Oko Desktop interface design
Oko Desktop is the decision surface over Oko's merged transcript catalogue, rebuildable search projection, and the PTY sessions Oko started itself. Raw vendor transcripts remain owned by their runtimes, while Transcript Lake owns the masked canonical store. The interface names that boundary wherever an operator could otherwise delete or trust the wrong thing.
Destinations
| Group | Destination | Decision |
|---|---|---|
| Work | Posture | Decide whether the catalogue, projection, broker, or router needs attention. |
| Work | Catalogue | Find a session in the merged catalogue by content or recency. |
| Work | Sessions | Inspect, steer, end, or stop sharing a PTY session Oko started. |
| Work | Requests | Answer interaction and approval requests blocking a run. |
| Evidence | Projection | Verify transcript-root coverage and rebuild the search projection. |
| Evidence | Activity | Read prompts, tokens, and measured frustration for the stated scan window. |
| Evidence | Goals | Inspect transcript-derived goals together with provenance. |
| System | Sync | Decide whether LAN mirrors and object storage are current. |
| System | Routing | Confirm the loopback proxy is the only model route. |
| System | Settings | See every path Oko reads and writes and the boundary it never crosses. |
Every destination states the operator journey it serves. Surfaces that cannot name a real source or decision do not ship; an engaged-time and cost screen was removed because that measurement was not exposed by OkoKit.
Rules the client may not break
- Every screen uses the shared Wisent design system; the repository carries no second local card, badge, panel, or button language.
- A failed read retains the last known value and adds the backend's exact error and reproduction command. It never turns a broken SQLite read into an empty catalogue.
- Not configured is neutral. A missing measurement is a dash, not a fabricated zero.
- Every number states its scope. Activity scans a bounded set of files; Projection counts indexed rows. Neither may call its value a total when it is not one.
- Secrets are presence booleans. Bearers, agent secrets, object API tokens, and capabilities never reach a view, log, or pasteboard.
- Destructive writes are confirmed and scoped. Projection pruning computes against every indexed session id and never rewrites the merged catalogue.
Refresh and cost
Independent reads execute concurrently. Transcript statistics are the slow path because they open source files, so Activity shows a named loading state while the rest of the window remains usable. A stale response never clears already-rendered content.
Window and packaging contract
The app creates a usable window when macOS restoration points at view types from an older release and returns no window. The Swift package product is OkoWorkspace even though the installed bundle and executable remain Oko.app and Oko; this prevents SwiftPM from resolving the dependency's older executable product with the same name.
WisentAuth gates the window and threads the signed-in user id into OkoModel.ownerId. That identity scopes shared-session publications, so a registry Oko could not reach reports not read rather than zero.