⏰ CLOCKWORK

The calendar where your AI agents show up for work.

Book → Run → Review → Repeat

Schedule recurring AI agent jobs on a real calendar. Clockwork executes them unattended in isolated, sandboxed worktrees — and files a report you can actually read.

Website · Download · Contact · Agent Library · Agent Workforce · Providers · Security

Why

You already pay for a coding agent. It idles 18+ hours a day.

Recurring agent work today lives in crontabs, shell scripts, CI pipelines, and sticky notes. Clockwork gives that work a home on a real calendar:

Without Clockwork	With Clockwork
Cron + terminal tabs	Month calendar with every job visible
Hope the script worked	Report with branch, diffstat, cost, transcript
Unbounded token spend	USD soft cap, plus hard turn / wall-clock caps
Agent has your whole disk	Per-run OS-sandboxed git worktree
Find last Tuesday's run: scrollback	Full-text search across retained history
The agent's work is never graded	An explicit verdict per run — accept, reject, or accept with a note the next occurrence reads

Screenshots

Month calendar — the default view	Task composer

Run report	Command palette (⌘K)

The Loop

BOOK    Pick an agent profile, repo, budget, and time. One-off or recurring.
  ↓
RUN     Your own CLI engine executes unattended inside an OS-sandboxed
        git worktree. Never touches main. SSH keys unreadable.
  ↓
REVIEW  A human-readable report lands in your inbox — what it did,
        what it skipped and why, what it cost. You record a verdict.
  ↓
REPEAT  Make it weekly. Search your retained run history.

✨ Highlights

🗓 A real calendar — month/week views, recurrence (RRULE + cron), missed-run policies, per-repo mutex, queue with reasons
👤 Human + agent time — subscribe your personal calendar via a read-only ICS URL, or import a local .ics file as a dated snapshot you re-import yourself. Recurring external events render as a single (recurring) base occurrence — Clockwork does not expand an external RRULE (packages/daemon/src/ics.ts)
🔀 Provider freedom — Claude Code, Codex CLI, OpenCode, and Hermes Agent; switch per task without rebuilding anything
🤖 13 production-grade agent profiles — Dependency Surgeon, Test Doctor, Security Auditor, Code Reviewer and more, each with mission, constraints, safety rails, and an output contract
🛡 Human-in-the-loop approvals — risky actions pause the run and ask you; unanswered asks fail safe (never silently approved), and notify you when a run is waiting. The macOS notification is unconditional — no per-task setting gates it. Telegram, Slack and email are all configured from the app — credentials in Settings, per-task fields in the composer — and all three now receive the approval request as well as the run report, through one fan-out that serves both directions (packages/daemon/src/delivery-dispatch.ts). The decision is not symmetric, and the screens say so. You answer in Clockwork, or from the Telegram message itself (packages/daemon/src/telegram-approvals.ts), which carries approve/deny buttons behind an inbound poller. Slack and email can only point you at the Inbox — Slack because its interactivity POSTs the click to a public HTTPS URL and this daemon binds loopback only, so a button there would be a control that silently does nothing. The generic HMAC-signed outbound webhook has its signing secret in Settings, but its per-task URL is set through the API only; there is no field for it in the composer
🧱 Policy floor in every mode — force-pushes to protected branches and package publishing are refused before they run on the Claude engine, even when the CLI would not have asked (a PreToolUse hook, fail-closed, ~60 ms per call)
🔎 Searchable execution history — FTS across every report and transcript; ⌘K command palette everywhere
💰 Budget enforcement by the supervisor — USD soft cap, turn limits, wall-clock timeouts enforced outside the model
🔗 Agent chains — sequence agents (scan → fix → test → PR); each stage waits for its upstream and receives its report via {{previous.report}}
🔑 Bring your own key — OpenAI-compatible API providers (Anthropic, OpenAI, Google, OpenRouter, xAI, Mistral, DeepSeek, Ollama, custom gateways) with keys sealed in the macOS Keychain, connection validation, and clear separation from CLI-subscription billing
🏛 Governance, with the seams shown — the policy engine really does run on every task create, task edit and webhook fire (engine allow-lists and a per-run cost ceiling, packages/daemon/src/policy-engine.ts), and control-plane mutations really are appended to the audit log. But reading either back is a paid route: GET /policies and GET /audit answer 402 on the free tier, which is the tier every install runs at today, and neither has a screen. The retention sweep runs on a cadence and at startup (default 90 days / 1000 runs per task, packages/daemon/src/retention-audit.ts), and Settings › Retention now shows what the next sweep will delete and when, with both numbers editable behind a confirmation that names them. requireApprovalOverUsd is stored and validated but nothing consumes it yet
👀 Watch it work — a live output tail while a run executes, with cost and turns ticking beside it, and a catch-up read so a tab opened mid-run is not blank. An approval raised while you are watching is answerable in the same view
🌅 The morning after — the Inbox opens on a digest when runs are unread: what needs you, what did not finish cleanly, what it spent, how many branches are waiting. Counted the way the Analytics tab counts, deliberately, so the two cannot disagree
🍎 A menu-bar item — next run, running count, and a badge you cannot miss when an approval is waiting, while the window is shut. Closing the window hides it; quitting still leaves the scheduler running, because launchd owns the daemon
🧰 Five jobs you can book without typing a prompt — Monday dependency triage, flaky-test sweep, Friday docs-drift check, morning repo-health digest, pre-release changelog draft. Export any task as a template and share it; import puts it through the same security preview a stranger's file gets
📊 Cost & reliability analytics — spend by task/provider/day with optimization suggestions that surface money-burning failures. Runs still in flight count as runs and as spend, are reported separately, and are excluded from every rate denominator and from average duration (packages/daemon/test/analytics.test.ts)
🏠 Local-first — SQLite in ~/.clockwork, loopback-only API, no account, no cloud, no telemetry. The other side of that: runs happen only while your Mac is awake. Clockwork holds it awake across a run's window when you are on mains power, but it cannot wake a sleeping machine — see Known limits. There is no Clockwork-hosted runner and none is planned: it would need your provider key, which would negate the Keychain promise
🧑‍💼 Agent workforce (12 features) — plan-then-execute approval gates, shift-handoff memory, office hours, sentinel→worker pairs, repo-shipped job offers, run verdicts, an earned-autonomy ladder, self-healing diagnostics, agent-proposed calendar events, timesheets, scorecards, and a portable proof-of-work export. All twelve have a screen; three of them actually gate something. Full table below

Event triggers — webhooks and GitHub events start tasks; see docs/triggers.md.

Providers

Clockwork drives the CLIs you already have — no API keys required.

Provider	Auth	Status
Claude Code (default)	Your Claude subscription login	✅
Codex CLI	Your ChatGPT/Codex login	✅
OpenCode	Its own configured model	✅
Hermes Agent (Nous Research)	Your Hermes-configured provider/model	✅

Detection is automatic (Settings → Providers): if the CLI is installed and logged in, it appears with its version and a health check. Select the engine per task in the composer — same task schema regardless of provider.

How provider execution works

Every provider implements the same AgentRunner contract (packages/shared/src/runner.ts): spawn in the run's worktree, stream progress logs over SSE to the UI, enforce budget bounds at supervisor level, map exits to failure classes (auth / capacity / timeout / budget), and return a structured outcome that becomes the report. Hermes runs via hermes -z one-shot mode with --usage-file cost telemetry; Claude Code via claude -p --output-format stream-json; Codex and OpenCode via their native headless modes.

🤖 Agent Profile Library

Profiles are production-grade operating contracts, not name stickers. Each one defines mission, constraints, hard safety rules, and an output contract.

Engineering	Operations & Docs
Dep Surgeon — patch/minor bumps proven by tests; majors get triage notes, never blind upgrades	CI Investigator — infra-flake vs regression triage from real logs
Test Doctor — flaky vs broken classification, minimal fixes, never weakens assertions	Repo Health Monitor — morning digest: stale branches, drift, advisories
Bug Hunter — evidence-first root cause before any fix	Docs Scribe — fix documentation drift from code evidence
Code Reviewer — read-only, severity-rated findings with file:line evidence	Changelog Writer — entries derived from actual diffs, never invented
Refactoring Engineer — behavior-preserving, tests green at every step
Performance Engineer — measure baseline → change one thing → re-measure
Security Auditor — report-only defensive scan; secrets masked
Release Engineer — version/changelog/build readiness checks

Twelve specialists, plus a Generalist for work that does not fit one — thirteen seeded profiles in all (packages/daemon/src/profiles.ts + packages/daemon/src/profile-library.ts).

Create your own in-app (Agents → New profile): pick skills, permission mode, budget defaults, and system prompt — bookable a minute later.

🧑‍💼 Agent Workforce

Twelve features that turn a calendar of scheduled runs into something closer to a team you manage. Every one of them has a screen in this build, and each screen declares its own location at the module scope of the file that mounts it (packages/ui/src/components/featureSurfaces.ts) — so the capability matrix behind Settings → "What does each plan include?" can tick a capability only when a mounted component actually registered one, and the tick doubles as a link that takes you there. Forgetting to register under-claims; it cannot over-claim.

Read the status column literally. It is the word packages/daemon/src/features.ts carries, and that file defines the two values narrowly:

enforced — daemon code outside the /workforce/* routes refuses or defers a user action because of this feature.
available — you can reach it today, and it gates nothing.

Three qualify as enforced. The other nine are real features you can use; they just do not stand in anything's way.

Feature	Where it lives	Status	What it does, and what it refuses
Plan → execute	`Tasks › Plan → execute`	enforced	One booking becomes two runs: a `plan`-mode run at an hour you pick, then an execute half created `enabled=0` that stays that way. Approving the plan books the execute run directly rather than re-enabling the task. Refuses: while the pair is unapproved, `POST /tasks/:id/run-now` and a webhook fire on the execute half both return 409; `PATCH /tasks/:id {"enabled":true}` on an execute half returns 409 at any pair status, because re-enabling it would let a later plan run fire it through the chain with a plan nobody read (`planExecuteGate`, `packages/daemon/src/api.ts`).
Shift handoff	`Inbox › a run’s report`	available	A recurring task carries a memory across occurrences — what it tried, what blocked it, what to check next. One setup step is yours: the memory is injected only if the prompt contains the literal `{{handoff.previous}}`. A task that does not ask never gets it.
Office hours	`Settings › Office hours`	enforced	You declare the windows in which you can answer an approval. Defers, never cancels: a due fire is pushed to the next window and the occurrence is recorded `deferred`. It applies only to tasks whose profile carries `may_require_approval`, and no profile route sets that column — autonomy enrolment is the only writer, which makes it a three-step setup, not two. Off by default, and it fails open: a broken config, no matching window, or an unflagged profile all mean "fire on schedule".
Sentinel → worker	`Tasks › Sentinels`	available	A cheap, frequent check books the expensive run when it trips, through the same policy and trigger path a webhook fire uses. Every evaluation is written down — a non-trip, a cooldown, a disabled sentinel, and a policy refusal each leave a row with its reason. Refuses (422): a sentinel bound to a trigger that books the sentinel itself, which is an infinite loop.
Repo-shipped jobs	`Tasks › Repo jobs`	available	A repo can declare recommended jobs in `.clockwork/jobs.json` (or `.yaml`, through a restricted parser that adds no new dependency). Clockwork offers them and imports nothing on its own; import creates the task disabled, behind a security preview computed at discovery time. The job file cannot choose its own power or budget: import hardcodes `acceptEdits`, $2 / 50 turns / 1h and no profile, whatever the file asks for. The red-flag 422 on import is real but unreachable from discovery — see the F5 note in the guide before treating it as a defence.
Accept with a note	`Inbox › a run’s report`	available	The per-run verdict: accept, reject, or accept-with-a-note. Re-deciding updates the verdict instead of stacking a second one. A note is appended to that task's handoff memory as a human-authored entry, so your correction is what the next occurrence's agent reads. This is the acceptance signal the autonomy ladder, timesheets and scorecards all read.
Earned autonomy	`Settings › Earned autonomy`	enforced	Opt-in, and a rung is offered, never granted — a streak of accepted runs writes an offer row and nothing else; only your acceptance writes the new rung. Refuses (403 `autonomy_rung_exceeded`) at task create, task patch and the webhook fire path — in practice only when the profile sits at the bottom `plan` rung and the task asks for another mode. The top two rungs share the permission mode `acceptEdits`, so neither refuses anything; the `acceptEdits → unattended` step's whole effect is to clear the office-hours flag. Enrolling overwrites the profile's permission mode, and the app warns before it does. An unenrolled profile is unconstrained, on purpose.
Self-healing	`Inbox › Approvals (remediation proposals)`	available	After N consecutive failures (default 3) Clockwork books one diagnostic run with the failed transcripts as context, whose instruction is "propose exactly one change, change nothing". The output is an approval item. The agent never edits its own prompt or profile: inside this feature, `apply()` is the only writer of `tasks.prompt` / `tasks.profile_id`, and it runs only from your click on Apply change — never from inside the diagnostic run (`packages/daemon/src/self-healing.ts`). Elsewhere in the product, `PATCH /tasks/:id` can still write both columns; that is your edit, not the agent's. At most one diagnostic per failure streak; a failed diagnostic books no second one.
Proposed events	`Inbox › a run’s report (when it proposes events)`	available	A report may suggest calendar events, offered as a download. Clockwork never writes to your calendar — there is no write path in the module, and the ICS overlay stays read-only. Model output is untrusted, so the parse is bounded: ≤20 suggestions, ≤8 KB block, first block only, Clockwork assigns the `.ics` UID, control characters stripped, credentials masked, and a bad block costs the suggestions rather than the run (`packages/runner/src/proposed-events-parse.ts`). Nothing is injected into your prompts, so an agent that is never asked proposes nothing.
Timesheets	`Analytics › Timesheets`	available	Hours worked, dollars spent, outcomes accepted, and an effective hourly rate per profile over any range — against an optional rate for your own time. The accuracy caveat is shown unconditionally, because a run that was still active when the daemon restarted is closed out at the restart time and so counts the downtime as work; the per-row flag on top of that is best-effort. The rate is `null`, never `Infinity` or `0`, when no hours were worked.
Performance reviews	`Analytics › Performance reviews`	available	Acceptance rate, failure rate and cost trend against the prior window — plain SQL, no model call. An unreviewed agent reads as "not yet reviewed", never as a 0% failure. `/review-prompt` returns the text of a prompt; writing the prose review means scheduling a task with it. No seeded reviewer profile does that for you.
Proof-of-work export	`Inbox › a run’s report`	available	One run's report as a single self-contained HTML file you host yourself — no script tags, no stylesheet links, no remote images, no telemetry pixel. Secrets are masked with no flag to turn it off, every interpolation is escaped, `redactPaths` strips repo/worktree/branch, the transcript is off by default, and every export is audited.

Routes, refusal paths, per-feature tests and the measured numbers: docs/agent-workforce.md.

📦 Installation

macOS 13+ (Apple silicon). Free during beta. The app carries the daemon and its own Node runtime — nothing else to install.

Download the app

# 1. Verify the bytes BEFORE you trust them
shasum -a 256 ~/Downloads/Clockwork_*_aarch64.dmg
curl -s https://github.com/vimoxshah/clockwork/releases/latest/download/checksums-sha256.txt
# if the two do not match: stop, do not install, report it

# 2. Open the DMG, drag Clockwork to Applications, then clear quarantine
xattr -dr com.apple.quarantine /Applications/Clockwork.app

# 3. Launch
open -a Clockwork

That is the whole install (a 51 MB download; 192 MB once installed, most of it the Node runtime). The app carries the daemon and its own Node, so there is no checkout, no pnpm, no Node to install, and no token to paste. On first launch Clockwork registers its background service with launchd, which is what keeps scheduled runs firing after you close the window and after a reboot, and pairs the window with the daemon's token itself. Move the app afterwards and it re-points the service at the new location.

Two things it cannot bring with it, because they are yours and already logged in: git, and at least one agent CLI (claude, codex, opencode or hermes). clockworkd doctor names either one when it is missing.

Releases are unsigned. There is no Apple Developer certificate on this project, so the release workflow ad-hoc signs the bundle (.github/workflows/release.yml exports APPLE_SIGNING_IDENTITY="-" when no certificate is configured) and nothing is notarized. macOS Gatekeeper will refuse the app — often with a misleading "damaged" message — until you clear the quarantine flag by hand. Clearing it tells your Mac you trust that specific binary, which is exactly why the hash check comes first. Homebrew (brew install --cask clockwork) verifies the SHA-256 for you but cannot skip quarantine either. Full detail, including the Homebrew tap: docs/install.md.

Or run it from source (for development)

# 1. Clone and install
git clone https://github.com/vimoxshah/clockwork.git
cd clockwork
pnpm install

# 2. Build everything
pnpm build

# 3. Start the daemon (serves UI + API on 127.0.0.1:4747)
node packages/daemon/dist/main.js

# 4. Pair the UI
open http://127.0.0.1:4747
# Paste the token from:
cat ~/.clockwork/api-token

Prerequisites:

Node.js ≥ 22, pnpm ≥ 11 (corepack enable). Run pnpm install with the same Node you will start the daemon with: better-sqlite3 is a native module compiled for one Node ABI, so switching versions afterwards (a Homebrew upgrade will do it) leaves the daemon unable to start, with NODE_MODULE_VERSION in ~/.clockwork/daemon.log.err. pnpm install again to rebuild.
At least one provider CLI installed and logged in:
- claude (recommended default)
- codex, opencode, or hermes for alternative engines
git

Desktop app (Tauri)

pnpm tauri build          # unsigned .app + DMG in src-tauri/target/release/bundle/

tools/stage-bundle.mjs runs first and stages what the app needs to stand on its own: the daemon's production tree into Contents/Resources/app (laid out as a miniature of the repo, because main.js walks to ../migrations, ../../ui/dist and ../../../resources/skill-pack) and the Node running the build into Contents/MacOS via externalBin, where Tauri signs it. That Node is the one better-sqlite3 is compiled against in the same command, so the NODE_MODULE_VERSION mismatch cannot happen in a released build.

The shell installs the LaunchAgent, re-points it when the app moves, restarts a daemon left stale by an update, and pairs the token. When the daemon still does not answer, the window shows daemon-down.html (packages/ui/public/) with the cause this install actually has and one command to run, then navigates to the real UI as soon as the port answers.

This build is unsigned and un-notarized; the release workflow only signs when Apple Developer credentials are present in CI, and they are not.

Run as a background service

# clockworkd entrypoint: install/uninstall/doctor
npx tsx packages/daemon/src/cli.ts install
clockworkd doctor        # verifies PATH, providers, data dir

Only one daemon may hold the port; a second one exits with a diagnostic naming the version skew instead of crash-looping behind an older build. The app shows a restart banner when the running daemon and the one on disk disagree.

🚀 First run in 60 seconds

Open Clockwork and press Run a sample job now. That is the whole procedure.

Clockwork points the read-only Code Reviewer at the first git repository it can find — one you have booked work against before, one it cloned for you, or the first one the folder picker shows in your home folder — caps the run at $0.50, starts it immediately, and opens the live view so you watch it work. If it finds no repository it says so, names where it looked, and offers a small bundled snippet instead; it never guesses a folder.

That first run cannot change anything. It runs in permission mode plan, inside a throwaway worktree, under a sandbox profile that mounts your repository read-only — three separate reasons, none of them a paragraph in a prompt.

Prefer to drive it yourself? + New task takes a name, a profile, a repo, a cap and a schedule — or start from one of five shipped templates. Either way the report lands in your Inbox with the branch, the diffstat and the cost. Record a verdict while you are there; several features read it.

⌨️ Keyboard shortcuts

Keys	Action
`⌘K`	Command palette (navigate, themes, create)
`⌘N`	New task
`⌘1–5`	Calendar / Inbox / Tasks / Agents / Analytics
`⌘,`	Settings
`/`	Focus inbox search

Full list: docs/SHORTCUTS.md

🏗 Architecture

┌──────────────┐   HTTP + SSE (loopback :4747, bearer token 0600)
│   UI (React) │◄───────────────────────────┐
└──────────────┘                            │
      Tauri shell loads the same URL        │
                                             │
┌────────────────────────────────────────────▼───┐
│                clockworkd (Fastify)            │
│  scheduler · queue + repo mutex · run manager  │
│  approvals · budgets · delivery · audit journal│
│                    SQLite ~/.clockwork         │
└──────────────────────┬─────────────────────────┘
                       │ spawn per run
            ┌──────────▼───────────┐
            │  runner child process│  own pgid, Seatbelt profile
            │  AgentRunner contract│  Claude │ Codex │ OpenCode │ Hermes
            └──────────────────────┘  worktree-isolated git operations

Monorepo: packages/shared (schemas/contracts) · packages/runner (engine runners + sandboxing) · packages/daemon (API/scheduler/state) · packages/ui (React + Tailwind design system)
Deterministic tests: CW_MOCK_STEP_MS makes full-loop integration tests sample intermediate states without sleeps
A screen declares itself: a capability is ticked as reachable only when the component that mounts it registers a surface at module scope (packages/ui/src/components/featureSurfaces.ts, packages/ui/src/components/LicenseCard.tsx). A feature that ships a daemon route with no screen, or an orphan component nobody imports, registers nothing — so the failure mode is a missing tick, not a false one

⚖️ Security Model

Isolation: each run gets a fresh git worktree + branch cut from base; a macOS Seatbelt (sandbox-exec) profile restricts writes to that worktree, Clockwork-managed tool caches, and the engine's own state dirs — for every engine, including the BYOK agent's shell. Turning it off (CW_SANDBOX=off) is journaled and stamped on the report.
Credential hygiene: sanitized child environment (allowlist, so SSH_AUTH_SOCK and provider keys never reach the agent); the sandbox denies reads of .ssh, .aws, .gnupg, gcloud, browser profiles, shell history; secret masking in reports. Keychain files stay readable — Claude Code needs its own OAuth item — see docs/security.md for why.
Approvals (Claude engine): gated tool calls pause the run and hold until you answer or the run's wall-clock budget ends, then fail-safe deny — recorded for audit either way. Other engines have no permission hook; the sandbox is their containment.
Budgets: USD soft cap + turn cap + wall-clock timeout enforced by the supervisor process, not by the model's self-restraint
Local-only: daemon binds 127.0.0.1; bearer token file is 0600; no analytics, no account, no cloud component

Audit it yourself. packages/runner/src/{sandbox,deny-list,run-env,service-path}.ts are the security boundary, dual-licensed under Apache-2.0 (LICENSE §12), and packages/runner/test/ exercises them against a real sandbox-exec — the suite writes a fake secret into ~/.ssh and ~/.aws, then runs cat inside the sandbox and asserts it fails.

What that does not prove:

That the DMG you downloaded was built from this source. Releases are built by GitHub Actions from this repository and the checksums are published, but reproducing the binary yourself is not yet supported.
That Apple has checked anything. The build is not signed with an Apple Developer identity and not notarized — see Installation.
That the sandbox alone stops ssh-agent forwarding. The Seatbelt profile permits system-socket; that claim holds because of the run-env allowlist, not the sandbox.

Details: docs/security.md · docs/privacy.md

🔍 Known limits

Open, reproducible, and written down here rather than discovered by you:

A refused execute booking strands its pair. When you approve a plan, the verdict commits first and the booking is attempted second. If the booking is refused — the policy engine rejects the execute half, the execute task was deleted between the plan run and your decision, or the booker throws — the pair stays at status approved with no execute run, and a second resolve answers already_resolved, so nothing re-books it (packages/daemon/src/plan-execute.ts:327, :349). A policy refusal is audited (plan_execute.book_rejected) rather than silent. Run now on that half is allowed once the pair reads approved, but that path does not bind the approved plan into the prompt, so it is not an equivalent recovery. (A paused daemon is not one of these cases: the run is queued and the pair reaches executed normally.)
The calendar latency ceiling is proven on one machine, not on the acceptance machine. Every number was measured on an Apple M4; the acceptance criterion names a base M1 Air, which has never been measured at all. On the M4 the year-view median over 5,000 runs is 40.82–42.17ms across three full test runs on 2026-09-07, against a 500 ms bound. Before the RRULE anchor fix the same measurement ranged 349.59–684.26ms across ten runs on one laptop at one commit: it met the bound in six and missed it in four, and the p95 was above the ceiling in seven, decided by machine load rather than by code. That is why the bench measures by default and only asserts under CLOCKWORK_BENCH_ASSERT=1 — the gate is about a wall-clock assertion deciding a build, not about the size of the margin. Full record: plan/STATUS.md (T-307) and docs/architecture/scalability.md.
One recurrence shape still hangs, and the defect is upstream. An hourly rule whose coarser BY part cannot be reached from its own INTERVAL grid — FREQ=HOURLY;INTERVAL=2;BYHOUR=3, whose hours stay even — never terminates inside rrule 2.8.1's skip loop. It behaved that way before the anchor work and it behaves that way after, because the reachable residues depend only on gcd(INTERVAL, 24). guardSchedule refuses exactly this shape when a task is saved, with an unreachable verdict, and a one-time sweep at daemon startup (sweepHazardousSchedules, packages/daemon/src/main.ts) runs the same check over every enabled recurring row saved before that guard existed: each one it refuses is disabled and gets an inbox item naming the rule and the fix, so a database carrying one boots into a stopped task rather than a wedged daemon. The tick path itself is still deliberately unguarded, and that is where the residue now sits — a hazardous rule written straight into SQLite while the daemon is running stays live until the next restart sweeps it.
One older capability still has no screen: container execution. GET /targets reports whether Docker is available and nothing dispatches a run to it — a probe, not a target, with nothing to set. It registers no surface, which is why the capability matrix leaves it unticked. The other three are no longer among them. DeliveryConfig carries a quietHours key ({ startHour, endHour }) and Settings has a Quiet hours card beside Office hours — and it works now: the deferral used to pre-claim the resume instant, which made the resume tick's own claim a no-op, so a deferred recurring schedule stuck at that instant and never fired again and a deferred one-shot was dropped outright (ADR-030). Retention has a card showing what the next sweep will delete and when, with both numbers editable behind a confirmation that names them — and its free-tier cap used to sit below the 90-day window every install ships with, so PUT /retention refused the value it had just handed you. An outbound webhook's URL is a field in the composer's delivery block. That URL is settable at task creation only: view() does not return a task's current delivery and patch() replaces it wholesale rather than merging, so editing one afterwards would drop the rest of that task's delivery config. A profile's delivery config is still API-only.
Keep-awake holds the Mac awake, but cannot wake it. The daemon arms a macOS power assertion (caffeinate) for a run's budgeted window and releases it afterwards. It declines on battery unless you set CLOCKWORK_KEEP_AWAKE_ON_BATTERY=1, and the OS still wins if you shut the lid. Nothing schedules a wake, so a machine already asleep at the fire time stays asleep, the run is handled by the missed-window policy, and there is no window to watch. When a run is open, the daemon samples its own window every 15s and the report says in words when the Mac slept for 60s or more during it — "This Mac slept for about 42 minutes during this run." sleptDuringRunMs carries the figure, and it is a floor: up to one 15s sample low. Two limits remain. Off macOS, and for a run recovered after a daemon restart, nobody watched, so that field and sleptThroughKeepAwake are both absent rather than false — the report declines to answer instead of answering "no". And a sleep past 60s starves the heartbeat too, so the run can still finalize as runner_crashed; the sleep sentence explains that report rather than preventing it. For genuinely unattended overnight work, use a machine that stays on.

📚 Guides

BYOK guide — connect Anthropic, OpenAI, Google, DeepSeek, Z.ai, and more; key storage, defaults, error decoding
Install & security — verified checksums, what Clockwork can reach once installed, and why quarantine must be cleared by hand
Troubleshooting — daemon, auth, scheduling, and license/plan problems
Agent workforce guide — all twelve features: routes, what each one enforces vs. merely offers, and where it's tested

🧪 Development

pnpm typecheck        # shared + runner + daemon
pnpm lint             # eslint
pnpm test             # vitest — unit + integration incl. full-loop E2E
pnpm build            # all workspace packages

# UI package only
pnpm --filter @clockwork/ui dev       # vite (proxies nothing; use served app)
pnpm --filter @clockwork/ui build

The e2e scripts under packages/ui/e2e/ are Playwright harnesses used during development to verify the real served application end-to-end (calendar, themes, palette, providers, ICS overlay, 1000-task benchmarks).

The docs are on the build. packages/daemon/test/claims-honesty.test.ts, feature-honesty.test.ts and landing-honesty.test.ts read this README, the landing page and the design docs, and fail the suite when the prose claims more than the code delivers — a permanence claim retention would contradict, a cited path that does not exist, an upgrade modal selling a feature that was deleted. An overclaim here is a red build, not a marketing choice.

🗺 Roadmap

License

Clockwork is proprietary software — see LICENSE.

Personal, non-commercial use: free. Run it on your own machines for your own work.
Commercial use (company-wide internal use, redistribution, or offering Clockwork-based functionality to others): requires a written Commercial License from the author.
The repository is public so you can audit exactly what runs on your machine — that transparency is a feature, not an invitation to redistribute.

Third-party open-source components keep their own licenses; see NOTICE.

_{Built for people who feel the chore pain weekly.}

Name		Name	Last commit message	Last commit date
.github/workflows		.github/workflows
decisions		decisions
designs		designs
docs		docs
dogfood		dogfood
evidence		evidence
landing-page		landing-page
licensing-receiver		licensing-receiver
packages		packages
packaging		packaging
plan		plan
resources		resources
reviews		reviews
spikes		spikes
src-tauri		src-tauri
tools		tools
vision		vision
worker		worker
.gitignore		.gitignore
CHANGELOG.md		CHANGELOG.md
CONTRIBUTING.md		CONTRIBUTING.md
LICENSE		LICENSE
NOTICE		NOTICE
README.md		README.md
eslint.config.js		eslint.config.js
package.json		package.json
pnpm-lock.yaml		pnpm-lock.yaml
pnpm-workspace.yaml		pnpm-workspace.yaml
tsconfig.base.json		tsconfig.base.json
vitest.workspace.ts		vitest.workspace.ts
wrangler.jsonc		wrangler.jsonc

Navigation Menu

Repository files navigation

⏰ CLOCKWORK

The calendar where your AI agents show up for work.

Why

Screenshots

The Loop

✨ Highlights

Providers

🤖 Agent Profile Library

🧑‍💼 Agent Workforce

📦 Installation

Download the app

Or run it from source (for development)

🚀 First run in 60 seconds

⌨️ Keyboard shortcuts

🏗 Architecture

⚖️ Security Model

🔍 Known limits

📚 Guides

🧪 Development

🗺 Roadmap

License

About

Releases

Packages

Contributors

Languages

Latest commit

History

Folders and files

Repository files navigation

⏰ CLOCKWORK

The calendar where your AI agents show up for work.

Why

Screenshots

The Loop

✨ Highlights

Providers

🤖 Agent Profile Library

🧑‍💼 Agent Workforce

📦 Installation

Download the app

Or run it from source (for development)

🚀 First run in 60 seconds

⌨️ Keyboard shortcuts

🏗 Architecture

⚖️ Security Model

🔍 Known limits

📚 Guides

🧪 Development

🗺 Roadmap

License

About

Topics

Resources

Contributing

Security policy

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages