Build Autonomous Coding Agents

A reference skill of design patterns for building autonomous coding agents, modeled on Cline and OpenAI Codex. It covers: the core agent loop (Think, Decide, Act, Observe) with a max-iteration cap; a multi-model architecture that routes tasks to different models (a fast model for planning, a powerful model for complex reasoning, a code-specialized model for generation); a Tool base class with a JSON-schema property plus concrete tools like ReadFileTool and a search/replace-based EditFileTool that validates expected occurrence counts before writing; a permission system with four levels (AUTO, ASK_ONCE, ASK_EACH, NEVER) mapped per tool, and an ApprovalManager that caches session-level approvals and assesses per-call risk, flagging shell commands containing rm -rf, sudo, or chmod as HIGH risk; sandboxed execution restricted to an allowlist of commands and a workspace directory with blocked system paths; browser automation via a Playwright-based BrowserTool (navigate, click, type, extract visible text) plus a VisualAgent that uses a vision-capable model to locate and click elements from a screenshot rather than a CSS selector; a ContextManager implementing Cline's @-mention pattern (@file, @folder, @url, @problems) to assemble prompt context; checkpoint and resume support for long-running sessions, persisting history, context, and git ref/dirty state; and dynamic MCP server discovery plus an "add a tool that..." flow that generates and hot-reloads a new MCP server from a natural-language description using the FastMCP framework.

Use this skill when designing or reviewing the architecture of an autonomous coding agent - its tool-calling loop, permission model, sandboxing, or context-injection system - especially one inspired by Cline- or Codex-style CLI or IDE agents. It is a reference of patterns and illustrative code, not a library to import: treat every snippet as a starting point to adapt, not production-ready code. Do not use it for building simple, single-turn LLM calls or tasks with no tool execution - the permission and sandboxing machinery only pays off once the agent can actually read, write, or run things. Skip the browser-automation and MCP sections entirely if the agent has no need to control a browser or dynamically add tools.

The skill's best-practices checklist reinforces the same priorities beyond the code samples: audit logging for every executed action, and undo/rollback availability, are both called out as required safety properties alongside the permission system itself, not optional extras.

Design guidance and Python code sketches, not a runnable package. Consumers bring their own LLM client, tool implementations, and storage; the patterns define shapes - a Tool base class with a schema property and execute() method, a ToolResult return type, a PermissionLevel enum, checkpoint JSON with history, context, and workspace state - rather than a finished SDK.

class PermissionLevel(Enum):
    AUTO = "auto"
    ASK_ONCE = "ask_once"
    ASK_EACH = "ask_each"
    NEVER = "never"

PERMISSION_CONFIG = {
    "read_file": PermissionLevel.AUTO,
    "list_directory": PermissionLevel.AUTO,
    "search_code": PermissionLevel.AUTO,
    "write_file": PermissionLevel.ASK_ONCE,
    "edit_file": PermissionLevel.ASK_ONCE,
    "run_command": PermissionLevel.ASK_EACH,
    "delete_file": PermissionLevel.ASK_EACH,
    "sudo_command": PermissionLevel.NEVER,
    "format_disk": PermissionLevel.NEVER
}

References Playwright/Puppeteer for browser control, the Model Context Protocol (MCP) for dynamic tool discovery and creation (including a FastMCP-based server generator), and vision-capable LLMs for the screenshot-driven VisualAgent. Points to Cline, OpenAI Codex, the MCP spec, and Anthropic's tool-use docs as the source patterns it distills.

Engineers building or hardening an autonomous coding agent - CLI tools, IDE extensions, or agentic backends - who need concrete patterns for the think/act loop, tool permissioning, sandboxing, and context assembly rather than starting from a blank page.