Install

macOS 12 or newer, one signed and notarized .dmg, and a download link that only exists once your trial has started. Windows and Linux are in development and there is nothing to download.

What you need

RequirementDetail
macOS12.0 or newer. This is the bundle’s minimumSystemVersion, so an older Mac will not open the app at all.
ChipApple Silicon or Intel. Version 3.7.2 is a universal build and runs natively on both.
An agent CLIAt least one, already installed. DeckSpace runs the CLIs on your PATH — it installs none of them. See below.
gitThe system git. The Review room and worktrees shell out to it rather than linking a git library.
tmuxOptional. Needed only for panes that survive quitting the app, and for remote panes over ssh. Nothing else depends on it.
A cardThe 7-day trial is card-gated. There is no free tier and no unlicensed grace period in the app.

The download is gated behind the trial

There is no anonymous download link. download.php requires an order parameter, and refuses with HTTP 403 when it is missing or does not check out. You get one by starting the trial.

  1. Start the 7-day trial on the product page. It goes to Stripe Checkout; the card is required and the subscription converts on day 7 unless you cancel.
  2. Stripe returns you to a personal thanks page carrying your order id. That page holds both the download button and your licence key.
  3. That button is macOS. For any other platform, or to see every build at once, open the download page with the same order on the end of the URL — it lists exactly the builds that are on the server right now.
  4. Download DeckSpace.dmg. The filename is deliberately unversioned so the same link keeps working across releases — the version lives in the app, not in the URL.

The server re-checks the order with Stripe on every download. It authorizes when the checkout was one of ours (a subscription), and either the invoice is paid or the subscription is trialing, active or past_due. A trial checkout is not “paid” — nothing has been charged yet — which is exactly why the trial-aware check exists.

Lost the link, or on a new machine

Use resend.php. Enter the email you subscribed with and it re-sends your personal link plus your licence key. It answers the same way whether or not that email has an order, so it will never confirm to a stranger that you are a customer — and it is rate-limited to five requests per hour per network.

Installing the app

  1. Open the .dmg and drag DeckSpace to Applications.
  2. Open it from Applications.
  3. The first launch opens the main window. On later launches started by the login item it stays in the menu bar instead.

The Mac build is signed with a Developer ID Application certificate under the hardened runtime, the app is notarized during the build, and the disk image is submitted and stapled separately. A correctly stapled disk image opens with no Gatekeeper warning.

If Gatekeeper does complain

Should macOS say it cannot verify the developer, right-click DeckSpaceOpenOpen. You need this once. An unstapled disk image looks perfectly fine on the machine that built it and only shows the warning to a customer, which is why the fallback is documented rather than assumed unnecessary.

Activating your licence

Installing does not unlock anything. DeckSpace is subscription-only and the gate is around the whole app, not individual features: with no valid licence and activation for this Mac, you get the activation screen and nothing else.

  1. Open Settings → Plan & license.
  2. Paste the key from your thanks page or your email.
  3. Click Activate.
FactDetail
Machines per licence2 Macs. The count is enforced by the activation server, and the app shows Devices: n / 2 Macs once active.
Key lifetimePermanent. The key is an identity, not an expiry date — it stays the same across renewals and reinstalls.
What actually expiresThe device activation token. When the subscription lapses the server stops renewing it and the app shows “subscription ended” rather than “invalid key”.
Working offlineUp to 30 days on a valid token, capped at your paid period plus 7 days of grace. Being briefly offline does not lock you out.
Freeing a seatRemove in Settings → Plan & license deactivates this Mac and returns the seat.

If the trial ends unpaid or you cancel, the app locks at the end of the paid period. Your data stays on disk untouched; renewing with the same key restores access.

What macOS will ask for

Nothing is requested at install time. Each permission is asked for the first time you use the feature that needs it, and every one of them is optional — panes, agents, the board and the review gate need none of them.

PermissionAsked for when
MicrophoneDictation, or the always-on voice assistant.
Automation (Apple Events)Voice actions that drive other apps — opening menus, quitting an app, running AppleScript.
Screen RecordingThe Screenshot tool, and letting the voice assistant look at your screen.
Accessibility and Input MonitoringPasting dictated text into another app, and global hotkeys. Grant these in System Settings; without them the transcript is left on the clipboard instead.
Files and FoldersOnly if you run the optional filing-system scan during onboarding. Folders macOS blocks are listed by name so you can grant and re-scan.

What DeckSpace does not install

It ships no model and no agent CLI. It detects the ones already on your login shell’s PATH and runs them in panes. If you have installed none, the app opens and every agent shows as unavailable.

Detection runs from Settings → AI providers, and only when you click Scan — never automatically at startup. The scan checks the known command names on your PATH and asks each one for its version. It installs nothing, changes nothing, and sends nothing off the machine.

Eleven CLIs are recognised (a twelfth entry, gemini, is kept only so old workspaces still resolve — that CLI was retired on 2026-06-18 and launches are sent to Antigravity instead). The app shows a copyable install command for each one it cannot find:

Agent CLICommand it looks forInstall hint the app shows
Claude Codeclaudenpm i -g @anthropic-ai/claude-code
Codexcodexnpm i -g @openai/codex
Aideraiderpython -m pip install aider-install && aider-install
Antigravityagycurl -fsSL https://antigravity.google/cli/install.sh | bash
OpenCodeopencodenpm i -g opencode-ai
Cursor Agentcursor-agentcurl https://cursor.com/install -fsS | bash
Droiddroidcurl -fsSL https://app.factory.ai/cli | sh
Copilot CLIcopilotnpm i -g @github/copilot
Grok CLIgrokcurl -fsSL https://x.ai/cli/install.sh | bash
Ampampnpm i -g @sourcegraph/amp
Qwen Codeqwennpm i -g @qwen-code/qwen-code
A CLI that works in Terminal but not here

An app launched from the Dock inherits a minimal PATH, which is the usual reason a GUI wrapper cannot find a CLI installed through nvm, asdf, mise or Homebrew. DeckSpace works around it by asking your login shell for its real PATH once at startup (capped at 1.5 seconds so a hung shell cannot block the first pane) and merging in ~/.local/bin, ~/.cargo/bin, ~/.bun/bin, ~/.npm-global/bin, ~/.deno/bin, ~/.volta/bin, the mise shims, /opt/homebrew/bin and /usr/local/bin. If your CLI is somewhere else, register it as a custom agent with an absolute path.

Where DeckSpace keeps things

Everything the app owns is under one folder, ~/Library/Application Support/ai.opxera.deckspace/:

PathWhat it holds
opxspace.dbSQLite: the board, swarm messages, background jobs, indexes. Survives restarts.
entitlement.jsonYour licence key and this Mac’s activation token.
ai-settings.jsonProvider settings and API keys.
sessions/Per-workspace layout snapshots — panes, working directories, theme — so a workspace reopens as you left it.
models/ggml-*.binSpeech models, downloaded on demand when you turn dictation on. Not part of the installer.
tts-cache/Generated speech audio, size-capped and pruned oldest-first.
global-memory/.opxmemory/The machine-wide memory vault. Per-workspace memory lives in the repo instead.
skills/, providers/, custom-agents.jsonYour global skills, custom providers and custom agent CLIs.

Two things land in your repositories rather than here, and both are visible files you can read and delete: .opxmemory/ (that workspace’s memory notes, plain markdown) and .deckspace/ (skills and providers you chose to save with the repo). To uninstall, quit the app, drag it to the Trash, and delete the support folder above.

Windows and Linux

There is nothing to download

From 3.7.0 DeckSpace ships on all three platforms. Continuous integration now uploads the Windows and Linux installers instead of discarding them, and the download page serves the right file for the visitor’s OS. What still differs between platforms is listed below — those differences are real, and worth reading before you install.

PlatformStateInstaller
macOS 12+shipping signed, notarized, universalDeckSpace.dmg
Windows 10/11shipping installer + MSI — not code-signed yetDeckSpace-Windows-Setup.exe, DeckSpace-Windows.msi
Linuxshipping no auto-update.AppImage, .deb, .rpm

Windows: the installer is not code-signed yet, and Windows will say so. You will see a blue full-screen panel reading “Windows protected your PC”. Click More info, then Run anyway. That screen is SmartScreen reporting that the file carries no publisher signature — it is not a virus warning and it is not about this particular download. A code-signing certificate is being obtained; until it is in place every Windows build shows this, and we would rather tell you here than have it surprise you. The macOS build is signed and notarized by Apple and shows nothing of the kind.

Every download still goes through the order check — there is no public release link, because a public release link is an ungated download. The installers are served by download.php, which verifies the order first. Up to and including 3.6.0 the Windows and Linux artifacts were built on every tagged release and then discarded, which is why no installer existed for them; from 3.7.0 they are uploaded and served.

Known gaps on those platforms, so the wait is an informed one:

AreaLinuxWindows
Write fence around agentsNeeds bwrap installed; without it panes still open, unfencedA restricted-token fence, reported only once a planted violation has been watched to fail on your machine. The shell command guard runs here too, in PowerShell — a destructive git typed into an agent pane is refused, the same as on macOS and Linux. It cannot run under cmd.exe, which has no way to host it, so panes there are unguarded and say so.
Auto-updateNot on the channel. New versions mean reinstallingNot on the channel yet
Tray iconGNOME has no tray by default; needs an AppIndicator extension
ScreenshotsNeeds grim/slurp, gnome-screenshot or spectacle on Wayland; maim, scrot or import on X11
Dictation insert, global hotkeysX11, and Wayland through the desktop's GlobalShortcuts portal (GNOME, KDE, Hyprland). Your desktop owns the binding, so you set it there, not here. wlroots compositors such as Sway and river ship no portal backend and get neither.
Bundled browser-testing enginemacOS onlymacOS only

Where the missing pieces are optional, the app runs and explains what is absent in a toast rather than failing quietly. That is the same choice the sandbox makes: it degrades rather than refusing to start, which is convenient and is also why walk-away is not equally safe everywhere.

One Intel binary is left

Rosetta, for one feature

Version 3.6.0 is the first universal build — the app itself runs as native arm64 on an M-series Mac. The bundled browser-testing engine is still an Intel binary, so that one feature asks macOS for Rosetta the first time you use it. Nothing else does. This stays disclosed until a native build of the engine exists.

After it opens