diff --git a/.env.example b/.env.example index 36e6580c9..603e35542 100644 --- a/.env.example +++ b/.env.example @@ -6,7 +6,7 @@ PORT=8787 HOST=127.0.0.1 PUBLIC_API_URL=http://localhost:8787 ALLOWED_ORIGINS=http://localhost:8081,http://127.0.0.1:8081 -DATA_DIR=.openmuse +DATA_DIR=.openfuse TASK_WORKER_ENABLED=true # Rate limiting keys on the socket address. Set true only behind a reverse proxy that # overwrites X-Forwarded-For; otherwise callers can spoof it. @@ -32,7 +32,7 @@ WEB_SEARCH_ENABLED=true # OPENAI_CHAT_COMPLETIONS=true # Live Google workspace: WORKSPACE_MODE=live, AGENT_BACKEND=model. -# OPENMUSE_ACCESS_KEY= # random secret, at least 24 characters +# OPENFUSE_ACCESS_KEY= # random secret, at least 24 characters # TOKEN_ENCRYPTION_KEY= # 32 random bytes encoded as base64 # GOOGLE_CLIENT_ID= # GOOGLE_CLIENT_SECRET= @@ -45,7 +45,7 @@ WEB_SEARCH_ENABLED=true # Browser worker (separate from the task worker): # BROWSER_WORKER_URL=http://127.0.0.1:8790 # WORKER_TOKEN= # same random 32+ character secret in API and browser worker -WORKER_DATA_DIR=.openmuse/browser-profiles +WORKER_DATA_DIR=.openfuse/browser-profiles WORKER_HOST=127.0.0.1 # An optional external raw AG-UI agent replaces conversational routing only. @@ -60,7 +60,7 @@ WORKER_HOST=127.0.0.1 # npx copilotkit@latest project select CPK_INTELLIGENCE_API_KEY= -# CopilotKit SDK telemetry goes through the shared sink to PostHog, tagged OpenMuse. +# CopilotKit SDK telemetry goes through the shared sink to PostHog, tagged OpenFuse. # project select also writes CPK_TELEMETRY_ID: preserve that generated value and # deploy it alongside CPK_INTELLIGENCE_API_KEY to link runtime usage to the account. # Do not invent an identity or copy one from another project. @@ -72,14 +72,14 @@ CPK_INTELLIGENCE_API_KEY= # DO_NOT_TRACK=1 # Optional private Docker Linux computer (separate from the browser). -# Build first: docker build -t openmuse-computer:local apps/computer +# Build first: docker build -t openfuse-computer:local apps/computer # Docker must be reachable from the API and any separate task worker. COMPUTER_ENABLED=false -COMPUTER_IMAGE=openmuse-computer:local +COMPUTER_IMAGE=openfuse-computer:local # Optional deployment name shared by API and worker. When unset, a new install keeps a random # name in DATA_DIR; an install created before that keeps a hash of PUBLIC_API_URL. # COMPUTER_DEPLOYMENT_ID= # e.g. from `openssl rand -hex 12` -# Optional scoped Docker engine, e.g. DOCKER_CONTEXT=colima-openmuse +# Optional scoped Docker engine, e.g. DOCKER_CONTEXT=colima-openfuse # Or run each owner's computer in an E2B Desktop sandbox instead of Docker # (graphical desktop with internet access; see docs/COMPUTER.md): # COMPUTER_PROVIDER=e2b-desktop # default: docker diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml index b4eebaafa..71e83996e 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.yml +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -1,5 +1,5 @@ name: Bug report -description: Report a reproducible OpenMuse failure +description: Report a reproducible OpenFuse failure title: "[Bug] " body: - type: textarea diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml index d5a8dac82..128ee435f 100644 --- a/.github/ISSUE_TEMPLATE/feature_request.yml +++ b/.github/ISSUE_TEMPLATE/feature_request.yml @@ -5,7 +5,7 @@ body: - type: textarea id: outcome attributes: - label: What outcome should OpenMuse handle? + label: What outcome should OpenFuse handle? validations: required: true - type: textarea diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index bbe7f14b6..011d280c4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -85,6 +85,6 @@ jobs: - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 - run: pnpm install --frozen-lockfile - name: Build the isolated Linux computer - run: docker build -t openmuse-computer:local apps/computer + run: docker build -t openfuse-computer:local apps/computer - name: Verify computer isolation, persistence and cancellation run: pnpm test:computer diff --git a/.gitignore b/.gitignore index 732d027dd..4828dc19c 100644 --- a/.gitignore +++ b/.gitignore @@ -5,7 +5,7 @@ build/ .env .env.local .env.*.local -.openmuse/ +.openfuse/ apps/mobile/ios/ apps/mobile/android/ .DS_Store diff --git a/CHANGELOG.md b/CHANGELOG.md index e5958c533..ae88f8980 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,7 +2,7 @@ ## 0.1.0-alpha — 2026-09-15 -Initial public OpenMuse alpha. +Initial public OpenFuse alpha. - Native/web interface using CopilotKit React Native and AG-UI. - Persistent browser computer, inline PDFs, structured artifacts, and optional Rich Threads integration. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index f20d7a962..f78e5fff1 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -1,6 +1,6 @@ -# Contributing to OpenMuse +# Contributing to OpenFuse -OpenMuse is an MIT-licensed alpha. Contributions should make delegated work reliable and visible, with honest connector status and useful native interactions. +OpenFuse is an MIT-licensed alpha. Contributions should make delegated work reliable and visible, with honest connector status and useful native interactions. ## Local development @@ -9,7 +9,7 @@ OpenMuse is an MIT-licensed alpha. Contributions should make delegated work reli 3. Run `pnpm dev` and, in another terminal, `pnpm dev:web`. 4. Use the fictional sample workspace for development and recordings. See [native setup](apps/mobile/README.md) for simulator/emulator builds. -Never commit `.env`, `.openmuse`, browser profiles, credentials, or personal documents. Live provider testing is optional for ordinary contributions; state exactly which paths you tested. +Never commit `.env`, `.openfuse`, browser profiles, credentials, or personal documents. Live provider testing is optional for ordinary contributions; state exactly which paths you tested. ## Checks before a pull request diff --git a/LICENSE b/LICENSE index a3366dc26..0e1238724 100644 --- a/LICENSE +++ b/LICENSE @@ -1,6 +1,6 @@ MIT License -Copyright (c) 2026 OpenMuse contributors +Copyright (c) 2026 OpenFuse contributors Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal diff --git a/README.md b/README.md index c1c6982ca..98cbb1c31 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@
-# OpenMuse +# OpenFuse **A personal agent with a browser, terminal, files, and work that keeps going. Compatible with any agent harness.** @@ -9,20 +9,16 @@ Built with CopilotKit React Native for iOS, Android, and web. [Quick start](#quick-start) · [Demo](#demo) · [Features](#features) · [Architecture](#architecture) · [Docs](docs/README.md) · [Contributing](CONTRIBUTING.md) -[![CI](https://github.com/CopilotKit/OpenMuse/actions/workflows/ci.yml/badge.svg)](https://github.com/CopilotKit/OpenMuse/actions/workflows/ci.yml) +[![CI](https://github.com/CopilotKit/OpenFuse/actions/workflows/ci.yml/badge.svg)](https://github.com/CopilotKit/OpenFuse/actions/workflows/ci.yml) [![MIT license](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE) -CopilotKit%2Fopenmuse | Trendshift +CopilotKit%2Fopenfuse | Trendshift -[![Deploy to Render](https://render.com/images/deploy-to-render-button.svg)](https://render.com/deploy?repo=https://github.com/CopilotKit/OpenMuse) +[![Deploy to Render](https://render.com/images/deploy-to-render-button.svg)](https://render.com/deploy?repo=https://github.com/CopilotKit/OpenFuse) Clone this template and customize it however you want. -**[Building on OpenMuse? Meet with the CopilotKit team →](https://www.copilotkit.ai/talk-to-an-engineer?ref=openmuse_hero)** - -https://github.com/user-attachments/assets/8014d185-346c-4954-8ff0-26c582c5093a - -https://github.com/user-attachments/assets/0cc87de0-c3c1-4f24-b7df-e7d04bb946fd +**[Building on OpenFuse? Meet with the CopilotKit team →](https://www.copilotkit.ai/talk-to-an-engineer?ref=openfuse_hero)**
@@ -30,17 +26,17 @@ https://github.com/user-attachments/assets/0cc87de0-c3c1-4f24-b7df-e7d04bb946fd ## Demo -On iPhone, ask OpenMuse to find interesting stories on Hacker News and summarize CopilotKit. On desktop, ask it to check the school-trip email, open the message, and research exhibits at Monterey Bay Aquarium. The agent shows email and browser results inline. **Take control** opens that same browser session when you need it. +On iPhone, ask OpenFuse to find interesting stories on Hacker News and summarize CopilotKit. On desktop, ask it to check the school-trip email, open the message, and research exhibits at Monterey Bay Aquarium. The agent shows email and browser results inline. **Take control** opens that same browser session when you need it. -The 38-second iPhone and 42-second desktop web demos show the current interface, framed in 16:9. The send arrow becomes a stop square inside the input pill while the agent replies, then switches back. Stopping keeps your draft intact. See the [recording notes](docs/DEMO.md) for the model setup and reproduction steps. +The send arrow becomes a stop square inside the input pill while the agent replies, then switches back. Stopping keeps your draft intact. See the [recording notes](docs/DEMO.md) for the model setup and reproduction steps. -[Mobile MP4](https://github.com/user-attachments/assets/8014d185-346c-4954-8ff0-26c582c5093a) · [Web MP4](https://github.com/user-attachments/assets/0cc87de0-c3c1-4f24-b7df-e7d04bb946fd) · [Recording details and reproduction](docs/DEMO.md) +[Recording details and reproduction](docs/DEMO.md) -The [Jev aquarium-trip demo](docs/demos/jev-generative-ui.md) walks through a fictional school email, clarification choices, sourced exhibit cards, hands-on preference refinement, and a confirmed selection. [Watch the 83-second live Jev recording](assets/demos/2026-09-23/jev-live-web.mp4), where TypeSafe Jev makes the decisions and a scripted agent keeps the trip scenario repeatable. A [scripted-decision sample recording](assets/demos/2026-09-23/jev-web.mp4) is also available. +The [Jev aquarium-trip demo](docs/demos/jev-generative-ui.md) walks through a fictional school email, clarification choices, sourced exhibit cards, hands-on preference refinement, and a confirmed selection. ## What it is -OpenMuse is a personal-agent application with an agent computer, visible work, and rich results. It runs its own server, task worker, and browser worker. You can inspect and change the source under the MIT license. +OpenFuse is a personal-agent application with an agent computer, visible work, and rich results. It runs its own server, task worker, and browser worker. You can inspect and change the source under the MIT license. The computer combines **persistent Chromium and an optional Linux workspace**. The agent can browse public pages, run commands in its own container, work with files, and move PDFs between the computer and the app. You can open its browser or terminal and continue the work. Graphical desktops and autonomous checkout remain future work. @@ -66,8 +62,8 @@ The [feature inventory](docs/FEATURES.md) describes implemented capabilities and **Requirements:** Node 24 LTS, pnpm 11.19.0, and a CopilotKit Intelligence project key. The local sample app needs no model, Google account, or Docker. ```sh -git clone https://github.com/CopilotKit/OpenMuse.git openmuse -cd openmuse +git clone https://github.com/CopilotKit/OpenFuse.git openfuse +cd openfuse pnpm install --frozen-lockfile cp .env.example .env npx copilotkit@latest login @@ -96,15 +92,15 @@ For iOS or Android, use `pnpm --dir apps/mobile ios` or `pnpm --dir apps/mobile ## Deploy on Render -[![Deploy to Render](https://render.com/images/deploy-to-render-button.svg)](https://render.com/deploy?repo=https://github.com/CopilotKit/OpenMuse) +[![Deploy to Render](https://render.com/images/deploy-to-render-button.svg)](https://render.com/deploy?repo=https://github.com/CopilotKit/OpenFuse) [render.yaml](render.yaml) deploys three services: the API, the web app, and a private browser. The API answers `/` with JSON, so the UI is its own static site. ### First run -1. Click **Deploy to Render**. Wait until `openmuse-api`, `openmuse-web`, and `openmuse-browser` are live. -2. On `openmuse-api`, open **Environment** and copy `OPENMUSE_ACCESS_KEY`. -3. Open the `openmuse-web` URL and sign in with that key. +1. Click **Deploy to Render**. Wait until `openfuse-api`, `openfuse-web`, and `openfuse-browser` are live. +2. On `openfuse-api`, open **Environment** and copy `OPENFUSE_ACCESS_KEY`. +3. Open the `openfuse-web` URL and sign in with that key. 4. Send a message. The deploy form asks for three values you provide. Render generates the other two. @@ -114,18 +110,18 @@ The deploy form asks for three values you provide. Render generates the other tw | `CPK_INTELLIGENCE_API_KEY` | You. Run `npx copilotkit@latest login`, then `npx copilotkit@latest project select`. Keep it on the server. | Chat cannot open a thread. | | `CPK_TELEMETRY_ID` | You. Keep the identity generated by the same project selection. | Runtime usage cannot be attributed to the Intelligence signup account. | | `OPENAI_API_KEY` | You. Used by the default `openai/gpt-5`. Change `MODEL` and supply the matching provider key for Anthropic or Google. | The model call fails. | -| `OPENMUSE_ACCESS_KEY` | Render | You cannot sign in. | +| `OPENFUSE_ACCESS_KEY` | Render | You cannot sign in. | | `TOKEN_ENCRYPTION_KEY` | Render | The API refuses to start in live mode. | -Health check: `https:///api/health`. +Health check: `https:///api/health`. ### Services | Service | Plan | What it runs | |---|---|---| -| `openmuse-api` | Standard, with a 1 GB disk at `/var/data` | The Hono API and the in-process task worker. `DATA_DIR` is `/var/data/openmuse`. | -| `openmuse-web` | Static site | The Expo web export. `EXPO_PUBLIC_API_URL` is baked in at build time. | -| `openmuse-browser` | Private service, Standard, 1 GB disk at `/data` | Playwright and Chromium. The API calls it on the private network. | +| `openfuse-api` | Standard, with a 1 GB disk at `/var/data` | The Hono API and the in-process task worker. `DATA_DIR` is `/var/data/openfuse`. | +| `openfuse-web` | Static site | The Expo web export. `EXPO_PUBLIC_API_URL` is baked in at build time. | +| `openfuse-browser` | Private service, Standard, 1 GB disk at `/data` | Playwright and Chromium. The API calls it on the private network. | **Standard** is the smallest plan that stays up. At 512 MB the process runs out of memory before it binds a port, because PGlite loads an embedded Postgres build. @@ -133,7 +129,7 @@ Health check: `https:///api/health`. **Live mode** is required. Render binds `0.0.0.0`, and sample mode rejects any host that is not loopback. The Blueprint sets `WORKSPACE_MODE=live`. -**Browsing is included, and you can take it out.** `openmuse-browser` is a private service, so it has no public URL. The API reaches it at `http://openmuse-browser:8790` with a token Render generates. If the private hostname is not `openmuse-browser`, set `BROWSER_WORKER_URL` to `http://:8790`. To deploy without it, delete the `openmuse-browser` service and the `BROWSER_WORKER_URL` and `WORKER_TOKEN` entries on `openmuse-api`. Chat, drafts, and tasks still run. Page reads, screenshots, and **Take control** do not. +**Browsing is included, and you can take it out.** `openfuse-browser` is a private service, so it has no public URL. The API reaches it at `http://openfuse-browser:8790` with a token Render generates. If the private hostname is not `openfuse-browser`, set `BROWSER_WORKER_URL` to `http://:8790`. To deploy without it, delete the `openfuse-browser` service and the `BROWSER_WORKER_URL` and `WORKER_TOKEN` entries on `openfuse-api`. Chat, drafts, and tasks still run. Page reads, screenshots, and **Take control** do not. The Docker computer and Google mail or calendar need the setup in the sections below. This Blueprint does not start them. @@ -143,7 +139,7 @@ Copy the commented settings in [.env.example](.env.example) into your private `. 1. Set `AGENT_BACKEND=model`, `MODEL=provider/model-id`, and the matching provider key. CopilotKit supports the configured OpenAI, Anthropic or Google provider. Fictional data can still be used with a real model. Provider keys stay on the server. 2. Create or select a CopilotKit Intelligence project with `npx copilotkit@latest login` and `npx copilotkit@latest project select`. Keep the generated `CPK_INTELLIGENCE_API_KEY` on the server. -3. For personal mail/calendar, set `WORKSPACE_MODE=live`, the generated `CPK_INTELLIGENCE_API_KEY`, a random `OPENMUSE_ACCESS_KEY` of at least 24 characters, and `TOKEN_ENCRYPTION_KEY` containing 32 random bytes encoded as base64. Restart the API. +3. For personal mail/calendar, set `WORKSPACE_MODE=live`, the generated `CPK_INTELLIGENCE_API_KEY`, a random `OPENFUSE_ACCESS_KEY` of at least 24 characters, and `TOKEN_ENCRYPTION_KEY` containing 32 random bytes encoded as base64. Restart the API. 4. Configure a Google OAuth web client with Gmail and Calendar APIs enabled. Set `GOOGLE_CLIENT_ID` and `GOOGLE_CLIENT_SECRET`; register `${PUBLIC_API_URL}/api/google/callback` as its redirect URI. Configure consent/test-user access in your Google project. 5. Open **Apps → Gmail** (or **Google Calendar**), connect read access, and grant write access when needed. Every send or calendar change still requires its own stored review. Changing/disconnecting the account invalidates pending connection-bound work. @@ -173,7 +169,7 @@ Or use `docker compose --env-file .env -f infra/compose.yaml up --build -d`. The Build the computer image, enable it on the API, then open **Computer → Terminal → Start computer**: ```sh -docker build -t openmuse-computer:local apps/computer +docker build -t openfuse-computer:local apps/computer COMPUTER_ENABLED=true pnpm dev ``` @@ -181,7 +177,7 @@ The API needs access to the Docker CLI and engine. Commands run in a nonroot con ### Application storage -By default, embedded PGlite, documents and the signing key live in `.openmuse/`; browser profiles live in `.openmuse/browser-profiles/`. Keep that directory private and back it up. The API hosts the task worker. The host must remain running for background work. +By default, embedded PGlite, documents and the signing key live in `.openfuse/`; browser profiles live in `.openfuse/browser-profiles/`. Keep that directory private and back it up. The API hosts the task worker. The host must remain running for background work. For a separate task worker, configure the same `DATABASE_URL`, secrets and shared `DATA_DIR` for both processes, then set `TASK_WORKER_ENABLED=false` on the API and run `pnpm dev:worker`. PGlite cannot be opened by separate processes. Production commands are `pnpm build:server`, `pnpm start` and `pnpm start:worker`. Run one API instance; task workers coordinate through SQL leases. @@ -195,7 +191,7 @@ Intelligence is a separate service and is not included in this repository's MIT ## Signup and runtime tracking -The CopilotKit SDK sends runtime telemetry through the shared CopilotKit sink to PostHog with `accessibility_title: "OpenMuse"`. Telemetry defaults to full capture; explicit SDK opt-outs and sampling settings take precedence. Keep the CLI-generated `CPK_TELEMETRY_ID` alongside the server-only project key when deploying. Intelligence records completed account signups separately; OpenMuse runtime usage can be joined to those accounts after the sink resolves the identity. [Setup, opt-out and PostHog validation](docs/TELEMETRY.md). +The CopilotKit SDK sends runtime telemetry through the shared CopilotKit sink to PostHog with `accessibility_title: "OpenFuse"`. Telemetry defaults to full capture; explicit SDK opt-outs and sampling settings take precedence. Keep the CLI-generated `CPK_TELEMETRY_ID` alongside the server-only project key when deploying. Intelligence records completed account signups separately; OpenFuse runtime usage can be joined to those accounts after the sink resolves the identity. [Setup, opt-out and PostHog validation](docs/TELEMETRY.md). ## Architecture @@ -230,7 +226,7 @@ flowchart TD ### OpenBot compatibility -OpenMuse's native client and personal-agent workflows are independent of OpenBot. The disabled OpenBot adapter is pinned and contract-tested against upstream interfaces. Live user/session bridging, routine mapping, and computer backend wiring remain future work. OpenBot's Intelligence runtime is not a raw AG-UI endpoint. [Integration contract](docs/OPENBOT-INTEGRATION.md). +OpenFuse's native client and personal-agent workflows are independent of OpenBot. The disabled OpenBot adapter is pinned and contract-tested against upstream interfaces. Live user/session bridging, routine mapping, and computer backend wiring remain future work. OpenBot's Intelligence runtime is not a raw AG-UI endpoint. [Integration contract](docs/OPENBOT-INTEGRATION.md). ## Development diff --git a/ROADMAP.md b/ROADMAP.md index bf271ae1f..83c977334 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -1,4 +1,4 @@ -# OpenMuse roadmap +# OpenFuse roadmap The release is a personal-agent alpha: delegate a job, inspect its plan, supply missing information, review an action, and return to a saved result. The [reference inventory](docs/FEATURES.md) is broader than this release. diff --git a/SECURITY.md b/SECURITY.md index 8065c0393..bcdfc706e 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -6,9 +6,9 @@ Use the repository's **Security → Report a vulnerability** form for private re ## Deployment boundary -OpenMuse currently supports one owner per deployment. Live mode uses a shared access key; it is not multi-tenant account authentication. Sample mode binds to loopback and contains fictional data. Use HTTPS and restricted network access for a remote live deployment. +OpenFuse currently supports one owner per deployment. Live mode uses a shared access key; it is not multi-tenant account authentication. Sample mode binds to loopback and contains fictional data. Use HTTPS and restricted network access for a remote live deployment. -The API holds provider credentials. Google tokens are encrypted at rest; short-lived signed URLs grant file and browser-console access. Protect `.env`, `.openmuse`, database backups, and browser profiles as private data. A signed URL is a credential until it expires. +The API holds provider credentials. Google tokens are encrypted at rest; short-lived signed URLs grant file and browser-console access. Protect `.env`, `.openfuse`, database backups, and browser profiles as private data. A signed URL is a credential until it expires. The browser worker must remain private and require its own random token. It runs persistent Chromium with application-enforced public-network checks. Playwright disables Chromium's internal sandbox by default; this is not a full desktop VM or a security boundary for hostile tenants. The browser Docker image reduces host access but does not establish kernel-enforced network isolation. See [worker boundaries](apps/worker/README.md). @@ -18,7 +18,7 @@ The optional computer service runs a **single-owner Docker Linux container**, se The container runs as UID/GID 1000 with a read-only root filesystem, all capabilities dropped, no added privileges, and Docker networking set to `none`. It receives no host directory mounts, Docker socket, model keys, Google tokens, or API access key. Limits are 512 MB RAM with no swap, one CPU, 128 processes, and 64 MB of temporary storage. Existing containers and volumes must match this deployment's ownership labels and isolation settings before the service attaches. -A named volume persists `/workspace`. Commands may create, change, or delete its files. The file API stays inside `/workspace`, rejects symlink traversal and special files, and uses atomic text replacement. Text reads/writes are limited to 256 KB; PDF import/export is limited to 10 MB and checks ownership in OpenMuse. File contents and command output remain untrusted input for the agent. +A named volume persists `/workspace`. Commands may create, change, or delete its files. The file API stays inside `/workspace`, rejects symlink traversal and special files, and uses atomic text replacement. Text reads/writes are limited to 256 KB; PDF import/export is limited to 10 MB and checks ownership in OpenFuse. File contents and command output remain untrusted input for the agent. Commands have a 30-second container timeout, a 2-second kill grace, a 35-second Docker-client timeout, and a combined 128 KB output cap. The server records output, status, and exit codes. Stop prevents restart until both Docker stop and the original execution are acknowledged. Failed cleanup retains a safety lock and permits an explicit Stop retry. Interrupted work is recorded with an uncertain outcome and is never automatically replayed. @@ -26,7 +26,7 @@ Docker shares its host kernel and does not provide a full VM or a hostile-tenant ### E2B desktop provider (opt-in) -With `COMPUTER_PROVIDER=e2b-desktop`, each owner's computer is a dedicated E2B Desktop VM instead of a Docker container, and the paragraphs above about Docker networking, the read-only root filesystem, capabilities and limits do not apply. Outbound internet access is enabled, the in-VM `user` account has passwordless sudo, and `/workspace` is stored with E2B. Internet access is an egress path that OpenMuse does not review: approval gating covers only the app's own email and calendar tools, so a prompt-injected agent could send data from the computer or submit forms in its browser. The live desktop stream is reachable from the internet and protected only by the VNC password in its URL (8 effective characters); treat that URL as a bearer secret. All listening VM ports are publicly reachable at `https://-.e2b.app` without application authentication; public traffic is enabled to allow the direct desktop iframe. The sandbox ID appears in the stream hostname and is not an access control. For example, `python3 -m http.server 8000` in `/workspace` exposes workspace files to the internet. Do not leave servers running or put sensitive files in an unauthenticated service. The iframe is sandboxed to block forms, popups and top-level navigation, but VM-controlled content can still display misleading prompts. The E2B API key stays on the API host and is never passed into the VM or to the client. A unique `COMPUTER_DEPLOYMENT_ID` is required, because sandboxes are matched by metadata across the whole E2B team. See [the E2B desktop section](docs/COMPUTER.md#run-the-computer-on-an-e2b-desktop-optional). +With `COMPUTER_PROVIDER=e2b-desktop`, each owner's computer is a dedicated E2B Desktop VM instead of a Docker container, and the paragraphs above about Docker networking, the read-only root filesystem, capabilities and limits do not apply. Outbound internet access is enabled, the in-VM `user` account has passwordless sudo, and `/workspace` is stored with E2B. Internet access is an egress path that OpenFuse does not review: approval gating covers only the app's own email and calendar tools, so a prompt-injected agent could send data from the computer or submit forms in its browser. The live desktop stream is reachable from the internet and protected only by the VNC password in its URL (8 effective characters); treat that URL as a bearer secret. All listening VM ports are publicly reachable at `https://-.e2b.app` without application authentication; public traffic is enabled to allow the direct desktop iframe. The sandbox ID appears in the stream hostname and is not an access control. For example, `python3 -m http.server 8000` in `/workspace` exposes workspace files to the internet. Do not leave servers running or put sensitive files in an unauthenticated service. The iframe is sandboxed to block forms, popups and top-level navigation, but VM-controlled content can still display misleading prompts. The E2B API key stays on the API host and is never passed into the VM or to the client. A unique `COMPUTER_DEPLOYMENT_ID` is required, because sandboxes are matched by metadata across the whole E2B team. See [the E2B desktop section](docs/COMPUTER.md#run-the-computer-on-an-e2b-desktop-optional). ## External actions diff --git a/apps/computer/Dockerfile b/apps/computer/Dockerfile index 209fdf60d..f42b4d9a2 100644 --- a/apps/computer/Dockerfile +++ b/apps/computer/Dockerfile @@ -3,11 +3,11 @@ FROM node:22.22.0-bookworm-slim RUN apt-get update \ && apt-get install -y --no-install-recommends bash python3 git coreutils \ && rm -rf /var/lib/apt/lists/* \ - && mkdir -p /opt/openmuse /workspace \ + && mkdir -p /opt/openfuse /workspace \ && chown 1000:1000 /workspace -COPY files.py /opt/openmuse/files.py -RUN chmod 0555 /opt/openmuse/files.py +COPY files.py /opt/openfuse/files.py +RUN chmod 0555 /opt/openfuse/files.py ENV HOME=/workspace LANG=C.UTF-8 WORKDIR /workspace diff --git a/apps/computer/e2b-desktop-smoke.test.ts b/apps/computer/e2b-desktop-smoke.test.ts index 70537b6f8..0de8cb8d0 100644 --- a/apps/computer/e2b-desktop-smoke.test.ts +++ b/apps/computer/e2b-desktop-smoke.test.ts @@ -18,7 +18,7 @@ test("real E2B desktop runs commands, opens GUI apps, streams, acts, persists fi timeout: 300000, skip: !apiKey && "set E2B_API_KEY to run the E2B desktop smoke test", }, async () => { - const directory = await mkdtemp(join(tmpdir(), "openmuse-e2b-desktop-smoke-")); + const directory = await mkdtemp(join(tmpdir(), "openfuse-e2b-desktop-smoke-")); const db = await createStore(); const config: Config = { mode: "sample", diff --git a/apps/computer/files.py b/apps/computer/files.py index ab8067968..270a5f1f3 100644 --- a/apps/computer/files.py +++ b/apps/computer/files.py @@ -76,7 +76,7 @@ def main(): raise ValueError("Only regular files can be replaced") except FileNotFoundError: pass - temporary = ".openmuse-" + uuid.uuid4().hex + temporary = ".openfuse-" + uuid.uuid4().hex fd = os.open(temporary, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o600, dir_fd=directory) try: with os.fdopen(fd, "wb") as target: diff --git a/apps/computer/smoke.test.ts b/apps/computer/smoke.test.ts index fe361ad56..dc9201916 100644 --- a/apps/computer/smoke.test.ts +++ b/apps/computer/smoke.test.ts @@ -16,7 +16,7 @@ import { createStore } from "../server/src/db.ts"; test("real isolated computer executes commands, persists files, bridges PDFs and stops active work", { timeout: 120000, }, async () => { - const directory = await mkdtemp(join(tmpdir(), "openmuse-computer-smoke-")); + const directory = await mkdtemp(join(tmpdir(), "openfuse-computer-smoke-")); const db = await createStore(); const config: Config = { mode: "sample", @@ -29,7 +29,7 @@ test("real isolated computer executes commands, persists files, bridges PDFs and googleRedirectUri: "http://localhost/callback", allowedOrigins: [], computerEnabled: true, - computerImage: process.env.COMPUTER_IMAGE ?? "openmuse-computer:local", + computerImage: process.env.COMPUTER_IMAGE ?? "openfuse-computer:local", computerDeploymentId: `smoke-${randomUUID()}`, }; const server = await createApp(db, config); @@ -68,7 +68,7 @@ test("real isolated computer executes commands, persists files, bridges PDFs and (await post("/files/read", { path: "/workspace/notes/hello.txt" })).text, "Hello from the API ✓", ); - const denied = await post("/commands", { command: "touch /etc/openmuse-must-fail" }); + const denied = await post("/commands", { command: "touch /etc/openfuse-must-fail" }); assert.equal(denied.status, "failed"); const network = await post("/commands", { command: "python3 -c 'import socket; socket.create_connection((\"1.1.1.1\", 443), 1)'", diff --git a/apps/mobile/App.tsx b/apps/mobile/App.tsx index 41152e116..53e192a60 100644 --- a/apps/mobile/App.tsx +++ b/apps/mobile/App.tsx @@ -32,13 +32,13 @@ import { IdeasScreen, } from "./src/agent-ui"; import { AgentWorkspaceProvider, useAgentWorkspace } from "./src/agent-workspace"; -import { API_URL, createSession, MuseApi } from "./src/api"; +import { API_URL, createSession, FuseApi } from "./src/api"; import { ChatScreen, WorkspaceTools } from "./src/chat"; import { ComputerEntry } from "./src/computer"; import { ComputerDraftProvider } from "./src/computer-drafts"; import { Details } from "./src/details"; import { BrowserScreen, CalendarScreen, FilesScreen, MailScreen } from "./src/screens"; -import { ThreadsProvider, ThreadsSheet, useMuseThread } from "./src/threads"; +import { ThreadsProvider, ThreadsSheet, useFuseThread } from "./src/threads"; import { Button, Card, colors, ErrorNotice, Field, IconButton, Mascot, s } from "./src/ui"; import { type Detail, useWorkspace, WorkspaceContext } from "./src/workspace"; @@ -111,7 +111,7 @@ export default function App() { - Welcome to OpenMuse. + Welcome to OpenFuse. A little room for your day. {busy ? ( @@ -130,7 +130,7 @@ export default function App() { Open workspace - Local workspaces open without a key. Make sure your OpenMuse server is running at{" "} + Local workspaces open without a key. Make sure your OpenFuse server is running at{" "} {API_URL}. @@ -142,7 +142,7 @@ export default function App() { ); } function WorkspaceApp({ token }: { token: string }) { - const api = useMemo(() => new MuseApi(token), [token]); + const api = useMemo(() => new FuseApi(token), [token]); const [workspace, setWorkspace] = useState(); const [section, setSection] = useState
("chat"); const [detail, setDetail] = useState(); @@ -250,7 +250,7 @@ function WorkspaceShell({ error: threadsError, retry: retryThreads, enabled: richThreads, - } = useMuseThread(); + } = useFuseThread(); const [threadsOpen, setThreadsOpen] = useState(false); const { width } = useWindowDimensions(); const desktop = width >= 900; @@ -261,7 +261,7 @@ function WorkspaceShell({ data?.tasks.find( (task) => task.status === "waiting_approval" || task.status === "waiting_input", ) || data?.tasks.find((task) => task.status === "running"); - const agentName = data?.identity.name || "OpenMuse"; + const agentName = data?.identity.name || "OpenFuse"; const status = activeTask ? activeTask.status === "waiting_approval" ? `Ready to review · ${activeTask.title}` diff --git a/apps/mobile/README.md b/apps/mobile/README.md index 462d85113..7116de34d 100644 --- a/apps/mobile/README.md +++ b/apps/mobile/README.md @@ -1,14 +1,12 @@ -# OpenMuse mobile +# OpenFuse mobile A shared React Native workspace for iOS, Android, and the web preview. The client uses native primitives and the CopilotKit headless hooks; the web preview renders those same screens through React Native Web. ## Demos -[![OpenMuse on iPhone — watch the 38-second demo](../../assets/demos/2026-09-16/mobile.png)](../../assets/demos/2026-09-16/mobile.mp4) +[Recording setup](../../docs/DEMO.md) -[iPhone · 38 seconds](../../assets/demos/2026-09-16/mobile.mp4) · [Desktop web · 42 seconds](../../assets/demos/2026-09-16/web.mp4) · [Recording setup](../../docs/DEMO.md) - -Meet OpenMuse's capybara in two different journeys: Hacker News and CopilotKit on iPhone; reading a school-trip email and researching aquarium exhibits on desktop. Results appear inline in chat, with **Take control** opening the same browser session. Send and Stop share the input pill's primary control. +Meet OpenFuse's capybara in two different journeys: Hacker News and CopilotKit on iPhone; reading a school-trip email and researching aquarium exhibits on desktop. Results appear inline in chat, with **Take control** opening the same browser session. Send and Stop share the input pill's primary control. ## Run @@ -39,7 +37,7 @@ The `build:ios` and `build:android` commands validate and export platform JavaSc ## Behavior - Chat, Activity, Ideas, Goals and Apps are the primary navigation. Tasks, timelines and notifications refresh from the durable server state. Apps contains Mail, Calendar, Browser, Files and Connections. -- Drafts are saved in OpenMuse and can be reopened from Mail. Mail attachments import into Files before reading. +- Drafts are saved in OpenFuse and can be reopened from Mail. Mail attachments import into Files before reading. - Calendar edits preserve named time zones. Date entry rejects nonexistent times at daylight-saving transitions. - Sending mail and creating, changing, or deleting events require a stored proposal and an explicit review decision. Editing a proposal declines the previous version, then opens a new draft. - Chat restores/saves AG-UI conversation messages, renders frontend tool cards, and supports interruption, retry, and document references. diff --git a/apps/mobile/app.json b/apps/mobile/app.json index 5c7827339..b7285ebfc 100644 --- a/apps/mobile/app.json +++ b/apps/mobile/app.json @@ -1,15 +1,15 @@ { "expo": { - "name": "OpenMuse", - "slug": "openmuse", - "scheme": "openmuse", + "name": "OpenFuse", + "slug": "openfuse", + "scheme": "openfuse", "version": "0.1.0", "orientation": "default", "userInterfaceStyle": "light", "newArchEnabled": true, - "ios": { "supportsTablet": true, "bundleIdentifier": "app.openmuse.mobile" }, - "android": { "package": "app.openmuse.mobile" }, - "web": { "bundler": "metro", "name": "OpenMuse — a little room for everything" }, + "ios": { "supportsTablet": true, "bundleIdentifier": "app.openfuse.mobile" }, + "android": { "package": "app.openfuse.mobile" }, + "web": { "bundler": "metro", "name": "OpenFuse — a little room for everything" }, "plugins": [ "expo-document-picker", "@config-plugins/react-native-blob-util", diff --git a/apps/mobile/assets/README.md b/apps/mobile/assets/README.md index 71d8f1a96..efa7efe59 100644 --- a/apps/mobile/assets/README.md +++ b/apps/mobile/assets/README.md @@ -1,5 +1,5 @@ -# OpenMuse capybara +# OpenFuse capybara -`capybara.png` is original artwork generated for OpenMuse with the built-in image-generation tool on September 16, 2026. The transparent PNG is bundled locally and used by the shared `Mascot` component. Sky, sand and lilac backgrounds preserve the avatar color preference. The asset is included under this repository's MIT license. +`capybara.png` is original artwork generated for OpenFuse with the built-in image-generation tool on September 16, 2026. The transparent PNG is bundled locally and used by the shared `Mascot` component. Sky, sand and lilac backgrounds preserve the avatar color preference. The asset is included under this repository's MIT license. Generation prompt: “An original friendly capybara assistant mascot, with a broad boxy rounded snout, small round ears, tiny relaxed eyes, a squat body and short legs. Sitting in a gentle three-quarter view, with warm caramel and oat tan coloring, a calm expression, a soft clay/plush finish and restrained detail readable at 48–96 pixels. Entire character centered on a transparent background. One character, no clothing, props, text, logos or watermark.” diff --git a/apps/mobile/package.json b/apps/mobile/package.json index 832ac35ad..a468dc645 100644 --- a/apps/mobile/package.json +++ b/apps/mobile/package.json @@ -1,5 +1,5 @@ { - "name": "@openmuse/mobile", + "name": "@openfuse/mobile", "version": "0.1.0", "private": true, "main": "index.js", diff --git a/apps/mobile/src/agent-ui.tsx b/apps/mobile/src/agent-ui.tsx index ead833976..4939c12c7 100644 --- a/apps/mobile/src/agent-ui.tsx +++ b/apps/mobile/src/agent-ui.tsx @@ -934,7 +934,7 @@ export function DelegateSheet({ goalId, milestoneId }: { goalId?: string; milest return ( {milestoneId && ( @@ -1147,7 +1147,7 @@ function IdeaCard({ idea }: { idea: Idea }) { {editing && ( void }) { {sample ? "Changes to this built-in page stay in your workspace." - : "OpenMuse checks this public page on the server and saves meaningful changes in Notifications."} + : "OpenFuse checks this public page on the server and saves meaningful changes in Notifications."}