> ## Documentation Index
> Fetch the complete documentation index at: https://docs-omnicoreagent.omnirexfloralabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Code Mode

> Let the model write a short Python program that calls your tools, safely

# Code Mode

With code mode, the agent gets a `run_code` tool. Instead of calling tools one
at a time, the model writes a short Python program that calls them as
functions, loops, filters, and computes, and gets back the program's result
and what it printed. One model turn can do what would otherwise take many.

```bash theme={"theme":{"light":"github-light","dark":"github-dark"}}
pip install "omnicoreagent[codemode]"
```

```python theme={"theme":{"light":"github-light","dark":"github-dark"}}
agent = OmniCoreAgent(
    name="analyst",
    system_instruction="Answer questions about orders.",
    model_config={"provider": "openai", "model": "gpt-5.4-mini"},
    local_tools=tools,
    agent_config={
        "code_mode": {
            "enabled": True,
            "tools": ["get_order", "list_orders"],  # omit to allow every eligible tool
            "max_duration_seconds": 30,
            "max_tool_calls": 50,
        },
    },
)
```

A program the model might write:

```python theme={"theme":{"light":"github-light","dark":"github-dark"}}
late = []
for order in list_orders(status="shipped"):
    detail = get_order(order_id=order["id"])
    if detail["days_in_transit"] > 7:
        late.append(detail["id"])
print(len(late), "late orders")
late
```

## How it stays safe

* Programs run in [Monty](https://github.com/pydantic/monty), Pydantic's
  interpreter for a Python subset, in a separate worker process. A program
  has no filesystem, network, or environment access; an attempt raises an
  error inside the program.
* Every tool call a program makes goes through the same path as a direct tool
  call: governance authorizes it (a denied call raises an error the program
  can catch), the run's record notes it before it starts, and it is recorded
  in the trace.
* A program is stopped at its time limit, memory limit (`max_memory_bytes`),
  or tool-call limit, and its output is capped (`max_output_bytes`).
* Under governance, running a program is its own capability (`code.run`); the
  development profiles allow it, and `strict-production` needs a rule.

## In the trace

Each tool call a program made is listed under its `run_code` call in the
trajectory (`code_calls`), with its own policy decision and outcome, and each
has an ID of the form `<run_code call ID>.<n>`.

## Approval inside a program

If a tool call inside a program needs approval, the program itself pauses: it
is stored on the run's record, signed, and the run waits like any other
([Durable Runs](/docs/core-concepts/durable-runs)). After the decision, the
program continues **from that call** — nothing it already did runs again:

```python theme={"theme":{"light":"github-light","dark":"github-dark"}}
result = await agent.run("refund the late orders", session_id="s1")
# result["status"] == "awaiting_approval"; the approval names the call inside the program
await agent.resolve_approval(run_id, approval_id, decision="approve", approver="alice")
result = await agent.resume(run_id)
```

A denied call is raised inside the program with the approver's note, so the
program can catch it and carry on.

Set `code_mode["snapshot_key"]` (or `OMNICOREAGENT_CODE_SNAPSHOT_KEY`) so a
paused program can continue in another process, such as after a restart; a
stored program that does not verify against the key is refused and never runs.
Without a key, a random one is used per process, so a paused program only
continues where it paused. A program too large to store (`max_snapshot_bytes`)
is told so instead of pausing.