co:op

Keep your agents busy while you sleep

Run agent loops all night — in a box they can't escape.

Coding agents earn their keep with the brakes off and nobody watching — exactly when you don't want them loose on your laptop. Point coop's loop at your task queue and it works the night through, rides through rate limits, and reviews its own work to a demanding bar — all inside a disposable container that mounts only your repo, shadows its secrets, and can't reach your home dir, keys, or other projects. The cage is what lets you walk away.

$ curl -fsSL https://raw.githubusercontent.com/AndrewDryga/coop/main/install.sh | sh
Get started → ★ Star on GitHub
coop loop — drain the queue overnight
🔒

The cage, not the leash

The container is the boundary. The agent runs --dangerously-skip-permissions and the worst it can do is trash one repo you can restore from git.

🙈

Secrets never enter

.env, *.pem, secrets/ and friends are shadowed — empty tmpfs over dirs, a blank read-only file over files. Templates stay visible.

🌙

A whip for all-nighters

A fresh agent per iteration drains the .agent/tasks/ queue, rides through rate limits with credential failover, and reviews its own work to a demanding bar each iteration.

What it does

One binary. Every workflow.

Point it at any git repo and go. The same box drives a whole fleet overnight, a PR-style handoff, or a council of models — all behind the same container boundary.

The loop

Drain the queue while you sleep

Add tasks with coop tasks add (or just ask your agent to add them) — one folder per task under .agent/tasks/ — and walk away. A fresh agent per iteration (no context rot) claims each one, commits behind your gate, and won't quit while work remains.

  • Each iteration prints which model is working, live.
  • A rate limit triggers credential failover, not a stall — it switches accounts and keeps going.
  • When the queue empties, a fresh reviewer holds every shipped task to a senior reviewer's bar — reopening anything short of done, then draining and reviewing again until the review is clean.
  • It closes with a cost receipt — what shipped, the spend per task, and a by-model breakdown of the run's tokens and dollars.
coop loop
A fleet

Many models, one live board

Run several agents at once, each looping in its own fork on its own slice of the queue. coop fleet watch is the live dashboard — progress, the task each is on, and who's done.

  • Declare the fleet once in .agent/fleet.yaml; coop fleet up starts them all detached.
  • Watch them finish in real time, then coop fork merge --all lands the lot through a revalidating rebase queue.
  • The board tracks cost per fork and a fleet total, so the spend adds up in view.
  • Add agents until review, not generation, is your bottleneck.
coop fleet up · coop fleet watch
Forks

Hand off work like a PR

A fork is a throwaway local clone handed to an agent instead of your working tree. Its origin is a local path, so the agent has nowhere to push — and you stay the only one who lands anything.

  • Open → work → review → land, the lifecycle of a contractor's PR.
  • Review the diff in your terminal or your IDE; merge rebases onto your branch.
  • Set COOP_GATE and every merge re-runs your tests on the rebased tree.
coop fork — review & land
Fusion

A council that argues before it commits

One model leads and does the real work; its configured council advises read-only; the leader synthesizes their strongest conclusions. You stop betting the run on one model's blind spots.

  • No extra service — the leader consults its peers from its shell, in parallel.
  • The synthesized answer beats any single model working alone.
  • Or add --peer codex (repeatable) to any run for a lighter, opt-in second opinion.
  • Capture the whole arrangement — lead, roles, and their targets — as a reusable preset.
coop fusion claude --peer codex --peer gemini
Presets

Many models, one recipe

Put your strongest model in charge and let it spend the cheap tokens: a lead plus the roles it routes work to — cross-vendor, each on its own model — captured once as a file and reused on any run.

  • The lead's target ladder fans across your accounts and falls back rung → rung on a rate limit.
  • Roles in three modes: an in-session native subagent, a read-only cross-vendor consult, and a write-capable delegate.
  • coop presets init scaffolds one; name it in the who-runs slot to run it — coop <preset>, the loop, fusion, or a fork. Details ↗
.agent/presets/frontier/preset.yaml 
lead:
  agent: [claude:claude-fable-5/xhigh, codex:gpt-5.6-sol/xhigh]
roles:
  thinker:       # deep thinking, in-session
    mode: native # coop generates a coop-thinker subagent
    agent: claude:claude-opus-4-8/xhigh
  critic:        # read-only, another vendor
    mode: consult
    agent: codex:gpt-5.6-sol/xhigh
  fast:          # cheap, write-capable
    mode: delegate
    agent: gemini:gemini-3.5-flash
Editors

Your editor is the cockpit

Register coop as an ACP agent (Zed today) and steer the sandboxed agent from the editor — while coop quietly runs the session for you.

  • A coop dropdown in the toolbar switches the credential or preset mid-thread — the conversation survives the switch.
  • A rate-limited turn rotates to your next account and re-sends itself; with every account cooling, it waits out the nearest reset and sends then.
  • Box restarts replay the handshake — the editor never disconnects — and a dev server in the box shows up at a stable localhost URL. Details ↗
Zed · settings.json 
{
  "agent_servers": {
    "coop": {
      "command": "coop",
      "args": ["acp", "claude"]  // or codex/gemini/grok
    }
  }
}
Defense in depth

Secrets stay out of the box

Out of the box, coop shadows the usual suspects by name — no setup. .coopignore adds your repo's own; coop check-secrets catches tokens hiding inside files; and coop doctor proves the whole thing holds.

🙈 Shadowed by default

A blank tmpfs covers secret folders and an empty read-only file covers secret files — applied before the agent starts, so a well-known credential name is never readable or writable.

.env.env.**.pem*.key*.p12*.tfvars*.tfstateid_rsa.ssh/.aws/.kube/.gnupg/.npmrc.netrc.git-credentialssecrets/credentials.jsonservice_account.jsonkubeconfigdatabase.yml+ more
👁 Kept visible

Templates and public CA bundles stay readable, so the agent can still see the shape of your config and TLS keeps working.

*.example*.sample*.templatecacerts.pemca-bundle.crt
.coopignore

Your final say on what's hidden

The defaults above can't know your repo holds a config/credentials.yaml or a committed prod.yml. Add a .coopignore — one pattern per line — and it's shadowed everywhere the box can see.

  • The boundary is .coopignore, not .gitignore — a normal run mounts your whole tree.
  • A content scan also gates every coop fork merge, so a token in an innocuous file is caught on the way in.
  • The box keeps your git identity — commits are authored as you, your key never enters.
coop check-secrets
Prove it

coop doctor attacks the box for you

Don't take the isolation on faith. doctor plants a decoy secret, launches the box, and checks from inside that the secret is unreadable and unwritable — then checks on the host that a fork carries neither the secret nor a pushable remote.

  • Inside the sandbox: secrets shadowed, decoy unwritable, source still readable.
  • On the host: gitignored secrets never enter a clone; origin is a dead-end local path.
  • Run it anytime — especially after changing config.
coop doctor
Install

From nothing to a sandboxed agent

One binary, no Go, no clone. A container runtime — Apple container, Docker, or Podman — is the only requirement.

01

Install the binary

Drops coop into ~/.local/bin and builds the box if a runtime is present.

$ curl -fsSL https://raw.githubusercontent.com/AndrewDryga/coop/main/install.sh | sh
02

Authenticate once

The token persists in the config dir — paste-code, no browser needed. 

coop doctor # prove isolation
coop login claude
coop claude # go
03

Or run it all night

Scaffold a queue, add a task per folder, and let the loop drain it. 

coop init
coop tasks add "…"
coop loop

Read the docs →