Beacon

Honest by Construction

“Connected” is a claim. Beacon only makes it when it can prove it.

Every cockpit eventually faces the same question: is this screen telling me the truth, or is it just still painted? A dashboard that keeps spinning after the thing it watches has died is worse than no dashboard at all — it turns a visible outage into an invisible one. Beacon is built around closing every place that could happen.

Why this exists

On 29 July 2026 the daemon had been restarted fifty-three hours earlier. Beacon had made zero reconnect attempts in that entire window — and had displayed “Connected” the whole time. A half-open socket dies without ever delivering a close event, so nothing ever fired. Replies were being produced on the host and simply never arriving. That bug is now a standing rule: “Connected” can never point at a dead socket.

The link proves itself every twenty seconds. Beacon pings the WebSocket on a 20s interval and tears it down after 45s of silence — calling terminate(), not close(), because a half-open socket never completes a closing handshake and a graceful close can hang forever. The teardown lands in the ordinary reconnect backoff, so both recovery and an honest “reconnecting” fall out of the normal path. Opening the laptop lid triggers an immediate redial.
Movement means liveness. The activity line under a running turn — ◐ Rummaging… 47s · bash · round 2 — advances its spinner and its verb only when a real daemon frame lands, never on a CSS timer. If the link dies mid-turn the line visibly freezes, then says so: No signal from the gateway · quiet for 1m20s. The blinking caret it replaced animated forever regardless, which is exactly how a dead socket passed for a working one for two days.
A 401 is reported as a 401. When the daemon rejects your token the connection dot grows an amber lock and reads 401 — not “offline”, which would send you debugging the wrong layer. And when the socket is closed for bad auth, Beacon deliberately stops reconnecting: a bad credential won’t heal itself, and retry-storming the daemon is worse than honest failure.
A failed send is never swallowed. If a send fails while the indicator still says connected, the failure is written into the thread you are looking at — queued, retried on reconnect, but never quietly. An app that silently pockets your message reads as an agent ignoring you.
Downloads are matched, not guessed. When the agent leaves a file in its outbox the reply grows a download chip — resolved by exact name against the daemon’s artifact manifest and fetched by content id, never by parsing a path out of prose. Against an older daemon the manifest is empty and no chip ever renders.

The Cockpit

Chat, with the work visible

Replies stream as markdown while every tool call renders inline — consecutive calls merge into one activity strip with live durations, and parallel dispatches show up as batches. Past six calls the strip collapses to a per-tool tally that keeps running and error states visible, so a long turn stays readable instead of scrolling away. The composer carries a per-session model switcher with auth-mode badges, an Agent | Chat toggle for tools-on or plain replies, and a one-shot 🔍 force-search that arms the next send to open with a real web search.

Replies render as full GitHub-flavoured markdown — tables, task lists, strikethrough — with syntax highlighting and long code blocks collapsed until you want them. Attach files by picker, paste, or drag-drop. Retry or edit your last message without retyping it. And relaunching Beacon reopens the conversation you were last in, rather than dropping you on an empty screen.

A finished reply in Beacon — the tool timeline above the answer, with the model switcher, Agent|Chat toggle, and force-search control in the composer

A finished turn — tool timeline above the answer.

A sidebar that survives a real workload

On the live box the session list had become unusable: 69 of 127 sessions were benchmark runs, and the source chips beside them were auto-derived as the first two letters of a prefix — VE, RE, TH, ME — four colliding labels that turned out to be one-off verification scripts sitting at equal weight beside real conversations. Now every source carries a readable name (Desktop, Telegram, Voice, Slack), the list groups by calendar day so “Yesterday” means yesterday even at 00:20, and machine runs fold behind a single dashed Automated chip that is excluded from the default view. The audit trail stays one click away; it just stops competing for your attention. Forget removes a session on the daemon, not merely locally — and a forgotten session that speaks again revives rather than staying silently buried. Unread dots ride the daemon's own high-water mark, so a session that moved while Beacon was shut reads as unread the moment you open it. Subagents nest under the session that spawned them instead of flattening into the list.

Coding runs that end at your review, not in your branch

Fire a sandboxed iterate-to-green run — repo, task, acceptance command, caps — and watch rounds stream live: outcome, tokens, duration, thinking flag, with a Stop button. The terminal state is a verdict: acceptance exit code, branch, and a colorized diff, plus copy-able git commands for reviewing it yourself. The Loop Manager sits above that as a PM cockpit — registered repos, a TASKS.md board, a LOOP.md contract editor, a compiled-run preview. Runs are capped by default at 30 rounds or 1200 seconds of wall time, editable per run, so an agent that isn't converging stops on its own budget rather than yours. You can also point a loop at nothing at all and have it bootstrap a brand-new project from the board.

Beacon never merges and never pushes — and that is not a policy note, it is an assertion in the proof suite. The command builder is checked for the absence of a git merge and a git push, so the promise fails loudly the moment anyone breaks it.

Live coding rounds streaming into Beacon — per-round outcome, tokens, and duration, with a Stop button

Rounds streaming live.

A finished coding run in Beacon — acceptance command exit 0 and the reviewable diff

The artifact — iterated to green, yours to merge.

The instruments

Mission is the landing view, and its centrepiece is the Armilla — an armillary sphere after Antonio Santucci's, built in Florence in 1593. The stand is static and represents Beacon itself; the nested great circles move on live daemon telemetry, and armed scheduled jobs park on the horizon dial as diamonds at the hour they will fire. It is an instrument, not an ornament: nothing on it moves unless something real is happening.

Around it: agent state and uptime, how many of your configured models are actually reachable (N/M ready), a telemetry headline and task ticker. Status is the read-only instrument panel behind that — agent status, a context inspector for the live session's window, the Sentinel dream log, and the daemon's profiles, all on a four-second poll. Live streams every gateway frame with filter, search and export, and a pause that freezes the rendered snapshot so a busy agent can't scroll what you're reading off the screen. Tool Feed aggregates calls across sessions with success stats.

Work that runs without you

Config → Cron is a scheduler, not a viewer: create a job from a name, a schedule and a command; run it now fire-and-forget; enable, disable or delete it. The expression is sanity-checked as you type and fully validated by the daemon, and every write re-reads the daemon's list rather than trusting the local copy. The Board is a daemon-backed Kanban whose stories dispatch straight into coding runs. Integrations is deliberately generic — every control renders from a manifest and its wire schema, with no integration-specific code in Beacon, so a new one needs no new release.

Documents with AI redlines

A calm writing surface over the daemon's documents folder. Type an instruction — "tighten the intro" — and proposed edits come back as inline tracked-changes, each with its own Accept/Reject plus an Accept all. Nothing touches disk until you accept.

AI redlines pending in the Documents editor — each proposed edit shown inline with Accept and Reject controls

Redlines pending — accepting is what applies them.

Models & keys

Paste a provider key once — it saves to the daemon, takes effect immediately, and is never shown again. Auth-mode badges say whether a provider runs on an API key or a subscription, and "Sign in with SuperGrok" is a full OAuth device-code flow for xAI — your subscription powers it, no key at all.

Beacon's Models tab — per-provider API keys, auth-mode badges, and SuperGrok subscription sign-in

The Models tab — paste-once keys and SuperGrok sign-in.

Memory you can edit, without racing the agent

The agent’s MEMORY.md and USER.md are editable in place, with a live character meter against the daemon’s budget. The interesting part is the conflict: if the agent wrote to memory while you were typing, your save is rejected rather than applied, and comes back carrying the current truth so your draft rebases on top of it. A stale save can never clobber what the agent learned in the meantime — and the daemon snapshots the previous content before every write, so there is history behind each edit.

The Skin Codex

Eight named theme plates — NOX, LVX, AVRVM, VMBRA, AERVGO, CAERVLA, RVBEDO, AETHER — each a complete design-token set with a live preview tile. Your pick persists across launches.

The Skin Codex.

Under the Hood

Serious engineering, for something that is “just” a desktop app.

Desktop clients get a reputation for being the soft layer — the place where correctness goes to become a rendering detail. Beacon is written the other way round: the parts that decide what you see are pure, and they are proved.

34 headless proofs. Beacon has no component-test framework. Rather than treat that as an excuse, the shared logic — timeline batching, session grouping, attention ranking, presence, the coding verdict, the pairing parser — is written pure specifically so it can be proved without one. The proofs run headless after every build; two of them drive a live daemon end to end.
The cache never second-guesses the daemon. The window paints instantly from a local cache, then reconciles against the daemon by a durable rowid cursor — asking only for what it has not already stored. Your own message renders optimistically and is re-keyed to its durable id when the daemon echoes it back. The daemon stays the single source of truth; the cache only ever makes it faster to look at.
The token never reaches the renderer. It is encrypted through the OS keychain and stored outside the app bundle — never in the renderer, never in localStorage, never committed. The UI knows a token exists; it is never told the value. The renderer reaches Node only through an allowlisted preload bridge, with context isolation on and node integration off.
Pairing refuses to false-succeed. A daemon that answers 200 without a token is treated as an error, not a silent empty-token pair. A wrong code reports how many attempts remain; a locked, expired, or already-used code says which. And after pairing, the only thing that ends the wait is the real daemon answering — a setup server that merely disappeared, mid-restart, keeps waiting instead of proceeding on a guess.
It never phones anywhere but your daemon. The three typefaces are bundled OFL variable fonts loaded from inside the app — Beacon requests no font, script or stylesheet from a CDN at runtime. The gateway address is configurable and defaults to the local daemon; a private gateway IP must never appear in committed source, and that is an enforced rule rather than a habit. Filesystem reach is confined too: the Loop Manager and Documents can only touch allowed paths under their root, and the proofs assert the guards hold.
A rejected token has exactly one face. A REST 401 and a WebSocket 4401 land on the same “not authorized” state across every surface — panels, the socket, the file preview. A bad credential can never masquerade as an empty workspace, which is the failure that sends you looking for missing data instead of a missing token.
The transcript stays fast at any length. Only the recent tail of a conversation is mounted; Show earlier reveals the rest on demand. A session that has been running for months doesn’t render thousands of markdown trees just to show you the last reply — which matters for an agent whose conversations are meant never to end.