Each project has its own group of bots (OCP Agent or OCP Coder).
Responsibility
A lasting goal for one bot. It stays until you mark it done. A routine can name its id in the prompt.
Thread
Address two bots in one thread. With no model configured, each bot records that it will not invent an action.
Draft reach does not send. Nothing is sent automatically. Allowing a Teams draft still sends nothing.
Open work
Approvals waiting, unsent drafts, open responsibilities, and routines. This list does not send anything.
Developer / Plumbing
Hand off
Give a finished task to another bot. The new task is queued for that bot.
Save as routine
Responsibility check
A standing check waits at least 15 minutes and stays read-only.
Memory
Facts this workspace remembers. Correct or forget them here. The model is not the only writer.
New Project / Product
Every project gets its own workspace directory and its own dedicated team of bots.
Audit
Permitted, refused, and failed actions. A refused row names the rule. Secrets are not stored here.
Category
A foreign agent on this machine, component replies, a local directory, and pages. WhatsApp reach stays a draft. Allowing that draft still sends nothing. Teams reach stays a draft too. Company sign-in checks a signed assertion on this machine and does not contact a company directory.
Directory
Pages
Model & providers
Appearance
Dark is the first look. System follows this device.
Point OCP at a local OpenAI-compatible server or a cloud provider. Keys stay on this machine (mode 0600).
Usage & Billing (₹ / UPI)
Tokens come from the provider. A number is marked estimated only when the provider sent none. Cost uses prices you enter. Local models stay at the $0 default until you enter one. OCP does not invent prices.
Credits
User-facing product name: Open Coding Partner (OCP).
Third-party components documented in NOTICE / THIRD_PARTY_NOTICES: OpenClaw, Hermes, Grok Build, Laya, LiteLLM, and xAI. They are not product names in the rest of this app.
OpenBot (MIT, CopilotKit) is credited for the coworker shape: a computer per coworker, a recorded gate, and taking the controls. This app implements that shape in its own code. No OpenBot source is copied.
AG-UI is the public Agent User Interaction Protocol. This app speaks the HTTP and event-stream binding in its own code. No protocol SDK is copied.
Routines
Intervals, five-field cron with an IANA timezone, and named events enqueue a bot task. A signed webhook can start the same routine. The signing secret is shown once and is not kept in the page.
Webhook requests send the raw body with headers x-ocp-timestamp (unix milliseconds) and x-ocp-signature (hex HMAC-SHA256 of timestamp + "." + body). A bad or replayed signature does not start a task.
Recent runs
Connectors
HTTP MCP servers for one bot. A token is stored locally and is never shown again. Test connection lists tools or shows the server error.
Plugins
Install a plugin on one bot. Skills and connectors stay on that bot. A checksum proves the manifest. It does not constrain the remote server after install.
Drafts still wait for a person. Allowing a WhatsApp or Teams draft still sends nothing.
Channels
Slack and Telegram messages become tasks for the assigned bot. Replies stay as drafts until you send them. Nothing is sent automatically. Tokens stay in Settings.
Drafts
Every outbound email or message stays here until you send it. Nothing is sent automatically.
Observability & Traces
End-to-end OpenTelemetry GenAI spans, latency flamegraphs, and token metering.
Observability:
Recent Session Traces
Skills
Reusable multi-step skills. A bot loads one on demand through tool search. Packs import from a zip or a git URL.
Memory
Structured notes kept on this machine. Filter by profile, journal, or shared. Deleting an item forgets that fact.
Issue to PR
A GitHub or Linear issue becomes a task. Approve the plan, edit, run tests, then open a pull request with the plan, the diff, and the test output. Merging stays with a person.
Vault
Logins, tokens, and OAuth secrets stay in this vault. A bot fills a virtual-computer login by item name. The secret is not sent to the model and is not written in the task log. A sign-in, 2FA, or captcha asks you to Take Control.
Accounts
OCP ships no OAuth client. Paste a Google or Microsoft client you created. These are the only scopes requested, and they are shown again before consent. See docs/oauth-setup.md. Refresh tokens stay in the vault.
Google scopes
openid — Sign-inemail — Account addresshttps://www.googleapis.com/auth/gmail.readonly — Gmail read and searchhttps://www.googleapis.com/auth/gmail.compose — Gmail drafts. A person sends from a draft card.https://www.googleapis.com/auth/calendar.readonly — Calendar readhttps://www.googleapis.com/auth/calendar.events — Calendar create. OCP asks before creating an event.https://www.googleapis.com/auth/drive.readonly — Drive search and read
Microsoft scopes
offline_access — Refresh tokenhttps://graph.microsoft.com/User.Read — Signed-in account addresshttps://graph.microsoft.com/Mail.Read — Outlook read and searchhttps://graph.microsoft.com/Mail.ReadWrite — Outlook drafts. A person sends from a draft card.https://graph.microsoft.com/Mail.Send — Outlook send. Only a person sends, from a draft card.https://graph.microsoft.com/Calendars.Read — Outlook calendar readhttps://graph.microsoft.com/Calendars.ReadWrite — Outlook calendar create. OCP asks before creating an event.https://graph.microsoft.com/Files.Read — OneDrive search and read
