Local Agents
Local agents run a coding agent, such as Codex or Claude Code, on your machine. You send them work from One Horizon, and each run stays linked to its initiative, bug, or todo.
A local agent only takes work from its owner, on the machine where it was set up. Other workspace members cannot start runs on your machine by assigning you work.
Before you begin
- Sign in to Desktop with the workspace that owns the work.
- Have Git available. Desktop can use its bundled Git; the CLI needs Git in your terminal.
- Install and sign in to the coding agent you want to use, unless it is Codex, which is bundled. See Coding agent requirements.
- Have a writable repository with a base branch such as
main. Desktop can also create or clone one for you. - For pull requests, merge requests, or handing work to another machine, the repository needs an
originremote this machine can push to.
Local agents sign in with OAuth. API keys cannot create or run them.
Desktop setup
Local agents are listed on the agents page under Workflows.
Open Add agent
Sign in to Desktop, choose the workspace, open Workflows, then open the agents page and select Add agent.
Choose the project path
Create a new GitHub project, clone an existing remote, or select a valid existing folder. If you create a project, connect GitHub first, choose the owner and repository name, then confirm the local path preview. GitLab projects can be cloned or selected as existing folders when this machine can push to them. Public repositories show a warning before setup continues.
Choose the coding agent and preset
Select Codex, Claude Code, Cursor, OpenCode, Mistral Vibe, Hermes, Cline, DeepSeek Harness, or OMP, then choose a compatible preset. OpenCode, Hermes, Cline, DeepSeek Harness, and OMP declare code work only, so choose Builder.
Set access and ownership
Choose Read-only, Workspace access, or Full access. Set the agent name for the project this agent will own on this machine.
Configure the workspace
Choose the workflow file, code isolation, and pull request or merge request behavior. Select a model and, for supported Codex models, reasoning effort. After setup, add skills, MCP servers, or plugins from the agent's Capabilities card; Agent capabilities lists which coding agents support each.
Start the agent
Select Set up agent. Desktop registers the agent, writes local harness settings, starts the process when possible, and opens its details page. Start it from that page if automatic startup did not succeed.
The access level is the agent's trust boundary for commands, files, and tools. Full access grants host-level trust. Choose it only for repositories and instructions you trust, and keep credentials out of work text, comments, and documents.
Desktop opens a browser sign-in to authorize the agent, which then runs as a separate process. Closing the Desktop window does not stop it. Stop agent releases its active work and shuts it down.
Once the agent is online, open an initiative, bug, or todo and select Send to... to start a run. Picking a specific agent sends the run to that agent only.
Other ways to create an agent
Get started on the Workflows overview creates one agent for your chosen harness plus starter workflows in one pass. That agent runs every workflow step. In the workflow designer, Create agent in an agent step's Agent selector creates an agent and selects it for that step. From a terminal, follow Use in Terminal.
Coding agent requirements
One Horizon never supplies a model credential. Each coding agent must be installed on your PATH and signed in with its own account before setup. Desktop and the CLI disable any agent they cannot find.
- Codex: bundled with One Horizon. Codex covers thread links and behavior.
- Claude Code: the
claudebinary, signed in to Claude Code. See Claude Code. - Cursor: the
agentbinary (some installs call itcursor-agent), signed in. The Cursor IDE and its MCP connector are not enough on their own. See Cursor. - OpenCode: the
opencodeCLI with a signed-in provider. Follow the OpenCode setup guidance. - Mistral Vibe: the
vibe-acpbinary, withMISTRAL_API_KEYset on this machine. - Hermes: the
hermesbinary from Nous Research. Sign in withhermes loginorhermes acp --setupfirst. Setup runshermes acp --check. - Cline: the
clinebinary (npm install -g cline), signed in withcline auth. That covers a Cline account, a ChatGPT subscription, or your own provider key. Setup runscline doctor. - DeepSeek Harness: the
dshbinary (npm install -g @deepseek-ai/dsh), a developer preview from DeepSeek whose behavior can change between versions. SetDEEPSEEK_API_KEY, or store the key with DeepSeek's credential service. Because DeepSeek Harness only reports a missing key on its first prompt, setup sends it one short test turn. - OMP: the
ompbinary from Oh My Pi. Configure a provider inside OMP (/login, or a provider API key in its environment).
Claude Code and Cursor can start their own login from the setup dialog. The other coding agents use credentials you set up with the vendor. If one reports that it is signed out, setup stops before the agent is created, shows Sign in required, and links to the vendor's help page.
Presets
The preset sets the starting access level and pull or merge request behavior:
| Preset | Default agent access | Default PR/MR creation |
|---|---|---|
| Builder | Workspace access | On |
| Planner | Read-only | Off |
| Reviewer | Workspace access | Off |
Builder edits files in the task workspace. Planner investigates and plans. Reviewer can run local tools and browser automation. You can change these settings later.
Project folder and worktrees
In Desktop, Create new project creates a GitHub repository and a local checkout, Clone repository clones an existing GitHub, GitLab, or Bitbucket repository, and Use existing folder uses a folder that is already a Git repository. The folder cannot be changed after the agent is created; create a new agent to use another repository.
By default, each run gets its own worktree under ~/.one/worktrees, created from your repository. To store worktrees elsewhere, add worktreesDir to ~/.one/config/local.json:
{ "worktreesDir": "D:\\OneHorizon\\worktrees"}
With Branch per task, runs use the selected folder directly and switch branches.
When you create or clone through a connected GitHub account, Desktop sets up a Git credential helper scoped to that repository, so no provider token is written into the project folder. GitLab, Bitbucket, and existing folders use the Git credentials already on this machine.
macOS protected folders
Choosing a repository in Documents, Downloads, or Desktop can trigger a macOS file-access prompt. The grant covers only the folder you select, and the agent inherits it. Running one agent from Terminal uses your shell's access instead.
Settings
Open the agent from the agents page to see its Settings card, in the browser or in Desktop.
| Setting | What it controls |
|---|---|
| Model | Which model the agent uses for local runs. Options depend on the agent harness. |
| Reasoning effort | Codex only, for models that support adjustable reasoning. Low, Medium, High, and Max trade speed against depth and token use. |
| Agent access | Read-only blocks file modifications, Workspace access allows the agent to use local tools inside the configured workspace boundary, and Full access grants host-level trust. Provider-specific harness flags are derived from this setting. |
| Code isolation | Worktree per task gives each run its own task worktree. Branch per task shares the repository and switches branches per run. |
| Workflow file | Path to the workflow file the agent reads, such as WORKFLOW.md. |
| Maximum concurrent tasks | How many sessions this agent can take on at once (12 by default). Runs still wait for the computer's execution limit and resource checks before they start. |
| Execution limit on this computer | Desktop only. How many runs can execute at once across every Desktop and CLI agent on this computer (12 by default). Runs also wait while CPU load, free memory, process count, or thermal pressure is over its limit. The CLI equivalent is one agent limit <count>. |
The Workflow file holds local settings such as hooks, worktree behavior, and commands. It is not the same as a workflow you build in the workflow designer.
Change a setting, then select Save settings. Auto start saves immediately and is on by default; turn it off if the agent should not start when Desktop opens.
Settings saved in the browser apply after the agent restarts on its machine. In Desktop, use Agent actions → Restart agent, or Restart all agents on the agents page. From the CLI, run one agent stop and one agent start.
Only you can open or change a local agent you own.
Sign-in and account changes
One operating-system user profile runs one One Horizon account at a time. Local configuration, credentials, repositories, and processes stay inside that profile.
| Event | What happens |
|---|---|
| Close Desktop while signed in | Detached agents keep running, refreshing authorization, and renewing active session claims. |
| Desktop session expires | Agents keep running with their separate local-agent authorization. Desktop asks you to sign in again. |
| Open Desktop while signed out | No agent starts until you authenticate as the identity that owns its local config. |
| Sign out of One Horizon | Desktop releases active claims, stops that identity's agents, and clears their local authorization. The configs stay on disk for the same identity. |
| Switch accounts in one operating-system profile | Sign-out finishes first. The next account cannot see or start the previous account's local agents. |
| Use separate macOS, Windows, or Linux login profiles | Each active operating-system session can run its own One Horizon identity, Desktop instance, credentials, and repositories. |
| Log out of the operating system, restart, or shut down | The operating system can stop agents. Matching agents with Auto start enabled start after that user opens Desktop and signs in again. |
An agent config is bound to its owner, dashboard origin, and machine. Older unbound configs are checked against the server before Desktop binds them. Desktop never starts a config that belongs to another account, or an unbound config for a newly signed-in account.
Agents in separate operating-system profiles only keep running while that profile stays signed in and active. Fast user switching can suspend them, depending on the operating system.
After updates
When Desktop installs an update, it stops your running local agents, relaunches, and restarts them on the new version. If one does not come back, use Agent actions → Restart agent. If you replace the app outside the updater, restart your agents yourself.
After a CLI update, the next CLI command restarts background agents. Stop and start foreground agents yourself.
Fix project setup failures
When project setup fails, Desktop shows the problem and the fix in the setup flow. Run diagnostics collects redacted Git, remote, and credential details you can send to support.
| Family | What it usually means | Primary action |
|---|---|---|
| F1 | Network, DNS, or provider reachability failed. | Try again after the connection is stable. |
| F2 | The connected provider account was disconnected or revoked. | Reconnect the affected provider account. |
| F3 | Provider scopes, SSO, SAML, or organization policy blocked the action. | Authorize the provider connection for that owner. |
| F4 | The repository name or local destination already exists. | Choose another name or folder. |
| F5 | The folder is not a usable non-bare Git repository with origin. | Let Desktop initialize it, add a remote, or choose another folder. |
| F6 | Git cannot push to the remote from this machine. | Fix the Git credentials on this machine. |
| F7 | The provider rejected the create, clone, or push operation. | Try again or choose another owner. |
| F8 | Desktop cannot write to the selected folder. | Choose a writable location. |