v1.1.0

aikido v1.1.0 adds a virtual bash for agents and turns aikido agent into an unattended worker. There are no breaking changes to the v1 API.

New

• tools/shell: a virtual bash over any vfs.Storage (wiki).
  • The model writes ordinary bash: pipes, loops, redirects, globs, here-docs, <(...).
  • The interpreter is mvdan.cc/sh. Every file access goes to the store, so overlays, dry runs, mounts and hidden-path policy keep working.
  • About 50 commands are written in Go with GNU flags, output and exit codes: cat, ls, find, xargs, cp/mv/rm, grep, sed, awk (goawk), jq (gojq), sort, uniq, cut, tr, diff, head/tail, wc, paste, base64, sha256sum and others.
  • CI compares them against GNU in Docker: 373 text cases and about 100 shell and file-command cases.
  • Nothing of the host is reachable: no host files, environment, network or processes.
• shell.External: host programs you allow (git, kubectl).
  • Each runs in a fixed directory that follows the script's cd, with a complete environment of its own.
  • Options: a per-call Allow policy, a timeout, and a process-group kill.
• Resource and safety bounds:
  • /tmp, process-substitution files and unstored output share one memory budget per shell.
  • Text commands bound their input or stream it.
  • Panics in the interpreter become a failed command, never a crashed host.
  • The timeout stops every loop.
• osfs.Options.RefuseSymlinks.
• aikido agent as an unattended worker:
  • --shell gives the agent the virtual bash, over the overlay unless you add --direct.
  • --direct --allow git --allow kubectl --env KUBECONFIG add host programs. Paths mean the same to the shell and to them, because the workspace is mounted at its real path.
  • An allowed git refuses options that run programs (-c, --upload-pack, ...).
  • --system-file CLAUDE.md appends the repo's instructions to the system prompt.
  • With --hide-hidden (the default), .env, .git and symlinks stay out of reach of every tool.
• examples/loki-agent: a log analyst over Grafana Loki: discovers labels, stores LogQL results in an in-memory workspace, analyzes them with the virtual bash and reports findings, likely cause and next queries.
• The CLI's [usage] line shows cache read and write tokens.

Benchmark

• Coding tasks: the virtual shell gets almost all of a real shell's gain on shell-shaped tasks, 42 instead of 300 tool calls, without host access.
• ICM ops-worker suite (workbooks, git, fake cluster, fake Loki), Claude Haiku 5.5: aikido agent --direct --shell --allow ... solved 11/12 like Claude Code on the same repo, 17% faster and 36% cheaper (results).

Review

• Dual review: three rounds by Claude Fable 5.1 high and Codex gpt-6-astra high.
  • Round 1: 7 BLOCKERs, among them host escapes through the interpreter's FIFOs and eval'd process substitution, panics that killed the host, and a cleanup that ran script code.
  • Round 2: 1 BLOCKER.
  • Round 3: none.
  • The last MAJORs were fixed or documented as limits (Shell wiki, Known limits).
• Upstream: a negative shift in mvdan.cc/sh panics; aikido guards it, and an upstream report is still to be filed.

v1.0.0

aikido v1.0.0 is the first release under github.com/govengers/aikido and the successor of github.com/mxcd/aikido v0.12.0. The exported API is now a semver contract.

go get github.com/govengers/aikido@v1
go install github.com/govengers/aikido/cmd/aikido@latest

Breaking: read the migration guide. No compatibility aliases. Change the import path, then follow the compiler through the rename table; the "Behaviour changes" table lists what compiles unchanged but acts differently. Hub users (v0.3.x): see "Coming from v0.3.x".

New

• In-memory agent harness with external file connections.
  • vfs/overlay: copy-on-write over any store, with Changes, Commit, Discard and UnifiedDiff.
  • vfs/mount: several stores combined by path prefix.
  • The CLI aikido agent --dir <path> [--apply] [--mount name=path[:ro]] edits a real directory as a dry run, and writes only with --apply after a run that ended normally.
• Agent loop limits and caching.
  • ToolCallTimeout, default 2 min.
  • Tool results bounded at MaximumToolResultBytes, default 64 KiB; the caller keeps the full result.
  • Prompt-cache breakpoints, on by default; turn off with DisablePromptCaching.
  • Empty replies are not stored, and tool panics become tool errors.
• Tools.
  • New: multi_edit, move_file, todo_write (agent.RegisterPlanTool).
  • read_file output is numbered and windowed.
  • Dispatch checks required arguments.
• OpenRouter errors. openrouter.APIError, llm.ErrInvalidResponse, and bounded reads and stream caps.
• Standards and docs.
  • Built to govengers/standards (library profile): lint 0, race tests, coverage 94%, an end-to-end suite against a fake OpenRouter and the real CLI binary, govulncheck.
  • Docs in the wiki, mirrored from docs/wiki, and in llms.txt.

Fixed

About 60 defects, found by the standards sweeps and by three rounds of dual review (Claude Fable 5.1 high and Codex gpt-6-astra high, both approved in round 3). Each has a regression test. The main ones:

• A panicking tool or client crashed the host process.
• A cancelled run that nobody read kept the session lock.
• A case-only move_file lost the file on case-insensitive filesystems.
• Images generated by the model broke every later request of the session.
• Cancellation was reported as ErrServerError and retried.
• A Codex token refresh could be replayed, which revokes the login.
• Unbounded provider reads.
• Video submits were retried and billed twice.

Benchmark

aikido against opencode on 12 coding tasks, 144 runs: same pass rate, faster median (results). A shell tool is deliberately not part of v1 (ADR-041).

Licence

Apache 2.0 (was MIT).