feat(automations): execute Den-scheduled Automations on desktop runners - #3466
Merged
Conversation
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
1 Skipped Deployment
|
Deploying openwork with
|
| Latest commit: |
47392f7
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://00524f3d.openwork.pages.dev |
| Branch Preview URL: | https://agent-automations-den-hosted.openwork.pages.dev |
Collaborator
Author
|
Engine update: per review direction, v1 will not ship the OpenCode binary. #3477 (stacked on this branch) replaces the execution leg with a native TypeScript engine behind the same |
reachjalil
changed the title
reachjalil
marked this pull request as ready for review
August 4, 2026 04:46
reachjalil
marked this pull request as draft
August 4, 2026 08:20
reachjalil
changed the title
reachjalil
marked this pull request as ready for review
August 4, 2026 08:55
This was referenced Aug 4, 2026
benjaminshafii
previously approved these changes
Aug 4, 2026
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
The scheduler claimed due Automations with their persisted provider/model selection without checking the owner's current access, so a revoked grant or removed provider kept dispatching to the owner's desktop runner. Access is now re-resolved at all three dispatch points: the scheduler tick and the desktop claim durably skip the occurrence with the authority failure code (the schedule still advances, and the receipt says why the run did not execute), and Run now fails with the mapped 409 instead of queueing. Source-pinned by test so no dispatch path can drop the check. Identified by Warden diff-security-review L9U-X9E. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The automationRunnerConfigure IPC handler accepted any renderer-supplied baseUrl, so a compromised renderer could point the main-process runner at an attacker endpoint and leak the bearer token through subsequent SSE and API requests. configure() now validates the URL before storing it: https origins only, plain http reserved for loopback development hosts, and embedded credentials rejected. An invalid URL leaves the runner disconnected, and a test proves no request ever leaves for a rejected endpoint. Identified by Warden diff-security-review JZP-2AT. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
benjaminshafii
approved these changes
Aug 4, 2026
This was referenced Aug 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Desktop execution for Den-scheduled Automations
This feature supersedes the Den-hosted OpenCode execution design previously
implemented on this PR.
Current candidate:
92041026a9b04b0c4dd7e564ea160cd26869c372Signed history normalization on
92041026adifferent-ai/openwork:dev@6785129e7.2699dcd8a; only newerdevchanges were inherited.git verify-commit 92041026apassed, and GitHub reports the PR's single commit as Verified.devand one commit ahead.Prior focused checks on
e8f564615different-ai/openwork:dev@6c5068f77without conflicts.b9fd17dea.pnpm --filter @openwork/app typecheck— passedpnpm --dir apps/server typecheck— passedpnpm --filter @openwork-ee/den-api typecheck:automations— passedgit diff --check upstream/agent/automations-den-hosted..HEAD— passedFree-model cleanup on
a90b54944pnpm --filter @openwork-ee/den-api typecheck:automations— passedpnpm --filter @openwork/app typecheck— passedgit diff --check— passedReview-fix verification on
46899f7bepnpm --filter @openwork-ee/den-api typecheck:automations— passedpnpm --filter @openwork/desktop typecheck:electron— passedpnpm --dir apps/server typecheck— passedpnpm --filter @openwork/app typecheck— passedgit diff --check— passedSummary
Den remains the durable scheduler and source of truth, while the authenticated
OpenWork desktop app executes Automations through its existing local OpenCode
runtime.
The desktop maintains an authenticated Server-Sent Events connection to Den.
SSE is notification-only and carries exactly a wake-up type plus a resumable
cursor. On connect, reconnect, or notification, the desktop discovers work over
HTTP, atomically claims an eligible
desktopoccurrence, executes it as anormal visible OpenWork thread, and reports attempt-bound heartbeats, ordered
events, usage, cancellation, and completion over HTTP.
The scheduled thread uses the selected model and the same workspace, tools, and
OpenWork Connect experience as a thread started manually in the desktop app.
Den never sends or launches an arbitrary command.
What changed
discovery, claim assignment, attempt-bound heartbeat/events/completion,
lease loss, and runner-unavailable outcomes.
desktopexecution target fields on Automation revisions andruns, plus durable MySQL runner registration and notification cursors.
with
Last-Event-ID, immediate discovery, and exponential backoff withjitter. Credentials never enter the URL, renderer storage, event data, or
logs.
ordered idempotent event append, and idempotent terminal completion APIs.
leases reject late events/results.
producing a normal sidebar thread and preserving the usual model/tool/
integration experience.
skipped / runner_unavailable / desktoppersistenceand the UI label Missed — desktop runner unavailable. Offline Run now
returns No desktop runner is online without queueing work.
run-scoped MCP execution code, OpenCode dependency, and Docker state/binary
changes used only by server execution.
implementing sandbox execution.
Baseline checks on
18463bcc9pnpm --filter @openwork-ee/den-api typecheck:automations— passedpnpm --filter @openwork/desktop typecheck:electron— passedpnpm --dir apps/server typecheck— passedpnpm --filter @openwork/app typecheck— passedgit diff --check— passedA broad app suite was also run during development: 610 tests passed and two
pre-existing SSR loading tests failed with
target.addEventListener is not a function. Those unrelated failures are not reported as passing checks.Packaged desktop proof
The packaged, ad-hoc-signed, LaunchServices-registered
OpenWork 3466 E2E.appis connected to the existing local Den profile.Connected scheduled result:
Desktop visible thread E2E 08:45:31atr_01kz5zf9hcf6aaaykkqdv78mycDESKTOP_VISIBLE_THREAD_OKopenwork-desktop-runner-v1user → assistant → usage → terminalAutomation: Desktop visible thread E2E 08:45:31Disconnected result:
Disconnected desktop final 08:46:51atr_01kz5z8kdhf6aaawf2v2ks906qskippedrunner_unavailabledesktopThe exact packaged app was rebuilt after merging current
dev, deep-linkscheme
openworkremains registered to bundlecom.differentai.openwork.dev,and the desktop, Den API/Web, and MySQL stack are left running for manual review.
Remaining hardening
availability check; the current connection presence is process-local.
limit, and fault-injection testing.
Merge, release, and deployment remain separate decisions.