one daemon, three clients
A terminal CLI, a native Mac app and a loopback web dashboard attach simultaneously and converge on the same durable state. Detaching never interrupts a turn.
the session player
Otto
A local-first AI agent harness for Apple Silicon: a background daemon that runs coding personas over local models â cloud only when you say so â with a terminal CLI, a native Mac app and a web dashboard all attached to the same durable sessions at once.
Python
macOS
local-first
three clients
One daemon owns everything â sessions, personas, provider access â and the clients are thin views that attach and detach without disturbing work already in flight. Close the terminal mid-turn and the turn keeps going; open the Mac app and the dashboard and all three converge on the same state. That state is an append-only entry tree in SQLite where messages, tool calls and config changes are all just entries, so rollback is moving a leaf pointer and crash recovery falls out of the same log.
A persona is a role, a model profile describes how to talk to one model, and effort scales thinking budget and per-turn tool allowances. MLX models route to oMLX, GGUF models to llama.cpp or Ollama, and any persona can bind to any model on any backend â a cloud lead can delegate to local coders, or a fully local session can send only its search queries out. Nothing reaches a cloud provider without a deliberately cloud-enabled persona or an explicit approval recorded as a durable audit entry; there is no silent local-to-cloud fallback.
The terminal is the main instrument: a full-screen app with a multi-line composer, slash-command and @file menus, markdown replies, coloured diffs, collapsible tool calls, nine views a keystroke apart, and an honest cost readout that says "$0.00 local" when every token was. Shell commands aren't sandboxed and the trust model says so plainly â instead there are ask-by-default approvals, workspace-confined file tools, private git checkpoints with preview-gated rollback, and secret redaction wherever text becomes durable. Also a disco-ball pet that dances while Otto works and dozes off when it doesn't.
highlights
append-only sessions
Messages, tool calls and config changes are all entries in SQLite â so branching, rollback and crash recovery come from one mechanism instead of three.
local first, cloud on request
MLX through oMLX, GGUF through llama.cpp or Ollama, plus Anthropic, OpenAI and Gemini â with API keys living only in the macOS Keychain.
nothing leaves silently
Content goes to a cloud provider only for a cloud-enabled persona or after an explicit approval, and the approval itself is written into the session log.
checkpoints, not promises
Private git checkpoints with preview-gated rollback, ask-by-default shell approvals, workspace-confined file tools, and secret redaction before anything persists.
a real TUI
Multi-line composer, slash and @file completion, coloured diffs, collapsible tool calls, five palettes â and a status-line pet that naps between turns.
under the hood
- Python 3.12+, loopback only â a bearer-token FastAPI daemon with idempotent mutating routes and SSE streams that replay history, then go live.
- honest trust model â file tools are confined to the workspace; shell commands are not sandboxed, and approvals are framed as accident prevention rather than isolation.
- guarded web access â search via self-hosted SearXNG, Brave, or a query-only proxy; fetches pin the validated public address, re-check every redirect, and treat all fetched text as untrusted.
- one memory budget â oMLX and llama.cpp coexist under a global budget with per-drain pinning and minimum residency, so model switching can't thrash.
- durable compaction â long sessions summarise into an entry with a persisted context-epoch hash, byte-identical across restarts so resuming can't drift.