local ai-powered browser task automation via pseudo-terminal cli spawning
Openwork spawns the OpenCode CLI as an external process using node-pty pseudo-terminal emulation, enabling local execution of AI-driven browser automation tasks without cloud infrastructure. The Electron main process manages the CLI lifecycle, captures stdout/stderr streams, and marshals task results back to the React renderer via IPC, creating a fully local execution model where the AI provider (Anthropic, OpenAI, Google, Groq) is user-supplied via API keys.
Unique: Uses node-pty pseudo-terminal emulation to spawn OpenCode CLI as a subprocess with full stream capture and IPC marshaling, rather than REST API calls or direct library imports. This enables true local-only execution where the Electron main process acts as a process supervisor and IPC bridge, not a cloud relay.
vs alternatives: Achieves true local-only automation without cloud infrastructure, unlike Selenium Grid or cloud-based RPA platforms, while maintaining process isolation and real-time UI feedback through Electron's IPC architecture.
os-native secure credential storage with keychain/vault integration
Openwork stores AI provider API keys in OS-native secure storage (macOS Keychain, Windows Credential Vault, Linux Secret Service) via the keytar library, ensuring credentials are encrypted at rest and never persisted as plaintext JSON. The secure storage layer is abstracted in the main process and exposed to the renderer via IPC, preventing the Chromium renderer from ever accessing raw credentials.
Unique: Implements three-tier process isolation: credentials stored in OS keychain (never in JSON), accessed only by Electron main process (not renderer), and exposed to renderer via IPC with no credential data in messages. Uses keytar library to abstract OS-specific keychain APIs rather than custom encryption.
vs alternatives: Provides stronger security than electron-store JSON storage by leveraging OS-native encryption, and avoids custom crypto implementation risks that plague many Electron apps storing secrets.
configuration generator for opencode cli with environment variable injection
Openwork generates OpenCode CLI configuration by reading app settings (provider, model, API key reference) and injecting them as environment variables or command-line arguments before spawning the CLI subprocess. The configuration generator validates that required settings are present (API key in keychain, provider selected) and constructs the CLI invocation with proper escaping and quoting. This approach keeps CLI configuration logic decoupled from Openwork, allowing the CLI to evolve independently.
Unique: Generates CLI invocations by reading app settings and injecting configuration as environment variables, rather than passing configuration files or hardcoding CLI arguments. This keeps CLI configuration logic in Openwork while allowing the CLI to remain provider-agnostic.
vs alternatives: More flexible than hardcoded CLI arguments by reading from app settings, and simpler than configuration file management by using environment variables that are automatically inherited by spawned processes.
permission system for folder access with os-native file picker integration
Openwork implements a permission system that tracks which folders the user has granted access to, storing folder paths in app settings. When a task requires file system access, the main process checks if the target folder is in the permitted list; if not, it prompts the user via OS-native file picker (macOS NSOpenPanel, Windows IFileDialog) to grant access. Granted folders are stored persistently and reused for subsequent tasks without re-prompting.
Unique: Implements application-level folder permission tracking with OS-native file picker prompts, rather than relying on OS sandboxing or requiring users to manually configure allowed paths. Permissions are stored persistently to avoid repeated prompts.
vs alternatives: More user-friendly than requiring manual path configuration, and more transparent than silent file access by prompting users with native dialogs they recognize.
task execution history persistence with debounced json flushing
Openwork maintains a task history log using electron-store with debounced writes to JSON files in the app's userData directory. The main process accumulates task records in memory and flushes to disk on a debounce timer (typically 1-2 seconds), reducing I/O overhead while ensuring eventual persistence. Task records include execution metadata (timestamps, status, provider used, token counts) and are queryable via the React UI for task replay and audit trails.
Unique: Implements debounced writes to electron-store rather than synchronous persistence, reducing I/O overhead for high-frequency task execution while maintaining eventual consistency. Task records include full execution context (provider, model, tokens) enabling replay and cost analysis.
vs alternatives: More efficient than immediate JSON writes for frequent tasks, and more transparent than opaque database storage by using human-readable JSON files that can be inspected or migrated without proprietary tools.
react-based task management ui with zustand state synchronization
Openwork provides a React-based renderer process UI built with Zustand for state management, enabling users to create tasks, monitor execution progress, view task history, and configure AI provider settings. The renderer communicates with the main process via IPC for all side effects (spawning CLI, accessing credentials, persisting history), maintaining strict separation between UI state and system state. Zustand stores handle local UI state (form inputs, modal visibility) while IPC messages synchronize with authoritative main process state.
Unique: Separates UI state (Zustand) from system state (main process), with IPC as the synchronization boundary. This enforces strict process isolation where the renderer cannot directly access credentials, file system, or spawned processes — all side effects flow through main process IPC handlers.
vs alternatives: Cleaner than monolithic state management by using Zustand for ephemeral UI state and IPC for authoritative system state, reducing the risk of renderer process compromise exposing credentials or system resources.
bundled node.js runtime with system path resolution for cli discovery
Openwork bundles a Node.js runtime within the Electron application and implements intelligent PATH resolution to locate the OpenCode CLI binary. The system PATH utilities search bundled runtime directories, system PATH environment variable, and fallback locations, enabling the app to function on systems without Node.js installed. The CLI path resolution is performed in the main process before spawning the CLI subprocess, with caching to avoid repeated PATH searches.
Unique: Implements multi-tier PATH resolution (bundled runtime → system PATH → fallback locations) with caching, enabling CLI discovery without requiring users to manually configure PATH or install Node.js. Bundled runtime is integrated into Electron build process rather than downloaded at runtime.
vs alternatives: Eliminates Node.js as a prerequisite for end users, unlike CLI tools that require separate installation, while avoiding the complexity of dynamic runtime downloads by bundling at build time.
electron ipc-based process isolation with preload script context bridging
Openwork implements strict process isolation using Electron's three-process model: main process (Node.js), preload script (isolated context), and renderer process (Chromium). The preload script uses contextBridge to expose a curated API surface to the renderer, forwarding IPC messages to the main process for all privileged operations (spawning CLI, accessing credentials, file system). This architecture prevents the Chromium renderer from directly accessing system resources, credentials, or spawned processes.
Unique: Enforces strict process isolation via Electron's three-process model with contextBridge API exposure, ensuring the Chromium renderer cannot directly access credentials, file system, or spawned processes. All privileged operations flow through main process IPC handlers with explicit message validation.
vs alternatives: Stronger security posture than monolithic Electron apps that expose Node.js APIs directly to renderer, and more maintainable than custom message validation by leveraging Electron's built-in contextBridge and preload script isolation.
+4 more capabilities