Clawdline Cloud
The sessions you already have, on every Mac you own.
Clawdline is a Mac app that already knows every terminal on your machine — which one is running an assistant, which one is idle, which one is waiting for you. It dispatches work between them, hands a line of work on, and runs it on a clock. Cloud adds the one thing a single Mac cannot do: reach.
The app is free forever and works with no account. Cloud is the optional half — and it is a dumb pipe by construction: here is everything it can see.
Press a row. This is the app's own list — Clawdline reads the terminals you already have open.
orchestra, with Claude and Codex
Work you hand to another session.
Some of what you ask for does not need the conversation it was asked in — run the suite, read this diff, draw the thing. A session writes the task down; Clawdline opens a terminal tab, types the first message into it, watches for the answer, and tells the session that asked.
The root writes a task down and asks for it to be run. Nothing else — it never touches a terminal, and it does not learn the child's id until the broker tells it.
Dispatching is remote code execution with a second step, so it holds its own credential: the orchestrator token is a local file, and no device token on this Mac's API can dispatch with it — not with send, not over a tunnel. A fleet dispatch from the cloud is a different door, and it arrives at this same broker.
Depth stops at two, and the floor is what has teeth: a child's children may not dispatch at all, and the refusal is the broker's, not a request the child is trusted to honour.
The file appearing is the completion signal. Nothing is inferred from a quiet tab, and a child that dies without writing one is reported as exactly that.
- Three parties, and the middle one is the app. The root never touches a terminal. The child never learns who asked.
- Depth stops at two. A child may open children of its own; those may not open anything, and the refusal is the broker's rather than a rule the child is trusted to keep.
- Claude or Codex, per task. The broker knows which assistant still has quota left, and says so before you spend a dispatch on one that has none.
- What Cloud adds: a dispatch from another of your Macs, or from a runner with no browser, arrives as an encrypted command carrying the very same task file. The receiving Mac's own broker decides — its claims, its capacity, its dispatch policy — and answers with the same typed refusals it would give a local caller.
handoff
A conversation ends before its work does.
The context fills, the day ends, or the next hour of this would be better done in Codex. What usually happens next is that somebody re-describes half of it from memory — and the half nobody remembered is the half that mattered. A handoff is the other move: the session with the state writes it down, and a new session picks the line of work up from that document. The file is the protocol; the app is the postman.
- A continuation, not an errand. The session a handoff opens is a new root, in nobody's tree: no deadline, no secret, nothing owed back to the sender.
- Closing the session that handed over does not touch the one that took over. You handed the work on precisely so that it would outlive the conversation.
- What Cloud adds: the same move across machines. The source Mac seals the whole package under your master secret and publishes it to your account, and another Mac of yours decrypts it and opens the receiving session — addressing one particular machine is a v1 question we have not settled. What we see is on the right — and none of it is the work.
Press any field. Everything above is what the cloud can read; the striped one is what it cannot, on any day, for any reason it might be asked.
schedule
Work that starts without you, and finishes like work you asked for.
A schedule is a task template Clawdline turns into an ordinary dispatch at a local wall-clock time: the same claims, capacity, depth and permission checks, and the same task record as work a session dispatched by hand. Not a timer that runs a script — a real session, with an assistant in it, that reports what happened.
Local wall-clock time, in this Mac's own time zone. Not UTC, and not the cloud's clock.
- Schedules live and fire on the Mac. If the app is closed, nothing fires. We keep that honest rather than papering over it with a cloud runner.
- One JSON file per schedule, and files are the source of truth. A phone paired to the app can write one; hand-editing has never stopped being a first-class way to work.
- A missed morning is a notification, not a silence: catch-up decides whether a run the Mac slept through still happens, and a window missed entirely tells you so.
- What Cloud adds: that list, mirrored to your phone as ciphertext and rendered read-only, with run-now, enable and disable as signed commands. Editing the definitions remotely is a later phase — until it ships, this is what it does.
remote control
Two features, two risk levels, two switches.
Reading a session hands over a repository name, a branch, a task title — and through the transcript, the conversation itself. Writing to a session types a line into Claude Code and presses Return, and Claude Code runs bash. These are not two positions on one dial, so they are not one switch.
Binds 127.0.0.1 and nothing else. Not "binds everything and filters" — there is no interface on your network for it to be found on.
A separate switch, on purpose. Turning the first one on does not turn this one on, and this one is the one that matters.
Both off. This is a fresh install: nothing answers, on loopback or anywhere else.
- Both off in a fresh install, and turning the first on does not turn the second on.
- Writing is a second grant, not a louder first one: an approved device reads with one capability; typing into a session needs send as well as the write switch, and the switch is per machine.
- What Cloud adds: the same two switches, over a wire, and a finer split behind them: a cloud device token carries read sessions, read transcript, send prompt and start session as four capabilities that never merge. Every command is signed by the sending device's own key and encrypted under your content key, and your Mac verifies both before anything is injected — so a stolen account is still not a shell on your machine.
attach to what is already running
The sessions you already have — not the ones it made.
Everything above starts from one unglamorous fact: Clawdline reads the terminals that already exist on your Mac. A session you opened yourself, in your own terminal, before the app was even running, is on the list a beat later — with its own status, its own question, its own place in the tree.
You started this yourself, in the terminal you already use, before the app was running. Nothing was launched from Clawdline, and nothing needs to be.
The same session, a beat later: on the list, in the menu bar, on your phone if you have paired one. The app read the terminal; it did not take it over, and closing the app leaves the session exactly where it was.
- No wrapper, no runtime of its own, no different way of starting work. Quitting the app leaves every session exactly where it was.
- What Cloud adds: that same list, from the sofa or the airport, for the Mac you left running at home.
the project is the unit
Open a project, and see everyone working in it.
Cursor and VS Code ask which project before they ask anything else, and everything after that happens inside it. Clawdline is built on the same base: a session, a dispatch, a schedule and a handoff each belong to a project directory, the list filters and groups by it, and picking one shows you everybody working there — Claude, Codex, you — and what each of them declared it may touch.
codex child → cloud/marketing · schedule → docs/backlog.yaml · the session you opened → not a task, so no claim
One directory, three kinds of record: a session you opened yourself, a task another session dispatched, and a schedule that becomes an ordinary dispatch at half past eight. Each one names this project — which is the reason they can be shown together at all.
claude child → db/migrations · the session you opened → not a task, so no claim
Picking a project changes the frame rather than filtering a feed: this is what is happening in ~/code/atrium, and a session in another directory is not hidden from you here — it is somewhere else.
newsletter → drafts/ · link check → declared read-only, which is a declaration and not a silence
Nothing is running in this one, and it is still a project: two schedules sit in it, waiting for their day. Schedules live and fire on the Mac, so those rows are a promise your machine keeps rather than one we keep for it.
- Every record names a directory. A dispatched task carries its project_dir; a schedule's template carries one; a handoff is opened in one. There is no work in this app that is not somewhere.
- What each may touch is declared against it. A task's write paths are relative to its project, and two tasks in one directory stop warning about each other exactly when both have declared and the declarations do not overlap. Declaring nothing keeps the warning — silence should mean proof rather than omission.
- It is not an editor. It opens no files, indexes no code and syncs no workspace. What it borrows from the IDE is the unit of orientation, and nothing else.
- What Cloud adds: the same lens from somewhere that is not in front of the Mac — and it stays a lens over ciphertext. A phone or a runner names a project by an id off the list your Mac serves, never by a path: the schedule API the app already exposes to a paired device has nowhere in its body to write a directory, and cloud v0 adds no body of its own. Your file paths are on the list our side never sees.
clawdfather, the next coordination layer
One decision, answered once — not re-argued in every session that hits the same fork.
Clawdfather is not shipped yet. It is the layer we are designing above dispatch, handoff and schedule: a broker-granted, revocable role — never a task parent, never a source of authority of its own — that a root session can ask a decision of, instead of guessing alone or five roots asking the same question five separate times. What already exists are the durable coordination primitives it would read: the task, claims and landing records described above. Everything below is the design we are holding ourselves to, not how anything routes today.
Every independent root that reaches the same fork sends its own question. If Clawdfather dispatches new work, each dispatched session remains an independent root rather than becoming its task child — closing one root touches nothing about another.
Session metadata is visible machine-wide by default — who is waiting on whom, what a task claimed it may touch, whether a delivery has actually landed. Reading what a session actually said is a separate grant, given project by project.
Goes to a human instead when: it's product intent or a value trade-off · anything irreversible or with an outside effect · spend · a credential or permission · a transcript grant · privacy or security · its own confidence being too low.
Everything else stays advisory. A human answers once — not once per session that happened to ask.
A version keeps a stale answer from being replayed, and each waiting root gets its own acknowledgement back. Standby means available, not thinking continuously — and being available is not standing authorization. No ordinary session blocks on it forever: past its timeout, a safe fallback applies and the work goes on.
- It reads before it reasons. A fresh decision already on record wins outright; failing that, it forms an advisory answer from session metadata, who is waiting on whom, declared claims and what has actually landed — never from a blank page.
- Escalation is the exception, not the default. Product intent, anything irreversible, spend, credentials, a transcript grant, privacy, security, or its own confidence being too low — any one sends the question to a human, once. Everything else stays advisory, read from the record.
- Metadata by default, transcripts by grant. Every session's metadata is visible to it machine-wide. Reading what a session actually said is a separate, durable, per-project grant — not a blanket read.
- Standby is the resting state, not authority. It sits available between events rather than reasoning continuously, and being available never stands in for a human's authorization. No ordinary session blocks on it forever — past its timeout, a safe fallback applies and the work goes on.
- Not shipped: this section names the design we are holding ourselves to, not current behaviour.
the boundary
What Cloud is, and what it can never be.
- We authenticate you to our control plane, and route to Macs of yours that are already logged in. We cannot issue Anthropic credentials, and we cannot make headless subscription use legitimate — that is the vendor's policy ground, not ours, and no amount of plumbing on our side changes it.
- What we can do is the legitimate path through the same problem: your CI, or a container, or anything else with no browser to log in from, calls our API, and the work is dispatched onto a Mac of yours where a real interactive session is already signed in.
- And the honest limit: several Macs share one account's quota — dispatching to three of them is not three times the allowance. What a fleet buys is environments and parallelism (different checkouts, local databases, particular toolchains), never multiplied quota.
One call, from a runner that has no browser.
The caller holds a device credential you provisioned: a real device keypair, and the account master secret. It composes the task, seals it, and signs it — all before the request leaves. There is no endpoint we host that accepts a plaintext prompt — the app's own API on your Mac is a different door, on your own network — and there is nothing on our side that could compose a command your Mac would accept.
Your Mac holds a connection right now, so the envelope reached it. Its own broker then applies its own claims, capacity and depth checks — a caller from outside is one more requester at the same door, never a superuser.
free, and the optional half
The app is the product. Cloud is reach.
Clawdline runs on your Mac, reads the terminals you already have, and dispatches, hands off and schedules entirely locally. That half is free forever and needs no account to work. Cloud adds only the parts that need a wire between machines — another Mac, a phone, a runner with no browser — and it carries them as ciphertext.