GitHub tokens stay with gh
Ensemblr stores none. No token field in settings, no OAuth screen, no second place one can leak from.
Agents that drive the app, not just the code.
Ensemblr™ is a desktop orchestrator for the Pi agent harness or the Claude Code CLI you already have installed. Every stream of work gets its own git worktree, and the agent inside it can spawn sub-agents, delegate, wait and integrate — then open the diff, run the scripts and file the PR.
No account, no sign-in, no cloud sync, no telemetry. No Ensemblr backend in the path, and no agent binary of its own.
- Apple silicon or x86-64 Linux®
- Pi or Claude Code CLI
- git
- gh, authenticated
ensemblr/octocat/appearance-tokensmaster
~/Ensemblr/workspaces/ensemblr/adamsAppearance tokensTerminal contrast pass
Move the appearance tokens onto the shared palette and keep the terminal readable.
ThinkingThe xterm adapter reads the computed value, so the token has to…
Grep --ensemblr-canvas
Readindex.css
Editindex.css+64-12
Editxterm-adapter.ts+38-6
Running npmnpm run test -- appearance
Done. Palette resolves through one pair of light/dark cuts, and the terminal picks the change up on a live config reload.
Two things to know: the adapter reads computed values, not the variables themselves.
--ensemblr-canvashad two definitions. The one inindex.csswon on every build, so the second was already dead.- xterm caches its theme per instance —
applyTheme()now runs on the config event rather than on mount.
4m, 12.8s
Send a follow-up
Fable 5.1Max
Working…
All filesChanges14ChecksReview
renderer/styles/index.css+110-14
renderer/lib/terminal/xterm-adapter.ts+62-6
renderer/appearance/preview.tsxA+23
renderer/state/appearance.tsR+16-4
renderer/lib/legacy-theme.tsD-113
renderer/fixtures/appearance.json+41-12
docs/appearance.mdU+8
bun.lock+4-2
renderer/lib/theme/palette.ts+31-7
renderer/components/terminal-view.tsx+12-5
renderer/state/__tests__/appearance.test.tsA+9
shared/config/settings.schema.json+6-6
renderer/styles/terminal-theme.cssD-48
CHANGELOG.md+2
SetupRun:3000
+@biomejs/biome@2.2.0
+@tailwindcss/postcss@4.3.2
+@types/node@20.19.43
+@types/react@19.2.17
+@types/react-dom@19.2.3
+electron@34.1.1
+next@16.2.10
+react@19.2.4
+react-dom@19.2.4
+tailwindcss@4.3.2
+typescript@5.9.3
+vitest@3.1.4
+xterm@5.5.0
+zod@4.4.3
57 packages installed [751.00ms]Rerun setup
Ensemblr Control
Not a place you run one agent. A place a team of agents runs itself.
A permission-gated surface lets an agent drive the app itself, not just the code in it. Pi reaches it through a shipped extension and Claude Code through an embedded MCP server, and a parity test keeps the two tool lists from drifting.
ensemblr_start_conversationensemblr_wait_for_agentsensemblr_launch_harnessensemblr_get_workspace_diffensemblr_add_diff_commentsensemblr_ask_user_questionensemblr_set_workspace_status
Ensemblr Controlapproval required
orchestratorclaude-fable-5-1
sub-agent
audit the reducer
sub-agent
port the tests
sub-agent
sweep the i18n keys
delegatewaitevaluateintegrate
- Permission mode
- read-only · approval required · workspace-trusted
- Delegation depth
- shallow — sub-agents never delegate onward
- Issue writes
- withheld from sub-agents; agent work stops at In Review, enforced in code
- Linked issue
- named in every brief, cut to the calls that caller may make
- Agent skill
- the tool surface, the worktree model and every settings.toml key — read on demand, shipped inside the app
Workspaces
One repo. As many streams as you have ideas.
A workspace is a real git worktree, not a branch you keep switching between. Two agents can rewrite the same file at once and never see each other.
- Quick start publishes a private repo to you or a GitHub organisation
- Start from a branch, a GitHub PR, or a Linear issue
- Adopt an existing branch, or cut one from the base ref
- Branch names derived from your first sentence to the agent
- A Backlog holding Linear and GitHub issues no workspace exists for
- Drag one rightward to cut its workspace; nothing is written back
Runtimes
Two runtimes. One surface.
Pi runs as a CLI over RPC; Claude Code runs through the Agent SDK against the binary you already have. The wiring differs, the surface does not.
- One timeline, tool cards, approvals and context gauge for both
- Fable 5.1 leads the Claude picker, ahead of Opus, Sonnet and Haiku
- Plan mode holds an agent and every sub-agent to read-only tools
- Git-backed checkpoints restore the tree to an earlier turn
- A failed turn offers only the recoveries its failure class earns
- Codex, Vibe and the claude TUI run as terminal harnesses
Review
Review the change where you made it.
The review panel sits beside the conversation that produced the change. Reading the diff never means leaving the agent that wrote it.
- Diffs scoped to uncommitted work, a commit, or a whole branch
- Attach a file, a folder or a diff to the chat beside it
- Inline comments anchored to lines, resolved ones struck through
- An agent’s comment pass pulls Checks forward once, however many it files
- PR title, description, live check status and merge, all through gh
Concierge
Where does everything stand? Start the Linear sync work.
ensemblr_start_conversation Linear issue sync
ensemblr_create_workspace Dock port detection
Both are running. Where they stand is in artifacts/where-the-work-stands.md.
4.2s
Ask across every project…
Opus 5High
The Concierge
Every workspace at once. Write access to none.
A panel that belongs to the app rather than to a workspace. It reads everywhere and changes nothing by hand: real work goes to an orchestrator it spawns.
- Reads every workspace’s files, diff, review comments and terminals
- Replays any conversation, tool calls included
- Spawns a root orchestrator into a workspace, and briefs it
- Cannot write a file in any workspace; its bash is read-only
- Cannot open a terminal or launch a harness
- Cannot act on a workspace without naming one
Credentials
Your machine. Your credentials.
Ensemblr is an orchestrator, not a service. Nothing to sign in to and nothing synced off your machine, because there is no our side.
Secrets live in the OS keyring
Linear’s OAuth tokens go to the macOS Keychain, or gnome-keyring or KWallet on Linux — never a file, never an environment variable. Infisical secrets are not stored at all: they resolve live at launch.
No agent binary ships
Your pi and claude installs, your credentials, your models. The ~260 MB the Claude Agent SDK would bundle is left out.
No account, no server
Ensemblr talks to GitHub, Linear, Infisical and your CLIs directly — no backend in the path, no telemetry. State is a local SQLite database.
Download
Open it, point it at a repo, start a workspace.
Ensemblr is at 0.1.4 and still pre-1.0. The core loop is wired to real services and used daily; expect rough edges, and file them.
Before it is useful
- macOS on Apple silicon, or Linux on x86-64
- Intel Macs and arm64 Linux are not built. Windows is not supported.
- An agent runtime CLI
- Pi, Claude Code, or both. Ensemblr ships neither. Fable 5.1 resolves only against a claude binary at 2.1.251 or newer.
- git
- Used natively for worktrees, branches, commits and diffs.
- GitHub CLI (gh), authenticated
- Authenticate once with gh auth login. PR and check data reads through it.
- A Linear accountoptional
- OAuth only, as many organisations as you need.
- An Infisical projectoptional
- A Machine Identity and a project link in the repo. Secrets resolve live at launch.
Version v0.1.4Architecture: Apple siliconPublished 6 Sept 2026
Signed with an Apple Developer ID and notarised by Apple. Hardened runtime, and the ticket is stapled to both the .app and the disk image, so macOS validates each offline on first open. No Gatekeeper override, no quarantine flag to strip.
Check it before you open it:
shasum -a 256 ~/Downloads/Ensemblr-0.1.4-arm64.dmg
43a188fdc27a69eea452cf3b10565ae6f7bc5f0d76389cc336efd3f77c7972ebOr install it with Homebrew:macOS only.
The cask declares Apple silicon and macOS 13, so brew refuses where the app cannot open. It pulls in gh too; gh auth login stays yours to run.
It is marked auto_updates, so brew upgrade leaves the bundle to Ensemblr’s own updater. To hand it to Homebrew instead, turn Settings → General → Update Ensemblr automatically off and upgrade explicitly:
Prefer a zip? Apple silicon .zip · 159 MB
Version v0.1.4Architecture: x86-64Published 6 Sept 2026
Unsigned. Linux has no notarisation to pass. Nothing on Linux issues the equivalent of a Developer ID, and a self-signed binary would prove nothing. The SHA-256 below is the check, and install.sh refuses on a mismatch.
Check it before you open it:
sha256sum ~/Downloads/Ensemblr-0.1.4-x64.AppImage
87759e1422353215e7046ce74bb8d68dd37befd06c9de4f661c2236874d6f85fOr install it with the script:
It verifies the SHA-256 first, puts the AppImage under ~/.local, and unpacks the launcher entry and icons the bundle already carries. Read it first: nothing in it needs root or writes outside your home directory.
Ensemblr does not update itself on Linux — an AppImage is a file you placed yourself, often somewhere it cannot be written back to. It reports a newer version instead; this is the other end of that:
Nightly · canary
An untested build of master. Rebuilt at 04:00 UTC on the nights the branch moved. It installs as “Ensemblr Canary” alongside a release rather than over it.
macOSsigned and notarised exactly like a release
Ensemblr-Canary-arm64.dmgLinuxunsigned, like the release AppImage
Ensemblr-Canary-x86_64.AppImageNo SHA-256 here: the bytes behind these links are replaced most nights, so one printed here would be wrong by morning. The nightly release names the commit it was built from.