Netrunner: an AI agent inside PosterChan that asks before it touches anything

• How a run works
• Where the work runs
• Nostr, through your own signer
• Making pictures, songs and video
• AI on this computer
• Our own GPUs
• Coming next

Today poster.place got a new app called Netrunner. It’s an AI agent in the spirit of opencode: you tell it what you want done, and it works through it step by step, reading files, running commands, writing notes, posting to Nostr. The difference from a chat window is that it actually does the work. The difference from most agents is that every change waits for you to say yes.

It’s in the sidebar, in the start menu on the desktop, and as a tile in the Android app. On a phone it’s full screen.

§How a run works

You pick what Netrunner works on, type a goal and press JACK IN. The model on my server plans the next step and asks for a tool. Reading is free: listing a folder, opening a file, searching, reading your timeline. Anything that changes something stops and shows you a card first.

For an edit, the card is the diff. For a command, it’s the command. You press Approve, Reject, or set an “always” rule for that project. If you reject, nothing happens and the model is told so it can try something else. When it’s done you get a TASK COMPLETE line with what it did, or FLATLINED if it couldn’t.

A few things I made sure of:

• The device that runs a tool checks it again. When a tool runs on your machine, the server only proposes it. Your client runs a write or a command only if it approved that exact call itself, and it re-checks the folder lock and the deny list every time, so a server asking for something you never approved gets refused.
• There’s a deny list. Commands that wipe a machine or its data are blocked outright and can’t be approved. Commands it can’t fully read (an unclosed quote, a nested bash -c) are always asked, never auto-approved.
• Your history is yours. Each session is saved as a Nostr document encrypted to your own key, so Recent sessions follows you to your other devices and the server can’t read it back. The server does see the conversation while it runs, because it runs the model. I’d rather say that plainly.
• Idle means idle. While nothing is running, Netrunner makes no requests and nothing animates.

§Where the work runs

There are three places a run can happen:

• A folder on this computer. In the desktop app (Windows, macOS, Linux) and on PosterChanOS, you point Netrunner at a project folder. The tools run on your machine, locked to that folder. “Open in Code” opens the same project in PosterChan Code.
• A server workspace. The web and the phone don’t have a machine of their own, so a node can give each member a small box: a container with no network, a read-only system, no privileges, 1 GB of memory and one CPU, and exactly one folder mounted, your PosterChan Code workspace. It’s off until the admin turns it on, and on poster.place I haven’t switched it on yet.
• My servers. Admins can point it at a node from Remote Node Management. That’s for me, not for members.

§Nostr, through your own signer

The part I use most is Your PosterChan apps. Here Netrunner works with the apps instead of files: Nostr, Communities, Notes, Calendar, Settings, and on the desktop your windows and files. On the desktop every window’s title bar also has a Netrunner button: it moves the window to the left, opens Netrunner beside it, and starts with that app’s tools.

It can read your timeline, your notifications, a thread, a profile, search, your follows, mutes and bookmarks. It can draft a post, a reply, a quote, a reaction, a repost, a DM, a follow, a mute, a bookmark, a profile edit, or a message in a Concord channel.

Netrunner never sees your nsec. It doesn’t read your key, store it, or receive it. Its tools go through the same code the app’s own buttons use, and signing happens wherever your account already signs: a local key, a browser extension (NIP-07), a remote signer (NIP-46) or an Android signer app (NIP-55). There’s a test that reads Netrunner’s code token by token and fails if it reaches for anything key-shaped, and another that checks no card or tool result contains the secret.

The card is the event. Before anything is signed it shows the kind, the exact text, every tag and which relays it goes to, and Approve publishes that exact object. @name becomes a proper mention, #tags become t tags. Follows, mutes and bookmarks are read and rebuilt the same way the follow button does it, and checked again at Approve, so it can never write a blank follow list over yours. A DM card shows the message and who it’s for. A Concord message goes into the channel’s composer and you press Send yourself.

Every public write is asked every time, with no “always allow”. After publishing, it tells the model relay by relay: accepted, refused and why, or no answer. And it can’t spam: at most 5 posts, replies, reactions or DMs and 10 list changes per session, 20 sends an hour per account, and never the same text twice in a session. Zaps are read-only. Nothing in Netrunner sends money.

§Making pictures, songs and video

Netrunner can also create: an image, a song, a video, a voice clip from a sample, or one of the meme effects. The card shows the exact prompt and what to avoid before any GPU time is spent.

This always runs on the server, whatever GPU your own machine has. It goes through exactly the same path as typing the command in AI chat: the same access check, the same load balancing across my nodes, the same GPU lock. One creation at a time per person. The result comes back in the run with Save to Files and Open in Meme Builder, and Netrunner can attach it to a post, which of course is asked first.

§AI on this computer

On PosterChanOS and the desktop app there’s a switch on the start screen: AI: Server | This computer. With “This computer”, the agent’s model runs on your own GPU instead of my server, and Netrunner works with the network off.

• It picks a model that fits your GPU’s memory, using the same rules the server uses, and downloads it once, checked against a pinned SHA-256.
• The model server listens on 127.0.0.1 only, on a random port, with a key made for that launch. The page never learns the port or the key.
• It runs only while Netrunner is asking it something and exits after each answer, so your GPU is free for everything else.
• On PosterChanOS it’s a package in our overlay (posterchan-llama-server, Vulkan, so AMD, Intel and NVIDIA all work). On Windows the desktop app downloads the Vulkan build and tells you if a runtime is missing instead of failing silently.
• The run loop moves into the page. It’s a port of the server’s engine, and a test feeds the same model replies to both and checks they behave identically.

Image, music and video creation still go to the server. So far I’ve tested this against a stand-in model; the first run on real hardware is next.

§Our own GPUs

None of this goes to OpenAI or any other cloud. The server side runs Qwen3.6-35B-A3B on llama-server, on my own hardware at home: an Intel Arc A770 in one box and an RTX 3060 in the other, shared with chat, images, music and video. The model isn’t kept loaded when nobody is using it, because that one GPU per box has other work to do. It’s available to members of the instance (anyone with a NIP-05 name here), the same as AI chat.

§Coming next

A rework is already planned:

• The AI Assistant’s agent work becomes interactive Netrunner sessions, so there’s one agent with approvals everywhere instead of two different ones.
• Sessions run in stock Debian containers.
• You’ll be able to export what a session made to your Files drive.

That’s not shipped yet. When it is, I’ll write about it.

Netrunner is open source in the PosterChan repo, with the rest of PosterChan.