Marshal is an infinite canvas where your coding agents work together — and the first one you can share live, across machines and people, down to the phone in your pocket.
One agent was a tab. Five are a pile — alt-tab archaeology, lost context, no shared picture of who is doing what, or why. A canvas fixes that, and tools like Maestri proved people want one.
But the moment work is agentic, it is also remote. The agent hits a question at 11pm and you're on a train. A teammate could unblock it in seconds — from another machine, another OS, another city. Every canvas today stops at the edge of one machine.
Real PTYs, real processes, real output. Not a dashboard about your agents — the place they live.
A real PTY per node, running any CLI agent — Claude Code, Codex, Gemini, opencode, or a plain shell.
A shared scratchpad any agent can read and write with marshal note.
A kanban the agents move their own cards on, so the plan stays where the work is.
Pencil and eraser on the canvas. Connections route around obstacles instead of through them.
An embedded browser pane, sandboxed away from the OS, pinned beside the agent that needs it.
The overseer. Watches the swarm, verifies a real clash, and acts under a server-enforced autonomy mode.
Each terminal gets a marshal command on its PATH and a private line to a loopback server. One agent delegates to another by name — no API keys, no glue, no piping raw terminal output between processes. Connections gate who may talk.
Chief's autonomy mode is enforced on the server, keyed to its terminal id, never to its prompt. Flip it live — and an agent cannot argue its way around it.
Electron, not Mac-only. Every push builds and packages an installer on all three operating systems. The incumbents in this space are Mac-native. That is the whole reason this exists.
ConPTY
arm64 + x64
x64
Scan a code and your agent session opens on another device — live, over any network, on someone else's OS. This is the part nobody else has.
Send messages, answer the agent's multiple-choice prompts as tappable buttons, hit Ctrl-C, and spawn a new terminal that runs on the owner's machine. From a phone, on cellular.
On mobile a session opens as a readable conversation — turns and tool calls — instead of a cramped 80-column terminal mirror you have to pinch around.
Workspace → Floor → terminals, notes, browsers, boards. Two devices hold one workspace, each keeping its own floor. Multi-floor is landing now.
Sharing is consent-gated and off by default. Two factors guard every session — an unguessable link plus a pairing code you read aloud — and wrong codes lock the door. Permissions are enforced on the owner's device, not the viewer's. Stop sharing and every paired viewer is signed out at once. The OS of each floor is always visible, because a macOS command is not a Windows command.
Agent-activity monitoring surfaces risky actions as findings pinned to the exact node that caused them, with a forensic timeline per session.
Secret reads and unexpected network egress surface where they happened — not in a log you'll never open.
Every session keeps an ordered record of what the agent actually did, so a finding can be traced back to its cause.
Perplexity's open-source agent-security engine, Apache-2.0. We're wiring it in — it is not shipped yet, and we'd rather say so.
The design decision everything else hangs off: agents never pipe raw terminal output into each other. Every session emits one ordered stream — raw bytes plus structured turns — and everything downstream is a subscriber.
Raw PTY bytes for fidelity, structured turns for readability. One sequence, durably recorded on your machine, so a viewer joining late catches up without a gap.
Gating happens on the machine that owns the process — keyed to identity, never to a prompt. A viewer cannot grant themselves anything the owner didn't.
Local-first. Your sessions live on your machine. We host nothing, and there is no account to create.
Three things we're building toward. None of them ship today, and none of them are on the page pretending otherwise.
Contribute a floor to someone else's workspace and keep ownership of your own machine's processes.
A session keeps running when your laptop sleeps. Credit-metered — and this is the business model, stated plainly.
Hand one agent another agent's accumulated understanding, instead of re-explaining the codebase from scratch.
Every line above is checkable by cloning. MIT — go read it.