@abot-ai/runtime 1.4.0 → 1.6.0

package/dist/src/web-ui/app/components/system-host/macos-permission-preparation.js

@@ -0,0 +1,83 @@
+import { hasCompletePermissionReceipt, macPermissionScopes } from "./macos-permission-scopes.js";
+
+export function createMacPermissionPreparation({
+  state, requestPermissions, beginRequest, finishRequest, isCurrentResponse,
+  getSurfaceRevision, isVisible, getEnvironmentId,
+}) {
+  function clear() {
+    for (const route of Object.values(macPermissionScopes)) {
+      state[route.receiptKey] = null;
+      state[route.errorKey] = "";
+    }
+  }
+  function reconcile() {
+    for (const route of Object.values(macPermissionScopes)) {
+      if (route.matches(state[route.receiptKey], state.snapshot, getEnvironmentId())) continue;
+      state[route.receiptKey] = null;
+      state[route.errorKey] = "";
+    }
+  }
+  function canPreparePermissions(route) {
+    if (state.busy || state.statusUnavailable) return false;
+    if (!isVisible()) return false;
+    if (typeof requestPermissions !== "function") return false;
+    return route.canCheck(state.snapshot, getEnvironmentId());
+  }
+  function canApplyPermissionResponse(operation, surface, route, binding) {
+    if (!isCurrentResponse(operation)) return false;
+    if (surface !== getSurfaceRevision()) return false;
+    if (!isVisible()) return false;
+    return route.matches(binding, state.snapshot, getEnvironmentId());
+  }
+  function permissionStillRequired(permission, route) {
+    const receipt = state[route.receiptKey];
+    if (!route.matches(receipt, state.snapshot, getEnvironmentId())) return false;
+    if (permission === "screen_recording")
+      return receipt.permissions.screenRecording === "required";
+    if (permission === "accessibility")
+      return receipt.permissions.accessibility === "required";
+    return false;
+  }
+  async function prepare(permission, scope = "companion") {
+    const route = macPermissionScopes[scope];
+    if (!route || !canPreparePermissions(route)) return false;
+    if (permission && !permissionStillRequired(permission, route)) return false;
+    const binding = route.binding(state.snapshot);
+    const surface = getSurfaceRevision();
+    state[route.errorKey] = "";
+    const operation = beginRequest();
+    try {
+      const receipt = await requestPermissions({
+        ...binding,
+        action: permission ? "request" : "check",
+        ...(permission ? { permission } : {}),
+      });
+      if (!canApplyPermissionResponse(operation, surface, route, binding)) return false;
+      if (!route.matches(receipt, state.snapshot, getEnvironmentId()))
+        throw new Error("permission_receipt_binding_invalid");
+      if (receipt.scope !== scope || !hasCompletePermissionReceipt(receipt))
+        throw new Error("permission_receipt_unavailable");
+      state[route.receiptKey] = receipt;
+      return true;
+    } catch {
+      if (!canApplyPermissionResponse(operation, surface, route, binding)) return false;
+      state[route.receiptKey] = null;
+      state[route.errorKey] = "Permission preparation could not complete. Check the executing Mac, its macOS 14 or later version and Swift developer tools. Refresh the connection, then check again.";
+      return false;
+    } finally {
+      finishRequest(operation);
+    }
+  }
+  function afterPaint(root) {
+    for (const [scope, route] of Object.entries(macPermissionScopes)) {
+      root?.querySelector(`[data-${route.selector}-permissions-check]`)
+        ?.addEventListener("click", () => void prepare(undefined, scope));
+      for (const permission of ["screen_recording", "accessibility"])
+        root?.querySelector(`[data-${route.selector}-permission-request="${permission}"]`)
+          ?.addEventListener("click", () => void prepare(permission, scope));
+    }
+  }
+  return { clear, reconcile, afterPaint, checkPermissions: () => prepare(), requestPermission: prepare,
+    checkNativePermissions: () => prepare(undefined, "native_runtime"),
+    requestNativePermission: permission => prepare(permission, "native_runtime") };
+}

package/dist/src/web-ui/app/components/system-host/macos-permission-rendering.js

@@ -0,0 +1,85 @@
+import { escapeHtml } from "../../lib/text-format.js";
+import { canCheckMacPermissions, canCheckNativePermissions, permissionsMatchConnection, permissionsMatchNativeOwner } from "./macos-permission-scopes.js";
+
+function hasNativePermissionSurface(snapshot) {
+  if (snapshot?.identity?.os === "macos") return true;
+  if (!snapshot?.nativePermissions) return false;
+  return snapshot.nativePermissions.reason !== "native_macos_unavailable";
+}
+function permissionSummary(receipt) {
+  if (!receipt) return "not checked";
+  if (receipt.permissions.screenRecording !== "granted") return "action needed";
+  if (receipt.permissions.accessibility !== "granted") return "action needed";
+  return "granted";
+}
+export function macPermissionSummary(snapshot, receipt, nativeReceipt) {
+  const parts = [];
+  if (hasNativePermissionSurface(snapshot)) {
+    const native = snapshot.nativePermissions;
+    const current = permissionsMatchNativeOwner(nativeReceipt, snapshot, native?.environmentId) ? nativeReceipt : null;
+    parts.push(`SYSTEM · ${native?.available ? permissionSummary(current) : "unavailable"}`);
+  }
+  if (snapshot?.identity?.os === "macos" && snapshot.connected) {
+    const current = permissionsMatchConnection(receipt, snapshot) ? receipt : null;
+    parts.push(`Companion · ${canCheckMacPermissions(snapshot) ? permissionSummary(current) : "update needed"}`);
+  }
+  return parts.join(" · ");
+}
+function permissionStatusLabel(status) {
+  if (status === "granted") return "Granted";
+  if (status === "required") return "Required";
+  return "Not checked";
+}
+function permissionRow(label, permission, status, selector, disabled) {
+  return `<div class="system-host-permission-row"><strong>${label}</strong>
+    <span class="system-host-permission-state" data-granted="${status === "granted"}">${permissionStatusLabel(status)}</span>
+    ${status === "required" ? `<button type="button" data-${selector}-permission-request="${permission}" ${disabled ? "disabled" : ""}>Allow ${label}</button>` : ""}</div>`;
+}
+function renderPermissionRoute({ title, description, selector, available, receipt, identity, permissionHelp, error, disabled }) {
+  return `<section class="system-host-permission-route" data-permission-route="${selector}">
+    <div class="system-host-permission-heading"><h4>${title}</h4>
+      ${available ? `<button type="button" data-${selector}-permissions-check ${disabled ? "disabled" : ""}>${receipt ? "Check again" : "Check permissions"}</button>` : ""}</div>
+    <p class="system-host-note">${escapeHtml(description)}</p>
+    ${available ? permissionRow("Screen Recording", "screen_recording", receipt?.permissions.screenRecording, selector, disabled) + permissionRow("Accessibility", "accessibility", receipt?.permissions.accessibility, selector, disabled) : ""}
+    ${identity ? `<p class="system-host-note">${identity}</p>` : ""}
+    ${receipt ? `<code class="system-host-permission-path" dir="ltr">${escapeHtml(receipt.executablePath)}</code><p class="system-host-note">${permissionHelp} After changing access, choose Check again.${receipt.restartMayBeRequired ? " macOS may require a restart before the new access takes effect; finish setup before starting a conversation." : ""}</p>` : ""}
+    ${error ? `<p role="alert" class="error-text">${escapeHtml(error)}</p>` : ""}
+  </section>`;
+}
+function nativeUnavailableDescription(native) {
+  if (!native) return "Update ABot to check the native SYSTEM route. Companion approval does not confirm SYSTEM access.";
+  if (native.reason === "native_macos_unavailable") return "The selected Runtime is not running natively on macOS. Companion permissions do not grant SYSTEM access on another computer.";
+  if (native.reason === "local_browser_required") return "Open ABot’s local Web UI on the Mac running the Runtime to prepare SYSTEM permissions.";
+  if (native.reason === "runtime_not_started") return "Start the selected Runtime, then refresh Computer access to prepare SYSTEM permissions.";
+  return "The selected Runtime cannot report its permission identity. Update or reconnect it, then refresh Computer access.";
+}
+export function renderMacPermissionPreparation({ snapshot, macPermissions, macPermissionError, nativeMacPermissions, nativeMacPermissionError, busy, statusUnavailable }) {
+  const showNative = hasNativePermissionSurface(snapshot);
+  const showCompanion = snapshot?.identity?.os === "macos" && snapshot.paired;
+  if (!showNative && !showCompanion) return "";
+  const native = snapshot.nativePermissions;
+  const nativeAvailable = canCheckNativePermissions(snapshot, native?.environmentId);
+  const nativeReceipt = permissionsMatchNativeOwner(nativeMacPermissions, snapshot, native?.environmentId) ? nativeMacPermissions : null;
+  const companionAvailable = canCheckMacPermissions(snapshot);
+  const companionReceipt = permissionsMatchConnection(macPermissions, snapshot) ? macPermissions : null;
+  const disabled = busy || statusUnavailable;
+  return `<section class="system-host-permissions" data-system-host-mac-permissions aria-label="macOS permission preparation">
+    <h3>Prepare Mac permissions before a conversation</h3>
+    <p class="system-host-note">SYSTEM and the companion can run under different apps or on different computers. Check each route you use. Checks do not capture content or start Spark; Allow buttons explicitly request access.</p>
+    ${showNative ? renderPermissionRoute({
+      title: "SYSTEM · ABot Runtime", selector: "native-mac", available: nativeAvailable, receipt: nativeReceipt,
+      description: nativeAvailable ? "Direct SYSTEM commands use the selected Runtime’s permissions. Allow Terminal or the application shown by macOS. If asked to reopen it, do so before starting a conversation, then check again." : nativeUnavailableDescription(native),
+      identity: nativeAvailable ? `Runtime computer: <strong>${escapeHtml(native.computerName)}</strong> · Environment: <strong>${escapeHtml(native.environmentId)}</strong>` : "",
+      permissionHelp: "This path identifies the Runtime process; macOS may assign its permissions to Terminal or the application that started it.",
+      error: nativeMacPermissionError, disabled,
+    }) : ""}
+    ${showCompanion ? renderPermissionRoute({
+      title: "Computer tools · ABot companion", selector: "mac", available: companionAvailable, receipt: companionReceipt,
+      description: companionAvailable ? "Screen capture and computer control through the connected companion. Spark collection is controlled separately." : "Connect or update the Mac companion to check its permissions here.",
+      identity: `Companion computer: <strong>${escapeHtml(snapshot.identity.name || "Connected Mac")}</strong>`,
+      permissionHelp: "macOS may label the companion “node”. Match this exact path in System Settings → Privacy &amp; Security.",
+      error: macPermissionError, disabled,
+    }) : ""}
+    <p class="system-host-note">These checks cover Screen Recording and Accessibility. Access to protected folders and automation of individual apps can require additional approval.</p>
+  </section>`;
+}

package/dist/src/web-ui/app/components/system-host/macos-permission-scopes.js

@@ -0,0 +1,51 @@
+/** Each receipt belongs to its executing process, never the browser computer. */
+export function canCheckMacPermissions(snapshot) {
+  if (snapshot?.identity?.os !== "macos") return false;
+  if (!snapshot.connected) return false;
+  if (!snapshot.hostId || !snapshot.connectionId) return false;
+  if (snapshot.readiness?.companionUpdateRequired) return false;
+  return snapshot.capabilities?.includes("macos_permission_preflight_v1") === true;
+}
+
+export function permissionsMatchConnection(receipt, snapshot) {
+  if (!receipt || !canCheckMacPermissions(snapshot)) return false;
+  if (receipt.hostId !== snapshot.hostId) return false;
+  return receipt.connectionId === snapshot.connectionId;
+}
+
+export function canCheckNativePermissions(snapshot, environmentId) {
+  const native = snapshot?.nativePermissions;
+  if (native?.available !== true) return false;
+  if (native.scope !== "native_runtime") return false;
+  if (typeof native.ownerId !== "string" || !native.ownerId) return false;
+  return native.environmentId === environmentId;
+}
+
+export function permissionsMatchNativeOwner(receipt, snapshot, environmentId) {
+  if (!receipt || !canCheckNativePermissions(snapshot, environmentId)) return false;
+  if (receipt.scope !== "native_runtime") return false;
+  if (receipt.environmentId !== environmentId) return false;
+  return receipt.ownerId === snapshot.nativePermissions.ownerId;
+}
+
+export function hasCompletePermissionReceipt(receipt) {
+  if (receipt?.ok !== true) return false;
+  if (typeof receipt.executablePath !== "string") return false;
+  if (!receipt.executablePath.startsWith("/")) return false;
+  const statuses = ["granted", "required"];
+  if (!statuses.includes(receipt.permissions?.screenRecording)) return false;
+  return statuses.includes(receipt.permissions?.accessibility);
+}
+
+export const macPermissionScopes = {
+  companion: {
+    receiptKey: "macPermissions", errorKey: "macPermissionError", selector: "mac",
+    canCheck: canCheckMacPermissions, matches: permissionsMatchConnection,
+    binding: snapshot => ({ hostId: snapshot.hostId, connectionId: snapshot.connectionId }),
+  },
+  native_runtime: {
+    receiptKey: "nativeMacPermissions", errorKey: "nativeMacPermissionError", selector: "native-mac",
+    canCheck: canCheckNativePermissions, matches: permissionsMatchNativeOwner,
+    binding: snapshot => ({ scope: "native_runtime", environmentId: snapshot.nativePermissions.environmentId, ownerId: snapshot.nativePermissions.ownerId }),
+  },
+};

package/dist/src/web-ui/app/components/system-host/macos-permissions.js

@@ -0,0 +1,36 @@
+import { escapeHtml } from "../../lib/text-format.js";
+
+function hasManagedMacPermissionRuntime(version) {
+  if (!Number.isInteger(version)) return false;
+  return version >= 6;
+}
+
+export function macCompanionPermissionPath(snapshot) {
+  if (!snapshot?.paired) return "";
+  if (snapshot.identity?.os !== "macos") return "";
+  if (!hasManagedMacPermissionRuntime(snapshot.companion?.installedVersion))
+    return "";
+  const home = snapshot.identity.homeDir;
+  const prefix =
+    typeof home === "string" && home.startsWith("/")
+      ? home.replace(/\/+$/u, "")
+      : "~";
+  return prefix + "/.abot/host-companion/runtime/node";
+}
+
+/** The managed companion keeps its macOS permission subject at one private path. */
+export function renderMacPermissionGuide(snapshot) {
+  if (!snapshot?.paired) return "";
+  if (snapshot.identity?.os !== "macos") return "";
+  const version = snapshot.companion?.installedVersion;
+  if (!hasManagedMacPermissionRuntime(version))
+    return '<p class="system-host-note">Update the Mac connection to set up Spark permissions for its dedicated companion runtime.</p>';
+  return `<details class="system-host-manual" data-system-host-mac-permissions>
+    <summary>macOS permissions for Spark</summary>
+    <p>The connection is ready independently of macOS permission to read activity. Start collection in Spark to request Accessibility access.</p>
+    <p>On the connected Mac, open System Settings → Privacy &amp; Security → Accessibility (Device Control &amp; Data Access on some macOS versions). Use the add button, press Command–Shift–G and select this companion executable:</p>
+    <pre><code>${escapeHtml(macCompanionPermissionPath(snapshot))}</code></pre>
+    <p>macOS may display it as node. Check its path before enabling access. This private runtime belongs to the ABot companion and is reused at sign-in.</p>
+    <p>Spark checks for approval for up to two minutes without collecting content. After that, stop and start collection to check again. A runtime replacement can require consent again.</p>
+  </details>`;
+}

package/dist/src/web-ui/app/components/system-host/macos-setup.js

@@ -0,0 +1,91 @@
+import { escapeHtml } from "../../lib/text-format.js";
+
+export function hasMacSetup(snapshot) {
+  if (snapshot?.readiness?.ready === true) return false;
+  return snapshot?.readiness?.platforms?.includes("macos") === true;
+}
+
+export function hasLocalMacSetup(snapshot) {
+  if (!hasMacSetup(snapshot)) return false;
+  return snapshot.readiness.localSetupAvailable === true;
+}
+
+function hasLoopbackRuntimeOrigin(url) {
+  if (!["http:", "https:"].includes(url.protocol)) return false;
+  if (url.hostname === "localhost") return true;
+  if (url.hostname.endsWith(".localhost")) return true;
+  if (url.hostname === "[::1]") return true;
+  return /^127(?:\.\d{1,3}){3}$/u.test(url.hostname);
+}
+
+export function macConnectionCommand(origin) {
+  try {
+    const url = new URL(origin);
+    if (hasLoopbackRuntimeOrigin(url))
+      return {
+        command: `abot host connect --url '${url.origin.replaceAll("'", "'\\''")}'`,
+        needsForwarding: false,
+      };
+  } catch {
+    // A remote or unavailable browser origin cannot identify a local forwarded port.
+  }
+  return {
+    command: "abot host connect --url http://localhost:<forwarded-port>",
+    needsForwarding: true,
+  };
+}
+
+export function macRepairConnectionCommand() {
+  return {
+    command: "abot host status\nabot host connect --url '<saved-runtime-url>'",
+    needsForwarding: false,
+  };
+}
+
+export function readMacPairingReceipt(receipt) {
+  if (!/^[A-Za-z0-9_-]{43}$/u.test(receipt?.code ?? ""))
+    throw new Error("The pairing response was invalid. Try again.");
+  if (!Number.isFinite(Date.parse(receipt.expiresAt)))
+    throw new Error("The pairing response was invalid. Try again.");
+  return { code: receipt.code, expiresAt: receipt.expiresAt };
+}
+
+export function renderMacSetupAction(snapshot, disabled) {
+  if (!hasMacSetup(snapshot)) return "";
+  const local = hasLocalMacSetup(snapshot);
+  const localLabel = snapshot.paired
+    ? "Repair Mac connection"
+    : "Connect this Mac";
+  const label = local ? localLabel : "Connect a Mac";
+  const action = local ? "local" : "manual";
+  return `<button type="button" data-system-host-mac="${action}" ${disabled ? "disabled" : ""}>${label}</button>`;
+}
+
+export function renderMacSetupNotice(snapshot) {
+  if (!hasMacSetup(snapshot)) return "";
+  if (!hasLocalMacSetup(snapshot))
+    return "<p>On the Mac you want to connect, use an installed ABot CLI in Terminal. The connection starts now and at future sign-ins for that Mac user.</p>";
+  const name = snapshot.readiness.localComputerName;
+  const computer = name ? ` <strong>${escapeHtml(name)}</strong>` : " this Mac";
+  return `<p>Connect${computer} using its installed ABot. This enables the companion now and at future sign-ins for the user running ABot. Allow the macOS permissions requested for desktop access.</p>`;
+}
+
+export function renderMacConnectionInstructions(manual) {
+  if (!manual) return "";
+  const expired =
+    manual.expiresAt && Date.parse(manual.expiresAt) <= Date.now();
+  const forwarding = manual.needsForwarding
+    ? "<p>Use an existing local port forward on the Mac to this Runtime. Replace &lt;forwarded-port&gt; with its localhost port. A remote Runtime address cannot be used directly.</p>"
+    : "";
+  const pairing =
+    manual.code && !expired
+      ? `<p>When Terminal asks, paste this one-time code:</p><pre><code>${escapeHtml(manual.code)}</code></pre><p>Code expires at ${escapeHtml(new Date(manual.expiresAt).toLocaleTimeString())}.</p>`
+      : "";
+  const repair = manual.repair
+    ? "<p>On the Mac already paired with ABot, run <code>abot host status</code> first. Replace &lt;saved-runtime-url&gt; in the connect command with the exact saved <code>url</code> shown by status, keeping the quotes. This resumes the saved connection. If this is a different Mac, return to the paired Mac or explicitly unpair before creating a new connection.</p>"
+    : "";
+  const expiration = expired
+    ? "<p>This pairing code expired. Choose Connect a Mac again for a fresh code.</p>"
+    : "";
+  return `<div class="system-host-manual"><p>Open Terminal on the Mac with ABot installed and run:</p><pre><code>${escapeHtml(manual.command)}</code></pre>${forwarding}${repair}${pairing}${expiration}<p>Return here and wait for Ready after connecting.</p></div>`;
+}

package/dist/src/web-ui/app/components/system-host/manager.js

@@ -1,14 +1,22 @@
 import { downloadHostSetup } from "./download.js";
 import { hostSetupIsReady, renderSystemHostConnection } from "./rendering.js";
 import { createSystemHostVisibility } from "./visibility.js";
+import { createMacConnectionActions } from "./macos-connection-actions.js";
+import { createMacPermissionPreparation } from "./macos-permission-preparation.js";
 
 export function createSystemHostConnectionManager({
   loadConnection,
   downloadSetup,
+  connectLocal,
+  createPairing,
+  requestPermissions,
+  getEnvironmentId = () => "",
+  getRuntimeOrigin = () => globalThis.location?.origin,
   revokeConnection,
   supportsConnection = () => true,
   saveDownload = downloadHostSetup,
   documentRoot = globalThis.document,
+  compact = false,
   onChange = () => {},
   schedulePoll = (callback, delay) => setTimeout(callback, delay),
   cancelPoll = (timer) => clearTimeout(timer),
@@ -23,6 +31,12 @@ export function createSystemHostConnectionManager({
     message: "",
     statusUnavailable: false,
     downloaded: null,
+    manualMac: null,
+    managementOpen: false,
+    macPermissions: null,
+    macPermissionError: "",
+    nativeMacPermissions: null,
+    nativeMacPermissionError: "",
   };
   let revision = 0;
   let pollTimer;
@@ -36,14 +50,46 @@ export function createSystemHostConnectionManager({
     isActive: () => state.active,
     onChange: visibilityChanged,
   });
+  const mac = createMacConnectionActions({
+    state,
+    connectLocal,
+    createPairing,
+    getRuntimeOrigin,
+    canInstallOnPlatform,
+    beginRequest,
+    finishRequest,
+    isCurrentResponse,
+    load,
+    getSurfaceRevision: () => surfaceRevision,
+    isVisible: () => visibility.isVisible(),
+  });
+  const permissions = createMacPermissionPreparation({
+    state, requestPermissions, beginRequest, finishRequest, isCurrentResponse, getEnvironmentId,
+    getSurfaceRevision: () => surfaceRevision,
+    isVisible: () => visibility.isVisible(),
+  });
   function markup() {
     return renderSystemHostConnection({
       ...state,
       error: state.error || state.actionError,
       supported: supportsConnection(),
+      compact,
     });
   }
   function afterPaint(root = state.root) {
+    permissions.afterPaint(root);
+    const management = root?.querySelector("[data-system-host-management]");
+    management?.addEventListener("toggle", () => {
+      if (management !== state.root?.querySelector("[data-system-host-management]")) return;
+      state.managementOpen = management.open;
+      lastNotification = markup();
+    });
+    root
+      ?.querySelector('[data-system-host-mac="local"]')
+      ?.addEventListener("click", () => void mac.connectMac());
+    root
+      ?.querySelector('[data-system-host-mac="manual"]')
+      ?.addEventListener("click", () => void mac.pairMac());
     root
       ?.querySelector("[data-system-host-refresh]")
       ?.addEventListener("click", () => void load());
@@ -90,6 +136,9 @@ export function createSystemHostConnectionManager({
     if (!visible && wasVisible) surfaceRevision += 1;
     wasVisible = visible;
     if (!visible) {
+      state.manualMac = null;
+      permissions.clear();
+      notify();
       stopPolling();
       return;
     }
@@ -124,13 +173,17 @@ export function createSystemHostConnectionManager({
       return false;
     }
     const operation = beginRequest(background);
+    const environment = getEnvironmentId();
     try {
       const snapshot = await loadConnection();
       if (!isCurrentResponse(operation)) return false;
+      if (environment !== getEnvironmentId()) return false;
       state.snapshot = snapshot;
+      permissions.reconcile();
       state.statusUnavailable = false;
       state.error = "";
       if (hostSetupIsReady(snapshot)) {
+        state.manualMac = null;
         state.downloaded = null;
         state.message = "";
         state.actionError = "";
@@ -139,6 +192,7 @@ export function createSystemHostConnectionManager({
     } catch {
       if (!isCurrentResponse(operation)) return false;
       state.statusUnavailable = true;
+      permissions.clear();
       state.error = state.downloaded?.restartRequired
         ? "Waiting for WSL and ABot to return after setup."
         : "Could not check this computer. Refresh to try again.";
@@ -161,7 +215,9 @@ export function createSystemHostConnectionManager({
     return message || "Setup could not be downloaded. Try again.";
   }
   async function install(platform) {
+    if (platform === "macos") return false;
     if (!canInstallOnPlatform(platform)) return false;
+    state.manualMac = null;
     const operation = beginRequest();
     const surface = surfaceRevision;
     try {
@@ -194,9 +250,11 @@ export function createSystemHostConnectionManager({
       const snapshot = await revokeConnection();
       if (!isCurrentResponse(operation)) return false;
       state.snapshot = snapshot;
+      permissions.clear();
       state.downloaded = null;
+      state.manualMac = null;
       state.statusUnavailable = false;
-      state.message = "Computer access revoked.";
+      state.message = "Computer unpaired.";
       return true;
     } catch {
       if (isCurrentResponse(operation))
@@ -219,20 +277,43 @@ export function createSystemHostConnectionManager({
     state.snapshot = null;
     state.statusUnavailable = false;
     state.downloaded = null;
+    state.manualMac = null;
     state.error = "";
     state.actionError = "";
     state.message = "";
+    state.managementOpen = false;
+    permissions.clear();
     stopPolling();
     wasVisible = false;
+    render();
   }
   return {
     state,
     load,
     install,
+    ...mac,
+    checkPermissions: permissions.checkPermissions,
+    requestPermission: permissions.requestPermission,
+    checkNativePermissions: permissions.checkNativePermissions,
+    requestNativePermission: permissions.requestNativePermission,
+    environmentChanged() {
+      revision += 1;
+      surfaceRevision += 1;
+      state.busy = false;
+      backgroundPending = false;
+      state.snapshot = null;
+      permissions.clear();
+      notify();
+      if (visibility.isVisible()) void load();
+    },
     revoke,
     markup,
     afterPaint,
     setActive,
+    openManagement() {
+      state.managementOpen = true;
+      notify();
+    },
     reset,
     mount(root) {
       state.root = root;