Client deployment

The Watcher client runs on each developer machine and sends coding-agent sessions to your self-hosted backend.

Environment	Installation path
Individually managed machine	Run the installer as the developer
Ephemeral development VM	Bake the client into the VM image
Persistent managed fleet	Follow the MDM rollout

Install for one user

Run the installer as the developer account and specify the self-hosted URL:

curl -fsSL https://github.com/ApolloResearch/watcher-bin/releases/latest/download/install.sh \
  | bash -s -- --watcher-api-url https://watcher.example.com

Installation is per user. The installer records the backend, installs the coding-agent hooks, and registers Watcher to start on login. See Supply chain security for internal mirrors.

Sending additional headers

In proxy authentication mode, set one WATCHER_HEADER_* environment variable for each header the client must send:

export WATCHER_HEADER_X_FORWARDED_USER=adrian@veidt.ent
export WATCHER_HEADER_X_AUTH_PROXY_TOKEN=RAMESESII

The suffix becomes the header name, with underscores replaced by hyphens. The installer stores the values in an owner-only file under ~/.apollo_monitor/. Re-run watcher hooks install to rotate them. To remove them, unset the variables and run watcher hooks clear-headers.

Bake the client into a VM image

Install Watcher while building the image, as the account developers will use:

curl -fsSL https://github.com/ApolloResearch/watcher-bin/releases/latest/download/install.sh \
  | bash -s -- --watcher-api-url https://watcher.example.com

~/.local/bin/watcher autostart install
~/.local/bin/watcher autostart enable

Repeat this for each account on a multi-user VM. In proxy mode, set that user's WATCHER_HEADER_* values while running the installer or watcher hooks install; the command captures them in an owner-only file that later launches read. In SSO mode, each developer signs in through the local UI.

Client updates

Clients started by the login service update automatically to a release matching the server. Foreground and mirror-backed clients require an explicit update. See Update Watcher.