Gitlawb Zero is an MIT-licensed terminal coding agent that answers to you — your model, your machine, your rules. Published as npm package @gitlawb/zero, it gives developers durable local sessions with full model choice and a decentralized git network.
What Makes Zero Different
Zero is built around the principle that you should own your coding agent completely. It runs locally, stores session data on your machine, and supports any model provider you choose.
Model Freedom — Bring OpenAI, Anthropic, Gemini, Groq, OpenRouter, DeepSeek, Mistral, xAI, Qwen, Kimi, GitHub Models, Ollama, LM Studio, or any OpenAI-/Anthropic-compatible endpoint. No lock-in. This is the widest model support of any terminal agent — where Claude Code locks you to Anthropic and Codex locks you to OpenAI, Zero treats every provider as a first-class citizen.
Durable Sessions — Sessions persist locally. Close the terminal, come back tomorrow, and your agent remembers the context. This is powered by a local session store that keeps conversation history and working state between runs. Unlike cloud-based agents where context resets on disconnect, Zero’s sessions are yours as long as the files exist on disk.
Decentralized Git Network — gitlawb is building a decentralized git network where AI agents and developers share workflows, generate apps, publish code, and open PRs on a peer-to-peer infrastructure. This is a fundamentally different approach from platform-bound agents.
Security posture
Zero’s security story has matured fast. The v0.4.0 release closed a sandbox bypass where a cloned repo could re-enable MCP servers that were explicitly disabled — the kind of privilege-escalation bug that matters when agents run with filesystem access. Permission payload validation, stale-lock DoS prevention, and a Windows taskkill hijack fix all shipped in the same batch, signaling that the team treats least-privilege as a design constraint, not an afterthought. For comparison, the coding-agent security checklist for 2026 lays out the broader threat model Zero’s sandbox hardening addresses.
The Hermes credential-guard and provider-isolation piece covers how a different project approaches the same boundary — separating what the agent can read from what it can write. Zero’s approach is more aggressive: deny-by-default, explicit allow, with a lock file that tracks granted permissions across sessions.
Architecture
Zero’s architecture is intentionally simple compared to framework-heavy agents. There is no plugin marketplace, no extension API, no runtime injection layer. The TUI is the interface, the session store is the persistence, and the model provider is configured at install time (or switched per-session with --model).
zero Interactive TUI mode
zero --one-shot Single-shot query mode
zero --model <model> Specify model providerThe --one-shot mode is useful for scripting and CI integration: pipe in a prompt, get a response, no interactive session created. This makes Zero usable as a subprocess in larger automation pipelines without the overhead of maintaining a persistent agent session.
Installation
npm install -g @gitlawb/zero
zeroSupports Linux, macOS, and Windows on x64 and arm64 — and, as of the latest release, Android via Termux (see the Termux support writeup). The Termux port is notable because it means Zero runs on a phone — a use case no other major terminal agent supports.
Where Zero sits in the market
Zero is closest to Kilo in philosophy — prioritizing simplicity and user ownership over framework complexity. But it adds durable sessions and the broader gitlawb decentralized network, making it more ambitious in scope. For teams that value model freedom and local control above all, Zero is compelling.
The gitlawb-zero vs Codex comparison frames the local-first-versus-cloud-parallelism divide directly. Codex gives you parallel cloud workers and a managed infrastructure; Zero gives you ownership and portability. The choice depends on whether you trust the cloud to be available when you need it.
The Hermes Agent vs Gitlawb Zero comparison draws the same line from the automation angle: Hermes is the platform with cron, memory, and orchestration; Zero is the tool with sessions and model freedom. Different bets on what “agent ownership” means.
Recent improvements
The development cadence has been aggressive. Recent releases shipped auto-commit messages (so the agent proposes commit messages based on the diff it just created), context preservation across exec prompts (the agent remembers what it did when you interrupt and redirect), and a provider-picker terminal UX that makes switching models mid-session a single keystroke instead of an environment variable edit. The –auto commit messages feature and the runner-hang fix round out the picture of a project optimizing for trustworthy, owned-by-you daily use. On the horizon, cross-session messaging — merged to main in August — lets live Zero sessions discover each other and exchange messages under an explicit accept/hold/refuse inbound policy.
What’s new in v0.6.0 (July 29, 2026)
Zero v0.6.0 is a release where privacy and reliability lead. If you are new to Zero, the sections below are the ones worth reading — each one is a small thing that makes a terminal agent feel safer to run.
Persistent session goals. You can now tell Zero something you want to keep in mind — for example, “always keep dependencies pinned” or “never touch the database folder” — and it stays active across sessions instead of vanishing when you close the terminal. For beginners this is the closest thing to writing your own .gitignore for agent behavior: set it once, and every future session inherits the rule. It’s implemented as a goal stored with the session, so the agent checks in when a task might conflict.
Credential privacy. The sandbox now blocks reads of git’s credential stores. That means files storing saved Git tokens (like ~/.git-credentials or platform equivalents) are off-limits unless you explicitly approve a read. Terminal agents often need git push, but they do not need to exfiltrate the tokens behind it — this closes exactly that class of “agent leaks my GitHub token” accidents.
Sandbox writes are serialized. A platform-specific write lock now guards the grant-state file. In plain terms: if two agent processes both try to update the permission list at the same moment, they can no longer corrupt the file and lose the rules you approved. For beginners running Zero as a daemon or inside CI, this removes a whole family of “my approvals disappeared” bugs.
Windows cleanup. On Windows, killing a provider command now kills the full process tree via a job object, so canceling a model call no longer leaves orphaned helper processes burning CPU in the background. Small, but it is the kind of thing you only notice when your task manager shows three leftover node processes.
Tighter provider plumbing. Providers that fail before a request is even sent are now retried instead of surfacing an error. Fireworks AI gets an official provider preset, joining the existing presets. Provider-command timeouts are treated as an upper bound (a fixture can bill beyond the 5-second default), and the process-management fixes apply on all platforms.
Atomic cron jobs. Zero’s built-in cron reserves job IDs atomically, so scheduled tasks cannot accidentally claim the same ID and overwrite each other’s state.
The v0.6.0 release continues the hardening arc that started v0.4.0 — sandbox bypasses, permission payload validation, and stale-lock prevention. The theme is consistent: an agent you own should also be an agent that withholds your data.
What’s new in v0.7.0 (August 10, 2026)
The next release jumped from privacy to capability. v0.7.0 gives tool results an image channel plus a view_image tool — the agent can finally look at the screenshots it captures instead of just writing them to disk — and adds PermissionModePlan, a read-only planning mode (CLI --plan) where mutating tools, local commands, and executable hooks are all refused while the agent studies the codebase. The same release hardened the sandbox against reading Zero’s own credential stores, fixed the Windows write jail honoring “Everyone”-granted paths, and made OpenRouter/OpenGateway model lists load live. It also closed a secret-redaction leakage bug. For the beginner-friendly walkthrough of everything in the release, see Gitlawb Zero v0.7.0 gave its agents eyes.
Unlike agents tied to a specific platform or CI/CD system, Zero works everywhere and answers to no one but you. For developers who want an agent that behaves like a local tool rather than a cloud service, Zero is the strongest option in the terminal agent category today.