desktop-monkey 0.1.0__tar.gz

desktop_monkey-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,37 @@
+name: ci
+
+on:
+  push:
+    branches: [development, main]
+  pull_request:
+    branches: [development, main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    # 3.12 is the declared floor (pyproject requires-python); 3.14 is what the maintainers run.
+    # A defect that only exists on the floor (Path.read_text(newline=) is 3.13+) cannot be seen
+    # by a test on the newer interpreter, so both stay in the matrix.
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ["3.12", "3.14"]
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v10.3.3
+        with:
+          python-version: ${{ matrix.python }}
+      - run: uv sync --all-extras --frozen
+      - run: uv run ruff check src tests
+      - run: uv run ruff format --check src tests
+      - run: uv run mypy src
+      - run: uv run pytest -q
+      - run: uv run python scripts/verify_done_contract.py --check

desktop_monkey-0.1.0/.github/workflows/publish-npm.yml

@@ -0,0 +1,31 @@
+name: publish-npm
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: read
+  id-token: write  # Required for OIDC trusted publishing
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v7
+      - name: Verify Done-Contract gate
+        run: python3 scripts/verify_done_contract.py --check
+      - uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+          registry-url: 'https://registry.npmjs.org'
+          package-manager-cache: false
+      - name: Upgrade npm for OIDC
+        run: npm install -g npm@^11.15.0
+      # No --provenance: npm only accepts provenance from PUBLIC source repos (E422 otherwise) and
+      # Arcane-Fly/desktop-monkey is private. Trusted publishing (OIDC) itself works from private repos.
+      # Bump package.json "version" before tagging: 0.1.0 is already on the registry.
+      - name: Publish to npm
+        run: npm publish --access public

desktop_monkey-0.1.0/.github/workflows/publish-pypi.yml

@@ -0,0 +1,26 @@
+name: publish-pypi
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: read
+  id-token: write  # Required for OIDC trusted publishing
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v10.3.3
+        with:
+          python-version: "3.12"
+      - run: uv sync --all-extras --frozen
+      - run: uv run python scripts/verify_done_contract.py --check
+      - run: uv run pytest -q
+      - run: uv build
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

desktop_monkey-0.1.0/.gitignore

@@ -0,0 +1,32 @@
+__pycache__/
+*.pyc
+.venv/
+.pytest_cache/
+.ruff_cache/
+.mypy_cache/
+node_modules/
+dist/
+build/
+*.egg-info/
+.env
+.env.*
+!.env.example
+.vercel/
+.railway/
+*.log
+.DS_Store
+coverage/
+.coverage
+# operator-only secrets / local state never committed
+state/
+*.pem
+*.key
+# local databases (relay.db holds signing keys + device codes) and Supabase CLI link state
+*.db
+supabase/.temp/
+dashboard/node_modules/
+dashboard/dist/
+dashboard/public/brand/
+dashboard/package-lock.json
+dist/
+*.svg

desktop_monkey-0.1.0/.python-version

@@ -0,0 +1 @@
+3.13

desktop_monkey-0.1.0/AGENTS.md

@@ -0,0 +1,70 @@
+# desktop-monkey — agent rulebook
+
+Canonical instructions for every AI agent and human working in this repo.
+
+## Scope and silo
+
+* Repo: `Arcane-Fly/desktop-monkey` (private). Local: `~/Desktop/Dev/desktopmonkey`.
+* Memory silo: **`_dev_`** (not `bsuite_`, not `qig_`). Cross-silo reads are fine; **cross-silo
+  writes are forbidden**. QIG packages are *consumed* as dependencies; this project is not QIG.
+* Python 3.12+ for device-side code (matches Monkey Monitor + QIG packages). TypeScript for the
+  web dashboard and shared schema package only.
+
+## Deploy isolation (hard rules — an incident here is an incident in someone else's project)
+
+The Railway workspace `arcane-fly`, the Vercel team `braden-pty-ltd` and the Supabase org hold many
+unrelated production projects (BSuite, monkey-oauth/fastmonkey.au, muscles, practicebridge, …).
+
+1. Desktop Monkey only ever acts on resources **pinned by ID** in `deploy/targets.json` (Railway
+   project `mesh-vm-test` with services `relay` and `mesh-vm`; Supabase `supabase-monkey-one` through
+   role `dm_relay`; Vercel project `dashboard`, which builds `dashboard/`). Pass the IDs explicitly
+   on every command; never infer a target from a CLI's "current" link.
+2. Every agent-run Railway change goes through `deploy/guard.py run` (deploys, redeploys, variable
+   edits). It refuses unpinned services, checks the CLI link against the pinned IDs, snapshots every
+   *other* project's latest deployment before and after, and exits 3 if any of them changed.
+   `python deploy/guard.py check` and `snapshot` are read-only.
+3. **Supabase** (operator decision 2026-11-07): the relay uses `supabase-monkey-one`
+   (`kxdaxwvxaonnvjmqfvtj`; related to the monkey apps and to be integrated with them) **only**
+   through role `dm_relay`, whose search_path is pinned to schema `desktop_monkey` (not exposed to
+   the Data API). Never point Desktop Monkey at the shared `postgres` credentials or at monkey-one's
+   `public` schema; any table created in an API-exposed schema gets RLS in the same migration. The
+   BSuite projects (`tuybltdrdefjblnplpqo`, `yhwlnehzclclnkpxjepc`) and every other Supabase project
+   are off limits. Creating a Supabase project needs operator approval (cost).
+4. No `railway link`/`vercel link` against an unpinned project. No env-var edits on any project not
+   in `deploy/targets.json`. No domain changes on `fastmonkey.au` or any `crm7.app` host.
+5. Secrets never enter the repo, prompts, logs, tool output or screenshots. Pass them on stdin or in
+   the environment, never on a command line, and never print them (`railway variables --json`,
+   `supabase projects api-keys`, `vercel env pull` to stdout). Tokens live in the platform secret
+   stores or `state/` (git-ignored). A service gets only the variables its code reads
+   (`deploy/targets.json` → `variables_read_by_code`), never a copied bundle.
+6. Connection strings come from the provider (Supabase Connect dialog or `supabase/.temp/pooler-url`,
+   Railway reference variables). **Never compose or guess hostnames, ports or users.** The relay has
+   no IPv6 egress, so it reaches Supabase through the session pooler (IPv4, port 5432).
+7. Never retry authentication in a loop against a production database. Supabase's pooler answers
+   repeated failures with `ECIRCUITBREAKER` and blocks new logins. One failed login: stop and report.
+
+## Operator-reserved actions (do not perform; queue in `docs/RESERVED-FOR-OPERATOR.md`)
+
+* Publishing to npm / PyPI (needs operator-held credentials).
+* Setting or rotating passwords and other credentials (database roles, API keys, platform secrets).
+* Creating Supabase projects, custom DNS/domains, paid GPU/model spend (Modal etc.).
+* `sudo`/system-level installs, editing global agent configs (`~/.claude`, `~/.codex`, `~/.cursor`),
+  changing the installed Monkey Monitor system service, touching any device other than this one.
+* Anything touching another project's resources.
+
+## Working rules
+
+* **Evidence, not assertion.** "Done" = the command that was run + its real output. Parity claims
+  are checked by `docs/parity/` tests, not by prose.
+* **A deploy is verified by the running service, not by a status read.** On 2026-11-07 a `SUCCESS`
+  status was read twice, seconds before the app crashed. Wait at least 60 s, read the deploy logs,
+  and check `/health`, OAuth discovery and `POST /mcp` → 401 before saying it works.
+* **No fabricated output.** If a tool/network call fails, say so and use another route. Label work as
+  it actually ran: local vs mesh, threads vs devices.
+* **Finish the whole ask.** Do not narrow scope silently; report `done/asked`.
+* Commits: `type(scope): description`, GPG-signed. Branches: `main` (release) and `development`
+  (integration). Work lands on `development`; `main` by PR at milestones.
+* Reverse engineering is **clean-room**: observe behaviour, record it in `docs/parity/`, implement
+  independently. Do not vendor proprietary frontend code or tokens.
+* Colour/brand: bind UI to the theme tokens (`theme/`, `src/desktop_monkey/theme`) shared with
+  Monkey Monitor. No raw hex in UI code outside the token source.

desktop_monkey-0.1.0/CLAUDE.md

@@ -0,0 +1,3 @@
+# CLAUDE.md
+
+See [AGENTS.md](AGENTS.md) — it is the single rulebook for this repository.

desktop_monkey-0.1.0/Dockerfile

@@ -0,0 +1,27 @@
+# Stage 1: Build the Dashboard SPA (React 19 + Vite + BSuite D2C Neon Electric theme)
+FROM node:22-slim AS dashboard-build
+WORKDIR /dashboard
+COPY dashboard/package.json ./
+RUN npm install --no-audit --no-fund
+COPY dashboard/ ./
+COPY src/desktop_monkey/theme/assets/ ./public/brand/
+RUN npm run build
+
+# Stage 2: Mesh relay + dashboard hub image for Railway
+FROM python:3.13-slim
+
+WORKDIR /app
+
+COPY pyproject.toml README.md ./
+COPY src ./src
+COPY --from=dashboard-build /dashboard/dist /app/dashboard/dist
+
+RUN python -m pip install --no-cache-dir --upgrade pip \
+ && python -m pip install --no-cache-dir '.[relay]'
+
+# Relay binds 0.0.0.0:$PORT and serves the built dashboard SPA from RELAY_STATIC_DIR
+ENV PORT=8787
+ENV RELAY_STATIC_DIR=/app/dashboard/dist
+EXPOSE 8787
+
+CMD ["python", "-m", "desktop_monkey.relay"]

desktop_monkey-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Braden Pty Ltd / Arcane-Fly
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

desktop_monkey-0.1.0/NOTICE

@@ -0,0 +1,12 @@
+Desktop Monkey
+Copyright (c) 2026 Braden Pty Ltd / Arcane-Fly. MIT.
+
+Portions of src/desktop_monkey/commander/data/dc-oss-tools.json (tool names, JSON Schemas and
+description strings) are derived from Desktop Commander MCP
+(https://github.com/wonderwhy-er/DesktopCommanderMCP, v0.3.1, commit e701d2b),
+Copyright (c) 2024-2025 Eduard Ruzga and Desktop Commander Contributors, MIT License.
+Used for interface compatibility. The hosted Remote MCP service is closed source; Desktop Monkey's
+relay and dashboard are independent, clean-room implementations of its observable behaviour.
+
+integrations/monkey-monitor/ is a vendored snapshot of the operator's own Monkey Monitor project
+(see integrations/monkey-monitor/UPSTREAM.md).

desktop_monkey-0.1.0/PKG-INFO

@@ -0,0 +1,164 @@
+Metadata-Version: 2.5
+Name: desktop-monkey
+Version: 0.1.0
+Summary: Desktop Commander-parity remote MCP plus a device mesh that pools compute, GPU, RAM and disk across your own machines.
+Project-URL: Homepage, https://github.com/Arcane-Fly/desktop-monkey
+Project-URL: Issues, https://github.com/Arcane-Fly/desktop-monkey/issues
+Author: Braden Pty Ltd / Arcane-Fly
+License: MIT
+License-File: LICENSE
+License-File: NOTICE
+Keywords: agent-hooks,desktop-commander,distributed,llm,mcp,mesh,remote-mcp
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: MacOS
+Classifier: Operating System :: Microsoft :: Windows
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Software Development
+Classifier: Topic :: System :: Distributed Computing
+Requires-Python: >=3.12
+Requires-Dist: cryptography>=44
+Requires-Dist: httpx>=0.28
+Requires-Dist: jsonschema>=4.23
+Requires-Dist: orjson>=3.10
+Requires-Dist: psutil>=6.1
+Requires-Dist: pydantic>=2.11
+Requires-Dist: pyhpke>=0.6.3
+Requires-Dist: qig-coordizer>=0.1.0
+Requires-Dist: qig-warp>=0.6.10
+Requires-Dist: typer>=0.15
+Requires-Dist: websockets>=15
+Provides-Extra: all
+Requires-Dist: aiosqlite>=0.20; extra == 'all'
+Requires-Dist: argon2-cffi>=23.1; extra == 'all'
+Requires-Dist: asyncpg>=0.30; extra == 'all'
+Requires-Dist: charset-normalizer>=3.4; extra == 'all'
+Requires-Dist: dask>=2025.1; extra == 'all'
+Requires-Dist: markdown-it-py>=3.0; extra == 'all'
+Requires-Dist: numpy>=2.0; extra == 'all'
+Requires-Dist: nvidia-ml-py>=12.560; (sys_platform != 'darwin') and extra == 'all'
+Requires-Dist: openpyxl>=3.1; extra == 'all'
+Requires-Dist: pyjwt[crypto]>=2.10; extra == 'all'
+Requires-Dist: pypdf>=5; extra == 'all'
+Requires-Dist: pywinpty>=2.0; (sys_platform == 'win32') and extra == 'all'
+Requires-Dist: qig-compute>=0.9.10; extra == 'all'
+Requires-Dist: ray>=2.40; extra == 'all'
+Requires-Dist: reportlab>=4.2; extra == 'all'
+Requires-Dist: sqlalchemy[asyncio]>=2.0.36; extra == 'all'
+Requires-Dist: starlette>=0.46; extra == 'all'
+Requires-Dist: uvicorn[standard]>=0.34; extra == 'all'
+Requires-Dist: weightspace>=0.3; extra == 'all'
+Requires-Dist: zeroconf>=0.140; extra == 'all'
+Provides-Extra: commander
+Requires-Dist: charset-normalizer>=3.4; extra == 'commander'
+Requires-Dist: markdown-it-py>=3.0; extra == 'commander'
+Requires-Dist: openpyxl>=3.1; extra == 'commander'
+Requires-Dist: pypdf>=5; extra == 'commander'
+Requires-Dist: pywinpty>=2.0; (sys_platform == 'win32') and extra == 'commander'
+Requires-Dist: reportlab>=4.2; extra == 'commander'
+Provides-Extra: dev
+Requires-Dist: anyio>=4.8; extra == 'dev'
+Requires-Dist: dask>=2025.1; extra == 'dev'
+Requires-Dist: mcp>=1.9; extra == 'dev'
+Requires-Dist: mypy>=1.14; extra == 'dev'
+Requires-Dist: pytest-asyncio>=0.25; extra == 'dev'
+Requires-Dist: pytest-timeout>=2.3; extra == 'dev'
+Requires-Dist: pytest>=8.3; extra == 'dev'
+Requires-Dist: qig-compute>=0.9.10; extra == 'dev'
+Requires-Dist: ray>=2.40; extra == 'dev'
+Requires-Dist: ruff>=0.9; extra == 'dev'
+Requires-Dist: weightspace>=0.3; extra == 'dev'
+Provides-Extra: fabric
+Requires-Dist: dask>=2025.1; extra == 'fabric'
+Requires-Dist: ray>=2.40; extra == 'fabric'
+Provides-Extra: mesh
+Requires-Dist: numpy>=2.0; extra == 'mesh'
+Requires-Dist: nvidia-ml-py>=12.560; (sys_platform != 'darwin') and extra == 'mesh'
+Requires-Dist: zeroconf>=0.140; extra == 'mesh'
+Provides-Extra: qig
+Requires-Dist: qig-compute>=0.9.10; extra == 'qig'
+Provides-Extra: relay
+Requires-Dist: aiosqlite>=0.20; extra == 'relay'
+Requires-Dist: argon2-cffi>=23.1; extra == 'relay'
+Requires-Dist: asyncpg>=0.30; extra == 'relay'
+Requires-Dist: pyjwt[crypto]>=2.10; extra == 'relay'
+Requires-Dist: sqlalchemy[asyncio]>=2.0.36; extra == 'relay'
+Requires-Dist: starlette>=0.46; extra == 'relay'
+Requires-Dist: uvicorn[standard]>=0.34; extra == 'relay'
+Provides-Extra: weightspace
+Requires-Dist: weightspace>=0.3; extra == 'weightspace'
+Description-Content-Type: text/markdown
+
+# Desktop Monkey
+
+> Your machines, one troop. A Desktop Commander–parity **remote MCP** plus a **device mesh** that
+> pools compute, GPU, RAM and disk across the PCs and laptops you own.
+
+**Status:** under construction — see [`docs/DONE-CONTRACT.json`](docs/DONE-CONTRACT.json) for the
+machine-checkable list of what "finished" means and [`docs/STATUS.md`](docs/STATUS.md) for the live
+done/asked count.
+
+## What it is
+
+1. **Commander layer** — 100% tool-surface and service parity with
+   [Desktop Commander Remote MCP](https://mcp.desktopcommander.app/): every MCP tool, plus the
+   hosted pieces (device enrolment, tunnel, per-client OAuth, usage metering, tool-call log,
+   revoke/share, settings). Parity is tracked in [`docs/parity/`](docs/parity/).
+2. **Troop mesh** — concurrent coordination of several machines: *primary + support*, *several
+   supports*, rings and chains. Work is split so that no single machine has to carry the compute,
+   GPU memory, RAM or disk. See [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md).
+3. **Hooks** — an improved, typed, auditable hook engine (lessons from Claude Code, Codex and
+   Cursor hooks) that also fires on mesh events.
+4. **Monkey Monitor entry point** — the local GTK app
+   ([`monkey-projects/monkey-monitor`](../monkey-projects/monkey-monitor)) is the local front door;
+   Desktop Monkey shares its colour tokens and logo.
+
+## Layout
+
+One Python package, `src/desktop_monkey/` (the earlier `packages/` / `services/` / `apps/` split was
+never built):
+
+| Path | Purpose |
+|---|---|
+| `src/desktop_monkey/protocol` | MCP tool schemas + mesh wire messages |
+| `src/desktop_monkey/commander` | Desktop Commander–parity MCP server |
+| `src/desktop_monkey/agent` | Per-device daemon |
+| `src/desktop_monkey/mesh` | Mesh scheduling, placement and pooling |
+| `src/desktop_monkey/relay` | Control plane + tunnel (deployed on Railway) |
+| `src/desktop_monkey/hooks` | Hook engine and adapters |
+| `src/desktop_monkey/learning` | Learning experiments |
+| `src/desktop_monkey/monitor` | Monkey Monitor integration |
+| `src/desktop_monkey/security` | Security helpers |
+| `src/desktop_monkey/theme`, `theme/` | Colour + logo tokens shared with Monkey Monitor |
+| `tests/` | Test suite |
+| `deploy/` | `targets.json` (pinned IDs) + `guard.py` (deploy isolation check) |
+| `scripts/` | Dev and operator scripts (`connect_relay_db.sh`, …) |
+| `supabase/migrations/` | Mesh schema on supabase-monkey-one (`public.mesh_*`, RLS on) |
+| `docs/` | Vision, architecture, ADRs, parity matrix, research |
+
+## Live hub
+
+The mesh relay is deployed on Railway as the central hub. This section lists its endpoints;
+current health is in [`docs/STATUS.md`](docs/STATUS.md).
+
+| | |
+|---|---|
+| **Public URL** | `https://relay-production-ef48.up.railway.app` |
+| **Health** | `GET /health` → `{"status":"ok"}` |
+| **MCP endpoint** | `POST /mcp` (OAuth 2.1 bearer token, PKCE S256; 401 without token) |
+| **Device mesh tunnel** | `wss://relay-production-ef48.up.railway.app/tunnel` |
+| **OAuth discovery** | `/.well-known/oauth-authorization-server` (issuer = public URL) |
+| **JWKS** | `/.well-known/jwks.json` (ES256) |
+| **Device enrolment** | `/device/start` → `/device/poll` → `/device/verify` (device-code flow) |
+| **Device API** | `/api/devices` (pause / resume / revoke) |
+
+Devices and MCP clients connect to the public URL above; `RELAY_PUBLIC_URL` is set
+on the Railway `relay` service so the OAuth issuer matches. The image is built from
+the repo `Dockerfile` (`pip install '.[relay]'`), which pins the relay extras the
+platform builder would otherwise skip.
+
+## Rules of the road
+
+Read [`AGENTS.md`](AGENTS.md) before touching anything — especially the deploy-isolation rules.

desktop_monkey-0.1.0/Procfile

@@ -0,0 +1 @@
+web: python -m desktop_monkey.relay

desktop_monkey-0.1.0/README.md

@@ -0,0 +1,71 @@
+# Desktop Monkey
+
+> Your machines, one troop. A Desktop Commander–parity **remote MCP** plus a **device mesh** that
+> pools compute, GPU, RAM and disk across the PCs and laptops you own.
+
+**Status:** under construction — see [`docs/DONE-CONTRACT.json`](docs/DONE-CONTRACT.json) for the
+machine-checkable list of what "finished" means and [`docs/STATUS.md`](docs/STATUS.md) for the live
+done/asked count.
+
+## What it is
+
+1. **Commander layer** — 100% tool-surface and service parity with
+   [Desktop Commander Remote MCP](https://mcp.desktopcommander.app/): every MCP tool, plus the
+   hosted pieces (device enrolment, tunnel, per-client OAuth, usage metering, tool-call log,
+   revoke/share, settings). Parity is tracked in [`docs/parity/`](docs/parity/).
+2. **Troop mesh** — concurrent coordination of several machines: *primary + support*, *several
+   supports*, rings and chains. Work is split so that no single machine has to carry the compute,
+   GPU memory, RAM or disk. See [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md).
+3. **Hooks** — an improved, typed, auditable hook engine (lessons from Claude Code, Codex and
+   Cursor hooks) that also fires on mesh events.
+4. **Monkey Monitor entry point** — the local GTK app
+   ([`monkey-projects/monkey-monitor`](../monkey-projects/monkey-monitor)) is the local front door;
+   Desktop Monkey shares its colour tokens and logo.
+
+## Layout
+
+One Python package, `src/desktop_monkey/` (the earlier `packages/` / `services/` / `apps/` split was
+never built):
+
+| Path | Purpose |
+|---|---|
+| `src/desktop_monkey/protocol` | MCP tool schemas + mesh wire messages |
+| `src/desktop_monkey/commander` | Desktop Commander–parity MCP server |
+| `src/desktop_monkey/agent` | Per-device daemon |
+| `src/desktop_monkey/mesh` | Mesh scheduling, placement and pooling |
+| `src/desktop_monkey/relay` | Control plane + tunnel (deployed on Railway) |
+| `src/desktop_monkey/hooks` | Hook engine and adapters |
+| `src/desktop_monkey/learning` | Learning experiments |
+| `src/desktop_monkey/monitor` | Monkey Monitor integration |
+| `src/desktop_monkey/security` | Security helpers |
+| `src/desktop_monkey/theme`, `theme/` | Colour + logo tokens shared with Monkey Monitor |
+| `tests/` | Test suite |
+| `deploy/` | `targets.json` (pinned IDs) + `guard.py` (deploy isolation check) |
+| `scripts/` | Dev and operator scripts (`connect_relay_db.sh`, …) |
+| `supabase/migrations/` | Mesh schema on supabase-monkey-one (`public.mesh_*`, RLS on) |
+| `docs/` | Vision, architecture, ADRs, parity matrix, research |
+
+## Live hub
+
+The mesh relay is deployed on Railway as the central hub. This section lists its endpoints;
+current health is in [`docs/STATUS.md`](docs/STATUS.md).
+
+| | |
+|---|---|
+| **Public URL** | `https://relay-production-ef48.up.railway.app` |
+| **Health** | `GET /health` → `{"status":"ok"}` |
+| **MCP endpoint** | `POST /mcp` (OAuth 2.1 bearer token, PKCE S256; 401 without token) |
+| **Device mesh tunnel** | `wss://relay-production-ef48.up.railway.app/tunnel` |
+| **OAuth discovery** | `/.well-known/oauth-authorization-server` (issuer = public URL) |
+| **JWKS** | `/.well-known/jwks.json` (ES256) |
+| **Device enrolment** | `/device/start` → `/device/poll` → `/device/verify` (device-code flow) |
+| **Device API** | `/api/devices` (pause / resume / revoke) |
+
+Devices and MCP clients connect to the public URL above; `RELAY_PUBLIC_URL` is set
+on the Railway `relay` service so the OAuth issuer matches. The image is built from
+the repo `Dockerfile` (`pip install '.[relay]'`), which pins the relay extras the
+platform builder would otherwise skip.
+
+## Rules of the road
+
+Read [`AGENTS.md`](AGENTS.md) before touching anything — especially the deploy-isolation rules.

desktop_monkey-0.1.0/dashboard/index.html

@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html lang="en" class="dark" data-theme="dark">
+<head>
+  <meta charset="UTF-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>Desktop Monkey — Remote MCP &amp; Compute Mesh</title>
+  <link rel="icon" href="/brand/favicon-32.ico" sizes="32x32" />
+</head>
+<body>
+  <div id="root"></div>
+  <script type="module" src="/src/main.jsx"></script>
+</body>
+</html>

desktop_monkey-0.1.0/dashboard/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "desktop-monkey-dashboard",
+  "version": "0.1.0",
+  "private": true,
+  "dependencies": {
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0",
+    "@tanstack/react-query": "^5.0.0",
+    "tailwindcss": "^4.0.0",
+    "@tailwindcss/vite": "^4.0.0",
+    "@bsuite/theme": "latest"
+  },
+  "devDependencies": {
+    "vite": "^6.0.0",
+    "@vitejs/plugin-react": "^4.0.0"
+  },
+  "scripts": {
+    "dev": "vite",
+    "build": "vite build",
+    "preview": "vite preview"
+  }
+}