The Problem

opcode is a desktop GUI application for managing Claude Code sessions, custom agents, and usage analytics. At 234 files with 127 source files and 79 Tauri components, it serves as a command center for AI-assisted development but suffers from structural issues that increase cognitive load and introduce security risk: deep nesting in execution files, circular import dependencies, duplicated logic across 55 files, and a critical vulnerability in a pinned Tauri plugin.

What This Does

opcode provides a Tauri 2-built desktop application (src-tauri/) with a React frontend (src/) for managing Claude Code projects and sessions. The codebase is organized into two projects: src (127 files, 121 code files) and src-tauri (79 files, 20 code files). Entry points are index.html, src/App.tsx, src/components/index.ts, src-tauri/src/main.rs, and src-tauri/src/lib.rs. Core functionality includes project/browsing (src/components/ProjectList.tsx), agent creation/management (src/components/CreateAgent.tsx, src/components/CCAgents.tsx), session execution (src/components/AgentExecution.tsx, src/components/AgentRunOutputViewer.tsx), and usage analytics (src/components/UsageDashboard.tsx). The app touches the filesystem through src-tauri/src/commands/storage.rs, binary execution via src-tauri/src/commands/claude.rs, and network operations through Tauri's webview integration. Six modules participate in circular imports (src/components/AgentExecution.tsx, src/components/StreamMessage.tsx, src/components/CCAgents.tsx), and 755 duplicated 6-line blocks across 55 files indicate widespread copy-paste patterns that ripple through project/settings/tab content components.

How It Is Wired

Execution flows through src/App.tsx → src/components/index.ts → component rendering. Agent execution routes through src-tauri/src/commands/agents.rs and src-tauri/src/commands/claude.rs in the Tauri backend, which interact with src-tauri/src/checkpoint/manager.rs for state management. The src/components/AgentExecution.tsx file (866 lines) is the primary cognitive load hotspot with indentation depth reaching 11 and 205 branch points over 596 lines in src/components/StreamMessage.tsx. The src/lib/api.ts file (866 lines) similarly suffers from oversized coupling. Import cycles involve src/components/AgentExecution, src/components/StreamMessage, and src/components/CCAgents, creating fragile interdependencies. The src/hooks/index.ts module (7 imports) and src/components/ErrorBoundary (7 imports, 0 exports) represent cleaner boundaries amid the complexity.

How To Use It

Setup: Clone with git clone https://github.com/moses-y/opcode (verbatim URL). Install dependencies via pnpm install (package.json present). The Tauri backend requires Rust toolchain; build with pnpm tauri build (Cargo.toml and tauri.conf.json present).

Configuration: No environment variables are documented in the repository structure. The src-tauri/tauri.conf.json and src-tauri/capabilities/default.json define app metadata and permissions, but API keys for Claude Code integration are not specified in the config files present. Users would need to configure Claude Code access through the GUI or add secrets to the environment.

Running it: Development server starts with pnpm dev (package.json scripts). The entry point is src/App.tsx rendered into index.html. For production, pnpm tauri build produces a desktop application bundle.

Real-World Use

A developer working on multiple Claude Code projects uses opcode to browse ~/.claude/projects/, resume interrupted sessions, and create specialized agents for code review or documentation tasks. When executing an agent, the flow passes from src/components/CreateAgent.tsx through src-tauri/src/commands/agents.rs which spawns a background process, tracks execution in src-tauri/src/checkpoint/manager.rs, and streams output back through src/components/StreamMessage.tsx. Usage analytics are collected in src/components/UsageDashboard.tsx and exported for cost tracking. The circular import structure between agent execution, stream messaging, and CC agents means modifying the agent execution flow requires careful coordination across three files to avoid breakage.

Code Health & Issues

  • CRITICAL - Upgrade tauri-plugin-shell@2 carrying CVE-2025-31477 (critical); the manifest pins the vulnerable version, enabling network reachability without credentials (src-tauri/Cargo.toml).
  • HIGH - Pin third-party GitHub Actions to commit SHAs; dtolnay/rust-toolchain@stable, Swatinem/rust-cache@v2, oven-sh/setup-bun@v2, dawidd6/action-download-artifact@v3 are untagged and can move (.github/workflows/).
  • HIGH - Upgrade tokio@1 CVE-2021-45710, regex@1 CVE-2022-24713, tauri@2 CVE-2026-42184, futures-util@0.3 CVE-2020-35908; pinned versions carry published advisories (package.json, src-tauri/Cargo.toml).
  • HIGH - No test suite; 142 source files with zero test files; any change ships with no regression signal.
  • HIGH - CI workflows invoke no test commands; 3 test files exist but 4 workflows have no test execution step.
  • MEDIUM - GITHUB_TOKEN permissions not declared in 3 workflows; one references secrets with no restriction (.github/workflows/build-linux.yml).
  • MEDIUM - No Dependabot or Renovate configured; 2 manifest files with no update bot (package.json, src-tauri/Cargo.toml).
  • MEDIUM - No dependency vulnerability scanning in CI; no dependency-review-action or osv-scanner gate.
  • LOW - No job timeout-minutes on 4 workflows; steps can run to the six-hour platform default.
  • LOW - Missing .editorconfig, .gitattributes, formatter config; inconsistent editor settings across contributors.

The Bottom Line

opcode is a functional Tauri/React desktop client for Claude Code management with solid feature coverage—project browsing, agent creation, session tracking, and usage analytics. However, the codebase carries significant technical debt: critical security vulnerability in a pinned dependency, pervasive circular imports, deep nesting making control flow hard to follow, and duplicated logic across more than half the files. The absence of tests and dependency scanning means regressions reach production undetected. Teams needing a stable, maintainable Claude Code GUI should expect to invest in refactoring the execution flow and agent components before production use; for quick prototyping or personal use, it works today but requires dependency upgrades and test investment to sustain.