CodeBuddy | Blog

Building an Autonomous Coding Agent with LangGraph Deep Agents

Fri, 03 Apr 2026 00:00:00 GMT

This post accompanies my talk at AI Salon KL – April 2026. If you’re reading this after the event, welcome — the architecture hasn’t changed.

The single-loop trap

Most AI coding assistants follow the same pattern:

User message → LLM → tool call → LLM → response

This works for simple tasks. But ask it to “refactor the authentication module to use OAuth2” and it falls apart — the model tries to hold the entire plan, all file contents, and every decision in a single context window. It forgets steps, loses track of changes, and hallucinates file paths.

The fundamental problem: a single LLM loop cannot reliably execute multi-step tasks.

The Deep Agents approach

Deep Agents is LangChain’s framework for building agents that go beyond shallow tool-calling. It provides four primitives that change the game:

graph LR subgraph Deep Agents Primitives A["🗓️ Planning (TodoListMiddleware)"] --> B["🔀 Subagent Spawning (SubAgentMiddleware)"] B --> C["📁 File System (FilesystemMiddleware)"] C --> D["📝 Rich Prompts (Project Rules + Memory)"] end style A color:#fff style B color:#fff style C color:#fff style D color:#fff

1. Planning tool — The agent decomposes tasks into a todo list (write_todos). It checks off items as it works. This is externalized memory — the agent doesn’t need to hold the plan in context.

2. Subagent spawning — Complex subtasks are delegated to specialist agents via the task tool. Each subagent gets its own context window, filtered tools, and middleware. When it finishes, the result flows back as a ToolMessage. The subagent is destroyed — no context pollution.

3. File system access — Instead of stuffing everything into the prompt, the agent reads and writes files. ls, read_file, write_file, edit_file, glob, grep — all backed by a pluggable storage layer. This is how the agent survives without a 1M-token context window.

4. Detailed prompts — System prompts composed from project rules, memories, and skills at runtime. Not a static string — a dynamic assembly of everything the agent needs to know about your codebase.

How CodeBuddy wires it together

CodeBuddy’s core is a single createDeepAgent() call. Everything else — the IDE integration, the 27+ tools, the 9 specialized subagents — plugs into this foundation:

const agent = createDeepAgent({
  model: buildChatModel({ provider, apiKey, modelName }),
  tools: await ToolProvider.getToolsAsync(),
  systemPrompt: basePrompt + projectRules + memories + skills,
  backend: compositeBackend,
  subagents: createDeveloperSubagents(model, tools),
  middleware: [
    createMemoryMiddleware({ sources: ["AGENTS.md"] }),
    createSkillsMiddleware({ sources: [".codebuddy/skills/"] }),
  ],
  checkpointer: sqlJsCheckpointSaver,
  store: inMemoryStore,
});

The returned agent is a standard LangGraph graph — streaming, human-in-the-loop, and LangSmith observability work out of the box.

The architecture in one diagram

sequenceDiagram participant U as User participant A as Developer Agent (createDeepAgent) participant MW as Middleware Stack (5 layers) participant P as Subagent Pool (9 specialists) participant T as Tools (27+ core + MCP) participant B as CompositeBackend (3 storage layers) U->>A: "Add OAuth2 to the auth module" A->>MW: Initialize (TodoList + Filesystem + SubAgent + Memory + Skills) MW-->>A: Enriched prompt + tools Note over A: 🗓️ Plans via write_todos: 1. Analyze current auth 2. Add OAuth2 provider 3. Update routes 4. Write tests A->>T: read_file("src/auth/...") T->>B: /workspace → VscodeFsBackend B-->>A: File contents A->>P: task({ type: "code-writer", desc: "Add OAuth2 provider" }) Note over P: New agent with filtered tools Own context window — isolated P->>T: write_file, edit_file P-->>A: ToolMessage with result Note over P: Agent destroyed A->>P: task({ type: "test-runner", desc: "Write OAuth2 tests" }) P->>T: execute_command("npm test") P-->>A: Test results A-->>U: ✅ Done — 4 files changed, tests passing

The three key architectural decisions

1. CompositeBackend — One unified file system interface, three storage layers:

Route	Backend	Purpose
`/workspace/*`	`VscodeFsBackend`	Real IDE files — read/write actual code
`/docs/*`	`StoreBackend`	Persistent cross-session documents
`/` (default)	`StateBackend`	Ephemeral agent state

The agent doesn’t know which backend serves a path. It just reads and writes files. This is how we bridge an AI framework with a real IDE.

2. Subagent isolation — Each subagent is a fresh ReactAgent with:

Its own context window (no leakage from other tasks)
Role-filtered tools (the test-runner can’t delete files)
Its own middleware stack
A single-task lifecycle — created, used, destroyed

This is cheaper and safer than maintaining long-running specialist agents.

3. Five-layer middleware — Three from Deep Agents, two custom:

TodoListMiddleware    → Planning and progress tracking
FilesystemMiddleware  → Context offloading to files
SubAgentMiddleware    → Specialist delegation
MemoryMiddleware      → AGENTS.md injection (custom)
SkillsMiddleware      → .codebuddy/skills/ loading (custom)

Middleware is composable and fault-tolerant. A failing middleware logs a warning but doesn’t crash the agent.

Self-healing: when things go wrong

Production agents fail. Models hallucinate. APIs time out. Rate limits hit. CodeBuddy handles this with four layers:

Layer	Handles	Mechanism
Tool-level	Parse errors, malformed args	Auto-retry with corrected input
Provider-level	Rate limits, API failures	Failover to next provider in chain
Context-level	Window overflow	Auto-compaction via summarization
Session-level	Unrecoverable errors	Checkpoint-based session restore

The agent doesn’t just retry — it diagnoses the failure type and picks the right recovery strategy. An auth error doesn’t trigger a retry (it would fail again). A rate limit triggers provider failover with cooldown tracking.

What this enables

With this architecture, CodeBuddy handles real-world tasks that single-loop agents can’t:

“Refactor the payment module” → Plans 8 steps, delegates file analysis to code-analyzer, rewrites with code-writer, runs tests with test-runner, fixes failures in a loop
“Debug this production error” → Reads stack trace, attaches to debugger (DAP), inspects variables, traces the root cause, writes the fix
“Add i18n support” → Scans all user-facing strings, creates translation files, updates components, tests each locale

Each of these involves 20-50 tool calls across multiple subagents. No single context window could hold it all.

The numbers

Metric	Value
Agent framework	LangGraph Deep Agents
Subagent specialists	9
Core tools	27+
LLM providers supported	10
Skills (external integrations)	16
Storage backends	3 (IDE files, persistent docs, ephemeral state)
Middleware layers	5
WASM modules	2 (Tree-sitter AST + SQLite)
Worker threads	5 (embeddings, AST, vector DB, analysis, chat)

Try it

CodeBuddy is open source and runs in VS Code, Cursor, Windsurf, and VSCodium.

ext install codebuddy.codebuddy

GitHub: github.com/olasunkanmi-SE/codebuddy
Deep Agents: github.com/langchain-ai/deepagentsjs

Presented at AI Salon KL — April 3, 2026. Built in Kuala Lumpur. 🇲🇾

Introducing CodeBuddy: The Autonomous AI Software Engineer

Thu, 26 Mar 2026 00:00:00 GMT

Most AI coding tools autocomplete a line and call it a day. We wanted something different — an AI that can take a task description, reason through the problem, write the code, run the tests, fix what breaks, and ship the result. All inside your editor.

Today we’re releasing CodeBuddy as an open-source extension for VS Code, Cursor, Windsurf, VSCodium, and any editor on the VS Code extension API. It’s also on the Open VSX Registry.

The problem

Developers spend significant time on tasks that are repetitive but not trivial — writing boilerplate, debugging stack traces, updating tests after refactors, wiring up API endpoints, writing documentation. Current tools help with fragments, but someone still has to orchestrate the work.

We asked: what if the AI could handle the full lifecycle of a task?

What CodeBuddy does differently

CodeBuddy is a multi-agent system, not a single-model wrapper. When you give it a task, here’s what happens:

The Developer Agent — a createDeepAgent() instance from deepagentsjs — analyzes your request and decides the approach
Specialized subagents handle the work via the Deep Agents task tool — one for code analysis, another for file editing, another for terminal commands
27+ built-in tools extend the Deep Agents file system primitives with IDE-native capabilities — terminal execution, web search, browser automation, debugger integration
Self-healing execution catches failures and retries with corrected approaches — up to 4 layers of recovery

The result: you describe what you want, and CodeBuddy does the rest.

Built on Deep Agents

CodeBuddy is powered by deepagentsjs — LangChain’s batteries-included agent harness. While simple LLM tool-calling loops produce “shallow” agents that fail on complex tasks, Deep Agents implements the patterns proven by applications like Deep Research, Manus, and Claude Code:

TodoListMiddleware — write_todos tool for planning and progress tracking
FilesystemMiddleware — File system tools backed by a composable backend abstraction
SubAgentMiddleware — task tool for spawning context-isolated specialist agents
CompositeBackend — Route file paths to different storage layers (disk, store, state)

CodeBuddy extends this foundation with a custom VscodeFsBackend, IDE-native tools, and MemoryMiddleware + SkillsMiddleware for persistent project context.

Architecture at a glance

graph LR A[Your Task] --> B[Developer Agent] B --> C[Planner] B --> D[Coder] B --> E[Debugger] B --> F[Tester] C & D & E & F --> G[Self-Healing Layer] G --> H[Completed Task]

Key numbers


7 specialized agents	Each optimized for a specific type of work
10 AI providers	OpenAI, Anthropic, Google, Groq, Ollama, LM Studio, and more
27+ built-in tools	File editing, terminal, web search, browser, debugger, MCP
16 integrations	GitHub, Jira, AWS, Datadog, PostgreSQL, Sentry, and more
8 WASM grammars	Tree-sitter AST parsing for JS, TS, Python, Go, Rust, Java, PHP, TSX
5 worker threads	Parallel processing for analysis, embedding, vector search

Privacy and security first

Every line of CodeBuddy runs locally in your editor. There are no cloud servers, no telemetry calls home, no code leaving your machine (unless you configure an external AI provider).

Enterprise teams get:

Access control with allow/deny lists and admin roles
Permission scoping to restrict what the agent can do (restricted / standard / trusted profiles)
Credential proxy — a localhost reverse proxy that injects API keys so they never touch the webview
Prompt injection detection — 15+ pattern detectors with automatic sanitization

Local models, zero latency

If you don’t want your code touching any API, CodeBuddy works fully offline with Ollama and LM Studio. Run DeepSeek Coder, CodeLlama, Qwen, or any GGUF model locally. The inline completion engine supports model-specific FIM (Fill-in-the-Middle) tokens for each provider.

What’s next

We’re actively developing:

More language support for AST analysis
Better context selection with relevance scoring improvements
Richer MCP ecosystem with community-contributed servers
Team collaboration features with shared project rules

Try it now

# VS Code / Cursor / Windsurf
ext install codebuddy.codebuddy

# VSCodium / Open VSX editors
# Install from https://open-vsx.org/

Read the quickstart guide to build your first feature with CodeBuddy in under 5 minutes.

Star us on GitHub if you find it useful. Contributions welcome.