▗▄▆███▆▄▖
  ▗▟▀    ╋    ▀▙▖
       ◢███◣
 ◢█◣   █◠◠◠█   ◢█◣
 ▐█▌█████╳█████▐█▌
 ▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔

A coding agent that does not need
the keys to your whole machine.

Every action runs through ral, under limits chosen by you and enforced outside the model.

The agent gets one tool

exarch reads code, edits files, and runs tests through one persistent ral session. There is no privileged back door: every action is a program in the same small language, under the same boundary.

ral keeps data as data. Results can be decoded into strings, lists, and records, not split and spliced into another command. Failures can be caught, inspected, and handled.

The session remembers bindings, environment changes, and the working directory between turns. exarch also logs the full conversation, every program it ran, and the complete output.

Permissions, not promises

Telling an agent what not to touch is advice. exarch instead wraps every program in a grant supplied by the host. The model can use that authority, but it cannot edit or remove the boundary around it.

an unrestricted shell tool
# the model supplies the command;
# the command gets your authority
shell("rm -rf build")
shell("curl get.sh | sh")
exarch — ral inside a grant
# the model supplies the program;
# you supply its authority
grant [exec: [git:[], cargo:[]],
       fs:   [read:  ['<cwd>'],
              write: ['<cwd>']],
       net:  false] {
  cargo test -q
}

Start with the smallest useful boundary

Pick a built-in profile for the job, then narrow or extend it with your own ral file if needed. Profiles govern executable programs, readable and writable paths, and network access. ral checks every action; the platform sandbox also confines child processes.

✚ dangerous Full ambient authority. For a VM, container, or hand-written restriction. net inheritexec inherit
✚ reasonable Daily coding. Common tools and network; writes stay in the project, caches, and scratch. net onexec curated toolchain
✚ edit-only Patch and refactor with a smaller tool surface; writes stay in the project and scratch. net onexec git denied
✚ read-only Review and investigation. Project writes are denied; scratch remains available. net onwrite scratch
✚ minimal A small base: project, scratch, system tools, and network, without home-directory reads. net onexec system tools
✚ confined A compact build jail: one project, scratch space, system tools, and no network. net offfs cwd + scratch
Read the profiles →

Bring the model you want

Set an API key or sign in with ChatGPT. exarch discovers available providers at startup, keeps their credentials in its own process, and removes them from the environment before the agent can run a program. Sign in to several ChatGPT accounts and each is separately selectable, even when they share a login email.

anthropic openai chatgpt openrouter deepseek opencode xai qwen + custom / self-hosted

Get exarch

One self-contained binary. The ral shell is built in.

curl -fsSL https://lambdabetaeta.github.io/ral/scripts/exarch-install.sh | sh
macOS arm64 exarch-macos-arm64
Linux x86_64 exarch-linux-x86_64
Linux arm64 exarch-linux-arm64
source lambdabetaeta/ral .tar.gz .zip

Set a provider key, enter the project you want it to work on, and run:

ANTHROPIC_API_KEY=… exarch

Built with funding from the Advanced Research + Invention Agency (ARIA).