Running AI Agents Directly in Your Terminal: Real-World Lessons from Codewhale and Comanda

I'm Denis Shokhirev, Agentic AI Systems Architect based in Freiburg, Germany, running DennisCraft AI Studio with a stack built on Claude, Supabase, n8n, Doppler, and self-hosted Postgres. Last quarter, a B2B client’s agent—running directly in their terminal—failed silently for 18 minutes due to unhandled stderr in a shell-generated migration script.

Why Terminal-Native AI Agents Matter in Production

For DACH B2B clients, “AI as a black box” is a non-starter. They demand end-to-end auditability, local logs, and direct rollback, not abstract promises of “explainability.” Delivering LLM-powered agents that operate in the terminal—using real CLI tools like Codewhale and Comanda—gives clients tangible control and visibility.

Stacking Codewhale, Comanda, and the Classic UNIX Workflow

What Each Tool Brings

Codewhale is a command-line interface for running LLM-powered code gen, refactoring, and documentation directly from the shell. Comanda is a flexible shell automation framework for orchestrating complex agent workflows. I always deploy agents in Docker sandboxes, with strict resource and file system limits, to minimize lateral risk.

Security Lessons: Where Terminal Agents Break Down

On three recent deployments, I caught the same vulnerability: LLM-generated shell commands failed to sanitize user input. For example:

#!/bin/bash
read -p "Enter filename: " filename
cat $filename

If the user enters ; rm -rf /, the agent will execute it. The solution: enforce static code analysis (e.g., with semgrep) on every AI-generated script before execution:

semgrep --config=auto --lang=bash ./generated_script.sh

According to OWASP (2023), 52% of CLI automation incidents stem from unsanitized input (OWASP Top Ten).

Sandboxing, Rate Limiting, Audit

• Each agent runs in a Docker container with a read-only root file system.
• Input is filtered through custom Python validators.
• All commands are logged in Postgres via Supabase for full audit trails.
• n8n orchestrates agent pipelines, enforcing a strict whitelist of allowed commands.

Field-Tested Scenarios: What Ships, What Fails

Success: Automated Database Migrations

I configured a Codewhale agent to generate Postgres migrations, validate them with psql --check, and run a manual diff—all from the shell:

codewhale "Create migration to add email field"
psql --dbname=clientdb --file=generated_migration.sql --check
diff schema_before.sql schema_after.sql

Result: safe, auditable migrations shipped to production in under 30 minutes, with no downstream issues.

Failure: Unhandled stderr Stalls the Pipeline

One agent-generated script for log archiving didn’t capture stderr, so on error, the pipeline hung for 18 minutes—until a manual kill. Solution: always redirect stderr to a dedicated log and parse it with a separate agent.

cp logs/*.log /backup/ 2> error.log
if [ -s error.log ]; then
  cat error.log | codewhale "Explain this error"
fi

Integrating Supabase and n8n for Logging and Orchestration

I log all agent activity to Supabase via REST API, so clients can trace every command. n8n orchestrates multi-stage pipelines and enforces a 120-second timeout—if an agent is unresponsive, it’s auto-killed and a Slack alert is sent.

FAQ

Why not run agents exclusively in the cloud?

Some clients require local transparency and control—terminal-native agents are easier to audit, monitor, and roll back in sensitive environments.

What’s the minimal stack for a production agent?

Codewhale or Comanda for CLI tasks, Docker for sandboxing, Supabase for audit logs, n8n for orchestration. Everything else is optional.

Can I run multiple agents in a single terminal?

Yes, using tmux or separate Docker containers. But traceability gets tricky—assign a unique trace ID to each session.

How do you validate generated code?

Run semgrep or bandit on every script. For Python, add gitleaks to scan for secrets and credentials.

What’s your fallback when an agent fails?

n8n catches the timeout, triggers an alert, and you can inspect logs via Supabase. For critical failures, revert using stored snapshots.

Where in your pipeline do terminal-based agents most often fail: input sanitation, error handling, or audit logging? Let me know—I’m collecting real production stories. I offer a free 30-min stack audit for DACH founders building AI in regulated markets. DM me on LinkedIn or write to @ger_dennis_ai.