OpenInstinct

How it works

Your phone talks to your Mac. That's the whole architecture.

The phone side is the Messages app you already have — no bot to add, no app to install, works from the lock screen. The Mac side is where the agent, its memory, its browser sessions, and your credentials live.

Your iPhone sends iMessage to Messages.app on your Mac, which the openinstinctd daemon reads and replies through; the daemon holds one long agent session with memory, a browser, and scheduled watches, and calls your own AI account.

Setup

One command. The menu bar does the rest, live.

The install command copies files and gets out of the way. Everything else is a checklist in the menu bar that watches its own state — each step turns green on its own as you finish it, and it refuses to run if something would go wrong.

Setup steps: an Apple ID for Gajae, who you are, Gajae's iMessage account, Full Disk Access, Automation, AI account, then text it.

The setup checklist showing an orange warning: Messages on this Mac is signed in as you. — It refuses to run on *your* Apple ID, and tells you which account it saw — so it can never reply inside your own conversations.

The setup checklist with every step green. — No terminal, no config files. The phone number, the permissions, the AI account — all from the menu bar.

The one thing to know: Gajae uses this Mac's Messages app as its own phone, so that app gets signed in with a separate, free Apple ID made for Gajae. Your iPhone and your own iMessage are untouched — you just stop using Messages on this Mac yourself.

What it does

Everything you'd ask a person who sits at your Mac.

Just text it

One long-running conversation, steered by every new message. Rapid texts fold into the turn already running; long answers arrive as separate messages. Typing indicator and read receipts when you're away from the Mac.

Send it pictures

Send a photo and it looks at it. When it takes a screenshot itself, you get the picture back.

Its own browser

A dedicated Chrome profile you sign into once. The browser tool is hard-pinned to it and can never open your personal Chrome or touch your cookies.

Background work

Anything slow — research, scraping, long browsing — runs as a child session. You get "on it", then the result, without the conversation blocking.

Scheduled watches

"Brief me at 9 every morning." "Tell me if this page changes." "Watch my DMs for 24 hours." Authored from chat, toggled from the menu bar. Failures get triaged by the agent instead of dumped on you.

It remembers

Every turn lands in a git-backed memory repo — daily notes rolled up into people, projects, and decisions — recalled on demand instead of stuffed into a context window.

The menu bar panel: awake and listening, a task in progress, and two scheduled tasks. — The menu bar in normal use: health in plain words, what it's working on, and every scheduled task with its next run.

Self-hosted, precisely

What actually leaves your Mac.

Thing	Where it lives
Your messages	Read from the Messages database on your Mac. Never uploaded anywhere but the model call for the turn you sent.
Memory	A git repository in your home folder. Yours to read, grep, back up, or delete.
Browser sessions, passwords	On disk, owner-only permissions. Secrets you text it are stored per-service and never echoed back.
Model calls	To whichever AI account you sign into — Claude, ChatGPT, an API key, or your own endpoint.
Telemetry	None. There is no server; there is no account with us.

System Integrity Protection stays on. The only permissions it asks for are Full Disk Access, to read incoming texts, and Automation, to send them. It answers exactly one phone number — yours — and drops everything else.

Install

Five minutes, once.

Make a free Apple ID for the agent. Any email. It needs a phone number for the verification code, but that phone does not become the agent's number.
Sign this Mac's Messages into it. Messages → Settings → iMessage → sign out → sign in with the new Apple ID.
Run the install command. Paste it into Terminal. It copies files into your home folder and opens the menu bar.
Follow the checklist. Your phone number, two macOS permissions, and your AI account. Each step verifies itself.
Text it. The panel shows the address to save in your contacts.

Building from source instead:

git clone https://github.com/Yeachan-Heo/openinstinct && cd openinstinct
bun install
bash scripts/install.sh

Full walkthrough in the user guide, internals in the architecture notes, operations in the runbook.

Why a command, not a download

It skips a wall Apple puts in front of unsigned apps.

macOS only inspects files that carry a com.apple.quarantine tag, and that tag is attached by the app that downloaded them — your browser. Anything fetched with curl is untagged, so Gatekeeper never assesses it and you never see "cannot be opened because the developer cannot be verified". This is the same reason Homebrew, rustup, and bun install the way they do.

The command downloads one .tar.gz, checks it against a published checksum, and extracts it. Downloading that same archive in a browser is equally fine: unpacking an archive and running a shell script is not a gated app launch, so there is no approval screen either way and nothing needs notarizing.

Prefer to read before you run? The install script is short, and it refuses to continue on a checksum mismatch.

Not for

Things it deliberately doesn't do.

Group chats. Voice. Multiple owners. Remote access from outside your Mac. Turning off System Integrity Protection. If you need an agent that anyone can message, this is the wrong shape — it is built to serve exactly one person.