I cannot bring myself to trust unreviewed software enough to install it on my own machine with arbitrary permissions. I understand the push for AI-generated websites, because the code running in my browser's sandbox is gonna have very limited permissions to do anything evil, but desktop apps are a completely different story

I feel you! We thought about this and all apps will have a permission model. So you can limit it to specific file disk locations, domains for network requests, and so on.