Codync - Moses Yebei

Abstract

The open-source Grok Bot alternative: message Claude Code, Codex, Cursor, Gemini and 40+ AI agents as bots on your own computer, from iPhone, Mac, Windows, Linux or terminal. Free. Also a Muse and Dots alternative. Built in Rust.

The Problem

Developers spend excessive time switching contexts between local terminals and cloud‑hosted AI assistants. Each agent (Claude Code, Codex, Gemini, etc.) requires a separate session and manual credential handling, which slows iterative coding and increases friction for non‑technical teammates.

What This Does

Codync turns each AI agent into a persistent bot that can be messaged from any device—iPhone, macOS, Windows, Linux, or terminal. Bots expose a unified chat interface, keep state across sessions, and deliver notifications when work completes. The desktop experience lives under apps/desktop. The entry point is apps/desktop/src/main/index.ts, which launches an Electron window (apps/desktop/electron-builder.yml) and loads the renderer bundle (apps/desktop/src/renderer/main.tsx). The renderer communicates with a Rust‑based host (host/Cargo.toml) through IPC; host modules (apps/desktop/src/main/host-controller.ts and host-proxy.ts) orchestrate agent calls, file access, and network requests.

The web preview is served from web/, built with Next.js (web/package.json). The web side also uses the same Rust host via WebAssembly (web/wasm/).

How It Is Wired

Entry point: apps/desktop/src/main/index.ts → electron-builder → apps/desktop/src/renderer/main.tsx. From the renderer, the BotStore (apps/desktop/src/renderer/store/bot-store.ts) holds bot metadata. On user interaction, BotSync (apps/desktop/src/renderer/store/bot-sync.ts) dispatches IPC messages to the host. The host (host/src/lib.rs) receives the command, resolves the target agent via host-proxy.ts, and forwards the request to the relevant SDK (e.g., Claude SDK in apps/desktop/src/main/claude.ts). The response flows back through IPC to the renderer, where ChatWindow (apps/desktop/src/renderer/views/ChatWindow.tsx) renders the message.

External touches:

Network: HTTP requests to AI provider APIs (e.g., Claude, Gemini) are performed in the host; the URLs and keys are expected in environment variables referenced in host/Cargo.toml.
Filesystem: File reads/writes are routed through apps/desktop/src/main/file-saves.ts and file-sink.ts.
Notifications: macOS (apps/desktop/resources/mac/com.pokai.Codync.dev.screen.plist) and Windows installers use native notification APIs exposed via the Electron renderer.

Wiring cost: The host is a single hub; changes to agent logic require edits in host/Cargo.toml and the corresponding JS glue in apps/desktop/src/main/*.ts. The renderer has minimal coupling, delegating all heavy lifting to the host.

How To Use It

# Clone
git clone https://github.com/moses-y/Codync
cd Codync

# Build desktop
cd apps/desktop
npm install          # uses package.json
npm run build        # generates dist/ and electron-builder config

# Run locally
npm run dev          # launches Electron with hot reload

Configuration Create a .env file in apps/desktop or set environment variables at runtime. Required keys are listed in host/Cargo.toml under [dependencies] for each AI provider. For example, CL_AZURE_KEY for Claude, GEMINI_API_KEY for Gemini.

Running The built binary is in apps/desktop/dist/. On macOS, double‑click codync-macos.dmg; on Windows, run codync-windows-x64.exe; on Linux, execute the AppImage from dist/.

Real‑World Use

A mobile developer opens the Codync iOS app, selects the “Claude Code” bot, and types: “Review my pull request #42 and suggest improvements.” The iOS client sends the message via a WebSocket to the local host; the host forwards it to Claude, streams the response back, and the iOS UI shows the review in real time. Meanwhile, the desktop app shows a notification, allowing the developer to click and jump into the review conversation.

Code Health & Issues

Tests: 100 test files under tests/ and cloud/test/e2e/.
CI: Workflows in .github/workflows/ cover desktop (release-desktop.yml), host (host.yml), and cloud (cloud.yml).
License: Apache‑2.0 (LICENSE).
No structural red flags per static analysis.
Missing: No automated linting configuration (e.g., ESLint) is present; adding one would improve code quality.

The Bottom Line

Codync offers a pragmatic, free solution for embedding AI agents as first‑class teammates. Its split between a Rust host and a lightweight Electron renderer keeps the codebase modular, but adding new agents requires updates in both the host Cargo configuration and the JS glue layer. The project is well‑structured, with comprehensive CI and a clear build path, making it suitable for teams that need on‑premise AI integration without subscription overhead.

What the analyser found

Deployment readiness

6/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

2,028 files

Swift194
TypeScript166
Rust166
TSX127
JSON86
Markdown79

ReactNext.jsTailwind

Module dependencies

The 10 most depended-upon modules of 316, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_sktop_src_renderer_lib_fonts["fonts"] n1_src_renderer_components_Icon["Icon"] n2_p_src_renderer_store_context["context"] n3_renderer_components_Controls["Controls"] n4__renderer_components_Overlay["Overlay"] n5_src_renderer_store_bot_store["bot-store"] n6__src_renderer_lib_observable["observable"] n7_c_renderer_components_Avatar["Avatar"] n8_web_app_links["links"] n9_src_renderer_store_app_model["app-model"] n7_c_renderer_components_Avatar --> n1_src_renderer_components_Icon n3_renderer_components_Controls --> n0_sktop_src_renderer_lib_fonts n3_renderer_components_Controls --> n1_src_renderer_components_Icon n3_renderer_components_Controls --> n4__renderer_components_Overlay n4__renderer_components_Overlay --> n0_sktop_src_renderer_lib_fonts n4__renderer_components_Overlay --> n1_src_renderer_components_Icon n9_src_renderer_store_app_model --> n6__src_renderer_lib_observable n9_src_renderer_store_app_model --> n5_src_renderer_store_bot_store n2_p_src_renderer_store_context --> n6__src_renderer_lib_observable n2_p_src_renderer_store_context --> n9_src_renderer_store_app_model n2_p_src_renderer_store_context --> n5_src_renderer_store_bot_store classDef cyc stroke:#ef4444,stroke-width:2px; class n9_src_renderer_store_app_model cyc;

Dependencies

4 of 44 declared dependencies are a major version behind. Resolved 28 of 44 against the registry.

Package	Declared	Latest	Behind
`@types/node`	^24.0.0	26.2.0	2 major
`@vitejs/plugin-react`	^5.2.0	6.0.5	1 major
`typescript`	^6.0.3	7.0.2	1 major
`vite`	^7.3.6	8.2.1	1 major

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high3

medium4

low2

Pin third-party GitHub Actions to a commit SHAhigh2 occurrences

.github/workflows

Swatinem/rust-cache@v2, softprops/action-gh-release@v2

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Upgrade the pinned dependency carrying a published advisoryhigh10 occurrences

tokio@1 CVE-2021-45710 (high) +7 more; futures-util@0.3 CVE-2020-35908 (medium) +1 more

The pinned version is the one that installs, so a published advisory against it describes this deployment rather than a hypothetical one, and the advisory is also a public description of how to exploit it.

Fix: Upgrade to the fixed version named in the advisory, then commit the lockfile.

Open a pull request instead of pushing to the default branchhigh

.github/workflows/host.yml

git push

Automated commits land on the branch that deploys, with no test having run against the result.

Fix: Push to a bot branch and open a pull request, or restrict the push to a tag ref.

Declare least-privilege permissions for GITHUB_TOKENmedium

.github/workflows/cloud.yml

1 workflow(s) declare no permissions

With no declaration the token inherits the repository default, so any injected step can push commits or mint releases from inside your own CI.

Fix: Add permissions: contents: read at the top of the workflow and widen per job only where needed.

Enable Dependabot or Renovatemedium

7 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Set persist-credentials: false on checkoutmedium

.github/workflows/cloud.yml

checkout keeps the token, then dependencies are installed

The token stays in .git/config for every later step, so a malicious postinstall script reads a pushable credential without one ever being passed to it.

Fix: Add with: persist-credentials: false, and pass an explicit token only to the step that pushes.

Set timeout-minutes on the workflow jobslow4 occurrences

.github/workflows/auto-tag.yml

4 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Add the repository convention files this project lackslow3 occurrences

missing .editorconfig, .gitattributes, a formatter config

Without them one contributor's editor writes tabs into a Python file, a shell script commits with CRLF and fails in the container, and a notebook diff is unreviewable.

Fix: Add .editorconfig, .gitattributes with text=auto eol=lf, and a formatter config.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.