OpenBot

Author: davidmckayv

.env.example

@@ -0,0 +1,151 @@
+DATABASE_URL=postgres://openbot:openbot@localhost:5432/openbot
+# Credential vault encryption key. The example value is public and only suitable for local
+# development. Production refuses to start with this key.
+#   openssl rand -base64 32
+KEY_ENCRYPTION_KEY=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
+PORT=3001
+TENANT_PACKAGE_DIR=../examples/fintech
+# What this deployment calls itself, when more than one shares an Intelligence project. A copy of a
+# deployment made for development uses the same project key, and threads are listed per Bot with
+# nothing to say which deployment a conversation came from. The name goes into every thread id this
+# deployment mints, so its own conversations stay identifiable. Unset, the tenant package's id is
+# used, which tells two packages apart but not two copies of one.
+# DEPLOYMENT_ID=
+# Google sign-in. Leave commented for local development with OPENBOT_DEV_NO_AUTH; uncomment all five
+# settings together so authentication is either fully configured or absent.
+#
+# BETTER_AUTH_SECRET must be a high-entropy secret of at least 32 characters. Generate one:
+#   openssl rand -base64 32
+# TRUSTED_ORIGINS is where the app is served from, which is port 3010 locally.
+# BETTER_AUTH_URL=http://localhost:3001
+# BETTER_AUTH_SECRET=
+# GOOGLE_OAUTH_CLIENT_ID=
+# GOOGLE_OAUTH_CLIENT_SECRET=
+# INITIAL_ADMIN_EMAILS=admin@example.com
+
+# Local development only. This admits every request as one local administrator. Keep it explicit and
+# never expose a deployment to the internet in this state; production refuses to start with it.
+OPENBOT_DEV_NO_AUTH=true
+TRUSTED_ORIGINS=http://localhost:3010
+
+# CopilotKit Intelligence. Required: the server refuses to start without all four because
+# Intelligence owns durable threads and memory and a deployment without it forgets every
+# conversation. There is no degraded mode.
+#
+# Do not run Intelligence yourself. These two point at the managed service and should be left
+# unchanged; the CLI below provisions a free licence for it. Running Intelligence on your own
+# infrastructure is an Enterprise Intelligence Platform feature deployed by Helm chart, and is not
+# self-serve: https://docs.showcase.copilotkit.ai/premium/self-hosting
+INTELLIGENCE_API_URL=https://api.intelligence.copilotkit.ai
+INTELLIGENCE_GATEWAY_WS_URL=wss://realtime.intelligence.copilotkit.ai
+#
+# Get both of the next two from the CopilotKit CLI:
+#
+#   npx --yes copilotkit@latest login           # browser sign-in
+#   npx --yes copilotkit@latest project select  # prints the cpk-... runtime key -> INTELLIGENCE_API_KEY
+#   npx --yes copilotkit@latest license --write # writes COPILOTKIT_LICENSE_TOKEN into this file
+#
+# The runtime key is also under "API Keys" in your project at https://intelligence.copilotkit.ai
+INTELLIGENCE_API_KEY=
+COPILOTKIT_LICENSE_TOKEN=
+
+# Model key. Required by the proof-of-concept Bot, which speaks OpenAI's API directly, and by the
+# framework Bot unless you point it at another provider below.
+OPENAI_API_KEY=
+
+# Framework Bot provider: openai, anthropic or google. It reads that provider's own
+# key and refuses to start without it, so a deployment on Anthropic never needs an OpenAI key for it.
+# The proof-of-concept Bot is OpenAI only by construction: it speaks that API directly.
+# BOT_PROVIDER=openai
+# ANTHROPIC_API_KEY=
+# GOOGLE_API_KEY=
+
+# Which model. Defaults per provider: gpt-5.5, claude-sonnet-4-5, gemini-2.5-flash.
+# BOT_MODEL=gpt-5.5
+
+# OpenAI only. Its newer models require the Responses API, which the framework Bot handles and the
+# proof-of-concept one cannot.
+# BOT_RESPONSES_API=false
+
+# The Bot computer. Absent means the feature is off and its routes are not mounted.
+AGENT_COMPUTER_URL=http://localhost:4100
+# Secret every computer requires from its caller. `agent-computer` drives a browser holding real
+# logins, while policy, audit and sign-in live in the API server. The computer refuses to start
+# without this value and refuses every request that does not present it. Use a long random value;
+# `scripts/start.sh` sets a development one for you.
+COMPUTER_TOKEN=
+# Local only. Lets a Bot browse this machine's own services; never set this in a deployment.
+AGENT_COMPUTER_ALLOW_PRIVATE_HOSTS=true
+#
+# What a Bot may do on its computer, as one JSON object. Absent uses the built-in default, which
+# permits the acting tools and forbids nothing, and records every action either way.
+#
+# `deny` is evaluated first and beats `allow`. An empty `allow` permits nothing, a missing policy
+# permits nothing, and a rule that fails to parse denies rather than letting the action through. The
+# server refuses to start if this is set and malformed, so an invalid restriction never falls back to
+# permissive behavior.
+#
+# Workspace and browser profile per Bot. Each Bot's computer is its own container with its own
+# volumes, so one Bot cannot read another's files or use another's logins, and every action records
+# which Bot took it. A rule can still restrict a single Bot with `bot.id`.
+#
+# Attributes: tool.name, bot.id, actor.id, page.url, page.host, element.ref/role/name/type,
+#             key, file.path, file.name, file.extension.
+#
+# Name every route to the same effect. A form submits from a keypress in any of its fields, so a rule
+# that only blocks a Submit button does not block Enter from another field. The example below refuses
+# Enter outright for that reason.
+# Functions: contains(haystack, needle) and matches(value, pattern), both case-insensitive.
+# `enforce` blocks; `dry-run` decides and records but lets everything through, so a new rule can be
+# tried against real traffic before it starts refusing anybody's work.
+#
+# AGENT_COMPUTER_POLICY={"mode":"enforce","deny":["(intent == \"activate\" && contains(element.name, \"submit\")) || (tool.name == \"computer_key\" && key == \"Enter\")"],"allow":["true"]}
+
+# How long one action waits for its element, in ms. Read by agent-computer, not the server.
+# ACTION_TIMEOUT_MS=10000
+
+# ---------------------------------------------------------------------------
+# The computer's profile and where its traffic leaves from
+# ---------------------------------------------------------------------------
+
+# Chromium profile directory inside agent-computer, mounted from the `agent-profiles` volume in
+# docker-compose.yml. Pointing it somewhere unmounted disables login persistence.
+# PROFILES_DIR=/profiles
+
+# Which Bot this computer belongs to, and therefore which profile directory it uses.
+# COMPUTER_BOT_ID=shared
+
+# Per-Bot egress identity. A proxy the Bot's browser sends everything through, so the far side sees a
+# stable address it can allow-list or attribute to that Bot. `EGRESS_PROXY_<BOT>` names one Bot,
+# `EGRESS_PROXY_DEFAULT` covers the rest, and absent means the browser goes out directly.
+#
+# Credentials may be in the URL and are split out before Playwright sees them. Only the HOST is ever
+# reported back on the admin page or the API, so the password does not end up on a screen.
+#
+# This is attribution, not anonymity, and it is not a boundary by itself: it gives a security team a
+# per-Bot address for network rules alongside AGENT_COMPUTER_POLICY.
+# EGRESS_PROXY_DEFAULT=http://user:password@proxy.internal:8080
+# EGRESS_PROXY_SALES_BOT=http://sales.proxy.internal:8080
+
+
+# The managed teammate AG-UI endpoint. Required: use an HTTP(S) URL.
+MANAGED_AGENT_AG_UI_URL=http://localhost:4200/ag-ui
+
+# The second Bot in the box runs on http://localhost:4201/ag-ui, on a framework rather than
+# proof of concept, and is reached the same way: point MANAGED_AGENT_AG_UI_URL at it, or add it as a
+# Bot of its own in the tenant package or at /agents.
+
+# Which model the Bots use. agent-bot speaks /v1/chat/completions and cannot use gpt-5.6-*, which
+# require the Responses API. agent-langgraph can: set BOT_RESPONSES_API=true and give it a 5.6 model.
+# BOT_RESPONSES_API=false
+
+# One computer per Bot. Unset, every Bot shares the computer at AGENT_COMPUTER_URL, suitable on a
+# laptop and explicit about being one shared machine. Set, the supervisor gives each Bot a container
+# of its own, with its own /workspace and its own browser profile.
+COMPUTER_SUPERVISOR_URL=
+# Shared with the supervisor. Not the security boundary, its four verbs are, but it keeps anything
+# else that can reach the port from cycling a Bot's computer.
+SUPERVISOR_TOKEN=
+# Set to runsc to run every computer under gVisor, if the host has it. Unset, a computer is an
+# ordinary container and shares the host kernel, which is worth knowing when the Bot is not ours.
+COMPUTER_RUNTIME=

.gitattributes

@@ -0,0 +1,2 @@
+# Auto detect text files and perform LF normalization
+* text=auto

.github/workflows/ci.yml

@@ -0,0 +1,85 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+# Least privilege by default. Jobs that need more must declare it locally.
+permissions:
+  contents: read
+
+# The newest push on a branch wins; main runs are retained for badge and release history.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  # Formatting, linting, typing and tests are independent checks, so each reports its own result.
+  static:
+    name: format, lint, types
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # Checkout leaves a usable credential in the runner otherwise, which every later step and
+          # every action it calls can read. Nothing here pushes.
+          persist-credentials: false
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: 1.3.14
+      - run: bun install --frozen-lockfile
+      - run: bun run format:check
+      - run: bun run lint
+      - run: bun run typecheck
+
+  test:
+    name: tests
+    runs-on: ubuntu-latest
+    # The suite includes a real database integration test. Without a database it fails on every run,
+    # including on main, which trains everyone to read a red CI as normal. pgvector rather than plain
+    # postgres because the knowledge schema uses the extension.
+    services:
+      postgres:
+        image: pgvector/pgvector:pg17
+        env:
+          POSTGRES_DB: openbot
+          POSTGRES_USER: openbot
+          POSTGRES_PASSWORD: openbot
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U openbot -d openbot"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+    env:
+      DATABASE_URL: postgres://openbot:openbot@localhost:5432/openbot
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: 1.3.14
+      - run: bun install --frozen-lockfile
+      # Not the db:migrate script: that one loads ../.env, which does not exist in CI. DATABASE_URL
+      # comes from the job env instead, which drizzle.config.ts already reads.
+      - run: bunx drizzle-kit migrate --config=drizzle.config.ts
+        working-directory: server
+      # A passing job must include the expected test floor. Import-time failures can otherwise skip
+      # files before their tests are registered.
+      - run: bun run test:ci
+
+  build:
+    name: build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: 1.3.14
+      - run: bun install --frozen-lockfile
+      - run: bun run build

.github/workflows/security_zizmor.yml

@@ -0,0 +1,56 @@
+name: security / zizmor
+
+# zizmor runs static analysis over every workflow under .github/workflows looking for the well-known
+# classes of GitHub Actions footguns: template injection from untrusted input, dangerous triggers
+# like `pull_request_target`, unpinned `uses:` refs, excessive token scopes, secret exfiltration
+# through job outputs, and a long tail of others.
+#
+# Public pull requests make workflow inputs and token scopes a security boundary.
+#
+# Findings at `low` confidence and above fail the job. Intentional exceptions belong in
+# `.github/zizmor.yml` with a justification.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - ".github/workflows/**"
+      - ".github/actions/**"
+      - ".github/zizmor.yml"
+  pull_request:
+    paths:
+      - ".github/workflows/**"
+      - ".github/actions/**"
+      - ".github/zizmor.yml"
+  schedule:
+    # Catch findings introduced by newly-published advisories even in a week when no workflow changed.
+    - cron: "0 9 * * 1"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  zizmor:
+    name: Static analysis (zizmor)
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        # `min-severity: low` blocks on the broadest set of findings without flagging
+        # hypothetical-only informational notes.
+        uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1
+        with:
+          min-severity: low
+          advanced-security: false
+          config: .github/zizmor.yml

.github/zizmor.yml

@@ -0,0 +1,15 @@
+# zizmor configuration, static analysis for GitHub Actions workflows.
+#
+# Docs: https://docs.zizmor.sh/configuration/
+#
+# This lives at `.github/zizmor.yml` because zizmor discovers it there. The workflow at
+# `.github/workflows/security_zizmor.yml` runs it and fails on findings at the configured level.
+#
+# Findings that cannot be remediated belong under `rules:` with a justification. Blanket suppressions
+# are not allowed.
+
+rules:
+  # `template-injection` flags untrusted ${{ }} expansions inside `run:` scripts. Route values
+  # through `env:` and reference the environment variable inside the shell.
+  template-injection:
+    ignore: []

.gitignore

@@ -0,0 +1,16 @@
+.worktrees/
+.superpowers/
+docs/superpowers/
+
+docs/specs/
+docs/plans/
+.env
+.env.*
+!.env.example
+node_modules/
+**/dist/
+app/src/lib/generated/application-config.ts
+.logs/
+.demo-logs/
+**/.impeccable
+.wave-state.md

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 CopilotKit
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.