Multi-agent architecture in practice: planners, sub-agent dispatch, tool design, context management, and the trade-offs behind CodeBuddy's LangGraph deep-agent core.
An AI agent that writes code should be able to check it, too. But a security tool has a failure mode no other tool has: a false ‘clean’ is worse than no tool at all, because it manufactures unearned confidence. Here is how we built a read-only security auditor into CodeBuddy around that single idea.
A single LLM loop can’t reliably run a multi-step coding task. CodeBuddy is a deep agent instead: one createDeepAgent call composed from five seams (model, tools, file system, subagents, middleware) returning a compiled LangGraph graph, with four layers of self-healing. This is the whole architecture from the inside, grounded in the real code and file paths.
Open the harness and the system prompt is 40 lines you could read over coffee. Print what the model actually receives on the same turn and it’s 4,000 tokens: a persona block, a skills catalog, a summarized history, tool schemas, spotlighted retrieval. None of it is in the prompt file. That gap is context engineering, and if you let it be ad-hoc string concatenation it rots. Here’s how we made it an ordered middleware stack instead, and why the order is load-bearing.
Ask an agent to review 300 files and somewhere around turn 40 it starts losing the plot. The fix isn’t a smarter model; it’s a different architecture. Here’s how recursive dispatch works, why we wired it into CodeBuddy, and everything that surprised us along the way.
