Five coding agents, five sets of credentials in your home dir. Here is how I isolated them

If you run more than one AI coding agent, you have already hit this. Claude Code
writes its config and credentials into your home directory. So does Codex. So does
Droid. So does OpenCode. They all assume they own $HOME. They read each other's
leftovers, they share the same API keys sitting in plaintext dotfiles, and the
moment you want one agent pointed at Anthropic and another at a cheaper backend,
you are hand-editing environment variables and hoping you did not leak a key into
the wrong session.

That is fine for one tool on one machine. It falls apart the second you are running
a few agents across a few projects, some on your own account, some on a client's.

So I built ringlet: one CLI that manages every coding agent through isolated
profiles, with cost tracking and credential security built in instead of bolted on.

The core idea: a profile is a fake HOME

The whole design rests on one decision. Each profile runs the agent inside its own
HOME, with its own config, its own credentials, and its own conversation history.
Nothing crosses over. Two profiles on the same machine cannot see each other's keys
or chat logs, because as far as the agent knows, it is the only thing that exists.

That single move solves a pile of problems at once:

• Client work stays separated from personal work. Different keys, different history.
• You can bind the same agent to different API backends per profile. One profile is Claude Code on Anthropic, another is Claude Code on MiniMax, and neither one needs reconfiguring when you switch.
• Credentials stop living in plaintext dotfiles.

How it works

Ringlet sits in front of the agents as a launcher and a bookkeeper.

Profile isolation is the load-bearing part. Every profile gets a separate
HOME with its own config, credentials, and history, so there is zero
cross-contamination between projects. When you launch a session, the agent boots
into that sandboxed home and behaves normally, it just cannot reach anything
outside it.

Provider switching rides on top of that isolation. Because credentials and
config are per-profile, moving an agent from one backend to another is a matter of
creating a new profile bound to a different API. The supported matrix today:

Agent	Providers
Claude Code	Anthropic, MiniMax
Codex CLI	OpenAI, OpenRouter
Grok CLI	OpenAI-compatible
Droid CLI	Anthropic, MiniMax
OpenCode	Anthropic, MiniMax

Security is where the isolation earns its keep. API keys are stored in your
system keychain, macOS Keychain or GNOME Keyring, never in plaintext. The optional
remote terminal runs sessions inside a sandbox, bwrap on Linux or sandbox-exec on
macOS, with read-only system mounts. The HTTP daemon binds to 127.0.0.1 only and
requires a bearer token read from ~/.config/ringlet/http_token. None of that is a
premium tier. It is the default posture.

Usage analytics are the last piece. Ringlet tracks tokens, cost, and session
time across every profile. It can import your existing Claude Code usage data, and
export everything as JSON or CSV when you need to actually report on spend. When you
are running five agents, "what did this month cost and where did it go" stops being
a guess.

Using it

Setup is interactive and detects what you already have installed:

ringlet init              # detects agents, creates your first profile
ringlet profiles run work # launch an agent session in the "work" profile
ringlet usage             # see token spend across profiles

The run command is the interesting one. ringlet profiles run work does not just
start an agent. It starts that agent inside the work profile's isolated HOME, with
that profile's credentials pulled from the keychain and its provider binding
applied. Spin up a second profile bound to a different backend and run it side by
side, and the two sessions never touch:

# Terminal 1: client work, Claude Code on Anthropic
ringlet profiles run client

# Terminal 2: personal work, a different profile on a cheaper backend
ringlet profiles run personal

# Later, see where the tokens went across every profile
ringlet usage

Two agents, two homes, two sets of keys, one command each. Nothing is shared unless
you say so.

For heavier setups there is a daemon with a web dashboard at
http://127.0.0.1:8765 for managing profiles, viewing usage, and launching
browser-based terminal sessions, plus a native Tauri desktop app if you would
rather not keep a browser tab open. Event hooks let you fire shell commands or
webhooks on tool use, notifications, or agent-stop events, which is how you build
audit logs or Slack alerts without patching the agents themselves.

There is also intelligent routing: attach an ultrallm proxy to a profile and
write rules that push long-context requests to cheaper providers automatically. If
your bill is dominated by a handful of huge-context calls, that is where the routing
pays off.

Where it does not fit

Honest part. Ringlet is a management and isolation layer, not magic, and it will not
help everyone.

• If you run exactly one agent, one account, one machine, you do not need this. The default single-HOME setup is simpler and ringlet is pure overhead for you. The value only shows up when you have multiple profiles or multiple providers to keep apart.
• It manages a fixed set of agents. Claude Code, Codex, Grok, Droid, OpenCode. If your agent of choice is not on that list, ringlet does not know how to launch it yet. A plugin SDK is on the roadmap, but it is not here today.
• Sandboxing is OS-specific. The remote-terminal sandbox uses bwrap on Linux and sandbox-exec on macOS. Windows is a supported platform for the CLI, but the sandbox story is not the same, so do not assume the browser-terminal isolation guarantees carry over there.
• It does not make your agents cheaper by itself. It tells you what you are spending and makes routing possible. Actually cutting the bill still means setting up routing rules and picking cheaper backends. Ringlet gives you the visibility and the switch, not the decision.
• Team and enterprise features are roadmap, not shipped. Shared profiles, centralized provider policy, SSO, and audit trails are planned. Today it is a single-user tool. If you need centralized policy across a team right now, this is not that yet.

Takeaways

• The real problem with running many coding agents is not speed, it is that they all fight over one home directory and one set of secrets.
• A per-profile fake HOME is a boring, effective fix. Isolation you can reason about beats environment-variable juggling.
• Put credentials in the system keychain and bind the daemon to localhost with a bearer token. Security defaults matter more than features when the thing is holding your API keys.
• Cost tracking across profiles turns "why is my LLM bill like this" into a query.

Code, install script, and the full feature list are here:
https://github.com/neul-labs/ringlet

If you juggle more than one coding agent, I want to know how you keep their
credentials apart today. Kick the tyres, issues welcome.