A local-first life-OS for macOS. A native cockpit that runs AI per life-domain (wealth, health, tax, career), grounded in a markdown vault on your machine. Any model. No terminal. Nothing leaves unless you say so.
Watch the 90-second demo · Star this repo if it is useful. It genuinely helps others find it.
One line: downloads the signed DMG, installs to /Applications, and launches.
curl -fsSL https://prevail.sh/install-mac | bashPrefer to click? Download the .dmg and drag Prevail.app to Applications. It is signed and notarized, so there is no Gatekeeper warning.
Download the installer and run it.
- It's yours. Your vault, chats, and the durable intent ledger stay on your machine. Local-first by default: nothing leaves until you turn on an integration.
- It learns you. Every message is captured as an intent the instant you send it (raw, never lost), then distilled into per-domain memory that's fed back into future chats. The more you use it, the sharper it gets.
- Grounded, not generic. Each life-domain answers from its own real state and history, not a blank slate every time.
- Any model, one cockpit. Installed CLIs (Claude · Codex · Antigravity · Ollama) or bring-your-own via the OpenRouter gateway: one key, 200+ models. Switch per turn; context carries across.
- Council. Fan one question to multiple models in parallel; a chair model synthesizes a single verdict.
- Private by default. Zero telemetry unless you explicitly opt in. Secrets live in the macOS Keychain.
- Agents, not just models. Validated harness runtimes (Hermes · Pi · OpenCode · OpenClaw) can now run work, not just chat. Each harness is invoked with its own real headless/agent flags (e.g. Hermes
-z --safe-mode), and every run is gated by the autonomy broker: safe (read-and-propose) by default, full agency only when you opt in.- Run with agent: on any Work-board task, hand it to a harness agent; it streams progress, then drops its result back as a comment and moves the task to Review.
- Loops on an agent: give any automation a per-loop executor so a recurring loop runs through the agent of your choice.
- Smarter runtime detection: Re-check now actually re-detects (a repaired install recovers without a restart), and the Runtimes list tells "won't run" (broken) apart from "not installed."
- Calmer sidebar: the benchmark/backup/process strips collapse into one Processes icon + modal; the Work/Editor switch goes full-width and the footer slims to Beta + a tiny theme toggle.
- Demo-first: launches into a pre-populated sample household (11 domains, realistic data). Explore freely, then switch to your own vault in one click.
- Starter packs: ready-made domain sets (Family · High-Income · Freelancer · Creator · Small Business · Student).
- Self-learning memory: raw intent ledger → distilled per-domain
_memory.md, always reusable. - Council & benchmarks: multi-model deliberation plus a built-in benchmark viewer.
- Gateway (Telegram), MCP (consume and expose), Providers, and a Remote WebUI: the same UI in a browser, loopback-bound + allowlisted, off by default.
- Quality of life: usage dashboard, in-app auto-update, start-on-boot, tray, export/import config.
| Domain-grounded chat | Every model, one cockpit |
|---|---|
|
 |
npm install
npm run tauri dev # hot-reload
npm run tauri build # signed .dmg under src-tauri/target/release/bundle/dmg/The engine sidecar is built from the sibling prevail-cli repo by scripts/prepare-sidecar.sh (wired into beforeBuildCommand), so the install is fully self-contained. Stack: Tauri 2 · React 19 · Tailwind 4; the frontend talks to the Rust backend only through src/bridge.ts. See CONTRIBUTING.md.
Secrets live in the Keychain; the WebUI is loopback-only + allowlisted when enabled. Telemetry is off by default: if you opt in, only an anonymous UUID and a fixed allowlist of event names are sent (never your name, paths, or vault content), and every event is mirrored to a local log you can read. See SECURITY.md.
GPL-3.0-only · © 2026 fru.dev. Free to use, study, share, and modify; redistributed forks stay open under the same license.