AI Shouldn't Live in a Chat Box: 53 Days of Onesist

1 Eating (Some of) My Own Words

I wrote:

An AI chatbot is a conversation partern, not a co-worker. I need AI that works on my files, not me working inside its chat.

I still believe that. But after a few weeks of using Onesist every day, one piece of friction wouldn't go away: I kept switching windows. The FSD was open in Onesist while the agent ran in a terminal next to it. Every time the agent finished writing output/erd/schema.dbml, I switched to Onesist to look at it, then back to the terminal to ask for a revision.

It was tool fatigue again, on a small scale, and this time I had built it myselft.

So in v.0.1.45 Onesist got a per-project Chat

The agent reads and writes files in the project folder. Nothing gets pasted in.
File changes can be undone per turn.
After writing an artifact, the agents calls Onesist's own import endpoints (tasks/import, rtm/import/apply), so the Tasks and RTM tabs update too. Those calls show up in the transcript. Nothing writes to the database behind your back.

The first version of the chat used bring-your-own-key providers through the Vercel AI SDK (23 presets, your own key, stored on your machine). But a lot of system analysts, me included, already pay for a coding-agent CLI. Paying twice for the same thing makes no sense.

The most interesting part is the part you don't see. The five CLIs speak five different protocols: an HTTP server, an SDK, JSON-RPC over stdio, one process per turn, and an RPC mode with line-delimited JSON. If those differences leaked into the chat code, it would be full of if (agent === "codex"). Instead, every CLI sits behind one interface, CliRuntime, with probe, listModels, startTurn, and capabilities. Adding a sixth CLI means adding one runtime, not combing through the app.

Permissions were the hardest part. Claude Code has a callback. Codex sends approval requests over JSON-RPC. Antigravity, when headless, can't ask at all. Pi has no permission gate whatsoever. Next post shows how each one maps onto the same approval card in the chat.

One rule holds for all of them: Onesist never writes to the user's CLI configuration. If you uninstall Onesist tomorrow, your Claude Code or Pi setup is exactly as you left in.

Switching agents mid-thread. A native provider re-reads the stored history every turn. A CLI keeps its own session. So Onesist records how far each CLI session has "seen" the thread, and on each turn decides whether to start fresh, reuse the session, hand over the history, or send only the delta. The handover is a slice of the real transcript, capped at 16k, never an LLM summary.
Fork and merge back. As in Git, a thread can branch from any message. Opencode sessions fork natively. When the branch is done, its work come back to the parent as one framed message.
A Workspace per thread. A thread can work in the project root, in a repo under input/code/<repo>, or in a new Git worktree, so two threads can try two ERD designs on two branches without overwriting each other.

Outward: Onesist runs an MCP server with five onesist_* tools that are read-only by design. An outside agent's permission prompt is not Onesist's approval flow, so if Claude Code in your terminal wants to read your tasks or RTM, it can. If it wants to change them, that has to go through Onesist.

Inward (v0.4.2): Settings -> MCP now has presets for Github, Figma, Miro, Monday and Custom. That fits a system analyst's week well: designs in Figma, flows in Miro, tasks in Monday, code on Github. The agent can read all of them without copy-pasting.

The next post is mostly about the security decisions: credentials are only written when you press Save, Github goes through the gh CLI because it doesn't support dynamic OAuth client registration, and there's an SSRF guard that resolves hostnames and follows redirects by hand.

A system analyst rarely looks at just one document. Onesist now has split view, and since v0.4.0 a tab can open in its own desktop window (up to five), for example the ERD on a second monitor.

That created a new problem: two windows editing the same document. The answer is one writer per document. A server-side lock belongs to whichever window claimed it first, and is released automatically when taht window's last SSE stream closes, so a crashed windows can never hold a document hostage. The code is in the next post.

Quitting on macOS took 123 seconds. The terminate path sent an event to a WebView that macOS was already tearing down. Now it takes 0.48 seconds.
A hidden WebView leaked up to 80 GB. Close-to-tray hid the window instead of closing it, and the hidden windows kept rendering. There are now memory watchdogs on both processes.
no such table after zipping data.db. The migration journal claimed tables the file didn't have. A schema guard now replays idempotent DDL, at a cost of 0.5 ms on a healthy DB.
A dead keyboard in the Windows terminal. node-pty's ConPTY input needs something Bun doesn't support, so on Windows the terminal server runs under Node.
A path traversal in an internal write whitelist. task/../../../chat/threads/<id> go through, and it really did delete a chat thread when I tested it.

Every one of these is now a "Do / Don't" rule in the repo's AGENTS.md, so the agents working on this codebase don't repeat them. The next post has the full stories.

Most development happens on macOS. The Windows path is not tested as thoroughly, and several release notes say so explicitly.
macOS bundles are ad-hoc signed. There's no Developer ID or notarization yet, so the first install still needs "Open Anyway".
DOCX export doesn't include images yet.
Claude Code's subagent messages aren't shown in the transcript yet, and Antigravity and Codex don't get Onesist's MCP tools yet.

Keep the principle, change the implementation. "AI lives in files" is still right. Assuming that meant "no chat" was the mistake.
Contract first, integrations second. CliRuntime made the fifth CLI as easy as the second. Without it, every new agent would have added debt.
Don't touch what belongs to the user. CLI configs, Git branches and tokens are only written when the user presses Save. That kin of trust costs more to rebuild than any feature.
Production bugs are the best documentation. Each bug above is now one line of rules, read by humas and agents alike.

I Said AI Shouldn't Live in a Chat Box. 53 Days Later, Onesist Has a Chat. Here's Why

1 Eating (Some of) My Own Words

2 Not One Agent: One Contract

3 Threads That Move, Branch, and Get Their Own Workspace

4 MCP, Both Ways

5 Split View and Separate Windows

6 The Bugs That Taught the Most

7 What Isn't Done (I'll Say It Myself)

8 Lessons After 12 Releases

Try it