Chat On Steroids

Chat On Steroids new-chat workspace with composer controls

Chat On Steroids settings for tools and chat automation

Screenshots of the app with private conversation and folder details redacted. Chat history loads in small chunks as you scroll upward. Image attachments stay visible as thumbnails, and delivery controls sit below their messages.

ChatGPT is a good engineer trapped in a text box. Developer mode lets it call MCP servers, but most servers give it one narrow API. This one gives it a workbench.

• Codex-grade tools. apply_patch, exec_command and write_stdin are ports of the tool contracts OpenAI's Codex CLI uses, so the model already knows how to hold them. Multi-file patches are preflighted before anything is written. Commands run as real processes with interactive stdin, output budgets and background results it can collect later.
• Sub agents inside ChatGPT. One prime chat can spawn worker chats, hand them tasks, read their reports and wake them again later. Workers are ordinary ChatGPT conversations in your own browser, brokered by the app, so you can watch every one of them.
• Sessions that outlive the context window. Every tool call is recorded locally with its real result. When a chat gets heavy, Compact & Resume asks it for a handoff brief, opens a fresh chat and moves the same local session across. The new chat can query everything the old one did.
• Plans, Goal and Loop. Split a request into editable tasks or generate follow-ups through a separate ChatGPT helper or the API. Astra can receive the next task through session_finish in the same turn, without opening another model turn.
• You stay the permission boundary. Only the folders you approve are visible. Each capability is a switch. Read-only mode is a single kill switch. Nothing runs on this machine that you did not turn on.

It runs in the tray, hosts no model of its own, and works with the ChatGPT you already use in the browser.

Every package ships with matching native dependencies, a pinned tunnel-client, ripgrep and the Chrome extension for that CPU. A standalone extension zip is attached for manual installs, and SHA256SUMS.txt lists every hash.

Windows and AppImage installs check GitHub for a newer release on start and every six hours, download it, verify its checksum and apply it when you quit or choose Install update. Staged downloads are revalidated before installation. macOS and DEB installs link to the release page for manual installation.

Debian and Ubuntu: prefer the DEB. The AppImage uses electron-builder's static launcher. On a host that disables unprivileged user namespaces, that launcher can fall back to starting Chromium with --no-sandbox so the app still opens. If you do not want that fallback, use the DEB.

The builds are not publisher-signed yet, and macOS builds are not notarized. SmartScreen, Gatekeeper or your browser will warn. Verify the hash first, then use the normal "run anyway" path, or build from source.

Get-FileHash .\Chat-On-Steroids-Setup-x64.exe -Algorithm SHA256 # Windows

shasum -a 256 Chat-On-Steroids-macOS-arm64.dmg # macOS
sha256sum Chat-On-Steroids-Linux-x64.AppImage # Linux

This is a beta with real permissions. A fresh install starts with the full Core capability set on, read-only mode off, multi-agent mode on with two workers, and, on Windows, the Desktop permissions on. On macOS the Desktop permissions start off; enable them in Settings → Workspace, then grant Screen Recording and Accessibility in System Settings. Linux has Core tools but no Desktop computer-control backend. Review folder access before connecting: exec_command runs programs as your logged-in user.

• Windows 10/11, macOS 13 Ventura or newer, or a current desktop Linux, on x64 or ARM64 matching the build you downloaded.
• Chrome 116 or newer for the companion extension. Without it you still get the MCP tools, but not session attribution, Compact & Resume, worker chats or the Goal loop.
• Linux: a Secret Service keyring such as GNOME Keyring or KWallet. The app refuses Electron's unencrypted basic_text fallback for stored keys.
• A ChatGPT workspace with Developer mode and custom MCP apps. OpenAI currently documents full MCP support, including write actions, as a beta for Business, Enterprise and Edu, with Pro limited to read and fetch. Business needs an admin to enable it. Check OpenAI's Developer mode and MCP apps page if your workspace looks different.
• An OpenRouter API key only if you select the API source for plans, Goal or Loop. The default ChatGPT helper source uses your connected browser session.

Use a normal ChatGPT conversation with the custom app enabled. OpenAI's built-in Agent mode does not use custom apps.

1. Install the build for your CPU and open Chat On Steroids. It lives in the tray or menu bar.
2. Open Settings → Workspace, review permissions and approve a project folder. Press Add, or drop the folder onto the Folders card.
3. Create an OpenAI Secure MCP Tunnel and a restricted API key, then press Connect. Details below.
4. In ChatGPT on the web, enable Developer mode and create the Core app from the tunnel. On Windows, create the Desktop app too if you left screen and input control on; on macOS, if you switched them on.
5. Press Open extension folder, open chrome://extensions, enable Developer mode, choose Load unpacked and select that folder. Pairing is automatic.

Settings → Setup marks each hop done only once the app has actually seen traffic on it. Back in chat, select a project and model, write a message, or choose Create plan from the gear. Images can be attached or dropped into the composer.

1. In Platform → Tunnels, create a tunnel in the same workspace you use in ChatGPT and copy its id (tunnel_...).
2. In Platform → API keys, create a Restricted key with only Tunnels: Read and Tunnels: Use.
3. Paste both into the Setup tab and press Connect.
4. In ChatGPT, enable Developer mode under Settings → Apps → Advanced settings and create a custom app of type Tunnel. Review the discovered actions and enable it.

Core and the optional Desktop surface (Windows and macOS) use separate tunnel ids, because ChatGPT treats each custom app as one endpoint. Release builds bundle a checksum-verified tunnel-client; a path you set explicitly wins over it, and PATH is only a fallback.

Cloudflare quick tunnel: press Connect, copy the URL and use it as the MCP server URL in ChatGPT. The random path in that URL is the secret. It changes on every restart.

Your own HTTPS tunnel: point it at the loopback URL the app shows and give ChatGPT the public equivalent, secret path included.

Permission changes take effect locally immediately. Schema changes schedule a separate connector refresh; if that refresh fails, refresh the custom app in ChatGPT. ChatGPT may keep an older reviewed action list until it refreshes.

The live tool list follows your settings: find is the no-shell search fallback and steps aside when commands are enabled. Enabling Session finish adds the Astra-only session_finish tool. Revoking a permission takes effect immediately, even while ChatGPT still shows the old schema. The full contract lives in docs/tool-surface.md.

Every call is answered with a structured outcome the model can act on. A refused call says why and what to do next, whether that is a missing permission, a folder outside the approved roots, unread background results it has to collect first, or a chat that lost its identity.

Recording is on by default and can be switched off. The app keeps a durable local history of every conversation the extension can see: the messages, each tool call, and the real result the app returned. That history feeds the Chat timeline in the app and the session tool, so ChatGPT can search what it did last week instead of guessing. Retention defaults to 30 days. Data lives under the app's per-user directory: %APPDATA%\chat-on-steroids\sessions\ on Windows, ~/Library/Application Support/chat-on-steroids/sessions/ on macOS, ${XDG_CONFIG_HOME:-~/.config}/chat-on-steroids/sessions/ on Linux.

The extension runs only on chatgpt.com and chat.openai.com plus the app's loopback bridge. It proves which conversation made each MCP call, captures the visible transcript, draws richer tool rows in the chat, and coordinates worker tabs. App and extension are versioned together: after updating the app, press Reload on the unpacked extension.

The gear holds the per-chat Goal/Loop controls, task editor, plan creation and Compact & Resume. The small circle beside it shows estimated current-chat tokens on hover or click. Pro chats use a static circle; other chats show a proportion of the configured local limit. These are recorder estimates, not the provider's exact context counter.

During work, Inject now queues messages for tool delivery; multiple injections can wait together until the next eligible call. A plan advances one stage at a time at session_finish for Astra, or after a completed answer for ordinary models. Queue cards can be edited or cancelled. Delivery status follows the tool handout, and earlier transcript pages remain accessible.

The app estimates context pressure locally. Fresh installs warn at about 400k estimated tokens, mark 533k as the ceiling, and enable automatic compaction at 400k. Pro models never auto-compact, regardless of that setting. Other eligible chats follow the configured threshold and live-work checks. These are local estimates, not ChatGPT's own counter.

Compact & Resume asks the current chat for a handoff brief, stores it, opens a fresh conversation and rebinds the same local session to it. While the brief is being written the old chat is refused every tool, so a turn that will not stop cannot keep changing the machine the brief describes. Both sends carry durable checkpoints tied to marked ChatGPT messages, so a refresh, a closed tab or an app restart cannot submit either prompt twice or lose the session between the two chats. If the handoff cannot complete, the original session stays where it was. Goal, task and worker history all move with it.

For ordinary models, Goal checks a completed answer and either drafts a follow-up or decides the task is complete. Loop generates continued work until switched off. Edit the task and prompts in Settings → Agents & automation. ChatGPT helper generation is the default; API generation uses your encrypted OpenRouter key. Goal also supports prepared messages with completion markers; Loop uses ChatGPT or API generation. Tool details can be included when you enable that option.

Astra behaves differently. With Session finish enabled, Goal and Loop both use Loop instructions and deliver through tool injection. Queued user instructions and plan stages take priority. When Astra calls session_finish with nothing waiting, your setting chooses a finish notification or automatic follow-up generation. A per-chat Goal/Loop switch also selects automatic generation. The generated instruction arrives on a later tool call; it never automatically starts a new turn after Astra has really finished. Silence alone does not queue a Pro goal, and Pro silence recovery waits ten minutes.

Finish reminders are added by the delivery layer, separate from the visible plan. Desktop notifications depend on OS support and notification settings; the app also offers Generate Goal while waiting at a finish point. Native notification actions and cold background browser focus are not yet verified across every supported desktop environment.

One prime chat can open up to eight worker chats (two by default) and exchange brokered messages with them through the agents tool. Provider rate limits still apply. Workers cannot talk to each other.

Workers are reusable conversations. When one reports its result it goes to sleep, frees its slot and keeps its full chat. Messaging it again wakes the same conversation. At about 400k recorded tokens a worker becomes non-revivable after its next stop; workers never compact themselves. With background chats enabled, app-managed tabs share one browser window. Idle tabs remain open up to the configured worker capacity; above it, the oldest inactive work is eligible for closure after one minute. Active chats and unsent drafts remain protected.

Each prime owns its worker history. If the last worker sleeps, the run is parked and another chat can start its own workers; the original prime still sees its full history in agents action=status, can spawn fresh workers, and can wake old ones when the execution slot is free. Turning multi-agent off pauses execution and keeps that history. Clear swarm is what discards it.

Identity is fail-closed. Spawning, messaging and every other identity-sensitive action needs the extension to prove which conversation made the call. A chat used from somewhere the extension cannot see, such as the phone app, still gets the ordinary Core tools but not agent control.

A wedged ChatGPT page can leave a turn running with no working Stop button while the model keeps calling tools. The app cannot end that turn, but it can take its tools away. Block in the Chat tab refuses every call from that conversation with a message telling the model to abandon the task and answer, and the turn ends itself. It is not a cancel, and it applies only to calls whose owner is proven.

• File tools stay inside approved folders. Paths are validated and canonicalised first. This is application-level containment, not an OS sandbox; same-user filesystem races remain possible.
• Commands are not folder-sandboxed. They start in an approved folder and then run with your normal user privileges.
• Desktop control is not folder-scoped. When enabled, it applies to the whole Windows or macOS desktop. On macOS it is off until you switch it on, and macOS additionally enforces its own Screen Recording and Accessibility grants.
• The MCP server is loopback-only behind a random secret path. ChatGPT reaches it through the tunnel you configure. Treat any public tunnel URL as a password.
• The browser bridge is loopback-only and separate. It exists for the extension and exposes no file, command or settings routes.
• Secrets use Electron safeStorage: DPAPI on Windows, Keychain on macOS, libsecret or KWallet on Linux.
• Read-only mode disables file writes, command execution, desktop control and clipboard writes in one switch.

Report vulnerabilities privately per SECURITY.md.

The MCP connector uses ChatGPT's documented Developer mode and Secure MCP Tunnel path. The extension is different: it observes ChatGPT's web UI, records rendered conversation state locally, and multi-agent mode opens and types into extra ChatGPT tabs. None of that is a documented public automation API. Depending on your account, OpenAI's terms and policies on automated access, rate limits and permitted use may apply. Read the agreement that governs your account before using the extension or multi-agent mode, and do not use these features to scrape ChatGPT, evade limits or bypass safety controls.

• Tools missing or stale after a permission change: tool-schema changes schedule a connector refresh after a 20-second debounce. If it fails, refresh the custom app in ChatGPT; this is separate from reloading the companion extension.
• Extension says app not found: recording or multi-agent mode must be on for the bridge to run. Then reopen the popup.
• Extension version mismatch: reload the unpacked extension after every app update.
• agents says UNIDENTIFIED_CALLER: use that conversation in the paired browser so the extension can observe its request id. The app will not guess identity from the active tab.
• COMPACTION_IN_PROGRESS in a chat: that chat is being handed off. Let it write the brief; work continues in the replacement.
• OS warning about an unverified app: expected for the unsigned beta. Verify SHA256SUMS.txt before overriding.
• Linux says secure credential storage is unavailable: unlock GNOME Keyring or KWallet and restart the app.
• Tunnel unavailable: point Advanced settings at an explicit tunnel-client or cloudflared, or use the bundled copy.

npm ci
npm run dev # run the app with hot reload
npm run verify # typecheck, tests and the privacy gate; the same gate CI runs

Read AGENTS.md before changing anything. It is the design record: what each invariant is, which incident produced it, and which test guards it.

npm run dist:x64 # Windows x64
npm run dist:arm64 # Windows ARM64
npm run dist:mac:x64 # macOS Intel DMG + ZIP
npm run dist:mac:arm64 # macOS Apple Silicon DMG + ZIP
npm run dist:linux:x64 # Linux x64 AppImage + DEB
npm run dist:linux:arm64 # Linux ARM64 AppImage + DEB

Package on the target operating system. The release workflow runs on native Windows, macOS and Linux runners for both CPUs, pins and verifies the tunnel and ripgrep assets, stages matching native dependencies, smoke-tests the packaged runtime, and assembles one release candidate with the extension zip and SHA256SUMS.txt. Publishing checks OpenAI's current stable tunnel-client release before and after the candidate build and refuses a stale pin, while keeping the tagged build reproducible.

Bug reports, feature requests and PRs are welcome. Read CONTRIBUTING.md first. Release history is in CHANGELOG.md.

MIT. See LICENSE.

Not affiliated with, endorsed by, or connected to OpenAI. "ChatGPT" and "Codex" are trademarks of OpenAI, used here only to describe what this tool works with.