Desktop agent

The agent runs your jobs.

The desktop agent connects to your Tanvrit workspace, accepts work, and executes it on the local machine. It speaks the same protocol whether you point it at the local hobby tier or (at public alpha) a managed Tanvrit pool.

Agent v1.0 ships at public alpha. Today the agent runs from source via tanvrit-compute agent run (CLI subcommand).

What the agent does

Connects to your workspace

Reads the OAuth token cached by the CLI, registers itself with the control plane, and announces its labels (os, arch, GPU, custom).

Accepts work

Long-poll / WebSocket subscription for jobs that match the agent's labels. The agent only accepts work from the workspace it is authenticated to — never any other.

Executes locally

Spawns the job process under your user account, captures stdout/stderr, and enforces the configured resource limits.

Reports status

Streams logs and state transitions back over the same channel. On exit, sends terminal state (SUCCEEDED, FAILED, CANCELLED) and exit code.

Install

macOS

Apple Silicon + Intel

Until the signed installers ship at public alpha, run the agent from source via the CLI:

tanvrit-compute agent run --workspace local

Authentication

The agent never has its own login. It reads the OAuth token from the same OS keychain entry the CLI writes — macOS Keychain (com.tanvrit.compute.cli), Windows DPAPI, libsecret on Linux. If you run tanvrit-compute auth logout, the agent loses access on its next heartbeat and stops accepting new jobs.

Resource limits

Caps live in ~/.tanvrit/agent.yaml. The agent enforces them per-job; jobs exceeding a cap are killed with ResourceExceeded.

# ~/.tanvrit/agent.yaml
limits:
  cpu: 4              # cores
  memoryMb: 8192      # MiB
  gpuCount: 0         # 0 disables GPU jobs
idleSuspendSeconds: 600   # suspend the agent process if no work for 10min
labels:
  arch: arm64
  os: darwin
  cpuCount: 8

Privacy & isolation

✓ The agent only runs jobs you explicitly authorise — no third-party tasks, ever.
✓ It never accepts work from a workspace other than the one it is registered to.
✓ Logs are scoped to the workspace and visible only to that workspace's members.
✓ The agent makes outbound HTTPS only — no inbound port; pairs through long-poll.
✓ Each job runs in its own process group with the agent's resource caps applied.
✓ Job artefacts are written to a workspace-scoped tmpdir and pruned on agent restart.

Run it now

The local hobby flow is end-to-end working today. Walk through the 5-minute quickstart to install the CLI, run the agent in a terminal, and submit your first job. For the cloud-tier agent installers, reserve early access.