TH060419/gatherthread

GatherThread is an open-source, self-hostable real-time collaboration workspace designed for people who keep their own local AI coding agents. It is explicitly harness-neutral rather than built for any single product, supporting both Codex Desktop and DeepSeek Harness clients that connect to the same ordered project event log; conversations stay attributable, replayable, and delivered live across role-based Solo and Multi sessions, while every participant keeps their local agent runtime and credentials. Git-backed code checkpoints are deliberately an opt-in feature, kept separate from the shared collaboration layer so that the product stays decoupled from any specific git workflow.

The typical workflow starts with opening a GitHub Issue against the Alpha access template, where applicants describe their motivation and optionally an email for private code delivery; a maintainer replies publicly with a one-use qualification code that must never be published, and the user redeems it at the hosted login page by entering display and device names under First-time activation. Solo sessions publish a complete canonical stream owned by the creator while other members follow read-only, whereas Multi sessions let many humans share one ordered conversation where human chat is broadcast directly and Agent requests are claimed only by the sender's local runtime and labelled with username, harness, provider, model, and capture fidelity. The server persists an append-only SQLite WAL event log with authoritative per-session sequence numbers, role-based access, durable replay, and WebSocket live delivery, while Codex and DeepSeek Harness maintain separate native projections recovered from durable cursors and outboxes, targeting remote pair-programming teams and small groups that want shared context without surrendering local model sovereignty.

Dependencies include Node.js, SQLite, Caddy as the documented edge, and optionally Tailscale for the Tailscale Serve mode, with an Alibaba Cloud ECS profile for the live deployment pattern; every mode keeps the application bound to loopback so that only the configured Caddy edge accepts public traffic. The first release ships peppered device credentials, HMAC-protected revocable browser sessions, single-use invitations and device authorization, device-bound runtime provenance, immediate session and socket invalidation on revocation, solo/multi ACL, event redaction, session-scoped idempotency, single-runtime request serialization, one-use realtime tickets, strict production WebSocket Origin checks, bounded JSON complexity, byte-paged replay, per-device rate limits, per-user and per-project session-count caps, and SQLite backup and restore scripts. Alpha hosted access at gatherthread.cn is invitation-only with no public registration or public Beta, the local, LAN HTTPS, and Tailscale self-hosting options remain available, and the license is Apache-2.0. Not yet implemented are automatic host failover, multi-process WebSocket fan-out, token-by-token agent streaming, attachment blob storage, retention workers, offline Web outbox, reply or search UI, and packaged native installers, and a first-run user must save the one-time device credential shown after activation before dismissing the dialog.