Machines Tab

TL;DR

Machines is your workspace’s roster. Each entry shows online state and metadata; clicking one opens an inspector chat that sends prompts straight to the remote agent — no local LLM in the middle. It is the visual front end for cmdop ask_agent.

The Machines tab is where you find every agent in your workspace and talk to them one at a time.

What the Machines tab shows

The list view shows hostname, display name, OS, online state, last-seen timestamp, and labels for each machine in your workspace. Search and filter live in the lists panel; the rail’s “Status” button toggles an online-only filter. Online detection comes from the daemon heartbeat — internal/desktop/services/connection keeps the wire open and the activity stream signals state changes back into the UI.

Online vs. offline vs. degraded

Machines have three states. Online means a healthy heartbeat in the last interval. Degraded means heartbeats are arriving but with errors (slow RPC, partial loss, recovering from a transport bounce). Offline means no heartbeat past the threshold — the machine is unreachable. The conceptual heartbeat math is in daemon.

An offline machine cannot receive prompts. The inspector will tell you so before you click Send, so a typo on a stale machine never gets queued forever.

Per-machine inspector chat — the direct pipe

This is the headline feature of the tab. Opening a machine produces a chat session with an ID of the form machine_<uuid>_<hex>. The chat service detects the prefix, marks the session with TargetMachineID, and bypasses the local LLM — your prompt is forwarded to the remote agent via remoteagent.AskStream and the replies stream back as chat:chunk events. The transcript still persists, so reopening the inspector resumes the conversation exactly where you left off. The relevant code is internal/desktop/services/chat/service_send_remote.go and internal/connect/remoteagent/client.go.

Per-machine chat is a direct pipe. Tokens you type are sent to the remote agent verbatim — there is no local model paraphrasing, no local tool routing, and no extra latency. See desktop inspector chat for the cross-surface story.

Authentication and password-protected machines

The first prompt to a password-locked machine triggers a streaming auth handshake; the resulting token is stored in the process-wide sessionauth cache (24 h TTL) so subsequent unary RPCs “just work” without re-prompting. The cache is memory-only — restarting the desktop drops every session token, on purpose.

If you restart the desktop, you will need to enter machine passwords again on first prompt. Tokens never touch disk.

Multi-target fan-out

The desktop does not yet have a multi-select fan-out UI on the Machines tab itself, but the local Chat tab can call ask_agents as a tool to fan out to several machines in one prompt. So there are two paths: open one inspector per machine for focused work, or call the fan-out tool from local chat for parallel work. The tool implementation is in internal/agent/builtin/tools/connecttool/ask_agents.go.

The Machines tab exposes a share-link action: pick a machine, generate a time-limited or permanent token, and get a URL that lets a teammate access the machine without your workspace credentials. Time-limited shares are hours-only — finer granularity is not exposed in the UI today. The CLI exposes the same operation via cmdop connect share.

Remote project files

The machine you select on this tab also drives which cmdop://machine/<id>/... paths are reachable in the Projects tab. Adding a remote project for an offline machine is fine — the desktop dials lazily on the first ListDir, not on Add.