协同AI工作流

Install

curl -fsSL https://raw.githubusercontent.com/AndrewDryga/coop/main/install.sh | sh

Downloads the prebuilt coop binary for your OS/arch into ~/.local/bin — no Go, no clone. If a container runtime is present, the installer also builds the sandbox image and runs coop doctor; otherwise do that once yourself:

coop build && coop doctor

Requirements: the installer needs curl, tar, and either sha256sum or shasum. Running Coop needs a container runtime — Apple container (macOS 26+), Docker, or Podman — which Coop auto-detects. The installed coop binary itself is static.

Staying current: coop update self-updates the binary and rebuilds the box image fresh, pulling the latest agent CLIs and ACP adapters (they ship features often) plus a newer base. (Re-running the install one-liner still works.)

<details><summary><b>Other ways to install</b></summary>

git clone https://github.com/AndrewDryga/coop && cd coop && make install   # from source

<details><summary><b>Verifying a download</b></summary>

The one-line command executes the mutable main/install.sh first, so that bootstrap trusts GitHub and the repository's current main branch. The script then requires the release's checksums.txt and verifies the downloaded archive with sha256sum or shasum; it aborts if either the metadata or tool is missing. When cosign is installed, it also authenticates the checksum file to the exact release workflow and requested tag — and, for every release from v2.2.2 on (all of them ship a bundle), refuses to install when the bundle is missing rather than falling back to the checksum alone. Without cosign it says the signature was not verified.

For verification before executing project code, download the release artifacts by hand. Set VER and ASSET for your platform — e.g. VER=v0.1.0 ASSET=coop_0.1.0_darwin_arm64.tar.gz:

```bash base="https://github.com/AndrewDryga/coop/releases/download/$VER" curl -fsSLO "$base/$ASSET" curl -fsSLO "$base/checksums.txt" curl -fsSLO "$base/checksums.txt.bundle"

^ installs the binary, and (if a runtime is present) builds the box + runs coop doctor

cd ~/code/your-repo # 1. any git repo coop init # 2. scaffold AGENTS.md, the .agent/ queue, and the hooks coop login claude # 3. authenticate once (paste-code, no browser; token persists) coop doctor # 4. prove isolation holds (run 'coop build' first if needed)

Quickstart

From nothing to disposable agents draining a task queue, sandboxed:

```bash curl -fsSL https://raw.githubusercontent.com/AndrewDryga/coop/main/install.sh | sh

Agents & config

One box, four agents. Each reads its config and credentials from ~/.config/coop/agents/<name>/, mounted into the box at ~/.claude, ~/.codex, ~/.gemini, and ~/.grok. That directory lives outside any repo, so credentials never land in git — edit those files on the host and they take effect in the box. The folders appear on first run, and each tool's normal user-level config works there as-is — claude/settings.json, codex/config.toml, gemini/settings.json, grok/config.toml. Only the active credential is mounted, so a running agent sees just the account it's using, not the whole vault.

Each run mounts only the launched agent's credentials: coop claude mounts ~/.claude (and that agent's API key from the env file), never the Codex or Gemini ones. The exceptions are runs where the lead is explicitly told to call peers — coop <target> --peer <target>... (including loops and forks) — which also mount the named peers so they can be consulted read-only (only those you name, never everyone signed in). A preset is explicit too: every signed-in provider named by a consult/delegate role ladder is mounted for that role; unavailable rungs are skipped. Raw runs (coop run, coop shell) and maintenance runs (the merge gate, coop doctor) mount no agent credentials at all. coop login <agent> mounts only the agent being signed in.

Blast radius. That credential dir is mounted read-write — the agent must write its session history, and OAuth refresh rewrites the token in place. So a prompt-injected agent can (a) read its own credentials and try to exfiltrate them — set COOP_EGRESS=none to cut the box off the network — and (b) write config its CLI auto-loads next launch (e.g. a settings.json hook), which then runs in future boxes for that credential. (b) stays inside the container — not a host escape — but it's a durable foothold. A fuller fix (copy credentials into an ephemeral in-box location, persist nothing host-side) is planned; for now, COOP_EGRESS=none covers the exfil half.

Command reference

Every command runs against the repo in your current directory. -h/--help works on any of them.

The groups below match coop help — same commands in each, with more of the flags spelled out here (there's room to render them).

Agents

Credentials, models & presets (details)

The box

Forks — hand off work like a PR (details)

Unattended (details)

Tasks — a folder-per-task queue in .agent/tasks/ (details)

Sessions — the local remote-session controller (details)

Services — the box's .agent/compose.yml sidecars (details)

Safety — prove the box holds, catch committed secrets

Set up & maintain

For Zsh, generate with coop completion zsh > "${fpath[1]}/_coop", then source that file after compinit in .zshrc: source "${fpath[1]}/_coop". Existing file-only installs need the source line too; it keeps Zsh spelling correction on globally while marking only coop arguments nocorrect.

1. checksums.txt is signed by the release workflow (keyless Sigstore):

cosign verify-blob checksums.txt \ --bundle checksums.txt.bundle \ --certificate-identity "https://github.com/AndrewDryga/coop/.github/workflows/release.yml@refs/tags/$VER" \ --certificate-oidc-issuer https://token.actions.githubusercontent.com

VS Code

git config --global diff.tool vscode git config --global difftool.vscode.cmd 'code --wait --diff "$LOCAL" "$REMOTE"'