outworked - Moses Yebei

The Problem

Running Claude Code as a single terminal session is limiting for multi-step workflows. You end up manually orchestrating tasks, context windows get cluttered, and there's no persistent record of what an agent did. Outworked addresses this by turning Claude into a team of specialized agents that work in parallel, each with a role, a persistent workspace, and the ability to interact with external tools—all visible in a desktop office metaphor.

What This Does

Outworked is a macOS desktop app (Electron + React) that lets you "hire" AI agents, assign them roles like Frontend Dev or Designer, and give them goals in plain English. An orchestrator (src/lib/orchestrator.ts) decomposes the goal into subtasks and routes them to the appropriate agents. Agents can write code, browse the web, send iMessages, manage Gmail/Google Calendar, and run scheduled tasks.

The app includes a "skills" system (electron/skills/) with pre-built integrations for Gmail, Google Calendar, Google Drive, Google Sheets, Notion, Slack, and a browser. It also supports MCP servers (electron/mcp/mcp-server.js) and channels (electron/channels/) for iMessage and Slack. The UI is a Phaser-based office scene (src/phaser/OfficeScene.ts) where agents visually walk around and work. Asset packs (scripts/generate-default-pack.js) let you customize sprites, furniture, backgrounds, and fonts.

How It Is Wired

Execution starts in electron/main.js (Electron main process). It initializes the app, sets up the database (electron/db/database.js, SQLite), and loads the src/ React app. The renderer communicates with the main process via electron/preload.js and electron/sdk-bridge.js.

The core control flow is in src/lib/orchestrator.ts. When you submit a goal, it uses src/lib/ai.ts to call Claude, which returns a plan. The orchestrator then creates tasks and assigns them to agents. Each agent's execution goes through electron/skills/skill-runtime-manager.js, which loads the appropriate skill (e.g., electron/skills/browser/index.js for web browsing) and runs its functions. Skills make external calls: the browser skill uses Playwright, Gmail/Calendar use OAuth (electron/skills/oauth-helper.js), and iMessage/Slack go through the channel modules.

The highest blast-radius file is src/lib/orchestrator.ts—it's the hub that all agent activity routes through. Changing it affects every workflow. The second is electron/skills/skill-runtime-manager.js, which loads and executes all skills; a bug there breaks every integration. The module graph shows a hub-and-spoke pattern with orchestrator.ts at the center; there's no significant cycle, so refactoring is manageable.

How To Use It

Setup: Clone and install dependencies.

git clone https://github.com/moses-y/outworked
cd outworked
npm install
npm run dev

Configuration: You'll need API keys for Claude and any services you use (Gmail, Slack, etc.). These are entered via the UI in src/components/KeysModal.tsx. No .env file is present, so keys are stored in the app's SQLite database.

Running it: The dev command starts the Electron app. For production, npm run build and npm run dist will produce a macOS installer (see electron-builder.yml).

Real-World Use

A practical scenario: "Build me a landing page and send it to my cofounder." The orchestrator splits this into subtasks: Frontend Dev scaffolds the site, Designer reviews it in the browser skill and takes a screenshot, Frontend Dev fixes spacing and starts a tunnel, then calls send_message via the iMessage channel to text the link. All visible in the office UI.

Code Health & Issues

No measured analysis has run for this repo yet. Structure looks sound: tests exist in electron/ (4 test files), CI is present in .github/workflows/, and a license is included.

Low - No end-to-end tests for the orchestrator or skill runtime; only unit tests on channels/triggers exist. The critical path (orchestrator.ts -> skill-runtime-manager.js) is untested.
Low - The build/ directory contains platform-specific artifacts (icon.icns, entitlements.mac.plist), which is fine, but there's no Windows/Linux build config in electron-builder.yml.

The Bottom Line

Outworked is a polished, genuinely useful tool for anyone who wants to run multi-agent Claude workflows with a visual interface. The skill system and MCP support give it real integration depth. It's macOS-only, and the orchestrator is the single point of failure—if it breaks, everything breaks. Worth trying if you're already invested in Claude Code and want to scale beyond single sessions.

What the analyser found

Deployment readiness

6/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

150 files

JavaScript29
TSX29
TypeScript23
Markdown15
JSON4
YAML2

ReactExpress

Module dependencies

The 10 most depended-upon modules of 81, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_src_lib_types["types"] n1_src_lib_terminal["terminal"] n2_electron_skills_base_runtime["base-runtime"] n3_src_lib_settings["settings"] n4_electron_db_database["database"] n5_src_lib_filesystem["filesystem"] n6_tron_triggers_trigger_engine["trigger-engine"] n7_src_lib_storage["storage"] n8_electron_skills_oauth_helper["oauth-helper"] n9_c_components_MarkdownMessage["MarkdownMessage"] n6_tron_triggers_trigger_engine --> n4_electron_db_database n7_src_lib_storage --> n0_src_lib_types n7_src_lib_storage --> n1_src_lib_terminal n7_src_lib_storage --> n3_src_lib_settings n1_src_lib_terminal --> n0_src_lib_types

Dependencies

7 of 29 declared dependencies are a major version behind. Resolved 29 of 29 against the registry.

Package	Declared	Latest	Behind
`@types/better-sqlite3`	^7.6.13	9.6.0	2 major
`electron`	^41.1.0	43.4.0	2 major
`better-sqlite3`	^12.8.0	13.0.3	1 major
`@types/node`	^25.5.0	26.2.0	1 major
`phaser`	^3.90.0	4.2.1	1 major
`typescript`	^6.0.2	7.0.2	1 major
`uuid`	^13.0.0	14.0.1	1 major

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high2

medium5

low2

Add a test suite; this repository has nonehigh81 occurrences

81 source files, no test files

Any change ships with no signal that existing behaviour still holds, so a regression reaches production undetected.

Fix: Add one test per public entry point, then a CI step that runs them.

Open a pull request instead of pushing to the default branchhigh

.github/workflows/update-homebrew-cask.yml

git push

Automated commits land on the branch that deploys, with no test having run against the result.

Fix: Push to a bot branch and open a pull request, or restrict the push to a tag ref.

Declare least-privilege permissions for GITHUB_TOKENmedium

.github/workflows/update-homebrew-cask.yml

1 workflow(s) declare no permissions, 1 of them reference secrets

With no declaration the token inherits the repository default, so any injected step can push commits or mint releases from inside your own CI.

Fix: Add permissions: contents: read at the top of the workflow and widen per job only where needed.

Enable Dependabot or Renovatemedium

1 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Move large binaries to Git LFS or out of the repositorymedium

public/music/dont_ever_turn_me_off.mp3

1 blobs over 5MB: dont_ever_turn_me_off.mp3 4.9MB

One repository here carries twenty blobs over 5MB including a 10.9MB spreadsheet, so every clone and every CI checkout pays for data nobody diffs.

Fix: Track those extensions with LFS, or move datasets to object storage and fetch them in a setup step.

Remove generated build output from version controlmedium5 occurrences

build

5 generated files committed

The reviewer reads src, production runs dist, and a stale bundle means the fix that was reviewed is not the code that executes.

Fix: Gitignore the output directory and build in CI.

Set timeout-minutes on the workflow jobslow

.github/workflows/update-homebrew-cask.yml

1 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Add the repository convention files this project lackslow3 occurrences

missing .editorconfig, .gitattributes, a formatter config

Without them one contributor's editor writes tabs into a Python file, a shell script commits with CRLF and fails in the container, and a notebook diff is unreviewable.

Fix: Add .editorconfig, .gitattributes with text=auto eol=lf, and a formatter config.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.