Desktop governance bridge — TUI permission gates now delegate to live Desktop for approval.
Desktop Integration
Arcana Desktop is a local approval and forensic companion that supervises the runtime lifecycle. It renders governance semantics, presents routed approvals, and provides proof inspection — all without leaving your machine.
What It Is
Desktop is not a separate product or authority surface. It's a companion to the local runtime:
- Runtime lifecycle — Start, stop, and monitor the Arcana daemon
- Approval routing — Receive and respond to approval requests from the TUI
- Proof inspection — View RunProof evidence, export proofs, verify chains
- Restart recovery — Pending approvals survive daemon and Desktop restarts
- Native notifications — OS-level alerts for approval requests
Governance Bridge
In v0.4.0, the TUI's permission gates can delegate to Desktop:
How Routing Works
- Agent requests action — The agent wants to execute a consequential tool
- Permission gate opens — TUI shows the approval gate
- Route decision — Based on policy, the gate routes to:
LOCAL_TUI— Handle in the TUI (default for low-risk)DESKTOP_PREFERRED— Send to Desktop if available, fall back to TUIDESKTOP_REQUIRED— Must be handled by Desktop (never falls back)CENTRAL_REQUIRED— Requires enterprise console approval
- Desktop receives — Native notification, approval UI with exact request inspection
- Operator decides — Approve or deny through Desktop
- Result flows back — TUI continues execution
Failed Prompt Queue
If a prompt fails due to a pending approval, it's queued for durable retry:
- Prompts that hit
DESKTOP_REQUIREDgates are queued - Once Desktop approves, the queued prompt retries automatically
- Idempotent retries prevent duplicate execution
Desktop Chat Sync
Desktop can sync chat messages from the TUI session:
- Streaming text follow — Desktop follows the TUI's streaming output in real-time
- Governance-controlled — Chat sync is a configurable governance policy
- Privacy-aware — Only syncs when explicitly enabled
Approval Routing Modes
| Mode | Behavior | Use Case |
|---|---|---|
LOCAL_TUI | Handle in TUI | Low-risk actions, solo work |
DESKTOP_PREFERRED | Desktop if available, TUI fallback | Default for most actions |
DESKTOP_REQUIRED | Desktop only, never TUI | High-risk actions, team environments |
CENTRAL_REQUIRED | Enterprise console | Compliance-gated actions |
Configuration
Desktop integration is configured in arcana.json:
{
"governance": {
"approval_route": "desktop_preferred",
"chat_sync": true,
"desktop_heartbeat_interval_ms": 5000
}
}
Per-Action Route Override
Override routing for specific action types:
{
"governance": {
"routes": {
"file_edit": "desktop_preferred",
"bash": "desktop_required",
"network": "desktop_required"
}
}
}
Esc Gesture
Press Esc in the TUI to:
- Leave the composer and activate spine keys (
j/k/v/a/d) - Cancel a rejection confirmation (not the approval itself)
- Not interrupt a running agent — use the palette command for that
Esc is inert on ACTION GATES — an accidental Escape cannot reject or decline a request. Gates resolve explicitly with ←/→ + Enter.
Runtime API
Desktop communicates with the Arcana daemon via a local HTTP API:
| Endpoint | Method | Purpose |
|---|---|---|
/approvals | GET | List pending approvals |
/approvals/:id | GET | Get approval details |
/approvals/:id/approve | POST | Approve a request |
/approvals/:id/deny | POST | Deny a request |
/approvals/:id/revoke | POST | Revoke an approval |
/sessions | GET | List active sessions |
/proofs/:id | GET | Get RunProof evidence |
/desktop/heartbeat | POST | Desktop presence signal |