
Security News
GitHub Actions Checkout Now Blocks Risky pull_request_target Checkouts
GitHub Actions checkout now blocks risky pull_request_target checkouts by default to help prevent pwn request supply chain attacks.
OpenPocket is a local emulator-first phone-use agent runtime for Android automation.
It combines a practical CLI, a Telegram gateway, model-driven planning, and adb-based action execution with auditable persistence:
Telegram / CLI -> Gateway -> Agent Runtime -> Model Client -> adb -> Android Emulator
OpenPocket targets both developers and everyday users who need repeatable mobile task execution.
Representative scenarios:
Near-term roadmap includes remote phone access to the local runtime for human-in-the-loop control.
start, stop, status, list-avds, hide, show, screenshottap, swipe, type, keyevent, launch_app, shell, run_script, wait, finish/stop, /cronrun, /runflowchart LR
U["Local User / Telegram"] --> G["OpenPocket Gateway"]
G --> A["Agent Runtime"]
A --> M["Model Client"]
A --> D["ADB Runtime"]
A --> S["Script Executor"]
D --> E["Android Emulator (Local)"]
A --> W["Workspace Store"]
W --> SS["sessions/*.md"]
W --> MM["memory/YYYY-MM-DD.md"]
W --> RR["scripts/runs/*"]
RP["User Phone (Upcoming Remote Control)"] -.-> G
adb)npm install -g openpocket
openpocket onboard
If you use the native macOS panel, install the release package from:
Then start the panel:
openpocket panel start
git clone git@github.com:SergioChan/openpocket.git
cd openpocket
npm install
npm run build
./openpocket onboard
./openpocket runs dist/cli.js when present and falls back to tsx src/cli.ts in local dev installs.
openpocket onboard automatically verifies Android runtime dependencies:
You can skip this step in CI/tests with:
export OPENPOCKET_SKIP_ENV_SETUP=1
For npm package install:
openpocket emulator start
openpocket gateway start
For local source clone:
./openpocket emulator start
./openpocket gateway start
./openpocket install-cli
This installs ~/.local/bin/openpocket and updates shell rc files when needed.
Primary config file:
~/.openpocket/config.json (or OPENPOCKET_HOME/config.json)Example config template:
Common environment variables:
export OPENAI_API_KEY="<your_openai_key>"
export OPENROUTER_API_KEY="<your_openrouter_key>"
export AUTOGLM_API_KEY="<your_autoglm_key>"
export TELEGRAM_BOT_TOKEN="<your_telegram_bot_token>"
export ANDROID_SDK_ROOT="$HOME/Library/Android/sdk"
export OPENPOCKET_HOME="$HOME/.openpocket"
Command prefix by install mode:
openpocket ..../openpocket ... (or openpocket ... after install-cli)./openpocket --help
./openpocket install-cli
./openpocket onboard
./openpocket config-show
./openpocket emulator start
./openpocket emulator status
./openpocket agent --model gpt-5.2-codex "Open Chrome and search weather"
./openpocket script run --text "echo hello"
./openpocket skills list
./openpocket gateway start
./openpocket panel start
Legacy aliases still work (deprecated): openpocket init, openpocket setup.
openpocket panel start on macOS uses this order:
/Applications or ~/Applications.apps/openpocket-menubar, build and launch from source.The documentation frontend is implemented in this repository:
/docs/docs/.vitepress/config.mjs/docs/index.md/docs/.vitepress/theme/custom.cssnpm run docs:dev
npm run docs:build
npm run docs:build:pages
npm run docs:preview
.github/workflows/deploy-docs-pages.ymlvercel.json/docs/get-started/deploy-docs.mdExpected GitHub Pages URL for this repo:
https://sergiochan.github.io/openpocket//src: runtime source code (agent, gateway, device, tools, onboarding)/docs: project documentation + VitePress site source/test: runtime contract and integration tests/apps/openpocket-menubar: native macOS menu bar control panel/dist: build outputRun checks:
npm run check
npm test
/docs in the relevant hub.run_script execution is guarded by an allowlist and deny patterns.FAQs
OpenPocket Node.js TypeScript runtime
The npm package openpocket receives a total of 0 weekly downloads. As such, openpocket popularity was classified as not popular.
We found that openpocket demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
GitHub Actions checkout now blocks risky pull_request_target checkouts by default to help prevent pwn request supply chain attacks.

Product
Socket now supports Custom Roles and Repository Access Permissions so organizations can control who can access specific repositories and actions.

Product
Socket MCP now lets AI assistants review org alerts, investigate threats using the Socket threat feed, and inspect package files in addition to dependency scoring.