Runtime modes

One program, five jobs. Which one it does is decided at startup, from how it was invoked and from whether the build it is in carries a window at all.

Drawing the diagram…

That last rule is what makes a double-clicked application do the obvious thing: a build with a window opens one, and a build without one serves.

The five

Mode	What runs	Socket
serve	The API and the built SPA as one process	The configured host and port, 9898 by default
desktop	serve, the token daemon, and a native window pointed at the server	The server's port, plus the daemon's
daemon	The token meter alone, for the whole machine	127.0.0.1:9899 by default
monitor	The transcript and metering command line	None, unless its own daemon command was asked for
acp	mechabedo as a coding harness, speaking the protocol on stdio	None. stdout is the wire

help and version are modes too, so a bundle asked for either prints and exits rather than sitting in a window run loop.

mechabedo                      # serve, or desktop inside a bundle
mechabedo daemon --play
MECHABEDO_MODE=daemon mechabedo

Why monitor mode exists

It is what makes the artifact the whole product rather than the server half of it. The archive, the sync, the meter, the sonifier and the terminal screen used to be reachable only from a checkout.

Mechabedo.app/Contents/MacOS/laufey monitor sources
Mechabedo.app/Contents/MacOS/laufey monitor tui

Everything after the mode token belongs to the monitor, which parses it and reports its own mistakes.

secret-scan looks for credentials in archived sessions, in an exported Logbook file, or in a harness's own history, and never prints a value, only where it is and a masked preview:

Mechabedo.app/Contents/MacOS/laufey monitor secret-scan ~/Downloads/report.html
Mechabedo.app/Contents/MacOS/laufey monitor secret-scan ~/.claude/projects --json

It exits 0 when nothing is found, 1 on findings and 2 on an error, so a script can run it as a check. --rules lists what it looks for.

Why acp mode exists

mechabedo is one of the seven harnesses, and a session on it starts this mode from the artifact that is running rather than from a mechabedo on PATH, which nothing installs.

The token daemon

The daemon meters the whole machine, including harnesses you started in your own terminal, and it outranks the server: with one running, the server forwards what it sees and mirrors the daemon's reading back over its own endpoint.

Drawing the diagram…

The desktop app runs one inside itself, which is why the status bar's rate already counts your terminal.

Vendor mode is not a sixth

MECHABEDO_VENDOR layers a strictly validated configuration over serve for a deployed container. It is the one case where startup may refuse: a missing or invalid auth section exits and lists every problem, because a deployment that came up unauthenticated would be worse than one that is down.

See Cloud agentic workspaces.

Profiles

A profile is one installation: a directory holding a database, a settings tree and its downloaded sources. The default is mainy.

One process holds one profile. A second start on the same profile refuses and names the one in the way, which is why running two at once is --profile <name> rather than an accident.

Next

• Install and first run - picking a shape
• Beam - reaching a serve installation from elsewhere
• Operating - running those as infrastructure