CoeOS Desktop

CoeOS Desktop is CoeOS’s agentic harness, on your machine. Where the web app works within guarded multi-agent limits, the desktop gives the agent the whole machine: your files, your shell, your environment. Closer to a coding agent than to a chat assistant.

It is available for macOS, Windows and Linux, and updates itself.

The model always goes through the box

The desktop only talks to your instance’s box: models, web search and page reading go through it. Same routing by skill, same confidentiality rules as the web app. A build check verifies that no other part of the code opens a network connection.

The agent

• A root agent plans into a shared task list, then delegates to sub-agents running in parallel, in the foreground or the background.
• Run budgets: steps, tokens, number of sub-agents, depth, concurrency.
• Machine tools: files anywhere on the machine, and the user’s shell with its environment. No sandbox.
• Agents are defined in Markdown; you can replace the shipped ones or add your own. A decision agent sorts and classifies lists with a decision model.
• Each agent’s model can be set: a box model for open work, an axis of the Local table for confidential work, or “CoeOS decides” by default.

Permissions

• Ask (default): every command and every write waits for your approval.
• Grant all: the agent acts without asking.

The mode switches live. Every turn keeps track of its writes: you see the diff and can undo them.

Code mode

For coding work, the agent follows a circuit: a plan, reviewed by a panel of three agents in parallel (direct, alternative, sceptic); a disagreement is brought back to you; only your GO approves the plan; then execution by dependencies and a code review. The model cannot approve its own plan.

Confidentiality

• Every request carries its class. A conversation starts open by default; Confidential is chosen in the composer or in Settings, and the box then serves the models of the Local table.
• As in the web app, a confidential conversation never goes back to open.
• Memory and skills are split by class: an open run never reads what came from a confidential run.
• Every MCP server carries a class; the knowledge base (OdyRAG) is kept out of open runs by default.

Memory and skills

• Memory: at the end of a run, the agent writes down what is durable. You can import an existing memory (file, folder, zip); it is searched locally.
• Skills: your Claude Code skills work as they are. A skill written by the agent only loads after you approve it.

Comfort

/ commands, conversation fork, generated titles, attachments (images, text, files), notifications, a context gauge, a task scheduler and a menu bar.

Voice (Jarvis)

Spoken conversation is available. It is a deliberate exception: audio goes to Google (Gemini Live), with a short-lived token issued by the box. Turning voice on switches the conversation to open and disables confidential until it stops.