> ## Documentation Index
> Fetch the complete documentation index at: https://openworklabs.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Installer delivery

> Choose how organization install links deliver standard OpenWork desktop installers.

Organization install links help members install the standard OpenWork desktop and connect it to the correct Den organization. Den does not build a customer-specific installer or wrap the installer in a ZIP. The implementation and security details remain in the repository's [Organization Install Links guide](https://github.com/different-ai/openwork/blob/dev/docs/org-install-links.md#installer-delivery).

## Delivery matrix

| Deployment style                   | Download behavior                                                                                                                                                                                                                          | Required client access                                                                                                                                                       |
| ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Internet-connected                 | Den validates the organization install token, then redirects the browser to the exact standard GitHub release asset under `OPENWORK_INSTALLER_RELEASE_REPO` and `OPENWORK_INSTALLER_RELEASE_TAG`. The organization token is not forwarded. | Den web/API, `github.com`, `release-assets.githubusercontent.com`, and `objects.githubusercontent.com` for legacy or rollback paths.                                         |
| Semi-air-gapped installer delivery | Den streams the matching standard installer from `OPENWORK_INSTALLER_ARTIFACTS_DIR`.                                                                                                                                                       | Den web/API only for installer download. Desktop runtime dependencies may still need internet unless mirrored or disabled.                                                   |
| Fully internal installer delivery  | Same mounted-artifact path, with Den web/API and installer bytes available entirely inside the isolated network.                                                                                                                           | Internal Den web/API only for installer download. Full product isolation still requires the broader checklist in [Air-gapped deployment](/docs/start-here/air-gapped-deployment). |

## Mounted artifact behavior

When `OPENWORK_INSTALLER_ARTIFACTS_DIR` points at a mounted directory and the expected file exists, Den streams that file directly. It does not fetch from GitHub, cache on first request, rewrap, ZIP, or hold the whole installer in memory.

`OPENWORK_INSTALLER_RELEASE_TAG` selects the expected release version. The standard filenames use the release tag without a leading `v`:

* `openwork-mac-arm64-<version>.dmg`
* `openwork-mac-x64-<version>.dmg`
* `openwork-win-x64-<version>.exe`
* `openwork-linux-x86_64-<version>.AppImage`
* `openwork-linux-arm64-<version>.AppImage`

`OPENWORK_INSTALLER_RELEASE_REPO` controls the GitHub redirect path when Den does not find a mounted artifact. It is not an internal artifact registry setting.

For multi-replica Den API deployments, mount the same read-only PVC at the same path on every replica. Connection grants are stored in MySQL, so preview and acceptance can land on different replicas safely, but installer bytes must be equally visible to each replica.

## One-origin steady state and install-link exchange

For normal signed-in desktop traffic, prefer one desktop-facing Den web origin. The desktop derives API and MCP paths through that origin's `/api/den` proxy.

If `DEN_API_PUBLIC_URL` is configured as a separate API origin, the one-time **Open OpenWork** install-link exchange must also reach that API origin. External MCP clients that use the published MCP URL must reach it too. This does not mean every steady-state desktop request needs both origins in the single-origin topology.

## MDM bootstrap alternative

Managed fleets can skip the install-link handoff by deploying the standard installer through MDM and writing the desktop bootstrap configuration file during provisioning. Use that path when you already have reliable software distribution and want the first launch to know the Den base URL without a browser deep-link step.

See the repository guide for the exact bootstrap file paths, JSON shape, and security properties.