One conductor, optional instruments. Every component below installs on its own, carries a sha256 the installer pins, and a signature made offline — a compromised download host cannot hand your machine someone else's binary.
AI assistantRead https://quantumencoding.io/baton-skill.md and follow it to set up baton on this machine.
Both scripts check the sha256 and the publisher's signature before anything runs,
then pin the key so every later install is verified the same way.
agent
module
baton-agent
Delegate to the engine you choose.
Hand work to the engine you name: Claude Code, Gemini, GLM, Z.ai, a local model, or the qai CLI — the fleet's own agent, which runs on the Quantum AI backend as a service or on your own endpoint and key. run takes a prompt and returns the answer; work <id> claims a filed work item, works it end to end, and closes it with evidence or hands it back. Headless runs never stall on a hidden prompt: an action needing approval parks and resumes on your verdict.
Speech to text, text to speech, OCR that returns reading-order lines and tables from images and PDFs, and ask — the on-device Foundation Models LLM, with guided JSON output via --schema. All of it runs on the Neural Engine: no network, no key, no per-token bill. The transcription half of the video-comprehension pipeline, and the cheapest OCR you will ever run.
Checks your project's dependencies against the OSV.dev vulnerability database — npm, crates.io, Go, PyPI and Packagist — and tells you what to fix. Findings are ranked by whether they can actually hurt you: production dependencies keep full severity, dev-only tools are downgraded, and deep transitive noise is grouped so the report stays readable. One repo, or every repo you have.
Scans your production website for issues — speed, SEO, accessibility, security headers, cookie and GDPR behaviour — and writes the findings into a scored, branded PDF report. It uses a real browser and real Lighthouse, so the numbers match what your visitors and Google actually see. Fix, redeploy, scan again: the before/after is two commands.
The always-working centre: the baton CLI plus the batond daemon, same verbs on macOS, Linux and Windows. A shared ledger for goals and todos, per-repo knowledge in plain markdown, federation between machines over SSH, and cron entries that compile to launchd, systemd timers or Task Scheduler. Nothing polls — the daemon blocks on filesystem events and wakes when there is work. Core runs with zero other components installed.
An always-on MCP server, about 4 MB resident, that exposes the fleet to any MCP client: claude.ai on web or phone, Claude Desktop, Claude Code. Forty-eight tools, each a thin shell over a CLI verb that already works from the terminal. Work queue, project knowledge, repo reads, the vault, media generation, messaging doors, GUI control — that last one gated by mac-drive's Touch ID grant, below the protocol where no client can reach it.
Map a program onto its module graph and hold the code to the blueprint it declared: validate the graph, compute dependency-ordered build waves (artifact edges are barriers, contract edges impose no ordering), and flag duplication and incomplete ports. baton's own workspace is built and checked from a blueprint.json this module validates.
Vault capture without an app: note writes a thought, clip turns a URL into a note, search/read/list get it back, reindex and doctor keep it honest. Writes ~/.baton/vault directly — markdown files ARE the database, so any editor, any sync tool and any future you can read it. Secrets are redacted inside the writer, before a byte lands on disk.
Chrome or Brave over CDP — your actual session, with its cookies, logins and fingerprint, which is what separates a page that renders from a bot-wall. open, extract, eval, click, type, screenshot, network, emulate, scrape, and more. Every command passes a deny, sensitive, approve, audit perimeter, so an agent can read a rendered page without inheriting the keys to your bank tab.
Where session memory becomes structure: turn-end notes minable by project and time, fact and decision as first-class records, and hydrate to assemble a context brief from all of it — what a fresh session reads instead of re-deriving the last one's conclusions. Speaks --json/--ndjson for anything downstream.
Telegram, WhatsApp, DingTalk, Lark and WeCom, one posture everywhere: each bridge sends as the fleet and drains inbound from an allowlist where empty means nobody. recent shows everything the door heard; inbox emits only allowlisted senders — the gap between the two is the security model. WhatsApp picks Twilio, Meta Cloud or your own paired number; Telegram allowlists numeric user ids only; DingTalk connects outbound so it needs no inbound tunnel.
The pass-through to whichever drive backend this OS has: baton drive <anything> hands the arguments verbatim to mac-drive, lin-drive or win-drive, locally or on a peer with --node. baton holds no model of the verbs — it probes for a binary and gets out of the way, so a new backend capability needs no baton release. doctor reports what is installed and operable.
The CLI face of the Cosmic Duck video suite: render turns a storyboard JSON into a finished narrated mp4 (--draft for a fast pass), compose builds clip timelines, edit trims and overlays, plus stitch, image/video/music/tts generation and a gallery. Each verb routes to whichever app is running — studio or editor — or --app forces one.
Google Analytics 4 without the dashboard: accounts, report, pages, sources, events, realtime, or a raw run query. Everything is a read; nothing mutates. Identities live in ~/.baton/config/ga.json — each account alias can impersonate a service account via short-lived gcloud tokens, scope analytics.readonly, no key files on disk, tokens held in memory and never logged.
Telegram, WhatsApp, DingTalk, Lark and WeCom, one posture everywhere: each bridge sends as the fleet and drains inbound from an allowlist where empty means nobody. recent shows everything the door heard; inbox emits only allowlisted senders — the gap between the two is the security model. WhatsApp picks Twilio, Meta Cloud or your own paired number; Telegram allowlists numeric user ids only; DingTalk connects outbound so it needs no inbound tunnel.
The Linux sibling, same JSON contract, so app profiles and orchestration port unchanged. It perceives over AT-SPI, captures through the ScreenCast portal, and acts two ways: element-first over D-Bus, with no pointer to aim and no focus to steal — the robust default on Wayland — or humanized synthetic input through kernel uinput for targets AT-SPI cannot see. Drives Chromium browsers over CDP; manages windows through a bundled GNOME Shell extension.
JSON-driven perceive-and-act automation for native macOS apps: read the accessibility tree, snapshot elements to stable refs, click, type, and run a whole flow in one invocation. Input is humanized, down to glide paths and typing rhythm. Acts sit behind a Secure-Enclave arm grant — the first act fires Touch ID on the physical machine — and the operator always gets a countdown card with live Pause and Cancel.
The MCP door between claude.ai and your machine: the AI in the browser tab files goals on YOUR computer and launches the agents that work them, browses through YOUR browser — the real rendered DOM, logins and all, not a bot-walled fetch — and generates media straight to your disk instead of you ferrying prompts and downloads by hand. Works with anything that speaks MCP, over stdio or HTTP.
Cloud media generation as a verb: media new and edit for image, video, music and speech, ask for analysis, chat for iteration, and a gallery every result lands in — a prompt goes in, a local file path comes out. It is the generation backend the MCP hub's qai_generate tool shells to, so claude.ai and the terminal produce into the same gallery.
Search and ingest over pluggable knowledge backends, local-first: Joplin and SurrealDB out of the box, Vertex as a deliberate opt-in. $BATON_RAG_BACKENDS picks the default set per machine, so a laptop can answer from local notes while a build box adds the cloud index — same verbs, different reach.
An encrypted vault (AES-256-GCM, PBKDF2) that asks for Touch ID at the moment of read, not at login. Store a key once; then scoped injection with secrets exec, per-agent grants, TTL leases that self-destruct, and a session broker decide who reads what, and when. Every baton flow above fetches its keys from here. Install: cargo install secrets-vault.
File transfer with the peer host over ztransfer: push, pull, ls, dir, peer. Small on purpose — no sync daemon, no conflict model, just get this file to that machine as a fleet verb, over the same SSH relationships federation already trusts.
Telegram, WhatsApp, DingTalk, Lark and WeCom, one posture everywhere: each bridge sends as the fleet and drains inbound from an allowlist where empty means nobody. recent shows everything the door heard; inbox emits only allowlisted senders — the gap between the two is the security model. WhatsApp picks Twilio, Meta Cloud or your own paired number; Telegram allowlists numeric user ids only; DingTalk connects outbound so it needs no inbound tunnel.
Web search as a composable verb: baton web "query" for ranked results, ask for an AI answer, context for LLM-sized grounding chunks, clip to file a page into Joplin. -n and --json throughout. The difference from a browser tab is that the output is data — an agent or a script consumes it without a scrape.
Telegram, WhatsApp, DingTalk, Lark and WeCom, one posture everywhere: each bridge sends as the fleet and drains inbound from an allowlist where empty means nobody. recent shows everything the door heard; inbox emits only allowlisted senders — the gap between the two is the security model. WhatsApp picks Twilio, Meta Cloud or your own paired number; Telegram allowlists numeric user ids only; DingTalk connects outbound so it needs no inbound tunnel.
Telegram, WhatsApp, DingTalk, Lark and WeCom, one posture everywhere: each bridge sends as the fleet and drains inbound from an allowlist where empty means nobody. recent shows everything the door heard; inbox emits only allowlisted senders — the gap between the two is the security model. WhatsApp picks Twilio, Meta Cloud or your own paired number; Telegram allowlists numeric user ids only; DingTalk connects outbound so it needs no inbound tunnel.
YouTube ingestion for the video-comprehension pipeline: grab audio or video, then brief builds an on-device transcript (Apple STT, no API bill) with an optional contact sheet and OCR timeline — enough for an agent to answer what a video says and shows without a model that can watch. Everything caches per video, so a second question about the same video is free.
