Dive into Claude Code: The Design Space of Today's and Future AI Agent Systems
Jiacheng Liu, Xiaohan Zhao, Xinyi Shang, Zhiqiang Shen
cs.SE, cs.AI, cs.CL, cs.LG
2026-04-15
VILA Lab reverse-engineers Claude Code v2.1.88: a thin model-tool loop plus seven permission modes, five-layer compaction, and four extensions, compared with OpenClaw and Hermes.
Coding agents have moved from inline suggestions to tools that run commands, edit files, and iterate on failures. Anthropic documents an "agentic loop" for Claude Code and does not publish an architecture. Researchers at MBZUAI's VILA Lab and UCL reverse-engineered the TypeScript extracted from the public npm package of Claude Code v2.1.88, about 1,884 files and 512K lines, then compared the design with OpenClaw and Hermes Agent.
The interesting questions are the ones every production agent has to answer: where reasoning lives, what the default safety posture is, how the context window is treated as a scarce resource, how the extension surface is split, how subagents are isolated, and how sessions persist. The paper pins Claude Code's answers to specific files.
Claims sit on three evidence tiers. Tier A is official docs and engineering posts, which capture intent. Tier B cites files and functions in the extracted source, the strongest tier. Tier C is community reconstruction and cross-system comparison, hedged in the text.
Five values are pulled from Anthropic's own safe-agent writing and Constitution: human decision authority, safety and privacy, reliable execution, capability amplification, and contextual adaptability. Those values become thirteen design principles, then get traced into query.ts, permissions.ts, and tools.ts. A running example, "fix the failing test in auth.test.ts," is walked through the query loop, permission gate, tool pool, compaction pipeline, subagent spawn, and session resume.
The comparison systems are chosen for contrast, not similarity. OpenClaw is a multi-channel personal-assistant gateway. Hermes Agent is a single Python process whose role is set by its entry point. Same design questions, different deployment contexts, different answers.
The core loop is thin. queryLoop() is an async generator that calls the model, runs tools, and feeds results back until the model emits text only. Community analysis of the extracted source estimates about 1.6% of the codebase is AI decision logic; the remaining 98.4% is deterministic infrastructure for permissions, routing, compaction, and recovery.
The default safety posture is deny-first: unmatched risky actions escalate to the user. Seven permission modes span plan, default, acceptEdits, auto (an ML classifier), dontAsk, bypassPermissions, and an internal bubble mode for subagents. Anthropic measured users approving about 93% of permission prompts, which makes click-through a weak sole control; sandboxing cut prompt frequency by an estimated 84%. The tool pool can include up to 54 built-ins, 19 always present and 35 gated by flags and user type. There are 27 hook events; five of them sit in the permission flow.
Context is the binding constraint: 200K for older models, 1M for the Claude 4.6 series. Five shapers run before every model call: budget reduction, snip, microcompact, context collapse, then auto-compact as a model-written summary. Extensibility is four mechanisms ordered by context cost: hooks are free by default, skills cost a short description, plugins are the packaging layer, MCP is expensive because it injects full tool schemas. Subagents run in isolated windows and return summaries only; agent teams in plan mode consume about 7x the tokens of a standard session. Sessions are mostly append-only JSONL. Resume and fork do not restore session-scoped permissions.
| Axis | Claude Code | OpenClaw | Hermes |
| Deploy | Per-session CLI/IDE | Persistent WebSocket gateway | One process, role set by entry |
| Trust | Per-action, seven modes | Perimeter pairing and allowlists | Per-action approvals across many surfaces |
| Context | Five-layer compaction | Structured long-term memory | One summarizer plus pre-injection scan |
For people building agents, this is a map of a production harness. The loop can stay simple. The shippable parts are layered permissions, graduated compaction, and extensions priced by context cost.
For people already running Claude Code, a few details change how you configure it. CLAUDE.md is delivered as a user message, not a system prompt, so compliance is probabilistic; deny rules are the deterministic layer. Resume will not carry last session's grants. Subagents do not inherit parent history by default, so the spawn prompt has to be self-contained. Use hooks for zero-cost interception; reach for MCP when you actually need new tools.
The comparison's useful claim is compositional. OpenClaw can host Claude Code over ACP. Hermes can sit on either side of the host/guest split. These are layers that compose, not exclusive product categories.
This is an architecture paper, not a new algorithm. Its value is making a closed product's implementation choices inspectable, and naming a gap: the architecture barely encodes long-term developer understanding. Anthropic's internal survey of 132 people found about 27% of Claude Code-assisted tasks would not have been attempted without the tool. Independent work found developers in AI-assisted conditions scoring 17% lower on comprehension tests. That gap is written as a future design question, not as a shipped mechanism.
The analysis is a snapshot of v2.1.88. Feature flags such as TRANSCRIPTCLASSIFIER and CONTEXTCOLLAPSE can tree-shake whole subsystems at build time, so different binaries can behave differently. Source code can prove structure. It cannot prove which flags are on in production, or how often a path runs.
The 1.6% / 98.4% split is a community estimate, not an official figure. OpenClaw and Hermes are themselves snapshots.
Defense in depth assumes independent layers. They are not fully independent. Bash commands with more than 50 subcommands fall back to a single generic prompt because per-subcommand parsing froze the UI. Independent security research also found a pre-trust window: hooks, MCP connections, and settings resolution can run before the interactive trust dialog, so deny-first is not yet in force. During the analyzed window a parser differential in sandbox DNS was reported, covering v2.1.88, with no CVE assigned.
Compaction is mostly invisible to the user. External work adds that summary-based compaction is a blocking inference stall and non-deterministic: the same input can retain different content. Whether bounded context produces more duplication and convention drift is left as a measurable prediction. Source analysis cannot answer it.