Apache Maka
A local-first agent workspace that performs project work while preserving recoverable execution records.
The sources clearly document an ask-by-default permission policy, confirmation for dangerous tools, renderer isolation, local data flows, credential masking, backup/restore, and third-party attribution. Deductions apply because tools still run in-process with the user's full OS-account authority and the permission engine is explicitly only a heuristic safety net; credentials are stored as plaintext JSON; network/model calls can cause external effects; and reconciliation of indeterminate tool side effects is not implemented. Dependency controls include lockfile installation, commit-pinned CI actions, production auditing, and notice checks, but the supplied files do not establish continuous vulnerability remediation or the condition of every transitive dependency.
The README, security policy, package scripts, and CI workflows are strongly consistent about architecture, permissions, testing, and releases. npm ci plus explicit build, type-check, workspace-test, sandbox-smoke, and release-check paths adequately support dependency availability. Deductions reflect reliance on external model services, Electron, ripgrep, bubblewrap, and OS facilities, with supported desktop releases limited to macOS Apple Silicon. Error classification, provider-error normalization, and fail-closed WebSearch messages are documented, but comprehensive actionable messaging across every tool, recovery, and installation path is not shown.
Desktop, TUI, non-interactive CLI, and evaluation scenarios have clear audiences and purposes, while cloud APIs, local models, and compatible gateways are supported. Capability boundaries are unusually explicit, including the lack of default process/container isolation, omitted Computer Use, preview-only Windows support, and opt-in continuation. Trigger precision is deducted because it is supported mainly by descriptions of permission tables, dynamic availability, and privacy gates rather than the complete policy inventory or false-trigger analysis. Environment fit is limited by formal macOS arm64 support, a recent Node requirement, and additional system tools.
The material supplies an architecture map, repository layout, documentation authority paths, installation instructions, command examples, a security contact, and detailed limitations. The full Apache-2.0 license, NOTICE direction, and third-party attribution are present. Deductions apply because the project explicitly warns that formats, CLI commands, and experimental features may change; examples are useful but no actual FAQ is supplied; and only a package version and security-support statement are shown, without a standalone changelog, compatibility policy, or migration history. Maintenance channels are identifiable, but publisher identity is unverified and older releases are explicitly not actively maintained.
The product combines conversations, tool calls, permission decisions, termination facts, recovery, branching, artifacts, and evaluation results into usable desktop and terminal workflows, offering substantial value beyond a basic chat interface. Cost-benefit is deducted because users must supply model access, continuation can consume tokens, and setup requires a recent Node runtime plus platform dependencies. Usage and attributable-cost accounting are described, but no resource-overhead measurements or outcome benchmarks are supplied.
Core claims trace to named architecture elements, storage locations, policies, tests, scripts, and CI steps, with strong corroboration across the README, SECURITY.md, package.json, and both workflows. The sources carefully distinguish implemented facts, commitments, heuristics, and limitations—for example, stating that permissions and redaction are not containment and identifying missing side-effect reconciliation, platform constraints, and intentional migration data loss. The static evidence therefore fully supports these three criteria.
- Tools run with the current OS user's authority and no product-wired process or container sandbox by default; do not run untrusted tasks from an administrator account or an overly privileged environment containing valuable credentials.
- API, OAuth, proxy, and search credentials are stored in permission-restricted but plaintext local JSON; rely on disk encryption, strict account isolation, and dependable backups.
- Upgrades do not migrate conversations that exist only in legacy transcripts or import legacy safeStorage credentials; back up first and expect to re-authenticate.
- Indeterminate tool side effects are parked rather than reconciled automatically; verify external state before retrying operations that may write data, incur costs, or make network changes.
- The project is still an early release: formal desktop support is limited to macOS Apple Silicon, Windows is an unsigned preview, and Intel macOS and Linux packages are unsupported.
What does this agent do, and when should you use it?
Apache Maka (Incubating) is a local-first agent workspace delivered through an Electron desktop app, terminal TUI, non-interactive CLI, and evaluation system. Every Maka surface executes through Runtime Host, which owns sessions, turns, agent lifecycles, tools, permissions, continuation, and events. Model messages, tool calls, tool results, permission decisions, and termination facts enter an append-only Runtime Event Log that drives session, UI, context, and recovery projections. The runtime provides local Read, Write, Edit, Bash, Glob, and Grep tools alongside streaming, context compaction, result pruning, startup recovery, and usage accounting. Workspace records remain on the user's machine by default, while model access can come from a cloud API, local model, or compatible gateway; the supported desktop release is currently limited to Apple Silicon Macs.
A task submitted through Desktop, the maka TUI, or maka run becomes a Session, Turn, and AgentRun managed by Runtime Host. Runtime calls the configured model connection, validates tool inputs, and can invoke Read, Write, Edit, Bash, Glob, and Grep under a permission policy; watchdogs, abort handling, and error classification constrain execution. Model messages, Tool Calls, Tool Results, and termination facts are appended to Runtime Event Log, from which Maka derives model context, session views, Turn Evidence, and recovery state. Desktop adds session creation, archiving, search, rename, retry, regeneration, turn-based branching, Artifact previews, and tool timelines. For experiments, maka eval run <spec> --out <directory> expands task × repetition × subject cells, retains immutable attempts, and produces score, normalized usage, attributable cost, duration, status, failure reason, and Artifact records.
- A developer working in a local repository can let Maka inspect files, search code, edit content, and run shell commands while retaining control over sensitive operations.
- An engineer who needs a scriptable single-turn workflow can invoke
maka runfrom a source checkout and capture the final response without using the desktop UI. - A maintainer coordinating independent implementation slices can use
--graphin a clean Git worktree, with implementation operators isolated in separate worktrees. - A team that needs auditable execution can retain append-only runtime facts, AgentRun ledgers, Turn Evidence, verified backups, and startup recovery state.
- An evaluation researcher can define multi-arm experiments across Maka and external subjects and collect consistent cost, duration, status, failure, score, and Artifact results.
- A privacy-conscious user can keep sessions and run records local by default while choosing a cloud API, local model, or compatible gateway.
What are this agent's strengths and limitations?
- The append-only Runtime Event Log preserves model messages, tool activity, results, and termination facts as an auditable execution record that also supports recovery.
- Desktop, TUI, non-interactive CLI, and Maka evaluation subjects share Runtime Host, giving the available interfaces one execution authority.
- Local-first storage combines with user-selected cloud APIs, local models, or compatible gateways instead of requiring one model provider.
- Tool schema validation, dynamic availability, permission policy, watchdogs, abort support, and error classification provide concrete controls around local execution.
- The evaluation subsystem supports declarative multi-arm experiments, immutable attempts, and a compact set of comparable usage, cost, duration, failure, score, and Artifact results.
- The project is under active development, and its data formats, CLI commands, and experimental capabilities may change.
- The supported desktop release is limited to Apple Silicon Macs; Windows x64 is an unsigned preview, while Intel Mac and Linux packages are unsupported.
- Maka includes no shared model account, so adopters must supply and maintain an API, local model, or compatible gateway and bear any provider costs.
- API and OAuth material, request headers, web-search keys, and proxy passwords are stored as local plaintext in
credential-vault.json, relying on the OS account boundary and enforced file permissions. - The current storage generation does not import earlier File/JSONL conversation authorities or old and safeStorage-encrypted credentials, creating upgrade and reauthentication risk.
- Phase 3 reconciliation for indeterminate tool side effects is not implemented; ambiguous outcomes are parked rather than retried.
How do you install or deploy this agent?
Running from source requires Node.js 22.19 or newer, npm, Git, and ripgrep; CI uses Node.js 24 and the current packageManager is npm 11. Run:
git clone https://github.com/apache/maka.git
cd maka
npm ci
npm run devnpm run dev starts the desktop development environment with HMR; use npm run dev:full to build every workspace first. If dependencies were installed with ELECTRON_SKIP_BINARY_DOWNLOAD=1, run node node_modules/electron/install.js before starting. Apple Silicon Mac users can instead download the signed and notarized Maka-<version>-mac-arm64.dmg from GitHub Releases, move Maka to Applications, and install ripgrep with brew install ripgrep. Windows x64 remains an unsigned preview; Intel Mac, Linux, and supported-tier Windows packages are not currently available.
How do you use this agent?
On first launch, open Settings → Models, add an API, local-model, or supported account connection, test it, and select a default model before starting a task; Maka does not bundle a shared model account. For terminal use from source, first run npm run build. Start the TUI with npm run cli:dev. Run one turn with npm run cli:dev -- run "Summarize this repository and identify its most important risk". Run a Graph task with npm run cli:dev -- run --graph "Implement two independent slices, integrate them, then review the result"; Graph implementation operators require a clean Git worktree because they use isolated worktrees. Execute an evaluation with maka eval run <spec> --out <directory>. Safe-boundary continuation is opt-in: setting MAKA_RUNTIME_SAFE_BOUNDARY_RESUME=1 enables Desktop Safe resume, CLI/TUI /resume, and desktop startup auto-resume, which may contact the model provider and consume tokens.
FAQ
Does Maka include a model account or usage allowance?
Can the agent modify files or execute commands without controls?
Where is workspace data stored?
userData in workspaces/default/. Operational state resides primarily in runtime.sqlite, Artifact payloads remain under artifacts/, and connections, credentials, and settings use separate configuration files.Will an interrupted turn resume automatically?
MAKA_RUNTIME_SAFE_BOUNDARY_RESUME=1 enables Safe resume, /resume, and desktop startup auto-resume. These paths may call the configured model and consume tokens, while ambiguous tool side effects remain parked.