@agentorg/computer 0.0.15 → 0.0.16

package/README.md

@@ -66,7 +66,7 @@ The file tools stay inside the workspace. That's a check, not a boundary. Below
 
 Before 0.0.14 the browser's endpoint passed on a body it couldn't read as one request, unchecked. So on a computer made with `--access none`, `read` or `files` and `--browser`, a caller holding that computer's token could run code in its browser by sending the call in a batch or behind a byte order mark. It needed the computer's own token and a client that sends such a body, which MCP clients don't. 0.0.14 fixes it; a computer in a container made by an earlier version keeps the fault until it is killed and made again.
 
-`--browser` drives the Google Chrome installed on the machine, in a profile of the computer's own. `serve --browser-name` and `--browser-path` choose another. The browser has no debug port: a small host process starts it and shares it on a Unix socket in a folder only its user can enter, which the agent's tools and the live view both use. It lives as long as its computer does: a client that ends its session or goes away leaves the browser and its pages as they are, and the agent's `browser_close` is refused. Only an agent with `--access terminal` can stop it, with `browser_run_code_unsafe` or from its terminal.
+`--browser` drives the Google Chrome installed on the machine, in a profile of the computer's own. `serve --browser-name` and `--browser-path` choose another. The browser has no debug port: a small host process starts it and shares it on a Unix socket in a folder only its user can enter, which the agent's tools and the live view both use. Playwright MCP, which serves the tools, listens on a Unix socket in a second such folder, and no port either. Only the service's user can reach them; callers go through the computer's `browser` endpoint and its token. It lives as long as its computer does: a client that ends its session or goes away leaves the browser and its pages as they are, and the agent's `browser_close` is refused. Only an agent with `--access terminal` can stop it, with `browser_run_code_unsafe` or from its terminal.
 
 ## Commands
 
@@ -214,7 +214,6 @@ A shell of your own needs [node-pty](https://github.com/microsoft/node-pty), an
 
 ## Known limits
 
-- With no isolation, each browser's Playwright MCP listens on a loopback port with no token of its own, so another user on the same machine could reach it directly. Don't run that on a machine you share.
 - A container has no CPU or memory limit, and its network is Docker's default, so it reaches the internet and anything else Docker's network does.
 - In a container the browser runs without its own sandbox, which needs privileges a computer doesn't have. The container is the boundary.
 - A browser that stops, or a container that ends by itself, shows the computer as `failed`, and what can no longer be opened live says so in `surfaces`. So does a computer that couldn't be brought back when the service started, for one in a container because Docker didn't answer; its `logs` say why. Stop the computer and start it again.

package/dist/agentcomputer.js

@@ -3804,44 +3804,73 @@ async function hostBrowser(options) {
 }
 
 // src/browser-mcp.ts
+import { mkdtempSync as mkdtempSync2, rmSync as rmSync2 } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
+import { join as join2 } from "node:path";
 var require2 = createRequire2(import.meta.url);
 var mcpParts = () => require2("playwright-core/lib/coreBundle").tools;
+function listenOnSocket(socket) {
+  const http = require2("node:http");
+  const make = http.createServer;
+  http.createServer = ((...args) => {
+    http.createServer = make;
+    const server = make(...args);
+    const listen = server.listen.bind(server);
+    server.listen = (() => listen(socket));
+    server.address = () => ({ address: "127.0.0.1", family: "IPv4", port: 0 });
+    return server;
+  });
+}
 async function serveBrowserMcp(options) {
   const parts = mcpParts();
   parts.setupExitWatchdog();
+  const folder = mkdtempSync2(join2("/tmp", "agentcomputer-"));
+  process.once("exit", () => rmSync2(folder, { recursive: true, force: true }));
+  const socket = join2(folder, "mcp.sock");
   const config3 = await parts.resolveCLIConfigForMCP({
     endpoint: options.endpoint,
     outputDir: options.outputDir,
     host: "127.0.0.1",
     port: 0,
+    // What the proxy sends, which is all that can reach the socket.
+    allowedHosts: ["localhost"],
     // The tool that closes the browser refuses, as it does for any browser its clients share.
     sharedBrowserContext: true
   });
   const tools = parts.filteredTools(config3);
-  await parts.start(
-    {
-      name: "Playwright",
-      nameInConfig: "playwright",
-      // playwright-core's, as Playwright MCP's program gives it.
-      version: require2("playwright-core/package.json").version,
-      toolSchemas: tools.map((tool) => tool.schema),
-      ignoreRoots: config3.ignoreRoots,
-      /** One for each client's session: a connection of its own to the one browser. */
-      create: async () => {
-        const browser = await playwright().chromium.connect(options.endpoint);
-        const context = browser.contexts()[0];
-        if (!context) {
-          await browser.close();
-          throw new Error("The browser has no context to work in.");
-        }
-        return new parts.BrowserBackend(config3, context, tools, {
-          dispose: () => browser.close()
-        });
-      }
-    },
-    config3.server
-  );
+  listenOnSocket(socket);
+  const say = console.error;
+  console.error = () => {
+  };
+  try {
+    await parts.start(
+      {
+        name: "Playwright",
+        nameInConfig: "playwright",
+        // playwright-core's, as Playwright MCP's program gives it.
+        version: require2("playwright-core/package.json").version,
+        toolSchemas: tools.map((tool) => tool.schema),
+        ignoreRoots: config3.ignoreRoots,
+        /** One for each client's session: a connection of its own to the one browser. */
+        create: async () => {
+          const browser = await playwright().chromium.connect(options.endpoint);
+          const context = browser.contexts()[0];
+          if (!context) {
+            await browser.close();
+            throw new Error("The browser has no context to work in.");
+          }
+          return new parts.BrowserBackend(config3, context, tools, {
+            dispose: () => browser.close()
+          });
+        }
+      },
+      config3.server
+    );
+  } finally {
+    console.error = say;
+  }
+  process.stdout.write(`${JSON.stringify({ socket })}
+`);
 }
 
 // src/container.ts
@@ -3856,7 +3885,9 @@ import { promisify as promisify2 } from "node:util";
 
 // src/browser.ts
 import { spawn } from "node:child_process";
-import { join as join2 } from "node:path";
+import { rmSync as rmSync3 } from "node:fs";
+import { request as ask } from "node:http";
+import { dirname, join as join3 } from "node:path";
 import { createInterface } from "node:readline";
 import { pipeline, Readable } from "node:stream";
 import { fileURLToPath } from "node:url";
@@ -27982,6 +28013,42 @@ function sendAnswer(upstream, response) {
   pipeline(Readable.fromWeb(upstream.body), response, () => {
   });
 }
+function socketFetch(socket) {
+  return (url3, init = {}) => new Promise((done, failed) => {
+    const { body } = init;
+    if (body != null && typeof body !== "string" && !(body instanceof Uint8Array))
+      return failed(new TypeError("A body to the browser's server is text or bytes."));
+    const { pathname, search: search2 } = new URL(url3);
+    const headers = Object.fromEntries(new Headers(init.headers));
+    if (body != null) headers["content-length"] = String(Buffer.byteLength(body));
+    const sent = ask(
+      {
+        socketPath: socket,
+        path: pathname + search2,
+        method: init.method ?? "GET",
+        headers,
+        signal: init.signal ?? void 0
+      },
+      (answer) => {
+        const answered2 = new Headers();
+        for (const [name, value] of Object.entries(answer.headers))
+          for (const one of [value ?? []].flat()) answered2.append(name, one);
+        const status = answer.statusCode ?? 502;
+        const none2 = [204, 205, 304].includes(status);
+        if (none2) answer.resume();
+        done(
+          new Response(none2 ? null : Readable.toWeb(answer), {
+            status,
+            headers: answered2
+          })
+        );
+      }
+    );
+    sent.on("error", failed);
+    sent.end(body ?? void 0);
+  });
+}
+var MCP = "http://localhost/mcp";
 var self = fileURLToPath(import.meta.url);
 function changed(text3, change) {
   const one = (json4) => {
@@ -28016,7 +28083,10 @@ async function end(child) {
 var Browser = class {
   #host;
   #mcp;
-  #origin;
+  /** Where its server answers, by way of its Unix socket. */
+  #served;
+  /** The folder its server made for its socket. */
+  #socketFolder;
   /** The bound browser's socket, for the live viewer. */
   endpoint;
   #hidden;
@@ -28038,7 +28108,7 @@ var Browser = class {
         self,
         "browser-host",
         "--profile",
-        join2(folder, "profile"),
+        join3(folder, "profile"),
         ...config3.path ? ["--executable", config3.path] : ["--channel", config3.browser ?? "chrome"],
         ...config3.sandbox === false ? ["--no-sandbox"] : []
       ],
@@ -28061,12 +28131,12 @@ var Browser = class {
     });
     this.endpoint.catch(() => {
     });
-    this.#origin = this.endpoint.then(
+    this.#served = this.endpoint.then(
       (endpoint) => new Promise((done, failed) => {
         if (this.#stopping) return failed(new Error("It stopped."));
         const mcp = spawn(
           process.execPath,
-          [self, "browser-mcp", "--endpoint", endpoint, "--output", join2(folder, "output")],
+          [self, "browser-mcp", "--endpoint", endpoint, "--output", join3(folder, "output")],
           // Its own limit on which files it touches is the folder it starts in.
           { cwd, stdio: ["ignore", "pipe", "pipe"] }
         );
@@ -28077,34 +28147,39 @@ var Browser = class {
           (code) => failed(new Error(`The browser's server exited with ${code}.`))
         );
         mcp.once("exit", ended("The browser's server"));
-        for (const stream of [mcp.stdout, mcp.stderr])
-          createInterface({ input: stream }).on("line", (line) => {
+        createInterface({ input: mcp.stdout }).on("line", (line) => {
+          try {
+            const { socket } = JSON.parse(line);
+            log(`The browser's server is on ${socket}.`);
+            this.#socketFolder = dirname(socket);
+            done(socketFetch(socket));
+          } catch {
             log(line);
-            const listening = /^Listening on (http:\/\/[^/\s]+)/.exec(line);
-            if (listening) done(listening[1]);
-          });
+          }
+        });
+        createInterface({ input: mcp.stderr }).on("line", log);
       })
     );
-    this.#origin.catch(() => {
+    this.#served.catch(() => {
     });
   }
   /** Wait until it answers, and read its tools. */
   async ready() {
-    const origin = await Promise.race([
-      this.#origin,
+    const served = await Promise.race([
+      this.#served,
       new Promise(
         (_, failed) => setTimeout(() => failed(new Error("The browser's server didn't start.")), START_MS)
       )
     ]);
     const client = new Client({ name: "agentcomputer", version: "0" });
-    await client.connect(new StreamableHTTPClientTransport(new URL(`${origin}/mcp`)));
+    await client.connect(new StreamableHTTPClientTransport(new URL(MCP), { fetch: served }));
     const { tools } = await client.listTools();
     await client.close();
     this.tools = tools.map((tool) => tool.name).filter((name) => !this.#hidden.has(name));
   }
   /** Answer one MCP request by passing it on, enforcing what this computer may not do. */
   async handle(request, response) {
-    const origin = await this.#origin;
+    const served = await this.#served;
     const chunks = [];
     let size = 0;
     for await (const chunk of request) {
@@ -28148,7 +28223,7 @@ var Browser = class {
     const session = headers["mcp-session-id"] ?? "";
     if (request.method === "DELETE") this.gate?.sessionEnded(session);
     if (tool && this.gate?.takeAnsweredChooser(session) && tool !== "browser_file_upload")
-      await fetch(`${origin}/mcp`, {
+      await served(MCP, {
         method: "POST",
         headers,
         body: JSON.stringify({
@@ -28161,7 +28236,7 @@ var Browser = class {
       });
     if (tool === "browser_file_upload") this.gate?.agentAnsweredChooser();
     if (message) headers["content-type"] = "application/json";
-    const upstream = await fetch(`${origin}/mcp`, {
+    const upstream = await served(MCP, {
       method: request.method,
       headers,
       ...message ? { body: JSON.stringify(message) } : {}
@@ -28176,6 +28251,7 @@ var Browser = class {
   async stop() {
     this.#stopping = true;
     await Promise.all([this.#mcp, this.#host].map((child) => child ? end(child) : void 0));
+    if (this.#socketFolder) rmSync3(this.#socketFolder, { recursive: true, force: true });
   }
 };
 
@@ -28188,7 +28264,7 @@ import { join as join7 } from "node:path";
 import { chmodSync as chmodSync2, existsSync, statSync as statSync2 } from "node:fs";
 import { createRequire as createRequire3 } from "node:module";
 import { hostname as hostname3 } from "node:os";
-import { basename as basename2, dirname as dirname3, join as join6 } from "node:path";
+import { basename as basename2, dirname as dirname4, join as join6 } from "node:path";
 
 // node_modules/@agentorg/exec/dist/lib.js
 import { realpathSync } from "node:fs";
@@ -28198,7 +28274,7 @@ import { Http2ServerRequest, constants } from "node:http2";
 import { Readable as Readable2 } from "node:stream";
 import { randomBytes as randomBytes3 } from "node:crypto";
 import { lstat as lstat2, open as open3, readdir as readdir2, rename as rename2, rm as rm2, stat as stat2 } from "node:fs/promises";
-import { dirname as dirname2, join as join3 } from "node:path";
+import { dirname as dirname2, join as join32 } from "node:path";
 import { randomBytes as randomBytes2 } from "node:crypto";
 import {
   chmod,
@@ -28212,7 +28288,7 @@ import {
   stat,
   writeFile
 } from "node:fs/promises";
-import { basename, dirname, join as join4, resolve, sep as sep2 } from "node:path";
+import { basename, dirname as dirname3, join as join4, resolve, sep as sep2 } from "node:path";
 import { spawn as spawn2 } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import { StringDecoder } from "node:string_decoder";
@@ -66245,7 +66321,7 @@ async function inside(root, path) {
         () => false
       ))
         throw refused2();
-      const above = dirname(at);
+      const above = dirname3(at);
       if (above === at) throw refused2();
       return join4(await real(above), basename(at));
     }
@@ -66333,7 +66409,7 @@ ${cut(shown.join("\n"), MAX_READ_CHARS)}`;
         after = before.split(input2.old_text).join(input2.new_text);
       }
       if (after === before) throw new ExecRefused("That edit changes nothing.");
-      const temporary = join4(dirname(path), `.agentexec-${randomBytes2(6).toString("hex")}`);
+      const temporary = join4(dirname3(path), `.agentexec-${randomBytes2(6).toString("hex")}`);
       try {
         await writeFile(temporary, after, found ? { mode: found.mode } : {});
         if (found) await chmod(temporary, found.mode & 511);
@@ -66472,7 +66548,7 @@ function createHostFiles(root, level) {
       found.sort(foldersFirst);
       const entries = await Promise.all(
         found.slice(0, MAX_ENTRIES).map(async (entry) => {
-          const own22 = await lstat2(join3(folder, entry.name)).catch(() => void 0);
+          const own22 = await lstat2(join32(folder, entry.name)).catch(() => void 0);
           return own22 && {
             name: entry.name,
             kind: entry.isDirectory() ? "folder" : entry.isSymbolicLink() ? "link" : "file",
@@ -66519,7 +66595,7 @@ function createHostFiles(root, level) {
       });
       if (before?.isDirectory()) throw new ExecRefused(`${path} is a folder.`);
       await stat2(dirname2(target));
-      const temporary = join3(dirname2(target), `.agentexec-${randomBytes3(6).toString("hex")}`);
+      const temporary = join32(dirname2(target), `.agentexec-${randomBytes3(6).toString("hex")}`);
       const file2 = await open3(temporary, "wx");
       const discard = async () => {
         await file2.close().catch(() => {
@@ -67773,7 +67849,7 @@ var loadPty = () => {
     } catch {
       return fails("node-pty isn't installed with this service.");
     }
-    const root = dirname3(require3.resolve("node-pty/package.json"));
+    const root = dirname4(require3.resolve("node-pty/package.json"));
     for (const helper of [
       join6(root, "prebuilds", `${process.platform}-${process.arch}`, "spawn-helper"),
       join6(root, "build", "Release", "spawn-helper")
@@ -68203,7 +68279,7 @@ async function forward(url3, authorization, request, response) {
 }
 
 // src/handlers.ts
-var VERSION2 = "0.0.15";
+var VERSION2 = "0.0.16";
 function createHandlers(computers) {
   return {
     getInfo: async () => ({
@@ -69101,7 +69177,7 @@ var Computer = class _Computer {
 };
 
 // src/service.ts
-import { readFileSync as readFileSync6, rmSync as rmSync3 } from "node:fs";
+import { readFileSync as readFileSync6, rmSync as rmSync5 } from "node:fs";
 import {
   createServer as createServer5,
   STATUS_CODES as STATUS_CODES3
@@ -84921,7 +84997,7 @@ var NodeStreamableHTTPServerTransport2 = class {
 
 // src/computers.ts
 import { randomBytes as randomBytes5 } from "node:crypto";
-import { appendFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync5, rmSync as rmSync2, statSync as statSync4 } from "node:fs";
+import { appendFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync5, rmSync as rmSync4, statSync as statSync4 } from "node:fs";
 import { isAbsolute, join as join10, resolve as resolve4 } from "node:path";
 var READ = ["about", "read", "list", "search"];
 var FILES = [...READ, "edit"];
@@ -85026,7 +85102,7 @@ var Computers = class {
       this.#stored.delete(id);
       await this.#runtimes[stored.isolation].remove(id).catch(() => {
       });
-      rmSync2(this.#folder(id), { recursive: true, force: true });
+      rmSync4(this.#folder(id), { recursive: true, force: true });
       throw refusalOf(error62);
     }
     this.#save();
@@ -85100,7 +85176,7 @@ var Computers = class {
     }
     this.#stored.delete(id);
     this.#save();
-    rmSync2(this.#folder(id), { recursive: true, force: true });
+    rmSync4(this.#folder(id), { recursive: true, force: true });
   }
   logs(id) {
     this.#found(id);
@@ -85271,7 +85347,7 @@ var OPENAPI = {
   "openapi": "3.1.0",
   "info": {
     "title": "AgentComputer",
-    "version": "0.0.15",
+    "version": "0.0.16",
     "description": "Computers for agents. This file is the source of truth: the HTTP API, the MCP control tools and the SDK are all generated from it. An operation with `x-mcp-tool` is also an MCP tool of that name.",
     "license": {
       "name": "Apache-2.0",
@@ -88415,7 +88491,7 @@ ${JSON.stringify({ code: status, message })}
   const scheme = options.tls ? "https" : "http";
   base = options.publicUrl?.replace(/\/+$/, "") ?? `${scheme}://${bound.family === "IPv6" ? `[${bound.address}]` : bound.address}:${bound.port}`;
   const record3 = recordOf(data);
-  rmSync3(record3, { force: true });
+  rmSync5(record3, { force: true });
   await computers.resume();
   writePrivate(
     record3,
@@ -88431,7 +88507,7 @@ ${JSON.stringify({ code: status, message })}
       process.stderr.write(`${String(error62)}
 `);
     });
-    rmSync3(record3, { force: true });
+    rmSync5(record3, { force: true });
     process.exit(0);
   };
   for (const signal of ["SIGINT", "SIGTERM"]) process.once(signal, () => void stop());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentorg/computer",
-  "version": "0.0.15",
+  "version": "0.0.16",
   "description": "Computers for agents, as a service: a terminal, files and a browser over MCP",
   "license": "Apache-2.0",
   "repository": {