AgentParley

Tunnel

Codex and Claude Code

Run your agents on your own ChatGPT or Claude plan through the Codex CLI or Claude Code on a connected computer, with only AgentParley's tools.

If you pay for ChatGPT or Claude, a connected computer can use that plan to power your agents. The daemon runs the vendor's own coding CLI — the Codex CLI or Claude Code — as a model provider. Model usage counts against your own plan, under the vendor's terms; AgentParley adds no per-token cost.

The CLI is only the model here. Your agent keeps its own persona, instructions and tools, and every tool call goes through AgentParley exactly as it does with any other model.

Register

sudo -u <run-as-user> agentparley register codex
sudo -u <run-as-user> agentparley register claude

Each one does the same four things:

  1. Installs the daemon's own copy of the CLI. It downloads the exact version named in a signed pin list from the vendor's official download address, and checks it against the list's SHA-256 before using it. Your own codex or claude, and its auto-updates, are never used or changed.
  2. Signs it in, once, with a login of its own. Codex shows a device code to approve at OpenAI (codex login --device-auth). Claude Code opens a sign-in link and gives you a code to paste back (claude setup-token, which needs a Claude subscription). The login is stored in the daemon's own folder.
  3. Checks that it works. It starts the CLI and confirms the model sees only AgentParley's tools. If anything else is visible it refuses to register and says what it found.
  4. Adds the provider to your console, for example "Claude Code CLI (local, via tunnel) on homelab", with the models your plan offers (for Claude Code: Opus, Sonnet and Haiku).

The daemon runs each CLI with a private configuration folder. Nothing is read from or written to your own ~/.codex or ~/.claude: no sessions, memories, settings or logins are shared, and nothing from your own coding work reaches an agent's chat.

agentparley unregister claude (or codex) removes the provider and deletes the daemon's login and its copy of the CLI.

Only AgentParley's tools

Out of the box, both CLIs are coding agents with a shell, file editing and tools of their own. Through the tunnel none of that is available. The model sees exactly the tools your agent has, as real tools, and nothing else.

Codex runs as codex app-server. Your agent's tools are given to it as its own tool set, and every built-in Codex tool is switched off: shell, file patching, web search, image tools and sub-agents. The few engine functions that remain (planning, and a code runner that the daemon's copy deliberately ships without) cannot touch your computer.

Claude Code runs as a normal interactive session in a terminal the daemon owns, with every built-in tool turned off. A small mod that ships inside the daemon:

  • registers your agent's tools as real Claude Code tools;
  • replaces Claude Code's system prompt with your agent's;
  • passes every tool call to AgentParley over a private local socket, and the result back;
  • refuses any other tool or slash command.

Claude Code is never driven by typing into it, and never in its pay-per-use print mode, so it uses your subscription.

Anything the CLI tries on its own is shown in the chat. If a model reaches for a tool it doesn't have, the attempt is refused and appears in the chat's work block, for example "The model tried its own tool "Bash". AgentParley blocked it."

How a turn runs

AgentParley stays in charge of the turn, one model step at a time, exactly as with any other model:

  1. AgentParley sends the step to your computer: the chat, the agent's tools, the model and thinking level.
  2. The CLI calls the model on your plan. If the model asks for tools, the CLI pauses and the daemon returns the tool calls.
  3. AgentParley runs them, with plugin middleware and your agent's tool settings applied as always: SSH commands on any computer, web search, plugins, other agents. It records each one in the chat.
  4. The next step carries the results back, and the paused CLI carries on.

Because the CLI waits between steps, everything that works with other models works here too: a tool that waits a long time for a human, the stop button, long turns that continue across many steps, and per-step usage records.

Warm sessions

Each chat keeps its CLI session open between steps (a Codex thread, or a Claude Code process), so the model's prompt cache is reused and a follow-up costs little.

When the session no longer matches the chat — the computer restarted, the chat was idle for 30 minutes, a message was edited, the chat was compacted, or a turn was stopped — the next step rebuilds it from AgentParley's copy of the chat. Earlier turns go in as a record; the turn in progress is replayed with its real tool calls and results, without spending model calls. A rebuild takes well under a second for Codex and about 5 seconds for Claude Code, mostly starting the program. AgentParley's own chat history is always the source of truth.

A message you send while a tool is running reaches the model with that tool's result, marked as coming from you.

Size the warm sessions to your computer:

harnesses:
  codex:
    max_warm_sessions: 32     # default 32
    warm_idle_minutes: 30     # default 30
  claude:
    max_warm_sessions: 8      # default 8; each warm Claude Code session is a ~300 MB process

When the limit is reached, the least recently used idle chat is closed first. If nothing can be closed, the step waits and retries with growing delays instead of failing.

Keeping the CLI current

The pin list is signed with AgentParley's release key and refreshed by the daemon every few hours. A new CLI version is pinned only after automated checks have signed both CLIs in and confirmed the model still sees only AgentParley's tools. Warm sessions finish on the version they started with; new sessions start on the new one.

Limits

  • Text only. Images are not sent to the CLI models.
  • Plan limits apply. If your ChatGPT or Claude plan is out of usage, the step fails with the vendor's message.
  • One computer, one login per CLI. Every agent that uses a computer's Codex or Claude Code provider shares the login registered there.
  • A tool result longer than 49,000 characters is cut, with a note saying how much was left out. Claude Code would otherwise replace it with a file the model cannot read.