Arigami

Arigami — the self-hosted cockpit for a team of coding agents (Claude Code or Codex) that runs on real desktops, hands you the wheel when it needs you, and learns your business only with your approval.

Website: arigami-site.vercel.app · Film (42 s): click the poster

Install in 60s

One line (Linux / macOS / WSL) — installs bun, the Claude Code CLI and the host as a service, then prints the URL and a pairing code:

curl -fsSL https://raw.githubusercontent.com/maor700/arigami/master/install.sh | bash

Docker:

git clone https://github.com/maor700/arigami && cd arigami
cp docker/.env.example .env      # Claude auth (see the file)
docker compose up --build        # → http://localhost:3199/__host/

Manual:

bun install && (cd web && bun install && bun run build)
bin/host start                   # → http://localhost:3099/__host/
bin/host pair                    # prints the pairing code for the first sign-in

Then open the cockpit, enter the pairing code, pick a profile bundle (see Profiles) and let Setup walk you through Claude or Codex auth, git and your first repo. install.sh --profile <bundle> pre-selects one. Details: docs/INSTALL.md · docs/DOCKER.md · docs/DEPLOY.md.

Prerequisites the installer handles for you: bun ≥ 1.2, git + gh, and the Claude Code CLI signed in with your own subscription — no API keys, no OpenRouter. (ANTHROPIC_API_KEY works too if you prefer metered billing.) Codex instead or as well: npm i -g @openai/codex, then sign in with ChatGPT or an OpenAI API key — see Engines.

What it is

• A team of agent sessions, not one chat. A project-manager session decomposes work, spawns children in their own git worktrees, tasks them, reads back thin results, and integrates. Cron and listeners (mail, webhooks, Linear, Slack) wake sessions on their own. One origin, one Bun server, one UI on your phone or laptop.
• Real desktops, and it hands you the wheel. Every session can drive a browser on its own Xvfb+VNC desktop. At login, 2FA, CAPTCHA or payment it pushes to your phone, you take over the screen, tap Done, and it continues — the human is in the loop exactly where the human is needed.
• A second brain with a human gate. Sessions write episodes, propose memory facts and skill changes — all of it lands in Pending with a diff, undo and scan, and nothing is written until you approve. Fold the cockpit to your business with profile bundles (repos + skills + memory seed + cron).
• A team of agents (the Team section). An agent is who — a persistent identity with a persona, shared skills it should use, its own memory namespace, default model and budget; sessions are born from it (create_session({agent})) and wear its emoji in the rail. Create one from any chat with an editable card, DM it in its home chat, and manage it on its own page. See docs/AGENTS.md.

Engines

Each session runs on one engine, chosen at creation: claude (Claude Code CLI) or codex (OpenAI Codex CLI). Accounts, quota recovery, agent allowlists and Composio work on both; the default is Settings › Host › default engine. What differs, and what does not work on Codex yet: docs/ENGINES.md.

Profiles

A profile bundle folds the cockpit to a purpose — repos + skills + memory seed + cron, applied additively (new skills land in $ARIGAMI_DIR/skills, cron jobs start disabled). The product ships no example profiles: they come from your organisation's profile repo (a git URL) or ~/.arigami/profiles/ — see profiles/README.md.

install.sh --profile <name> · bin/host profile apply <name> · Setup → Profile. Write your own; see docs/INSTALL.md §3.

Why not …

	Arigami	OpenClaw	Hermes Agent	Claude Cowork
Self-hosted	✅	✅	✅	❌
Model / billing	your Claude Code and/or ChatGPT/Codex login	any provider, API keys	any provider, API keys	Claude (Anthropic cloud)
Multi-agent orchestration	PM → children, worktrees, cron	YAML graphs	weak	❌
Real desktop per agent + human takeover	✅ VNC, push to phone	❌	❌	built-in browser, cloud only
Learns (memory + skills)	✅	via skills	✅ core	❌
Human gate on learning	pending + diff + quarantine, always	skill staging	opt-in, no diff	—
Profile bundles (fold to a business)	✅	❌	❌	❌

Security posture

Agents here run shell commands, browsers and git with your credentials, so the cockpit is treated as an admin console, never a public site:

• Authenticated by default. Session cookie, first sign-in by pairing code, optional OIDC (Google/GitHub/your IdP) — docs/AUTH.md.
• Binds 127.0.0.1 and fails closed. Reaching it from another device goes through a tunnel you control: tailscale serve (private to your tailnet, real HTTPS) or Caddy/your reverse proxy with TLS. Never tailscale funnel.
• The cockpit is never funnelled. The only surfaces that open without a cookie are signed, expiring share links for artifacts and webhooks.
• Agents never print absolute URLs. Everything the host hands you is a host-relative path, so links work from localhost, a tailnet or a proxy.
• Skills and memory are never auto-written. Proposals wait in Pending.
• Telemetry is off by default. Opting in sends only funnel milestone names, version, OS/arch and a random id — never prompts, paths or hostnames. DO_NOT_TRACK=1 always wins; Settings shows the exact payload — docs/TELEMETRY.md.

Threat model and hardening: docs/SECURITY.md. Report vulnerabilities: SECURITY.md.

Docs

• docs/INSTALL.md — the three doors (installer, Docker, manual)
• docs/AUTH.md — sign-in, pairing, OIDC, migrating a live host
• docs/DEPLOY.md — systemd units, restart/upgrade from the cockpit
• docs/DOCKER.md — image, volumes, Kubernetes notes
• docs/ENGINES.md — the two agent engines (Claude Code, Codex): accounts, quota, what differs, limitations
• docs/SPEC.md — data model, REST/WS API, host MCP tools, UI
• docs/ONBOARDING.md — repos, profiles, readiness gates
• docs/TRIGGERS.md · docs/DISPATCHER.md — listeners, cron, PM → children
• docs/RESILIENCE.md — the host supervisor: per-session health, the recovery ladder (respawn, token refresh, account switch, the fable → sonnet → haiku model ladder), synthesized reports for a child that never reported, the incident log and the "waiting for you" queue
• docs/AGENTS.md — agents (Team): persona, memory namespace, create_session({agent}), the Rail section and chat card; A2: connections + Chrome profile + cron per agent; A3: host-enforced tool/domain allowlists, daily budgets, activity ledger with cost, auto-approved actions; A4: slash-commands, @mentions, bundles that ship agents; A5: revocable , human-approved share links, budgets that stop turns; M1: a vendor MCP grant per agent

Windows: bin\host.ps1 mirrors bin/host (start/launch/doctor/install as a Scheduled Task); server/lib/platform.ts normalizes the POSIX assumptions. macOS: bin/host install registers a launchd agent and bin/install-app builds a one-click Arigami.app.

License

Apache-2.0 — see LICENSE and NOTICE. Contributions are accepted under the DCO (CONTRIBUTING.md).