OpenWorker

Summary

OpenWorker is an open-source AI coworker that lives on your desktop, delivering finished work like polished documents or updated calendars, and it operates on a free license. The tool runs as a desktop application on macOS and Windows, and it is for general productivity users needing task automation across local files and connected apps. Its documentation positions it alongside general automation frameworks, and it is currently in open beta with active development.

Command line

Values are placeholders taken from each option’s declared default. Nothing is executed here — the output shown is a recording of a run that already happened.

Release history

1. v0.2.1 Aug 25, 2026 · issue 008

   Adds Ox Alpha stealth preview model via OpenRouter with 1,048,576-token context and tool calling support.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v0.2.1 https://github.com/andrewyng/openworker.git
   # already have the repo? check out this version:
   $ git checkout v0.2.1

   └──▷ HOW TO FIND IT
   Select the Ox Alpha stealth preview to run long-context agentic tasks via OpenRouter before the model's official release.
   📍In the model selector, choose 'Ox Alpha · via OpenRouter' from the OpenRouter section of the model list.
   • ›Adds openrouter:stealth/ox-alpha to the model matrix, exposing the Ox Alpha stealth/cloaked lab preview via OpenRouter with a 1,048,576-token context window and tool-calling capability.
2. v0.2.0 Aug 24, 2026 · issue 007

   OpenWorker v0.2.0 adds Memory, Skills, a Responses API provider, BytePlus/Ark integration, persona sharing, and a revamped permission engine.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v0.2.0 https://github.com/andrewyng/openworker.git
   # already have the repo? check out this version:
   $ git checkout v0.2.0

   └──▷ HOW TO FIND IT
   Trigger a session that routes to the new Responses provider with reasoning enabled by leaving the endpoint blank for a native OpenAI model.
   📍In the provider settings screen, select OpenAI and leave the Endpoint field blank — the session is automatically routed to the Responses provider, enabling reasoning and tools.
   Point OpenWorker at a custom Responses-compatible endpoint (e.g. a self-hosted or third-party proxy) instead of the default OpenAI URL.
   📍In the provider settings screen, select OpenAI and enter your custom Responses endpoint URL in the Endpoint field.
   Export a persona bundle to share a coworker configuration — including skills, MCP connectors, and consent metadata — with another user or team.
   📍In the Coworkers panel, open the persona you want to share, then choose Export bundle. The resulting file includes version and consent fields and can be imported on another instance via Import bundle.
   • ›Adds ALWAYS_DOMAIN and READONLY_SESSION approval outcomes to the permission engine, giving session-wide grants for classifier-approved read-only shell commands.
   • ›Adds /v1/board/ API endpoints with per-actor board tokens (identity + access) designed to be handed to external harnesses and other machines.
   • ›Introduces Memory V1: remembered facts and user instructions surfaced in a single screen.
   • ›Adds the OpenAI Responses provider, enabling reasoning and tool use for native OpenAI models; native OpenAI (blank endpoint) is now routed to the Responses provider automatically.
   • ›Adds support for custom Responses endpoints.
   +16 moreshow less

   • ›Registers BytePlus and Volcengine Ark as new providers, including model catalogs, credential verification via Responses, and branding.
   • ›Adds Skills support: per-persona skills wired through manifest into sessions.
   • ›Adds persona sharing v1: export and import persona bundles with versioning and consent.
   • ›Ships built-in security coworker persona bundles in the sidecar.
   • ›Adds a self-contained findings report page for security bundles.
   • ›Makes connectors a per-coworker allowlist.
   • ›Introduces shadow evaluation mode: the auto-approve reviewer records decisions while the human still approves, with a deny card and one-shot 'Allow anyway' option.
   • ›Adds reviewer metering: badge, mode-menu summary, and durable stats.
   • ›Adds a session read-only command grant, enabled on the consent card.
   • ›Adds compound command splitting so each part is checked independently by the permission engine.
   • ›Validates approval answers server-side and audits autonomy changes.
   • ›Introduces the Artifact viewer with an airtight sandbox for agent HTML and an 'Open in browser' option.
   • ›Upgrades ask_user with rich options, grouped questions, and option previews.
   • ›Adds a coworker picker with setup chips above the composer and folder selection at send.
   • ›Adds an append-only board event store with hash-chaining per space for tamper-evidence via verify_chain; supports taint provenance marking.
   • ›Pins Intel Mac (darwin-x86_64) builds via a macos-15-intel Actions runner, adding DMG artifacts and auto-update manifest entries for Intel Macs.
   └──▷ BREAKING ON UPGRADE

   • !The Mode.AUTO enum value is renamed to Mode.BYPASS_APPROVALS; any code or tests referencing Mode.AUTO will break.
3. v0.1.7 Jul 30, 2026 · issue 004

   OpenWorker v0.1.7 adds AWS Bedrock, Google Vertex AI, OpenRouter, and Meta Model API providers, plus auto-compaction and token-usage metering.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v0.1.7 https://github.com/andrewyng/openworker.git
   # already have the repo? check out this version:
   $ git checkout v0.1.7

   └──▷ TRY IT
   Connect to AWS Bedrock using a console-issued API key (no AWS CLI required) and run a task on a Bedrock-hosted model.
   copy

   $ # In Settings, add a Bedrock provider entry, set auth_method to api_key,
   # and paste your bearer token. Model IDs follow the pattern:
   # bedrock:claude/<bedrock-model-id>  — native Anthropic path
   # bedrock:other/<bedrock-model-id>   — Converse API path
   #
   # The bearer token is picked up via AWS_BEARER_TOKEN_BEDROCK;
   # you can also set it in the environment before launching OpenWorker:
   export AWS_BEARER_TOKEN_BEDROCK=<your-bedrock-api-key>

   Review per-session token usage, including cache hits, after a long Anthropic session where prompt caching is active.
   📍In the composer, click the token-usage chip to open the popover. Rows show session totals per model: 'Uncached input', cached reads, cache writes, output, and a cumulative 'Total input' row when a cache split exists.
   • ›Adds AWS Bedrock provider with per-family dispatch: Claude models route through the native AnthropicBedrock client; all other families (Llama, Nova, Mistral, Cohere, DeepSeek, …) use the Converse API (bedrock-runtime.converse / converse_stream); auth selectable via api_key (bearer token, rides AWS_BEARER_TOKEN_BEDROCK), profile (named ~/.aws profile or default credential chain), or iam (explicit access keys + optional STS session token).
   • ›Adds Google Vertex AI provider with per-family dispatch: Gemini and Claude via their native paths, open-weight models via the MaaS endpoint; auth by Google Cloud ADC, service account, or API key.
   • ›Adds OpenRouter as an OpenAI-compatible reseller provider.
   • ›Adds Meta Model API provider with Muse Spark 1.1, supporting tool calling, vision, and streaming.
   • ›Adds Nemotron Super 3 120B to the Bedrock model matrix.
   +8 moreshow less

   • ›Adds Kimi K3 via Together (1 M context window, vision).
   • ›Introduces auto-compaction of long session histories (coworker/compaction.py): when outbound history approaches the model context limit (trigger: min(threshold_pct × context_window, cap_tokens), defaults DEFAULT_THRESHOLD_PCT = 0.8, DEFAULT_CAP_TOKENS = 250_000), older turns are replaced with an LLM-written structured summary while the persisted transcript is never modified; configurable via Settings overrides.
   • ›Meters normalized token usage (input, output, cache reads, cache writes) across all model providers and surfaces it in the composer as a chip with a per-session popover breaking down totals per model, including an 'Uncached input' row and cumulative Total input when prompt caching is active.
   • ›Enables Anthropic prompt caching via two ephemeral breakpoints per request (last system block + final message block).
   • ›Settings gains a multi-field provider credentials form with a segmented per-method auth panel and an add-model family dropdown for the new cloud providers.
   • ›Adds WorkspaceTrustStore gating workspace MCP config, with global MCP config winning on name clash with a trusted workspace.
   • ›Ripgrep-backed grep tool now explicitly excludes generated directories (node_modules, dist, and similar) regardless of .gitignore presence, with exclusions applied after caller-provided globs.
   • ›Transcript view clamps long user messages with a more…/less… toggle.
   └──▷ BREAKING ON UPGRADE

   • !Interpreters and package managers (python, python3, node, npm, npx) have been removed from the default shell auto-run allowlist; workflows that relied on auto-approving these commands must now explicitly allowlist them.
4. v0.1.6 Jul 23, 2026 · issue 004

   OpenWorker v0.1.6 adds Gemini 3 and Kimi K2.7 models, extended thinking, mid-session model switching, and reasoning trace display.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v0.1.6 https://github.com/andrewyng/openworker.git
   # already have the repo? check out this version:
   $ git checkout v0.1.6

   • ›Enables Anthropic extended thinking via the provider profile's thinking_budget field (hidden override); on by default at a budget of 8192 tokens, set to 0 to disable.
   • ›Adds mid-session model switching via engine.switch_model(model), which persists a transcript marker and warns when the new model cannot see earlier images in history.
   • ›Shows live reasoning traces — a streaming Thinking block during generation and a persisted disclosure in the transcript — for both Anthropic and Gemini thinking-capable models.
   • ›Adds Gemini 3 models with thought_signature support, replaying signatures on tool-result turns so multi-turn tool loops remain coherent.
   • ›Adds Kimi K2.7 Code via Together to the model matrix.
   +3 moreshow less

   • ›Persists Always-allow tool grants with the session so they survive across turns.
   • ›Persists error and interrupt markers in history and surfaces a Retry action on failed turns.
   • ›Keeps interrupted partial streams in the transcript rather than discarding them.
   └──▷ BREAKING ON UPGRADE

   • !The user-facing thinking_budget settings field has been removed; extended thinking is now enabled by default (budget 8192) and the field survives only as a hidden provider-profile override.