I built a desktop AI agent that writes its own tools — behind verification gates

A desktop AI agent that writes its own tools — and why every line passes a gate before it runs.

The itch

Agent capability is quietly becoming synonymous with a specific vendor's pricing plan. I wanted the opposite: an agent that runs on my machine, where models are swappable parts (Anthropic / OpenAI / Moonshot, or free-tier OpenAI-compatible APIs), and where the tools it writes stay on my PC as my assets.

So I built AMA-teras (AGPL, Electron + TypeScript): a desktop agent that, when it hits a capability it lacks, writes a new tool plugin for itself.

The scary part, handled first

"Self-evolving" sounds like a horror story, so the pipeline is the product:

1. Generation happens in an isolated git worktree — the running app is never touched
2. The generated tool must pass typecheck → real unit tests → a smoke run
3. Then a human reads the full diff and approves or rejects
4. Promotion is a git tag; failed health checks auto-rollback
5. The agent cannot modify its own approval mechanism or evolution engine (protected paths are enforced by a tripwire gate)

Nothing ships unreviewed — including code it wrote for itself, and anything imported from the community registry (shared plugins carry a verification-evidence record; audits elsewhere report 12–20% of marketplace skills are malicious, so evidence-or-nothing felt right).

What it can actually do

• Ask for a feature in chat ("I want a YAML→JSON tool") → it plans, writes the plugin + tests, runs the gates, asks for approval, and the tool is usable immediately
• Approve everything from your phone (worktree promotion, publishing, even Bluesky posts go through the same approval gate)
• Nightly autonomous mode stacks its work on a separate branch for morning review — main is never touched unattended

Honest limitations

• Windows installer only today (source build elsewhere is untested)
• The installer is unsigned (SmartScreen warning)
• Self-evolution is deliberately scoped to tool plugins, not the core

A large part of this app was built by the agent itself, under the same gates. The failure stories are documented in the repo — including the night it deleted its own work branch and we had to rebuild two tools from scratch (that incident is why nightly work now auto-backs-up to a private remote).

Repo: https://github.com/moriwo-dev-ai/ama-teras

Feedback very welcome, especially on the safety model.