{ Introduction }

Codira is an ai-native macOS IDE. A team of agents — a Planner, an Implementer, a Reviewer, a Security checker, and a QA reviewer — work together on every change you ship. You watch them work, approve or reject their output, and ship with confidence that nothing unexpected slipped through.

It's not another autocomplete IDE with more buttons. It's a different mental model: plan first, write second, review always, ship cleanly.

Getting Started

Install

1. Download Codira from codira.com/download.
2. Open the DMG, drag Codira.app to your Applications folder.
3. Launch from Applications or Spotlight.

macOS 11 Big Sur or later. Universal binary — runs natively on both Apple Silicon and Intel Macs.

First Launch

You'll see a three-step onboarding modal:

1. Welcome — one-screen overview of how the agent team works.
2. Sign in — sign in to Codira to get the agent team running on your credit wallet. Your 7-day Pro trial includes enough credits to try the first few /plan runs. If you'd rather use your own Anthropic / OpenAI keys, click Set up later in Settings — Codira lands in the workbench with a lockout that points you at Settings → API Keys to paste keys, then unlocks.
3. Get started — final tips, then the workbench loads.

You can switch between hosted credits and BYO keys any time in Settings → API Keys. Both modes route through the same five-agent loop.

Your First Project

Click Create New Project from the empty explorer panel. Pick a framework (Next.js recommended for first-timers — it's the default). Name your project. Click Create.

Codira spawns a terminal session, runs the framework's scaffold CLI, streams progress live in the wizard, and auto-opens the new folder as a workspace when package.json lands.

Your First ai Run

Four ways to invoke the agent team — each sized to the kind of change you’re making:

Try this: open any file, press ⌘K, type "add a 2-line docstring at the top explaining what this file does", hit ⌘↩. The agent team plans → writes → reviews → shows you a diff. Click Apply to write it; click Reject to discard.

How Codira Works

The Agent Team

Codira's secret isn't a smarter single model. It's a team of nine specialized agents, each with one job and a different vantage point. They hand off to each other so no single model has to be good at everything:

Single-model IDEs ask one model to "do everything." That works for autocomplete but breaks at the shape of larger changes — the model invents files that don't exist, deletes code that wasn't related, can't explain what it just did.

Codira's team produces visibly better output on non-trivial tasks because each agent has one job and a different vantage point.

Plan-First Workflow

Every Codira change starts with a plan. Even ⌘K edits go through Plan → Implementer.

A plan is structured JSON the Planner produces:

{
  "goal": "Add login form with email validation",
  "steps": [
    { "id": "s1", "title": "Add validation helper",
      "files": ["src/lib/validation.ts"] }
  ],
  "filesToTouch": ["src/lib/validation.ts", "src/components/LoginForm.tsx"],
  "assumptions": ["zod is already a dependency"],
  "risks": ["existing LoginForm may have its own validation already"]
}

You see the plan before anyone writes code. If the planner misread your intent or wants to touch the wrong files, you fix it cheaply at plan time instead of expensively after.

Patch Guards

Five deterministic safety nets fire on every patch the Implementer produces. They run automatically, never get tired, don’t care what the model “intended,” and they’re LLM-free — just parsers and diff analyzers in TypeScript, so their findings are ground truth the Reviewer treats as facts:

• PRESERVATION guard — Catches dropped exports. If the model was asked to “add a feature” but its patch silently removes the file’s existing named exports, that’s a flag. The classic “add became rewrite” failure mode.
• DEL guard — Catches unrelated deletions. If the model removes 50 lines from a file you didn’t mention, that’s a flag.
• GROUND guard — Catches hallucinated references. If the patch references useAuthContext() but no such symbol exists in your codebase, that’s a flag.
• REGEN guard — Catches wasteful rewrites. If the model rewrote 80% of a file to change one function, that’s a flag (advisory).
• STUB guard — Catches placeholder code that looks finished. Empty submit handlers, hardcoded fake data, no-op returns, lists that ignore their input and render “Event at {h}:00” for every hour — that’s a flag.

Findings are surfaced as banners on the patch card. You see exactly what the guards caught. You decide whether to apply, reject, or send it back with critique.

Time Machine

Every ai-applied change is a git checkpoint under refs/codira/cp/*. Open the Time Machine panel (clock icon in the activity bar) to see the timeline.

Each entry shows:

• The user goal that triggered the change
• A diff of what changed
• A one-click Revert button that restores the previous state atomically

Your manually-typed edits aren't checkpointed (your git history covers those). Only ai-driven changes get the Time Machine treatment — so "undoing ai" is always one click, never "let me figure out what to reset to."

Features

⌘K Composer

The headline feature. Press ⌘K anywhere in the editor.

A focused modal appears in the center of your editor. Type what you want changed. Hit ⌘↩ to run fast (Plan + Implementer) or ⇧↩ to run with full review (adds Reviewer + Security + QA).

The composer:

• Scopes intelligently — if you have text selected, the agent edits just that range (with surrounding context for imports/types). If nothing's selected, it sees the whole file.
• Streams live progress — you watch Planning → Writing → Reviewing happen in real time.
• Shows a diff — per-file collapsible diffs with side-by-side option. Patch guards render as banners above. Review verdicts (Reviewer / Security / QA) get one-line summaries.
• Recommends a verdict — an Apply Decision Pill rolls up every agent verdict and guard result into one call: Ready to apply, Apply with care, or Don’t apply yet — with the specific reasons listed. You always have the final say; the pill never disables Apply.
• One approval applies all changes — the agents may touch multiple files; clicking Apply writes them atomically and captures a Time Machine checkpoint.
• Rejects cleanly — esc closes, discards. Nothing has been written.

Chat Panel

The right sidebar. Three modes:

• Auto — Codira picks the right model per call (cheap for chitchat, frontier for complex work)
• Claude — Forces Anthropic Claude as the responder; best for long-form reasoning, code reading, planning questions
• GPT — Forces OpenAI GPT-4o as the responder; best for code generation, fast turnaround on small edits

Slash commands

Free-form

Anything else is just a chat with the active provider. Ask questions, brainstorm, explain code, debug errors. No plan, no patches, no commits.

Genesis — Multi-Agent Project Foundation

Starting something new? Describe the app in a sentence or a paragraph and Genesis runs the full agent team to lay the foundation — before a single file is written.

Planner, Implementer, and Reviewer work the architecture in sequence; Security, QA, Auditor, and Verifier weigh in parallel; Debugger and Explainer close it out. Genesis synthesizes their output into three artifacts in your workspace:

• .codira/genesis.md — a human-readable architecture brief (stack, data model, key decisions, risks).
• .codira/backlog.json — a starter backlog of stories and subtasks with dependencies.
• .codira/blueprint.md — a plan-ready brief you can feed straight into /plan to start building.

Architect — Visual Stack & Schema Designer

Click the network icon in the activity bar. Full-screen modal opens.

Three tabs:

Stack

Drag-and-drop from a curated palette of ~50 tech tiles — frameworks, databases, ORMs, auth providers, payment processors, hosting platforms, more. Connect tiles to show dependencies. Each tile carries its install command and docs link.

Schema

Add entity nodes (User, Order, Product…). Edit fields inline with type dropdowns (string, int, datetime, uuid, json, etc.). Click chip toggles for primary key, unique, nullable. Drag from one entity's edge to another's to create relationships (1:1, 1:N, M:N — click the edge label to cycle).

Notes

Free-form architecture context. "Multi-tenant by user_id." "No MongoDB." "Targets p95 < 1.5s." Anything that helps the Planner make better decisions.

Why it matters

The Architect doc is saved to .codira/architect.json in your project (commit-friendly). On every /plan and ⌘K Composer run, the Planner reads it — so plans respect your stack choices and reference your real schema by name, instead of hallucinating tables or libraries.

Generate Files

The Schema tab has a Generate Files button (top-right) that turns your visual design into real code dropped into your project. Pick one of five formats + a target path:

• Prisma schema — Postgres datasource preconfigured, lands at prisma/schema.prisma
• SQL migration — Postgres CREATE TABLE DDL with FKs + join tables, topologically sorted
• Drizzle ORM — pg-core helpers, composite-PK M:N join tables, lands at src/db/schema.ts
• TypeScript types — plain export interface per entity, no ORM, lands at src/types/schema.ts
• Markdown docs — README-style table-per-entity format, lands at docs/SCHEMA.md

The file lands as a pending patch card in chat — same review/apply/checkpoint flow the ai agents use. Re-generating against an existing file builds an update op with expectedBaseline so the preservation guard catches accidental schema regressions.

The original Copy as Prisma / SQL / Markdown clipboard buttons stay for when you just want to paste into an external tool.

Time Machine

Every checkpoint, every diff, every revert.

Browse the timeline (clock icon). Click any entry to expand and see the diff. Revert restores that exact pre-checkpoint state — your files revert, the checkpoint stays in history so you can re-revert (i.e. redo) later.

The Time Machine is project-scoped — each workspace has its own timeline.

Ship Panel

Click the rocket icon in the activity bar.

The Deploy section opens the provider's "import this repo" URL in your browser pre-filled with your repo. You complete the connection on their site (one-time), then every git push from Codira ships a new build.

Tools section — fresh-machine setup

Codira shells out to gh (GitHub CLI) and vercel for the repo / deploy actions. On a fresh Mac neither is installed by default. The Tools section shows each one's state with an Install / Login button:

gh creates repos under whichever account it's authed as — there's no way for Codira to push to an account you don't control. Run gh auth status in the terminal to confirm which account gh is using.

Auto-init git for non-repo workspaces

If you open a workspace that doesn't have a .git directory (e.g. a project you just unzipped or downloaded as a tarball), Codira auto-initializes git + makes a baseline commit ("Initial commit (Codira baseline)") the first time you run an action that needs a repo (Apply patch or Create GitHub repo). Idempotent — workspaces that already have .git + commits are left alone.

Search Panel

Plain find-in-files across your workspace — the magnifying-glass icon in the activity bar. Type a query, results group by file with a one-line preview of each match, click any result to jump straight to the line in the editor.

Search is case-insensitive substring across every text file in the workspace tree (binary files, node_modules,.git, .next, dist, and other generated dirs are skipped automatically). Debounced ~200 ms, so it updates as you type without thrashing on large repos.

Semantic Search

Codira indexes your project the first time you open it as a workspace. Files are embedded with OpenAI's text-embedding-3-small and cached locally at .codira/embeddings.json.

When you /plan or ⌘K, Codira queries the index for the top-3 files semantically relevant to your goal and includes them in the Planner's context. The Planner finds the right file by meaning, not by name — ask for "the file that handles user authentication" and it returns the right file even if it's named realme_common/auth/jwt.py.

Inline Completion

Optional ghost-text autocomplete. Toggle the ai Autocomplete pill at the right side of the bottom panel.

When on, GPT-4o-mini generates inline completions as you type. Press Tab to accept. Default off — many users prefer not to have suggestions interrupting their flow. Daily token cap of 200k prevents runaway usage.

Live Preview

Bottom panel Canvas tab. Codira auto-detects your dev server (npm run dev, expo start, etc.) and renders an iframe pointed at it. You see your app as you build it.

For most apps the iframe is enough. For mobile-specific apps (Expo), click Open in Browser for the real experience — iframes can hide some interactions.

UAT Auto-Run (v0.9.6)

The 5 patch guards catch static failure modes (dropped exports, hallucinated imports, stubbed code). They can’t tell you whether the page actually renders. After v0.9.6, every successful Apply auto-runs an end-to-end smoke check against your live preview:

• Tests fire first (if a test command is detected — npm test, pytest, etc.)
• Then UAT fires against the preview iframe: navigate, wait for body, screenshot, capture console errors
• Pass → green verdict card, done
• Fail → the failure is formatted as critique and fed back to the Implementer for a retry, capped at 2 rounds. New patch surfaces as a regular pending card.

Always-on for v0.9.6 (rationale: prove the safety value before adding a knob). Settings toggle to disable comes in v0.9.6a. Skipped silently when no dev server is running.

You can also trigger a UAT manually with /uat <goal> (independent of any patch).

Debugger — “Explain failure” (v0.9.10)

When a test or UAT fails, you don’t have to read raw error tails or wait for the auto-retry to guess at a fix. Click Explain failure on the failed card — the Debugger agent (9th in the lineup) analyzes the failure and emits a structured DebugAnalysisCard:

• Root cause — 1-2 sentences on the underlying reason, not just the symptom
• Execution trace — numbered steps with file:line refs tracing how the failure happened
• 2-3 candidate fixes — each with name + description + honest tradeoff + an Apply this fix button

Click a fix → the Implementer runs with that fix’s critique as the directive → new pending patch through the 5-guard pipeline. Teaches you what broke and why, rather than silently retrying. Manual-trigger by design (saves the Debugger LLM call for failures the user actually wants to understand).

UI Editor Quick Edits (v0.9.7)

Click any element in the live preview with Edit UI mode on. The UI Editor panel opens with a new Quick edits section between the read-only computed styles and the free-form prompt textarea. Direct controls for the 7 most-edited properties:

• Padding / Margin / Font-size / Border-radius — px steppers (±4 nudge, type-in input)
• Font weight — button group (400 / 500 / 600 / 700)
• Text color + Background color — native color picker + hex input

Controls pre-fill from the element’s computed styles. Nudge one → “Apply N quick edits” button appears → opens Composer with a mechanical prompt (“set padding to 24px; set background color to #1e293b.”). The Implementer’s job becomes transcription, not invention — no ai-guessed values, just exact transcription into the right source file. Still goes through the full 5-guard + reviewer pipeline.

Free-form prompt textarea remains for harder asks (“make this feel premium”). Both Apply buttons coexist — use what fits the change.

Command Palette (v0.12.2)

Press ⌘P from anywhere in the IDE. Fuzzy file-open over the entire workspace — type any subsequence of the file name and the match list narrows live. ↑ / ↓ to navigate, ↵ to open, Esc to close. Sub-200ms cold walk on a 5k-file repo; capped at 10k files.

Rename Symbol (v0.12.12)

Press ⌘⇧R on a symbol in the editor — the Rename modal opens pre-filled with the selection or word at cursor. Type a new name; the preview list updates 350ms after you stop typing, showing every whole-word case-sensitive hit across the workspace, grouped by file.

Per-file checkboxes let you untick files you don’t want to touch. Old → new is rendered inline with a rose strike-through and an emerald insert so you can spot collisions before applying. ⌘↵ applies all selected files atomically (one-by-one, never half-written); any open editor tabs touched by the rename reload from disk.

Find & Replace (v0.12.4)

The Search panel (sidebar → magnifier) has three toggles next to the query input: Aa for case-sensitive, ab for whole-word, .* for full regex. Combine them as needed; invalid regex surfaces inline.

Open the Replace input below the search field. Replace All shows a confirmation toast with the count, then writes each file atomically. The result rows render the substitution inline before you commit — old → new on every match. Regex back-references ($1, $2, $&) work in the replacement string.

Git Blame in the Gutter (v0.12.13)

Click the Blame button (lower-right of the editor, over the scrollbar). Per-line authorship appears in the left margin as <author> · <age>; hover any line for the full commit popup (SHA, author, email, date, summary).

Codira layers the working-tree contents on top of the committed blame, so a line you just edited shows as Uncommitted rather than misattributing to whoever last touched that slot at HEAD. Per-tab toggle — flipping blame on for auth.ts doesn’t blast it across every open file. Results are cached per file × content shape, so toggling off and on is instant on an unchanged file.

Inline Git Diff (v0.12.5)

In the Source Control panel (sidebar), click any file row — a Monaco diff modal opens showing HEAD vs the working tree for that file. Esc closes. Untracked files skip the click (no HEAD to diff against). Binary files are refused with a clear message rather than rendering garbage.

Image-to-Code (v0.12.7)

Paste an image (⌘V) into the Composer — Figma frame, screenshot, mockup. The image attaches as a thumbnail strip above the prompt input. PNG / JPEG / WebP / GIF, up to 4MB each, up to 4 images per run.

When a run launches with image attachments, the planner auto-routes to a vision-capable model regardless of your normal Anthropic / OpenAI pick — and routes back to your normal model for follow-up text-only runs. The provider- specific multi-modal block construction (Anthropic image blocks, OpenAI image_url data URLs) is handled under the hood.

Schema Auto-Load (v0.12.0)

Open a workspace that contains any of:

• prisma/schema.prisma — Prisma
• src/db/schema.ts or similar — Drizzle
• A models.py with SQLAlchemy Base subclasses
• A Django app with models.py defining model classes

— and the Architect schema canvas is populated automatically with the entities, fields, and relationships parsed from your source. No setup, no manual import.

A filesystem watcher fires drift toasts when the schema or package manifest changes after open, surfacing new tables / new dependencies that aren’t yet reflected on the canvas. Click the toast to merge them in.

Sync to Source — Prisma Reverse-Sync (v0.12.14)

Architect schema canvas → top-right toolbar → Sync to source button. Reads your existing prisma/schema.prisma, splices canvas-derived model blocks in place over the matching source blocks, appends new entities at the end, drops entities the user removed from the canvas. Everything else — datasource, generator, enums, comments, blank lines between blocks — passes through verbatim.

Drizzle / SQLAlchemy / Django reverse-sync are not in this cut — each needs its own splicer + emitter pair. Use Generate Files (see Architect) for those ORMs in the meantime.

@web in Chat (v0.12.11)

Type @web <query> at the start of any chat message — Codira runs a DuckDuckGo search server-side (Rust + reqwest, no API key required), posts the top results as a card in the chat, and folds the same hits into the planner’s context block for that run.

Two-clause form for explicit separation: @web rust audio crate without alsa dep; build me a simple sample player. The first clause is what gets searched; the second is the planner’s actual goal, with the search results visible as context.

The directive is user-explicit by design — no silent tool- calls from the Planner. You see what was searched and what was found before the agents start thinking.

Account & Billing

Plans

Every new account starts with a 7-day Pro trial — full access, no card, plus a starter credit grant to use the hosted gateway. When the trial ends, pick a plan to keep the ai features going; your projects, Architect docs, and Time Machine history stay exactly where they are. There's no permanent free tier. Prefer to run on your own keys? BYO is included on every paid plan.

Credits

Codira uses credits as the unit of ai work. 1 credit = $0.01 retail.

Each ai run costs credits based on:

• Which model ran (frontier = more)
• How many input + output tokens
• Whether prompt cache was hit (cheaper)

Typical costs:

Monthly bundled credits: Solo 2,000, Pro 4,000, Team 10,000 per seat (pooled). Every run debits credits from your wallet — so you always see usage and we can throttle abuse — and you can buy top-up packs anytime. BYO keys bypass credits entirely.

Wallet

Open Settings → Account → Credits. You see:

• Current balance
• Lifetime purchased / used
• Last 5 transactions

Updates flow live via SSE — buy credits in your browser, watch the IDE wallet tick up in real time. Run an agent, watch it tick down.

Auto-topup

Settings → Account → Credits → Auto-topup section.

• Enable — toggle on
• Threshold — buy more when balance drops below this (default 500)
• Pack — which pack to buy (Starter $20 / Growth $50 / Scale $100 / Power $250)

Codira charges your default card on file (Stripe). Last-attempt status shows succeeded/failed with the Stripe error if anything went wrong.

Bring Your Own Keys

If you'd rather pay Anthropic/OpenAI directly:

1. Get keys from console.anthropic.com and platform.openai.com
2. Paste in Settings → API Keys

When a BYO key is set for a provider, Codira routes that provider's calls directly (no Codira gateway, no credits debited). The Current Routing card in the same tab shows per-provider status:

• 🟢 direct to OpenAI (your key, no debit) — BYO active
• 🔵 via Codira (debits your wallet) — hosted gateway
• 🟡 not ready — paste a key or sign in — neither

You can BYO one provider and use the gateway for the other. Mix freely.

Buying Credits

Open Settings → Account → Credits → Buy credits ↗ to launch the dashboard in your browser. Pick a pack, pay via Stripe Checkout. Your wallet updates in the IDE the moment you return.

Settings

Themes

Settings → Theme.

• Dark (default) — Photoshop-inspired medium-gray chrome with a dark editor body
• Light — Inverted palette; white editor, light-gray panels
• System — Follows macOS Appearance, including live-flips when you change it in System Settings

Monaco's syntax theme swaps to match.

API Keys

Already covered above. Same tab also shows the Current Routing card — useful for confirming what's billing.

ai Models

Settings → Models. Two dropdowns — one per provider — let you pick the exact model the agent team uses by default. The Planner agent + chat use the Anthropic choice; the Implementer agent uses the OpenAI choice.

Changes take effect on the very next message — no restart. Useful when Anthropic deprecates a dated model variant (just swap to the next available), or when you want Sonnet speed for planning instead of Opus quality.

Env Vars — per workspace, in the Keychain (v0.12.8)

Settings → Env Vars. Per-workspace KEY=VALUE pairs stored in the macOS Keychain (via the keyring crate, apple-native backend) — never in settings.json. Add a key, paste a value, save; the value lives in the Keychain item for this workspace and is materialized to .env.local at the workspace root on save.

.env.local is wrapped in managed-block markers (# >>> codira-managed env vars >>> and the matching close marker) so your hand-edited content above or below the block is preserved. Codira also adds .env.local to .gitignore on first write if it isn’t already ignored.

Values are lazy-revealed in the UI — click the eye icon to show, hides again after you click elsewhere. Vite, Next, Remix, and SvelteKit all pick up .env.local automatically; no extra wiring needed.

This Project — per-workspace overrides (v0.12.15)

Settings → This Project. Per-workspace overrides for the team-coordination fields (models + agentRouting) stored in .codira/settings.json. Commit the file to your repo and every teammate’s IDE (plus any CI run) uses the same per-project routing.

The tab shows two per-provider dropdowns (Anthropic, OpenAI) with an empty “Use global default” option. Pick an override on change and Codira writes the file atomically; pretty-printed JSON so it reads cleanly in a PR. A read-only preview at the bottom shows exactly what’s on disk.

Per-slot agent routing pinnings (e.g. pin Planner to Opus for this repo) are read + enforced today; the visual editor for per-slot edits is a follow-up — hand-edit .codira/settings.json directly:

{
  "version": 1,
  "models": { "anthropic": "claude-3-7-sonnet-20250219" },
  "agentRouting": {
    "planner": { "provider": "anthropic", "model": "claude-opus-4-20250514" }
  }
}

Crash Reporting

Settings → About → "Send anonymous crash reports."

Default on. What we collect:

• Stack traces
• IDE version + OS
• Anonymous user id (random, persisted locally, can't be reversed)

What we never see:

• Your code
• Your chat messages
• Your API keys
• File paths beyond the basename (/Users/jane/secret-project/auth.ts → <redacted>/auth.ts)

Toggle off any time. Takes effect on next launch.

Privacy Policy

Full text at codira.com/privacy.

Keyboard Shortcuts

Project Files

Codira keeps a few files inside your workspace at .codira/:

Edit MEMORY.md, architect.json, settings.json, and standards.md by hand if you prefer — Codira tolerates manual edits and reloads them automatically.

Troubleshooting

I can't sign in — "invalid_client" error

Email support@codira.com. Your OAuth client may not be properly registered on your account.

"Sign in to start using Codira" modal blocks the whole UI

You finished onboarding without picking an auth path (no sign-in, no BYO key). The lockout fires because the agent team can't make ai calls without one. Two options:

1. Sign in with Codira — primary CTA. Opens your browser, signs you in, the lockout dismisses.
2. I'll use my own API keys → opens Settings → API Keys. Paste an Anthropic or OpenAI key (or both); the lockout dismisses the moment a valid key is set.

Your files and projects are untouched while the lockout is up — it only blocks ai features. The editor, terminal, git, and Time Machine all keep working.

My wallet shows 0 but I just bought credits

Click the ⟳ refresh button next to your balance in Settings → Account. Or quit + reopen Codira (forces the SSE channel to reconnect).

Composer is unusable / hangs forever

1. Press Esc or click Stop to bail out
2. Check that you have credits (if signed in) or BYO keys (if not)
3. Try again with a simpler prompt

If a specific kind of prompt always hangs, email support with the prompt — likely a model issue we can route around.

Semantic search "failed: 401 Incorrect API key"

Your stored API key is invalid. Open Settings → API Keys → Clear on the affected provider. The IDE falls back to .env keys (if running from source) or to the hosted gateway (if signed in).

"Module not found" or syntax errors highlighted in valid code

Codira's editor doesn't run a full TypeScript language server against your project. Module imports show no errors (we disabled semantic validation to avoid noise). Syntax errors DO surface. If you need full type checking, run npm run typecheck in the integrated terminal.

Scaffold wizard says "Success!" but is stuck

Should be fixed in v0.5.1+. If you hit it on an older build, click Stop, then in the terminal panel run:

cd /Users/you/Projects        # or wherever you tried to scaffold
ls                            # confirm the project folder exists with package.json

Then open the folder manually via File → Open Folder.

Privacy & Security

What we collect

• Anonymous crash reports (opt-out in Settings → About): stack traces with redacted file paths, IDE version, OS version, anonymous user id.
• Subscription / billing data: through Stripe. Codira sees enough to validate your subscription and meter usage; Stripe handles cards.
• Usage telemetry: which features were used, anonymized. Aggregate-only — we don't tie events to individual users.

What we never see

• Your code. Even when using the hosted gateway, requests pass through unchanged — we don't log, store, or analyze the bodies. The gateway is a thin authenticating proxy.
• Your chat messages. Same as above.
• Your API keys in BYO mode. Those stay on your machine in ~/Library/Application Support/dev.codira.ide/settings.json (chmod 0600).
• Your project file contents. Indexed locally only; embeddings live at .codira/embeddings.json in your workspace.

Where your data lives

Code signing

Beta status: Codira v0.5.x is ad-hoc signed (Tauri's signingIdentity: "-") and not yet notarized with an Apple Developer ID. That means on first launch, macOS Gatekeeper will show a "Codira is from an unidentified developer" dialog.

To bypass on first launch:

1. Right-click Codira.app in Applications → Open
2. Click Open in the dialog that appears
3. If that doesn't work: xattr -cr /Applications/Codira.app in Terminal to strip the quarantine attribute

Subsequent launches don't require the right-click — Gatekeeper remembers your first-time approval. Apple Developer notarization is on the v0.6 roadmap (one-time $99/yr Apple cert setup); once shipped, the unidentified-developer dialog goes away entirely.

Frequently Asked Questions

Is Codira open source?

Codira's core is closed-source. Some adjacent tooling (the ai agent prompt templates, the Architect tile registry) may be open-sourced in the future. The credits + hosted gateway is closed by necessity.

Why does Codira need OAuth?

To verify your subscription, access your credits wallet, and bill correctly for ai runs. Sign-in is required for paid features.

Can I use Codira without signing in?

Yes — on any paid plan (or during your trial), paste your own Anthropic or OpenAI API key in Settings → API Keys. The agent team then runs against your keys directly and bypasses the hosted gateway and credits entirely — you pay the provider directly. (The managed credit wallet is the simpler path for most users; BYO is there when you'd rather bring your own.)

Does Codira upload my code anywhere?

Only to the ai provider you're using (Anthropic or OpenAI), when you run an agent. We don't proxy, store, or log code on Codira's servers — even when using the hosted gateway, request bodies pass through unmodified.

Can I switch between BYO and hosted gateway?

Yes — at any time, per provider. Set a BYO key in Settings → API Keys → that provider routes direct. Clear it → that provider routes via Codira's gateway (if signed in). Mix and match.

What happens if Codira goes down?

If you're in BYO mode: nothing — Codira talks directly to the ai providers. If you're using the hosted gateway: ai features pause until codira.com is back. Your code is unaffected.

How do I export my Architect design?

Architect → Schema tab → Copy as Prisma / SQL / Markdown in the toolbar.

How do I revert a change Codira's ai made?

Time Machine panel (clock icon) → find the entry → Revert.

Does Codira support [other framework]?

Scaffolder ships with Next.js, Vite + React, Expo, SvelteKit, Astro, and Remix. The Architect tile registry covers 50+ tools including Vue, Hono, FastAPI, Tauri, more. Frameworks not in the scaffolder still work — open an existing folder of any framework as a workspace.

Does Codira support Python / Rust / Go projects?

Yes for the editor, ai features, Time Machine, Architect, Ship. The Scaffolder is JS/TS only for now (Next.js, Expo, etc.). Open any non-JS project as a workspace and everything else works.

Can I run Codira on Linux / Windows?

Not today. macOS only for v1 — but the macOS app is universal, so it runs on both Apple Silicon and Intel Macs from one download. Linux and Windows are roadmap items, no timeline yet.

How do I uninstall?

1. Quit Codira (⌘Q)
2. Drag /Applications/Codira.app to Trash
3. Optional: rm -rf ~/Library/Application\ Support/dev.codira.ide to clear settings + chat history

How do I get support?

Email support@codira.com. Include:

• Codira version (Settings → About)
• macOS version
• A reproduction of the issue if possible
• The error toast / message text

For billing / subscription / wallet issues, mention "billing" in the subject — those route to a different queue.

Quick Reference Card

Print this. Stick it next to your monitor.

⌘K           Composer
⌘↩           Run fast (Composer) / Apply (diff view)
⇧↩           Run with full review (Composer)
⌘,           Settings
⌘B           Toggle side panel
⌘S           Save
⌘⇧W          Close folder
Esc          Close modal

/plan <goal>          Multi-file plan + review + apply
/remember <fact>      Append to .codira/MEMORY.md
/analyze              Re-run the project first-look scan

Activity bar (left, top to bottom):
  Folder      Explorer
  Search      Find in files (ripgrep-style)
  Branch      Source Control
  Sparkles    Agents (toggle Reviewer / Security / QA)
  Clock       Time Machine (checkpoints + revert)
  Rocket      Ship (commit, push, deploy)
  Network     Architect (Stack + Schema designer)
  Gear        Settings