Nano Agent Loop

A tiny Elixir demo of an AI coding-agent loop with exactly one tool: sandboxed bash.

This wraps req_llm and ex_bashkit into a minimal agent loop.

Run

MODEL is required and selects both provider and model:

MODEL=openai_codex:gpt-5.3-codex-spark \
  elixir nano_agent_loop.exs "Create /work/sales.csv, compute revenue by product with shell commands, write /work/report.txt, and show it."

Auth

Auth is handled by ReqLLM. Use its standard provider environment variables or OAuth-file settings:

ANTHROPIC_API_KEY=sk-ant-... MODEL=anthropic:claude-sonnet-4-5-20250929 \
  elixir nano_agent_loop.exs "your task"

REQ_LLM_OAUTH_FILE=./auth.json MODEL=openai_codex:gpt-5.3-codex-spark \
  elixir nano_agent_loop.exs "your task"

ReqLLM also checks application config, .env, and local oauth.json / auth.json files where supported.

Privacy note

This demo sends your prompt, conversation context, and sandbox command output to the configured LLM provider. Do not include secrets, private data, or credentials in prompts or files you ask the agent to create or inspect.

Safety model

nano_agent_loop.exs creates one persistent ExBashkit.Session with:

• in-memory virtual filesystem; files are discarded when the script exits
• no host filesystem mounts
• no host OS process spawning; commands run inside the sandbox
• no network access from the sandbox
• resource limits
• terminal control-sequence stripping before printing tool output

So the LLM can do things like:

mkdir -p /work
cat > /work/file.txt <<'EOF'
hello
EOF
cat /work/file.txt
grep hello /work/file.txt
sed 's/hello/world/' /work/file.txt > /work/out.txt

…but it cannot run arbitrary host executables, access the network, or touch the real filesystem. Any files it creates are virtual and disappear when nano_agent_loop.exs exits. Tool output is untrusted, so nano_agent_loop.exs strips common terminal control sequences before printing it.