byre/internal/agents/kb/setup.md

How to walk the human through setting up byre: the tools the server's agents need, vendor sign-ins, and the macOS permissions on the server's Mac and each client Mac.

Walking the human through setup

Go one step at a time: check, say in a line or two what is missing and what it is for, fix what you can yourself, and ask the human only for what needs their hands (a password, a sign-in, a click on a macOS prompt). Check again after each fix, and finish with a short list of what is ready and what was left out on purpose. Ask which vendors the human wants (Claude, GPT, Gemini) before installing agent CLIs; one is enough.

byre is /Applications/Byre.app/Contents/Helpers/byre and byre-hands is beside it, on every Mac with the app.

Tools on the server's Mac

Agents run on the Mac byre runs on, the one your own Bash runs on. Check its tools with:

"$SHELL" -l -i -c '/Applications/Byre.app/Contents/Helpers/byre check'

It prints one JSON line: ready (false while something blocking is missing) and checks, each with name, need (required; agent, where one of claude, codex and agy is enough; or optional), for (what it is used for), ok, command (what installs it), fix (what to do after) and blocking.

• Run each missing tool's command yourself through the login shell, "$SHELL" -l -c '<command>'. brew must be there first; installing Homebrew asks for the human's password, so ask them to run its installer in a terminal on that Mac (the app's Server tab there lists each missing tool with a Run in Terminal button). xcode-select --install opens a macOS dialog on that Mac's screen for the human to click Install.
• Sign-in needs the human at a terminal on that Mac: claude, codex login or agy, each run once. claude auth status (JSON, loggedIn) and codex login status show whether one is signed in; agy has no status command, so ask.
• The service's PATH is fixed when it is installed, and your own shell has the same one. It comes from an interactive login shell (-l -i), since claude's installer has the human add ~/.local/bin to .zshrc. When a tool is found through that shell but not by /Applications/Byre.app/Contents/Helpers/byre check run directly, reinstall the service from it so it picks the new PATH up: "$SHELL" -l -i -c '/Applications/Byre.app/Contents/Helpers/byre install'. That restarts byre and cuts your turn off; you resume with a restart message, so say before running it that you will carry on afterwards. When you resume, check with byre check before reinstalling again: the restart usually took.
• byre install and the app's Server tab (Turn off, Turn on) are the only ways to restart byre's service. Never run launchctl on it yourself, and never tell the human to.
• Google Chrome, for agents' browser tools, asks "downloaded from the Internet" on its first launch, and can't be driven until the human answers Open.

Permissions on the server's Mac

Agents see and control the server's Mac, and read its Desktop, Documents, Downloads and iCloud Drive folders, through macOS privacy grants that belong to byre. Check them with a copy of byre-hands (each run needs its own path):

d=$(mktemp -d) && cp /Applications/Byre.app/Contents/Helpers/byre-hands "$d/" && "$d/byre-hands" check; rm -rf "$d"

It prints a JSON array, one entry per grant: name, status (granted, missing, or unchecked when the test couldn't run, such as Automation of Orion while Orion isn't running), detail (what to switch on) and settings, the x-apple.systempreferences URL of its System Settings pane.

• A missing folder grant makes macOS show a prompt on that Mac's screen during the check, and the check waits until it is answered, so tell the human to be at that Mac before you run it, and give the call a timeout of a few minutes.
• For Screen Recording, Device Control and Data Access (what macOS 27 calls Accessibility) and Automation, open the pane for the human with open '<settings>' and tell them which switch to turn on. On a Mac that runs a server, the panes list two entries: byre with a black terminal icon is the server, whose grants agents on that Mac use, and Byre with byre's app icon is the app, whose grants client tools on that Mac use. The check's detail names the one it checked. Device Control and Data Access can list byre switched off; only the switch being on counts.
• Check again after the human says they've done it.

Client Macs

list_clients lists the human's Macs with the app open (and their iPhone, which needs nothing). Agents use a client Mac through client_hands and the client file tools, with grants that belong to byre's app there. Check them with client_bash on that Mac, running the same byre-hands command as above, and open a missing grant's pane there the same way with open '<settings>'. Ask before opening anything on a client Mac's screen, and only when the human is at it. The human can also run the check from the app's Settings tab on that Mac.

Client Macs need no agent CLIs. Google Chrome is optional there, for agents' chrome tool on that Mac; "$SHELL" -l -c 'brew install --cask google-chrome' through client_bash installs it when brew is there.

What to leave alone

Don't change anything the check reports as found, and don't install optional tools the human doesn't want.