Prime Agent keeps Python, subagents, and goals alive between turns
Prime Agent approaches coding work as a persistent program rather than a sequence of isolated prompts. Its built-in model tool is an IPython environment. File operations, shell commands, subagent calls, tool use, and context handling all happen through code in that environment. An rlm(...) call can start a child agent and return its result to the parent program, which suits research jobs that divide into independent experiments or code inspections.
Sessions can detach from the terminal while the daemon, worker, kernel, schedules, and retained subagents continue. Goals survive turns, heartbeats re-enter work, and bounded autonomous mode can run under token, time, and turn budgets. The README correctly says that hitting a budget is not proof of completion, and a passed quality gate proves only what that gate checks. Those caveats matter for any agent expected to work without someone watching every message.
The installer is short, while provider login and Python state remain
The stable path is a shell installer for macOS or Linux. It downloads a versioned release, checks its SHA-256 digest, installs the command, and can prepare the IPython runtime. The first session then uses /login to select a subscription or API-key provider. Prime Agent starts in the current directory, which becomes the scope for its file and command work.
That convenience should not blur the persistent parts. Background services keep agents alive after a terminal disconnect, and prime-agent doctor can inspect or repair them. Saved sessions can be resumed by path or ID. A clean worktree and a checkpoint are sensible defaults because the model can change files while the user is away. The README itself recommends a disposable clone, clean worktree, or another restore point.
What happened when we ran it
Our unprivileged Node 22 sandbox installed 372 npm packages in 23 seconds and consumed 434 MB on disk. The monorepo build succeeded in 13 seconds. Npm audit reported 4 known vulnerabilities: 0 critical, 2 high, 2 moderate, and 0 low. Those findings need package-level review before a team permits long-lived background processes on developer machines.
The test command ran for 567 seconds and exited with code 1. Its final Node test output said 750 tests passed, 0 failed, 0 cancelled, 0 skipped, and 0 todo across 126 suites. The summary's own duration was about 8.2 seconds, while the outer measured step lasted much longer. The supplied tail contains no error after that summary, so it does not identify which surrounding check or process caused exit 1.
That mismatch is a finding, not a license to call the suite green. commit e319a66 installed and built, and the visible Node tests all passed, yet the command our harness invoked failed. The checkout had 1,194 files, about 375,941 source lines, and used 20.8 MB before dependencies. It included 6 CI workflow files, no Dockerfile, no top-level tests directory, and npm workspaces.
Model-generated Python runs with the user's permissions
Prime Agent's most important documentation is its warning. Model-generated Python and project commands execute with the user's permissions. Worker and kernel processes improve lifecycle isolation and recovery, but they are not a security sandbox. Untrusted repositories, instructions, skills, or extensions can therefore reach whatever the user account and surrounding environment permit.
The persistent REPL raises the stakes because state can outlive one exchange. Imported skills are executable Python packages. Agents can communicate directly, schedules can restart work later, and autonomous mode can continue without a fresh prompt. Use an external sandbox or restricted environment for unknown code, keep credentials out of the workspace, and inspect the process after detaching. A daemon is useful continuity, not containment.
Refinement changes supplemental state and preserves rollback snapshots
The continual harness can store prompts, memories, skill descriptions, and reusable subagent specifications. /refine reviews a trajectory and may make focused updates to that supplemental state. The immutable base system prompt stays fixed, and recorded snapshots allow rollback. That is a better design than silently rewriting the entire instruction stack, but teams still need to review what changed.
A successful local trick can be too specific for later tasks. A remembered instruction may also preserve a mistaken assumption or an unsafe command pattern. Refinement history should be treated like configuration history: small diffs, named evidence, and a clear reason to keep each item. Packaging a new executable skill remains a separate act, according to the README, which is the right distinction between remembering guidance and installing code.
Version 0.8.1 is active and the runtime is still changing
GitHub recorded 18,565 stars, 92 combined issues and pull requests, and a last push on August 26, 2026. Version 0.8.1 was released the same day. It raised the default maximum RLM recursion depth for new sessions from 1 to 2, adjusted ACP behavior around subagent completion, and changed one gateway's default model after its catalog shifted.
Open pull requests on August 26 included a proposed move away from IPython and ZMQ toward a smaller CPython REPL runtime. That work shows active engineering, but it also touches the central execution model described by the current README. Users building extensions around kernel behavior should pin a release and read upgrade notes rather than tracking main casually.
Prime Agent has a specific advantage for long research jobs: subagents, state, schedules, and goals are part of one programmable harness. Our 750 passing Node tests show substantial covered behavior, while exit 1 and 4 audit findings block an easy production recommendation. Run it in a disposable environment, start with narrow provider credentials, and prove detach, resume, cancellation, and rollback before trusting a week-long autonomous task.