Den-Worker-Proxy Architecture for Cloud Inference in OpenWork

The den-worker-proxy is a lightweight HTTP gateway that authenticates requests, enforces Redis-backed rate limits, and routes traffic from the OpenWork desktop client to cloud-hosted inference workers while exposing health endpoints and OpenTelemetry observability.

The den-worker-proxy serves as the critical bridge between OpenWork's desktop interface and scalable cloud inference backends. As implemented in the different-ai/openwork repository, this service handles request validation, worker routing, and operational monitoring for the platform's serverless compute architecture.

Health and Readiness Monitoring

In ee/apps/den-worker-proxy/src/app.ts, the proxy exposes two essential endpoints for orchestration systems. The /health endpoint returns a simple JSON payload confirming service availability:

{
  "ok": true,
  "service": "den-worker-proxy"
}

The /ready endpoint performs deeper dependency validation, specifically probing the database connection before returning status. When the database is unreachable, the endpoint returns a 503 status code with a detailed failure payload:

{
  "ok": false,
  "service": "den-worker-proxy",
  "checks": {
    "database": "error"
  }
}

This design enables load balancers to route traffic away from unhealthy instances while providing clear diagnostic information.

Request Routing and Authentication

The proxy validates JWT tokens extracted from the Authorization header to identify users and their target Den (the per-organization workspace). After authentication, it constructs a Redis rate-limiting key using the pattern worker-proxy:${workerId}:${authState}:${method}:${ip} to prevent abuse and replay attacks.

Once validated, the routing logic forwards requests to the appropriate inference endpoint. The implementation in src/app.ts proxies the request to the worker's internal address, preserving headers and body while making cloud inference appear seamless to desktop clients:

import { Hono } from "hono";

const app = new Hono();

app.post("/proxy/:workerId", async (c) => {
  const { workerId } = c.req.param();
  const token = c.req.header("Authorization")?.split(" ")[1];
  // Verify JWT → user & org
  // Rate-limit via Redis key `worker-proxy:${workerId}:…`
  const resp = await fetch(`http://inference-${workerId}.svc.internal${c.req.path}`, {
    method: c.req.method,
    headers: c.req.headers,
    body: c.req.body,
  });
  return new Response(resp.body, { status: resp.status, headers: resp.headers });
});

Observability and Error Handling

According to ee/packages/utils/src/observability.test.ts, the service registers itself as den-worker-proxy with OpenTelemetry instrumentation. This enables distributed tracing across the entire OpenWork stack, from the desktop application through the proxy to the final inference execution.

For graceful degradation, the proxy returns structured error responses when downstream workers are unreachable or authentication fails, ensuring clients receive actionable HTTP status codes rather than connection timeouts.

Deployment Architecture

The den-worker-proxy operates as an independent npm workspace defined in ee/apps/den-worker-proxy/package.json under the name @openwork-ee/den-worker-proxy. In production environments, it runs alongside den-web and den-api services as configured in packaging/docker/docker-compose.den-dev.yml.

For local development, the scripts/dev-local.mjs script (specifically lines 175-232) launches the proxy on a dedicated workerProxyPort, enabling full-stack testing of the cloud inference pipeline. As documented in docs/memory-bank-architecture.md (line 154), the proxy facilitates deployment into Daytona sandboxes, providing isolated execution environments for inference tasks.

Summary

• The den-worker-proxy acts as a secure gateway between OpenWork clients and cloud inference workers, implemented in ee/apps/den-worker-proxy/src/app.ts
• Health checks include basic liveness (/health) and database-dependent readiness (/ready) endpoints that return 503 errors when dependencies fail
• Redis-backed rate limiting uses the key pattern worker-proxy:${workerId}:${authState}:${method}:${ip} to prevent abuse
• The service integrates with OpenTelemetry for distributed tracing under the service name den-worker-proxy, as verified in ee/packages/utils/src/observability.test.ts
• Deployment utilizes Docker Compose alongside den-web and den-api, with support for Daytona sandbox environments and local development via scripts/dev-local.mjs

Frequently Asked Questions

How does the den-worker-proxy handle authentication?

The proxy extracts JWT tokens from incoming request headers, validates them to identify the user and their organization (Den), and verifies permissions before constructing the Redis rate-limit key and forwarding requests to inference workers.

What happens when the database is unavailable?

When the database connection fails, the /ready endpoint returns a 503 status code with a JSON payload indicating {"database": "error"}, signaling orchestrators to remove the instance from the load balancer rotation while keeping the service process alive for retries.

How is the den-worker-proxy deployed in development environments?

The scripts/dev-local.mjs script starts the proxy on a dedicated worker proxy port defined by the workerProxyPort variable, running it alongside other OpenWork services defined in packaging/docker/docker-compose.den-dev.yml for local integration testing.

What rate-limiting mechanism does the den-worker-proxy use?

The service implements Redis-based rate limiting using a structured key format worker-proxy:${workerId}:${authState}:${method}:${ip} that incorporates the worker ID, authentication state, HTTP method, and client IP address to prevent replay attacks and enforce usage quotas.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}