GenerateSaaSAgent runtime
The agent runtime a desktop app with AI forks from its own binary - consent, lifecycle, and what runs on-device.
A desktop app with AI runs its own agent runtime, forked from the app's own binary - so there is nothing for the user to download, install, or pair. The app starts it per user on their own machine, drives their own coding CLIs there, and keeps your backend out of the loop.
| Started by | the app, on demand, on the user's own machine |
| Reached over | a unix domain socket in a private directory - no web page and no other account on the machine can dial it |
| Lifecycle | forked on demand, stopped at quit (unless config.desktop.agents.background is on) |
| Network | the model turn only - the user's CLI calls its own provider under the user's own login |
| Controls | Settings > Models, under App runtime: a live read of whether it is running, plus Start and Stop |
config.desktop.agents.enabled decides whether the app starts and supervises the runtime, and every desktop project ships it - so flipping the flag to true turns the feature on with no regeneration. config.runner.enabled governs a separate, web-only daemon your web users install and pair from the browser; the app never installs, looks for, or talks to it.
On by default
The runtime starts on first use - opening the Models tab, a Terminal, a chat, or an automation stages the on-device config and starts it. There is no permission card in front of it; the user's control is Stop under Settings > Models > App runtime.
What runs, and where
Everything the runtime orchestrates stays on the user's machine, under limits they can see:
- Their own CLIs (Claude Code, Codex, Grok, and OpenCode) run on-device under their existing logins - the app holds no key and no session. Each CLI calls its own model provider to answer a turn.
- Chat and automated runs are confined to one folder under the runtime's own policy: the app's managed work folder, or the project's connected folder once the user grants one through the native dialog. A Terminal session is the deliberate exception - the user is sitting at it.
- How much of that the CLI enforces varies. Every run starts in that folder and carries a deny-list covering credential and secret paths; Claude Code and Codex apply that list, and Codex adds an OS sandbox where the platform offers one. Grok and OpenCode expose no equivalent control, so on those two the boundary is the CLI's own behaviour rather than something the runtime can impose.
- A local audit log in the app's own data folder records every run before it executes.
- The model picker fetches the public models.dev catalog, sending nothing about the user or machine, with a built-in fallback for offline.
Automations that must keep firing while the app is closed are the one lifecycle exception, and it is your choice rather than the user's: config.desktop.agents.background (off by default) - see Automated agents.
Where local data lives
Every path below sits under the app's data folder on the user's machine. Each project keeps its own; the legacy bucket holds the paths a product with projects and multiTenant both off has always used.
| Data | Legacy bucket (no project) | Project workspace |
|---|---|---|
| Chats | local/chats/<userId>/ | local/chats/<userId>-<projectId>/ |
| Automations | local/automations/ | local/automations/<projectId>/ |
| Task overrides | local/task-overrides.json | local/task-overrides/<projectId>.json |
| Work folder | work/local/agent/ | work/local-<projectId>/agent/ |
local/automations/workspaces.json: the allowlist the app maintains, so the runtime ticks only projects the user can still reach (with either flag on it ticks nothing else; a product with both off ticks the legacy bucket alone).local/connected-folders.json: the granted folder for each project, when the user has connected one. Runs there record that folder in the audit log, not the managed one.- Terminal sessions open in the work folder of the row above - or the project's connected folder - so a session sees the same files that project's chats and automations do.
- Machine-global: CLI connections, secrets, CLI trust prompts and approvals, and the audit log sit outside these paths. Integrations are not on disk at all - they live in your backend.