{"slug": "varela-neuromancer-inspired-self-mutating-coding-harness", "title": "Varela: Neuromancer-inspired self-mutating coding harness", "summary": "Varela, a self-mutating agent harness inspired by Neuromancer, rewrites its own source code while running and hot-reloads, logging every run to turn repeated wins into new tools and failures into lessons. Built with zero dependencies in plain JavaScript and a WASM sandbox, it supports multi-agent orchestration, a model router for Anthropic, OpenAI, and OpenRouter, and a 3D cyberpunk world UI. The harness requires Node.js ≥ 20 and can import existing Claude Code or Codex logins.", "body_md": "A minimalistic, self-mutating agent harness in the spirit of [Pi](https://github.com/badlogic/pi-mono):\nplain JavaScript, **zero dependencies**, a WASM sandbox for untrusted code, an\nalways-on daemon, multi-agent orchestration, and a model router that speaks to\nAnthropic, OpenAI and OpenRouter — via OAuth or API keys.\n\nIts trick: varela **rewrites its own source while running** (and hot-reloads),\nlogs every run, and turns repeated wins into new tools and repeated failures\ninto lessons — so it measurably gets better the longer you use it. And you can\nwatch it work in a **3D cyberpunk world** where the agent is a person and\nfanning out spawns more of them, live.\n\nDrop a screen-recording of`varela --web`\n\nhere — the world with avatars fanning out is the demo that sells it.`git add docs/demo.gif`\n\n.\n\n```\n# Node ≥ 20. No npm install needed (zero deps).\nnode bin/varela.js import     # reuse an existing Claude Code / Codex login…\nnode bin/varela.js login      # …or sign in fresh (OAuth or API key)\nnode bin/varela.js            # start chatting\nnode bin/varela.js --web      # …or explore the 3D world\n```\n\nAlready use Claude Code or Codex? `varela import`\n\ncopies those logins in (varela\nuses the same client IDs, so their tokens work as-is). `--claude`\n\n/ `--codex`\n\nto pick one. It only reads those stores when you run it — never automatically.\n\nThat's the 30-second path. Everything below is depth.\n\n```\nvarela login        # sign in to a provider (OAuth or API key)\nvarela              # full-screen chat that fills the terminal (--plain for a line console)\nvarela --tui        # full-screen split-view UI (file tree + chat + preview)\nvarela --dash       # mission-control dashboard (agent tree, sparklines, growth)\nvarela --web        # 3D cyberpunk world UI (reuses a running daemon, else starts one)\nvarela -p \"task\"    # one-shot mode\nvarela --daemon     # WebSocket daemon: scheduler + heartbeat + serves the 3D world\nvarela hub [port]   # run a mesh rendezvous hub for the P2P human-agent world\n```\n\nRequires Node.js ≥ 20 (uses `node:wasi`\n\n, `fetch`\n\n, ESM). No `npm install`\n\nneeded.\n\nThe harness runs in place — the checkout **is** the install (it self-mutates).\nThe installers only put a `varela`\n\nlauncher shim on your PATH:\n\n```\n# Windows\n.\\install.ps1            # shim in %LOCALAPPDATA%\\varela\\bin + user PATH\n.\\install.ps1 -Daemon    # …and register the daemon at logon (Task Scheduler)\n.\\install.ps1 -Uninstall\n# Linux/macOS\n./install.sh             # shim in ~/.local/bin\n./install.sh --daemon    # …and enable a systemd user service for the daemon\n./install.sh --uninstall\n```\n\nNo installer? Add `scripts/`\n\nto your PATH — it holds repo-relative launchers\n([scripts/varela.cmd](/ajensenwaud/varela/blob/main/scripts/varela.cmd), [scripts/varela](/ajensenwaud/varela/blob/main/scripts/varela)) —\nor just run `node bin/varela.js`\n\n. `npm install -g .`\n\n(or the packed tarball —\n`npm pack`\n\nproduces a ~53 kB package) also works; note that a global install\nrelocates the harness root, so self-mutations then edit the globally installed\ncopy, and running from a git checkout keeps them version-controlled.\n\n-\n**Agent loop**([src/agent.js](/ajensenwaud/varela/blob/main/src/agent.js)) — sends the conversation plus tool schemas to the routed model, executes tool calls (dangerous ones require confirmation), loops until the model stops calling tools. -\n**Model router**([src/router.js](/ajensenwaud/varela/blob/main/src/router.js)) — resolves`provider/model`\n\nstrings, manages credentials and token refresh. Built-in providers:`anthropic`\n\n— OAuth (Claude Pro/Max sign-in, PKCE) or API key`openai`\n\n— OAuth (ChatGPT sign-in, PKCE, localhost callback) or API key`openrouter`\n\n— OAuth PKCE key exchange or API key- Drop a JS module in\n`~/.varela/extensions/providers/`\n\nto add another; it just needs to default-export`{ id, models, login, refresh, chat }`\n\n. The internal message format is Anthropic-style content blocks; shared converters for OpenAI-compatible APIs live in[src/providers/openai-compat.js](/ajensenwaud/varela/blob/main/src/providers/openai-compat.js).\n\n-\n**WASM sandbox**([src/wasm/sandbox.js](/ajensenwaud/varela/blob/main/src/wasm/sandbox.js)) — runs WASI preview1 modules from`~/.varela/wasm`\n\nwith**no** filesystem or network access by default. This is where generated/untrusted code should run; the`shell`\n\ntool is for trusted host automation. -\n**Self-mutability**— the harness can rewrite itself while running:`self_list`\n\n/`self_read`\n\n/`self_edit`\n\n— inspect and patch varela's own source (with backup + rollback if the edited file fails to load).`create_tool`\n\n— write a new tool into`~/.varela/extensions/tools/`\n\n.- Both hot-reload the tool registry and providers immediately (cache-busted\ndynamic\n`import()`\n\n), so the agent can use a capability it just built in the very next step.\n\n-\n**Console**([src/cli/chat.js](/ajensenwaud/varela/blob/main/src/cli/chat.js)) — the default`varela`\n\nopens a**full-screen chat** that fills the terminal, Pi-style:**no alternate screen**, so finished messages commit to your terminal's normal scrollback (native mouse/PageUp scroll and copy keep working) while only a small bottom region is redrawn in place inside synchronized-output frames. Built on its own input engine ([keys.js](/ajensenwaud/varela/blob/main/src/cli/keys.js)+[editor.js](/ajensenwaud/varela/blob/main/src/cli/editor.js)):**Esc interrupts** a running turn — the model fetch aborts, partial output is kept in the conversation. Esc also clears input; double-Esc shows the rewind menu (`/rewind`\n\ndrops turns,`/undo`\n\nreverts files).**Multiline input**:`\\`\n\n+Enter or Ctrl+J for newlines, bracketed paste (multi-line pastes just work),**Ctrl+G opens $EDITOR/$VISUAL**(vim, notepad, …) to compose, full readline keys (Ctrl+A/E/K/U/W/Y, Alt+B/F, Ctrl+←/→) and an optional** vim mode**(`editorMode`\n\nin`/configure`\n\n).with a fuzzy-search menu; mentioning an image file (`@`\n\nfile mentions`@shot.png`\n\n) attaches it as**vision input**.:`!`\n\nshell mode`! npm test`\n\nruns directly, shows output, and adds it to the conversation context — no model round-trip.**Type-ahead command menu**(↑/↓, Tab; Enter runs the highlighted command),** Ctrl+R reverse history search**, history persisted across sessions.** Shift+Tab cycles permission modes**:`plan`\n\n(read-only — mutating tools are denied and the agent proposes) →`default`\n\n(confirm) →`acceptEdits`\n\n(file edits auto-approve) →`yolo`\n\n. File edits show a**colored diff** before you approve them.- Status line shows model · mode · messages · $/day ·\n**context meter**· open todos;** Ctrl+O**expands recent tool results,** Ctrl+T**shows the agent's todo checklist (`update_todos`\n\ntool); code blocks get lightweight**syntax highlighting**;`/theme`\n\nswitches palettes; an**OSC 9 desktop notification** fires when a turn finishes while the terminal is unfocused. `/btw <q>`\n\nasks an ephemeral side question (sees the conversation, never joins it);`/web <url>`\n\npulls a page into context as text.\n\n`--plain`\n\n([src/cli/repl.js](/ajensenwaud/varela/blob/main/src/cli/repl.js)) drops to a line-by-line readline console (used automatically when output is piped). Both honor`NO_COLOR`\n\n. -\n**Daemon + attach**([src/net/daemon.js](/ajensenwaud/varela/blob/main/src/net/daemon.js)) —`varela --daemon`\n\nhosts the runtime behind a localhost WebSocket (hand-rolled RFC 6455,[src/net/ws.js](/ajensenwaud/varela/blob/main/src/net/ws.js); port`daemon.port`\n\n, default 7717, token-authenticated via`~/.varela/daemon.token`\n\n). Starting`varela`\n\nwhile a daemon runs auto-attaches: the REPL becomes a thin client, the conversation and scheduler live in the daemon, several clients can attach at once, and background output (scheduler, heartbeat, sub-agents) is broadcast to all of them. Interactive prompts (`/login`\n\n,`/configure`\n\n, tool confirmations) round-trip over the socket. -\n**Sub-agents**—`/delegate build the parser :: write its tests`\n\nspawns one sub-agent per`::`\n\n-separated task; they run in parallel with fresh conversations and report back to your screen as they finish (`/delegate`\n\nalone lists them). The model can fan out itself via the`delegate`\n\ntool (waits for all children, max 8). Sub-agent tool calls are auto-approved. -\n**Orchestration**([src/orchestrator.js](/ajensenwaud/varela/blob/main/src/orchestrator.js)) —`/orchestrate <objective>`\n\nruns a full**plan → capped parallel fan-out → synthesize** cycle: the model decomposes the objective into independent subtasks, they run as sub-agents with a concurrency cap (default 3), and their reports are synthesized into one answer. Also available to the model as the`orchestrate`\n\ntool. Every stage emits world events, so the 3D world animates the whole fan-out. -\n**Personality**—[AGENTS.md](/ajensenwaud/varela/blob/main/AGENTS.md)at the harness root defines varela's voice and disposition; it's appended to the system prompt. Add`~/.varela/AGENTS.md`\n\nfor personal overrides. Since the harness is self-mutating, varela can be asked to revise its own personality. -\n**Context compaction**— long conversations auto-summarize once they pass`compactAt`\n\n(~80k tokens by default): older turns are compressed into a context block, the recent turns kept verbatim, always cut at a clean turn boundary.`/compact`\n\nforces it. -\n**Sessions**([src/sessions.js](/ajensenwaud/varela/blob/main/src/sessions.js)) — every conversation persists to`~/.varela/sessions/`\n\n;`/sessions`\n\nlists them,`/resume <id>`\n\ncontinues one after a restart (REPL or daemon),`/clear`\n\nstarts a new one. -\n**MCP client**([src/mcp/client.js](/ajensenwaud/varela/blob/main/src/mcp/client.js)) — declare servers in`~/.varela/mcp.json`\n\nand their tools appear as`mcp__<server>__<tool>`\n\n(stdio transport, newline-delimited JSON-RPC, zero deps). Read-only-annotated tools skip confirmation; everything else asks.`/mcp`\n\nshows status. Server connections survive hot reloads. -\n**Cost tracking**([src/usage.js](/ajensenwaud/varela/blob/main/src/usage.js)) — every reply's token usage is priced (editable table,`config.prices`\n\noverrides) into a session total and a 90-day daily ledger.`/usage`\n\nbreaks it down;`dailyCapUsd`\n\nin`/configure`\n\nsets a hard daily spend cap that stops the loop when hit — essential for unattended daemon operation. The status bar above each prompt shows model · messages · today's spend · running sub-agents · heartbeat. -\n**Self-improvement loop**([src/trajectory.js](/ajensenwaud/varela/blob/main/src/trajectory.js)) — every episode (prompt, tool calls, outcome, duration, errors) is logged to`~/.varela/trajectories/*.jsonl`\n\n.`/good`\n\nand`/bad`\n\ngrade the last episode;`/reflect`\n\ndistills recent failures into`~/.varela/LESSONS.md`\n\n(loaded into the system prompt, so mistakes stop repeating);`/distill`\n\nturns repeated successful tool patterns into new purpose-built tools via`create_tool`\n\n. The trajectory format doubles as SFT-ready data if you later fine-tune a local model. -\n**WASM tools as an extension format**— drop`<name>.wasm`\n\n+`<name>.json`\n\n(manifest:`{name, description, parameters, module, dangerous?, preopenDir?}`\n\n) into`~/.varela/extensions/wasm-tools/`\n\n; input arrives as JSON on stdin, stdout is the result, and execution is sandboxed (no fs/network unless the manifest grants a directory). Tools can be written in any language that compiles to WASI — including by varela itself. -\n**Terminal markdown**([src/cli/md.js](/ajensenwaud/varela/blob/main/src/cli/md.js)) — assistant replies render headings, bold, inline code, fenced code blocks, lists and quotes, including line-by-line while streaming. -\n**Git-backed undo**([src/undo.js](/ajensenwaud/varela/blob/main/src/undo.js)) — before`write_file`\n\n,`edit_file`\n\n,`self_edit`\n\nor`create_tool`\n\ntouches a file, the pre-change content is snapshotted: into the enclosing repo's git object store when there is one (`git hash-object -w`\n\n— no branches or index touched), else into a content-addressed store under`~/.varela/undo-store`\n\n.`/undo`\n\nreverts the last change-set (`/undo 3`\n\nthe last three,`/undo list`\n\nshows the journal); files that were created get deleted again.`shell`\n\noutput is not covered — that's what real commits are for. -\n**3D cyberpunk web world**([src/web/](/ajensenwaud/varela/blob/main/src/web)) —`varela --web`\n\nopens a browser onto a neon-grid city (Three.js + bloom, loaded from a CDN — the harness itself stays dependency-free) that is a**full client to the daemon**: the same chat, streaming, slash commands and tool confirmations as the console. The agent is a person on the plaza; when it spawns sub-agents (`/delegate`\n\n,`/orchestrate`\n\n, or the model deciding to),**avatars appear on the fly**, glow as they think / call tools / speak, and drift away when done — driven by the runtime's world-event bus over the WebSocket. The surrounding city is your**workspace**: files and directories become buildings (sized by bytes, colored by type), and when the agent touches a file its avatar** walks to that building**and it lights up.** Record**the canvas to a shareable`.webm`\n\n, or**replay** the last run as a cinematic — both from the HUD. Navigate with**WASD / arrows**,** mouse look**(click the scene for pointer-lock),** Space/Shift**for up/down,** Tab**to jump to chat,** Esc**to release. Served by the same daemon that hosts the console/TUI, so every surface shares one live conversation. -\n**Mesh — a P2P human-agent world**([docs/mesh.md](/ajensenwaud/varela/blob/main/docs/mesh.md),[src/mesh/](/ajensenwaud/varela/blob/main/src/mesh)) — agents on different machines meet in a shared world, each still owned and controlled by its human, each exposing a**chosen subset of its skills** for others' agents to consume. A peer's skill appears in your agent's registry as`peer__<name>__<skill>`\n\nand calls RPC to the owner's daemon, which runs it and returns only the result —**credentials, files and shell never leave the owner's machine.** Discovery via a thin`varela hub`\n\n;**direct peer-to-peer WebSocket links** where reachable (hub only as fallback, no relay in the data path). Ed25519 identity, signed messages, and a policy gate: exposure is off by default,`public`\n\nis recommended only for wasm-sandboxed skills, everything else is`confirm`\n\n/`allowlist`\n\nwith rate + cost caps, full audit, and`/mesh pause`\n\n. In the 3D world, peers are avatars you can see and whose skills you can invoke. Configure shared skills in`~/.varela/mesh/world.json`\n\n;`/mesh`\n\nto manage. (WebRTC/NAT traversal deferred to keep the harness zero-dependency — see the doc.) -\n**Mission-control dashboard**([src/cli/dashboard.js](/ajensenwaud/varela/blob/main/src/cli/dashboard.js)) —`varela --dash`\n\nis a full-screen terminal dashboard (not a chat log): a live agent tree, cost/token**sparklines**, growth stats, the scheduler timeline and a streaming activity pane, all fed by the same world-event bus. For the SSH/headless user who lives in a terminal.`Tab`\n\nto type a task/command. -\n**Growth stats**([src/stats.js](/ajensenwaud/varela/blob/main/src/stats.js)) — the \"gets better the longer it runs\" numbers (skills built, lessons learned, episodes, feedback rate), surfaced via`/stats`\n\n, the status bars, and the web/dashboard headers. -\n**Split-view TUI**([src/cli/tui.js](/ajensenwaud/varela/blob/main/src/cli/tui.js)) —`varela --tui`\n\nopens a full-screen, three-panel interface on the alternate screen buffer (zero deps, one write per frame): a**file tree**(left, expandable), the** conversation**(right, streaming markdown, scrollable), and a** file preview**(right-bottom, line-numbered, opens when you pick a file).`Tab`\n\ncycles focus, arrows navigate/scroll the focused panel,`Enter`\n\nopens a file or sends a message,`Ctrl+O`\n\ndrops the previewed file's path into your prompt,`Esc`\n\ncloses the preview,`Ctrl+C`\n\nquits. Same runtime as the console (agent, scheduler, sessions, cost tracking), just a richer front-end. The ANSI-aware layout helpers (`fit`\n\n,`wrapAnsi`\n\n,`layout`\n\n) are unit-tested. Like the console, it**attaches to a running daemon** if one is up (streaming and slash commands round-trip over the WebSocket, conversation lives in the daemon) and hosts a local runtime otherwise. -\n**Scheduler**([src/scheduler.js](/ajensenwaud/varela/blob/main/src/scheduler.js)) — persistent scheduled tasks (`~/.varela/tasks.json`\n\n) checked every 15s while varela runs, in the console or headless via`varela --daemon`\n\n. Specs:`every 5m`\n\n,`daily 09:30`\n\n,`in 10m`\n\n,`at 2026-07-02T15:00`\n\n. Each run gets a fresh conversation and**auto-approves tools**(nobody is at the prompt) — schedule accordingly. -\n**Heartbeat**— periodic autonomous check-in (`/heartbeat on 30m`\n\n). Each beat the agent reads`~/.varela/HEARTBEAT.md`\n\nand carries out whatever standing instructions are due; if the file is missing or empty the model call is skipped entirely, so an idle heartbeat costs nothing.\n\n| command | |\n|---|---|\n`/login <provider> [oauth|key]` |\nauthenticate (OAuth is the default) |\n`/logout <provider>` |\nremove stored credentials |\n`/providers` |\nlogin status per provider |\n`/model [provider/model]` |\ninteractive model picker, or switch directly |\n`/configure` |\ninteractive settings editor (model, heartbeat, daemon port, …) |\n`/delegate <t1> [:: <t2> …]` |\nspawn parallel sub-agents; bare `/delegate` lists them |\n`/orchestrate <objective>` |\nplan → capped parallel fan-out → synthesize |\n`/stats` |\ngrowth: skills built, lessons learned, episodes, feedback |\n`/mesh [status|connect|peers|pause|block <id>]` |\nthe P2P human-agent world |\n`/status` |\nmodel, session, spend, sub-agents, MCP, heartbeat at a glance |\n`/sessions` · `/resume <id>` |\nlist / continue saved conversations |\n`/compact` |\nforce context compaction |\n`/mcp [reload]` |\nMCP server status (config: `~/.varela/mcp.json` ) |\n`/usage` |\ntokens + cost, session and today, per model |\n`/good [note]` · `/bad [note]` |\ngrade the last episode (feeds self-improvement) |\n`/reflect` |\nturn recent failures into lessons (loaded into the system prompt) |\n`/distill` |\nturn repeated successful patterns into new tools |\n`/undo [n|list]` |\nrevert the last n file mutations (git-backed) |\n`/rewind [n]` |\ndrop the last n conversation turns |\n`/mode [plan|default|acceptEdits|yolo]` |\npermission mode (Shift+Tab cycles) |\n`/btw <question>` |\nephemeral side question — never joins the conversation |\n`/web <url>` |\nfetch a page as text into context |\n`/theme [neon|mono|ocean]` |\nconsole theme |\n`/models` |\nmodel suggestions per provider |\n`/tools` |\nlist loaded tools (⚠ = needs confirmation) |\n`/schedule` |\nlist scheduled tasks |\n`/schedule add <spec> :: <prompt>` |\ne.g. `/schedule add daily 09:00 :: tidy my downloads` |\n`/schedule rm <id>` · `/schedule run <id>` |\nremove / run now |\n`/heartbeat [on|off] [interval]` |\ne.g. `/heartbeat on 15m` |\n`/reload` |\nhot-reload tools, extensions, providers |\n`/yolo` |\ntoggle auto-approval of dangerous tools |\n`/clear` |\nreset the conversation |\n`/config` , `/help` , `/exit` |\nthe obvious |\n\nEnvironment variables `ANTHROPIC_API_KEY`\n\n, `OPENAI_API_KEY`\n\n,\n`OPENROUTER_API_KEY`\n\nare picked up automatically if you never run `/login`\n\n.\n\n`read_file`\n\n· `write_file`\n\n· `edit_file`\n\n· `list_dir`\n\n· `shell`\n\n(PowerShell on\nWindows, bash on Linux) · `wasm_run`\n\n/ `wasm_list`\n\n· `delegate`\n\n· `orchestrate`\n\n·\n`self_list`\n\n/ `self_read`\n\n/ `self_edit`\n\n· `create_tool`\n\n— plus anything from\nJS extensions, WASM manifests, and MCP servers.\n\n```\nnpm test        # node --test, 18 tests\n```\n\nUnit tests live in [test/varela.test.mjs](/ajensenwaud/varela/blob/main/test/varela.test.mjs); integration\ntests ([test/integration.test.mjs](/ajensenwaud/varela/blob/main/test/integration.test.mjs)) spawn the\ndaemon-protocol and TUI-attach harnesses in [tools/itest/](/ajensenwaud/varela/blob/main/tools/itest) as\nchild processes, each with an isolated `VARELA_HOME`\n\nand an ephemeral daemon\nport, so they never touch your real `~/.varela`\n\nor a running daemon.\n\n```\nbin/varela.js            entry point (REPL, -p one-shot, --daemon)\nAGENTS.md                personality (appended to the system prompt)\nsrc/surface.js           the Surface primitive — the I/O seam (one runtime, many front-ends)\nsrc/kernel.js            shared services: config · router · registry · tracker · events\nsrc/agents.js            conversation layer: agent loop + sub-agents + sessions + todos\nsrc/agent.js             the Agent (streaming, tool confirmation, permission modes)\nsrc/runtime.js           buildRuntime — the assembler that wires kernel + conv + scheduler + mesh\nsrc/commands.js          slash commands (shared by REPL and daemon)\nsrc/router.js            model router + credential handling\nsrc/providers/           anthropic.js, openai.js, openrouter.js, openai-compat.js, sse.js\nsrc/auth/oauth.js        PKCE, loopback callback server, token refresh helpers\nsrc/net/                 ws.js (RFC 6455), daemon.js\nsrc/scheduler.js         scheduled tasks + heartbeat\nsrc/sessions.js          session persistence\nsrc/usage.js             token/cost ledger + spend caps\nsrc/trajectory.js        episode logging + feedback (self-improvement substrate)\nsrc/undo.js              git-backed file snapshots + /undo\nsrc/orchestrator.js      plan → fan-out → synthesize\nsrc/stats.js             growth stats (skills, lessons, episodes, feedback)\nsrc/workspace.js         bounded workspace snapshot (files → city buildings)\nsrc/cli/dashboard.js     mission-control dashboard (--dash)\nsrc/mesh/                P2P world: identity, protocol, hub, link, remote tools\nsrc/web/                 3D cyberpunk world (index.html, app.js, style.css)\nsrc/net/static.js        static file server for the web world\nsrc/mcp/client.js        MCP client (stdio JSON-RPC)\nsrc/tools/               registry + built-ins (self-mutation, delegate, wasm, shell)\nsrc/wasm/sandbox.js      WASI sandbox\nsrc/cli/                 repl.js, tui.js (split-view), md.js, banner.js, ansi.js\ntest/                    node --test suite\n~/.varela/               config.json, credentials.json, daemon.token, tasks.json,\n                         sessions/, trajectories/, usage.json, mcp.json,\n                         undo.jsonl, undo-store/,\n                         AGENTS.md + LESSONS.md (optional), extensions/, wasm/\n```\n\nA tool extension (`~/.varela/extensions/tools/fetch_url.js`\n\n):\n\n```\nexport default {\n  name: 'fetch_url',\n  description: 'HTTP GET a URL and return the body as text.',\n  parameters: { type: 'object', properties: { url: { type: 'string' } }, required: ['url'] },\n  dangerous: false,\n  async execute({ url }) {\n    return (await fetch(url)).text();\n  },\n};\n```\n\nThe agent can (and will) write these itself via `create_tool`\n\n.\n\n- OAuth flows use the public client IDs of the vendors' own CLIs (Claude Code, Codex). Anthropic OAuth uses a paste-the-code flow; OpenAI and OpenRouter use a localhost callback. Use them only with accounts/plans that permit CLI access; API keys always work.\n**OpenAI has two paths, chosen by credential kind.** An**API key** uses the standard chat-completions API. A**ChatGPT/Codex OAuth login**(`varela import --codex`\n\n, or`varela login openai`\n\n) is routed to OpenAI's Codex backend (`chatgpt.com/backend-api/codex/responses`\n\n, the Responses API) — those tokens are rejected by the standard API (no pay-as-you-go billing) but are included with the ChatGPT subscription. Use a plain model id with the subscription (`/model openai/gpt-5.5`\n\n); codex-suffixed ids like`gpt-5-codex`\n\nare refused on ChatGPT accounts. See[openai-responses.js](/ajensenwaud/varela/blob/main/src/providers/openai-responses.js).- Replies stream token-by-token in the console and over the daemon socket; scheduled/sub-agent runs are non-streaming (their output is a report).\n- The daemon binds to 127.0.0.1 only and requires the token in\n`~/.varela/daemon.token`\n\n; anything that can read your home directory can attach — it's a local control socket, not a network service. - Credentials are stored in plaintext at\n`~/.varela/credentials.json`\n\n(mode 0600 on POSIX). Consider OS keychain integration for anything serious.", "url": "https://wpnews.pro/news/varela-neuromancer-inspired-self-mutating-coding-harness", "canonical_source": "https://github.com/ajensenwaud/varela/", "published_at": "2026-07-04 05:31:21+00:00", "updated_at": "2026-07-04 05:49:44.585638+00:00", "lang": "en", "topics": ["ai-agents", "developer-tools", "ai-tools", "large-language-models", "ai-infrastructure"], "entities": ["Varela", "Anthropic", "OpenAI", "OpenRouter", "Claude Code", "Codex", "Node.js", "WASM"], "alternates": {"html": "https://wpnews.pro/news/varela-neuromancer-inspired-self-mutating-coding-harness", "markdown": "https://wpnews.pro/news/varela-neuromancer-inspired-self-mutating-coding-harness.md", "text": "https://wpnews.pro/news/varela-neuromancer-inspired-self-mutating-coding-harness.txt", "jsonld": "https://wpnews.pro/news/varela-neuromancer-inspired-self-mutating-coding-harness.jsonld"}}