OpenWorker 이전 버전 및 전체 버전

OpenWorker inside OpenShell. The CLI is published as an image, ghcr.io/andrewyng/openworker, so you can run a coworker fully inside an NVIDIA OpenShell sandbox with one command. When a site is blocked, the coworker asks and waits while you allow it.
OpenShell 0.1.2. The desktop app's OpenShell option now works with OpenShell 0.1.2. If you are on OpenShell 0.0.x, upgrade OpenShell first. On a Mac, Docker Desktop's host networking must be on; Settings checks this and tells you. "Allow everything" is no longer offered with OpenShell.
What's Changed
- Sandbox improvements - WebSearch follows allow-list. Agent can work egress policy server to request user for additions to network policy.
- CLI improvements
- Run OpenWorker inside an OpenShell sandbox
- Supporting newer version of OpenShell - 0.1.2
Full Changelog: https://github.com/andrewyng/openworker/compare/v0.3.0...v0.3.1

OpenWorker 0.3.0
Agent Security OpenWorker now provides multiple layers of protection for AI agents. The approval system and the permission ladder decide what an agent may do, and a secure runtime now sets a hard limit on what it can do. OpenWorker integrates the OpenShell secure runtime from the NVIDIA Open Agent Safety Platform, announced this week. It is an enforceable boundary outside the model and the agent harness. Every agent runs in its own Linux container, with Landlock and seccomp on every process. This enables Users to restrict AI agents to only allowed files and allowed websites. Even if an agent is misled by a prompt injection or drifts from its task, it cannot read your other files, take your keys, or reach anywhere else. Docker (or Docker Desktop) needs to be installed on Mac, Windows or Linux to allow OpenWorker to setup and use OpenShell. In absence of Docker, sandboxing is still provided using OS specific primitives. Detailed architecture to come soon as a blog and docs. Thanks to @devikaverma for this researching and enabling above techniques inside OpenWorker to provide a more secure way to run AI agents.
Set it up in Settings ▸ Sandbox.
Machines. Run OpenWorker on a different machine and use it from the desktop app. Sessions live on that remote machine and keep running when your laptop is closed. Join a machine from Settings ▸ Machines.
This enables several use cases like 24x7 code reviewer agent, or an agent that answers question from Slack.
openworker command line. On Linux, install it with one command:
curl -fsSL https://raw.githubusercontent.com/andrewyng/openworker/main/packaging/install.sh | sh
Or download it below: openworker-linux-x86_64.tar.gz or openworker-linux-aarch64.tar.gz.
The command line can be used to make a remote openworker join the Desktop app, allowing the user to control it remotely.
Also: the app is in English and Simplified Chinese; many fixes to the agent loop, approvals, scheduled tasks and MCP tools.
More languages are in the roadmap.
Downloads: Mac (Apple Silicon: OpenWorker-macos-arm64.dmg; Intel: OpenWorker-macos-x64.dmg), Windows (OpenWorker-windows-setup.exe), Linux (above).
What's Changed
- Updating README by @rohitprasad15 in https://github.com/andrewyng/openworker/pull/569
- security(teams): enforce worker visibility on board item reads by @rakeshutekar in https://github.com/andrewyng/openworker/pull/585
- fix(teams): enforce attachment read authorization by @rakeshutekar in https://github.com/andrewyng/openworker/pull/586
- Add GUI internationalization with English and Simplified Chinese by @jasmine889966 in https://github.com/andrewyng/openworker/pull/127
- fix: scheduled task can run twice when an approval lands on a tick by @Saidheerajgollu in https://github.com/andrewyng/openworker/pull/379
- Parse inbox reply intent from the leading word, not substrings by @Saidheerajgollu in https://github.com/andrewyng/openworker/pull/24
- Reject path-traversal session ids in the conversation store by @Saidheerajgollu in https://github.com/andrewyng/openworker/pull/55
- Recover truncated tool calls, and never pass a leaked one off as an answer by @hacksics in https://github.com/andrewyng/openworker/pull/219
- Tolerate a corrupt line when loading a conversation .jsonl by @Saidheerajgollu in https://github.com/andrewyng/openworker/pull/56
- Make the conversation-log shrink rewrite atomic (prevent history loss on a mid-write crash) by @lifrary in https://github.com/andrewyng/openworker/pull/70
- fix: repair tool-call/result pairing on load to prevent unrecoverable 400 errors by @rkfshakti in https://github.com/andrewyng/openworker/pull/350
- fix(skills): confine staged upload tokens by @mo-tunn in https://github.com/andrewyng/openworker/pull/548
- MCP permission model: EXTERNAL floor, durable per-tool trust, fixed approval cards (OPE-136) by @devikaverma in https://github.com/andrewyng/openworker/pull/598
- fix(engine): agent loop fixes for long, tool-heavy sessions (OPE-156) by @de

OpenWorker v0.2.1
New: Ox Alpha (stealth preview) joins the model picker via OpenRouter — 1M-token context, tool calling.
Full details of the 0.2.0 release: https://github.com/andrewyng/openworker/releases/tag/v0.2.0
Full Changelog: https://github.com/andrewyng/openworker/compare/v0.2.0...v0.2.1

OpenWorker v0.2.0
New
- Skills — package repeatable workflows as reusable instruction packs the coworker loads on demand.
- Security coworkers — specialized agents for development teams: a Security Coworker for code security review, a Cloud Posture Coworker for infrastructure and account posture, and a Dependency Audit Coworker for supply-chain checks. Pick them from the coworker picker like any other specialist.
- Memory — the coworker remembers across sessions, with project memory tied to your repo or folder: name memories and boards, and bind them per session from the composer's "+" menu.
- Auto-approve — automatic reviewer mode that safely approves routine tool calls so long-running work isn't interrupted.
- Better MCP setup — a guided "add server" flow, and connection failures now surface clearly instead of failing silently.
- Multiple reasoning effort levels in the model picker.
- Ark model providers join the picker.
- Intel Mac builds — the DMG now ships for both Apple Silicon and x64.
Fixed
- Scheduled automations handle daylight-saving shifts and weekday rules correctly.
- Vision inputs work with Ollama models.
- Clone/pull operations respect the approval gate.
- Attachment filenames dedup properly; stale platform paths cleaned up; Python 3.10 supported.
Security hardening — secrets files are created with private permissions, web fetch connections are pinned, and MCP dependencies were bumped, alongside a broader batch of approval-handling and workspace-trust fixes. Updating is recommended.
Thanks to @Amagah, @asklokesh, @ChakrawarShubham, @coderdailyone, @CyberDefenseOperations, @fanziqingbyte, @manavshrivastavagit, @Mr-Neutr0n, @Osamaali313, and @rkfshakti for contributing to this release!
Full Changelog: https://github.com/andrewyng/openworker/compare/v0.1.7...v0.2.0

OpenWorker v0.1.7
New
- Auto-compaction — long sessions keep going: older turns are summarized automatically instead of hitting the context limit. Your transcript is never changed.
- More model providers — AWS Bedrock, Google Vertex AI, OpenRouter, and Meta Muse Spark join the picker, plus Kimi K3 via Together.
- Token usage in the composer — per-session usage at a glance, with a full input/output/cache breakdown one click away.
- Prompt caching on Anthropic models — cheaper, faster repeat turns.
- Long pastes fold in the transcript behind a more/less toggle.
Fixed
- macOS no longer asks to "access data from other apps" when your workspace is a home folder.
- Windows and cross-platform fixes to setup and search.
Security hardening — this release includes a set of security fixes across network access, workspace trust, MCP configuration, and approval handling. Updating is recommended.
Full Changelog: https://github.com/andrewyng/openworker/compare/v0.1.6...v0.1.7