qm

qm A multiplayer agent harness for work. In Slack and on the web. qm 是一个用于工作的多人智能体框架，支持 Slack 和网页端。

What is QM? Most agents are designed like personal assistants. You can make one work for a whole company, but it quickly gets complex. QM is designed for startups. Employees each get their own isolated workspace and work independently without affecting each other, and they can also collaborate with the agent in channels, group messages, and projects. Each person and each room has its own scoped memory, files, keychain view, permissions, crons, web apps, and durable sandbox. It’s built with open source in mind. Pick your own harness and model and switch between them — Pi, OpenCode, Codex, and Claude Code all drive the same core, so a deployment isn’t tied to any single vendor. 什么是 QM？大多数智能体被设计为个人助理。你可以让它为整个公司服务，但这很快会变得复杂。QM 专为初创公司设计。每位员工都拥有独立的隔离工作空间，可以互不干扰地独立工作，同时也能在频道、群聊和项目中与智能体协作。每个人和每个房间都有其专属的记忆、文件、密钥链视图、权限、定时任务、Web 应用和持久化沙箱。它以开源为核心理念。你可以选择自己的框架和模型并随时切换——Pi、OpenCode、Codex 和 Claude Code 均驱动同一个核心，因此部署不会绑定于任何单一供应商。

Features 功能特性

Personal and shared scopes. People customize the agent to be theirs, and still work with it collaboratively in Slack channels and projects. 个人与共享作用域。用户可以自定义属于自己的智能体，同时仍能在 Slack 频道和项目中进行协作。

Slack and web. The same identity and configuration carries between Slack and the web app. Slack 与网页端。相同的身份和配置可在 Slack 和 Web 应用之间无缝同步。

Admin control. Set org-level configuration, a security posture, and which harnesses and models are available. 管理员控制。设置组织级配置、安全态势，以及可用的框架和模型。

Web apps. Spin up custom internal apps and publish them to the right people. Web 应用。快速构建自定义内部应用并发布给指定人员。

Shared skills. Skills are scope-owned and shareable by grant, with admin-gated promotion to the whole org and skill packs imported from git repositories. 共享技能。技能归属于特定作用域，可通过授权共享；管理员可将其提升至全组织可用，并支持从 Git 仓库导入技能包。

Background work. Crons and watches run work while nobody’s watching. 后台工作。定时任务和监控任务可在无人值守时自动运行。

What you can do with it 你可以用它做什么

Search internal notes, email, documents, databases, and the web together 联合搜索内部笔记、电子邮件、文档、数据库和网络信息。

Retrieve information from your company brain 从公司“大脑”中检索信息。

Build internal apps, publish them to the right people, and keep their data current 构建内部应用，发布给指定人员，并保持数据实时更新。

Learn your writing voice from past sends, then triage your inbox on a schedule — labels and reply drafts included 学习你过往邮件的写作风格，并按计划整理收件箱——包括自动打标签和生成回复草稿。

Work in an existing repository: run tests, open PRs, monitor CI, check system logs 在现有仓库中工作：运行测试、提交 PR、监控 CI、检查系统日志。

Track a project in a shared channel and post updates and follow-ups 在共享频道中跟踪项目，并发布更新和后续跟进。

Architecture flowchart 架构流程图

[Diagram: LR DB[(“Postgres
sessions · memory · queue”)] subgraph CORE[“Headless core”] API[“API · identity · policy · scheduler”] LOOP[“Agent loop
(Pi, OpenCode, Claude Code)”] API <—> LOOP end SBX[“Per-scope sandbox
files · tools · logged-in services”] DB <—> API LOOP <—> SBX] （架构图：Postgres 数据库存储会话、记忆与队列；核心层处理 API、身份、策略与调度；智能体循环层驱动模型；沙箱层处理文件、工具与登录服务。）

Loading 加载机制

Every turn runs through a central core, which can use a variety of models and harnesses to generate the response. A Postgres persistence layer holds user data, session history, and other durable state. The agent has a small, fixed tool surface; one of those tools is execute, which runs commands in the scope’s own isolated sandbox — its durable computer, where installed tools stay installed. The web UI, the admin panel, and the public portal are optional plugins over the core’s HTTP API; Slack is an optional in-process plugin that core starts and supervises through a direct service client. The core runs TypeScript directly on Node and uses Fastify for HTTP. The Slack plugin uses Bolt; the web UI builds with Vite and renders with Lit. The core itself is generic. Everything specific to one company — org config, custom tools and skills, sandbox image, infrastructure — lives in a deployment directory that the qm CLI validates and deploys. Every substrate (harness, session store, sandbox, memory) sits behind an interface, so production implementations swap in via one wiring file. 每一轮交互都通过中央核心运行，该核心可以使用多种模型和框架来生成响应。Postgres 持久化层存储用户数据、会话历史和其他持久状态。智能体拥有一个小型、固定的工具集；其中一个工具是 execute，它在作用域独立的沙箱（即其持久化计算机）中运行命令，安装的工具会保留在其中。Web UI、管理面板和公共门户是基于核心 HTTP API 的可选插件；Slack 是一个可选的进程内插件，由核心通过直接服务客户端启动和监管。核心直接在 Node 上运行 TypeScript，并使用 Fastify 处理 HTTP。Slack 插件使用 Bolt；Web UI 使用 Vite 构建并由 Lit 渲染。核心本身是通用的。所有特定于公司的内容——组织配置、自定义工具和技能、沙箱镜像、基础设施——都位于一个部署目录中，由 qm CLI 进行验证和部署。每个底层组件（框架、会话存储、沙箱、记忆）都位于接口之后，因此生产环境的实现可以通过一个配置文件进行切换。

Security and secrets 安全与密钥

QM’s approach follows local coding agents like OpenCode, Codex, and Claude Code: the agent acts as the person it’s working for, with their credentials and permissions, and everything it does is audited. An org picks one security posture, which narrower scopes can only tighten: QM 的方法遵循 OpenCode、Codex 和 Claude Code 等本地编码智能体的逻辑：智能体以其所服务用户的身份行事，使用该用户的凭据和权限，且其所有操作均可审计。组织可以选择一种安全态势，较小的作用域只能在此基础上进一步收紧：

Strict — every harness tool call pauses for human approval, except the two no-effect turn enders. 严格模式——除两个无副作用的结束指令外，每个框架工具调用都需人工批准。

Auto (default) — a classifier screens provenance-labelled external data and tool results before they reach the model; a deployment can point that at its own screening proxy. 自动模式（默认）——分类器会在外部数据和工具结果到达模型前进行筛选；部署环境可将其指向自定义的筛选代理。

Dangerous — no content screening, no pauses between tool calls. 危险模式——无内容筛选，工具调用间无暂停。

The predeclared command policy — approval rules and hard denials for things like recursive deletes or destructive SQL — applies in every posture, Dangerous included. SECURITY.md has the threat model, the operator assumptions, and the known limitations. 预定义的命令策略——针对递归删除或破坏性 SQL 等操作的批准规则和硬性拒绝——适用于所有态势，包括“危险模式”。SECURITY.md 中包含了威胁模型、操作员假设和已知限制。

Deploy it for your org 为你的组织部署

Create an organization-owned deployment repository that depends on @yc-software/qm: 创建一个属于组织的部署仓库，并依赖 @yc-software/qm：

npm exec --yes --package=@yc-software/qm@latest -- \
  qm init . --org <slug> --target <fly-or-aws>
npm install

Initialization materializes a deployment skill for an agent and walks through infrastructure, web sign-in, connector credentials, optional Slack access, deployment, and live verification — no source checkout required. Each deployment runs in the operator’s own cloud account; initialization does not generate or enable deployment CI, and this repository has no production deployment workflow. See deployment.md for the details. 初始化过程会为智能体生成部署技能，并引导完成基础设施、Web 登录、连接器凭据、可选的 Slack 访问、部署和实时验证——无需检出源代码。每个部署都在操作员自己的云账户中运行；初始化不会生成或启用部署 CI，该仓库也没有生产部署工作流。详情请参阅 deployment.md。

Contributing 贡献

We take contributions as human-written text, not code — see CONTRIBUTING.md. Describe the change you’d like informally in a .txt or .md file in adrs/, and if we’re aligned we’ll handle the implementation. Report vulnerabilities privately — see SECURITY.md, not a public issue. 我们接受以人类编写的文本形式提交的贡献，而非代码——请参阅 CONTRIBUTING.md。在 adrs/ 目录下的 .txt 或 .md 文件中非正式地描述你想要的更改，如果我们达成一致，我们将负责实现。请私下报告漏洞——请参阅 SECURITY.md，不要提交公开 Issue。

Customize your instance 自定义你的实例

The deployment repository above carries config and a sandbox layer, and never needs a source checkout. Some organizations want the opposite trade: the whole codebase in one place, so engineers and coding agents read core and customizations together, while the customizations themselves stay private. For that, keep a private fork: a standalone private repository whose history begins as a clone of qm and whose core stays identical to upstream. Populate it once, then clone it to work in: 上述部署仓库包含配置和沙箱层，无需检出源代码。有些组织希望采取相反的权衡：将整个代码库放在一个地方，以便工程师和编码智能体可以同时读取核心代码和自定义代码，同时保持自定义代码的私密性。为此，请保留一个私有分支（Private Fork）：一个独立的私有仓库，其历史记录始于 qm 的克隆，且其核心与上游保持一致。填充一次后，克隆它进行工作：

gh repo create <org>/qm-private --private
git clone --bare git@github.com:yc-software/qm qm-seed.git
git -C qm-seed.git push --mirror git@github.com:<org>/qm-private
rm -rf qm-seed.git
git clone git@github.com:<org>/qm-private
git -C qm-private remote add upstream git@github.com:yc-software/qm

Create the private fork with a plain clone, as shown above, and never with 如上所示，使用普通克隆创建私有分支，切勿使用……