by zosmaai
Desktop GUI for the pi coding agent — open-source Claude Cowork alternative
# Add to your Claude Code skills
git clone https://github.com/zosmaai/zosma-coworkLast scanned: 7/29/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@trickfilm400/rollup-plugin-off-main-thread: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "brace-expansion: brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash",
"severity": "high"
},
{
"type": "npm-audit",
"message": "ejs: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "filelist: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "jake: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "minimatch: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "vite-plugin-pwa: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "workbox-build: Vulnerability found",
"severity": "high"
}
],
"status": "WARNING",
"scannedAt": "2026-07-29T06:30:50.174Z",
"npmAuditRan": true,
"pipAuditRan": true,
"promptInjectionRan": true
}zosma-cowork is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by zosmaai. Desktop GUI for the pi coding agent — open-source Claude Cowork alternative. It has 100 GitHub stars.
zosma-cowork returned warnings in SkillsLLM's automated security scan. It has no critical vulnerabilities, but review the flagged issues in the Security Report section before adding it to your workflow.
Clone the repository with "git clone https://github.com/zosmaai/zosma-cowork" and add it to your Claude Code skills directory (see the Installation section above).
zosma-cowork is primarily written in TypeScript. It is open-source under zosmaai on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh zosma-cowork against similar tools.
No comments yet. Be the first to share your thoughts!
Requires a passing catalog security scan. Resolve the flagged issues and resubmit to enable featuring.
English | 中文 | Español | 日本語 | Deutsch | Français | Português | Русский | 한국어 | हिंदी
📖 Documentation: cowork.zosma.ai
A desktop agentic work harness built on pi, the minimal, language-agnostic coding agent harness. Streaming, thinking, tool calls, multi-turn sessions — all free, all open-source, all local.
Built by Zosma AI.
Invoice processing with natural language agents. See more demos at zosma.ai/zosma-cowork/gallery
Zosma Cowork is a desktop application built on pi — the minimal, language-agnostic coding agent harness. pi's philosophy of simplicity and composability carries directly into your desktop experience. Every pi extension works out of the box, with zero wrappers or adapters.
Zosma Cowork is 100% free and open-source (MIT). Bring your own API key, use an existing subscription (Claude, ChatGPT, Copilot), or run local models — you stay in control.
The pi ecosystem includes hundreds of extensions, skills, tools, prompts, and themes — all compatible with Zosma Cowork. Plug them into your ~/.zosmaai/cowork/ directory and they just work. No wrapping, no porting, no lock-in.
DefaultResourceLoader — skills, tools, and prompts auto-discovered from ~/.zosmaai/cowork/~/.zosmaai/cowork/Cmd/Ctrl+Shift+K to focus, Cmd/Ctrl+N for new sessionThe diagram is generated from assets/architecture.mmd. To update:
# Edit assets/architecture.mmd, then re-render:
mmdc -i assets/architecture.mmd -o assets/architecture.png -t default -b white -w 900 -H 700 -s 2
See the full Product Roadmap for phased plans, competitive positioning, and technical decisions.
System Architecture — Full stack: React → Rust → Node sidecar → pi SDK
Communication Flow — Sequence diagram: streaming events pipeline
Extension Ecosystem — 4 tiers: installed, vendored, planned, future
Competitive Positioning — Quadrant chart vs Cursor, Hermes, Slack AI
Roadmap Timeline — Gantt chart: 6 phases, 28 weeks
Data Flow — User → App → Agent → Storage layers
| Layer | Technology |
|---|---|
| Frontend | React 19, Tailwind CSS v4, Radix UI |
| Desktop Shell | Tauri v2, Rust, Tokio |
| Agent Engine | Node.js sidecar using @earendil-works/pi-coding-agent (pi-mono SDK) |
| Testing | Vitest, Testing Library, jsdom |
| Linting | Biome (frontend + sidecar), Clippy (Tauri relay) |
# Install frontend dependencies
npm install
# Install agent-sidecar dependencies
cd agent-sidecar && npm install && cd ..
# Run frontend dev server
npm run dev:frontend
# Run full Tauri app (frontend + Rust relay + Node.js sidecar)
npm run dev
npm run devruns the sidecar from TypeScript source viatsx— no bundle needed. On a fresh checkout it auto-generates lightweight dev stubs for the Tauri bundle resources (src-tauri/agent-sidecar/index.cjs,src-tauri/binaries/node) so the Rust shell can compile. The real sidecar bundle and Node.js binary are produced only by the production build (npm run build).
# Frontend
npm run lint # Biome lint
npm run typecheck # TypeScript check
npm run test # Vitest run
npm run validate # lint + typecheck + test
npm run format # Biome format
# Tauri
npm run build:frontend
npm run build # Build release binary
# Agent Sidecar
cd agent-sidecar
npm run build # TypeScript → JavaScript
npm run dev # tsx watch (standalone development)
# Rust (Tauri relay only)
cargo fmt --all --check
cargo clippy --workspace -- -D warnings
Every merge to main produces unsigned cross-platform installers via the
Staging Build workflow (.github/workflows/staging-build.yml). The bundles
are attached as workflow artifacts (14-day retention) and a Discord embed
with auth-free nightly.link download URLs is posted
to whatever channel the DISCORD_STAGING_WEBHOOK repo secret points at
(typically #staging-builds).
This flow does not create a GitHub Release, tag a commit, or publish to
AUR / winget / Homebrew — those side-effects remain gated on the
tag-triggered release.yml. See issue
#133 for the design.
To run a staging build on demand, trigger Staging Build from the Actions
tab via Run workflow.
One-time setup: in Discord, open the target channel → Edit Channel →
Integrations → Webhooks → New Webhook, copy the URL, then add it as a
GitHub repo secret named DISCORD_STAGING_WEBHOOK (Settings → Secrets and
variables → Actions → New repository secret). The workflow degrades
gracefully — if the secret is unset the notify job emits a warning and
exits 0, so the build itself still succeeds and the artifacts are still
uploaded.
| What | Location | Notes |
|---|---|---|
| LLM providers & API keys | ~/.zosmaai/cowork/auth.json |
Managed by the app |
| Model definitions | ~/.zosmaai/cowork/models.json |
Managed by the app |
| Extensions & skills | ~/.zosmaai/cowork/extensions/ |
Pi-compatible extensions |
| Session history | ~/.zosmaai/cowork/ |
Managed by Zosma Cowork |
The Tauri relay communicates with the Node.js sidecar via stdin/stdout JSON lines:
Commands (→ sidecar):
| Command | Description |
|---|---|
init |
Initialize agent with zosmaDir config |
get_models |
List available models from all providers |
prompt |
Send user message, stream events |
abort |
Cancel running prompt |
set_model |
Switch active model |
save_auth |
Save API key for a provider |
reload |
Reinitialize with fresh extensions/auth |
Events (← sidecar):
| Event | UI Effect |
|---|---|
ready |
Models loaded, enable UI |
event |
Agent session events (thinking, text, tool calls) |
done |
Prompt completed |
result |
Response to a request command |
error |
Error with message |
zosma-cowork/
├── agent-sidecar/ # Node.js agent process
│ └── src/
│ └── index.ts #