AJ NiPlexAdarsh Jaiswal

Home / Projects / NiPlex-Harness

Private · In developmentPythonDiscordTelegramSandboxAgents

NiPlex-Harness

A personal AI agent you run from Discord or Telegram. Also known as Kaizen Manas, with the agent itself named Manas. The name joins kaizen (continuous improvement) and manas (Sanskrit for mind), and replaced NiPlex Harness on 17 September 2026. One Python process built for a single owner and for free hosts with no PC, so your phone is the control panel. It keeps notes, searches the web and runs Python in a resource-limited sandbox, and it stops at approval buttons before anything risky. The current source is private; this page describes what it does. An older public snapshot is on GitHub.

Tools61 in 13 switchable groups
Chat appsDiscord, Telegram
Code executionLimited sandbox + approval buttons
Tests484, run on Python 3.12 and 3.13

What it does

Set up from chat

Manas, the purple axolotl plush, waving hello
Saying hello: the first thing you do is chat with it
  • /setup walks through provider, API key and model. The model list comes from the provider's own API, and you can answer with a number, an ID or random.
  • Providers: Agnes, Google Gemini, OpenAI, OpenRouter, any OpenAI-compatible endpoint, and Anthropic through an OpenAI-compatible proxy.
  • The bot tries to delete the chat message that holds your API key. The key is saved in a local file that is never committed.

What the agent can do

  • Memory: notes kept globally or per chat, keyword search, semantic search through Gemini embeddings, a small knowledge graph, search across past sessions and a timestamped event log.
  • Terminal: run Python in the sandbox, keep several terminal sessions open and reset the sandbox's installed packages.
  • Files and vault: create, edit and delete files inside folders, with an Obsidian-ready vault. Files are never written to the project root.
  • Skills: write, load and search reusable skills in personal, market and custom folders.
    Manas reading a book in a cosy room at night
    Skills are short guides the agent reads and reuses
  • Web: DuckDuckGo search with no API key, and page reading that refuses private and cloud-metadata addresses.
  • Also: scheduled jobs, sub-goal tracking, GitHub tools (off by default), push notifications, offline voice replies (off by default) and a to-do list and clarify question for long tasks.
  • Every group can be switched on or off by asking the agent, so it only sees the tools you want it to have.

Safe by default

  • Only numeric user IDs on the allow-list can talk to it. An empty list lets nobody in.
  • Risky code stops at Allow Once, Allow Session, Always Allow (that exact command only) or Deny buttons. Waiting approvals survive a restart.
  • /allow opens a 5, 10 or 30 minute window with no prompts, then closes it by itself.
  • The sandbox runs with a scrubbed environment, so tokens and keys are not passed in, plus limits on memory, CPU time, file size, open files and processes. A timeout stops the whole process group.
  • Secret Vault: store a secret once and write {=NAME=} in code. The value is filled in at run time and removed from the output before the model sees it.
  • Scheduled jobs that run on their own can only use read-only tools.
  • Web results and saved skills are screened for prompt-injection phrases and hidden characters. The harness's own code is hard-blocked from the agent's file tools.
  • Crash reports to GitHub are off unless you turn them on, and secrets are stripped first.

Keeps itself running

  • Auto-deploy (needs a GitHub token): a supervisor checks the deploy branch about every two minutes, rejects code that does not compile, restarts on the new commit and rolls back if the bot crashes within two minutes of a deploy.
  • A crash restarts the bot with growing delays, from 5 seconds up to 5 minutes.
  • Long chats are compressed in the middle so the history stays inside the model's limit.
  • Settings live in .env: GATEWAY, the bot token, the allow-list IDs, SANDBOX_MODE (builtin or external), SANDBOX_TIMEOUT (60 s by default) and SANDBOX_MAX_MEMORY_MB (512 by default).

Merged in October, rolling out

Manas watering a small seedling in a garden
Kaizen: small, steady improvement
  • Live progress in the chat: one line per tool call, the agent's text before a tool call sent as it happens, long replies split instead of cut off, and 25 tool rounds per message by default.
  • A persistent shell terminal, a group of 5 tools. It keeps its state between commands and runs any installed language. Off by default; only the owner can switch it on in .env, never from chat. Risky commands use the same approval buttons.
  • Model routing: small, medium and power tiers, each one model plus up to three fallbacks, set with /routing. With a power model set, hard jobs can be handed over automatically, or you use /model and /escalate.
  • /ui shows each kind of button, menu, poll and card the bot can send. Normal replies do not use them yet.

How a message is handled

ReceiveA message arrives from Discord or Telegram. Anyone who is not on the allow-list is ignored. Messages in the same chat are handled one at a time, in the order they arrive.
ThinkThe agent sends the chat and the tools that are switched on to your chosen model. One message can use up to 25 rounds of tool calls.
CheckRisky code or commands pause with approval buttons. Safe ones run straight away.
ActTools use the sandbox, the vault, memory or the web, and the results go back to the agent.
ReplyThe answer returns to the chat, with files attached when needed.

Commands

/setupChoose provider, API key and model.
/helpShow usage help.
/resetClear the current chat session.
/allowSkip approval buttons for 5, 10 or 30 minutes.
/routingModel tiers and automatic escalation.
/modelSee or pin the model tier.
/escalateSend a task to the power model.
/uiShow the UI styles.

Boundaries

  • It is a personal harness for one owner, not a hosted multi-user service.
  • The approval gate, file protection, content screening and secret removal are checks that catch real mistakes. They are not a security boundary. The real boundary is the host or container it runs in.
  • The built-in sandbox is a limited subprocess on the same host, not a container or a virtual machine. An external sandbox service can be used instead.
  • Sub-agents are named trackers for a sub-goal, not separate running agents.
  • Connecting outside MCP servers is scaffolding only and is not yet part of the agent loop.
  • Semantic memory search needs a Google key and falls back to keyword search without one.
  • Merged features are in the private main branch; a bot has them only after it updates and restarts.
  • The current source is private and the public repository is an older snapshot, so the snapshot does not match everything on this page.