Romulus

Romulus killed Remus. This should kill your need for Meta Muse.

Romulus is a free, open-source to-do list app with an AI agent built in, for Windows, macOS, Linux and Android. Download it free.

A to-do list with an agent in it. Write a task the way you'd tell a person ("find the cheapest flight to Denver the weekend of the 14th", "order the groceries", "apply to these three internships", "draft a reply to the landlord"), hand it to the Agent, and it goes and does it: searches the web, reads pages, fills forms, compares prices, builds the cart, drafts the email. It comes back only when it needs a decision, and it never buys, sends, submits or books anything until you reply "yes" to the exact thing it described.

Bring your own model. Plug in whatever you already pay for or can run: a Claude or ChatGPT plan, an OpenRouter account (hundreds of models, some free), a Gemini key, the free tiers from Grok, Groq, Cloudflare or NVIDIA, or your own model on your own hardware through Ollama. Connect several and the app tries them in your order. Tasks that touch private things (bank, medical, passwords…) only ever go to your local model.

Your money, without the subscription. The Finance tab does what people pay Rocket Money, Monarch or Copilot for: every account in one place, recurring bills and subscriptions found automatically (and flagged when one stops), net worth over time, an income statement and balance sheet, receipts pulled from your inbox, live stock prices. The bank connection is read-only and costs about $15 a year; the data sits in an encrypted vault on your computer (and, if you scan a QR code, on your phone behind your fingerprint), not on anyone's server, and no cloud AI can read it.

Plus a School list that pulls due dates from course calendars, a Notes board, an Hours log, Google and Microsoft calendars, and an Android app that stays in sync.

Install

Download page: jamesbobdev-gif.github.io/Romulus picks the installer for your platform and shows the current version.

Windows: download Romulus-Setup-<version>.exe from the latest release and run it. The installer isn't code-signed yet, so Windows warns: More info → Run anyway. Installed copies update themselves.

Linux, macOS and Android: the .deb (Ubuntu, Debian, Mint) or .AppImage (other distributions), the .dmg and the .apk are attached to the same releases. The macOS build is unsigned, so the first open needs System Settings → Privacy & Security → Open Anyway.

From source: Node 22 or newer, then npm install and npm start.

Then read docs/SETUP.md: connecting an AI (every option, with the buttons to press), syncing with your phone, calendars, Finance, and where your keys live.

What's in the box

Human	Your own to-dos: due dates, times, tags, subtasks, repeats, drag to reorder, search.
Agent	Tasks the AI does. Live view of what it's doing, its questions, its results, the conversation. A pill on each task picks which AI.
School	Assignments, with due dates pulled from Blackboard or D2L calendar links; the class is the tag.
Work	A second list, synced with the rest.
Calendar · Notes · Hours	Extra views: the month, a board of note cards, a log of hours per day.
Finance	A Rocket Money / Monarch replacement: accounts, recurring bills and subscriptions, net worth, statements, receipts from Gmail, live stock prices. Bank read-only through SimpleFIN. Encrypted twice, locks itself, never on a server; the phone can get its own copy from a QR code.

What the Agent can do today: research and writing; shopping on Amazon and Walmart (groceries included) with the cart built and held for your yes; flights, tickets and bookings with a seat map you can override; forms and job applications filled from a Locked profile only your local model may read; email through Claude; a morning look-ahead over your calendar and inbox; tasks that start on their own when an email arrives, a calendar event is near or a web page changes; goals planned first and then run as a chain of steps; deep research (#legion) that your local model splits into pieces so no single cloud AI sees the whole question; steps you've allowed once and for all so it stops asking; memory of what you've said and what worked on each site; its own headless browser you can watch and take over.

Privacy, in short

Everything you connect stays on the computer where you connected it. Keys, tokens and sync keys are encrypted with the operating system's own encryption and never synced. The sync key, which is the password to your lists, is kept only there on the computer and in app storage excluded from backups on the phone, and can be rotated from Settings. The Locked profile is encrypted on your device before it is uploaded. The Locked profile and Finance are never given to a cloud AI. Sync goes through a Supabase project you own, and the sync table is closed to anyone without the list's key. There is no telemetry. Details in SECURITY.md.

---

Working on the code

npm install
npm start        # dev mode
npm test         # unit tests (Node's built-in runner, files in test/)
npm run dist     # installer into dist/

• main.js starts the Electron main process and wires the modules: each gets what it shares with the others through init(ctx) and lists its IPC calls in handlers.
• main/ is the desktop plumbing: window and tray, saving tasks, config and encrypted secrets (store.js), calendar sync and accounts, Gmail dates, the morning look-ahead, Finance, downloads.
• agent/ is the Agent: routing between lanes, the Claude runner, the other cloud AIs (providers.js), the local-model lane and its tools and browser, AI connections (ai-connections.js, claude-auth.js, openrouter-connect.js), the usage-limit hold, the weekly memory tidy, skills and site notes.
• preload.js is the bridge between the two.
• renderer/ is the UI. index.html holds the markup, styles.css the look, js/*.js the page scripts. Plain scripts, no bundler: they share one global scope and load in the order index.html lists them, ending with init.js. Declare a top-level name in one file only.
• mobile/ wraps the same UI in Capacitor for Android. supabase/ holds the sync project's SQL (setup.sql is the one-paste version) and edge functions. minipc/ has scripts for running the local model on a second machine, which takes local tasks for every device through sync (docs/second-machine.md).

CONTRIBUTING.md has the ground rules; the one that matters most is that the Agent's "ask before anything final" stays enforced in code.

Sign-in clients

One-click Google and Microsoft sign-in needs the app's own OAuth clients in oauth-clients.json (see oauth-clients.example.json; git-ignored). The official builds carry the maintainer's. A build without one still works: people paste their own Google Cloud credential in Settings → Calendars.

Releases

One version number (package.json) covers every device: the desktop installers and the Android APK of a release all carry it, and each installed copy picks the new version up on its own. Computers (main/updater.js) check the releases repository every four hours, download quietly and install when idle; the phone (mobile/update-phone.js) checks a few times a day and shows an Update banner, since Android won't replace an app without a tap. So a release reaches the phone and both computers within hours of each other, each on its own schedule.

Releasing to every device: bump the version in package.json, commit, and push a v<version> tag. That runs .github/workflows/release.yml, which builds Windows, Linux and macOS installers and the signed Android APK on GitHub's runners and publishes them all to the public releases repository named in package.json → build.publish. It needs these repository secrets:

Secret	What
RELEASES_TOKEN	Classic personal access token with the repo scope, write access to the releases repository.
ANDROID_KEYSTORE_BASE64	The Android signing keystore, base64-encoded (base64 -w0 release.keystore). Without it the phone build is skipped.
ANDROID_KEYSTORE_PASSWORD, ANDROID_KEY_ALIAS, ANDROID_KEY_PASSWORD	Its password, key alias and key password.
OAUTH_CLIENTS_JSON	Optional: the app's own Google / Microsoft sign-in clients.

Make the keystore once (keytool -genkeypair -v -keystore release.keystore -alias romulus -keyalg RSA -keysize 2048 -validity 10000) and keep it safe: Android only installs a new APK over an old one when both are signed with the same key, so losing it means everyone reinstalls. A phone that has a debug build from ./gradlew assembleDebug must uninstall it once before the first signed release goes on (sync brings the tasks back). The Mac and Windows installers stay unsigned until their signing secrets are set; the release workflow lists them.

npm run release is the quick path for Windows only: it bumps the version, builds the installer on this machine and publishes it. The phone and the other systems only get a version that went through the tag workflow.

Never add seed-config.json or oauth-clients.json to a build you share, and never share an APK built with your own mobile/sync-config.json: both hold keys to your lists.

Phone app (Android)

cd mobile
node prepare-www.js        # copies renderer/ and bakes in sync-config.json
npx cap sync android
cd android && ./gradlew assembleGithubDebug

Needs JAVA_HOME (JDK 21) and ANDROID_HOME. The APK lands in mobile/android/app/build/outputs/apk/github/debug/ (assemblePlayDebug makes the Google Play build instead, with no update banner); it updates an installed copy in place. Its version comes from the root package.json. Without a mobile/sync-config.json the build bakes in no keys, and the phone is connected by pasting the sync code into Settings → Device sync; that is how the public APK from the releases page is built (see Releases below).

Where your data lives

Tasks are in tasks.json in the app's user-data folder (%APPDATA%\Romulus on Windows, ~/Library/Application Support/Romulus on macOS, ~/.config/Romulus on Linux; copies before 1.0.3 used a Tasks folder, moved on first start). Back up that one file. Config and keys are in config.json next to it, secrets encrypted.

Desktop behaviour

The installed app starts at login (toggle in the tray menu), hides to the tray when closed, and reappears when the screen wakes or unlocks. Windows won't let an app pin itself: Start menu → right-click Romulus → Pin to taskbar.

Theme

Settings → Theme takes CSS. The whole look is CSS variables, so a re-skin is a handful of overrides:

:root{
  --bg:#16161D; --surface:#1F1F28; --ink:#E6E6EA;
  --muted:#9C9CA8; --faint:#6E6E7A; --hairline:#33333E;
  --chip:#2A2A35; --accent:#8FA3FF;
}

Quick reference

• Enter adds a task (date, time and tag are optional and stay sticky for batch entry)
• / jumps to the input · Ctrl+F (Cmd+F) searches
• ↑/↓ select · Space completes · Enter expands · Delete removes · Esc deselects
• Drag the dots on a row's left edge to reorder; click a tag chip to filter
• Hover a row for edit / expand / delete; overdue and due-today rows get a snooze button
• Notes: + Add a note in a group; drag cards between groups; highlight lines in a description for → To-do or → Agent

License

MIT.