insideout Get Pro

14 · The harness around a coding agent

Pro

Agents, lesson 14

The harness around a coding agent

Context files, skills, hooks and permissions around the model.

You know the loop from "Observe, decide, act", tool definitions from "Designing tools a model can use", compaction from "Keeping an agent's window clean", and the tool gate and sandboxes from "Limits on what an agent may do". This lesson is about the coding agents you work with, such as Claude Code, Codex and Cursor, and the parts around their model that you control.

Part 1. Same model, different agent

Give two coding agents the same model and the same failing test, and one may fix it while the other gives up. In February 2026 LangChain measured the gap. It kept one model, GPT-5.2-Codex, and changed only what surrounds it: the system prompt, the tools, and code in the loop such as a check for edits that go round in circles and a checklist to run before finishing. On Terminal Bench 2.0, 89 tasks done in a terminal, its score rose from 52.8% to 66.5%.

None of that touched the model. It's all part of the harness, the code that turns the model's text into work. It runs the loop from "Observe, decide, act", offers the tools, writes the system prompt, decides which tool calls run, which ask you first and which are refused, and chooses what enters the window each turn. Claude Code, Codex and Cursor are each one, and much of what you can change about them lives in plain files in your repo.

Example 1.1

One request through a coding agent (example sizes)

  1. system prompt 3,000+tools 4,000+AGENTS.md 720
    +skill list 120+your line 10=7,850 tokens in

    You type one line. Before the model reads it, the coding agent wraps it in instructions, tool definitions and your repo's context file.

  2. model:Bash("npm test")
    stop reason:tool_use

    The model proposes a command. Nothing has run yet.

  3. hook before the tool call→exit 0: no objection
    permission rules→Bash(npm test *) is allowed→run

    Your hook gets a look first, then the permission rules. The command matches an allow rule, so it runs without asking you.

  4. 3,000 lines of output→40 lines kept→the history
    edit, test again, until an answer with no tool call

    Long output is cut to the part that matters before it goes back. Every later edit and command passes the same checks, until the model answers or a cap stops it.

Your turn

Your coding agent ran npm test without asking you, but asked before running git push. Which part made that call?

The model only proposes, and it proposed both commands the same way. AGENTS.md told it which command to run, not whether it may. The coding agent checked each proposal against its rules: npm test matched an allow rule, git push matched none, so it asked. Edit a settings file and the agent behaves differently, with no change to the model.

Harness

Everything around a model that turns its text into actions: the loop, the tool definitions, the system prompt, the permission checks and the choice of what goes into the context. Swap it and the same model behaves like a different agent.

Part 2. The context file

Keep going with Pro

You've done the first part. Pro opens the rest of this lesson, and every other one.

Still to come
  1. The context file
  2. Loaded only when needed
  3. What may run, and what checks it
  4. MCP servers and what they can reach
See Pro plansI have Pro: sign in
Next lessonMCP end to endThe messages between an agent and its tools, and how they get attacked. Start lesson 15

Agents overviewSpotted a mistake? Tell us.