Decisions
Why Link Desktop gives an agent a virtual desktop of its own.
Why a virtual display rather than the owner's screen?
An Xvfb display works on a box with no screen and touches nothing of the
owner's, so an agent can use it unattended. The tool never reaches the
owner's own screen, and no setting turns that on: a real screen would need
the owner's permission for every action, and the desktop portal and
capture interfaces it would use cannot be exercised on a cloud machine.
Why does each display have a cookie?
The display starts with an MIT cookie, so no other user of the machine
draws on it. Each program the agent's run tool starts gets that
display's DISPLAY and XAUTHORITY, and its sandbox reads that display's
socket and the cookie, never the whole of /tmp/.X11-unix.
Why is the display picked by Link?
The display number is one no X server on the machine uses, so two agents on one machine never share a display.