Agent Mode
Agent Mode is Codeep's autonomous execution engine. Instead of just answering questions, the agent plans a sequence of steps and executes them — writing files, running commands, checking output, and fixing errors automatically.
How it works
When you give Codeep a task in Agent Mode, it follows this loop:
- 1Plan — Reads project context and breaks task into steps
- 2Execute — Runs each step: edits files, executes commands, fetches URLs
- 3Verify — Checks output — if a build fails or tests error, it attempts to fix them
- 4Report — Shows a summary of what was done
Agent modes
| Mode | Description |
|---|---|
on (default) | Agent runs automatically for every prompt |
manual | Agent only runs when you explicitly use /agent <task> |
Plan mode (/plan + /go)
Before letting the agent touch your files, preview the full plan it would execute. /plan <task> generates a numbered, reviewable plan — files it would touch, commands it would run, risk level it self-assesses — and surfaces it as a chat message. Run /go to execute as-is, or /plan <revised task> to refine before approval.
Personalities (/personality)
Built-in personalities swap how the agent talks and what it prioritises. Custom agents created in Agent Studio go further: the same portable Markdown file can pin an exact provider/model, restrict tool groups, limit project scope, and add tested behavior rules. Older prompt-only personality files remain fully compatible.
Six built-in presets
| Preset | When to use | What it changes |
|---|---|---|
concise | Quick fixes; pair with ship-it for max velocity | Short answers, no preamble, bullet-heavy output, no emojis |
verbose | Learning a new framework, post-mortems, documentation | What / why / alternatives considered / caveats on every change; line-number citations; explicit verification checklists |
security | Auth flows, payments, file uploads, public APIs | Treats every input as hostile, enumerates attack surface in comments, prefers allowlists, lists 2-3 attack scenarios after implementing |
senior-reviewer | Refactoring legacy, architectural decisions, PR self-review | Strong opinions on naming + abstraction, push-back on shortcuts, flags missing tests, suggests alternatives even if user pushed the messier one |
junior-mentor | You're learning, teaching colleagues, writing tutorials | Adds 'why this exists' context, uses grounded analogies, links to canonical docs (MDN / language ref), suggests one follow-up exercise |
ship-it | Hot fixes, demo prep, prototype for tomorrow's meeting | Picks first reasonable approach, inline TODO comments fine, tests happy path only, suggests minimum-viable not robust-for-all-cases |
Basic flow
~/.codeep/config.json as activePersonality. It survives terminal restarts and is shared across every project on this machine. Aliases for clearing: /personality off, /personality none, /personality clear.Combo with plan mode
The high-leverage pattern for sensitive work: set a personality, then run plan mode. The plan you review carries the personality's priorities, so you catch issues before any code touches disk.
Custom personalities
Create one visually in Dashboard → Agent Studio, or drop a Markdown file in one of two locations:
| Location | Scope | Use case |
|---|---|---|
.codeep/personalities/<name>.md | project | Team conventions — commit to repo so collaborators get the same tone |
~/.codeep/personalities/<name>.md | global | Personal preferences across every project on this machine |
Name on disk becomes the slug (filename without .md, lowercased, dashes ok). First line is parsed as the display name; the rest is the prompt addendum the agent receives when active. A custom-bot/v1 frontmatter block turns model, tools, and scope into runtime controls. Prompt-only files without that block keep legacy behavior; the complete section layout written by the earlier Agent Studio is also recognized for compatibility. Files are capped at 64 KB each.
---
codeep: custom-bot/v1
description: Reviews a change against Acme engineering rules
model: openai/gpt-5.6-sol
tools: [files, tests, git, mcp]
scope: selected
projects: [acme-api, acme-web]
---
# Acme Corp PR Reviewer
> Reviews a change against Acme engineering rules.
You are reviewing a PR following Acme Corp engineering conventions:
## Naming
- All async functions end in "Async" (legacy convention)
- React components are PascalCase, hooks start with "use"
- Database tables are snake_case
## Tests
- Every public function needs a unit test
- Integration tests live in /test/integration/
- Avoid mocks for things we own — use real test fixtures
## Comments
- JSDoc on every exported function with @param + @returns
- No inline comments unless explaining "why" (never "what")
- TODO must include ticket: // TODO(ACME-1234): ...
## Anti-patterns to flag
- Throwing from constructors
- Magic numbers (everything except 0, 1, -1)
End every review with: "What I'd test that you didn't" — 2-3 specific cases.Scope and override rules
When two personalities share the same name, the more specific scope wins. So a project file .codeep/personalities/concise.md overrides the built-in concise — but only inside that workspace.
Project (.codeep/personalities/) → wins
Global (~/.codeep/personalities/) → next
Built-in → fallbackRuntime controls
| Field | Behavior |
|---|---|
model | automatic inherits the client selection; provider/model pins an exact available model for the run |
tools | Allowlist of files, terminal, tests, git, web, and registered MCP groups; missing, empty, or malformed v1 metadata means conversation-only |
scope | all, selected project basenames, or personal mode only |
projects | Workspace folder basenames allowed when scope is selected; * and ? wildcards are supported |
What each capability grants
Unselected groups are removed from the runtime tool registry — the model is never offered them, so it cannot call one and be refused. What a selected group covers is wider than its name suggests in one case:
| Capability | Grants |
|---|---|
files | Read, write, create and delete files anywhere in the project |
terminal | Any shell command the client's own allowlist permits |
tests | Recognised test commands only — npm test, pytest, go test, and similar |
git | Git commands — see the warning below; this is not a read-only capability |
web | URL fetching and web search; private and internal addresses stay blocked |
mcp | Tools exposed by MCP servers the active client has registered |
git show HEAD:file and git log -p return the committed contents of any file, so a bot with git but not files can still read your source. The same allowlist permits git rm, git commit and git push, so it can also rewrite the repository and publish that change. What it cannot do is run arbitrary commands — that is what terminal grants. Don't give git to an agent that must only look.codeep schema marker is unavailable rather than being reinterpreted as legacy.Where it works
| Client | How |
|---|---|
CLI TUI | /personality typed directly in the prompt |
Zed (ACP) | Same /personality command in chat — Zed sees the same `availableCommands` |
VS Code extension | Agent selector in the chat toolbar/settings, with /personality as a compatible fallback |
macOS | Native Agent Studio manager plus a compact per-conversation picker |
chat() path used by /agent with agentMode: off, and inline completions) doesn't inject the personality — that's by design since chat replies don't go through the system prompt the same way.User profile (/me)
A durable, human-readable description of you that Codeep injects into the agent's context on every run — so it adapts to how you work without you repeating yourself. Reply language, response style, default stack, hard “always / never” rules. It flows to every surface (terminal, VS Code, Zed) because they all share the same files.
Two layers, two scopes
| File | Scope | What goes here |
|---|---|---|
~/.codeep/profile.md | global | Who you are across all projects: reply language, style, stack, universal preferences |
.codeep/profile.md | project | What this repo is to you: your role, goals, constraints, 'don't touch' areas |
Run /me to view everything, /me init (or /me init project) to scaffold a template, and /me off / /me on to toggle injection. Edit the Markdown files in any editor — there's no schema, just write what matters. Project rules in .codeep/rules.md still take precedence on any conflict.
Let Codeep learn (opt-in)
Turn on auto-learn and Codeep quietly extracts your durable preferences from sessions and merges them into a separate profile.learned.md (global and project), kept apart from your hand-written file so it's never clobbered. One cheap LLM pass at session save, throttled, off by default.
| Command | What it does |
|---|---|
/me learn on | Enable automatic learning (global + project) |
/me learn | Learn from the current session right now (one-off) |
/me learn project | One-off, scoped to this repo |
/me forget | Clear the auto-learned profile(s) |
/me sync (or codeep account sync) — pull is additive, so a web edit never overwrites a local profile. In VS Code, use Codeep: Edit Profile, Codeep: Toggle Profile Auto-Learn, and Codeep: Sync Profile to Dashboard.Sub-agents (delegate · /agents)
The agent can hand a self-contained sub-task to a specialist sub-agent that runs in its own fresh context window and returns only a summary. The win is twofold: your main context stays small (the sub-agent burns tokens exploring; you get the gist), and each sub-task runs with a tuned persona and a scoped toolset.
Built-in agents
| Agent | Tools | What it's for |
|---|---|---|
planner | read-only | Investigates, then returns a concrete step-by-step implementation plan — no code |
researcher | read-only | Explores the codebase / web and returns a tight, cited summary — great for 'how does X work?' without flooding your context |
reviewer | read-only | Senior review of a change: correctness, security, design — cites file:line, suggests fixes |
tester | read + write + run | Writes focused tests for a target, runs them, iterates to green |
Run /agents to list what's available. The agent calls them itself via the delegate tool — you don't invoke them directly:
Your own agents
Drop a Markdown file with frontmatter in .codeep/agents/<name>.md (project) or ~/.codeep/agents/<name>.md (global):
---
name: migrator
description: Writes and runs database migrations
tools: [read_file, write_file, edit_file, execute_command]
model: glm-5.2 # optional model override
personality: senior-reviewer # optional preset to layer on
maxIterations: 12 # optional budget
---
You write safe, reversible DB migrations. Always include a down migration…tools is an allowlist — omit it and the sub-agent inherits all tools; include it and anything outside the list is rejected at dispatch (so a researcher literally cannot write files). Sub-agents inherit your profile and project rules, and their file changes are covered by /undo just like the main agent's.Guaranteed review pass
Turn on Agent Auto-Review in /settings (or set agentAutoReview) and after any agent run that changed files, Codeep automatically delegates to the reviewer and appends its findings — so a review stage always happens, even if the model wouldn't have asked for one. Off by default; one extra read-only pass when on.
Activity insights (/insights)
A retrospective view of what the agent has done for you — runs, tool actions, projects touched, most-edited files — over a configurable window (default 7 days, max 365).
Where the data comes from
Every agent run writes a JSON record to ~/.codeep/history/<id>.json:
{
"id": "1777454909089-19z7tln",
"startTime": 1777454909089,
"endTime": 1777455195496,
"prompt": "Napravi mi listu glavnih stranica…",
"projectRoot": "/Users/vladoivankovic/dev/BuboBall",
"actions": [
{ "id": "…", "timestamp": …, "type": "write", "path": "/path/to/file" },
{ "id": "…", "timestamp": …, "type": "read", "path": "/path/to/other" },
{ "id": "…", "timestamp": …, "type": "execute", "command": "npm test" }
]
}/insights reads every file in that directory whose startTime falls inside the window. No SQL, no telemetry, no upload — pure local.
What you see
| Section | What it shows |
|---|---|
Headline tally | Total runs · total tool actions · total active time · how many days had any activity (out of N) · avg actions per run |
By project | Each repo (basename of projectRoot) with runs / actions / active time, sorted by time. Top 8. |
Top tools | Action types ranked by count (write × 78, read × 64, execute × 32, …). Top 8. |
Most-touched files | Absolute file paths with edit count, ~ prefix for readability. Top 8. |
Recent runs | 10 most recent: relative date (today / 2d ago / 2026-04-29), project, duration, prompt |
Flags
| Flag | Effect |
|---|---|
(no flag) | Last 7 days |
--days N | Last N days (clamped to 1–365) |
--days=N | Same, equals-form |
/insights because the token tracker is in-memory and would lose data across restarts. The current session's cost (including prompt-caching savings) is in /cost. For historical cost, use the codeep.dev dashboard if you're logged in.Confirmation settings
Set Agent Confirmation in /settings to control when the agent asks for approval:
| Setting | Behavior |
|---|---|
always | Ask before every file write and command |
dangerous (default) | Ask before tools marked as dangerous |
never | Execute everything without asking |
When using dangerous mode, you can choose exactly which tools require confirmation via /settings:
| Setting | Default | Description |
|---|---|---|
Confirm: delete_file | ON | Ask before deleting files |
Confirm: execute_command | ON | Ask before running shell commands |
Confirm: write_file / edit_file | OFF | Ask before writing or editing files |
Auto-verification
Set agentAutoVerify to automatically run checks after the agent makes changes:
| Value | What it runs |
|---|---|
off | No automatic verification |
build | npm run build (or equivalent for your stack) |
typecheck | tsc --noEmit |
test | npm test |
all | build + typecheck + test |
Example session
/undo to reverse the last agent action, or /undo all to revert the entire session.