# Bandicot

People and agents, one workspace: Bandicot is a native Mac workspace where people and AI agents work on the same projects: approvals before writes, a version for every change, and the tokens and cost of every turn in view. Agents do the work inside your projects. You approve what lands and see what every turn spent.

## Product contract

Bandicot is a native Mac workspace where people and AI agents work on the same projects. It puts approvals, versions, projects, sessions and the token record around the model provider the user chooses: hosted providers, a custom OpenAI-compatible endpoint, or a local model. The native host is the execution authority; the desktop window and website are presentation and account surfaces, not a cloud agent runtime.

## What is shipping and what is being built

- A native host owns the work [Verified core]: Bandicot's Zig host runs tools, sessions, approvals and versions around whichever model you pick. Native macOS host; the desktop window and website are presentation and control surfaces.
- Approval before writes [Available now]: An agent asks before it writes, runs or spends outside the rules you set; the rules live in one permissions file. Applies to tool calls the host executes; a remote provider still sees the prompts sent to it.
- A version for every change [Available now]: Every file an agent changes is recorded, with diffs, restore and undo of a whole run. Files inside projects you enrol; restoring is itself recorded in the history.
- See what every turn spent [Available now]: Tokens, cache reads and cost are recorded per turn, session, profile and model, and the Habits tab shows the patterns. Reports what the provider or local runtime exposes; a provider that hides usage shows a dash, never a guess.
- Fewer tokens for the same work [In development]: A frozen prompt prefix, append-only history and threshold compaction are built to cut tokens per solved task. No whole-task saving is claimed until the fixed-corpus measurement lands; the mechanisms ship, the number does not yet exist.
- Automations [Available now]: Agents that run on a schedule or on request inside a project, under the same approvals as a chat. Runs on your Mac while Bandicot is open; there is no hosted runner.
- Profiles with their own memory [Available now]: Each person or role gets a profile with separate projects, memory and settings; profiles can nest. Profiles share one Mac and one account; plans set how many profiles an account holds.
- An agent crew per team [Available now]: Name agents as teammates, assign them work and run them from one roster, next to the people. The roster and its runs live on one Mac; syncing a team across machines is in development.
- Teams across machines [In development]: One project and roster shared by people on different Macs. The host answers team sync as unavailable today; nothing on this site implies live multi-machine collaboration.
- Skills, plugins and MCP servers [Available now]: Install skills, plugins and MCP servers per project, with their tools under the same approvals. Extensions run on your Mac with the permissions you grant them.
- One setup file for a whole team [Available now]: A setup file carries providers, skills and settings, so a second person lands on the same setup. Keys are typed at a hidden prompt and never stored in the file.
- Any model, one project [Available now]: Switch between hosted providers and local models without rebuilding the project around one lab. Remote providers receive the prompts sent to them and bill you directly.
- Local models in one click [Available now]: A pinned catalog of 8 small chat models, from Gemma 3 270M to SmolLM3 3B, each checked against the Mac's GPU memory budget before download. Apple Silicon Macs; each model needs about 1.25 to 4 GB of memory. Small models are useful for private, light work, not a match for frontier models.

## Safety and provider boundary

The model proposes; the host and your rules decide. An unapproved write does not land. Providers see the prompts users send to them. This site makes no SOC 2 or GDPR credential claim and must not be used as evidence of one.

## Website and pricing boundary

The website provides presentation, docs, accounts, billing, and device linking. Website pricing describes profile capacity; it is not model-provider usage, tokens, or a collaboration-seat SKU. Refer to [Pricing](https://bandicot.app/pricing) for the current account terms rather than copying prices into this machine-readable file.

Canonical: https://bandicot.app/
Short machine file: https://bandicot.app/llms.txt

## Answers

### What is an approval gate for AI agents?
https://bandicot.app/learn/approval-gate

An approval gate stops an AI agent before an action with side effects, such as a shell command, a push or a write outside its rules, until a person says yes. In Bandicot, permissions.json decides which calls run, which ask you and which are blocked, so only real decisions reach you.

1. Write the rules once: permissions.json lists which tool calls run, which ask you and which are blocked.
2. Let the agent work: Calls the rules allow run straight away and show as one line each in the chat.
3. Answer only real decisions: A call that needs you appears as Needs your call, with Allow once, Allow this session, Allow this project or Deny.

On screen: Needs your call, Allow once, Allow this session, Allow this project, Deny, Runs, Asks you, Blocked.
Also asked as: how to stop an AI agent from running commands without asking; AI coding agent that asks before pushing to git; human in the loop approval for AI agents on Mac; permissions file for AI agent tools.

### How do you undo what an AI agent changed?
https://bandicot.app/learn/undo-an-agent-run

Bandicot saves every agent run as one version, so Undo this run puts every file it touched back the way it was. To go further back, rewind to any message and choose files and conversation, only the files or only the conversation. Changes made outside Bandicot are kept in the same history.

1. Find the run: Each run ends with the files it changed and an Undo this run button.
2. Undo it whole: One click restores every file the run touched, in one step.
3. Or rewind further: Rewind to this message offers Files and conversation, Only the files or Only the conversation.

On screen: Undo this run, Rewind to this message?, Files and conversation, Only the files, Only the conversation, Outside Bandicot.
Also asked as: undo changes made by an AI coding agent; revert everything Claude or ChatGPT edited in my project; AI agent version history for files; rewind an AI chat and restore files.

### What does tokens per solved task mean?
https://bandicot.app/learn/tokens-per-task

Tokens per solved task is every token a model reads and writes to finish one task, counted across all its turns and tool calls. Bandicot shows input, cached and output tokens on every turn, and its engine is measured this way on a fixed set of tasks before and after each change.

1. Read the meter: The window's title strip shows tokens in, the share that was cached and tokens out.
2. Compare runs: Every turn records what it spent, so two ways of doing a task can be compared.
3. Judge by the task: A cheap turn that fails costs more than a dear one that finishes; count the whole task.

On screen: in, cached, out.
Also asked as: how to see how many tokens an AI agent used; AI agent cost per task; track token usage per chat turn on Mac; why is my AI agent so expensive.

### Why does a frozen prompt prefix cut AI token costs?
https://bandicot.app/learn/frozen-prefix

Model providers cache the start of a prompt and bill repeated reads of it for less. A frozen prefix keeps the system prompt and tool definitions byte for byte the same on every turn, so the cache keeps hitting. Bandicot appends changing state at the end of the conversation instead of rewriting the start.

1. Freeze the start: System prompt and tool definitions are written once, in a fixed order.
2. Append at the end: Status, counters and steering arrive as new messages at the tail.
3. Compact rarely: History is summarised only at thresholds, in batches, keeping decisions and failures.

On screen: cached.
Also asked as: how prompt caching works for AI agents; reduce token cost of long AI conversations; why does my agent miss the prompt cache; append-only context for LLM agents.

### What are sub-agents in an AI workspace?
https://bandicot.app/learn/sub-agents

Sub-agents are agents a main agent starts to work on parts of one request at the same time, each with its own tools and context. In Bandicot you can see every call each sub-agent makes, and only their findings come back into your chat, so the main conversation stays short.

1. Ask once: Give one request, such as an audit across several folders.
2. Watch them split: Each sub-agent works its part with its own tools; its calls are listed under Search, web and agents.
3. Read one answer: Their findings merge into a single reply in your chat.

On screen: Search, web and agents, N calls.
Also asked as: run several AI agents in parallel on one task; AI agent that delegates to sub-agents; multi-agent workflow on Mac; keep AI chat context small with sub-agents.

### How do you schedule an AI agent to run on its own?
https://bandicot.app/learn/automatons

In Bandicot, an automaton is an agent that runs on a schedule or on request inside a project, on your Mac while Bandicot is open, under the same approvals as a chat. You set how often it runs, when it stops, and whether missed runs are skipped or caught up.

1. Name it and set the pace: Every (minutes) sets the interval; Stop after (runs) ends it, and 0 keeps it running.
2. Choose what happens to missed runs: Missed runs: Skip them or Catch up.
3. Decide what it may touch: Without Allow file writes, runs can only read the workspace (read, grep, find, ls).

On screen: Every (minutes), Stop after (runs), 0 keeps it running., Missed runs, Skip them, Catch up, Allow file writes, The agent asks to proceed.
Also asked as: schedule an AI agent to run every hour; AI agent cron job on Mac; recurring AI tasks that ask before writing files; automate a daily AI code review.

### How do you give a whole team the same AI agent setup?
https://bandicot.app/learn/setup-file

Bandicot keeps a workspace's setup in one file, setup.json, carrying providers, skills and settings. Drop it on the window and Bandicot shows what it will apply before anything changes. Keys are not in the file; each person types theirs at a hidden prompt. Everyone who drops the same file lands on the same setup.

1. Drop the file: Drag setup.json onto the Bandicot window.
2. Review it: A setup file is ready to review lists what it will apply.
3. Type keys privately: Any key the setup needs is typed at a hidden prompt, never stored in the file.

On screen: A setup file is ready to review, setup.json, permissions.json.
Also asked as: share AI agent configuration with a team; onboard a teammate to the same AI setup; AI workspace config file for teams; reuse AI agent settings on another Mac.

### Can an AI agent run on a local model on a Mac?
https://bandicot.app/learn/local-models-on-mac

Yes. Bandicot offers a pinned catalog of 8 small chat models for Apple Silicon Macs, from Gemma 3 270M to SmolLM3 3B, each checked against the Mac's GPU memory budget before download. You can switch between them and hosted providers without rebuilding the project. Remote providers receive the prompts sent to them.

1. Pick from the catalog: Each local model is checked against the Mac's memory before it downloads.
2. Keep light work local: Small models suit private, light work; they are not a match for frontier models.
3. Connect a provider for big jobs: Hosted providers bill you directly, and Bandicot shows every token either way.

On screen: on this Mac.
Also asked as: run an AI agent offline on a Mac; local LLM agent for macOS; private AI assistant on Apple Silicon; switch between local and hosted models in one app.

## Shipped

### Bandicot lives at bandicot.app

https://bandicot.app/shipped/bandicot-app · Site · 2026-10-21

Every page now answers at bandicot.app, and www and the old address forward there. bandicot.app/download always starts the newest stable build for Apple silicon Macs; add ?asset=sha256 for its checksum or ?asset=install for the install steps.

Nothing to redo: A passkey you created before today still signs you in on the new address in current Safari and Chrome, and new passkeys belong to bandicot.app. In a browser without that support, sign in once with your password and add a passkey in Settings. Desktop apps installed before the move keep reaching your account at the old address; new builds talk to bandicot.app directly.

### A quieter site, and a page for everything we ship

https://bandicot.app/shipped/a-quieter-site-and-shipped · Site · 2026-10-20

The hero now sits over a field of horizon lines that breathe slowly and lean toward your pointer. One bright trace runs along a line at a time, the way a run moves through the work. With reduced motion turned on it holds still.

Shipped, written up: The home page used to list commits. It now shows the three newest posts here, and this page collects every change worth noticing, by category, with a full-text feed for readers and assistants. The commit-by-commit record stays on the changelog.

Olive, spent once: Pricing is now stone and hairline, with olive only on the recommended plan. Across the site the accent marks the primary action or the one element a figure is about, and focus rings, labels and links are stone white. A test holds that budget so decoration cannot creep back. Every page and the app share one type contract: Inter at two weights for reading and emphasis, Questrial for the wordmark and headlines, Geist Mono for code.

### The Pricing card reads the plan you are on

https://bandicot.app/shipped/pricing-reads-your-plan · Product · 2026-10-19

The Pricing card in the dock read fields the engine never filled, so a Team account could see the free plan. It now reads your account's plan from the engine itself, and shows what that plan includes.

Smaller requests: Larger requests to Anthropic are now compressed before they leave your Mac. If a server ever refuses a compressed request, Bandicot resends it plainly and stays uncompressed for the rest of the session.

A bench agents can drive: A separate lab copy of the app, with its own storage and keychain entries, lets an agent sign in, click, type and read the real window, the way a person tests a change. It is how new work is checked before it reaches you.

### Every page answers search and assistants directly

https://bandicot.app/shipped/search-and-answer-engines · Site · 2026-10-18

Crawlers and AI assistants read a page as it arrives; they do not wait for scripts. Every docs page now renders on the server, so what a reader sees and what an assistant reads are the same words.

A card for every link: Each page has its own share image, drawn from its title and section, so a link pasted into a chat says what it points to.

Counting assistant visits: Visits that come from an AI assistant's answer are recognised and counted separately, which tells us which answers people follow.

### A Habits tab, and characters drawn from how you work

https://bandicot.app/shipped/habits-and-liquid-characters · Product · 2026-10-18

The gateway now opens on Providers, then Usage, Activity, Habits and Models. Habits shows how a profile works: the hours and weekdays it runs, how its runs end, how long they take. Each profile also draws a small liquid character from the traits its habits leave, so a week reads at a glance before you read a number.

A fuller usage report: Usage now counts files touched and compactions next to tokens, credits tool output to the tool that produced it, and marks a cost as unknown when a model has no published rate, so you know which figures are exact.

### Olive over warm black, in two themes

https://bandicot.app/shipped/olive-brand-two-themes · Design · 2026-10-18

Bandicot now has one accent, olive, used sparingly over a ramp of warm blacks. The same tokens drive the app and this site, so a screenshot and a page look like the same product. Dark, Light and Match macOS all read from that one set, and type follows one rule: Inter at two weights for reading, Questrial for the wordmark and the site's headlines.

### The new site goes live

https://bandicot.app/shipped/the-new-site · Site · 2026-10-18

The site now shows the product at work instead of describing it. The home page replays scripted runs inside a replica of the app window, with every tool call and token counted as it happens.

Learn and Changelog: Learn answers the questions people ask about agents in a few sentences each. The changelog lists every feature as it ships, with a feed you can follow.

### Tool calls get their own rail in the terminal

https://bandicot.app/shipped/agent-tabs-in-the-terminal · Product · 2026-10-18

A run used to fill the chat with tool output. Now each call is a single row in the conversation, and the detail lives in the terminal, on a vertical rail with one tab per tool. Search, web and sub-agents share one more tab. Each tab counts its calls, and the rail shows the total, so you can see what a run did without scrolling through it.

### One setup file you can hand to anyone

https://bandicot.app/shipped/one-portable-setup-file · Product · 2026-10-18

A setup file carries providers, tools and preferences. Drop one on the window and Bandicot shows what it will change before anything does; applying it is one step you can undo. Keys are typed at a hidden prompt, so a second person can land on the same setup with keys of their own. Hooks from a file only run once you trust them.

### Your Macs work as one

https://bandicot.app/shipped/your-macs-as-one-group · Team · 2026-10-18

Your account now certifies each of your Macs, paired with a short code. When an agent asks for permission on one Mac, the ask shows on your others, and an answer there settles it. Nothing widens what an agent may do. You can start a Mac's automation from another of your Macs, under that Mac's own rules. When a Mac sleeps, its schedules run on an awake Mac that holds the same project and are handed back on wake.

Keep working when the app is closed: An opt-in setting starts the engine at login, so schedules and approvals keep moving when the window is closed.

### Your agent reads team channels safely

https://bandicot.app/shipped/team-channels-behind-a-broker · Team · 2026-10-18

Team channels are useful context and a risk: anyone can write in them. Your agent now reads them through a broker that marks every message as untrusted, so text in a channel cannot instruct it.

An offline mailbox: Messages to a Mac that is offline are sealed to that Mac's key and wait as ciphertext until it comes back. A recovery envelope stays in your account.

### Versions sync a folder with your team

https://bandicot.app/shipped/versions-sync-with-your-team · Engine · 2026-10-18

Versions already kept every run on your Mac undoable. A folder can now be shared with your team: its history travels as signed chains, merges three ways, and stops at real conflicts so a person decides. The store underneath moved to a signed operation log with packed segments and a persisted index, and capture follows file-system events, so an idle folder costs nothing.

### Versions on every disk you plug in

https://bandicot.app/shipped/versions-on-every-disk · Engine · 2026-10-17

Versions captures and restores on APFS, HFS+ and exFAT, and recovers cleanly after a crash on each. A moved folder keeps its history, and a stale folder grant pauses capture until you renew it. Undoing a run now lets you choose parts of a file, so you can keep the good half of an agent's edit.

### Dark, Light and Match macOS

https://bandicot.app/shipped/dark-light-match-macos · Design · 2026-10-16

Pick Dark or Light, or let the app follow macOS. Every theme draws from the same brand, so nothing changes but the light. The title strip now zooms with the app and stays native beside the window controls at every zoom level.

## Changelog

- 2026-10-18 · Terminal · 8862102a: Agent calls sit on a vertical icon rail. One tab per tool, search, web and sub-agents under one more, each tab counts its calls and the rail shows the total
- 2026-10-18 · Chat · e889d9cd: One auto view. Tool calls are title rows, their input and output live in the terminal's agent tabs, only thinking expands
- 2026-10-18 · Setup · b3315485: Drop a setup file on the window, type keys at a hidden prompt, and a second user lands on the same setup. Optional keys no longer pending forever
- 2026-10-18 · Permissions · 545d855a: Auto is the only permission mode, tuned by permissions.json; dock reads Work | Team | Versions and never clips
- 2026-10-18 · Team · 2cffe87c: Your agent reads team channels and drafts posts behind a broker. Messages fenced as untrusted, zero escalations from a hostile corpus
- 2026-10-18 · Macs · 3ee6c14d: A sleeping Mac's schedules run on your awake Mac that holds the project, handed back on wake
- 2026-10-18 · Macs · 9cbff698: Answer and start work across your own Macs. Remote approvals in under 50 ms, engine at login
- 2026-10-18 · Setup · 9cac30cf: One portable setup file. Review, consent, apply in one journal commit, undo, export; user hooks trust-gated
- 2026-10-18 · Team · c3f84303: Offline mailbox. Calls sealed to the recipient's endpoint key, parked as ciphertext until that Mac drains; recovery envelope kept in your account
- 2026-10-18 · Team · 2d761c37: Your own Macs as one group. Account key certifies each Mac, six-digit pairing, revoke to a new epoch, recovery kit
- 2026-10-18 · Versions · 5e88fb2c: Sync a folder with your team. Signed chains over Team letters, three-way merge, conflicts you settle
- 2026-10-17 · Team · e8d84155: Across networks. N0 relays, one reused link per peer, path per member, event-driven sync
- 2026-10-17 · Versions · 823196ec: Store format v2. Signed operation log, pack segments, persisted history index
- 2026-10-17 · Team · e8e795b1: An invite link lets its holder straight in, and a signed-out account's Team keeps running
- 2026-10-17 · Team · cc9fa705: Hand the coordinator role over the wire and export a team's history
- 2026-10-17 · Team · bed7ef9c: The owner accepts each join, with a Notifications sidebar per team and team-coloured channels
- 2026-10-17 · Versions · 2bd329af: Capture and restore on HFS+ and exFAT, with crash recovery on both
- 2026-10-17 · Versions · d7500169: A stale folder grant pauses capture until renewed, and a moved root keeps its history
- 2026-10-17 · Versions · 47c8905a: Choose parts of a file in the run-undo dialog
- 2026-10-17 · Automatons · afb1033f: Daily schedules in an IANA zone fire on the first fold and skip a gap; keyed provider calls retry safely
- 2026-10-17 · Team · 9a2d9c6d: Local history export and a typed key-loss error, with the retention review
- 2026-10-16 · Window · 2ebda7c1: The title strip zooms with the app and the window follows it
- 2026-10-16 · Browser · f907f5db: Present as desktop Chrome and keep sign-ins across launches
- 2026-10-16 · Appearance · b1ed64c6: Dark, Light and Match macOS, one brand everywhere
- 2026-10-16 · Window · 4b0c3842: Run history and rewind with named points ship by default
- 2026-10-15 · Work · 88b9567b: One prompt bar, a run card that shows progress, gateway usage in the session panel
- 2026-10-15 · Versions · 5eb5ac51: V13. Rewind to a person's message, files and conversation
- 2026-10-15 · Versions · eebe8a23: V12. Take some parts of a file, not only the whole file
- 2026-10-15 · Versions · 43f8c474: V15. Named points and putting the folder back as one undoable run
- 2026-10-15 · Versions · 5302c672: V16. Review choices saved with the change survive a restart
- 2026-10-15 · Versions · 382bf8e6: V14. Name what a run did that history cannot put back
- 2026-10-15 · Window · ea6f6ec8: Work session panel, dock fit, automaton pages with their own model and report
- 2026-10-14 · Window · b5d2c837: Quiet feedback. Sonner toasts, notices in Activity, deep Versions
- 2026-10-14 · Versions · dcdacb58: Review and apply an agent's isolated change (V08 UI)
- 2026-10-14 · Versions · f98497a7: Run titles and summaries from versions_runs; Undo this run (V06/V07 UI)
- 2026-10-14 · Versions · b2138f7f: V05 native Versions UI. Consent, timeline history, restore, storage
- 2026-10-14 · Team · 2288b89f: Automatons merged into Team's Agents view
- 2026-10-14 · Versions · 2e61bd12: Native history engine V01–V04, background runs and profile memory (Codex)
- 2026-10-14 · Team · 363d8868: Several teams per Mac, team-wide channels in each (owner-approved)
- 2026-10-13 · Team · 7c4b1741: T04 Channel view in Teams (owner-approved design)
- 2026-10-13 · Team · b0c5b0ed: T04 Team service process, peer protocol and engine route
- 2026-10-13 · Team · 0cabd7a0: T03 outbox, delivery states and bounded catch-up
- 2026-10-13 · Team · a2893653: T02 governance, one-use invites and coordinator-only join
- 2026-10-13 · Team · aeea3d72: T01 MLS backend qualification (mls-rs chosen) and iroh peer frames
- 2026-10-13 · Automatons · eb47460b: A03 durable schedule claims and missed-run policy
- 2026-10-13 · Automatons · 5bc48a36: A01 an automation runs as an independent run beside Work
- 2026-10-13 · Automatons · 712cb207: Answer a background run's approvals and questions from its column
- 2026-10-13 · Automatons · f0dc0dae: Tell a running agent something from its column (F03 steer)
- 2026-10-13 · Automatons · 96f8aa32: The picked agent's session beside the canvas, read without activation
- 2026-10-13 · Automatons · 247c3385: The agent canvas, only blobs, with the picked agent beside it
- 2026-10-13 · Versions · 2a3bcbe6: A GitHub-shaped Code page first; Changes shows the files changed
- 2026-10-09 · Window · ff5077b9: Session-specific side chats and the prompt bar ladder
- 2026-09-28 · Chat · 21945bbf: Consolidate the knowledge pane into Brain and land the shell work
- 2026-09-20 · Window · 3b606d32: Composer morph, activity axis, inline attachments and browser pane
- 2026-09-18 · Window · 4d1a610d: Port the studio checkpoint pattern into the composer card
- 2026-09-18 · Window · 4082fa29: Readable menus, session search above New session, checkpoint preview; replan search as automatic
- 2026-09-18 · Window · 9f3c18c5: Run-card status pill, sessions search hotkeys, responsive inspector tabs
- 2026-09-18 · Window · 5af39585: Inspector dock card, calm run card with checkpoints, queue status
- 2026-09-18 · Window · 34d3114e: Composer in the middle pane, capability settings, radial continue, calm live text
- 2026-09-18 · Window · b270ce56: Composer fitting and clipping, transcript expand prefs, context bar, prompt rail
- 2026-09-16 · Window · 10d17f95: The run frame is the conversation. Real trail, resting orbs, one sidebar control
- 2026-09-16 · Window · 4d7db4ee: The rail's tabs are the studio's segmented control, copied whole
- 2026-09-16 · Window · 1e898dbb: Inspector tabs are the studio's segmented control, in the rail
- 2026-09-16 · Window · 44375c14: Setups live with the input toggles; focused pane rings its header
- 2026-09-16 · Window · 88601237: Inspector tabs, ghost composer chrome, unclipped popovers
- 2026-09-16 · Window · 73253125: One brand corner scale and control rhythm
- 2026-09-13 · Automatons · 7b5a0dc6: Bind managed delegation to Automaton runs
- 2026-09-13 · Automatons · 51cf5418: Finish AT-09 delivery RPC and evidence
- 2026-09-12 · Automatons · 0564ea03: AT-05 scoped context + AT-06 desktop supervision
- 2026-09-09 · Automatons · 17019cff: AT-04 grant path + fail-closed invoke
- 2026-09-09 · Automatons · 8a4e41f9: AT-03-RED host Scheduler.tick wire
- 2026-09-09 · Automatons · aad15a58: AT-03 Athens TZ + host due-admit
- 2026-09-09 · Automatons · 883166ce: AT-02 F03 renewal + F04 cancel ownership
- 2026-09-09 · Automatons · a097abda: Close AT-01-RED O1 + negatives
- 2026-09-09 · Automatons · 2bf5689a: AT-01 host path + native-read deny ceiling
- 2026-09-09 · Automatons · 2da78c34: AT-01 shared runtime + F02 deny ceiling
- 2026-09-04 · Window · e7e30c2a: Expose complete async workspace states
- 2026-09-04 · Automatons · 2dca3dea: Persist execution authority
- 2026-09-04 · Versions · d0ec2410: Surface guarded rollback outcomes
- 2026-09-04 · Team · 77eb4bd4: Retain searchable knowledge revisions
- 2026-09-04 · Team · 854ce19e: Serialize multiplayer canvas revisions
- 2026-09-04 · Team · b14f667b: Isolate shared browser sessions
- 2026-09-04 · Window · d4dbdef7: Shared-session view with switchable surfaces
- 2026-09-04 · Team · 26b1a440: Teams agent editor with identity and settings
- 2026-09-04 · Window · 0b13d0c0: Agent run cards with host status and follow-up controls
- 2026-09-04 · Window · 1d83f1f4: Team channel header metadata and composer audience
- 2026-09-04 · Window · 329df923: Ship the full brand favicon program + web manifest
- 2026-09-04 · Team · f040d4ef: TEAM-006 channel rows + Teams navigation sections
- 2026-09-04 · Team · e1aeb8fb: TEAM-025 end-to-end channel encryption authority
- 2026-09-04 · Team · 2c4cab5b: TEAM-022/023 voice and meeting authorities
- 2026-09-04 · Team · 41f38825: TEAM-015 shared debugging authority
- 2026-09-04 · Team · 7c57c64d: TEAM-021 notification authority with smart dispositions
- 2026-09-04 · Team · 0f3f011a: TEAM-013 shared editing and TEAM-025/026 moderation authorities
- 2026-09-04 · Team · 9a035683: Share previews, verification staleness, credential refs, cross-account journey
- 2026-09-04 · Team · ab69d176: TEAM-012 session-collaboration authority + S2.2 plan
- 2026-09-04 · Team · 05cc12fb: Harden join transport and remote snapshots
- 2026-09-04 · Automatons · 61cdc525: Profile-isolated snapshot inventory reader
- 2026-09-03 · Window · f27f1bab: Scroll rail v5. Velocity-morphing responsive ticks
- 2026-09-03 · Window · fc24ccdb: Retire 'layer around the model' tagline from metadata and AI surfaces
- 2026-09-03 · Window · 453d5539: Data-sec anchors for docs article sections
- 2026-09-03 · Window · a7c5bf73: Dither data display, orbit depth, docs scroll rail, footer cleanup
- 2026-09-03 · Window · 5c78f1d8: Marketing UX polish. Kerning, corners, orbit, pricing slider, scroll rail
- 2026-09-02 · Window · 2098a89b: Redesign marketing home with orbit board, night pixel tools, company footer
- 2026-08-27 · Automatons · b07eb3fc: Persist cron triggers through RPC
- 2026-08-27 · Automatons · 456a2bfb: Implement calendar-aware schedule triggers
- 2026-08-27 · Automatons · afdc1663: Execute RPC runs through HostService
- 2026-08-27 · Team · 7f57d983: Propagate thread metadata through realtime
- 2026-08-27 · Team · 4a04a2f0: Route thread metadata through host authority
- 2026-08-27 · Team · 5ef89004: Harden authoritative messaging and flexibility taxonomy
- 2026-08-26 · Team · 314e0187: Implement operational presence end to end
- 2026-08-25 · Team · 4f048dce: Wire realtime synchronization end to end
- 2026-08-25 · Team · 54d2b759: Add TEAM-010 ordered realtime event bus
- 2026-08-24 · Team · fd9c5b5a: Add durable thread system
- 2026-08-24 · Team · 49890c52: Add AI-native message actions
- 2026-08-24 · Team · 41b19ed7: Complete message interaction lifecycle
- 2026-08-24 · Team · 90a4f676: Add message reactions
- 2026-08-24 · Team · 93ef7829: Add durable message interaction model
- 2026-08-24 · Team · d7febda8: Add governed channel lifecycle
- 2026-08-24 · Team · 17c739d8: Add scoped role permissions
- 2026-08-24 · Team · 31a706ca: Add durable member presence model
- 2026-08-24 · Team · bd080645: Project organization hierarchy
- 2026-08-24 · Team · 6d5e28ac: Add canonical Team entity projection

## Documentation library

### Get started [available]
The short path into Bandicot: a native Mac workspace where people and agents work on the same projects.

#### What Bandicot is
Bandicot is a native Mac workspace where people and AI agents work on the same projects: approvals before writes, a version for every change, and the tokens and cost of every turn in view.

The native host on your Mac runs sessions, tools, approvals and versions. The website explains the product and handles your account, billing and device linking. It is not a hosted agent runtime.

#### Start free
Solo is free: one profile, the core harness, no card. Connect a hosted provider with your own key, or install a small local model. Provider charges, hardware, storage and electricity are separate from Bandicot.

Then open a project, give an agent a task, and read what it asks to do before it does it.

#### Read the labels
Every page carries one status label: Available now, Verified core, Measured, In development or Direction. The label says what exists today, not what is planned.

Bandicot is a native Mac product. We do not claim SOC 2 or GDPR certification, and a hosted provider still receives the prompts you send it.

### People and agents, one workspace [available]
What Bandicot is for: one workspace where people and agents work on the same projects, with approvals, versions and costs you can read.

#### The idea
Agents are useful when they work inside your projects, and trustworthy when you can see what they did. Bandicot gives people and agents one workspace: the same files, the same history, the same rules.

Agents do the work inside your projects. You approve what lands and see what every turn spent.

#### Three things stay in view
Approvals. An agent asks before it writes, runs or spends outside the rules you set; the rules live in one permissions file.

Versions. Every file an agent changes is recorded, with diffs, restore and undo of a whole run.

Tokens and cost. Tokens, cache reads and cost are recorded per turn, session, profile and model, and the Habits tab shows the patterns.

#### Any model, one project
Switch between hosted providers and local models without rebuilding the project around one lab.

Local models are one option among providers. They suit private, light work; small models are not a match for frontier models. Remote providers receive the prompts sent to them and bill you directly.

#### Fewer tokens, by mechanism
The prompt prefix is frozen, history is append-only, compaction runs at thresholds, and skills load on demand. You see every token either way.

Status: In development. No whole-task saving is claimed until the fixed-corpus measurement lands; the mechanisms ship, the number does not yet exist.

### Product status [available]
A plain account of what is usable today, what is verified in the core, and what is still in development.

#### Five status labels
Available now: A current user-facing path exists within the stated scope. Verified core: Implemented and tested as a foundation; not necessarily a complete public journey.

Measured: Measured on named hardware or a named corpus, inside a stated boundary. In development: Active product work that must not be presented as shipped. Direction: Part of the product contract without a release-date promise.

#### What is true today
Available now: approvals before writes, a version for every change, tokens and cost per turn, automations, profiles with their own memory, an agent crew on one Mac, skills, plugins and MCP servers, setup files, switching between providers, and a pinned catalog of small local models.

Verified core: the native host that runs sessions, tools, approvals and versions around whichever model you pick.

#### What is still being built
In development: a whole-task token saving measured on a fixed corpus, and teams across machines. The host answers team sync as unavailable today; nothing on this site implies live multi-machine collaboration.

Remote handoff and shared compute are direction only. Follow the page label instead of inferring a date.

### Install [available]
Install Bandicot on an Apple Silicon Mac, sign in with a free Solo account, connect a hosted or local model, and open your first project.

#### Set up the app
Bandicot is a native macOS app. Create a free Solo account on the website, then sign in from the app to link the device. The app owns your sessions and files; the website does not run your work.

A setup file can carry providers, skills and settings, so a second person lands on the same setup.

#### Add a model
Connect a hosted provider with your own key, or install a model from the local catalog. You can switch at any time; the project, approvals and history stay the same.

#### Install a local model
The local catalog holds 8 small chat models, from Gemma 3 270M to SmolLM3 3B. Each needs about 1.25 to 4 GB of memory and is checked against the Mac's GPU memory budget before download. It runs on Apple Silicon Macs with llama.cpp.

If a model does not fit, Bandicot says so before downloading anything.

### Local models [available]
A pinned catalog of small chat models that run on your Mac, with a fit check before every download.

#### A catalog with a fit check
A pinned catalog of 8 small chat models, from Gemma 3 270M to SmolLM3 3B, each checked against the Mac's GPU memory budget before download. The catalog is pinned, so each entry is a known model rather than a link.

Models run on Apple Silicon Macs with llama.cpp.

#### What small models are for
Apple Silicon Macs; each model needs about 1.25 to 4 GB of memory. Small models are useful for private, light work, not a match for frontier models.

Use a local model for work that should stay on your Mac, and a hosted provider when the task needs more capability.

#### Mix local and hosted
A local model is one provider among others. Switch per session without rebuilding the project: sessions, approvals, versions and the token record carry over.

### Connect a model [available]
Bring a hosted provider, a custom OpenAI-compatible endpoint or a local model into the same project and approval loop.

#### Providers and endpoints
Add a hosted provider with your own key, or point Bandicot at a custom OpenAI-compatible endpoint you control. The compatibility layer covers the request shape; it does not claim that every server or model behaves identically.

Remote providers receive the prompts sent to them and bill you directly.

#### Change the model, keep the work
A project keeps its sessions, tool boundaries, approvals and version history while you compare models. Context limits, vision support, tool support and latency are model-specific facts, not guarantees from the harness.

#### Where execution belongs
A provider supplies inference; it does not own the project. The native host runs tools and can refuse an action when a rule or approval is not satisfied, whichever model proposed it.

### Projects [verified-core]
A durable home for files, sessions, model choices and agent work, shared by people and agents.

#### More than a prompt
A project gives related sessions, files, model choice, agent steps and history one home. People and agents work on the same files under the same rules, so a change of direction is not a blank chat.

The native host owns project state. The desktop window shows it and submits intent, but never keeps a second source of truth.

#### Folders you enrol
Files inside projects you enrol; restoring is itself recorded in the history.

#### What a project does not promise
A project is not a hosted file vault and not a replacement for source control. Keep using the tools you already use for branching, review and backup.

### Sessions [verified-core]
Sessions belong to the Mac app, not the window: each turn records intent, tool calls, approvals, changes and cost, and survives a closed window.

#### The host owns the session
A session belongs to the native host and its project, not to a window. The window can close and reopen without losing accepted work.

This also means the website never implies a cloud agent: sessions run on your Mac.

#### A visible turn boundary
A turn separates intent, model output, tool calls, approvals and the resulting changes. A pending approval stays part of the session until you decide.

Every turn records its cost. Reports what the provider or local runtime exposes; a provider that hides usage shows a dash, never a guess.

#### What durability does not mean
Context limits and provider behavior still vary. An interrupted provider request cannot be made to finish, and not every model supports every tool.

### Agents [verified-core]
Model-driven plans, tools, sub-agents and automations that work inside your projects.

#### The model proposes; the host executes
Bandicot's Zig host runs tools, sessions, approvals and versions around whichever model you pick.

The model can propose an action. The host decides whether it takes effect, under the rules in your permissions file.

#### Useful autonomy has edges
Plans can declare steps and dependencies before tools run. Writes pass through an approval, and repeated failure stops at a bound instead of retrying forever.

These safeguards do not make an agent correct. They make its work inspectable.

#### Automations
Agents that run on a schedule or on request inside a project, under the same approvals as a chat.

Runs on your Mac while Bandicot is open; there is no hosted runner.

### Skills, plugins, and MCP [available]
Add skills, plugins and MCP servers per project, with their tools under the same approvals.

#### Three ways to extend a project
Skills carry reusable guidance and procedures. Plugins add behavior with an explicit lifecycle. MCP servers expose tools and context through a protocol boundary.

Install skills, plugins and MCP servers per project, with their tools under the same approvals.

#### Loaded on demand
Skills load when a task needs them and append to the end of the session. They do not change the fixed prefix of every request.

#### Review before you extend
Extensions run on your Mac with the permissions you grant them. Before enabling one, check what it can read and write, where its credentials live, and whether its provider sends data off the machine. Approvals protect effects; they do not replace an extension's privacy policy.

### Approvals [available]
An agent asks before it writes, runs or spends outside the rules you set.

#### Ask before effects
An agent asks before it writes, runs or spends outside the rules you set; the rules live in one permissions file.

An action you deny, or have not approved, does not land.

#### One permissions file
The rules you set live in one permissions file, so what an agent may do without asking is written down and can be reviewed.

Applies to tool calls the host executes; a remote provider still sees the prompts sent to it.

#### Approval is not a correctness check
An approval confirms that you accepted a described action. It does not guarantee the change is right. Read the scope and the affected files before allowing a write.

### Versions and history [available]
A version for every change an agent makes, with diffs, restore and undo of a whole run.

#### Every change leaves a version
Every file an agent changes is recorded, with diffs, restore and undo of a whole run.

Files inside projects you enrol; restoring is itself recorded in the history.

#### Undo a whole run
When an agent run goes the wrong way, undo it as one step instead of reverting files by hand. Restoring is itself recorded, so history only grows.

#### History is not truth
A visible history does not make an answer correct. It makes the proposed work, the approved change and the next decision easier to question. It does not replace source control.

### Teams and agent crew [in-development]
Name agents as teammates and run them from one roster on a Mac. Teams across machines are in development.

#### The crew on one Mac
Name agents as teammates, assign them work and run them from one roster, next to the people.

The roster and its runs live on one Mac; syncing a team across machines is in development.

#### Teams across machines
One project and roster shared by people on different Macs.

The host answers team sync as unavailable today; nothing on this site implies live multi-machine collaboration.

#### People and agents in one project
Shared work should stay legible: who proposed an action, which model was used, what was approved and what changed. Personal memory and provider keys stay with the profile that owns them.

### Profiles [available]
Separate identities and workspaces for each person or role, with the plan limits stated plainly.

#### A profile with its own memory
Each person or role gets a profile with separate projects, memory and settings; profiles can nest.

Profiles share one Mac and one account; plans set how many profiles an account holds.

#### What the plans cover
Solo is free with one profile. Team holds up to 3 profiles, Family up to 6, Business up to 25, and Enterprise starts at 26. The pricing page is the authority for prices.

Profile capacity is not a token allowance. Provider usage and local machine costs are separate.

#### One setup file for a team
A setup file carries providers, skills and settings, so a second person lands on the same setup.

Keys are typed at a hidden prompt and never stored in the file.

### Shared compute [in-development]
A direction for using trusted machines together when a model needs more than one Mac offers.

#### Why it is on the list
Some capable models do not fit on the Mac where a project starts. The direction is to let you use trusted machines you choose while the project, approvals and model boundaries stay understandable.

That is about moving inference capacity, not uploading projects to an undisclosed cloud. Trust, privacy, network and cost choices must be explicit before a machine takes part.

#### Not shipped
Shared compute is in development. Today a model runs on your Mac or at the provider you chose, and nothing routes a model across machines on its own.

A working version needs authenticated workers, policy checks, cancellation, recovery and a truthful account of where prompts and weights travel.

#### With consent
Until it is built, choose a local model or a provider deliberately and treat remote capacity as a separate decision.

### Desktop [verified-core]
The native Mac window for projects, sessions, approvals, versions and token costs.

#### A window over the host
The desktop window shows the live session, project, approvals, versions and the cost of each turn. The native host owns execution; closing the window does not hand authority to the website.

Native macOS host; the desktop window and website are presentation and control surfaces.

#### Calm by default
Tool calls appear as single title rows. Their input and output open in the terminal's agent tabs, and only the model's thinking expands in the chat.

#### Habits
Reports what the provider or local runtime exposes; a provider that hides usage shows a dash, never a guess.

The Habits tab shows the patterns across turns, sessions, profiles and models.

### Terminal [verified-core]
Where the input and output of an agent's tool calls open, one tab per agent.

#### One tab per agent
A tool call shows in the chat as a title row. Open it to read its input and output in the terminal's agent tabs, without filling the chat with raw output.

The terminal reads the same host-owned session as the chat, so there is one record of what ran.

#### Same rules as the chat
A command an agent runs passes through the same approvals as any other tool call. The terminal shows what happened; it is not a second way around the rules.

#### The website is not the terminal
The public site documents the product. It does not run commands or models.

### Remote and handoff [specified]
The direction for moving work between trusted machines. It is not available today.

#### One project, trusted machines
The direction includes handoff between a Mac, private hardware and future surfaces such as mobile, while project intent, approvals, budget and history stay legible.

This is direction, not a feature. Bandicot does not host agents or provision machines for you today.

#### The route must be visible
A remote path needs identity, capability, network, privacy, cancellation and recovery rules. You should know which machine receives prompts, and which host owns the result, before a turn begins.

#### No date implied
Direction means recorded without a release date. Do not read it as a promise about mobile, cloud or cross-machine availability.

### Privacy [available]
What stays on your Mac, what a provider sees, and what the website account holds.

#### Work stays on your Mac
The native host keeps sessions, project files, memory and execution state on the machine that owns the work. The website is not a place where that state is copied.

A model you install from the local catalog also keeps its prompts on the machine. Review its runtime and any extensions you add.

#### Providers see what you send
Remote providers receive the prompts sent to them and bill you directly.

Bandicot does not make a hosted provider anonymous and does not promise a provider's retention behavior. Choose the provider with the privacy properties you need.

#### The website account
The website account covers identity, billing and device linking. Read the privacy policy for the processors and retention of those services. Using the app and using the website account are separate boundaries.

### Security [available]
The posture Bandicot can explain today: host authority, approvals, bounded work and explicit limits on claims.

#### One execution authority
The native host owns sessions, tools, permissions and effects. The window can submit intent and render state, but it cannot invent a write the host did not accept.

Applies to tool calls the host executes; a remote provider still sees the prompts sent to it.

#### Ask first and stay bounded
Writes and runs outside your rules need approval, and repeated failures stop at a bound. Keys are typed at a hidden prompt and never stored in a setup file.

These are engineering controls, not proof that every provider, plugin or configuration is safe. Review what you enable.

#### What Bandicot does not claim
We do not claim SOC 2 or GDPR certification, a provider's retention behavior, or that a local model fits every Mac. Report a security concern through the support channel on the site.

### Pricing and the free layer [available]
What the free plan includes, what paid plans cover, and which costs stay with your provider or hardware.

#### Solo is free
Solo includes one profile and the core harness, and needs no card. Provider charges, a faster Mac, storage and electricity are not part of it.

#### What paid plans cover
Paid plans add profile capacity: Team up to 3 profiles, Family up to 6, Business up to 25, Enterprise from 26. They are not token plans and do not include provider usage.

Bandicot does not meter your tokens, agents, sessions, skills, plugins or MCP servers. Those run on your Mac under your provider's terms. Use the pricing page for current prices and billing details.

#### You see what you spend
Tokens, cache reads and cost are recorded per turn, session, profile and model, and the Habits tab shows the patterns.

A local model avoids a per-request provider bill, but it still uses memory, disk, electricity and time.

### FAQ [available]
Short answers about what Bandicot is, what it costs, which models it runs and what is still in development.

#### What is Bandicot?
Bandicot is a native Mac workspace where people and AI agents work on the same projects: approvals before writes, a version for every change, and the tokens and cost of every turn in view.

It is not a model and not a hosted agent runtime. It works with the model you choose.

#### What does free include?
Solo includes one profile and the core harness, with no card. Provider usage, hardware, storage and electricity are outside it.

#### Can I run a local model?
Yes. The local catalog holds 8 small chat models, from Gemma 3 270M to SmolLM3 3B, each needing about 1.25 to 4 GB of memory and checked against the Mac's GPU memory budget before download. It runs on Apple Silicon Macs.

Small models suit private, light work. For harder tasks, switch to a hosted provider in the same project.

#### Does it save tokens?
The prompt prefix is frozen, history is append-only, compaction runs at thresholds and skills load on demand. We do not yet claim a whole-task saving; that waits for a measurement on a fixed corpus. You can read the tokens and cost of every turn today.

#### Can a team share a project across machines?
Not yet. An agent crew runs from one roster on one Mac. Teams across machines are in development.

#### Do you hold SOC 2 or GDPR certification?
No. We do not claim SOC 2 or GDPR certification. A hosted provider receives the prompts you send it.

### Roadmap [specified]
The direction after today's workspace, with no invented ship dates.

#### Prove the token saving
The mechanisms ship: a frozen prefix, append-only history, threshold compaction and on-demand skills. The next step is measuring tokens per solved task on a fixed corpus, before and after each change. Until that exists, no percentage is claimed.

#### Teams across machines
One project and roster shared by people on different Macs.

Agents, profiles, approvals and versions already work on one Mac. The work ahead is carrying them to people on different machines without merging private memory.

#### Further out
Remote handoff and shared compute are direction only. Each needs identity, privacy, cancellation and recovery to be shown end to end before its label can change.

A roadmap entry has no ship date. It is not an availability promise.