Open Cube

A native macOS app and CLI for running Codex and Claude Code as a separate standard macOS user. Local projects, explicit permissions, native Metal access. No VM, Electron, cloud backend, telemetry, or bundled agent credentials.

The macOS app is evolving into an open agent desktop: named parallel sessions, an inspected local-computer profile, a local-model compatibility catalog and connection controls. Docker, Gemini execution and provider API-key storage are visible in the interface but are not yet launchable; the existing agent user runtime remains the supported execution path.

One cross-platform system

The product is a Rust workspace with one web client, described in ADR 008:

Path	What it is
crates/core	Domain, workbench state and the inspector policy. Platform neutral, carries the tests.
crates/runtime	The launch contract and the account boundary, with platform adapters.
crates/cli	open-cube: read the workbench, and see what a launch would do.
crates/app	The Tauri window for macOS, Windows and Linux.
web/	The client: React and TypeScript, light and dark themes.
Sources/, scripts/	The Swift macOS app and its installer, retired once the Rust runtime lands (#32, #33).

pnpm install
pnpm app        # the window, against the dev server
pnpm test       # cargo test --workspace
pnpm build      # build the client

The window opens on a chat with an in-app inspector that answers from the engine snapshot — what each agent is doing, what runs in each sandbox, which model version was used and what it cost — under a read-only policy that refuses file contents and credentials and never reaches the network. Around it sits a VS Code arrangement: an activity strip, a sidebar that shows one area at a time — agents and their chats, search, source control, sandboxes and terminals, models, workflows — and a work area of tabs that split side by side. In those tabs: the chat, a terminal dock, a canvas workflow editor, a sandbox boundary view, a model library, usage and the agent studio, with the workbench-API rail beside them.

It does not launch agents, providers, ptys or Docker yet: that is the Swift app above, until crates/runtime and crates/cli take it over.

See the cross-platform migration design for the platform-specific security plan.

AI-assisted product, architecture and implementation work is governed by .ai/README.md, with the delivery order in the Open Cube roadmap. Repository-wide instructions for agents are in AGENTS.md.

Polski: instalacja krok po kroku · Download for macOS · Security model

Experimental alpha, not independently security-audited. A separate account is the boundary; actual macOS permissions determine access. Safe/Network profiles are informational. Read the security model before running untrusted code.

Quick start

Requires macOS 14+ and a main account authorized to use sudo. Apple Silicon and Intel are supported by one universal installer. Agent tools require their own provider login.

1. Open the download page and click Pobierz na macOS.
2. Open the .pkg and follow macOS Installer. The app is installed into /Applications.
3. Open Open Cube → Skonfiguruj Maca. The guide opens Terminal; answer its prompts without typing shell commands.
4. Use Zaloguj Codex / Zaloguj Claude, then add your first project.

Open Sesje → Nowa sesja to create a Codex, Claude, or Terminal session for one project. Each one opens a separate native control window in Open Cube; the interactive tool remains in Terminal, where macOS handles the account switch.

The app prepares the user-scoped launcher and ~/.local/bin/agentctl on launch. The guide asks before creating an account, granting workspace access, restricting the main HOME or installing agent tools. Existing account passwords and existing projects are preserved. Passwords are handled by sudo/sysadminctl. The .pkg has no privileged install scripts: account creation and permission changes happen only through the separate guide. It requires no Xcode or ZIP extraction. Open the new copy from /Applications after upgrading from a manual installation in ~/Applications; projects and settings are shared and preserved.

The app is ad hoc signed; the installer is unsigned and not notarized. macOS may require you to review the download in System Settings → Privacy & Security → Open Anyway. We do not disable Gatekeeper or remove quarantine attributes. Apple Events consent for Terminal/iTerm is also handled by macOS.

The source guide can also be previewed from a checkout:

bash scripts/quickstart.sh --dry-run

Build from source

Requires Swift 6 / Xcode 16 or newer (a compatible Command Line Tools install also works). Install Apple's tools with xcode-select --install if missing and finish the system installer before continuing.

git clone https://github.com/rajanbor/open-cube.git
cd open-cube
bash scripts/quickstart.sh

Build without installing or changing the machine:

swift test
bash scripts/build-app.sh

Separate setup steps

Each script can be reviewed and run independently:

bash scripts/install.sh --dry-run
bash scripts/install.sh
bash scripts/setup-macos.sh                 # preview only
bash scripts/setup-macos.sh --apply         # prompts before each change
bash scripts/install-agent-tools.sh         # preview only
bash scripts/install-agent-tools.sh --apply
open "$HOME/Applications/Open Cube.app"

The setup creates standard agent only if missing, uses /Users/Shared/AgentWork, and offers a targeted ACL denying that account access to your main HOME. It does not grant admin, sudo, Docker access or Full Disk Access; it does not copy credentials or change sudoers. Do not sign the agent account into iCloud.

Agent tools install under /Users/agent/.local. The script installs a checksum-pinned Node release if required, uses a user-local npm prefix, and adds one PATH line to agent's .zprofile. It never runs sudo npm.

Log in to your providers separately:

sudo -iu agent
codex login
claude
exit

See OpenAI's CLI guide and Anthropic's installation guide.

Use

Add an existing directory inside AgentWork, or choose a trusted source repository and preview an isolated copy. Select the project and click Codex, Claude or Terminal. The terminal explains its sudo password prompt; startup errors also appear in the project panel.

To import one of your GitHub repositories, choose Dodaj projekt → GitHub. Install GitHub CLI first if it is not already on your Mac. The app opens its official login in your browser, lists personal, organisation and collaborator repositories available to the connected account, available to that account, and creates an isolated workspace after you choose one. Private repositories work when the connected account can read them. GitHub credentials stay in the main account's Keychain; the agent gets no token, remote origin, or credential configuration. Review the selected repository as trusted before importing it.

~/.local/bin/agentctl list
~/.local/bin/agentctl status
~/.local/bin/agentctl add /absolute/path/to/trusted-repository
~/.local/bin/agentctl codex example
~/.local/bin/agentctl claude example
~/.local/bin/agentctl open example
~/.local/bin/agentctl sessions example
~/.local/bin/agentctl stop example
~/.local/bin/agentctl remove example

If you already have another agentctl, the installer refuses to overwrite it. The installed runtime CLI is also available at /Users/Shared/AgentWorkbench-<main UID>/agentctl.

How isolation works

A normal Git worktree in a private source repository still depends on that repository's .git. Our creator makes an independent bare clone with --no-local, removes its source remote, then creates a worktree from that copy. Only committed history is imported; uncommitted files, credentials and source configuration are not copied. There is no automatic merge/sync back to source.

Launches switch UID through sudo -iu agent with a clean environment. Canonical paths and private-directory access are checked again as agent. Git status also runs as agent because Git filters can execute repository code. The main-owned launcher is not setuid and has no privileged service.

Known limits

• No enforced network/per-project sandbox. Other agent-readable files remain readable; localhost services may expose data. Lando status is not queried.
• sudo -n diagnostics report Unknown without authorization. Run sudo -v then agentctl status in the same terminal. GUI authorization may differ.
• Session state is advisory. Stop sends SIGTERM to the supervisor's own child group; daemonized descendants may remain. No automatic SIGKILL.
• remove confirms and archives direct workspace children, retaining source repositories and isolated Git metadata. It does not permanently delete them.
• Import assumes a trusted source and no concurrent manipulation of destinations. This alpha does not promise protection against every filesystem race.

Project

Architecture · Contributing · Report vulnerabilities privately · Changelog

Apache-2.0 © 2026 Rajan Bor and contributors. Independent project; not affiliated with Apple, OpenAI or Anthropic.