cowork-to-code-bridge — let a sandboxed agent safely reach Open Interpreter's real machine (async, file-based RPC)

[abhinaykrupa]

cowork-to-code-bridge — let an Open Interpreter session running in a sandbox reach the real machine

Open Interpreter shines when it has the actual machine — your files, your installed tools, your git remotes. But when OI (or any agent) runs somewhere sandboxed — a cloud notebook, a CI runner, a chat surface like Claude Cowork — it's walled off from the box where the work actually needs to happen.

cowork-to-code-bridge closes that gap with a local-first, file-based RPC: the sandboxed agent queues a task into a shared directory, and a small daemon on your real Mac/Linux box picks it up, runs it (build, test, git push, brew install, docker, whatever), and returns the result through the same directory. No inbound ports, no HTTPS tunnel, no exposing your machine to the internet — just a bind-mounted folder.

Why it might interest this crowd:

• Async by default. queue_task() is fire-and-forget and returns a task_id; poll_task_result() is idempotent. Long builds don't block the agent loop. There's also a blocking call_remote() for quick stuff.
• Idempotency keys so a retried task (commit, push, install) doesn't double-fire.
• Safety rails for delegated execution: per-task permission scopes (plan / readonly / edit / full), a per-task USD budget cap, and an owner-set ceiling that always wins over whatever the caller requests.
• Model routing: tasks can request a tier (haiku/sonnet/opus) and the daemon maps it to the right model.
• It's plain Python + bash, no heavy deps — easy to wire into an OI tool/function.

The pattern generalizes to any agent framework (it's been wired to AutoGen, LlamaIndex, CrewAI, etc.), but the OI use case is especially clean: "run this on my actual machine" is exactly OI's wheelhouse, and the bridge gives a sandboxed OI that reach safely.

Repo + quickstart: https://github.com/abhinaykrupa/cowork-to-code-bridge

Would love feedback from anyone running OI in a constrained/remote environment — does the async queue + permission-scope model fit how you'd want to delegate to your local box?