OpenCode — the harness as a server

Rules come from AGENTS.md files; agents themselves are markdown — a file in .opencode/agents/ declares a persona with its own prompt, model, tools, and permission overrides. The primary pair, build and plan, differ exactly there: plan is the same engine with edit and bash turned down to ask.

The model is handed material by ripgrep-backed grep, glob, line-ranged read, webfetch, and web search. The distinctive delivery channel is the language-server fleet: after an edit, LSP diagnostics flow back into the loop, so the model sees what it just broke without being asked to look.

Compaction is an explicit checkpoint system. When estimated tokens cross the context limit minus a buffer (20,000 by default), the session's own model writes a structured continuation summary — objective, active work, blockers, next moves — and future requests build from that checkpoint plus what followed. Lossy for the window, never for the record: durable history is kept beneath every checkpoint.

Around fourteen built-ins — bash, edit, write, read, grep, glob, patch, web, todo, question, skill, lsp — each a TypeScript module with a Zod schema, and the schemas are served over the API so any client can render a call. MCP servers extend the set, local over stdio or remote over HTTP, with automatic OAuth including dynamic client registration.

The boundary is policy, not sandbox. A permission block maps every tool to allow, ask, or deny — with wildcards, per-bash-command patterns, and per-agent overrides — and an ask surfaces as an approval prompt in whichever client is attached. Isolation itself is left to the operator; the harness runs where you run it.

Sessions, messages, parts, and permissions live server-side in SQLite (v1 used JSON files; v2 moved to Drizzle-managed SQLite with a migration path). Around every change the harness takes a git-based snapshot of the worktree, so undo and redo restore both the files and the conversation position together.

The loop runs in the server and narrates itself: every step is broadcast on the event bus, approval gates pause it, and a question tool lets the model hand a decision back to the human mid-run. Because the contract is HTTP, the same run can be steered from a terminal today and a CI job tomorrow.

Delegation is session-shaped: the task tool or an @mention spawns a child session running the same loop under a restricted tool and permission set. Three specialists ship — general, read-only explore, and scout — and any user-defined markdown agent can be delegated to the same way.

Reusable know-how has three registers: SKILL.md skills loaded on demand through a dedicated tool, custom slash commands, and plugins — JavaScript modules from a directory or npm that hook the lifecycle (before and after tool execution, file edits, session events) and can register new tools.

Receipts arrive continuously: the LSP fleet — twenty-eight-plus language servers, auto-downloaded — returns diagnostics after every edit, which is verification wired into the loop rather than bolted after it. And the event bus is the trace: a session shared as a live web page is observability handed to anyone with the link.

The harness itself does not learn; the configuration accretes. A failure becomes a permission pattern, a repeated workflow becomes an agent file or a plugin hook, a house rule becomes AGENTS.md — all of it markdown and TypeScript in the repo, versioned like the code it governs. Evolution is a commit.