All 46 Dependencies
Every package qm depends on, ranked by repo health score.
QM is a self-hosted platform for running AI agents across an entire organization instead of one person at a time. Most agent products are built like personal assistants — wiring one up for a whole company quickly turns into a tangle of shared state and stepped-on context. QM instead gives every person and every room (channel, group, or project) its own isolated scope: its own memory, files, credential keychain view, permissions, scheduled crons, web apps, and durable sandbox computer. People customize the agent to be theirs while still collaborating with it — and each other — in Slack channels, group messages, and shared projects.
The project is deliberately harness-agnostic: Pi, OpenCode, Codex, and Claude Code all drive the same core, so a deployment isn't locked to one vendor's coding agent or model. A headless TypeScript core built on Fastify handles identity, policy, and scheduling, backed by Postgres for durable session, memory, and queue state; the agent loop hands off to whichever harness a deployment configures, and every harness reaches its own per-scope sandbox for file access, tool execution, and logged-in services. Slack support ships as an in-process plugin (via Bolt) that the core starts and supervises, and the web UI and admin panel are built with Vite and Lit.
Security is modeled explicitly rather than bolted on. Every organization picks one security posture — Strict (every tool call pauses for human approval), Auto (blocks private-network access, optional content screening), or Dangerous (no pauses, no screening) — and a separate sharing posture that controls whether resources from one scope can be read in another. A predeclared command policy enforces hard denials (recursive deletes, destructive SQL) in every posture, including Dangerous. Background work — crons, watches, and inbound webhooks — runs independently of any open conversation, and admins get org-level control over which harnesses, models, and security settings are available to their teams.
QM ships as an npm package (`@yc-software/qm`) that organizations deploy into their own cloud account via a generated deployment repository and the bundled `qm` CLI, rather than as a hosted SaaS product — though a third-party hosted version exists for teams that don't want to run their own infrastructure. Everything specific to one company — configuration, custom tools and skills, sandbox image, infrastructure choices — lives in that deployment repository, keeping the open-source core generic and upgradable.
