The agent runner

A detached Node process inside each workspace keeps one agent session open for the life of the container and listens on a Unix socket.

• Private control channel. The controller reaches the socket through SSH with nc -U; no agent control port is exposed on the workspace network.
• Independent from controller restarts. Deploying or restarting the controller does not end the agent session. The runner sources credentials explicitly because a detached, non-interactive process does not read shell startup files.
• One runner per harness. The controller installs the runner selected by the workspace's harness. It is the only component that talks to an agent-specific API.
• Template dependencies, shipped runner code. The template holds large dependencies; the controller supplies the runner code. Routine runner updates therefore do not require a template rebuild.
• Replay on attach. A snapshot contains the conversation and pending approvals, so reconnecting after a controller restart presents the current state.

The transcript is not mirrored to the database. Destroying a workspace removes its transcript, but the timeline retains recorded actions such as prompts, approvals, pushes, and discards.

Permissions belong to the agent's configuration. Configure each agent with a seed file; anything the agent does not resolve reaches the browser approval UI.