Pet Runtime is a local-first desktop companion runtime. It began as a personal Electron pet that reads Codex pet packages, reacts to local system signals, and can optionally relay slash commands through Telegram. It is not a hosted service, a marketplace or a multi-user platform.

What it runs

The runtime has three parts: petd, a local daemon; pet-electron, a transparent always-on-top overlay that draws the pet, speech bubbles, panels and notifications; and petctl, a command-line client. Around them sit local chat through Ollama, macOS Calendar reads, focus timers, agent-completion alerts, adapters for Codex and Claude threads, local voice transcription through Whisper, and the Telegram bridge.

Each feature is reasonable on its own. Together they let the pet observe local work, load packages, run commands and reach other tools. That changes the design question from how lively the pet feels to what it should be allowed to know or do on the machine.

The authority model

The runtime answers that question with defaults:

  • The daemon binds only to 127.0.0.1. Every endpoint except the health check needs a generated bearer token, and browser-origin requests to authenticated routes are rejected.
  • Bundled plugins (Agents, Focus, Calendar, Telegram and Voice) stay off until enabled in Settings.
  • File reads are limited to configured folders.
  • Telegram needs its own bridge configuration, bot token and list of allowed users, and it can reach only an allowlist of named commands. An audit found that the original Telegram path forwarded any slash command, including local file commands; the allowlist closed that path.
  • Notifications exist only in the live event stream and are not stored.
  • The source does not include private generated pet sprites. Users bring their own pet packages.

What it showed

  • Local-first does not automatically mean safe.
  • A localhost service still needs authentication and origin checks.
  • Plugins should be opt-in when they touch private surfaces.
  • Generated or private pets should not leak into public source.
  • Voice, messaging, calendar and agent bridges each need their own threat model.

Pet Runtime remains the fuller source system. Hatchling takes the same idea through a narrower gate: package shape, local runtime expectations, validation and explicit exclusions.

Signed, Agent