Each component installs independently, so a machine carries only what it uses. Every release is built and signed offline, and the installer verifies each download against its sha256 checksum before anything runs. The checksums are published on every build below and on the checksums page.
AI assistantRead https://quantumencoding.io/baton-skill.md and follow it to set up baton on this machine.
Every download is checked against its sha256 and the publisher's signature before anything
runs, and the key is pinned so later installs are verified the same way. Checksums are on the checksums page; the
machine-readable manifest, signatures included, is at /api/releases.
Everything else, added any time
The installer above carries the core and can add any of these. So can baton update install <name>, later, on any machine —
nothing here has to be decided now.
agent
module
baton-agent
Delegate to the engine you choose.
Hand work to the engine you name: Claude Code, Gemini, GLM, Z.ai, a local model, or the qai CLI, the fleet's own agent, which runs on the Quantum AI backend as a service or on your own endpoint and key. run takes a prompt and returns the answer; work <id> claims a filed work item, works it end to end, and closes it with evidence or hands it back. Headless runs never stall on a hidden prompt: an action needing approval parks and resumes on your verdict.
A drop-in rm that moves files to the OS trash instead of destroying them, with the flags rm takes so nothing in a script has to change. It exists because an agent with a shell is one bad glob away from an unrecoverable afternoon, and the difference between a scare and a disaster is whether the file is still somewhere. Also on crates.io: cargo install ai-trash.
Speech to text, text to speech, OCR that returns reading-order lines and tables from images and PDFs, and ask, the on-device Foundation Models LLM, with guided JSON output via --schema. All of it runs on the Neural Engine: no network, no key, no per-token bill. The transcription half of the video-comprehension pipeline, and the cheapest OCR you will ever run.
Checks your project's dependencies against the OSV.dev vulnerability database (npm, crates.io, Go, PyPI and Packagist) and tells you what to fix. Findings are ranked by whether they can actually hurt you: production dependencies keep full severity, dev-only tools are downgraded, and deep transitive noise is grouped so the report stays readable. One repo, or every repo you have.
Scans your production website for issues (speed, SEO, accessibility, security headers, cookie and GDPR behaviour) and writes the findings into a scored, branded PDF report. It uses a real browser and real Lighthouse, so the numbers match what your visitors and Google actually see. Fix, redeploy, scan again: the before/after is two commands.
Programmatic access to Alibaba Cloud: accounts maps configured identities to their key bindings and surfaces aliyun-CLI profiles not yet mapped, status answers whether credentials are present and hosts reachable, models lists what a host serves, and chat runs a completion through an account's host. Credentials are reported by source and length, never by value.
Read the AI Conductor app's agent transcripts from the terminal: list conversations newest-first, search text across every message with role and project filters, show one transcript in order. Roles are user, assistant, thinking and tool, so you can search what the model THOUGHT and not only what it said. --project matches the chat's working directory, which is how you scope a search to one repo.
The always-working centre: the baton CLI plus the batond daemon, same verbs on macOS, Linux and Windows. A shared ledger for goals and todos, per-repo knowledge in plain markdown, federation between machines over SSH, and cron entries that compile to launchd, systemd timers or Task Scheduler. Nothing polls: the daemon blocks on filesystem events and wakes when there is work. Core runs with zero other components installed.
Machine integration: git-activity installs a post-commit recorder that marks when a repo was last worked, across one repo or every repo under a directory, and backfills the marker so history is not lost. The markers are what the fleet reads to answer which projects are live, without polling a disk full of git directories.
An always-on MCP server, about 4 MB resident, that exposes the fleet to any MCP client: claude.ai on web or phone, Claude Desktop, Claude Code. Forty-eight tools, each a thin shell over a CLI verb that already works from the terminal. Work queue, project knowledge, repo reads, the vault, media generation, messaging doors, GUI control, the last gated by mac-drive's Touch ID grant, below the protocol where no client can reach it.
An agent driving your desktop is mechanically a remote-access tool. What separates a legitimate one from malware is not the code, it is that the person whose machine it is can SEE it happening. This is that seeing: a small window saying whether someone is at the controls, and below it every action they take in plain words. It reads the activity log and does nothing else, with no network and no way to act, so the face cannot lie about the hands.
The macOS front door: one notarized .pkg, stapled so it installs on a laptop with no network, carrying the whole payload with every binary inside signed and timestamped. Core is required and lands on the default PATH; every module is a tick-box in the Customize pane you can change later. The curl one-liner stays for scripts and CI. macOS 14+, Apple silicon.
The control deck: file and launch goals, generate media, read and send fleet messages, edit options, install components. Deliberately a separate binary from baton-hud, which is the witness and must be able to prove it cannot act. Every button is one baton invocation run off the UI thread, the same CLI contract everything else drives, so the window can never do something the command line cannot.
Qwen cloud media generation, bring-your-own-key only: no gateway in the middle and no fallback lane that could bill you by surprise. DASHSCOPE_API_KEY alone is enough; the biometric secrets vault and the fleet's account map are enrichment, never requirements. Every route is a published row you can print with models, async submissions print the exact command to resume them, and keys are reported by provenance and never printed.
The signed Windows installer: one Authenticode-signed executable (subject QUANTUM ENCODING LTD, verified by Windows itself before it runs) carrying the whole payload, every binary inside individually signed and timestamped. It extracts, runs the tested installer while you watch, and holds the window open until you have seen the outcome. The front door for people; the irm one-liner stays for scripts and CI.
The gated order path to Alpaca. The agent running a strategy does not hold order tools at all: its toolset is scoped to data-only families, so placing, replacing, cancelling and closing are absent from what it can call. The single remaining write path is this module, and every route through it passes an approval gate first, enforced by the type system rather than by policy: the approval token cannot be constructed outside the gate, and submit requires one.
Map a program onto its module graph and hold the code to the blueprint it declared: validate the graph, compute dependency-ordered build waves (artifact edges are barriers, contract edges impose no ordering), and flag duplication and incomplete ports. baton's own workspace is built and checked from a blueprint.json this module validates.
Vault capture without an app: note writes a thought, clip turns a URL into a note, search/read/list get it back, reindex and doctor keep it honest. Writes ~/.baton/vault directly: markdown files ARE the database, so any editor, any sync tool and any future you can read it. Secrets are redacted inside the writer, before a byte lands on disk.
Chrome or Brave over CDP: your actual session, with its cookies, logins and fingerprint, which is what separates a page that renders from a bot-wall. open, extract, eval, click, type, screenshot, network, emulate, scrape, and more. Every command passes a deny, sensitive, approve, audit perimeter, so an agent can read a rendered page without inheriting the keys to your bank tab.
Where session memory becomes structure: turn-end notes minable by project and time, fact and decision as first-class records, and hydrate to assemble a context brief from all of it. That brief is what a fresh session reads instead of re-deriving the last one's conclusions. Speaks --json/--ndjson for anything downstream.
Telegram, WhatsApp, DingTalk, Lark and WeCom, one posture everywhere: each bridge sends as the fleet and drains inbound from an allowlist where empty means nobody. recent shows everything the door heard; inbox emits only allowlisted senders. The gap between the two is the security model. WhatsApp picks Twilio, Meta Cloud or your own paired number; Telegram allowlists numeric user ids only; DingTalk connects outbound so it needs no inbound tunnel.
The pass-through to whichever drive backend this OS has: baton drive <anything> hands the arguments verbatim to mac-drive, lin-drive or win-drive, locally or on a peer with --node. baton holds no model of the verbs: it probes for a binary and gets out of the way, so a new backend capability needs no baton release. doctor reports what is installed and operable.
The CLI face of the Cosmic Duck video suite: render turns a storyboard JSON into a finished narrated mp4 (--draft for a fast pass), compose builds clip timelines, edit trims and overlays, plus stitch, image/video/music/tts generation and a gallery. Each verb routes to whichever app is running (studio or editor), or --app forces one.
Google Analytics 4 without the dashboard: accounts, report, pages, sources, events, realtime, or a raw run query. Everything is a read; nothing mutates. Identities live in ~/.baton/config/ga.json: each account alias can impersonate a service account via short-lived gcloud tokens, scope analytics.readonly, no key files on disk, tokens held in memory and never logged.
Telegram, WhatsApp, DingTalk, Lark and WeCom, one posture everywhere: each bridge sends as the fleet and drains inbound from an allowlist where empty means nobody. recent shows everything the door heard; inbox emits only allowlisted senders. The gap between the two is the security model. WhatsApp picks Twilio, Meta Cloud or your own paired number; Telegram allowlists numeric user ids only; DingTalk connects outbound so it needs no inbound tunnel.
The Linux sibling, same JSON contract, so app profiles and orchestration port unchanged. It perceives over AT-SPI, captures through the ScreenCast portal, and acts two ways: element-first over D-Bus, with no pointer to aim and no focus to steal (the sturdy default on Wayland), or humanized synthetic input through kernel uinput for targets AT-SPI cannot see. Drives Chromium browsers over CDP; manages windows through a bundled GNOME Shell extension.
JSON-driven perceive-and-act automation for native macOS apps: read the accessibility tree, snapshot elements to stable refs, click, type, and run a whole flow in one invocation. Input is humanized, down to glide paths and typing rhythm. Acts sit behind a Secure-Enclave arm grant (the first act fires Touch ID on the physical machine) and the operator always gets a countdown card with live Pause and Cancel.
The MCP door between claude.ai and your machine: the AI in the browser tab files goals on YOUR computer and launches the agents that work them, browses through YOUR browser (the real rendered DOM, logins and all, not a bot-walled fetch) and generates media straight to your disk instead of you ferrying prompts and downloads by hand. Works with anything that speaks MCP, over stdio or HTTP.
Cloud media generation as a verb: media new and edit for image, video, music and speech, ask for analysis, chat for iteration, and a gallery every result lands in. A prompt goes in, a local file path comes out. It is the generation backend the MCP hub's qai_generate tool shells to, so claude.ai and the terminal produce into the same gallery.
Search and ingest over pluggable knowledge backends, local-first: Joplin and SurrealDB out of the box, Vertex as a deliberate opt-in. $BATON_RAG_BACKENDS picks the default set per machine, so a laptop can answer from local notes while a build box adds the cloud index. Same verbs, different reach.
An embeddable, multi-provider agent engine: one streaming tool-use loop that runs a turn, executes tools, feeds the results back and continues until the model stops. Anthropic, OpenAI, Gemini, local models and self-hosted endpoints all reach it through wire adapters at the edge, so there is one loop rather than one per provider. Confirm-class tools park the turn in a staged-action ledger until a human decides, which is the prompt-injection firewall, and a headless caller can park rather than block. Prompt in, text out.
An encrypted vault (AES-256-GCM, PBKDF2) that asks for Touch ID at the moment of read, not at login. Store a key once; then scoped injection with secrets exec, per-agent grants, TTL leases that self-destruct, and a session broker decide who reads what, and when. Every baton flow above fetches its keys from here. Install: cargo install secrets-vault.
File transfer with the peer host over ztransfer: push, pull, ls, dir, peer. Small on purpose: no sync daemon, no conflict model, just get this file to that machine as a fleet verb, over the same SSH relationships federation already trusts.
Telegram, WhatsApp, DingTalk, Lark and WeCom, one posture everywhere: each bridge sends as the fleet and drains inbound from an allowlist where empty means nobody. recent shows everything the door heard; inbox emits only allowlisted senders. The gap between the two is the security model. WhatsApp picks Twilio, Meta Cloud or your own paired number; Telegram allowlists numeric user ids only; DingTalk connects outbound so it needs no inbound tunnel.
Web search as a composable verb: baton web "query" for ranked results, ask for an AI answer, context for LLM-sized grounding chunks, clip to file a page into Joplin. -n and --json throughout. The difference from a browser tab is that the output is data: an agent or a script consumes it without a scrape.
Telegram, WhatsApp, DingTalk, Lark and WeCom, one posture everywhere: each bridge sends as the fleet and drains inbound from an allowlist where empty means nobody. recent shows everything the door heard; inbox emits only allowlisted senders. The gap between the two is the security model. WhatsApp picks Twilio, Meta Cloud or your own paired number; Telegram allowlists numeric user ids only; DingTalk connects outbound so it needs no inbound tunnel.
Telegram, WhatsApp, DingTalk, Lark and WeCom, one posture everywhere: each bridge sends as the fleet and drains inbound from an allowlist where empty means nobody. recent shows everything the door heard; inbox emits only allowlisted senders. The gap between the two is the security model. WhatsApp picks Twilio, Meta Cloud or your own paired number; Telegram allowlists numeric user ids only; DingTalk connects outbound so it needs no inbound tunnel.
YouTube ingestion for the video-comprehension pipeline: grab audio or video, then brief builds an on-device transcript (Apple STT, no API bill) with an optional contact sheet and OCR timeline, enough for an agent to answer what a video says and shows without a model that can watch. Everything caches per video, so a second question about the same video is free.
