cowork-os 0.3.21 → 0.3.25

package/README.md

@@ -1,5 +1,5 @@
 <p align="center">
-  <img src="screenshots/cowork-os-logo.png" alt="CoWork OS Logo" width="120">
+  <img src="screenshots/cowork-oss-logo-new.png" alt="CoWork OS Logo" width="120">
 </p>
 
 <div align="center">
@@ -26,11 +26,38 @@ Your AI needs a secure home. CoWork OS provides the runtime, security layers, an
 
 | | |
 |---|---|
-| **6 AI Providers** | Claude, GPT-4, Gemini, Bedrock, OpenRouter, Ollama (free/local) |
+| **20+ AI Providers** | Claude, OpenAI, Gemini, Bedrock, OpenRouter, Ollama (free/local), Groq, xAI, Kimi, Mistral, Cerebras, MiniMax, Qwen, Copilot, and more |
 | **14 Messaging Channels** | WhatsApp, Telegram, Discord, Slack, Teams, Google Chat, iMessage, Signal, Mattermost, Matrix, Twitch, LINE, BlueBubbles, Email |
-| **Security-First** | 1800+ unit tests, configurable guardrails, approval workflows |
+| **8 Enterprise Connectors** | Salesforce, Jira, HubSpot, Zendesk, ServiceNow, Linear, Asana, Okta |
+| **6 Cloud Storage** | Notion, Box, OneDrive, Google Workspace (Drive/Gmail/Calendar), Dropbox, SharePoint |
+| **Security-First** | 2350+ unit tests, configurable guardrails, approval workflows |
 | **Local-First** | Your data stays on your machine. BYOK (Bring Your Own Key) |
 
+### Feature Comparison (CoWork OS vs OpenClaw vs Claude Cowork)
+
+| Feature | CoWork OS | OpenClaw | Claude Cowork |
+|---|---|---|---|
+| Model providers / BYOK | 20+ providers (Claude, OpenAI, Gemini, Bedrock, OpenRouter, Ollama, Groq, xAI, Kimi, Mistral, Cerebras, MiniMax, Qwen, Copilot, and more); BYOK | Any model supported; OAuth + API keys (Anthropic/OpenAI listed) | Claude plans (Pro/Max/Team/Enterprise); other providers not mentioned |
+| Local-first data control | Data stays on your machine; BYOK | Run on your own devices; local-first gateway | Runs locally in an isolated VM; choose folders/connectors; local history for Team/Enterprise |
+| Desktop platforms | macOS (cross-platform planned) | macOS, Linux, Windows (via WSL2) | macOS only (research preview) |
+| Messaging channels | 14 channels: WhatsApp, Telegram, Discord, Slack, Teams, Google Chat, iMessage, Signal, Mattermost, Matrix, Twitch, LINE, BlueBubbles, Email | Multi-channel inbox: WhatsApp, Telegram, Slack, Discord, Google Chat, Signal, BlueBubbles, iMessage, Teams, Matrix, Zalo, WebChat, macOS, iOS/Android | Not stated (desktop app + connectors) |
+| Enterprise connectors | Salesforce, Jira, HubSpot, Zendesk, ServiceNow, Linear, Asana, Okta | Not stated | Connectors supported; examples include Slack, Notion, GitHub, Linear |
+| Cloud storage connectors | Notion, Box, OneDrive, Google Workspace, Dropbox, SharePoint | Not stated | Not stated |
+| Mobile companions | iOS + Android companion apps (local network) | iOS/Android nodes + macOS menu bar app | Not stated (macOS only) |
+| Scheduling / cron | Recurring tasks via cron expressions | Cron + wakeups | Not stated |
+| Remote access | Tailscale or SSH tunnels | Tailscale Serve/Funnel or SSH tunnels | Not stated |
+| WebSocket API / control plane | WebSocket API for custom integrations | Gateway WebSocket control plane | Not stated |
+| Browser automation | Playwright automation | Browser control (Chrome/Chromium) | Browser access via Chrome connector |
+| Skills / plugins | 75+ bundled skills | Skills platform (bundled, managed, workspace skills) | Not stated |
+| MCP support | Yes | Not stated | Not stated |
+| Guardrails (token/cost/iteration limits) | Configurable guardrails | Not stated | Not stated |
+| Approval workflows | Required for destructive operations | Not stated | Human approval before significant actions |
+| Access control (pairing/allowlists) | Pairing codes + per-channel allowlists | DM pairing + allowlists | Folder/connector access controls |
+| Sandbox isolation | macOS sandbox-exec or Docker | Not stated | Runs locally in an isolated VM |
+| Encrypted credential storage | OS keychain + AES-256 fallback | Not stated | Not stated |
+
+_Sources: [OpenClaw README](https://github.com/openclaw/openclaw), [OpenClaw docs](https://docs.openclaw.ai), and the [Claude Cowork product page](https://claude.com/product/cowork). “Not stated” means not documented in public materials._
+
 > **Status**: macOS desktop app (cross-platform support planned)
 
 ---
@@ -40,7 +67,7 @@ Your AI needs a secure home. CoWork OS provides the runtime, security layers, an
 <p align="center">
   <img src="screenshots/ZeroLeaks-result-010226.png" alt="ZeroLeaks Security Assessment Result" width="600">
   <br>
-  <em>CoWork OS achieves one of the highest security scores on <a href="https://zeroleaks.ai/">ZeroLeaks</a> — outperforming solutions like OpenClaw in prompt injection resistance</em>
+  <em>CoWork OS achieves one of the highest security scores on <a href="https://zeroleaks.ai/">ZeroLeaks</a> — outperforming many commercial solutions in prompt injection resistance</em>
   <br>
   <a href="ZeroLeaks-Report-jn70f56art03m4rj7fp4b5k9p180aqfd.pdf">View Full Security Assessment Report</a>
 </p>
@@ -63,7 +90,7 @@ Your AI needs a secure home. CoWork OS provides the runtime, security layers, an
 - **Dangerous command blocking**: Built-in patterns + custom regex rules
 - **Approval workflows**: User consent required for destructive operations
 - **Pairing & allowlists**: Control who can access your AI via messaging channels
-- **1800+ tests**: Comprehensive test coverage for access control and policies
+- **2350+ tests**: Comprehensive test coverage for access control and policies
 
 ### Your Data, Your Control
 
@@ -158,6 +185,34 @@ CoWork OS is **free and open source**. To run tasks, configure your own model cr
 | OpenAI (ChatGPT OAuth) | Sign in with ChatGPT account | Uses your ChatGPT subscription |
 | AWS Bedrock | AWS credentials in Settings | Pay-per-token via AWS |
 | Ollama (Local) | Install Ollama and pull models | **Free** (runs locally) |
+| Groq | API key in Settings | Pay-per-token |
+| xAI (Grok) | API key in Settings | Pay-per-token |
+| Kimi (Moonshot) | API key in Settings | Pay-per-token |
+
+### Compatible / Gateway Providers
+
+| Provider | Configuration | Billing |
+|----------|---------------|---------|
+| OpenCode Zen | API key + base URL in Settings | Provider billing |
+| Google Vertex | Access token + base URL in Settings | Provider billing |
+| Google Antigravity | Access token + base URL in Settings | Provider billing |
+| Google Gemini CLI | Access token + base URL in Settings | Provider billing |
+| Z.AI | API key + base URL in Settings | Provider billing |
+| GLM | API key + base URL in Settings | Provider billing |
+| Vercel AI Gateway | API key in Settings | Provider billing |
+| Cerebras | API key in Settings | Provider billing |
+| Mistral | API key in Settings | Provider billing |
+| GitHub Copilot | GitHub token in Settings | Subscription-based |
+| Moonshot (Kimi) | API key in Settings | Provider billing |
+| Qwen Portal | API key in Settings | Provider billing |
+| MiniMax | API key in Settings | Provider billing |
+| MiniMax Portal | API key in Settings | Provider billing |
+| Xiaomi MiMo | API key in Settings | Provider billing |
+| Venice AI | API key in Settings | Provider billing |
+| Synthetic | API key in Settings | Provider billing |
+| Kimi Code | API key in Settings | Provider billing |
+| OpenAI-Compatible (Custom) | API key + base URL in Settings | Provider billing |
+| Anthropic-Compatible (Custom) | API key + base URL in Settings | Provider billing |
 
 **Your usage is billed directly by your provider.** CoWork OS does not proxy or resell model access.
 
@@ -188,6 +243,18 @@ All channels support:
 - Session management
 - Rate limiting
 
+### Visual Theme System
+
+Customize the app appearance with multiple theme options.
+
+| Theme | Description |
+|-------|-------------|
+| **System** | Follows your macOS light/dark mode preference |
+| **Light** | Clean light interface |
+| **Dark** | Dark mode for reduced eye strain |
+
+Configure in **Settings** > **Appearance**.
+
 ### Agent Capabilities
 
 - **Task-Based Workflow**: Multi-step execution with plan-execute-observe loops
@@ -196,6 +263,7 @@ All channels support:
 - **75+ Built-in Skills**: GitHub, Slack, Notion, Spotify, Apple Notes, and more
 - **Document Creation**: Excel, Word, PDF, PowerPoint with professional formatting
 - **Persistent Memory**: Cross-session context with privacy-aware observation capture
+- **Workspace Recency**: Workspaces ordered by last used time for quick access
 
 ### Voice Mode (NEW)
 
@@ -340,7 +408,7 @@ Customize agent behavior via Settings or conversation:
 ┌─────────────────────────────────────────────────────────────────┐
 │                    Execution Layer                               │
 │  File Operations | Document Skills | Browser Automation          │
-│  LLM Providers (6) | Search Providers (4) | MCP Client           │
+│  LLM Providers (20+) | Search Providers (4) | MCP Client          │
 └─────────────────────────────────────────────────────────────────┘
                               ↕
 ┌─────────────────────────────────────────────────────────────────┐
@@ -401,7 +469,7 @@ This is a good option for:
 
 - Node.js 18+ and npm
 - macOS 12 (Monterey) or later
-- One of: Anthropic API key, Google Gemini API key, OpenRouter API key, OpenAI API key, AWS Bedrock access, or Ollama installed locally
+- One of: any supported LLM provider credentials (API key/token or AWS credentials) or Ollama installed locally
 
 ### Installation
 
@@ -1347,7 +1415,13 @@ Access CoWork OS from your iPhone, iPad, or Android device via the local network
 
 ## Web Search Integration
 
-Multi-provider web search for research tasks.
+Multi-provider web search for research tasks with automatic retry and fallback.
+
+### Features
+
+- **Automatic Retry**: Transient errors (rate limits, timeouts) trigger automatic retry with exponential backoff
+- **Provider Fallback**: If one provider fails, automatically tries the next configured provider
+- **Graceful Degradation**: Returns helpful error messages instead of failing silently
 
 ### Supported Providers
 
@@ -1380,6 +1454,8 @@ Claude Code-style tools for developers.
 → grep pattern="TODO:" glob="*.ts"
 ```
 
+**Smart Document Detection**: Automatically detects document-heavy workspaces (PDF/DOCX) and provides helpful guidance to use `read_file` instead, since grep only searches text files.
+
 ### edit_file - Surgical Editing
 
 ```
@@ -1411,6 +1487,213 @@ Full HTTP client for API calls (curl-like).
 
 ---
 
+## Notion Integration
+
+Configure in **Settings > Integrations > Notion**. Use `notion_action` to search, read, and update Notion content. Write actions (create, update, append, delete) require approval.
+
+### Search pages or data sources
+
+```ts
+notion_action({
+  action: "search",
+  query: "Roadmap"
+});
+```
+
+### Query a data source with filters and sorts
+
+```ts
+notion_action({
+  action: "query_data_source",
+  data_source_id: "YOUR_DATA_SOURCE_ID",
+  filter: {
+    property: "Status",
+    select: { equals: "Active" }
+  },
+  sorts: [
+    { property: "Updated", direction: "descending" }
+  ],
+  page_size: 25
+});
+```
+
+### Paginate a data source query
+
+```ts
+notion_action({
+  action: "query_data_source",
+  data_source_id: "YOUR_DATA_SOURCE_ID",
+  start_cursor: "NEXT_CURSOR_FROM_PREVIOUS_RESPONSE",
+  page_size: 25
+});
+```
+
+### Update or delete a block
+
+```ts
+notion_action({
+  action: "update_block",
+  block_id: "BLOCK_ID",
+  block_type: "paragraph",
+  block: {
+    rich_text: [{ text: { content: "Updated text" } }]
+  }
+});
+
+notion_action({
+  action: "delete_block",
+  block_id: "BLOCK_ID"
+});
+```
+
+---
+
+## Box Integration
+
+Configure in **Settings > Integrations > Box**. Use `box_action` to search, read, and manage Box files and folders. Write actions (create, upload, delete) require approval.
+
+### Search for files
+
+```ts
+box_action({
+  action: "search",
+  query: "Q4 report",
+  type: "file",
+  limit: 25
+});
+```
+
+### Upload a file
+
+```ts
+box_action({
+  action: "upload_file",
+  file_path: "reports/summary.pdf",
+  parent_id: "0"
+});
+```
+
+---
+
+## OneDrive Integration
+
+Configure in **Settings > Integrations > OneDrive**. Use `onedrive_action` to search, read, and manage OneDrive files and folders. Write actions (create, upload, delete) require approval.
+
+### Search for files
+
+```ts
+onedrive_action({
+  action: "search",
+  query: "Roadmap"
+});
+```
+
+### Upload a file
+
+```ts
+onedrive_action({
+  action: "upload_file",
+  file_path: "reports/summary.pdf"
+});
+```
+
+---
+
+## Google Workspace Integration
+
+Configure in **Settings > Integrations > Google Workspace**. Unified access to Gmail, Google Calendar, and Google Drive with shared OAuth authentication.
+
+### Available Tools
+
+| Service | Tool | Actions |
+|---------|------|---------|
+| **Drive** | `google_drive_action` | list_files, search, upload_file, download_file, delete_file |
+| **Gmail** | `gmail_action` | list_messages, search, send_email, read_email, create_draft |
+| **Calendar** | `google_calendar_action` | list_events, create_event, update_event, delete_event |
+
+### Gmail - Send an email
+
+```ts
+gmail_action({
+  action: "send_email",
+  to: "recipient@example.com",
+  subject: "Weekly Report",
+  body: "Please find the attached report..."
+});
+```
+
+### Calendar - Create an event
+
+```ts
+google_calendar_action({
+  action: "create_event",
+  title: "Team Standup",
+  start_time: "2025-02-10T09:00:00",
+  end_time: "2025-02-10T09:30:00",
+  attendees: ["team@example.com"]
+});
+```
+
+### Drive - List files
+
+```ts
+google_drive_action({
+  action: "list_files",
+  page_size: 20
+});
+```
+
+---
+
+## Dropbox Integration
+
+Configure in **Settings > Integrations > Dropbox**. Use `dropbox_action` to search, read, and manage Dropbox files and folders. Write actions (create, upload, delete) require approval.
+
+### List folder contents
+
+```ts
+dropbox_action({
+  action: "list_folder",
+  path: "/Reports"
+});
+```
+
+### Upload a file
+
+```ts
+dropbox_action({
+  action: "upload_file",
+  file_path: "reports/summary.pdf",
+  path: "/Reports/summary.pdf"
+});
+```
+
+---
+
+## SharePoint Integration
+
+Configure in **Settings > Integrations > SharePoint**. Use `sharepoint_action` to search sites and manage drive items. Write actions (create, upload, delete) require approval.
+
+### Search sites
+
+```ts
+sharepoint_action({
+  action: "search_sites",
+  query: "Marketing"
+});
+```
+
+### Upload a file
+
+```ts
+sharepoint_action({
+  action: "upload_file",
+  file_path: "reports/summary.pdf"
+});
+```
+
+---
+
 ## Personality & Customization
 
 Tell the agent what you want:
@@ -1494,6 +1777,35 @@ Sign in with your ChatGPT subscription to use without additional API costs.
 
 ---
 
+## Additional LLM Providers
+
+Configure these in **Settings** > **LLM Provider** by entering API keys/tokens, model IDs, and base URLs when required.
+
+| Provider | Compatibility |
+|----------|---------------|
+| OpenCode Zen | OpenAI-compatible |
+| Google Vertex | OpenAI-compatible |
+| Google Antigravity | OpenAI-compatible |
+| Google Gemini CLI | OpenAI-compatible |
+| Z.AI | OpenAI-compatible |
+| GLM | OpenAI-compatible |
+| Vercel AI Gateway | Anthropic-compatible |
+| Cerebras | OpenAI-compatible |
+| Mistral | OpenAI-compatible |
+| GitHub Copilot | OpenAI-compatible |
+| Moonshot (Kimi) | OpenAI-compatible |
+| Qwen Portal | Anthropic-compatible |
+| MiniMax | OpenAI-compatible |
+| MiniMax Portal | Anthropic-compatible |
+| Xiaomi MiMo | Anthropic-compatible |
+| Venice AI | OpenAI-compatible |
+| Synthetic | Anthropic-compatible |
+| Kimi Code | OpenAI-compatible |
+| OpenAI-Compatible (Custom) | OpenAI-compatible |
+| Anthropic-Compatible (Custom) | Anthropic-compatible |
+
+---
+
 ## Built-in Skills (75+)
 
 | Category | Skills |
@@ -1522,6 +1834,47 @@ Browse and install servers from a catalog with one-click installation.
 
 ---
 
+## Enterprise MCP Connectors
+
+Pre-built MCP server connectors for enterprise integrations. Install from **Settings > MCP Servers > Browse Registry**.
+
+### Available Connectors
+
+| Connector | Type | Tools |
+|-----------|------|-------|
+| **Salesforce** | CRM | `health`, `list_objects`, `describe_object`, `get_record`, `search_records`, `create_record`, `update_record` |
+| **Jira** | Issue Tracking | `health`, `list_projects`, `get_issue`, `search_issues`, `create_issue`, `update_issue` |
+| **HubSpot** | CRM | `health`, `list_contacts`, `get_contact`, `search_contacts`, `create_contact`, `update_contact` |
+| **Zendesk** | Support | `health`, `list_tickets`, `get_ticket`, `search_tickets`, `create_ticket`, `update_ticket` |
+| **ServiceNow** | ITSM | `health`, `list_incidents`, `get_incident`, `search_incidents`, `create_incident`, `update_incident` |
+| **Linear** | Product/Issue | `health`, `list_issues`, `get_issue`, `search_issues`, `create_issue`, `update_issue` |
+| **Asana** | Work Management | `health`, `list_tasks`, `get_task`, `search_tasks`, `create_task`, `update_task` |
+| **Okta** | Identity | `health`, `list_users`, `get_user`, `search_users`, `create_user`, `update_user` |
+
+### Setup
+
+1. Go to **Settings > MCP Servers > Browse Registry**
+2. Find the connector you need (e.g., Salesforce)
+3. Click **Install**
+4. Configure credentials when prompted (API keys, OAuth tokens, etc.)
+5. The connector tools become available to the agent
+
+### Building Custom Connectors
+
+Use the connector template to build your own:
+
+```bash
+cp -r connectors/templates/mcp-connector connectors/my-connector
+cd connectors/my-connector
+npm install
+# Edit src/index.ts to implement your tools
+npm run build
+```
+
+See [docs/enterprise-connectors.md](docs/enterprise-connectors.md) for the full connector contract and conventions.
+
+---
+
 ## WebSocket Control Plane
 
 Programmatic API for external automation and mobile companion apps.
@@ -1580,7 +1933,7 @@ Users must comply with their model provider's terms:
 
 ### Completed
 
-- [x] Multi-provider LLM support (6 providers)
+- [x] Multi-provider LLM support (20+ providers including Groq, xAI, Kimi, GitHub Copilot, OpenAI/Anthropic-compatible)
 - [x] Multi-channel messaging (14 channels)
 - [x] Configurable guardrails and security
 - [x] Browser automation with Playwright
@@ -1591,13 +1944,22 @@ Users must comply with their model provider's terms:
 - [x] Tailscale and SSH remote access
 - [x] Personality system
 - [x] 75+ bundled skills
-- [x] 1800+ unit tests
+- [x] 2350+ unit tests
 - [x] Docker-based sandboxing (cross-platform)
 - [x] Per-context security policies (DM vs group)
 - [x] Enhanced pairing code UI with countdown
 - [x] Persistent memory system with privacy protection
 - [x] Mobile Companions with LAN access support
 - [x] Voice Mode with ElevenLabs and OpenAI integration
+- [x] Enterprise MCP Connectors (Salesforce, Jira, HubSpot, Zendesk, ServiceNow, Linear, Asana, Okta)
+- [x] Cloud Storage Integrations (Notion, Box, OneDrive, Google Drive, Dropbox, SharePoint)
+- [x] Visual Theme System (Light/Dark/System modes)
+- [x] Workspace recency ordering
+- [x] Web search retry with exponential backoff
+- [x] Google Workspace Integration (Gmail, Calendar, Drive with shared OAuth)
+- [x] Gateway channel cleanup and enhanced security (Matrix direct rooms, Slack groups)
+- [x] Agent transient error retry logic for improved reliability
+- [x] Smart parameter inference for document creation tools
 
 ### Planned
 

package/connectors/README.md

@@ -0,0 +1,20 @@
+# Connectors
+
+This folder contains connector templates and reference implementations.
+
+Connectors are MCP servers that expose enterprise APIs (Salesforce, Jira, etc.) to CoWork OS via tools. They are designed to run outside the desktop app so they can be deployed locally or as a managed service.
+
+Templates:
+- `connectors/templates/mcp-connector`
+
+Reference implementations:
+- `connectors/salesforce-mcp`
+- `connectors/jira-mcp`
+- `connectors/hubspot-mcp`
+- `connectors/zendesk-mcp`
+- `connectors/servicenow-mcp`
+- `connectors/linear-mcp`
+- `connectors/asana-mcp`
+- `connectors/okta-mcp`
+
+See `docs/enterprise-connectors.md` for the Phase 1 connector contract.

package/connectors/asana-mcp/README.md

@@ -0,0 +1,24 @@
+# Asana MCP Connector (MVP)
+
+This connector exposes Asana APIs to CoWork OS through MCP tools.
+
+## Requirements
+
+- `ASANA_ACCESS_TOKEN` (required)
+
+## Build & Run
+
+```bash
+npm install
+npm run build
+npm start
+```
+
+## Tools
+
+- `asana.health`
+- `asana.list_projects`
+- `asana.get_task`
+- `asana.search_tasks`
+- `asana.create_task`
+- `asana.update_task`