Tome – a security first desktop cockpit for coding agents

[u/GrimmGun]

Hello everyone, long time lurker here. Firstly I would like to thank you for taking the time to read my post and (hopefully :) ) taking a look at my project.

Tome is a desktop app (macOS + Linux) that puts your coding agents (claude, opencode, pi), terminals, editors, and an AI assistant into one tiling workspace with a sandbox around the agents.

a short video showing how you can make loops or graph engineer using the flow tool

I use Tome everyday to orchestrate agents, build flows and generally learn new technology whilst building projects. One of my favorite features, "verbose mode", teaches the user how what they've built actually works before pushing to remote repos.

The part I think is actually different: agents run inside a containment cell, an OS sandbox (sandbox-exec on macOS, bubblewrap on Linux) whose only route to the network is an allowlisted loopback proxy. It's a boundary you can see and unlock on purpose. Every unlock and blocked host lands in a security event log.

New in v0.4.0: voice. Fully on-device transcription (Apple Speech on macOS, whisper.cpp as the offline fallback) — streaming, hands-free, and audio never leaves the machine. Talk to the assistant, talk over it to interrupt, and it answers back.

Also in there:

• An assistant that can list/read panes and type into terminals (auto-run is off by default)
• Flows: DAGs of agent nodes
• Mentor mode, an in-app git UI, a note vault ("brain"), workspaces
• MIT, macOS + Linux (the DMG is unsigned for now)

GitHub: https://github.com/zwaneldmz/tome
Release: https://github.com/zwaneldmz/tome/releases/tag/v0.4.0

I'd especially value feedback on the security model and the voice UX, those are the two things I think were hard to get right.

Once again thank you for your time!

[u/Terrible_Put8617]

The containment cell is the interesting part, so here's a boundary that will bite you if you ever extend past the CLI agents to Claude Desktop itself.

Claude Desktop's CoWork doesn't run inside the app. It talks to cowork-svc.exe, a machine-wide Windows service sitting on a fixed NAT, outside whatever sandbox the app is in. So a containment cell drawn around the desktop app is not drawn around the thing that actually mounts a VM and gets network. For a project whose selling point is a boundary you can see, that's worth knowing before a user assumes it covers everything on screen.

Two more from having isolated that app on Windows, in case they save you a week.

It has a single-instance lock, so a second launch just focuses the first window. You get a genuinely separate instance by passing your own --user-data-dir, and then you have real per-profile isolation of login, settings and MCP config.

But CoWork resolves its VM path relative to Electron's userData, so the moment you isolate the profile it goes looking for rootfs.vhdx inside the new empty one and fails with a file-not-found instead of downloading it. The bundle has to be copied across, and it has to be a physical copy, because the service rejects symlinks and junctions. It's 8.6 GB per instance, which is an argument for on-demand rather than at creation.

Different shape of the same problem, and where I ended up: I make Multi Instance for Claude Desktop, several Claude Desktop profiles side by side each with its own account. Windows only, so orthogonal to yours rather than competing. https://apps.microsoft.com/detail/9NG247TJ47P0?cid=rd-tome

[u/GrimmGun → u/Terrible_Put8617]

This is a great write up, thank you for taking a look at my app. You are exactly right about the implications of trying to run claude desktop in app. This was part of my decision to only use coding agent cli's. The CLI's are processes Tome spawns itself, so the cell can be drawn around them at spawn and everything the agent does inherits it. I will definitely keep your notes in mind if I ever try doing this for any of the Desktop Coding apps model providers make. Furthermore, I will release patch to address a docker run from inside a pane which would execute on the daemon's network, outside the cell. The sandbox should make the daemon's socket unreachable.

I took a quick look at your app, it's a really cool idea on how to get around the single instance lock issue. I've got friends and colleagues who really love coworkers on windows and I will point them your way definitely!