rafal-fryc rebuilds Mike to run entirely on your own machine

A from-scratch desktop version of Mike that keeps everything local - no cloud accounts, no outside servers, no data leaving the laptop.

infrastructuresecurity

rafal-fryc has taken Mike and ported it into a standalone Windows desktop application, swapping out every piece that normally relies on the cloud for a local equivalent. Logins, the database, file storage and document conversion all now happen on the machine itself. The fork ships with unusually open documentation: a written record of the design decisions, the data layout, and exactly how it differs from the original.

What stands out is the discipline. Before tagging a release, rafal-fryc ran a security review that caught five real problems - including weak download protection and a logging bug that was quietly writing user prompts and document excerpts to disk - and fixed them. It's single-user only and Windows-first for now, with Mac and Linux deferred.

So what Worth a look for any firm or solo practitioner that wants Mike's capabilities without sending client material to the cloud.

View this fork on GitHub →

Spotted something wrong? Or know the PR text has fresher detail than the writeup above?

Commits in this thread

3 commits from rafal-fryc/mikelocal, oldest first. Source extracted verbatim from the harvested git log.

SHA	Subject	Author	Date
`e2a80b08`	Convert to local desktop app (Electron + SQLite + workspace folder)	riffyraf	2026-05-01	↗ GitHub
commit body Replace every cloud dependency with a local equivalent and ship as a downloadable Windows app: - Electron shell with workspace picker, scrypt-hashed local password, lock screen on every launch - Supabase Auth → local HS256 JWT (Node crypto, no library deps) - Supabase Postgres → SQLite via better-sqlite3 with a Postgrest-shaped compat shim, so existing route handlers stay unchanged - S3/R2 storage → local filesystem under <workspace>/files with path-traversal guard and short-lived token-bearing URLs - API key management via existing Settings UI, persisted in user_profiles - LibreOffice runtime detection with graceful degradation - electron-builder NSIS installer config, Next.js standalone build - Full README rewrite for end users plus DECISIONS.md, TODO.md, and per-phase notes under .claude/phases/ Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
`79acd8a6`	feat(security): address review-critical findings + lock-screen polish	riffyraf	2026-05-03	↗ GitHub
commit body - Critical (5): per-launch DOWNLOAD_SIGNING_SECRET, JWT alg/typ + exp type-guard in verifyLocalJwt, sandbox:true on the renderer, raw-stream log gated behind MIKE_DEBUG_RAW_STREAM, drop dead workflow column insert. - Session 1 (security): CSP on packaged builds, DevTools gated to unpackaged + non-lock-screen, dotenv only loaded in standalone dev, pickWorkspace realpath + install-dir guard. - Session 2 (backend): belt-and-braces user_id on documents DELETE + project_id on folder cleanup, global Express error handler, 127.0.0.1 in signed URLs, 60s timeout + 200MB cap on LibreOffice conversion. - Session 3 (frontend): drop dead incrementMessageCredits, cache JWT module-scope in supabase shim, suppress double-loading spinners after unlock. - Lock screen: scope display:flex so .status[hidden] actually hides the "Starting Mike..." spinner. DECISIONS.md updated for the lockout-state choice. TODO.md updated with the deferred Important + Minor items. .gitignore now excludes /vendor/ and backend/.dist-bundle/. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
`b89e5763`	docs(readme): comprehensive project guide	riffyraf	2026-05-03	↗ GitHub
commit body Replace minimal README with full project documentation: architecture overview (process model + IPC surface + supabase shim), security model (threat model + scrypt params + JWT verifier + sandbox/CSP + filesystem guard + lockout-state caveat), data layout, build prerequisites + EPERM/Developer Mode notes, expanded project layout, tech stack table, full diff-from-upstream summary, known limitations, and contributor conventions. Also fixes the stale "LibreOffice not bundled" line - it has been bundled since the LO-installer fix. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Capture this thread into my fork

Download a single Markdown prompt that tells Claude how to port every commit above into your working tree — adapting paths and structure to match your repo. Run it via claude -p < capture-thread-100.md from inside the repo you want the changes in.

⬇ Download capture-thread-100.md