2026-09-02 01:05:41 +08:00
commit 04bac1f6e2
2200 changed files with 489415 additions and 0 deletions
@@ -0,0 +1,51 @@
# Desktop runner for Den-scheduled Automations
## Outcome
Den remains the durable scheduler and source of truth for Automation schedules,
occurrences, leases, notification cursors, ordered events, usage, and terminal
results. Den no longer launches OpenCode or stores an Automation execution
runtime in its container.
An authenticated desktop installation registers as a `desktop` runner and
maintains a Server-Sent Events stream. SSE carries only a wake-up type and a
resumable notification cursor. After connecting or receiving a wake-up, the
desktop discovers work over HTTP, atomically claims one occurrence, and reports
attempt-bound heartbeats, ordered events, cancellation, usage, and completion.
When a runner has no pending notifications, Den exponentially backs its cursor
query off from one second to 15 seconds. The poll resets to one second after
activity, and its sleep is capped by the existing 15-second presence keepalive.
This preserves the resumable SSE and bounded claim protocol while reducing an
idle runner's steady-state notification queries from 60 to four per minute.
The claimed Automation runs as a normal visible local OpenWork thread in the
desktop's active workspace. It uses the selected model and the same local
OpenCode tool and integration experience as a thread started by the user.
## Offline behavior
Scheduled desktop occurrences have a bounded claim window. If no eligible
desktop claims one before its deadline, Den durably records `skipped` with
`runner_unavailable`; the app displays **Missed — desktop runner unavailable**.
Run now fails immediately with **No desktop runner is online** while no desktop
SSE connection is present.
## Focused proof
The 2026-08-04 packaged macOS candidate was connected to the local Den test
profile and produced both required outcomes:
- `Desktop visible thread E2E 08:45:31` succeeded as a normal sidebar thread,
  with result `DESKTOP_VISIBLE_THREAD_OK`, ordered user/assistant/usage/terminal
  events, and token usage stored in Den.
- `Disconnected desktop final 08:46:51` was not claimed and became the explicit
  missed desktop-runner-unavailable receipt. Run now while disconnected returned
  the explicit no-runner-online response.
## Deferred hardening
Repository-wide suites, cross-platform packaged proof, multi-replica online
presence, exhaustive reconnect/race testing, fault injection, and broader
security review remain follow-up work. A future `sandbox` target can extend the
execution-target contract; it is not implemented here.