Local-first AI coding,
explained

"Local-first" gets used loosely, so here is what it means concretely in Wanju: the app runs on your machine, your repositories stay on your machine, and there is no account server. When you use AI features, the primary network traffic is your machine talking directly to the provider you configured — OpenAI, Anthropic, or Google — with your own API key. If you explicitly enable cellular approvals, temporary end-to-end encrypted diffs and decisions also pass through Wanju's relay; the relay never receives their decryption key.

What that buys you: your code is never cloned into a vendor's VM, no third party of ours can retain it, and the tool keeps working offline for everything that isn't an AI call — dashboard, analysis, tasks, editor, Git.

What it doesn't buy you on its own is safety from the agent itself — a local agent can still propose a bad edit. That's why the built-in agent pairs local-first with a deny-by-default approvals inbox, an allowlisted command runner, credential-file blocking (agents, search, and AI context can't read key files), and an append-only audit log.

Secrets follow the same principle: API keys are encrypted with your operating system's keychain (Windows DPAPI, macOS Keychain) and sent to exactly one place — the provider you chose. The Settings screen shows which protection mode is active, honestly.

If you want to see the model without installing anything, the graveyard scan runs the same philosophy in your browser: your data goes from GitHub to your tab, and nowhere else.