Personal Apps
“Here’s my data. Build me a dashboard.” One file. Double-click. It’s an app.
Tell your AI what you need. It writes the whole app as a single HTML file.
Keep it, copy it, send it to a friend. Use it for a minute or for years. Done with it? Delete it.
It opens, edits and saves the files on your computer. No uploading, no downloading.
Everything it saves is a plain file that opens in any other app.
Start
Once. Download it for macOS or Linux.
Any coding agent that can write files, such as Claude Code or Codex. Point it at the resworb skill, which teaches it how to write an app for resworb, and say what you need:
Read https://github.com/Orcaryn/resworb/blob/main/skills/resworb/SKILL.md and write me a resworb app that shows my ~/Notes folder as cards.
Open the .lmth file it wrote. Read the popup, click Allow. That’s it.
Under the hood
Has the network. Reads the page’s <meta> tags before any script runs, shows the popup, and runs the proxy for resworb-net.
It relaunches itself in the OS sandbox: Seatbelt on macOS, bwrap --unshare-net on Linux. The kernel denies sockets and DNS to it and to every process it starts.
Before it opens the window, the sandboxed process proves it is offline: on macOS it must fail to bind a loopback port, on Linux its network must hold only lo. If it cannot, it refuses. No flag skips this.
A page reaches files only through window.resworb, which checks every path against its grants. The sandbox also limits writes to the granted folders, for the page and every program it runs.
One value per <meta>. With no tags, a page may see its own folder and nothing else, and it opens without asking.
| Tag | Allows | For example |
|---|---|---|
resworb-read | See files in a folder and its subfolders. | ~/notes |
resworb-write | See, change and delete them. | ./reports/*.md |
resworb-net | Send and receive data with one server. | api.example.com:443 |
resworb-run | Run one program. | git |
resworb-env | Give its programs one variable. | AWS_PROFILE |
resworb-socket | Talk to the program behind one socket. | /var/run/docker.sock |
resworb-node | Full Node: any file, any program. Only for pages you trust. | full |
Questions
No. You say what you want, and your AI writes the app. You read the popup and decide what it may touch.
Any coding agent that can write files, such as Claude Code or Codex. Give it the resworb skill and it knows the rest.
An HTML file with its own extension, so a double-click opens it in resworb, not in your browser. It’s “html” backwards.
Not on its own. Your operating system blocks the internet for the app and for every program it starts. An app can ask for one server, and the popup tells you first. If you let an app run a program, or give it full Node, that program may still reach the internet through other apps, and the popup says so. SECURITY.md lists everything resworb does not enforce.
Only to check GitHub for a new version, at most once a day. Turn it off in Permissions → Check for Updates Automatically. No telemetry, no crash reports.
Yes, it’s one file. When someone opens an app they downloaded, the popup shows the site it came from first. If the app asks for a lot, they tick “I trust where this page came from” before it opens.
If it asks for something new, resworb asks you again and marks what changed. resworb does not check the rest of the file, so an edit that asks for nothing new opens without a popup.
Open a second window, or use the camera, microphone, screen capture, notifications or location. Closing its window quits it.
Not yet. The plan is written down. On Linux there is a .deb for x86-64, tested on a headless Ubuntu 24.04 server but not yet on a desktop.
Nothing. resworb is free and open source, under the MIT license.
Version 0.1.1, signed and notarized for macOS. Release notes and checksums. Then give your AI the resworb skill.