Agent Workspace

Not a chat app with a code theme — an agent runtime: a multi-provider LLM hub with on-device model support, a tool executor with sandboxed shell execution, MCP client support, Git integration, and a retrieval memory system with BM25 ranking, embeddings, and a provenance graph.

Why it is unusual

Most things marketed as "AI apps" are a text box wired to someone else's API. The hard parts — deciding what the model should see, giving it tools, letting it act safely, and remembering across a long session — belong to whoever built the platform underneath. This is that underneath layer, on a device with a small screen, an unreliable network, and a battery. That constraint is the point.

What I built

The LLM hub — provider-agnostic by design. A configuration layer over multiple providers rather than one hardcoded SDK, covering streaming and non-streaming API styles behind one interface. It also runs models on the device itself, with a downloader that pulls them from Hugging Face and a background keep-alive service so a large download survives the app being backgrounded. Local inference means the app still works with no network, no API key, and no per-token cost.

The agent runtime. An agent registry, a prompt assembler and store, a tool executor with typed tool schemas, and a session manager. The tool layer reads source code across many languages plus PDF, DOCX, XLSX, PPTX and CSV directly — so the agent reads a spreadsheet or a slide deck as content, not as an unreadable blob.

Execution — two sandboxes, deliberately. An on-device shell via Termux for local commands against the real workspace, and a remote cloud sandbox for anything that should not touch the phone. Letting a model run shell commands is the single most dangerous capability in an agent; two tiers mean the risky path has somewhere isolated to go instead of being either blocked entirely or allowed everywhere. A workspace lock guards against an agent and a user mutating the same files at once.

The memory system. The naive approach is to resend the entire conversation every turn: expensive, slow, and it degrades as the session grows. Instead the agent maintains curated per-session notes that are re-injected each turn, with retrieval deciding what surfaces — BM25 keyword ranking as the spine and embeddings layered on top as an enhancement that degrades gracefully if unavailable. Retrieval queries are composed from the current demand plus recent turns and a derived "current focus" block, because ranking on a bare "ok, continue" gives no signal. A tracked bug is a first-class object with a status: open problems render in a persistent block, a proposed solution is editable so a rejected fix is not re-proposed, and resolved items are down-ranked rather than deleted. Every note records the turn it was born from, so the agent can answer where a memory came from. Chunking is boundary-aware — markdown headings and code fences — so a recalled fragment is a coherent section rather than a sentence cut in half.

Extensibility. An MCP client and registry, so the agent connects to external tool servers over the emerging open standard rather than a proprietary plugin format, plus markdown-defined skills and a plugin importer.

The developer surface. Git integration with its own UI, a code index, file digests and line diffs, a repository workspace, a document workspace with PDF preview and OCR, and a markdown renderer, over a local database.

The decisions that actually mattered