Transistor. A native AI operating system. One agent with persistent memory, skills and scheduled tasks, synced across every device.

Overview

Transistor is a desktop app that runs a personal AI agent on your own computer. Memory, conversations and skills stay on disk, the app holds your credentials itself, and nothing that sends, deletes, pays or publishes goes out until you approve it. It’s an operating-system layer, not a chat window: memory that’s there when a session starts, skills it learns from your conversations, tasks that run in the background, and a home screen that leads with what needs you. It’s early: version 0.1, Mac first.

Why I built it

Every AI app you use is quietly building a picture of you: your projects, your writing, how you think. That picture lives on their servers, and when a better model ships you start from zero. Cloud agents also run on someone else’s computer and ask for approval rather than enforce it. I wanted it the other way round: the model as an engine you can swap, and your memory and permissions on a machine you own.

My role

I designed and built Transistor on my own: the product, the interface and its themes, the Rust runtime, the website and the docs. Claude Code was my pair, co-authoring 145 of the repository’s 198 commits.

What it does

• One agent, your choice of model. Use a subscription or an API key. Routing picks a model per task, and switching keeps your memory.
• Memory, skills and routines. Episodic, semantic and procedural memory indexed on the Mac, saved skills the agent reuses, and scheduled tasks written in plain language (“send me a summary of unread email every morning at 8”) whose results arrive in the Feed.
• An approval firewall. Every tool call is classified, and an unknown tool counts as risky.
• Mission Control, Feed and apps. Briefings, workflows, meetings and notes, calendar, channels and boards, in one shell with four themes, each light or dark.
• Apps and plugins. Single-file apps with their own data, and plugins that install switched off and run sandboxed.
• Sync with no cloud account. Pair devices with a code; sync is peer to peer and end-to-end encrypted.

Decisions and trade-offs

• Read freely, act through a gate. Tools whose names start with a read verb run on their own. Anything that sends, deletes, pays, executes or pushes is high risk and waits for you, and anything unrecognised is medium: unknown means ask. The approval card shows the tool’s actual arguments, not a summary of them.
• Credentials never reach the model. Secrets live in the macOS Keychain and are read through a single credential proxy, so they never appear in a prompt, a log or git.
• Off by default. Sync starts switched off. Pairing codes expire after five minutes and burn after five wrong tries. A new app installs switched off, runs in a sandboxed frame and gets no network unless you approve it. A plugin is an MCP server run under the operating system’s sandbox.
• Some things never leave the device. Permissions, approvals and the audit log don’t sync, even between your own machines.
• Talk about the work, not the machinery. The copy talks about teammates doing work, not about latency or uptime. No emoji as icons, nothing heavier than medium weight, mono labels in capitals, and separation by borders, never shadows.
• Rebuilt the engine underneath. Transistor started as an interface over OpenClaw, an open-source agent, and can still import its memories, skills and scheduled tasks. In October I deleted that layer and moved the agent into Transistor’s own Rust runtime, with signed updates, the sync engine, sandboxed plugins and an audit trail arriving in the same week.

How it’s built

It’s a Tauri 2 app. A Rust core runs the agent loop, tool calls, approvals, memory and sync in-process, under a React and TypeScript interface. Conversations, memory and skills live in one SQLite file, with sqlite-vec for vector search and embeddings computed on the device. MCP servers join the same dispatch path, so they pass the same firewall, and outside agents like Claude Code can search your memory through Transistor’s own MCP server, with every write they ask for waiting on your approval.

Sync is a change log merged last-writer-wins over Noise-encrypted connections, found on the local network or through a small self-hostable relay that only ever sees ciphertext.

Where the AI stops

I keep the known limits next to the features. Approval keys on tool names, so it stops agent mistakes, not a hostile server that names a destructive tool get_all_files. A malicious or compromised MCP server is the biggest risk left, and hardening against it is first on the security roadmap.

Timeline

• 22 March 2026. First commit, with a voice agent and system-wide shortcuts within the week.
• Late March. Cassette, a meeting notepad inside the OS.
• April. The marketing site and waitlist, the docs, and a full onboarding: a team builder, connectors and approval gates.
• 2 October. The native runtime replaces OpenClaw, with signed updates, sync, sandboxed plugins and an audit trail.
• 3–5 October. The app platform, an MCP server for outside agents, private memories, a signed app registry and on-device vector search.

Where it is now

Transistor is in development at v0.1 on the Mac, with signed updates that install only after you confirm, on stable and beta channels. Desktop-to-desktop pairing and sync work. The phone side has a written protocol with test vectors, but no client yet, and plugin sandboxing on Windows and Linux isn’t built. The waitlist is at transistoros.com.