Devika Verma
a442e0e0b8
Three gate defects, each verified by direct execution before and after. 1. web_fetch was RiskClass.READ, so is_consequential() was False and evaluate() returned allow on its third rung -- before any rule, mode or PDP, in EVERY mode including plan/discuss. A URL's query string carries data outbound, so this was an ungated egress path. New RiskClass.EGRESS covers model-chosen network reads; web_search stays READ (fixed configured provider, not a model-chosen host). Adds an allowed_domains allowlist (exact host or subdomain; 'evil-python.org' never matches 'python.org'), a session-scoped "always allow this domain" grant, and ApprovalOutcome.ALWAYS_DOMAIN. 2. A risk override could DOWNGRADE a built-in: marking write_file as read made is_write False (skipping path scoping) and consequential False (skipping the read-only gate) at once -- one settings line disabling two protections, in every future session. Overrides may now only tighten a built-in write/exec/ egress tool; relaxing a metadata/MCP tool (the intended use) still works. 3. Path scoping read a literal "path" argument, so apply_patch and apply_unified_diff -- whose paths live inside the patch/diff blob -- were never scoped at all. write_paths() extracts them from the blob and scopes every one; a write whose path cannot be located now fails closed to approval rather than slipping through auto/custom unscoped. allowed_domains is user-global only, alongside auto_allow: a cloned repo must not be able to widen the agent's network reach. Golden matrix: web_fetch interactive allow->ask, plan allow->deny, plus new egress/patch rows (31 rows green). test_permissions_risk's override test asserted the old downgrade behavior and is updated to the tightening rule. Full suite: 22 failures, all pre-existing on the unmodified tree (boto3 absent, Windows symlink privilege, Slack socket timeouts) -- none introduced here. Design of record: ocw-context/docs/reviewed-auto-mode.md Part 3.
OpenWorker
openworker.com · Download · Issues
Beta - OpenWorker is in open beta: fully usable, updates itself, and we're actively polishing rough edges. Issues welcome.
AI that gets your everyday tasks done. OpenWorker is an open-source AI coworker that lives on your desktop and delivers finished work, not just chat: a polished document, a Slack reply with the numbers, an updated calendar, a triaged inbox.
It runs on your machine and doesn't lock you into any model: bring your own API key for OpenAI, Anthropic, Google, or an open-weight provider, or run fully local with Ollama. Your data leaves your machine only through the model and integrations you choose.
Download
⬇ macOS (Apple Silicon) macOS 12+ · signed & notarized · auto-updates
⬇ Windows 10/11 (x64) builds are not yet code-signed, so SmartScreen will warn; signing is in progress
Open the app, add a model key (or point it at Ollama), and ask for something real.
How it works
- Tell OpenWorker the outcome you want - "prepare a customer brief," "untangle my calendar," "draft a report," "check where the release stands across Jira and GitHub."
- It breaks the task into steps and works across your desktop, files, and connected apps.
- Before anything consequential - sending a message, changing a calendar, running a command - it checks in and you approve or redirect.
- You get the finished deliverable, not a to-do list.
Under the hood:
┌────────────────────────────────────────────────┐
│ OpenWorker desktop app │ native shell + GUI
├────────────────────────────────────────────────┤
│ local agent server (Python) │ engine · tools · connectors - built on aisuite
├───────────────┬────────────────┬───────────────┤
│ your files │ your tools │ your model │ everything runs with your keys,
│ & terminal │ 25+ connectors │ any provider │ on your machine
└───────────────┴────────────────┴───────────────┘
What it can do
- Produce real deliverables - documents, spreadsheets, reports, and web pages land as files you can open and share.
- Work from Slack - mention
@OpenWorkerin a channel; a session opens on your desktop, the work happens with your tools, and the answer comes back as a thread reply. - Use your everyday tools - 25+ integrations including GitHub, Slack, Jira, Notion, Linear, HubSpot, Outlook, monday.com, Gmail, and Google Calendar, plus your terminal and local files. Any tool reachable over MCP plugs in too, with per-tool control.
- Run on a schedule - automations for recurring work: a morning brief, a weekly report, a standing watch over a channel. Runs land in the app with full transcripts.
- Ask before acting - writes, sends, and shell commands are approval-gated. Unattended runs park their asks in an inbox instead of acting on their own.
Bring your own model
Model access is yours: pick a provider, paste your key, switch anytime. Supported out of the box:
OpenAI · Anthropic · Google Gemini · Inkling (Thinking Machines) · GLM (Z.ai) · DeepSeek · Kimi (Moonshot) · Qwen · MiniMax · Mistral · Grok (xAI) - plus open-weight models via Together and Fireworks, and fully local models via Ollama.
A curated model list marks what we've verified for tool-calling work. Adding any model string works at your own risk.
Privacy
OpenWorker is local-first. Everything lives on your machine: the agent loop, your conversations, connector tokens, and model keys - all in the app's local secret store. The only cloud piece is a small service that brokers OAuth handshakes for connectors. You can always use the App without signing-in - use the connectors via manually-created credentials/API-keys.
Run from source
Prerequisites: Python 3.10+, Node 20+, and (for the desktop shell) the Rust toolchain via rustup.
git clone https://github.com/andrewyng/openworker
cd openworker
# 1. One-time bootstrap - creates the Python venv at .venv
# (on Windows, run from Git Bash or WSL)
bash packaging/setup_dev_env.sh
# 2. Start the local agent server
.venv/bin/openworker-server --cwd ~/some/project --port 8765
# (Windows: .venv\Scripts\openworker-server.exe)
# 3. In a second terminal, start the UI
cd surfaces/gui
npm install
npm run dev # browser UI on the Vite dev port
The standalone server creates a per-launch token at
<state-dir>/sidecar-8765.token; Vite reads that user-only file when it starts.
For direct API calls, send its value in the X-OpenWorker-Token header. The
desktop app uses an in-memory launch token instead and never writes it to disk.
To run the full desktop app instead of the browser UI, replace step 3 with npm run tauri dev (from surfaces/gui/) - the Tauri shell launches the window and supervises the server itself.
Tests: .venv/bin/pytest (server), npm test and npm run e2e in surfaces/gui (GUI unit + hermetic end-to-end). Desktop bundles are built with packaging/build_dmg.sh / packaging/build_windows.ps1.
Repository layout
| Directory | What's in it |
|---|---|
coworker/ |
Python backend - agent engine, model providers, connectors, MCP client, memory, automations |
surfaces/gui/ |
Desktop app - React UI + Tauri shell that supervises the server |
stt/ |
Speech-to-text sidecar (Rust) for voice input |
packaging/ |
Installer builds (macOS DMG, Windows), auto-update manifest, dev bootstrap |
docs/ |
Design specs and decision logs |
tests/ |
Backend test suite |
Built on aisuite
OpenWorker's engine is built on aisuite, a lightweight Python library providing a unified chat-completions API across LLM providers and an agents layer with tools, toolkits, and MCP support. If you want to build your own agent harness rather than use ours, start there; this repo is a working reference for what aisuite can carry.
OpenWorker was originally developed inside the aisuite repository before moving to its own home here; thanks to the aisuite contributors whose work it builds on.
Contributing
Contributions and bug reports are welcome - open an issue or a pull request. The app updates itself, so fixes reach installs quickly. For any PR, please attach screenshots of what was broken and how it is fixed now. We will shortly add features that you can contribute to. Please note that we are actively developing based off a internal list and goal, so we may not approve PRs that add features that are already under-development or deviates from our vision.
License
MIT - see LICENSE.