What the agent harness is
When you send a message in AICODESIT's AI Chat or run a Pipeline step, it does not just call an AI API and return whatever it says. It runs the request through an agent harness — a layer that assembles the context the AI will see, grants it specific capabilities, manages a multi-turn action loop, enforces safety, checks the output for errors, and feeds everything back to the AI until the task is genuinely done.
The harness is what separates a single AI response from an AI agent that can actually ship working code. And unlike most platforms, every part of it is configurable. You can control the context, the tools, the loop depth, the model, and the break conditions — per step, not just per project.
Context variables — what the agent knows
Before every agent call, the harness assembles a set of variables and substitutes them into the system prompt and user prompt. This means the AI is not reasoning in a vacuum — it is reasoning against the exact state of your project at the moment the step runs.
| Variable | What it injects |
|---|---|
{{user_message}} | The message the user typed to trigger this run |
{{file_tree}} | A live flat list of every file in the project (refreshed at each step) |
{{project_url}} | The live preview URL — lets the agent reason about what is currently deployed |
{{conversation_history}} | The full past AI chat history for this project — everything discussed in all previous sessions |
{{system_prompt}} | The project's global system prompt — the same instruction set the regular AI Chat uses |
{{db_schema}} | Full database schema: table names, column types, constraints, row counts, and up to 5 sample rows (PII redacted) |
{{auth_context}} | All auth API endpoints, Google login flow, and the full Stripe integration reference |
{{fn_context}} | Every deployed edge function and its invoke URL |
{{step_N_output}} | The full text output from step N — how steps pass data to each other |
{{step_N_tool_output}} | The raw tool/gather results from step N (file reads, grep results, command output) |
{{step_N_image_url}} | The URL of an image generated in step N |
{{step_N_video_url}} | The URL of a video generated in step N |
{{db_N_rows}} | N rows from every table — e.g. {{db_10_rows}} injects 10 rows from all tables |
You use these variables in the system prompt or user prompt of any pipeline step by writing them literally: Here is the current schema: {{db_schema}}. The harness resolves them before the AI ever sees the prompt. The database variables are fetched fresh each time — the AI always sees the current schema, not a cached snapshot.
This is important. It means you can build prompts that are genuinely dynamic. A step that writes database queries can be given the exact table structure it needs. A step that refactors code can be given the current conversation history so it knows what was already tried. A step that generates a landing page image can receive the URL of a product image generated in the previous step.
Capability grants — what the agent can do
Each agent step only has access to the capabilities you explicitly grant it. If you do not grant a capability, the AI does not know it exists — it is not just blocked; the instructions for using it are not injected into the prompt at all.
| Capability | What it enables |
|---|---|
| Read | Read any file in the project by path, optionally specifying a line range |
| Gather | List files in a directory, grep across the codebase by text or glob pattern |
| Command | Run shell commands inside a hardened sandbox — install packages, run scripts, curl endpoints |
| Write file | Create or overwrite any file in the project |
| Edit file | Apply a targeted find-and-replace edit to an existing file without rewriting it entirely |
| Delete file | Remove a file from the project |
| Database | Run structured DB operations (select, insert, update, delete, create table, add column, set RLS) without writing a curl command |
| Generate image | Call the image generation pipeline mid-step; the image URL is saved and available to downstream steps |
| Generate video | Submit a video generation job and poll until the video is ready |
| Sub-agent | Spawn parallel AI sub-calls mid-stream (see below) |
| Memory | Read and write to the project's persistent memory files |
| Skill | Load a platform or user-defined skill document into context on demand |
| Check | After any file write, automatically run syntax checks and a headless browser console check — results fed back to the AI for self-correction |
Granting fewer capabilities is not just a safety choice — it also makes the agent more predictable. A step that should only read files and generate a report does not need write access. Keeping it scoped means it cannot accidentally modify anything while trying to complete a simple read task.
The multi-turn loop — how the agent reasons and acts
A single AI call that writes files and reads context is useful but limited. The harness runs a multi-turn loop that gives the agent far more power: the AI acts, the harness executes those actions, returns the results, and the AI continues until the task is done.
The loop works like this: the AI produces output that may contain special tags — <read>, <gather>, <cmd>, <database>, and others depending on the granted capabilities. The harness parses all the tags, executes them in parallel, collects the results, feeds them back as a user message, and calls the AI again. This continues until the AI produces a response with no tags, or the maximum loop count is reached.
You control three things about the loop:
- Max iterations — how many times the agent can loop before the harness forces it to stop. Default is 3, but complex tasks may need 8-10.
- Break condition — a string that, if it appears in the AI's output or in any tool result, exits the loop immediately. Use a specific phrase like
TASK COMPLETEthat the AI will output only when it is genuinely done. - Tools return edge — in the Pipeline Builder you can control whether tool results are fed back to the AI (creating a reasoning loop) or whether the step completes immediately after tool execution (one-way side effects).
Importantly, if the AI writes a <gather> tag to list files and also a <read> tag to read one of those files, both operations are executed in parallel — the harness does not wait for the first to finish before starting the second. This keeps multi-step reasoning fast even when the agent is doing many lookups simultaneously.
Duplicate tags are automatically deduplicated. If the AI outputs the same <read path="App.tsx" /> twice in one response (a common model mistake), the harness executes it once and returns the result once. This prevents unnecessary cost and prevents the AI from getting confused by duplicate context.
Automatic quality checks
When the Check capability is enabled on a step, every file write triggers two automated checks before the loop continues:
- Syntax check — JavaScript files are parsed with Acorn; TypeScript and TSX files are run through the TypeScript compiler. Any syntax errors are collected with file names and line numbers.
- Browser console check — a headless Puppeteer browser loads the project's live preview URL, waits for it to settle, and captures any JavaScript exceptions or console errors that appear.
Both results are injected back into the conversation as a user message. If errors are found, the AI sees them immediately and can fix them in the next loop iteration — without you having to copy-paste error messages from the browser. If no errors are found, the AI sees "All checks passed" and knows the code is clean.
This feedback loop is what makes AICODESIT's agent different from a code generator. A code generator writes code and stops. An agent writes code, checks it, fixes it, checks it again, and only stops when it passes. The harness does all of this automatically.
Sub-agents — parallel work inside a single step
The most powerful feature of the harness is sub-agents. When the Sub-agent capability is granted, the AI can spawn multiple parallel AI calls mid-stream — before its own response has even finished — by outputting <sub_agent> tags.
Sub-agents are launched eagerly. The harness watches the AI's output as it streams and fires a sub-agent the moment it sees a complete </sub_agent> closing tag, without waiting for the parent agent to finish. Multiple sub-agent tags in one response run simultaneously. When all sub-agents are done, their results are collected and injected back into the parent agent's context.
Each sub-agent can have its own system prompt, its own capability set, and its own model. You can use a fast, cheap model (Claude Haiku) for sub-agents doing simple lookups while keeping the expensive model (Claude Fable 5) for the orchestration layer that coordinates them. The two tiers work independently.
Sub-agents make it possible to do work in a single step that would otherwise require a parallel branch in the graph — things like simultaneously researching three different aspects of a problem, generating three image variants, or reading three different files and synthesising them.
Model choice and bring your own key
Every agent step can use a different model. You select the model in the Pipeline Editor's step settings. The harness supports:
- Platform models — any model configured in the admin panel (Claude, GPT-4o, Gemini, Mistral, and others via OpenRouter)
- Bring your own key (BYOK) — supply your own API key and model ID, pointed at Anthropic, OpenAI, Google, Groq, Mistral, xAI, Cohere, Fireworks, or OpenRouter
The harness automatically falls back to the platform default model if a step's configured model has no key, so a pipeline never crashes silently on a model resolution failure.
If a model returns a 429 rate-limit response, the harness waits 15 seconds and retries up to three times before failing the step. For long-running pipelines with many steps hitting the same model, this prevents transient rate limits from breaking a run that took minutes to get to that point.
Security: sandboxed command execution
When a step has the Command capability, the harness does not run shell commands on the host server. Every command runs inside a hardened sandbox using bwrap and a custom seccomp BPF filter. The sandbox enforces:
- Seccomp filter — ptrace, process_vm_readv/writev, and all SysV IPC syscalls are blocked at the kernel level. Any attempt to call them kills the process immediately.
- User namespace — commands run as uid 2000 with all Linux capabilities dropped. Non-root with no capabilities.
- Network isolation — a private network namespace with only loopback. The command cannot reach external IP addresses or bind to public ports.
- Resource limits — 64 processes, 256 open file descriptors, 30 CPU seconds, 512 MB virtual memory, and 50 MB per file written.
- Filesystem — a fresh tmpfs root,
/usrmounted read-only, compilers and linkers shadowed with/dev/null, only the project directory writable.
Secret substitution is also handled carefully: API keys injected via {{DB_API_KEY}} are only substituted inside curl commands, never in arbitrary shell scripts. And the SSE stream that sends events to the frontend has a secret redaction pass — if a key value somehow appeared in the output, it would be masked before reaching the client.
Conclusion
The reason AICODESIT's agents produce working code rather than plausible code is not the model. Every major platform uses the same models. What matters is what surrounds the model: the context it receives, the tools it can act on, the feedback loop that checks its work, and the safety layer that keeps everything within bounds.
Because all of this is configurable — per step, per pipeline — you can tune the agent precisely for the task. A simple file-read step needs no tools and no loop. A complex refactor step needs the full file tree, the conversation history, read and write access, the syntax check, and 8 loop iterations. The harness handles both without you writing any infrastructure code.
That is what "full control" means in practice: not a settings panel with toggles, but an execution layer where every variable is documented, every capability is explicit, and every output is checked before the agent decides it is done.
Build your first pipeline in AICODESIT →
Related: How to automate your dev workflow with the Pipeline Builder · Brain Graph — Obsidian-style knowledge mapping inside your AI code editor