Under your rules
Default deny. Reading inside a workspace is free. Writing, running commands, using the network and reading secrets wait for your key press.
AI
An OS that works with you.
We are building AI into the desktop as a participant with permissions, not a chat window bolted on the side. It reads, proposes and acts, and you decide what it may do.
Direction, not a release. Each item below says whether it exists.
AI in the OS. Not on top of it.
Keys stay on the Mac
The desktop is the interface and holds no keys. Credentials live in the Mac keychain and reach only the agent engine.
Open engine, your model
The engine is open source and runs on your machine. You choose the model, hosted or local.
Agents
A teammate with a seat at the desktop.
An agent engine runs on the host and talks to the desktop. The desktop draws the conversation, the file tree, the diff and the approval card, all in HolyC and in the same style as every other window.
Tidy the notes in this folder.
I can read 12 files. I want to rename 3 and merge 2.
Allow changes?Rename 3 files, merge 2
Rules
It proposes. You approve.
Every write, command and outward action becomes a card you can read before anything happens. A plan mode that cannot edit anything, a diff you can reject, and checkpoints so any turn can be undone.
Read in the workspaceFree
Write a fileAsks
Run a commandAsks
Use the networkAsks
Read a secretAsks
Write outside the workspaceRefused
Faces
Characters, not chat bubbles.
Kamiji avatars already live in the desktop, with animated sheets and a Kamikin chat. They are the natural face for an agent: a hand that nods, hops and points, instead of a spinner.
Take a closer look.
Plan and act
A read-only plan mode first, then an act mode that can edit, each step shown.
Sandboxed work
Agent actions run on the host, optionally inside a Docker or Lima sandbox.
An audit trail
Every decision, approved or refused, is written to a log you can read.
A kill switch
Stop an agent in under a second, even mid-command.
One-use approvals
A decision is a token tied to this app, version, package and permission set.
Tools through MCP
Agents reach creative tools and services through the same permission words as apps.
Where we are going.
In order, with the status of each.
Approval cards in the desktop
PrototypeThe hub asks, the desktop shows a sheet, a one-use token answers.
Agent engine on the host
PrototypeA small bridge service (Python, no dependencies) runs the agent loop and a tool registry on the Mac. Tested offline with a fake model and local fake servers, with streamed replies for Anthropic and Ollama; the Anthropic backend has not been tried with a live key. The pinned open-source engine in the plan is not used yet.
Read-only IDE in the desktop
PrototypeThe host side runs and is tested: file tree, file read with a size cap and language guess, and search, all confined to the workspace. The IDE window itself, in HolyC, is not written yet.
Edits as diffs you approve
PrototypeApprove writes the file, reject leaves it untouched. Works on the host and is tested; the desktop shows the diff as plain chat lines, not a diff viewer.
Chat, plan and act
PrototypeThe Kamikin chat has an AI mode with tool lines, Approve and Reject, and a Plan mode that cannot edit. The desktop side has not been run in the VM yet.
Checkpoints and undo
PrototypeA snapshot of the workspace is saved in a separate git repository before each edit or command turn, and Undo restores that exact tree, also after a restart. Tested on the host; the Undo button in the desktop has not been run in the VM.
Agents inside Creation Studio
PrototypeThe host speaks MCP over stdio and registers a server's tools behind approval cards (tested with a stand-in server). No Creation Studio server exists yet, so convert, render and inspect are a plan.
Local models
PrototypeRuns against Ollama on your machine, with streamed replies (tried live with a 20B model), and a configurable fallback that is written to the audit log. Not yet shown in the desktop.
Prototype means parts run and are tested on the host, but the feature is not finished end to end in the desktop. Planned means a design only. Source: the AI IDE plan in the repository.
Tech specs.
Engine
An open-source agent server on the Mac, bound to 127.0.0.1 and started by a small bridge. The desktop talks to the bridge over the same framed channel as the browser.
Permissions
Default deny. Writes outside the workspace are refused outright. Grants live on the host, and the desktop only shows the question. See Security.
Privacy
Documents and keys stay on your machine unless you send them. Text that tools return is treated as data, never as instructions.
Models
Chosen by you. Hosted or local, with fallbacks logged.
What exists today
The permission words and the approval-sheet mechanism exist in the installer and hub. The host agent bridge (tools, approvals, audit, undo) is built and tested with a fake model, and the Kamikin chat has an AI mode wired to it that has not yet been run in the VM. The IDE, MCP and local models are designed, not built.
Be there early.
The whole thing is open. Follow the plan, or build part of it.