workscanner-bridge

The WorkScanner bridge reads your local Screenpipe database, runs pattern detection on-device, and syncs summaries to WorkScanner.

Raw frames, audio, and OCR text never leave your machine. Only aggregated observations ("Used iTerm2 12 times for 45 minutes today") are sent. All observations are redacted for obvious secrets (API keys, credit cards, JWTs, password query params) before upload.

Install

# Prereq — Screenpipe running locally
brew install screenpipe && screenpipe

# Install the bridge
npm install -g workscanner-bridge

Configure

1. Go to https://workscanner.ai/settings/bridge
2. Click Create API key, copy the key (shown only once)
3. Run:

workscanner-bridge login
# Paste the key when prompted

Usage

# One-shot sync of everything new
workscanner-bridge sync

# Daemon — sync every 5 min
workscanner-bridge watch

# Inspect current state
workscanner-bridge status

# Remove local config
workscanner-bridge logout

Custom Screenpipe path

If Screenpipe's DB isn't at the default (~/.screenpipe/db.sqlite):

workscanner-bridge login --db /custom/path/db.sqlite
# or
SCREENPIPE_DB_PATH=/custom/path/db.sqlite workscanner-bridge sync

Self-hosted WorkScanner

workscanner-bridge login --api-url https://workscanner.example.com
# or
WORKSCANNER_API_URL=https://workscanner.example.com workscanner-bridge sync

What gets synced

The bridge reads three Screenpipe tables (frames, audio_transcriptions, ocr_text) and produces four types of observations:

| Type | When | Example | |---|---|---| | app_switch | App used 3+ times in the sync window | "Used Slack 47 times (128 min) today: #ops, #engineering" | | meeting | 5+ consecutive audio segments <2 min apart | "Meeting 42 min, 3 speakers: 'let's align on the Q2 roadmap…'" | | screen_capture | 6+ consecutive OCR frames in same app, >3 min | "Spent 18 min reading HubSpot (Pipeline)" | | clipboard | (reserved — Screenpipe doesn't yet expose clipboard events) | — |

What's redacted

Every text field is passed through the redaction pass before upload:

• Credit card numbers (Luhn-matching 13-19 digit sequences)
• SSNs
• AWS access keys (AKIA…)
• GitHub tokens (ghp_, gho_, ghs_)
• Anthropic keys (sk-ant-…)
• OpenAI keys (sk-…)
• Slack tokens (xoxb-, xoxp-)
• JWTs
• PEM private-key blocks
• Bearer / Basic / Authorization header values
• Password/secret query parameters in URLs

Field lengths are hard-capped (summary ≤ 500, context ≤ 5000, appName ≤ 200, actionUrl ≤ 2000).

Configuration file

Stored at ~/.workscanner/config.json with 0600 perms:

{
  "apiKey": "wsk_bridge_...",
  "apiUrl": "https://workscanner.ai",
  "screenpipeDbPath": "/Users/you/.screenpipe/db.sqlite",
  "redactPatterns": []
}

Add extra redaction regex strings (applied globally, replaced with [REDACTED:USER]) via redactPatterns. E.g. to scrub a specific internal project codename:

{ "redactPatterns": ["\\bProjectRedacted\\b"] }

Cursor state lives at ~/.workscanner/cursor.json — delete to force a full re-sync.

Development

git clone https://github.com/liorwn/workscanner
cd workscanner/bridge
npm install
npm run build
node dist/cli.js status

License

MIT