You'd build your own agent for the control.
You use Claude Code for the quality.
CommandSuite runs Claude Code and OpenAI Codex on hardware you own, with what you'd only get from a custom build: a roster shared with your humans, objectives with a required definition of done, and a record of every LLM call. The labs keep improving the agents. You keep command.
Node 22+ · wraps the claude and codex CLIs you already
have, using their existing logins. csuite needs no API keys of its own.
# one process, SQLite, nothing else to stand up $ npm install -g csuite $ csuite serve ✓ first run — wizard creates your team, admin member, TOTP → http://127.0.0.1:8717 # wrap an agent as a long-lived team member $ csuite claude-code ✓ briefing · trace capture · mcp-bridge ● builder online · awaiting objectives
If this mock doesn't match what you see, file a bug.
Frameworks cap your agent at the quality of your scaffolding. The frontier CLIs are better than what most of us can build and maintain — but they're closed boxes with no team, no contract, and no record. Pick a column.
| Build your own | Claude Code · Codex | + CommandSuite | |
|---|---|---|---|
| Agent quality | Capped by your scaffolding | Frontier | Frontier — it's the same CLI |
| Wired into your systems | Yes — that's why you built it | No — it's a terminal program | Webhooks, shared toolbox, server-held secrets |
| Every LLM call on the record | You instrumented it | Closed box | From the agent's own telemetry |
| On a team with your humans | Sort of | No identity at all | One roster, one auth layer |
| Delegation contract | Whatever you wrote | A prompt and a prayer | Required --outcome, audit log |
| Upkeep | Yours, forever | The lab's problem | The lab's problem |
Everyone in this space wants to sell you a better agent. The agents are fine. What's missing is the part around them: the roster, the assignment, the receipt.
You can't assign vague work — the server refuses the command. Every objective carries a definition of done that rides in the agent's tool descriptions and is re-briefed after restarts and context compaction.
$ csuite objectives create --assignee builder \ --title "Migrate CI to composite actions" objectives create: --outcome is required (the tangible definition of "done") $ csuite objectives create --assignee builder \ --title "Migrate CI to composite actions" \ --outcome "main green on new workflow; old YAML deleted" ✓ obj-4f21 assigned → builder
"Migrate CI to composite actions" outcome: main green on new workflow; old YAML deleted ───────────────────────────────────── 22:03 assigned andrew → builder 02:14 blocked "AWS_ROLE_ARN unset in repo secrets — need a human" 08:36 unblocked andrew 09:52 completed "Workflow migrated, 3 runs green, old files removed" ───────────────────────────────────── trace panel · 47 llm_exchange · $1.84
Four states, store-enforced: active → blocked → done | cancelled. Completion
requires a written result. Every transition lands in an append-only log.
The frontier CLIs are built to run while you watch. The command layer cuts the tether: agents keep working on a box you own, interruptions are triaged, and your phone buzzes when an agent asks for a human — and stays quiet otherwise.
blocked with a reason, and DMs
you — DMs always reach your phone through Web Push. Agents that are fine stay silent.
You answer from the chat thread and go back to sleep.
Working agents are still reachable: messages land inside the live session — an MCP
notification for Claude Code, turn/steer for Codex — no polling loop, no
restart. A teammate who has never touched your terminal DMs builder from the
web UI and watches its status flip to working.
Capture comes from the agents' own instrumentation — Claude Code's OpenTelemetry export and hooks, Codex's session records — normalized into one activity model and secret-redacted before it's stored. Works the same against Anthropic direct, Bedrock, Vertex, or a custom gateway, because it instruments the agent, not the wire.
"Trace capture no longer intercepts TLS — the MITM proxy is removed"
"The MITM proxy, per-session CA, HTTP/1.1 reassembler, host allowlist, and the
— SECURITY.md, shipped with the repo--unsafe-tls/NODE_TLS_REJECT_UNAUTHORIZED=0escape hatch are all deleted. The runner never injects proxy or CA environment variables and never touches the agent's TLS trust store. … The agent's outbound TLS is never decrypted."
Full visibility, minus the part you were right to be suspicious of. The same file publishes a known-limitations list — redaction is pattern-based, and it says so.
Humans sign in with TOTP. Agents authenticate with bearer tokens. Both resolve through one auth layer to one member record — same channels, same DMs, same roster, same live presence. Not a bot integration. One org chart.
● andrew human · director online ● builder agent · operator working ⠋ ● scout agent · operator blocked — needs a human ○ reviewer agent · viewer offline
Presence is turn-accurate — working means mid-turn right now, model call or
tool run, driven by the agent's own instrumentation rather than a liveness guess. Any
member with objectives.create can push work to anyone: CLI, web UI, or
another agent.
The parts you'd have built around a custom agent — event ingress and credential handling — come with the layer.
?level=critical&if_busy=now punches through, routine news can wait
its turn. Every delivery leaves a receipt you can replay.
env leaks
[REDACTED] into its own record, not your key. Rotate once; every runner
picks it up on restart.