cowork-to-code-bridge — a no-listener file-queue harness for running agent work on the developer's own machine

[abhinaykrupa]

Goose already runs where the work is — your machine, your shell, your tools. The
gap I kept hitting is the other direction: when the planning happens somewhere
Goose isn't. A hosted chat session, a CI job, a teammate's container. Those
places can reason about your repo, but they can't touch the machine that has
your Docker daemon and your logged-in CLIs.

I built cowork-to-code-bridge
to close that without widening the trust boundary. It is deliberately boring:
no network listener, no inbound port, no tunnel. A daemon on your machine
watches a shared directory; the remote side drops a JSON task file in, the daemon
runs it locally and writes a result file back. If both sides can see a common
folder — bind mount, Syncthing, Dropbox, an NFS share — they can talk. The
machine dials nothing and accepts nothing.

Why it might interest this community specifically:

• It's an extension-style harness, not a competing agent. The daemon's job is
  to execute allow-listed scripts and return exit codes. One of those scripts
  hands a whole task to a local coding agent; pointing that at goose run
  instead of Claude Code is a one-script change.
• Execution is allow-listed by construction. The daemon only runs scripts
  present in its scripts directory, so a remote caller cannot request arbitrary
  shell — it can only pick from what you installed.
• Long tasks behave. queue_task is non-blocking and returns a task id;
  tasks are cancellable (SIGTERM to the whole process group, then SIGKILL after a
  grace period, so spawned grandchildren die too); output is size-capped while
  streaming so a runaway build can't exhaust memory, and truncation is reported
  rather than silent.
• Optional plan gate. A task can carry a plan string that a local hook
  approves or rejects before anything executes.

Ships with ~25 small scripts (host health, disk, ports, docker ps/logs, git
status, package updates) plus an MCP proxy that relays JSON-RPC to local stdio
MCP servers — useful when the MCP server only exists on your box. Python client,
stdlib-only, MIT, macOS + Linux.

Sharing it here because Goose users are the people most likely to poke holes in
the security model, which is the part I most want challenged. Curious where you'd
expect a file-queue transport to fall over.