Developer shares lessons from building Ghost, a macOS agent harness with 78 tools and deterministic routing

Tunashavetoes · reddit · 2026-08-13

The author shares their experience building Ghost, a native macOS AI workspace (v2.1.0, notarized) that can be summoned with ⌥Space and supports chat, RAG, Mac automation, coding-agent work, calendar, messaging, and timers. Key design decisions include:

Deterministic routing over LLM intent classification: Commands vs. agents are distinguished using prefix rules (! and >) to avoid model misclassification.
The model never touches the filesystem directly: All file operations go through Swift code that normalizes paths and checks permissions, reducing injection risk.
Verification, not trust, for side effects: Writes are confirmed against the actual filesystem; unconfirmed writes are treated as errors.
Risk tiers and approval modes: 78 tools are classified into low/medium/high/blocked tiers, with three approval modes: Ask, Safe, Auto-run.
Weak local models get a harness too: Local models are probed on first launch; those without native function calling use a managed tool loop.
Egress is guarded as hard as ingress: Localhost, private IPs, etc. are blocked to prevent SSRF.

The author also discusses the tradeoff of choosing per-tier approval modes over per-folder/per-app permission matrices and asks for feedback. Tech stack: SwiftUI/AppKit, SQLite+FTS5, 8 providers + BYO Claude Code/Codex.

Original post →

Developer shares lessons from building Ghost, a macOS agent harness with 78 tools and deterministic routing

More from coding & agent