Four approaches to the identical downside – from custom diffs to 9-technique fallback cascades. OpenCode also implements modifying as a device (software/edit.ts), with nine fallback matching strategies: precise match → line-trimmed → block-anchor → whitespace-normalized → indentation-versatile → escape-normalized → trimmed-boundary → context-aware → multi-prevalence (for bulk replacements). OpenCode has a doom loop detector. The approaches vary from OS-stage course of isolation (Codex sandboxes every command in a bubblewrap namespace with seccomp filters) to platform-particular containers (Gemini CLI uses macOS Seatbelt or Docker) to command-level analysis (Mistral Vibe parses commands with tree-sitter earlier than executing) to nothing in any respect (OpenCode relies solely on user approval prompts). Codex assumes the model is perhaps adversarial – an inexpensive assumption if you’re building for millions of customers working untrusted prompts. As I wrote in my notes: “The permission prompts aren’t a formality. Claude Code is still second. Claude Code is closed-supply, so I couldn’t do the same architectural deep dive – but it’s included in the benchmark because ZAI supplies an Anthropic-suitable endpoint that runs it natively with none fork. The benchmark evidence supports this: agents with more forgiving edit tools scored higher on the same model. Both colleges face the identical basic challenge: LLMs make small mistakes.

But everything else is blocked – even if the method someway escapes the bubblewrap namespace, it still can’t make network connections. A key detail: when even the compaction immediate doesn’t fit, Codex trims from the start of the historical past. Phase 1 sends the rollout to the mannequin with a structured prompt asking for outcomes, key steps, issues that didn’t work, and reusable information. If the mannequin hallucinates rm -rf / or a prompt injection tips it into exfiltrating your SSH keys, what stops it? However the customized format nonetheless demands the model produce structurally legitimate patches. The open-supply device Aider pioneered this approach, demonstrating that models skilled on structured diffs could edit recordsdata efficiently. But job errors are signal – the model genuinely can reason about “file not found” and self-correct. These collisions and their penalties, good and dangerous, are the focus of this paper. The design assumption: the model should deal with the duty, not on debugging the scaffolding. Exhibiting errors lets the model self-correct, however exhibiting each error dangers confusing it with noise.

Codex does have fuzzy matching, but it only handles whitespace-level differences; the custom patch format itself remains to be a barrier for non-frontier models. Infrastructure handles the whole lot silently. Infrastructure errors are noise – exhibiting the model “connection reset by peer” helps no person. It’s not an edge case handler – it’s load-bearing infrastructure that runs on every edit. A coding agent runs shell commands in your machine. The bash tool uses tree-sitter to parse commands into an AST for allowlist/denylist checking (smarter than regex – it catches echo foo && rm -rf / that string matching would miss). ’t match the file content material after all three methods fail, the edit device calls gemini-2.5-flash by way of a devoted llm-edit-fixer config to fix the string matching. This is the reason Codex’s customized format works beautifully for GPT (which is fine-tuned on it) but poorly for GLM-4.7 (which isn’t). But it surely means switching between agents isn’t only a UX change – it’s a safety posture change. Only if pruning isn’t enough does it run a full LLM compaction via a devoted compaction agent. When the token rely crosses a configurable threshold (default 200K), the AutoCompactMiddleware triggers an LLM name to summarize the conversation earlier than hitting the API restrict. The approaches cut up into proactive (compress before hitting the restrict), reactive (compress after hitting it), and hybrid (low cost pruning first, LLM summarization if needed).

Compaction is actually summarization beneath strain: replace the complete historical past with a shorter version that preserves what matters. The difference between proactive and reactive compaction compounds over multi-step problems. All 4 agents remedy these problems. I forked three of those brokers to add GLM-4.7 help. This is defensive engineering that the majority brokers skip. The second is diff-based mostly editing: the mannequin produces structured edit blocks inside a instrument name – diff-like formats with markers delineating old and new code. Flash evaluates whether or not the dialog is productive, with Pro providing a second opinion if confidence exceeds 0.9). The double-test sample for loop detection is intelligent – falsely stopping a productive agent is worse than letting a stuck one run just a few more turns. When rate limits persist (429 errors), it falls back to a special mannequin solely – if Pro is throttled, it switches to Flash and retains working. The mannequin by no means sees any of this. Should the model see its personal failures?