Pizza Bot：面向后台 AI Agent 的收件箱

Pizza Bot 是一个面向长时间运行 AI 工作的收件箱。启动或安排任务后，你可以继续处理日常工作；已完成的工作会汇集到 Unread，等待你决策的运行则会汇集到 Action。即使你切换页面或断开连接，Agent 仍会继续工作；但 api-server 进程必须保持运行。

Pizza Bot 使用有状态的 DeepAgents/LangGraph 运行时，并在 Electron 和浏览器中提供相同的 React 体验。桌面应用、Web 应用和终端 CLI 均通过 HTTP/SSE 与 api-server 通信。

Pizza Bot 由 Amazon 开发，并以 Apache 2.0 许可证发布。

• 异步工作。 在不停止运行的情况下切换对话。
• 返回正确的队列。 已完成的工作会进入 Unread；持久化的审批请求会进入 Action。
• 组织对话。 将线程归入文件夹，同时不会在全局 Unread 和 Action 队列中隐藏匹配的工作。
• 恢复实际工作。 已检查点保存的运行可在客户端断开后继续存在，cron 或 webhook 触发器无需打开对话即可启动工作。
• 委派给专业 Agent。 Skills 会成为具有工具作用域的子 Agent，其进度会显示在 Activity 面板中。
• 自带模型提供商。 支持 Amazon Bedrock、Anthropic、Google Gemini、OpenAI、OpenRouter 和 Ollama。
• 保持对重要操作的控制。 工作流内置人类参与审批、长期记忆、文件附件和桌面通知。
• 明确授予本地访问权限。 在 Settings > Files 下添加单独的只读或可写文件夹；Pizza Bot 默认不拥有访问主目录的权限。

macOS（Intel 和 Apple silicon）、Windows 以及 Linux（x64 和 arm64）的安装程序均附在每个 release 中，并提供 SHA256SUMS 以校验下载文件。macOS 构建已签名并经过公证；Linux 软件包未签名，因此请使用校验和进行验证。

需要 Node.js 24 或更高版本。

npm install
npm run build
npm run dev

npm run dev 会启动 Vite 前端和 Electron 桌面 shell。该 shell 会自行派生并监管其 api-server，与打包后应用的进程模型一致。在启动实际运行前，请先在 Settings > Providers 下配置模型。

有关隔离的数据根目录、浏览器和 CLI 开发、桌面软件包以及远程后端，请参阅从源码运行。

正在运行的 api-server 需要访问至少一个模型提供商；HTTP 客户端则不需要。在 Settings > Providers 中配置 Amazon Bedrock、Anthropic、Google Gemini、OpenAI、OpenRouter 或 Ollama。Bedrock 接受 AWS profile、AWS 访问密钥或 Bedrock API key，并可选择覆盖区域；否则使用 AWS_REGION 或 us-west-2。Bedrock 将其原生模型目录与区域 Mantle 目录结合，并根据模型声明的 API 系列，经由 Converse、OpenAI Responses 或 Chat Completions，或 Anthropic Messages 路由模型。OpenAI 和 Anthropic 也接受用于兼容端点的自定义 base URL；OpenAI 可显式选择 Responses 或 Chat Completions，Anthropic 则支持 x-api-key 或 bearer 认证。使用 PIZZA_MODEL=<provider>:<id> 选择模型。桌面端使用 Electron safeStorage 保护输入的密钥；服务器配置仅持久化环境变量引用。

可通过 UI 或 <PIZZA_DATA_ROOT>/.mcp.json 添加 MCP 服务器。可在 <PIZZA_DATA_ROOT>/skills 下添加 Agent Skills，或安装将 MCP 服务器与 Skills 打包在一起的插件。Skills 在其声明的工具被启用并连接后即可使用。自定义 Skill 可以在不修改原始版本的情况下，替换具有相同 id 的 Built-in 或 Plugin Skill；移除自定义内容后，会再次显示 Built-in 或 Plugin 版本。内置的 Pizza Bot Guide 可以解释功能、建议工作流、协助完成设置，并指向项目文档。

有关配置、环境引用、Skill 编写、审批关卡和插件安装，请参阅扩展 Pizza Bot。

apps/        api-server (Hono) | cli | desktop-shell (Electron) | web (React)
packages/    core | runtime-langgraph | inference-providers | plugin-api | plugin-sdk | storage | logging
plugins/     bundled Plugin packages and their packaging workspace
skills/      optional Built-in Agent Skills
tests/       LangGraph compatibility and protocol conformance

生产环境图引擎被隔离在 packages/runtime-langgraph 中；前端消费协议投影，而非直接导入运行时或模型绑定。

• 运行 - 桌面端、浏览器、CLI 和软件包命令。

• 扩展 - MCP 服务器、Skills 和插件。

• 架构 - 系统边界、事件模型、持久化、传输方式和设计决策。

• 独立后端 - 认证、远程 Electron、静态浏览器部署、Docker、Compose 和 Kubernetes。

• 贡献 - 开发设置、CI 检查、worktree、发布和分层规则。

• 安全 - 网络默认设置、凭据、本地数据和插件信任。

• 日志 - 诊断、保留、查看和脱敏。

• 路线图 - 探索方向及用于评估它们的原则。

• 行为准则 - 社区参与预期。

• 默认本地优先。 api-server 绑定至 127.0.0.1；绑定非回环地址需要认证和明确的来源允许列表。

• 应用状态保留在本地。 线程、检查点、记忆、附件和日志均位于 <PIZZA_DATA_ROOT> 下（默认为 ~/.pizza-bot-oss）。模型和工具请求会发送至你配置的提供商和端点。

• 本地文件夹需要明确授权。 在 Settings > Files 下添加的每个文件夹默认为只读，除非你允许写入。远程授权指定的是后端主机上的路径。

• MCP 服务器和插件均受信任。 它们的命令和 materializer 可使用你的用户账户权限执行。请只安装你信任的来源。

有关完整安全模型和漏洞报告流程，请参阅 SECURITY.md。

Pizza Bot 由其 Executive Chefs 和 Sous Chefs 设计、构建并开源：

Pizza Bot 还受益于 Amazon 内部超过 2,000 名用户的塑造，他们测试了早期版本，并分享了来自实际使用场景的反馈。他们提交的 bug 报告、提出的想法和坦诚的意见，帮助 Pizza Bot 为更广泛的社区做好了准备。感谢每一位贡献者。

Apache-2.0。有关署名通知，请参阅 NOTICE。

Pizza Bot is an inbox for long-running AI work. Start or schedule a task, return to your day, and let completed work collect in Unread while runs waiting for your decision collect in Action. Agents keep working when you navigate away or disconnect; the api-server process must remain running.

Pizza Bot uses a stateful DeepAgents/LangGraph runtime with the same React experience in Electron and the browser. The desktop app, web app, and terminal CLI all communicate with the api-server over HTTP/SSE.

Pizza Bot was developed at Amazon and is released under the Apache 2.0 license.

• Work asynchronously. Switch conversations without stopping their runs.
• Return to the right queue. Completed work lands in Unread; durable approval requests land in Action.
• Organize conversations. Group threads into folders without hiding matching work from the global Unread and Action queues.
• Resume real work. Checkpointed runs survive client disconnects, and cron or webhook triggers can start work without an open conversation.
• Delegate to specialists. Skills become tool-scoped subagents whose progress appears in the Activity panel.
• Bring your model provider. Amazon Bedrock, Anthropic, Google Gemini, OpenAI, OpenRouter, and Ollama are supported.
• Keep control of consequential actions. Human-in-the-loop approvals, long-term memory, file attachments, and desktop notifications are built into the workflow.
• Grant local access explicitly. Add individual read-only or writable folders under Settings > Files; Pizza Bot receives no default home-directory access.

Installers for macOS (Intel and Apple silicon), Windows, and Linux (x64 and arm64) are attached to every release, with a SHA256SUMS to check a download against. The macOS builds are signed and notarized; the Linux packages are not signed, so verify them against the checksums.

Node.js 24 or newer is required.

npm install
npm run build
npm run dev

npm run dev starts the Vite frontend and Electron desktop shell. The shell forks and supervises its own api-server, matching the packaged application's process model. Configure a model under Settings > Providers before starting a live run.

See Running from source for isolated data roots, browser and CLI development, desktop packages, and remote backends.

A running api-server needs access to at least one model provider; HTTP clients do not. Configure Amazon Bedrock, Anthropic, Google Gemini, OpenAI, OpenRouter, or Ollama in Settings > Providers. Bedrock accepts an AWS profile, AWS access keys, or a Bedrock API key, with an optional region override; otherwise AWS_REGION or us-west-2 is used. Bedrock combines its native catalog with the regional Mantle catalog and routes models through Converse, OpenAI Responses or Chat Completions, or Anthropic Messages according to their advertised API family. OpenAI and Anthropic also accept custom base URLs for compatible endpoints; OpenAI can explicitly select Responses or Chat Completions, and Anthropic supports x-api-key or bearer authentication. Select a model with PIZZA_MODEL=<provider>:<id>. The desktop protects entered secrets with Electron safeStorage; server configuration persists only environment-variable references.

Add MCP servers from the UI or <PIZZA_DATA_ROOT>/.mcp.json. Add Agent Skills under <PIZZA_DATA_ROOT>/skills, or install plugins that package MCP servers and skills together. Skills become available after their declared tools are enabled and connected. A custom skill can replace a Built-in or Plugin skill with the same id without modifying the original; removing the customization reveals the Built-in or Plugin version again. The Built-in Pizza Bot Guide can explain features, suggest workflows, help with setup, and point to project documentation.

See Extending Pizza Bot for configuration, environment references, skill authoring, approval gates, and plugin installation.

apps/        api-server (Hono) | cli | desktop-shell (Electron) | web (React)
packages/    core | runtime-langgraph | inference-providers | plugin-api | plugin-sdk | storage | logging
plugins/     bundled Plugin packages and their packaging workspace
skills/      optional Built-in Agent Skills
tests/       LangGraph compatibility and protocol conformance

The production graph engine is isolated to packages/runtime-langgraph; frontends consume protocol projections rather than importing runtime or model bindings.

• Running - desktop, browser, CLI, and package commands.

• Extending - MCP servers, skills, and plugins.

• Architecture - system boundaries, event model, persistence, transports, and design decisions.

• Standalone backend - authentication, remote Electron, static browser deployment, Docker, Compose, and Kubernetes.

• Contributing - development setup, CI checks, worktrees, releases, and layering rules.

• Security - network defaults, credentials, local data, and plugin trust.

• Logging - diagnostics, retention, viewing, and redaction.

• Roadmap - exploratory directions and the principles used to evaluate them.

• Code of Conduct - community participation expectations.

• Local-first by default. The api-server binds to 127.0.0.1; non-loopback binding requires authentication and an explicit origin allowlist.

• Application state stays local. Threads, checkpoints, memories, attachments, and logs live under <PIZZA_DATA_ROOT> (~/.pizza-bot-oss by default). Model and tool requests go to the providers and endpoints you configure.

• Local folders require an explicit grant. Each folder added under Settings > Files is read-only unless you allow writes. Remote grants name paths on the backend host.

• MCP servers and plugins are trusted. Their commands and materializers can execute with your user account's permissions. Install only sources you trust.

See SECURITY.md for the complete security model and vulnerability reporting process.

Pizza Bot was designed, built, and brought into the open by its Executive Chefs and Sous Chefs:

Pizza Bot was also shaped by more than 2,000 users across Amazon who tested earlier versions and shared feedback from real-world use. Their bug reports, ideas, and candid input helped make Pizza Bot ready for a broader community. Thank you to everyone who contributed.

Apache-2.0. See NOTICE for attribution notices.