April 2026 walkthroughLockfile evidencemacOS consumer

The open source AI projects on GitHub a real Mac app pinned in April 2026, with the file paths a reader can verify

Most coverage of the April 2026 open source AI tooling cycle is a list of GitHub repositories and star counts. Useful for browsing. Less useful for understanding what those repositories actually look like when a non-developer puts them to work. This page is the other half of that story: which of those open source projects a shipping consumer macOS app, Fazm, pinned during the month, the lockfile lines that prove it, the user-visible JSON config that mirrors Claude Code, and the bundled markdown skill folder that totals

4,523 lines across 17 files

.

The whole walkthrough is anchored to one repository on disk. Every claim below points at a path under /Users/matthewdi/fazm/ on the developer machine that built the binary you can install today, or at a line in the public CHANGELOG inside that repository. Read it end to end and you can run the same checks yourself with cat and wc -l.

M
Matthew Diakonov
11 min read
4.8from App Store reviews
Lockfile pins three GitHub-tracked AI tooling packages: claude-agent-acp 0.29.2, claude-agent-sdk 0.2.112, playwright/mcp 0.0.68
17 plain-markdown skill files at Desktop/Sources/BundledSkills/, 4,523 lines total
User MCP server config at ~/.fazm/mcp-servers.json, paste-compatible with Claude Code

Section 1 — The lockfile is the receipt

Fazm is a SwiftUI app for macOS, but the agent that does the actual model and tool work runs as a Node sub-process called acp-bridge. That sub-process has its own package.json and package-lock.json, and those two files are the receipt for which open-source AI projects on GitHub are wired in this month. Below is what that lockfile literally contains for the four packages that matter to this topic. The version numbers, integrity hashes, and registry URLs are real and unedited.

acp-bridge/package-lock.json (excerpt)

The line that ties everything together is the transitive dependency on @anthropic-ai/claude-agent-sdk 0.2.112, which then depends on @modelcontextprotocol/sdk at any 1.29.x or higher. Those four packages are the GitHub-side surface area of this consumer app for the month.

Section 2 — Four pinned upstreams, named

Each of the four pins is a separately maintained open project on GitHub. The accent letters are just initials so they line up; the version on each card is what is actually in the lockfile that built the .app you can download today.

GitHub-tracked dependencies

Pinned in acp-bridge/package-lock.json

@agentclientprotocol/claude-agent-acp

v0.29.2 — agent-side ACP transport, Apache-2.0

@anthropic-ai/claude-agent-sdk

v0.2.112 — TypeScript SDK for the Claude agent

@playwright/mcp

v0.0.68 — Microsoft Playwright bridge spoken over MCP

@modelcontextprotocol/sdk

^1.29.0 — MCP TypeScript SDK pulled by claude-agent-sdk

Section 3 — One month, four releases, every one of them named

The CHANGELOG.json file at the root of the Fazm repository is machine-readable and reads in chronological order. Below is the April 2026 slice with each release tied to which open-source upstream it touched.

April 2026 release walk

1

v2.4.0 — April 20, 2026

The transparency release. Three open-source npm packages move from hidden to user-visible, with a new JSON config and a Settings panel.

  • Upgraded @agentclientprotocol/claude-agent-acp to v0.29.2.
  • Switched the AI-model picker from a static Swift array to a list streamed live from the agent SDK, so newly released models reach users without an app update.
  • Added ~/.fazm/mcp-servers.json with a Settings UI; schema mirrors Claude Code's mcpServers exactly.
2

v2.4.1 — April 22, 2026

Hardening pass on the new dynamic-model path. Fixes the case where Anthropic returns a partial model list and the pill labels drift.

  • Fixed model label showing “Smart” for Sonnet users when the upstream agent reports an incomplete list.
  • Fixed onboarding chat splitting into multiple bubbles when tool calls arrive interleaved with text.
  • Stopped a revoked sign-in from looping in the background; the app signs you out instead.
3

v2.4.2 — April 26, 2026

Seven lines of Swift that quietly migrate a stored UserDefaults value forward across the protocol upgrade. Without it, every upgrader would have lost their Smart pill label.

  • Migrated persisted preference opus to the new ACP alias default on first launch after upgrade.
  • Renamed Open to Select in the workspace directory picker.
  • Updated the Custom API Endpoint help text to mention local LLM bridges as a valid example, since the bridge sub-process accepts any OpenAI-compatible endpoint a user points it at.
4

v2.5.0 — April 27, 2026

Restored the visible signal that an agent is in control of a browser tab. Plus quality-of-life fixes the previous month had piled up.

  • Restored the browser overlay that signals when the agent is driving a Chromium tab through Playwright MCP.
  • Persisted timed-out and error messages across app restarts.
  • Pre-filled the user's email at checkout, accepted promo codes, and removed the dead Help Center link from Settings.

Section 4 — The MCP config file the user can actually open

Most consumer AI Mac apps that integrate external tooling do it through a hidden, app-local sandbox path with a proprietary JSON shape. The 2.4.0 release went the opposite direction. The user file lives at ~/.fazm/mcp-servers.json (created by MCPServerManager.swift line 41 to 43), and the schema is the same one Claude Code already uses for its own mcpServers block: name, command, optional args, optional env, optional enabled.

That single decision is the whole reason an MCP server published on GitHub this week with a one-line npx invocation in its README slots into Fazm with no rewriting. The right side of the toggle below is unedited from the schema in the Swift source.

MCP config: closed shape vs. paste-compatible

// Hypothetical proprietary format
// (what other consumer apps tend to ship)
{
  "integrations": {
    "playwright": {
      "type": "external",
      "binary": "/Applications/X.app/Contents/.../bin/playwright-mcp",
      "params": ["--headless", "--port", "9001"],
      "credentials_blob": "<encrypted>",
      "internal_id": "0xA1F3"
    }
  }
}
-18% more readable

Section 5 — The skill bundle, line counted

The other half of the “you can read what is bundled” decision is the skill folder. Every file below is plain markdown with a YAML frontmatter block at the top, sitting at Desktop/Sources/BundledSkills/. Run wc -l Desktop/Sources/BundledSkills/*.skill.md on the repo today and you get exactly the line counts below, in this order, with a 4,523 total at the bottom. On first launch each one is SHA-256 hashed and rewritten into ~/.claude/skills/<name>/SKILL.md, so any other Anthropic agent on the same Mac sees them too.

17 .skill.md files, 4,523 total lines

  • deep-research.skill.md (856 lines)
  • travel-planner.skill.md (534 lines)
  • docx.skill.md (481 lines)
  • doc-coauthoring.skill.md (375 lines)
  • pdf.skill.md (314 lines)
  • social-autoposter.skill.md (302 lines)
  • xlsx.skill.md (291 lines)
  • social-autoposter-setup.skill.md (274 lines)
  • pptx.skill.md (232 lines)
  • telegram.skill.md (203 lines)
  • find-skills.skill.md (148 lines)
  • google-workspace-setup.skill.md (132 lines)
  • canvas-design.skill.md (129 lines)
  • video-edit.skill.md (105 lines)
  • web-scraping.skill.md (58 lines)
  • ai-browser-profile.skill.md (47 lines)
  • frontend-design.skill.md (42 lines)

If a folder of seventeen plain-text files seems unglamorous next to a glossy GitHub trending list, that is the point. None of these are hidden behind a closed prompt; the user can open any one of them in TextEdit, swap a line, and re-run. The format is the same one the open agent ecosystem on GitHub has converged on this year.

Section 6 — Where the consumer surface differs from a typical desktop AI app

The table below is the angle of this whole page in one block: there are several decisions a consumer app can make about how to consume open source AI tooling on GitHub, and most apps make the closed choice silently. The right column is what Fazm actually shipped this month, with the file or pin that proves it.

FeatureTypical consumer AI Mac appFazm in April 2026
GitHub-tracked open agent runtimeBundled, version not user-visiblePinned in acp-bridge/package-lock.json: 0.29.2
MCP server config formatCustom JSON or proprietary UIMirror of Claude Code mcpServers, paste-compatible
Bundled agent skills as plain markdownClosed prompts, baked into the binary17 readable .skill.md files, 4,523 total lines
Update path for new upstream modelsWait for an App Store releaseDynamic model list streamed live from the agent SDK
On-screen context for the agentRepeated screenshots of the active windowLive macOS accessibility tree, structured roles and values
Where user MCP servers liveHidden, app-local sandbox path~/.fazm/mcp-servers.json, editable in any text editor

Comparison is based on what Fazm 2.5.0 shipped between April 20 and April 27, 2026, and on patterns common in other macOS AI clients.

Section 7 — Why this is not a screenshot agent

A natural reading of “AI agent that uses my Mac” is that something is taking screenshots in a loop and asking a vision model to read them back. The bundled web-scraping and floating-bar paths in this codebase do not work that way. The default screen-context path reads the live macOS accessibility tree of the frontmost app, which gives the agent labelled, addressable elements with roles, values, and parent-child relations. Compared to a screenshot loop:

  • Faster. An accessibility tree of a typical document window serializes in tens of kilobytes. A high-resolution screenshot is hundreds of kilobytes once base64-encoded for an LLM.
  • Smaller in tokens. The agent reasons over labels, not pixels, so the same “click the second row” instruction costs a fraction of the input tokens.
  • Deterministic. Dark mode, retina scaling, font size, and theme accents do not change the structural answer. A screenshot loop can see a different image for the same logical state.
  • Works on any app. Most macOS apps expose an accessibility implementation; the approach is not limited to Chromium or to web pages. Screenshot-only loops effectively only work where OCR already works.

The Playwright MCP pin from Section 1 still exists for one reason: a live web page in a logged-in browser tab is the one place where the accessibility tree is missing a piece (cookies, network state, page chrome) and a real Chromium-controlled session is the right tool. The two paths coexist, and the agent picks the appropriate one per task.

Want a walk through the lockfile and the skill folder live

Fifteen minutes. We open the repository, run wc -l on the bundle, paste an MCP server line from a public GitHub README into ~/.fazm/mcp-servers.json, and watch it appear in the active server list.

Frequently asked questions

Which open-source AI packages does Fazm actually pin in its lockfile in April 2026?

Four. The acp-bridge subprocess inside Fazm is a Node project, and its package-lock.json declares: @agentclientprotocol/claude-agent-acp at version 0.29.2, @anthropic-ai/claude-agent-sdk at 0.2.112, @modelcontextprotocol/sdk at any 1.29.x or higher (transitively pulled by claude-agent-sdk), and @playwright/mcp at 0.0.68. The first three are the open Anthropic and ACP toolchain. The fourth is the Microsoft Playwright MCP server. All four resolve to public npm tarballs whose source repositories live on GitHub. None of them are vendored or forked; the consumer Mac app installs them at their published version on every clean build of the bridge.

Where on disk does the Mac app store user-defined MCP servers, and is that file portable to other Anthropic agent setups?

It stores them at ~/.fazm/mcp-servers.json. The file is created by MCPServerManager.swift in /Users/matthewdi/fazm/Desktop/Sources/MCPServerManager.swift and uses an exact mirror of Claude Code's mcpServers JSON shape: each top-level key is a server name, each value is an object with command, optional args, optional env, and optional enabled. That means an MCP server entry that works in Claude Code's own .claude.json works in Fazm with no rewriting, and vice versa. If you publish an MCP server on GitHub with a one-line npx invocation in your README, that line is the value of command in both files.

How many open-source-style markdown skills does Fazm bundle as of April 27 2026, and what is the total line count?

Seventeen files at /Users/matthewdi/fazm/Desktop/Sources/BundledSkills/, totalling 4,523 lines. The largest is deep-research.skill.md at 856 lines. Then travel-planner at 534, docx at 481, doc-coauthoring at 375, pdf at 314, social-autoposter at 302, xlsx at 291, social-autoposter-setup at 274, pptx at 232, telegram at 203, find-skills at 148, google-workspace-setup at 132, canvas-design at 129, video-edit at 105, web-scraping at 58, ai-browser-profile at 47, frontend-design at 42. Each file is plain markdown with YAML frontmatter, readable by any human and any LLM, and free to fork or remix.

What changed in Fazm 2.4.0 on April 20 2026 with respect to upstream open-source AI tooling on GitHub?

Three things. One: the Claude agent protocol was upgraded to v0.29.2, which is the @agentclientprotocol/claude-agent-acp package on npm and the agent-client-protocol repository on GitHub. Two: the available-AI-models picker stopped being a static array baked into the Swift binary and started populating from whatever the agent emitted at session start. So when Anthropic flipped a new model on the SDK side, Fazm picked it up the same day, with no App Store push. Three: a new ~/.fazm/mcp-servers.json file became the source of truth for user-defined MCP servers, with a Settings UI to add, edit, and toggle them, and the JSON shape was deliberately Claude-Code-compatible to keep the format portable.

How does the bundled skill list get from the .app bundle into the agent runtime on first launch?

SkillInstaller.swift in /Users/matthewdi/fazm/Desktop/Sources/SkillInstaller.swift does the work. On first launch it ensures ~/.claude/skills/ exists, then iterates every *.skill.md file inside the app bundle's Resources/BundledSkills folder. For each one it computes a SHA-256 digest of the bundled file and a SHA-256 digest of the installed file at ~/.claude/skills/<name>/SKILL.md. If the digests differ, the bundled version is copied forward. If they match, the file is skipped. There is no version flag and no manifest; the hash is the version. A skill update therefore ships in a normal app update without any user action and without needing the agent to be online.

Why pin @playwright/mcp specifically, and what does the consumer app use it for?

Because Playwright MCP is the open-source bridge that lets a Claude agent drive a real Chromium tab through a stdio-spoken MCP interface. Pinning it at 0.0.68 means the bridge sub-process knows which build of the Playwright server is wrapped in this release of Fazm, so a regression in the upstream npm package does not silently move under the user's feet. Inside the Mac app the bundled web-scraping skill leans on it for headed runs, the bundled social-autoposter skill leans on it for actually posting in a logged-in profile, and the floating control bar uses it whenever a user asks the assistant to do something on a website that needs cookies and login state.

Is the Mac app reading my screen as image bytes, or is it pulling structured information out of macOS's accessibility layer?

The screen-context path is structured. The floating bar can capture a window image when the user explicitly asks for one through ScreenCaptureManager.swift, but the default path that an agent uses to know what is on screen reads the live macOS accessibility tree of the frontmost app. That means the agent sees buttons, text fields, table cells, and table contents as labelled, addressable elements with roles and values, not as pixels. Compared to a screenshot-only loop, this is faster, smaller in tokens, deterministic across themes and color schemes, and works on any app that has an accessibility implementation, not just web pages running in Chromium.

If I want to point Fazm at a brand-new MCP server that landed on GitHub this week, what do I actually have to do?

Open Settings, scroll to the MCP servers panel, click Add, and paste the same fields you would put under mcpServers in a Claude Code config: name, command, optional args, optional env. Save. The bridge sub-process picks it up on the next session start. If you prefer to edit JSON directly, open ~/.fazm/mcp-servers.json in any editor; the file format is documented at the top of MCPServerManager.swift and matches Claude Code's mcpServers exactly, so a config copied from a public README on GitHub is paste-compatible.

Did the agent client protocol upgrade in 2.4.0 break older user state, and how was it handled?

It nearly did. Before the upgrade the user's preferred model was persisted as the literal string 'opus' in UserDefaults. After the upgrade the protocol started using a new alias, 'default', for the dynamic Smart pill. Without a migration anyone who upgraded would have seen their Smart preference silently revert to whatever the new default was, and the pill would have lost its label. Version 2.4.2 on April 26 shipped a small migration in Swift that maps a stored 'opus' value forward to the new ACP alias on first launch after upgrade, so the pill stays Smart and the model stays Opus. The full release note in CHANGELOG.json reads: 'Fixed Smart (Opus) model preference not persisting after app update — now correctly maps stored opus to the new ACP model ID'.

Is the bundled skill bundle just a copy of skills that already exist on GitHub, or are these original?

Mixed. Some are original to this codebase (social-autoposter, travel-planner, ai-browser-profile, deep-research as written here). Others reflect well-trodden community patterns adapted into the same skill.md frontmatter format. All seventeen are stored as ordinary markdown so that a curious user can open one in TextEdit and read it, fork it, or replace it. Once installed at ~/.claude/skills/<name>/SKILL.md they are also visible to any Claude agent the user runs outside Fazm, including the Anthropic CLI, which is the same convention the open agent ecosystem on GitHub has settled on this year.