Zyquo Agent
The autonomous agent that actually operates your Mac
A native macOS agent that plans, runs real bash and AppleScript, verifies its own work — and always asks before anything risky.
77/80
models tool-calling verified live
8/8
safety tests passed
11/11
end-to-end scenarios passed
38
PolicyEngine self-check assertions
12
providers, 170 models
~19,000
lines of Swift, 82 files
Overview
Zyquo Agent turns cloud LLMs into an agent that does things on your Mac: it runs bash commands, drives apps with AppleScript, reads and writes files, and keeps iterating until a task is genuinely done. It is not a chat window with a shell attached — it is a real plan → act → observe → reflect loop with a live, editable checklist.
Safety is the headline feature. Every action passes a PolicyEngine gate that parses commands rather than pattern-matching them, splitting compound lines and classifying each subcommand. Hard denies block catastrophic commands outright; an always-ask class — sudo, out-of-workspace deletes, curl-pipe-to-shell — requires approval in every mode, including Autonomous. An append-only audit log records everything.
Everything is measured, not claimed: 77 of 80 agent-capable models pass a live tool-calling battery, 11 of 11 end-to-end scenarios pass in real workspaces, 8 of 8 safety tests pass, and the PolicyEngine self-check runs 38 assertions. The app is roughly 19,000 lines of Swift across 82 files, built without the Xcode IDE.
Key Features
True agentic loop
A stop_reason-keyed while-loop streams a model turn, executes its tool calls, threads results back, and repeats — handling truncation, refusals, and transient errors.
Policy gate on every action
Commands are parsed, not pattern-matched: compound lines split per subcommand and the verdict is the most severe — ls && rm -rf still asks.
Live editable plan
The agent maintains a real checklist through an internal update_plan tool, persisted to disk, rendered live, and editable by you mid-run.
Real tools, streamed live
bash, AppleScript, and five file tools with line-by-line stdout/stderr streaming, timeouts, exit codes, and full cancellability — even partial tool arguments stream.
LoopGuard budgets
Step, token, and wall-clock budgets plus repetition and stall detection — on a trip it pauses and asks you, never silently spins or aborts.
Memory and context compaction
At 85% of context, older steps are summarized by the same model while the plan, MEMORY.md, and the last 6 steps stay verbatim; large outputs offload to disk.
Scoped workspaces
Every task gets its own directory; file tools are scoped there by default and escaping requires explicit approval, with created and modified files tracked.
Append-only audit log
Every executed action recorded with timestamp, exact payload, cwd, policy ruling, exit code, and output — viewable in-app and exportable.
Headless CLI mode
The app binary doubles as a CLI for scripting and CI: run tasks headlessly with live rendering, stdin approvals, and policy self-checks.
How It Works
AgentLoop
A Swift actor running the plan → act → observe → reflect cycle: stream a turn, execute tool calls, thread results back, repeat until the model answers without tools.
PolicyEngine and ExecutionService
Shell execution never leaks into views — everything goes through ExecutionService and passes PolicyEngine first, evaluating deny → ask → allow per parsed subcommand.
Tool layer
Eight tools behind a Tool protocol (name, description, JSON-Schema parameters, execute) registered in a ToolRegistry — adding a tool is deliberately trivial.
MemoryManager
Live token accounting calibrated by provider usage numbers, compaction at 85% of context with a thrash guard, output offloading over 8 KB, and an agent-owned MEMORY.md.
Provider layer
A native AnthropicClient and one OpenAICompatibleClient normalized behind a single ProviderClient protocol, so the agent loop never sees a wire format.
Event-driven UI
The command-center interface renders exclusively from an AgentEvent stream and the persisted Transcript — step cards, plan panel, live terminal feed, and audit views.
Tech Stack
App
Agent Core
AI
Security
Quality
Highlights
- sudo is never run silently in any mode — proven by a test that forces a sudo tool call and confirms denial in all three safety modes
- Three safety modes (Manual, Guarded, Autonomous) with an always-ask circuit-breaker class that no mode and no remembered rule can override
- 77 of 80 agent-capable models verified live for streamed tool calling; the 3 failures are external and documented
- Found and fixed real provider quirks: Gemini thought-signature round-tripping and OpenAI reasoning_effort downgrading with tools
- A task that triggered 4 context compactions still produced a fully correct result, verified live
- Design traced to a 413-line research document citing 79 sources; built entirely without the Xcode IDE
Explore Zyquo Agent
Autonomous agent for the Mac — the full source is on GitHub.