Chat On Steroids

An Electron workspace built around ChatGPT rather than a coding agent of its own. It runs a local MCP listener and exposes it to the user’s own ChatGPT conversation through a tunnel, so the model can read and edit files inside approved folders, run commands, keep terminals open and drive the desktop — while a companion Chrome extension observes and automates the ChatGPT page itself, typing, sending and recording the turns. Workers are further ChatGPT chats that the app reuses for delegated jobs; Goal continues unfinished work and Loop keeps pushing inside the same brief; Compact & Resume moves one local session from an old conversation to a new one when it grows too long, with the worker history attached. The app is the authority on what a local tool did, and the extension never executes it. Windows 10 and 11, macOS 13 or newer and desktop Linux are supported, the licence is MIT, and the README calls the project an independent beta that is not affiliated with or endorsed by OpenAI, with local tools bounded by the folders and capabilities the user approves.

Who built itThe repository is owned by a second account, totec448-spec, and the work is split between them: Maximapple has 569 of the 876 commits and the owner account 159, together 730, while commit author names read Maxim on 571 of them. Neither account gives a real name anywhere in the material. Beyond them the contributor list holds 27 names, led by Haz4rdovisk with 31, ayhanmalkoc with 16 and hhh2210 with 15.

1. 01

   Five weeks, 876 commits and twenty releases

   The repository was created on 2026-08-22 and its oldest commit is Chat On Steroids 2.0.0 on 2026-08-24; the newest is a merge on 2026-10-01. Between those dates sit 876 commits in 39 days — 55 in August, 813 in September, 8 in the first hours of October — and 20 releases, from v2.0.2 on 2026-08-26 to v2.1.22 on 2026-09-30, with a 21st prepared in an open pull request titled Release 2.1.23. The version numbers are the least interesting part of that list. 2.0.6 is titled “I am exhausted.”; 2.1.13 is titled “i am very sad. openai theatend to ban my account for whatever reason. anthropic support blocks me. money tight.”; 2.1.14 is “Death to Anthropic and OpenAI. Join the resistance”; v2.0.9 is “they nerfed astra”, v2.0.8 “Darkex by dark tibo”, and two releases two weeks apart are both titled “6 sol in 2 weeks”. The complaints were committed as evidence: docs/images/ holds openai-account-warning-2026-09.png, openai-chatgpt-warning-2026-09.png and anthropic-support-reply-2026-09.png. Around the same repository on 2026-10-01: 4,217 stars, 560 forks, 12 watchers, 15 open issues, 75,191 KB of metadata size, and a change log that has grown to 146,821 characters.

2. 02

   The way in is MCP through a tunnel, not the API

   The README gives setup as four steps: install the app and approve a project folder under Settings, then Workspace; connect Core under Settings, then Setup, and add it in ChatGPT under Plugins, then Add, then Create MCP App; load the companion extension unpacked and let it pair; then choose a model and send. What that hides is in the project’s own agent map, which counts four cooperating planes: Core, Desktop and Plugins are three logical MCP surfaces on one local MCP listener, each reached by a secret path and checked against a live permission and a caller proof, while the browser bridge is a separate loopback service with its own authentication and an optional local control API is a third listener for a trusted local caller. The transport is a tunnel client that the build fetches, with src/main/tunnel/ on the app side. The README states the reason: “Uses your ChatGPT conversation rather than invoking Codex directly”, with the note that ChatGPT Work and Codex share usage limits, so the plan, model availability and context limits still apply. Several releases are about this link alone — 2.1.19 is “The browser connects on its own again”, 2.1.18 “Recommended skills install again” — and an issue opened on 2026-10-01 shows the extension panel reporting the app connected on port 8769 while the worker it had just spawned still had no local tools.

3. 03

   The extension is the half that touches the page

   The companion is a Manifest V3 extension of fourteen files and about 1.4 MB, and it is where the ChatGPT page is actually read and written: content.js at 678,238 bytes and chatgpt-dom.js at 161,384 run in the isolated world, fiber.js (144,035) and usage.js (25,547) run in the page’s own world, and background.js (239,061) is the suspending service worker holding the journal, the tab and document registry, the claims and the acknowledgements. The agent map is explicit that the extension “never executes the model’s local tool”, and it sets an economy for the browser: reuse an eligible document, let one operation own one elected tab across navigation and worker suspension, and treat a settled app-owned page as reusable after two minutes without work and closable after five, with pins and recent user access vetoing both. That the page world matters is not theoretical: when the 404 detection in #851 was reviewed, the note was that usage.js lives there, so open ChatGPT tabs need one reload after updating. The extension ships eight locales; the app ships ten more plus English, which its own issue #855 counts as eleven languages. Release 2.1.17 advertises “an extension that updates itself”, with a manifest.json of 1,784 bytes carrying the version the app checks.

4. 04

   Durable means written down before it is needed

   Work that outlives a process has to be on disk, and the agent map says where. The clearest case is the queue: the app freezes an input in its durable outbox before delivery, which is why “queued”, “put into the composer” and “ChatGPT accepted it” are three different facts rather than one optimistic status. The document then states, per store, what it survives and cannot prove — sessions/ and named state/ files survive an app restart but cannot prove an old page is running; storage.local survives a browser restart and holds pairing intent and command acknowledgements; storage.session survives worker suspension, enough for the journal and the tab registry; content-script memory survives one document. The local session is the durable identity and the ChatGPT conversation is the replaceable front end, whose id is explicitly not the session id — which is what lets Compact & Resume move the same session from chat A to chat B. Waiting chats and sleeping workers “retain their durable history and identity, not an indefinite browser tab”, and recovery helps only work the app can still prove it owes. There is a src/main/durable.ts of 7,973 bytes with a 6,678-byte test, and the subtle part is a boundary: closing a chat’s tab pauses automatic repair, and #853 excepted an explicit, user-pressed Compact & resume, because pressing it is the user coming back.

5. 05

   Permissions: approved folders and a window the model may not touch

   Access is granted per folder and per capability: a fresh install enables the Core capabilities and two workers, Windows installs enable Desktop permissions as well, and shell commands run with the user’s normal privileges. The boundaries are settled against the real machine rather than argued. Issue #863 records the mismatch — on macOS the backend runs inside the app and skips its own process, so a window listing with the app’s own name returned 0 of 9 windows while the app window was open, while on Windows the helper is a separate PowerShell process and CoS’s own windows were listed, including the window holding CoS’s own permission switches. The fix passes the app’s process id to the helper. Issue #844 asked for WSL projects, and the answer was narrow: an existing folder under a local distribution may be approved through a distribution-hosted UNC path, arbitrary network hosts stay refused, UNC input outside an approved root is refused before any lookup, and only the distribution name is case-folded, since folding all of Windows would merge Linux folders that differ only in case. When #851 began watching a failed resume, the condition attached in review was that only the exact same-origin request is observed — its conversation id and HTTP status, “never headers, cookies or content” — fenced to one request, document, conversation, question and turn.

6. 06

   What the community round fixed, and what the maintainer retracted

   The thirty issues and pull requests in the report are the newest thirty, and all fall inside eleven hours on 2026-09-30 and 2026-10-01 — one working night. Most of the fixes come from outside: AcureroAdrian filed the reports #844 to #847 and then the pull requests #848, #850 and #851 that answer them. Review is specific and about cost. On #849 the maintainer accepted the rule but objected that errors() runs on every recorder tick and walks up to eight ancestors reading innerText for every button on the page, while the sidebar alone can hold hundreds of them; the contributor added a pre-filter and a test asserting zero innerText reads for 300 sidebar buttons, with 894 tests passing. Asked for a Discord, the answer in #864 was that there is not one and there are no plans for one — GitHub is the place, with rules a workflow restates for first-time contributors: link the issue, one topic per pull request, a test that fails without your change, before-and-after screenshots for interface changes. That thread holds the admission worth keeping: after suggesting a new chat to a user, the maintainer wrote “starting a new chat is not the real fix. Sorry for that suggestion.” Live testing is shown rather than claimed: #860 records lowering the auto-compaction threshold to 10,000 tokens and restoring it, so compaction was found six minutes late after a turn ended.