GitHub tokens stay with gh
Ensemblr stores none. No token field in settings, no OAuth screen, no second place one can leak from.
Agents that drive the app, not just the code.
Ensemblr™ is a desktop orchestrator for the Pi agent harness or the Claude Code CLI you already have installed. Every stream of work gets its own git worktree, and the agent inside it can delegate from root to manager to leaf, wait, verify and integrate — then open the diff, run the scripts and file the PR.
No account, no sign-in, no cloud sync, no telemetry. No Ensemblr backend in the path, and no agent binary of its own.
- Apple silicon or Intel Mac, or x86-64 Linux®
- Pi or Claude Code CLI
- git
- gh, authenticated
ensemblr/octocat/appearance-tokensmaster
~/Ensemblr/workspaces/ensemblr/adamsAppearance tokensTerminal contrast pass
Move the appearance tokens onto the shared palette and keep the terminal readable.
ThinkingThe xterm adapter reads the computed value, so the token has to…
Grep --ensemblr-canvas
Readindex.css
Editindex.css+64-12
Editxterm-adapter.ts+38-6
Running npmnpm run test -- appearance
Done. Palette resolves through one pair of light/dark cuts, and the terminal picks the change up on a live config reload.
Two things to know: the adapter reads computed values, not the variables themselves.
--ensemblr-canvashad two definitions. The one inindex.csswon on every build, so the second was already dead.- xterm caches its theme per instance —
applyTheme()now runs on the config event rather than on mount.
4m, 12.8s
Send a follow-up
Fable 5.1Max
Working…
All filesChanges14ChecksReview
renderer/styles/index.css+110-14
renderer/lib/terminal/xterm-adapter.ts+62-6
renderer/appearance/preview.tsxA+23
renderer/state/appearance.tsR+16-4
renderer/lib/legacy-theme.tsD-113
renderer/fixtures/appearance.json+41-12
docs/appearance.mdU+8
bun.lock+4-2
renderer/lib/theme/palette.ts+31-7
renderer/components/terminal-view.tsx+12-5
renderer/state/__tests__/appearance.test.tsA+9
shared/config/settings.schema.json+6-6
renderer/styles/terminal-theme.cssD-48
CHANGELOG.md+2
SetupRun:3000
+@biomejs/biome@2.2.0
+@tailwindcss/postcss@4.3.2
+@types/node@20.19.43
+@types/react@19.2.17
+@types/react-dom@19.2.3
+electron@34.1.1
+next@16.2.10
+react@19.2.4
+react-dom@19.2.4
+tailwindcss@4.3.2
+typescript@5.9.3
+vitest@3.1.4
+xterm@5.5.0
+zod@4.4.3
57 packages installed [751.00ms]Rerun setup
Ensemblr Control
Not a place you run one agent. A place a team of agents runs itself.
A root agent can hand a workstream to a manager, which may split it once more into leaves. Each conversation keeps its own context, while the Agents panel shows the whole tree, live tool activity and context use.
ensemblr_start_conversationensemblr_wait_for_agentsensemblr_launch_harnessensemblr_get_workspace_diffensemblr_add_diff_commentsensemblr_ask_user_questionensemblr_set_workspace_status
Ensemblr Controlapproval required
orchestratorclaude-fable-5-1
sub-agent
audit the reducer
sub-agent
port the tests
sub-agent
sweep the i18n keys
delegatewaitevaluateintegrate
- Permission mode
- read-only · approval required · workspace-trusted
- Delegation depth
- two edges — root → manager → leaf; leaves stop there
- Issue writes
- withheld from sub-agents; agent work stops at In Review, enforced in code
- Linked issue
- named in every brief, cut to the calls that caller may make
- Agent skill
- the tool surface, the worktree model and every settings.toml key — read on demand, shipped inside the app
- Unattended runs
- told you are away rather than left asking; the loop is sized to what the change earns; a second writer on the worktree is refused, and the run stops at a pull request it never merges
Workspaces
One repo. As many streams as you have ideas.
A workspace is a real git worktree, not a branch you keep switching between. Two agents can rewrite the same file at once and never see each other.
- Quick start publishes a private repo to you or a GitHub organisation
- Start from a branch, a GitHub PR, or a Linear issue
- Adopt an existing branch, or cut one from the base ref
- Branch names derived from your first sentence to the agent
- A Backlog holding Linear and GitHub issues no workspace exists for
- Drag one rightward to cut its workspace; nothing is written back
Runtimes
Two runtimes. One surface.
Pi runs as a CLI over RPC; Claude Code runs through the Agent SDK against the binary you already have. The wiring differs, the surface does not.
- One timeline, tool cards, approvals and context gauge for both
- Each agent is handed control-tool names its own runtime can call
- Sage, Coder, Builder, Grunt and Explorer roles guide delegation
- Plan mode holds an agent and every sub-agent to read-only tools
- A planning agent still names the work, asks, and submits its plan
- Git-backed checkpoints restore the tree to an earlier turn
- A failed turn offers only the recoveries its failure class earns
- Cross-runtime delegation between Pi and Claude Code stays opt-in
Review
Review the change where you made it.
The review panel sits beside the conversation that produced the change. Reading the diff never means leaving the agent that wrote it.
- Diffs scoped to uncommitted work, a commit, or a whole branch
- Attach a file, a folder or a diff to the chat beside it
- Inline comments anchored to lines, resolved ones struck through
- An agent’s comment pass pulls Checks forward once, however many it files
- Repository settings land on a branch and in this diff, like any other change
- PR title, description, live check status and merge, all through gh
Concierge
Where does everything stand? Start the Linear sync work.
ensemblr_start_conversation Linear issue sync
ensemblr_create_workspace Dock port detection
Both are running. Where they stand is in artifacts/where-the-work-stands.md.
4.2s
Ask across every project…
Opus 5High
The Concierge
Every workspace at once. Write access to none.
A panel that belongs to the app rather than to a workspace. It reads everywhere and changes nothing by hand: real work goes to an orchestrator it spawns.
- Reads every workspace’s files, diff, review comments and terminals
- Replays any conversation, tool calls included
- Spawns a root orchestrator into a workspace, and briefs it
- Cannot write a file in any workspace; its bash is read-only
- Cannot open a terminal or launch a harness
- Cannot act on a workspace without naming one
Credentials
Your machine. Your credentials.
Ensemblr is an orchestrator, not a service. Nothing to sign in to and nothing synced off your machine, because there is no our side.
Secrets live in the OS keyring
Linear’s OAuth tokens go to the macOS Keychain, or gnome-keyring or KWallet on Linux — never a file, never an environment variable. Infisical secrets are not stored at all: they resolve live at launch.
No agent binary ships
Your pi and claude installs, your credentials, your models. The ~260 MB the Claude Agent SDK would bundle is left out.
No account, no server
Ensemblr talks to GitHub, Linear, Infisical and your CLIs directly — no backend in the path, no telemetry. State is a local SQLite database.
Download
Open it, point it at a repo, start a workspace.
Ensemblr is at 0.1.22 and still pre-1.0. The core loop is wired to real services and used daily; expect rough edges, and file them.
Before it is useful
- macOS on Apple silicon or Intel, or Linux on x86-64
- arm64 Linux is not built. Windows is not supported.
- An agent runtime CLI
- Pi, Claude Code, or both. Ensemblr ships neither. Fable 5.1 resolves only against a claude binary at 2.1.251 or newer.
- git
- Used natively for worktrees, branches, commits and diffs.
- GitHub CLI (gh), authenticated
- Authenticate once with gh auth login. PR and check data reads through it.
- A Linear accountoptional
- OAuth only, as many organisations as you need.
- An Infisical projectoptional
- A Machine Identity and a project link in the repo. Secrets resolve live at launch.
Signed with an Apple Developer ID and notarised by Apple. Hardened runtime, and the ticket is stapled to both the .app and the disk image, so macOS validates each offline on first open. No Gatekeeper override, no quarantine flag to strip.
Check it before you open it (Apple silicon .dmg):
shasum -a 256 ~/Downloads/Ensemblr-0.1.22-arm64.dmg
9bfb01be6f22b3efa2fc986d10eb9de2c4809456e1d4a971f7808b8e5b4ecb63Check it before you open it (Intel Mac .dmg):
shasum -a 256 ~/Downloads/Ensemblr-0.1.22-x64.dmg
85d8a63490ae19b1798c0cc1ec9f367491215d8dd27f8a013f07a5a7c2af0a37Or install it with Homebrew:macOS only.
The cask picks the Apple silicon or Intel disk image to match the Mac and needs macOS 13, so brew refuses where the app cannot open. It pulls in gh too; gh auth login stays yours to run.
It is marked auto_updates, so brew upgrade leaves the bundle to Ensemblr’s own updater. To hand it to Homebrew instead, turn Settings → General → Update Ensemblr automatically off and upgrade explicitly:
Prefer a zip? Apple silicon .zip · 155 MBIntel Mac .zip · 161 MB
Version v0.1.22Architecture: x86-64Published 24 Sept 2026
Unsigned. Linux has no notarisation to pass. Nothing on Linux issues the equivalent of a Developer ID, and a self-signed binary would prove nothing. The SHA-256 below is the check, and install.sh refuses on a mismatch.
Check it before you open it:
sha256sum ~/Downloads/Ensemblr-0.1.22-x64.AppImage
89ecd3aad7e9f289e6ffc740286a5b837c36c4cfa7f46a07334a3d9e85947ab1Or install it with the script:
It verifies the SHA-256 first, puts the AppImage under ~/.local, and unpacks the launcher entry and icons the bundle already carries. Read it first: nothing in it needs root or writes outside your home directory.
From somewhere it can write — which is where the script puts it — Ensemblr updates itself: same digest check, then the AppImage is swapped in on restart. Where it cannot write its own file it reports the newer version and links the release page instead, and this is the other end of that:
Nightly · canary
An untested build of master. Rebuilt at 04:00 UTC on the nights the branch moved. It installs as “Ensemblr Canary” alongside a release rather than over it.
macOS · Apple siliconsigned and notarised exactly like a release
Ensemblr-Canary-arm64.dmgLinuxunsigned, like the release AppImage
Ensemblr-Canary-x86_64.AppImageNo SHA-256 here: the bytes behind these links are replaced most nights, so one printed here would be wrong by morning. The nightly release names the commit it was built from.