Daily Edition Sources +3

The Old Proxy Is Gone. OpenWork's Cloud Has One Door Now.

OpenWork has deleted its standalone cloud-worker proxy; the public replacement makes a fresh signed preview the access-resolution seam while keeping a stable route for clients that cannot hold an expiring address.

Photocopied marker diagram showing a crossed-out old worker proxy, a fresh signed preview with an expiry clock, and a stable compatibility route pointing to it, with a public-source-and-tests caveat stamp.
Diagram PunkOpenWork moves Cloud runtime access into a fresh-preview resolution seam.
repos source trail evidence
3 source signals 0 repos commit 92f4f3f
Evidence: commit 92f4f3f / August 28, 2026 / Daily Edition
Open Edition Evidence below

OpenWork’s August 27 commit deletes the standalone den-worker-proxy application. It makes refreshed, signed Daytona previews the shared way Web sessions, remote sessions, automations and provider setup find a worker. That matters when the connection expires: a Cloud workspace cannot make an old URL its permanent home if the current preview is meant to be short-lived.

The first angle was too simple. OpenWork has not abolished proxying or handed every client a direct preview link. The change adds an API compatibility route: a desktop client can ask it to resolve current access while the Web path receives a fresh preview. The project is moving the decision about where a Cloud worker lives into one resolution step, instead of letting clients remember an expiring host.

A URL can be a capability and a cache problem

The public signed-preview evaluation shows the practical shape. It seeds an expired preview, refreshes it, probes the new preview’s health endpoint, and expects the runtime to return the new URL with an expiry. The legacy connection, by contrast, receives a stable API worker route with no preview hostname. When that stable route is used, the new compatibility proxy resolves the current preview before forwarding the request.

A durable client address and a short-lived runtime address can coexist only if there is a clear place to refresh, authenticate and test the latter. The evaluation also refuses a redirect served by the sandbox-controlled health endpoint. It is a focused signal: the resolver is meant to ask whether this is the live destination, not blindly follow an address it was handed.

The middleman moved; the question became inspectable

For an operator, the audit question is concrete: which client receives an expiring preview, which receives a stable route, and where does that route re-check the worker? OpenWork’s test covers the intended split, a refreshed-preview case and a redirect refusal. It does not show a release, a default setting, a particular Daytona deployment or a complete security proof. The next signal is release guidance that makes preview expiry, compatibility routing and failure behavior a supported contract rather than source-code inference.

Evidence Trail

Receipts below the story

The article above is the public narrative. This section keeps the source trail and limits on the same page.

Edition
DateAugust 28, 2026
LaneDaily Edition
Confidence78%
Sources3
Repossource trail

Primary Evidence

  • OpenWork Cloud-runtime refactor: commit 92f4f3fb, “remove the legacy worker proxy path”
    • Shows: the public main-branch change that deletes the standalone den-worker-proxy, names fresh signed Daytona previews as the Cloud runtime access seam, and adds the access, lifecycle, Cloud-route and compatibility-path work behind that change.
  • OpenWork signed-preview evaluation: cloud-runtime signed-preview test
    • Shows: a focused public test of refreshing an expired preview, retaining a stable legacy client URL, forwarding that route to a newly resolved preview, and refusing a redirect from the sandbox-controlled health endpoint.
  • OpenWork compatibility implementation: worker compatibility proxy
    • Shows: the public code path that authenticates a stable worker request, resolves Cloud access at request time, and forwards to the current runtime preview instead of retaining the removed standalone proxy host.

Evidence Limits

  • These public source and test receipts do not prove that a release includes the refactor, that Cloud is enabled or identically configured for every OpenWork installation, or that the new access path has been independently deployed or load-tested.
  • A passed redirect and expiry test is not a comprehensive authentication or security guarantee. Watch for release documentation that commits to the stable-route and preview-expiry behavior, and for regressions in refresh, compatibility or redirect handling.
Letters & Corrections

Send a note to the desk

Corrections, missing context, or a follow-up lead.