat). Run a one-off task: codemini run "Find stale dependencies and explain the upgrade risks". Use a role: codemini run --harness reviewer "Review the current changes". Run a staged pipeline: codemini run --pipeline "Run tests, fix failures, and summarize the result". Start the Web UI: codemini --web, or codemini web --project . --port 3456. Manage skills: codemini skill list / install / inspect / enable / disable / reindex. Configure sandboxing: codemini config set sandbox.mode workspace-write, etc. In-session slash commands: /coding, /daily, /tools, /history, /inbox, /dream, /reflect, /compact.