The Coding Agent Built
for Kimi, GLM & DeepSeek

The calls of one step whose resource accesses do not conflict — two reads of one file, edits of different files — run concurrently, and their results keep the order of the calls. Identical calls in one step run once.

A large MCP server does not flood the tool table. A server with more than ten tools is deferred: announced by name and description, and loaded with select_tools when the model needs it — except the tools its preload list keeps in the table, which the model holds from the first request. deferred = true/false on a server, or default_deferred under [mcp], overrides the rule.

Past 90 % of the model’s window — 786,432 tokens on DeepSeek, which keeps 256K for output — the model writes a handoff summary: goals and constraints, decisions, commands run and files changed, what is still unknown, and the plan. Your oldest and most recent messages stay verbatim, with the live todo list and a pointer to the replaced lines in the records. A context overrun the provider reports, Z.AI’s 1261 included, takes the same path.

A tool call repeated across steps draws a reminder at 3, 5 and 8 in a row, and on repeats interleaved with other calls; twelve in a row stop the turn. repeat_breaker = false turns both off.

max_turns (--max-turns, RUSTA_MAX_TURNS; default 100) caps a turn’s model round-trips. When it, or the repeated-call guard, stops a turn, the model gets one more step, with tools refused, to say what it completed, what is blocked and what comes next. The result carries a stop_reason.

agent delegates to a sub-agent, and agent_swarm runs many at once — only when you ask for delegation, and swarms only in swarm mode, which you turn on. Delegation nests one level unless max_subagent_depth raises it. Each sub-agent keeps an agent_id and its records, so one that stopped, failed or ran past its deadline can be resumed.

Four profiles are built in — explore and plan (read-only), coder and default — and YAML profiles add your own. Declare [subagent.models] and the delegation tools gain a model parameter, so a file-locating sub-agent runs on a small fast model while the session stays on the flagship. An unknown alias fails the call rather than billing the flagship.

agent takes fork: true: the sub-agent starts from a one-time snapshot of the calling conversation, with its instructions, tools and model, so its first request repeats the caller’s prefix and hits the prompt cache. The agent call that created it is answered as “still executing when you were spawned; outcome unknown”, not left dangling.

write_file overwrites only a file this agent has read and that has not changed on disk since — judged on length, modification time and a content digest, since the first two miss an equal-length rewrite inside one clock tick. edit_file needs its old_string to match exactly once. Creating a file needs no read.

Three modes — default, accept_edits, bypass_permissions — and ordered rules, the first match winning; a compound shell command is matched per segment. Writes to secrets (.env*, .ssh/, *.key, *.pem, …) and git push, reset, rebase, checkout -f and clean -f ask in every mode, --yes included. No command, hook or MCP server Rusta starts sees the variables it reads its API keys from.

In the default and accept_edits modes, bash asks before rm -rf, shutdown, mkfs, wipefs, dd to a device and the like — checked across the whole chain, sudo, sh -c, eval and command substitutions included — and before a command whose name is known only at run time. rm -rf on literal /tmp paths is exempt.

A cloned repository’s .rusta.toml cannot start MCP servers, redirect requests or your key, loosen permissions or reach outside the folder until you trust it, and cannot declare hooks at all. An interactive session lists those settings and asks; a headless run leaves them out and says so. rusta trust trusts a folder ahead of time.

Only you turn plan mode on — /plan, --plan, or plan = true. The agent researches and writes a plan, and every edit waits until you approve the plan in exit_plan_mode’s review, in every permission mode. A headless --yes run has nobody to review it: plan = true from the config is not applied there, and an explicit --plan ends the run with the plan unapproved and nothing edited.

Background commands and sub-agents outlive the step that started them: task_list, task_output and task_stop manage them, and wait_for blocks inside the turn until one finishes. cron_create schedules a prompt, re-injected into this session when it is idle.

No single result floods the context: each is capped at 50,000 characters, with the full output saved to a spill file the model can read. read_file returns 100,000 characters a call by default, with the exact offset to continue from, and images are downsampled to 256 KiB and 2000 px.

Run your own commands on session, turn and tool events — PreToolUse, UserPromptSubmit and Stop can block. Hooks live in your own config only, and fail open, so a broken script never blocks work.

fetch refuses loopback, private, link-local and cloud-metadata addresses, checked after DNS resolution and on every redirect. A fetched page cannot pose as the harness: the system-reminder tags in web results are escaped, and the model is told web content is untrusted data.

Headless (-p) for scripts and CI, with --stream-json events, and an interactive REPL; a terminal UI builds with --features tui. Sessions are JSONL records, written by one process at a time: --resume continues one, rusta fork copies one, and rusta export packs one into a ZIP archive.