A coding agent that has to earn its shell access
How the LangGraph SWE-agent indexes a repo with tree-sitter, edits inside a five-layer sandbox, and self-repairs against tests — and why a red-team suite is part of CI.
Giving a language model run_shell is easy. Making it safe enough that you would run it on a repository you care about is the actual work.
The loop
index → plan → act → observe → repair, up to four iterations. The act step is a ReAct loop over six tools: search_code, open_file, edit_file, run_shell, run_tests, submit.
Indexing uses tree-sitter to chunk code by symbol rather than by line count, embeds the chunks into a per-task Qdrant collection, and retrieves with hybrid dense + BM25 search. That is what lets the agent work on repositories far larger than the context window.
Five layers between the model and your machine
- Workdir isolation — the agent only ever sees a copy.
- Path-traversal checks on every file operation.
- A command allowlist for
run_shell. rlimitenforcement on memory and CPU.- Timeouts on every tool call, plus a hard iteration cap.
Evals in three tiers
- 47 unit tests that need no API keys.
- A 20-task hand-curated mini-bench of real Python bugs.
- A 10-attack red-team suite — prompt injections that try to escape the sandbox, exfiltrate files or run disallowed commands. The current block rate is 100 percent, and it runs on every change.
Resilience
Groq is the primary provider with three rounds of exponential backoff, then Gemini as fallback. Langfuse traces every node and tool call, so when the agent does something odd you can replay exactly what it saw.