Packaging and Gateway Product Modes¶
Open Cowork is one open-source product family with multiple deployable surfaces. The names below are the public names to use in docs, releases, support, and downstream builds.
The most important rule is unchanged: Open Cowork is a product layer on top of OpenCode. It should not become a second OpenCode runtime.
Source of truth for monorepo product partitions and short names (Gateway, Wiki, Channel Gateway): Product partitions ADR. Importing private product history into this public repo: Monorepo privacy ADR.
Product Names¶
| Public name | Status | Owning code (today → target) | Release artifact |
|---|---|---|---|
| Open Cowork Desktop | Supported | apps/desktop | macOS .dmg/.zip, Linux .AppImage/.deb |
| Open Cowork Cloud | Supported for self-host beta and private hosted beta | cloud server code under packages/cloud-server; the browser UI is the unified renderer (packages/app/src) served by the cloud at GET / | open-cowork-cloud OCI image and Helm/Compose assets |
| Channel Gateway | Supported as a cloud channel adapter | apps/channel-gateway; packages/gateway-* | preferred OCI open-cowork-channel-gateway (dual-tag open-cowork-gateway) |
| Standalone Gateway | Supported as a Gateway-only execution appliance | apps/standalone-gateway | CLI open-cowork-gateway-standalone; OCI image after release gate |
| Gateway (durable work coordinator) | Monorepo SoT; local-operator claim-gated | products/gateway | bin cowork-gateway (optional; not default Desktop) |
| Wiki | Monorepo SoT; optional installable | products/wiki | bin cowork-wiki (optional; not default Desktop) |
| Knowledge | Supported in-app | runtime-host + mcps/knowledge | bundled with Desktop/Cloud; not a separate CLI |
| Open Cowork Mobile | Reserved | none yet | no artifact |
| Open Cowork Teams | Reserved product/edition name | team and org policy surfaces across Cloud/Gateway | no separate runtime |
Be precise in operator docs — never use unqualified “the gateway”:
- Channel Gateway (
apps/channel-gateway): chat providers → Open Cowork Cloud through HTTP/SSE; never spawns OpenCode. - Standalone Gateway (
apps/standalone-gateway): private OpenCode runtime + Gateway Postgres for Gateway-only deployments. - Gateway (
products/gateway; packagecowork-gateway): durable Initiatives/Issues/scheduler/Mission Control + MCP beside OpenCode. Optional; not default-on in public Desktop. Standalone release:.github/workflows/release-gateway.yml(gateway@v*tags). - Wiki (
products/wiki; CLIcowork-wiki/openwiki): standalone git-backed knowledge product. Distinct from in-app Knowledge (Knowledge vs Wiki ADR). Standalone release:.github/workflows/release-wiki.yml(wiki@v*tags).
Package and Image Names¶
| Surface | Package or image | Stability |
|---|---|---|
| Desktop app | @open-cowork/desktop workspace package | internal workspace package |
| Cloud image | ghcr.io/<owner>/open-cowork-cloud:<tag> | release image |
| Cloud Helm chart | helm/open-cowork-cloud | release/deployment asset |
| Channel Gateway app | @open-cowork/channel-gateway | internal workspace package |
| Channel Gateway image | preferred ghcr.io/<owner>/open-cowork-channel-gateway:<tag>; dual-tag open-cowork-gateway | release image (compat dual-tag) |
| Channel Gateway Helm chart | helm/open-cowork-gateway | release/deployment asset |
| Standalone Gateway app | @open-cowork/standalone-gateway workspace package | internal workspace package |
| Standalone Gateway CLI | open-cowork-gateway-standalone | source-built CLI |
| Durable Gateway CLI | cowork-gateway (+ compat opencode-gateway) | independent product version (1.3.x line) |
| Wiki CLI | cowork-wiki (+ compat openwiki) via @openwiki/cli pack | independent product version (0.x) |
| Shared API client | @open-cowork/cloud-client | workspace source package; public SDK packaging requires its own release checklist |
| Shared contracts | @open-cowork/shared | internal/shared workspace package |
The desktop/cloud release workflow publishes Desktop artifacts plus Cloud and Channel Gateway OCI images. Workspace packages are not automatically public npm packages. Gateway and Wiki publish as independent product artifacts when enabled (not on every Desktop tag). If a package is promoted to a public SDK, it needs semver, API stability docs, README examples, changelog entries, and package-level provenance.
Dual-publish freeze (JOE-915)¶
Private repos opencode-gateway and open-wiki are frozen as of 2026-07-18. Do not cut new feature releases from those remotes. Monorepo tags:
| Product | Tag pattern | Workflow |
|---|---|---|
| Gateway | gateway@v* / gateway-v* | .github/workflows/release-gateway.yml |
| Wiki | wiki@v* / wiki-v* | .github/workflows/release-wiki.yml |
Archive procedure and README banners: Product repo freeze and archive.
Channel Gateway image dual-tag (JOE-902)¶
Preferred OCI repository name for the Cloud Channel Gateway is:
During the compatibility window, release CI also tags the same digest as:
Helm chart defaults (helm/open-cowork-gateway/values.yaml) use the preferred open-cowork-channel-gateway repository. Operators still on the old name can set image.repository to …/open-cowork-gateway or continue consuming the legacy evidence file open-cowork-gateway.image.json (alias metadata).
Compose service names remain open-cowork-gateway for local stacks; image tags open-cowork-gateway:local and open-cowork-channel-gateway:local are both produced in CI.
Do not use either image name for the durable Gateway product (cowork-gateway / products/gateway).
Product Modes¶
| Mode | User promise | Execution authority | Best for |
|---|---|---|---|
| Desktop local | Private local OpenCode workspace | Desktop-managed local runtime | individual desktop use, offline/local projects |
| Cloud workspace | Synced browser/desktop/gateway cloud sessions | Cloud workers | team sync, managed BYOK, web workbench |
| Cloud Channel Gateway | Chat access to Cloud workspaces | Cloud workers; Gateway is a client | Telegram/Slack/email access to Cloud |
| Standalone Gateway | Chat-first private appliance | Standalone Gateway plus private OpenCode | VPS, private server, no Cloud dependency |
| Full hybrid | Desktop local plus Cloud plus Gateway | per-thread authority | organizations that want local privacy and cloud collaboration |
The same product may expose multiple modes, but one thread has exactly one execution authority. Local threads stay local. Cloud threads sync through Cloud. Gateway messages belong either to a Cloud Channel Gateway session or to a Standalone Gateway session; they should not be merged implicitly.
Release Channels¶
| Channel | Meaning | Required evidence |
|---|---|---|
master source | Latest merged source. Not a release channel. | CI on master |
v0.x preview | Public OSS preview. APIs and packaging may still move. | CI, docs, checksums, SBOM/provenance, explicit unsigned macOS notice while applicable |
| private hosted beta | Managed BYOK beta for design partners. May use private ops evidence outside this repo. | private beta evidence, launch evidence manifest, BYOK redaction, restore/failover drills |
| public beta | Public hosted BYOK. No enterprise promise yet. | load/soak, supply-chain, abuse, billing, support, and deployment evidence |
v1.x stable | Broad OSS release baseline. | signed/notarized macOS or explicit platform policy, stable docs, state-change notes, release gates |
| enterprise-ready | Downstream/internal enterprise deployments. | SSO/OIDC, audit/export, backup/restore, operator runbooks, support SLA, tenant isolation evidence |
Cloud and Gateway images must use the same release tag as the source release and should be deployed by digest from the image evidence files. Do not deploy latest for shared, beta, or production environments.
Support Policy¶
| Deployment | Support expectation |
|---|---|
| OSS local desktop | GitHub issues, docs, and community best effort. |
| OSS self-host Cloud/Gateway | GitHub issues plus deployment readiness docs. Operators own their infrastructure, secrets, backups, and cloud bills. |
| Internal enterprise downstream | The downstream owner controls branding, OIDC, infra, private config, and support process. Keep private values outside the public repo. |
| Managed BYOK SaaS | Commercial operator owns uptime, billing, incident response, backup/restore, token handling, customer support, and private launch evidence. |
| Security issues | Use SECURITY.md; do not file public issues with exploit details or secrets. |
Support docs must be honest about launch tier. The public repo can claim local self-host beta evidence. Managed SaaS or enterprise claims need private operations evidence before being marketed as GA.
Release Checklist Additions¶
Before a release that touches Desktop, Cloud, Gateway, packaging, or docs:
- Product names in README, docs, release notes, images, and Helm/Compose examples match this page.
- Cloud Channel Gateway and Standalone Gateway are not described as the same product mode.
open-cowork.config.jsonand deploy examples use placeholders for private domains, project ids, customer names, prices, and secrets.- Release notes state the accepted launch tier: preview, private hosted beta, public beta, stable, or enterprise-ready.
Validation¶
Run these checks after editing packaging, naming, product-mode, or release docs:
For release-sensitive edits, also run:
Env naming disambiguation (channel vs standalone)¶
| Binary | Package | Product mode value | Env family |
|---|---|---|---|
| Cloud Channel Gateway | apps/channel-gateway | cloud_channel only | OPEN_COWORK_GATEWAY_* (includes OPEN_COWORK_GATEWAY_PRODUCT_MODE) |
| Standalone Gateway | apps/standalone-gateway | standalone only | OPEN_COWORK_STANDALONE_GATEWAY_* |
OPEN_COWORK_GATEWAY_PRODUCT_MODE is not a switch that turns apps/channel-gateway into Standalone. Setting it to standalone or hybrid fails closed and names the correct binary in the error message.