{"slug": "qm", "title": "qm", "summary": "QM, a multiplayer agent harness for work in Slack and on the web, is designed for startups, allowing each employee to have an isolated workspace while collaborating in channels and projects. The core is vendor-neutral, supporting Pi, OpenCode, Codex, and Claude Code, and includes features like scoped memory, admin control, web apps, and background work. Security postures range from strict to dangerous, with an auto mode that screens external data.", "body_md": "A multiplayer agent harness for work. In Slack and on the web.\n\nMost agents are designed like personal assistants. You can make one work for a whole company, but it quickly gets complex. QM is designed for startups. Employees each get their own isolated workspace and work independently without affecting each other, and they can also collaborate with the agent in channels, group messages, and projects.\n\nEach person and each room has its own scoped memory, files, keychain view, permissions, crons, web apps, and durable sandbox.\n\nIt's built with open source in mind. Pick your own harness and model and switch between them — Pi, OpenCode, Codex, and Claude Code all drive the same core, so a deployment isn't tied to any single vendor.\n\n**Personal and shared scopes.** People customize the agent to be*theirs*, and still work with it collaboratively in Slack channels and projects.**Slack and web.** The same identity and configuration carries between Slack and the web app.**Admin control.** Set org-level configuration, a security posture, and which harnesses and models are available.**Web apps.** Spin up custom internal apps and publish them to the right people.**Shared skills.** Skills are scope-owned and shareable by grant, with admin-gated promotion to the whole org and skill packs imported from git repositories.**Background work.** Crons and watches run work while nobody's watching.\n\n- Search internal notes, email, documents, databases, and the web together\n- Retrieve information from your company brain\n- Build internal apps, publish them to the right people, and keep their data current\n- Learn your writing voice from past sends, then triage your inbox on a schedule — labels and reply drafts included\n- Work in an existing repository: run tests, open PRs, monitor CI, check system logs\n- Track a project in a shared channel and post updates and follow-ups\n\n```\nflowchart LR\n  DB[(\"Postgres<br/>sessions · memory · queue\")]\n\n  subgraph CORE[\"Headless core\"]\n    API[\"API · identity · policy · scheduler\"]\n    LOOP[\"Agent loop<br/>(Pi, OpenCode, Claude Code)\"]\n    API <--> LOOP\n  end\n\n  SBX[\"Per-scope sandbox<br/>files · tools · logged-in services\"]\n\n  DB <--> API\n  LOOP <--> SBX\n```\n\nEvery turn runs through a central core, which can use a variety of models and harnesses\nto generate the response. A Postgres persistence layer holds user data, session history,\nand other durable state. The agent has a small, fixed tool surface; one of those tools is\n`execute`\n\n, which runs commands in the scope's own isolated sandbox — its durable computer,\nwhere installed tools stay installed. The web UI, the admin panel, and the public portal\nare optional plugins over the core's HTTP API;\nSlack is an optional in-process plugin that core starts\nand supervises through a direct service client.\n\nThe core runs TypeScript directly on Node and uses Fastify for HTTP. The Slack plugin uses Bolt; the web UI builds with Vite and renders with Lit.\n\nThe core itself is generic. Everything specific to one company — org config, custom tools\nand skills, sandbox image, infrastructure — lives in a **deployment directory** that the\n[ qm CLI](/yc-software/qm/blob/main/cli/README.md) validates and deploys. Every substrate (harness, session\nstore, sandbox, memory) sits behind an interface, so production implementations swap in\nvia one wiring file.\n\nQM's approach follows local coding agents like OpenCode, Codex, and Claude Code: the agent acts as the person it's working for, with their credentials and permissions, and everything it does is audited. An org picks one security posture, which narrower scopes can only tighten:\n\n**Strict**— every harness tool call pauses for human approval, except the two no-effect turn enders.** Auto**(default) — a classifier screens provenance-labelled external data and tool results before they reach the model; a deployment can point that at its own screening proxy.**Dangerous**— no content screening, no pauses between tool calls.\n\nThe predeclared command policy — approval rules and hard denials for things like recursive deletes or destructive SQL — applies in every posture, Dangerous included.\n\n[ SECURITY.md](/yc-software/qm/blob/main/SECURITY.md) has the threat model, the operator assumptions, and the\nknown limitations.\n\nCreate an organization-owned deployment repository that depends on `@yc-software/qm`\n\n:\n\n```\nnpm exec --yes --package=@yc-software/qm@latest -- \\\n  qm init . --org <slug> --target <fly-or-aws>\nnpm install\n```\n\nInitialization materializes a deployment skill for an agent and walks through\ninfrastructure, web sign-in, connector credentials, optional Slack access, deployment,\nand live verification — no source checkout required. Each deployment runs in the\noperator's own cloud account; initialization does not generate or enable deployment CI,\nand this repository has no production deployment workflow. See\n[ deployment.md](/yc-software/qm/blob/main/deployment.md) for the details.\n\nWe take contributions as *human-written* text, not code — see\n[ CONTRIBUTING.md](/yc-software/qm/blob/main/CONTRIBUTING.md). Describe the change you'd like informally in a\n\n`.txt`\n\nor `.md`\n\nfile in [, and if we're aligned we'll handle the implementation. Report vulnerabilities privately — see](/yc-software/qm/blob/main/adrs)\n\n`adrs/`\n\n[, not a public issue.](/yc-software/qm/blob/main/SECURITY.md)\n\n`SECURITY.md`\n\nThe deployment repository above carries config and a sandbox layer, and never needs a\nsource checkout. Some organizations want the opposite trade: the whole codebase in one\nplace, so engineers and coding agents read core and customizations together, while the\ncustomizations themselves stay private. For that, keep a **private fork**: a standalone\nprivate repository whose history begins as a clone of qm and whose core stays identical\nto upstream.\n\nPopulate it once, then clone it to work in:\n\n```\ngh repo create <org>/qm-private --private\n\ngit clone --bare git@github.com:yc-software/qm qm-seed.git\ngit -C qm-seed.git push --mirror git@github.com:<org>/qm-private\nrm -rf qm-seed.git\n\ngit clone git@github.com:<org>/qm-private\ngit -C qm-private remote add upstream git@github.com:yc-software/qm\n```\n\nCreate the private fork with a plain clone, as shown above, and never with GitHub's fork feature. The word \"fork\" here names the concept — a downstream copy that diverges deliberately and merges from upstream — not GitHub's Fork button. A GitHub fork inherits the visibility of the repository it came from, so a fork of a public repository cannot be made private. A GitHub fork also shares one object network with the repository it came from, so commits pushed to the fork stay fetchable by SHA from the public side. Many organizations disallow forking private repositories as well. A plain clone has none of these problems, and it costs one thing: the clone is an ordinary repository, so upstream's CI workflows run live in your own account. Expect to supply the secrets those workflows need, or disable the ones you do not want running.\n\nEverything specific to your organization goes in `deploy/layers/<org>/`\n\n— config, sandbox\ntools and skills, plugin images, infrastructure — in the same shape `qm init`\n\nproduces. See\n[ deploy/layers/README.md](/yc-software/qm/blob/main/deploy/layers/README.md). Core stays byte-identical to\nupstream, which is what keeps merges small.\n\nTwo skills maintain the boundary in both directions. `update-qm`\n\nmerges upstream qm into\nthe private fork and opens the sync PR; `upstream-pr`\n\nsends an organization-agnostic fix back to\nqm, cutting the branch from `upstream/main`\n\nand checking the outgoing diff, commit\nmessages, and screenshots for organization identifiers before it pushes. Nothing under\n`deploy/layers/`\n\never travels upstream.\n\n— first run, end to end`docs/getting-started.md`\n\n— the`cli/README.md`\n\n`qm`\n\nCLI and the deployment directory contract— the deployment directory in full`docs/deploy-directory.md`\n\n— every knob, documented in place`.env.example`\n\n— the surfaces (Slack, web UI, admin, portal)`plugins/`\n\nExcept where otherwise noted, QM is available under the [MIT License](/yc-software/qm/blob/main/LICENSE).", "url": "https://wpnews.pro/news/qm", "canonical_source": "https://github.com/yc-software/qm", "published_at": "2026-07-31 18:04:58+00:00", "updated_at": "2026-07-31 18:22:49.567465+00:00", "lang": "en", "topics": ["ai-agents", "ai-products", "ai-tools", "ai-infrastructure"], "entities": ["QM", "Slack", "Pi", "OpenCode", "Codex", "Claude Code", "Postgres", "Fastify"], "alternates": {"html": "https://wpnews.pro/news/qm", "markdown": "https://wpnews.pro/news/qm.md", "text": "https://wpnews.pro/news/qm.txt", "jsonld": "https://wpnews.pro/news/qm.jsonld"}}