Harness adapters
On this page
AOP provides one run and resume interface over installed agent harnesses. Install and
authenticate the harness you want to use first. AOP uses its native credentials, models, tools, and
session mechanism while giving every run the same AOP access controls and result format.
Supported harnesses#
| Harness | --agent | Default | Model and effort selection |
|---|---|---|---|
| Codex | codex | Native default | Accepts native model IDs and effort levels. Z.AI Coding Plan is available as the zai-coding-plan inference provider. |
| Claude Code | claude | Native default | Accepts normal model aliases and effort from low through max. |
| Cursor Agent | cursor | composer-2.5 | Reasoning and fast variants are part of the model ID, so separate effort is rejected. |
| Devin CLI | devin | swe-1-7 | Reasoning variants are part of the model ID, so separate effort is rejected. |
| OpenCode | opencode | the model in OpenCode's resolved configuration (opencode debug config); without one, --model is required | Short model names are qualified with opencode/; effort selects the native variant. |
| Antigravity | agy | Native default | Accepts exact names printed by agy models; effort is low, medium, or high. |
| Grok Build | grok | the default grok models reports | Accepts native effort from none through max. |
| Hermes | hermes | Hermes's configured default; AOP records the model from its session | Uses the configured inference provider unless both --provider and --model override it. |
| DeepSeek Harness | dsh | deepseek-flash through deepseek-official | Also supports deepseek-v4-pro; another configured route requires both --provider and --model. |
| Zcode | zcode | Native configured model | Uses native provider/model IDs and model-specific effort levels verified through the app-server. |
Use aop models to inspect installed or configured inventories and see whether each entry came from
the authenticated harness, an installed default, or AOP's catalog. Exact resume retains the original
harness, model, effort, inference provider, mode, and execution profile.
Every adapter supports bounded execution, exact resume, the edit, review, sealed, and host profiles, input snapshots, validated artifacts, normalized results and token usage, and retained provenance. The rest differs by harness. The last column is the version each adapter was last tested with on 2026-10-22; newer versions usually work, and a harness change that breaks one is fixed in the next AOP release.
| Harness | Enforced --no-web | Participant mode | Model inventory | Provider override | Calculated cost | Provider-reported cost | Minimum version | Last tested |
|---|---|---|---|---|---|---|---|---|
| Codex | All profiles | No | Account or authenticated route | Z.AI Coding Plan | API-equivalent | No | 0.150.1 | 0.163.0 |
| Claude Code | All profiles | No | Native inventory plus catalog | No | Claude Code's own figure | No | 2.1.308 | |
| Cursor Agent | No | No | Account | No | No | No | 2026.10.16 | |
| Devin CLI | Sandboxed profiles | No | Account | No | No | No | 3000.11.92 | |
| OpenCode | All profiles | No | Account | No | API-equivalent | When emitted | 1.19.3 | |
| Antigravity | No | No | Account | No | API-equivalent | No | 1.1.16 | 1.4.5 |
| Grok Build | Sandboxed profiles | No | Account | No | API-equivalent | When emitted | 1.0.60 | |
| Hermes | All profiles | Experimental | Configured route | Yes | API-equivalent or Hermes's own figure | When emitted | 0.22.2 | |
| DeepSeek Harness | Sandboxed profiles | No | Bundled defaults | Yes | Known provider routes | No | 0.2.1-rc.2 | |
| Zcode | No | No | Authenticated Z.ai route or configured models | Through the model ID | Canonical Z.ai route, API-equivalent | No | 0.16.9 |
"Sandboxed profiles" means edit, review, and sealed: these harnesses rely on AOP's network namespace for --no-web, so a host run with --no-web is refused.
Calculated cost is an API-equivalent comparison unless the table identifies a native CLI calculation. Provider-reported cost remains separate and is retained only when the harness exposes monetary evidence for the selected billing route. Hermes turns are serialized when shared rotating OAuth credentials require it; other harnesses remain concurrent.
Enforced no-web support#
aop run --no-web keeps inference traffic available while denying model-controlled external
retrieval. Enforcement differs because the harnesses expose different native control surfaces.
| Harness | Effective no-web policy |
|---|---|
| Codex | Native web search and tool network access disabled; local shell and file tools remain available inside Codex's network-disabled workspace sandbox. Native routes use authentication-only state; selected external routes receive an AOP-generated provider-only config. |
| Claude Code | Local file-tool allowlist; safe mode, Chrome, and MCP restrictions enabled. |
| OpenCode | All model tool calls denied; external plugins disabled. |
| Grok Build | Sandboxed profiles only; local file-tool allowlist (read_file, search_replace, grep, list_dir, todo_write); native web, subagent, shell, fetch, and MCP routes denied, including the search_tool and use_tool MCP catalog tools; authentication-only state. |
| Hermes | file and todo toolsets only; safe mode disables customizations and MCP. |
| Cursor Agent | Unsupported; the run fails before dispatch. |
| Devin CLI | Sandboxed profiles only; its shell and server-side web search tools denied, since Devin's web search runs on its own servers through the inference host; other tools remain. |
| Antigravity | Unsupported; the run fails before dispatch. |
| DeepSeek Harness | Sandboxed profiles only; its web, search, fetch, shell, jobs, and workflow plugins disabled, since its web_search runs on DeepSeek's servers through the inference host; file, subagent, skill, todo, and goal tools remain. |
| Zcode | Unsupported; the run fails before dispatch. |
The complete effective policy and adapter mechanisms are retained in each run's request.json.
Exact resumes inherit the policy. AOP never substitutes a prompt instruction for missing
enforcement.
Authentication and private state#
Authenticate with the native harness before using it through AOP. For isolated profiles, AOP copies
only the credentials, configuration, and extensions allowed by the selected profile into private
state beneath .aop/provider-state/. Existing global sessions, logs, and caches are not reused.
Exact resume reuses the same private state so credential updates and harness session data remain
available to that session.
sealed uses an opaque session identity and omits local instructions and extensions. It receives
only the authentication material required by the selected harness. Its private state and cache are
reused only by exact resumes.
Cleanup removes mutable harness state with the task while preserving retained requests, results, events, logs, inputs, and artifacts. See Execution profiles for the surrounding filesystem and environment boundary.
Harness-specific behavior#
Codex#
For native routes under edit and review, AOP seeds authentication, root configuration, user rules and skills, and the model catalog. It does not copy sessions, history, databases, logs, caches, or generated system skills. Native sealed runs receive authentication only. Sealed and --no-web runs start app-server with --disable plugins, which also stops Codex from cloning its plugin marketplace (about 100 MB) into each fresh private home.
AOP executes new Codex turns and exact resumes through Codex app-server. The native protocol supplies thread identity, terminal messages, per-turn token usage, effective model identity, and exact resume without AOP reading Codex session history. When a run reaches its AOP deadline, AOP sends turn/interrupt, allows a bounded five-second accounting and teardown grace outside the requested run time, and then terminates the provider process if it does not stop. A timed-out turn remains failed even when native interruption returns terminal accounting evidence.
For ChatGPT logins in the configured source home's auth.json, AOP uses Codex's native external-token protocol. Task processes receive access tokens without refresh tokens. A controller-side Codex process owns refresh against the configured source, and a source-scoped lock coordinates AOP refreshes across concurrent runs and repositories. Exact resume binds to the original account and user. When an existing session migrates, AOP preserves its old credential copy under .aop/retired-credentials/, outside the task mounts, and records that path in request.json. These copies are never used for authentication or promoted into the source login. The configured source must remain outside the current task's writable provider state. An already-invalid source refresh token still requires a valid native credential source; AOP does not recover it by searching old task homes. API-key authentication and the Z.AI Coding Plan route retain their existing transport.
Under --no-web, AOP gives app-server authentication-only state, disables native web search, and selects a named Codex permission profile that mirrors the AOP filesystem profile while disabling tool network access. Local shell and file tools remain usable, review and sealed keep /workspace read-only, and edit can modify its task worktree without permitting tool-controlled network retrieval. Named permission profiles require Codex 0.150.1 or newer.
Z.AI Coding Plan remains a Codex inference route rather than a separate harness. Configure a native Codex provider for https://api.z.ai/api/v1 with wire_api = "responses", requires_openai_auth = false, and one environment-key credential. AOP reads the effective layered Codex configuration for the task working directory through app-server config/read, records the stable route identity as zai-coding-plan, and separately preserves the native Codex provider key.
Use both --provider zai-coding-plan and --model MODEL for an explicit override. When native Codex configuration already selects the validated route, AOP records its effective model and route without requiring an override. AOP rejects ambiguous route matches, noncanonical endpoints, mixed authentication, missing credentials, and models absent from the fresh authenticated inventory.
For isolated Z.AI runs, AOP creates route-private Codex state containing only the selected provider, pinned authenticated model catalog, and allowed rules or skills for the profile. It projects only the configured credential environment variable and never copies ChatGPT authentication, .env, unrelated providers, or unrelated API keys. Exact resume retains the original route and inventory snapshot while rereading the pinned credential variable and verifying current model availability.
Inspect the current route inventory with:
aop models --agent codex --provider zai-coding-plan --json
Set AOP_CODEX_SOURCE_HOME when the authenticated source is not
${CODEX_HOME:-~/.codex}.
Claude Code#
aop models --agent claude asks the installed CLI for its SDK initialization inventory without submitting a prompt. Native authentication, provider environment overrides, and model configuration stay with Claude. Hooks and MCP startup are disabled for discovery. Native entries are labeled native-advertised; they describe what the harness advertises, not verified inference or subscription entitlement. Newer CLIs supply resolved model IDs; older CLIs may supply only aliases. Discovery runs on each listing, including --refresh, but Claude may maintain its own cached inventory.
The models.dev catalog supplements this list with entries labeled catalog. API-equivalent prices come from model-prices at the time of listing; a price scope of api-equivalent-peak or api-equivalent-off-peak marks a provider with time-of-day pricing. Missing prices remain unknown with null JSON values or n/a text values. JSON records include inventory source, retrieval time, and hash. Native discovery failures produce an explicit warning and catalog fallback when available. Catalog failures also produce a warning while allowing native inventories to be listed. Explicit model selections remain accepted independently of discovery, and dispatch does not depend on the catalog.
For edit and review, AOP seeds Claude authentication and configuration into a private home while
leaving runtime history, project state, logs, and caches behind. sealed receives authentication
only. Repository access is constrained by the selected AOP profile.
--system-prompt TEXT or --system-prompt-file PATH replaces Claude's base system prompt, and --tools LIST sets its exact built-in tool set, for example --tools Bash,Read,Write,Edit; an empty value means no system prompt text or no tools. AOP passes them as Claude's --system-prompt and --tools, records them in request.json as system_prompt and tools, and reuses them on resume. They do not change the AOP sandbox or profile, and other harnesses reject them. Under --no-web, --tools must stay within the default no-web set: Read, Edit, Write, Glob, and Grep. User instructions, skills, and MCP servers are governed by the profile: sealed gives Claude a private home with only credentials and an empty workspace. Claude still adds its own environment and account context to each request. --thinking-display summarized asks Claude Code to return Anthropic's official summaries of the model's thinking in place of its print-mode default; omitted and highlights are the other values Claude Code accepts. The summaries arrive as thinking blocks in the run's events.jsonl and in Claude's own session transcript. The setting is recorded in request.json as thinking_display and reused on resume; other harnesses reject it.
--provider-base-url URL sends Claude's inference requests to URL by setting ANTHROPIC_BASE_URL inside the run, for example a local request recorder or proxy; it works with the OAuth login, is recorded in request.json as provider_base_url, and is reused on resume. Other harnesses reject it. In every profile except host, an ANTHROPIC_BASE_URL already set in the caller's environment is not passed to Claude, so AOP refuses such a run unless --provider-base-url names the URL to use. Runs without --no-web share the host network, so a recorder listening on 127.0.0.1 is reachable; with --no-web, AOP forwards a loopback base URL into the run's network namespace. A minimally prompted run looks like:
aop run --agent claude --profile sealed --system-prompt '' --tools Bash,Read,Write,Edit --prompt-file prompt.txt
--prompt-parts PATH sends the prompt as separate content blocks, so Anthropic's prompt caching can reuse a long prefix shared across runs. PATH holds a JSON list such as [{"text": "...", "cache": true}, {"text": "..."}], sent in order. Mark the last block that later prompts will repeat with "cache": true; a request finds a cached prefix only at that block or up to 20 blocks before its own mark, so split a long shared prefix into small blocks. Claude Code uses three of the four cache marks a request may carry, so a prompt can mark one block. request.json keeps the joined text as prompt and the block lengths and mark as prompt_parts. aop resume accepts --prompt-parts too; other harnesses reject it.
Cursor Agent#
For edit and review, AOP seeds CLI configuration, skills, plugins, policies, and authentication
without copying IDE extensions. Project metadata, chats, tracking data, and Cursor-created worktrees
start empty. sealed receives authentication only, while host uses Cursor's native global state.
Set AOP_CURSOR_HOME or AOP_CURSOR_CONFIG_DIR for nonstandard source locations.
Devin CLI#
AOP seeds authentication and configuration without copying installed versions, sessions,
transcripts, logs, or databases. It invokes Devin's noninteractive permission mode inside the AOP
execution boundary. sealed removes instruction, MCP, plugin, hook, skill, rule, and memory settings
from its minimal configuration.
On SSH, authenticate with devin auth login --force-manual-token-flow. Set AOP_DEVIN_DATA_DIR or
AOP_DEVIN_CONFIG_DIR for nonstandard source locations. Each invocation must produce a valid Agent
Trajectory Interchange Format (ATIF) export containing its terminal response and resume identity.
OpenCode#
AOP preserves OpenCode's native OPENCODE_EXPERIMENTAL_OUTPUT_TOKEN_MAX environment setting in sealed runs. OpenCode owns validation and the model-capacity bound. It can raise OpenCode's default output ceiling for reasoning-heavy tasks without changing reasoning effort; record the selected value alongside experiment inputs. For example, prefix an invocation with OPENCODE_EXPERIMENTAL_OUTPUT_TOKEN_MAX=64000.
aop models --agent opencode --refresh refreshes both AOP's model catalog and OpenCode's native models.dev cache. Regular listings use OpenCode's native cache policy.
For edit and review, AOP seeds configuration, authentication, and existing generated plugin
dependencies while keeping sessions, logs, model state, refreshed tokens, generated metadata, and
downloads private. sealed omits user configuration and instructions, while host uses native
global state.
Set AOP_OPENCODE_CONFIG_DIR or AOP_OPENCODE_DATA_DIR for nonstandard source locations.
Antigravity#
AOP seeds configuration and credentials from ~/.gemini, but not conversations, history, caches,
logs, scratch files, or databases. sealed retains authentication only. An exact resume fails if
Antigravity reports a different conversation ID.
When native Agy settings select modelProvider: "gemini", AOP preserves GEMINI_API_KEY and the
optional GOOGLE_GEMINI_BASE_URL override. Isolated state omits unrelated OAuth credentials, and
sealed retains only the provider selection. Results record the metered API route and API-key
credential source without recording either environment value.
Set AOP_AGY_SOURCE_DIR for a nonstandard source profile.
Grok Build#
For edit and review, AOP seeds authentication, configuration, rules, skills, agents, commands,
hooks, personas, plugins, and workflows into a private GROK_HOME. It does not copy sessions, logs,
caches, cross-session memory, plugin data, model caches, crash reports, traces, worktrees, or
installed binaries. sealed receives auth.json only.
AOP runs one noninteractive Grok turn and disables Grok's nested sandbox inside the outer AOP profile. It retains the exact session identity, normalized usage, timing, cost evidence, and final response needed by the common result interface.
If GROK_STORAGE_MODE is exported in the environment that starts AOP, its value is passed to Grok
unchanged. AOP neither validates nor defaults it. Set AOP_GROK_SOURCE_HOME when the authenticated
source is not ${GROK_HOME:-~/.grok}.
Hermes#
For providers other than Nous, aop models --agent hermes supplements the provider's models.dev entries with the default model returned by hermes config get model --json. That entry is labeled configured, including when it is absent from the catalog or prices are unavailable. Configuration is not proof of provider entitlement. Nous continues to use its existing endpoint inventory and provider prices.
For edit and review, AOP seeds configuration, skills, hooks, and memories while keeping sessions,
logs, databases, and caches private. sealed receives credentials without extensions or other user
instruction sources.
AOP asks the installed launcher for its own launch command with hermes --print-runtime-command, so it supports Hermes installed by Hermes's own installer. Each run sets HERMES_DISABLE_LAZY_INSTALLS=1, so a task never installs dependencies, finishes a pending Hermes update, or rewrites Hermes's launchers. Do not run Hermes by hand with an AOP task's home as HERMES_HOME: without that setting Hermes treats the task as its installation's owner and rewrites the launchers to point into it.
Some Hermes OAuth refresh tokens rotate after use. AOP keeps the freshest credentials in
repository-private shared state and serializes Hermes turns so concurrent tasks cannot consume the
same token. Other harnesses remain concurrent. Supplying both --provider NAME and --model MODEL
overrides the configured inference route and retains it on resume.
Hermes alone supports experimental participant mode:
aop run player --agent hermes --mode participant --profile review --prompt "Submit one move"
Participant mode is for an agent that takes one turn in a structured exchange, such as a game move or a vote, rather than doing open-ended work. AOP asks Hermes for one turn without model tools, but Hermes has no supported way to remove its tools entirely, so participant mode is not a tool-security boundary; the AOP profile remains the filesystem boundary.
DeepSeek Harness#
AOP invokes the official dsh --profile headless interface and adds the structured result and exact
resume support required by AOP. DeepSeek Harness still owns its agent loop, tools, prompt assembly,
inference route, and session persistence.
Each task receives a private DSH_HOME. AOP reads the native settings.yaml and copies only the selected inference route, leaving unrelated settings, profiles, sessions, plugins, credentials, and user-level .env files behind. dsh's headless profile reads its API key from the launch environment and leaves its managed credential store off, so AOP passes the route's one credential as an environment variable: an exported value such as DEEPSEEK_API_KEY when set, and otherwise the matching entry under refs in the version: 1 ~/.dsh/.credentials.yaml. Plain dsh --profile headless outside AOP needs the key exported in the same way. If a configured route does not name a credential environment variable, its native ambient authentication discovery still applies. AOP disables dsh telemetry and session-log upload for every run.
The default route is deepseek-official with deepseek-flash (DeepSeek-V4.1-Flash). The native DeepSeek route accepts --effort none, low, high, and max; AOP maps none to native off. Another route must exist under llm-pi-ai.providers and be selected with both --provider and --model. The dsh headless interface cannot list models by provider, so aop models --agent dsh reports the canonical Flash model and legacy Flash/Pro defaults. Calculated cost uses DeepSeek's peak or off-peak rate for the run's time and is unavailable for a run that crosses a peak boundary, because dsh reports no per-request times. See pricing.
The adapter targets dsh 0.2.1-rc.2, which calls DeepSeek's Anthropic-compatible Messages API at https://api.deepseek.com/anthropic, and uses its public Session.snapshotEvents() interface and native user-message constructor. It sets the harness sandbox to danger-full-access with approval policy never, because dsh's workspace-only write policy excludes AOP's separate artifact directory. The AOP sandbox continues to enforce edit, review, and sealed; host retains host access. The effective harness policy is recorded in request.json. The optional DeepSeek plugin-package inventory is disabled: its new default-on collector rejects the generated profile's unversioned manifest when AOP installs its loose runner. dsh 0.2 attaches each session's log to every DeepSeek request by default; AOP turns that off. dsh installed with npm under any prefix works, including a user prefix that needs no sudo.
dsh needs Node.js 22.19 or newer within 22.x, or Node.js 24 or newer. The host profile uses the Node.js on your PATH, and AOP refuses an unsupported version before starting; the sandboxed profiles use the Node.js visible inside the sandbox.
Set AOP_DSH_SOURCE_HOME when the source state is not ${DSH_HOME:-~/.dsh}. dsh owns migrating its own historical session formats.
Zcode#
AOP invokes Zcode's native --prompt --output-format stream-json --mode yolo interface. The AOP sandbox enforces the selected filesystem profile, and AOP enforces deadlines and validates terminal output. The adapter requires a completed turn, a terminal result, the selected model identity, and an exact session identity on resume. It retains native events and per-turn usage without reading the session database for accounting.
Install and configure the native Zcode CLI first, then run:
aop models --agent zcode
aop run example --agent zcode --model zai/glm-5.3-flash --effort high --prompt "Inspect this project"
aop resume RUN_ID --prompt "Continue the inspection"
Model IDs come from the native provider map and model.main selection in ~/.zcode/cli/config.json. For a native Anthropic-format provider configured at https://api.z.ai/api/anthropic, AOP queries Z.ai’s authenticated Coding Plan inventory using the selected native API key. Returned models carry authenticated-endpoint availability and the inventory timestamp and hash. Model listings map the canonical Z.ai route to Z.ai's API rates from model-prices and label those rates api-equivalent; they describe API token rates, not Coding Plan subscription charges. Models model-prices does not price retain unknown rates. Other configured models remain labeled configured. Without an available API key, AOP lists configured entries; a failed authenticated request is reported as an error. ZCODE_MODEL can supply the native environment selection, and native API-key discovery and ZCODE_BASE_URL remain available. Separate --provider overrides are unsupported. An explicit model selection must agree with any project-level model.main, because native project configuration takes precedence over user configuration.
AOP uses Zcode's native app-server and v4 commands for prompt submission. It verifies the selected model, permission mode, and requested effort before inference, records the effective effort, and preserves that selection on exact resume. Supported effort values come from the selected model's native settings. In Zcode 0.16.9, GLM-5.3 and GLM-5.3-Flash support low, high, and max, with max as the native default. Unsupported values fail before the prompt is sent. Prompts travel over stdin without an OS argument-size limit.
All profiles, including host, use a task-private Zcode home. AOP projects the selected provider's native API key, endpoint, and models into the app-server's provider configuration and leaves unrelated providers, credentials, sessions, databases, logs, and caches behind. A native configured key takes precedence over the selected provider's environment key. Zcode 0.16.9's app-server does not load the standalone CLI's OAuth store, so OAuth-only configuration is rejected; use the native provider's API-key configuration. AOP does not refresh OAuth tokens itself. Exact resume verifies the private provider configuration and credential fingerprint against the pinned selection and rejects conflicting project configuration. External provider-file overrides are rejected because they would bypass that projection.
edit, review, and host seed user instructions and extensions; sealed disables plugins, skills, memory, and MCP and receives no user instruction files. Zcode's headless interface does not provide a verified no-web boundary, so AOP rejects --no-web. Completed request measurements survive timeouts and truncated output as partial accounting. On the canonical Z.ai route, AOP sums the API-equivalent cost of each measured model request at its completion time, including lite-model and compaction calls, when those measurements reconcile with the turn usage. Unknown models or incomplete cost evidence leave calculated cost unavailable. Billing provenance records the native credential source and Coding Plan subscription route; calculated cost represents API-equivalent token rates, not subscription charges. Zcode does not expose provider-reported monetary cost.
Set AOP_ZCODE_BIN to a specific executable and AOP_ZCODE_SOURCE_HOME to a nonstandard source .zcode directory. AOP mounts the resolved CLI bundle and its sibling packages directory into isolated profiles, including installations launched through the stable ~/.local/bin/zcode symlink. The integration is tested against the native 0.16.9 executable using a local inference server for run and exact resume under all four profiles, including effort values and the actual provider request body. Native Bash tool tests verify worktree edits, artifact collection, read-only workspace enforcement in review, and workspace invisibility in sealed.
Current limitations#
| Harness | Current limitation |
|---|---|
| Codex | No participant mode. |
| Claude Code | Native inventory advertises models without proving entitlement; no participant mode. |
| Cursor Agent | Effort is part of the model ID; no participant mode. |
| Devin CLI | Effort is part of the model ID; successful runs require a valid ATIF export; no participant mode. |
| OpenCode | No participant mode. |
| Antigravity | Exact resume fails if the conversation ID changes; no participant mode. |
| Grok Build | No participant mode. |
| Hermes | Participant mode is experimental; rotating OAuth credentials serialize Hermes turns. |
| DeepSeek Harness | Developer-preview CLI; inventory lists bundled defaults rather than the selected provider; no participant mode. |
| Zcode | Live inventory requires a canonical Z.ai Coding Plan route and API key; other inventories are configuration-based. Requires the native app-server v4 command interface and selected provider API key. No standalone OAuth, no-web, participant mode, or provider-reported monetary cost. Project model selection must agree with an explicit override. |
Antigravity integration requires Agy 1.1.16 or newer. AOP checks the installed version before dispatch and model discovery so an older or unrecognized interface fails before task state is created.
Cursor Agent and Devin CLI do not report enough information for AOP to calculate an API-equivalent cost. See Token usage and pricing for the values available from each harness.
Executable overrides#
Use these environment variables when a supported executable is not on the normal PATH or AOP
should invoke a specific installation:
AOP_CODEX_BIN
AOP_CLAUDE_BIN
AOP_CURSOR_BIN
AOP_DEVIN_BIN
AOP_OPENCODE_BIN
AOP_AGY_BIN
AOP_GROK_BIN
AOP_HERMES_BIN
AOP_DSH_BIN
AOP_ZCODE_BIN
AOP_BWRAP_BIN
In isolated profiles, overrides should normally point to an installed harness. AOP supports system and Homebrew installations, self-contained executables, dsh installed through npm, and Hermes installed by its own installer. A custom launcher may not work if it needs other files that are not visible inside the isolated run.
Prompt transport#
AOP carries prompt text through stdin, a private prompt file, or the harness protocol, so large --prompt and --prompt-file inputs avoid the operating system's argument-size limit on both run and resume. The selected transport is recorded in request.json under effective_policy.prompt_transport.
Codex and Zcode use their native protocols; Claude, OpenCode, and Cursor use stdin; Agy uses structured stdin; Grok, Devin, and the dsh driver read a prompt file. The installed Hermes one-shot CLI accepts only argument text, so AOP loads the private file inside its native Python process before CLI parsing. Prompts never cross an OS process-launch boundary as large arguments. Model context and provider request-size limits still apply.