@agentorg/computer 0.0.15 → 0.0.17

package/README.md

@@ -28,10 +28,12 @@ Isolation is chosen for each computer when it is made, and it keeps it until it
 A computer in a container:
 
 - Its image holds AgentExec, Playwright MCP and a headless Chromium. It is `ghcr.io/uniac-ai/agentcomputer/computer` at the service's version; `--image` names another.
-- `--workspace` is mounted at `/workspace`, read-only at `--access read`, and nothing else of the machine is visible. The computer is told that folder's path on the machine and the machine's name, which `about` answers. Docker has to be able to share that folder. Without `--workspace`, the service makes one.
+- `--workspace` is mounted at `/workspace`, read-only at `--access read`, and nothing else of the machine is visible. The computer is told that folder's path on the machine and the machine's name, which `about` answers. Docker has to be able to share that folder, and the data folder, where its home is. Without `--workspace`, the service makes one.
 - The image is fetched the first time it is needed, which can take minutes: when the service starts if its own isolation is `container`, and otherwise when the first computer in a container is made, a call that then waits for it. `docker pull` it beforehand to spare that wait.
 - It runs as the user who started the service, with no capabilities.
-- `stop` stops the container and keeps it, so what was installed in it is there at `start`. `kill` removes it. Starting a stopped computer uses the image it was made from.
+- Its home, `/home/computer`, is a folder of the machine's, in the computer's own folder in the data folder, mounted as the workspace is. What the agent keeps there stays, the browser's profile with its sign-ins among it. `stop` stops the container and keeps it, and `kill` removes it with the computer's folder.
+- **After an update,** a computer in a container is made again at its first start under a new version of the service, or under another `--image`: its container is removed and made again from the service's image. It keeps its workspace, its home, and its id, token, endpoints and settings. It loses its running commands, as at any restart, and everything else in the container: software installed there, and files outside `/workspace` and `/home/computer`, such as `/tmp`. Keep what must last in those two folders, or in an image of your own. Every computer's answer says the `version` of the program it runs.
+- A container made before 0.0.17 keeps its home inside it. At its first remake the home is copied out. If that fails, the container is kept and started as it was, its `logs` say why, and the copy is tried again at its next start. Until it is made again, its `version` is `null`.
 
 ## Access
 
@@ -42,7 +44,7 @@ A computer in a container:
 | `terminal` | Those, and `exec_command`, `write_stdin`, `list_sessions` |
 | `none`     | No `computer` endpoint; needs `--browser`                 |
 
-`read` answers a text file as numbered lines, and a PNG, JPEG, GIF or WebP of up to 3 MiB as the picture itself: an image an MCP client can pass on to a model. The browser's `browser_take_screenshot` answers an image too, but not one of more than 3 MiB, which a `fullPage` screenshot of a long page can be many times over: it answers an error that gives the size and says to take it again without `fullPage`, or of one element. The most counts bytes only: a model may still refuse a smaller picture for its height or width. A container made by an earlier version keeps the program it was made with: it refuses a picture as a binary file, and passes on a screenshot of any size, until it is killed and made again.
+`read` answers a text file as numbered lines, and a PNG, JPEG, GIF or WebP of up to 3 MiB as the picture itself: an image an MCP client can pass on to a model. The browser's `browser_take_screenshot` answers an image too, but not one of more than 3 MiB, which a `fullPage` screenshot of a long page can be many times over: it answers an error that gives the size and says to take it again without `fullPage`, or of one element. The most counts bytes only: a model may still refuse a smaller picture for its height or width.
 
 `about` tells the agent what a person looking at the computer reads. It takes nothing and answers JSON text, `{"rows": [...]}`, each row a `label` and a `value`, with `"path": true` on a value that is a path and `"caution": true` on one to be read as a caution; a row that is neither has neither. The rows come in this order:
 
@@ -58,15 +60,15 @@ A computer in a container:
 
 - **In a container** the agent's commands find the folder somewhere else, so `Folder` says both and is not marked as a path: `/home/me/Research on the machine, mounted at /workspace in it`. CPU and Memory there are the computer's own; with no isolation they are the whole machine's.
 - **The last three** are a reading of its load taken over half a second when it is asked, in the same way the `load` surface reads. They come together, or not at all where a reading can't be taken.
-- **Not every computer has it.** One with no `computer` endpoint has no `about`. One in a container made by an earlier version keeps the program it was made with: `about` is listed among its tools and isn't there until it is killed and made again.
+- **Not every computer has it.** One with no `computer` endpoint has no `about`.
 
-A client that calls a computer's tools can put the commands it starts in a group, and stop them together. At `--access terminal` it sends a word as `agentexec/group` in the `_meta` of an `exec_command` call, and the request `agentexec/group/stop` with `{"group": "<word>"}` on the `computer` endpoint, which ends every running command of that group and answers `{"stopped": <how many>}`. Giving up a call does not stop its command; only that request does. A shell a person opened is in no group. This is AgentExec's, described in [its README](https://github.com/uniac-ai/AgentExec#sessions), and the service passes both through, with no isolation and in a container. A container made by an earlier version has neither until it is killed and made again.
+A client that calls a computer's tools can put the commands it starts in a group, and stop them together. At `--access terminal` it sends a word as `agentexec/group` in the `_meta` of an `exec_command` call, and the request `agentexec/group/stop` with `{"group": "<word>"}` on the `computer` endpoint, which ends every running command of that group and answers `{"stopped": <how many>}`. Giving up a call does not stop its command; only that request does. A shell a person opened is in no group. This is AgentExec's, described in [its README](https://github.com/uniac-ai/AgentExec#sessions), and the service passes both through, with no isolation and in a container.
 
 The file tools stay inside the workspace. That's a check, not a boundary. Below `terminal`, the browser's `browser_run_code_unsafe` tool is hidden and refused, because it would otherwise be a terminal. The browser's endpoint takes one JSON-RPC request in each POST, as a JSON object, and refuses anything else with 400, a batch among them: it checks each request before passing it on, and passes on only what it read. The service enforces all of this, whatever the client does.
 
-Before 0.0.14 the browser's endpoint passed on a body it couldn't read as one request, unchecked. So on a computer made with `--access none`, `read` or `files` and `--browser`, a caller holding that computer's token could run code in its browser by sending the call in a batch or behind a byte order mark. It needed the computer's own token and a client that sends such a body, which MCP clients don't. 0.0.14 fixes it; a computer in a container made by an earlier version keeps the fault until it is killed and made again.
+Before 0.0.14 the browser's endpoint passed on a body it couldn't read as one request, unchecked. So on a computer made with `--access none`, `read` or `files` and `--browser`, a caller holding that computer's token could run code in its browser by sending the call in a batch or behind a byte order mark. It needed the computer's own token and a client that sends such a body, which MCP clients don't. 0.0.14 fixes it; a computer in a container made by an earlier version keeps the fault until its container is made again.
 
-`--browser` drives the Google Chrome installed on the machine, in a profile of the computer's own. `serve --browser-name` and `--browser-path` choose another. The browser has no debug port: a small host process starts it and shares it on a Unix socket in a folder only its user can enter, which the agent's tools and the live view both use. It lives as long as its computer does: a client that ends its session or goes away leaves the browser and its pages as they are, and the agent's `browser_close` is refused. Only an agent with `--access terminal` can stop it, with `browser_run_code_unsafe` or from its terminal.
+`--browser` drives the Google Chrome installed on the machine, in a profile of the computer's own. `serve --browser-name` and `--browser-path` choose another. The browser has no debug port: a small host process starts it and shares it on a Unix socket in a folder only its user can enter, which the agent's tools and the live view both use. Playwright MCP, which serves the tools, listens on a Unix socket in a second such folder, and no port either. Only the service's user can reach them; callers go through the computer's `browser` endpoint and its token. It lives as long as its computer does: a client that ends its session or goes away leaves the browser and its pages as they are, and the agent's `browser_close` is refused. Only an agent with `--access terminal` can stop it, with `browser_run_code_unsafe` or from its terminal.
 
 ## Commands
 
@@ -214,7 +216,6 @@ A shell of your own needs [node-pty](https://github.com/microsoft/node-pty), an
 
 ## Known limits
 
-- With no isolation, each browser's Playwright MCP listens on a loopback port with no token of its own, so another user on the same machine could reach it directly. Don't run that on a machine you share.
 - A container has no CPU or memory limit, and its network is Docker's default, so it reaches the internet and anything else Docker's network does.
 - In a container the browser runs without its own sandbox, which needs privileges a computer doesn't have. The container is the boundary.
 - A browser that stops, or a container that ends by itself, shows the computer as `failed`, and what can no longer be opened live says so in `surfaces`. So does a computer that couldn't be brought back when the service started, for one in a container because Docker didn't answer; its `logs` say why. Stop the computer and start it again.

package/dist/agentcomputer.js

@@ -3804,49 +3804,78 @@ async function hostBrowser(options) {
 }
 
 // src/browser-mcp.ts
+import { mkdtempSync as mkdtempSync2, rmSync as rmSync2 } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
+import { join as join2 } from "node:path";
 var require2 = createRequire2(import.meta.url);
 var mcpParts = () => require2("playwright-core/lib/coreBundle").tools;
+function listenOnSocket(socket) {
+  const http = require2("node:http");
+  const make = http.createServer;
+  http.createServer = ((...args) => {
+    http.createServer = make;
+    const server = make(...args);
+    const listen = server.listen.bind(server);
+    server.listen = (() => listen(socket));
+    server.address = () => ({ address: "127.0.0.1", family: "IPv4", port: 0 });
+    return server;
+  });
+}
 async function serveBrowserMcp(options) {
   const parts = mcpParts();
   parts.setupExitWatchdog();
+  const folder = mkdtempSync2(join2("/tmp", "agentcomputer-"));
+  process.once("exit", () => rmSync2(folder, { recursive: true, force: true }));
+  const socket = join2(folder, "mcp.sock");
   const config3 = await parts.resolveCLIConfigForMCP({
     endpoint: options.endpoint,
     outputDir: options.outputDir,
     host: "127.0.0.1",
     port: 0,
+    // What the proxy sends, which is all that can reach the socket.
+    allowedHosts: ["localhost"],
     // The tool that closes the browser refuses, as it does for any browser its clients share.
     sharedBrowserContext: true
   });
   const tools = parts.filteredTools(config3);
-  await parts.start(
-    {
-      name: "Playwright",
-      nameInConfig: "playwright",
-      // playwright-core's, as Playwright MCP's program gives it.
-      version: require2("playwright-core/package.json").version,
-      toolSchemas: tools.map((tool) => tool.schema),
-      ignoreRoots: config3.ignoreRoots,
-      /** One for each client's session: a connection of its own to the one browser. */
-      create: async () => {
-        const browser = await playwright().chromium.connect(options.endpoint);
-        const context = browser.contexts()[0];
-        if (!context) {
-          await browser.close();
-          throw new Error("The browser has no context to work in.");
-        }
-        return new parts.BrowserBackend(config3, context, tools, {
-          dispose: () => browser.close()
-        });
-      }
-    },
-    config3.server
-  );
+  listenOnSocket(socket);
+  const say = console.error;
+  console.error = () => {
+  };
+  try {
+    await parts.start(
+      {
+        name: "Playwright",
+        nameInConfig: "playwright",
+        // playwright-core's, as Playwright MCP's program gives it.
+        version: require2("playwright-core/package.json").version,
+        toolSchemas: tools.map((tool) => tool.schema),
+        ignoreRoots: config3.ignoreRoots,
+        /** One for each client's session: a connection of its own to the one browser. */
+        create: async () => {
+          const browser = await playwright().chromium.connect(options.endpoint);
+          const context = browser.contexts()[0];
+          if (!context) {
+            await browser.close();
+            throw new Error("The browser has no context to work in.");
+          }
+          return new parts.BrowserBackend(config3, context, tools, {
+            dispose: () => browser.close()
+          });
+        }
+      },
+      config3.server
+    );
+  } finally {
+    console.error = say;
+  }
+  process.stdout.write(`${JSON.stringify({ socket })}
+`);
 }
 
 // src/container.ts
 import { execFile as execFile2, spawn as spawn3 } from "node:child_process";
-import { readFileSync as readFileSync3 } from "node:fs";
+import { chmodSync as chmodSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, renameSync as renameSync2, rmSync as rmSync4 } from "node:fs";
 import { connect } from "node:net";
 import { hostname as hostname4 } from "node:os";
 import { join as join8 } from "node:path";
@@ -3856,7 +3885,9 @@ import { promisify as promisify2 } from "node:util";
 
 // src/browser.ts
 import { spawn } from "node:child_process";
-import { join as join2 } from "node:path";
+import { rmSync as rmSync3 } from "node:fs";
+import { request as ask } from "node:http";
+import { dirname, join as join3 } from "node:path";
 import { createInterface } from "node:readline";
 import { pipeline, Readable } from "node:stream";
 import { fileURLToPath } from "node:url";
@@ -27982,6 +28013,42 @@ function sendAnswer(upstream, response) {
   pipeline(Readable.fromWeb(upstream.body), response, () => {
   });
 }
+function socketFetch(socket) {
+  return (url3, init = {}) => new Promise((done, failed) => {
+    const { body } = init;
+    if (body != null && typeof body !== "string" && !(body instanceof Uint8Array))
+      return failed(new TypeError("A body to the browser's server is text or bytes."));
+    const { pathname, search: search2 } = new URL(url3);
+    const headers = Object.fromEntries(new Headers(init.headers));
+    if (body != null) headers["content-length"] = String(Buffer.byteLength(body));
+    const sent = ask(
+      {
+        socketPath: socket,
+        path: pathname + search2,
+        method: init.method ?? "GET",
+        headers,
+        signal: init.signal ?? void 0
+      },
+      (answer) => {
+        const answered2 = new Headers();
+        for (const [name, value] of Object.entries(answer.headers))
+          for (const one of [value ?? []].flat()) answered2.append(name, one);
+        const status = answer.statusCode ?? 502;
+        const none2 = [204, 205, 304].includes(status);
+        if (none2) answer.resume();
+        done(
+          new Response(none2 ? null : Readable.toWeb(answer), {
+            status,
+            headers: answered2
+          })
+        );
+      }
+    );
+    sent.on("error", failed);
+    sent.end(body ?? void 0);
+  });
+}
+var MCP = "http://localhost/mcp";
 var self = fileURLToPath(import.meta.url);
 function changed(text3, change) {
   const one = (json4) => {
@@ -28016,7 +28083,10 @@ async function end(child) {
 var Browser = class {
   #host;
   #mcp;
-  #origin;
+  /** Where its server answers, by way of its Unix socket. */
+  #served;
+  /** The folder its server made for its socket. */
+  #socketFolder;
   /** The bound browser's socket, for the live viewer. */
   endpoint;
   #hidden;
@@ -28038,7 +28108,7 @@ var Browser = class {
         self,
         "browser-host",
         "--profile",
-        join2(folder, "profile"),
+        join3(folder, "profile"),
         ...config3.path ? ["--executable", config3.path] : ["--channel", config3.browser ?? "chrome"],
         ...config3.sandbox === false ? ["--no-sandbox"] : []
       ],
@@ -28061,12 +28131,12 @@ var Browser = class {
     });
     this.endpoint.catch(() => {
     });
-    this.#origin = this.endpoint.then(
+    this.#served = this.endpoint.then(
       (endpoint) => new Promise((done, failed) => {
         if (this.#stopping) return failed(new Error("It stopped."));
         const mcp = spawn(
           process.execPath,
-          [self, "browser-mcp", "--endpoint", endpoint, "--output", join2(folder, "output")],
+          [self, "browser-mcp", "--endpoint", endpoint, "--output", join3(folder, "output")],
           // Its own limit on which files it touches is the folder it starts in.
           { cwd, stdio: ["ignore", "pipe", "pipe"] }
         );
@@ -28077,34 +28147,39 @@ var Browser = class {
           (code) => failed(new Error(`The browser's server exited with ${code}.`))
         );
         mcp.once("exit", ended("The browser's server"));
-        for (const stream of [mcp.stdout, mcp.stderr])
-          createInterface({ input: stream }).on("line", (line) => {
+        createInterface({ input: mcp.stdout }).on("line", (line) => {
+          try {
+            const { socket } = JSON.parse(line);
+            log(`The browser's server is on ${socket}.`);
+            this.#socketFolder = dirname(socket);
+            done(socketFetch(socket));
+          } catch {
             log(line);
-            const listening = /^Listening on (http:\/\/[^/\s]+)/.exec(line);
-            if (listening) done(listening[1]);
-          });
+          }
+        });
+        createInterface({ input: mcp.stderr }).on("line", log);
       })
     );
-    this.#origin.catch(() => {
+    this.#served.catch(() => {
     });
   }
   /** Wait until it answers, and read its tools. */
   async ready() {
-    const origin = await Promise.race([
-      this.#origin,
+    const served = await Promise.race([
+      this.#served,
       new Promise(
         (_, failed) => setTimeout(() => failed(new Error("The browser's server didn't start.")), START_MS)
       )
     ]);
     const client = new Client({ name: "agentcomputer", version: "0" });
-    await client.connect(new StreamableHTTPClientTransport(new URL(`${origin}/mcp`)));
+    await client.connect(new StreamableHTTPClientTransport(new URL(MCP), { fetch: served }));
     const { tools } = await client.listTools();
     await client.close();
     this.tools = tools.map((tool) => tool.name).filter((name) => !this.#hidden.has(name));
   }
   /** Answer one MCP request by passing it on, enforcing what this computer may not do. */
   async handle(request, response) {
-    const origin = await this.#origin;
+    const served = await this.#served;
     const chunks = [];
     let size = 0;
     for await (const chunk of request) {
@@ -28148,7 +28223,7 @@ var Browser = class {
     const session = headers["mcp-session-id"] ?? "";
     if (request.method === "DELETE") this.gate?.sessionEnded(session);
     if (tool && this.gate?.takeAnsweredChooser(session) && tool !== "browser_file_upload")
-      await fetch(`${origin}/mcp`, {
+      await served(MCP, {
         method: "POST",
         headers,
         body: JSON.stringify({
@@ -28161,7 +28236,7 @@ var Browser = class {
       });
     if (tool === "browser_file_upload") this.gate?.agentAnsweredChooser();
     if (message) headers["content-type"] = "application/json";
-    const upstream = await fetch(`${origin}/mcp`, {
+    const upstream = await served(MCP, {
       method: request.method,
       headers,
       ...message ? { body: JSON.stringify(message) } : {}
@@ -28176,6 +28251,7 @@ var Browser = class {
   async stop() {
     this.#stopping = true;
     await Promise.all([this.#mcp, this.#host].map((child) => child ? end(child) : void 0));
+    if (this.#socketFolder) rmSync3(this.#socketFolder, { recursive: true, force: true });
   }
 };
 
@@ -28188,7 +28264,7 @@ import { join as join7 } from "node:path";
 import { chmodSync as chmodSync2, existsSync, statSync as statSync2 } from "node:fs";
 import { createRequire as createRequire3 } from "node:module";
 import { hostname as hostname3 } from "node:os";
-import { basename as basename2, dirname as dirname3, join as join6 } from "node:path";
+import { basename as basename2, dirname as dirname4, join as join6 } from "node:path";
 
 // node_modules/@agentorg/exec/dist/lib.js
 import { realpathSync } from "node:fs";
@@ -28198,7 +28274,7 @@ import { Http2ServerRequest, constants } from "node:http2";
 import { Readable as Readable2 } from "node:stream";
 import { randomBytes as randomBytes3 } from "node:crypto";
 import { lstat as lstat2, open as open3, readdir as readdir2, rename as rename2, rm as rm2, stat as stat2 } from "node:fs/promises";
-import { dirname as dirname2, join as join3 } from "node:path";
+import { dirname as dirname2, join as join32 } from "node:path";
 import { randomBytes as randomBytes2 } from "node:crypto";
 import {
   chmod,
@@ -28212,7 +28288,7 @@ import {
   stat,
   writeFile
 } from "node:fs/promises";
-import { basename, dirname, join as join4, resolve, sep as sep2 } from "node:path";
+import { basename, dirname as dirname3, join as join4, resolve, sep as sep2 } from "node:path";
 import { spawn as spawn2 } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import { StringDecoder } from "node:string_decoder";
@@ -66245,7 +66321,7 @@ async function inside(root, path) {
         () => false
       ))
         throw refused2();
-      const above = dirname(at);
+      const above = dirname3(at);
       if (above === at) throw refused2();
       return join4(await real(above), basename(at));
     }
@@ -66333,7 +66409,7 @@ ${cut(shown.join("\n"), MAX_READ_CHARS)}`;
         after = before.split(input2.old_text).join(input2.new_text);
       }
       if (after === before) throw new ExecRefused("That edit changes nothing.");
-      const temporary = join4(dirname(path), `.agentexec-${randomBytes2(6).toString("hex")}`);
+      const temporary = join4(dirname3(path), `.agentexec-${randomBytes2(6).toString("hex")}`);
       try {
         await writeFile(temporary, after, found ? { mode: found.mode } : {});
         if (found) await chmod(temporary, found.mode & 511);
@@ -66472,7 +66548,7 @@ function createHostFiles(root, level) {
       found.sort(foldersFirst);
       const entries = await Promise.all(
         found.slice(0, MAX_ENTRIES).map(async (entry) => {
-          const own22 = await lstat2(join3(folder, entry.name)).catch(() => void 0);
+          const own22 = await lstat2(join32(folder, entry.name)).catch(() => void 0);
           return own22 && {
             name: entry.name,
             kind: entry.isDirectory() ? "folder" : entry.isSymbolicLink() ? "link" : "file",
@@ -66519,7 +66595,7 @@ function createHostFiles(root, level) {
       });
       if (before?.isDirectory()) throw new ExecRefused(`${path} is a folder.`);
       await stat2(dirname2(target));
-      const temporary = join3(dirname2(target), `.agentexec-${randomBytes3(6).toString("hex")}`);
+      const temporary = join32(dirname2(target), `.agentexec-${randomBytes3(6).toString("hex")}`);
       const file2 = await open3(temporary, "wx");
       const discard = async () => {
         await file2.close().catch(() => {
@@ -67773,7 +67849,7 @@ var loadPty = () => {
     } catch {
       return fails("node-pty isn't installed with this service.");
     }
-    const root = dirname3(require3.resolve("node-pty/package.json"));
+    const root = dirname4(require3.resolve("node-pty/package.json"));
     for (const helper of [
       join6(root, "prebuilds", `${process.platform}-${process.arch}`, "spawn-helper"),
       join6(root, "build", "Release", "spawn-helper")
@@ -67881,6 +67957,33 @@ var ProcessRuntime = class {
   }
 };
 
+// src/handlers.ts
+var VERSION2 = "0.0.17";
+function createHandlers(computers) {
+  return {
+    getInfo: async () => ({
+      version: VERSION2,
+      isolation: computers.isolation,
+      isolationsAvailable: await computers.available()
+    }),
+    listComputers: async ({ state }) => computers.list(state),
+    createComputer: (input2) => computers.create(input2),
+    getComputer: async ({ computerID }) => computers.get(computerID),
+    killComputer: async ({ computerID }) => {
+      await computers.kill(computerID);
+      return void 0;
+    },
+    setComputerTimeout: async ({ computerID, timeout }) => computers.setTimeout(computerID, timeout),
+    stopComputer: ({ computerID }) => computers.stop(computerID),
+    startComputer: ({ computerID, timeout }) => computers.start(computerID, timeout),
+    getComputerLogs: async ({ computerID }) => ({ logs: computers.logs(computerID) }),
+    createLiveSession: async ({ computerID, surface, mode }) => computers.liveSession(computerID, surface, mode ?? "watch"),
+    openLiveSession: async () => {
+      throw new ApiError(426, "Open it as a WebSocket.");
+    }
+  };
+}
+
 // src/inside.ts
 var INNER_PORT = 8e3;
 var INNER_TOKEN_VARIABLE = "AGENTCOMPUTER_INNER_TOKEN";
@@ -67921,7 +68024,7 @@ async function serveInside(options) {
     if (pathname === "/ready") {
       const { browserTools, surfaces } = await running2;
       response.writeHead(200, { "Content-Type": "application/json" });
-      return void response.end(JSON.stringify({ browserTools, surfaces }));
+      return void response.end(JSON.stringify({ browserTools, surfaces, version: VERSION2 }));
     }
     const endpoint = /^\/mcp\/(computer|browser)$/.exec(pathname)?.[1];
     if (!endpoint) return void response.writeHead(404).end();
@@ -67980,10 +68083,15 @@ var UPGRADE_HEADERS = [
   "sec-websocket-extensions",
   "sec-websocket-protocol"
 ];
+var messageOf = (error62) => error62 instanceof Error ? error62.message : String(error62);
 var nameOf = (id) => `agentcomputer-${id}`;
+var HOME = "/home/computer";
+var homeOf = (folder) => join8(folder, "home");
 var sleep5 = (ms) => new Promise((done) => setTimeout(done, ms));
 var ContainerRuntime = class {
   #image;
+  /** The id of that image, as it is now on this machine. */
+  #imageId;
   constructor(image) {
     this.#image = image;
   }
@@ -68007,12 +68115,14 @@ var ContainerRuntime = class {
   }
   async prepare() {
     await this.#docker();
+    const id = () => docker(["image", "inspect", "--format", "{{.Id}}", this.#image]);
     try {
-      await docker(["image", "inspect", "--format", "{{.Id}}", this.#image]);
+      this.#imageId = await id();
     } catch {
       process.stdout.write(`Pulling ${this.#image}
 `);
       await docker(["pull", this.#image]);
+      this.#imageId = await id();
     }
   }
   async #inspect(name) {
@@ -68022,7 +68132,39 @@ var ContainerRuntime = class {
       return void 0;
     }
   }
-  async #create(name, spec, token) {
+  /**
+   * Remove a container made from another image, for it to be made again. What it keeps is outside
+   * it: its workspace, and its home. One made before its home was outside has its home copied out
+   * first, and if that can't be done it is kept as it is, to try again at its next start.
+   */
+  async #remake(name, made, folder, events) {
+    if (!made.Mounts.some((mount) => mount.Destination === HOME)) {
+      const home = homeOf(folder);
+      const copying = `${home}.copying`;
+      rmSync4(copying, { recursive: true, force: true });
+      try {
+        const owners = process.getuid?.() ? [] : ["--archive"];
+        await docker(["cp", ...owners, `${name}:${HOME}`, copying]);
+        rmSync4(home, { recursive: true, force: true });
+        renameSync2(copying, home);
+      } catch (error62) {
+        rmSync4(copying, { recursive: true, force: true });
+        events.log(
+          `Its home couldn't be copied out of its container (${messageOf(error62)}), so the container is kept and started as it was made. The copy is tried again at its next start.`
+        );
+        return;
+      }
+      events.log("Its home was copied out of its container, to keep.");
+    }
+    await docker(["rm", "--force", name]);
+    events.log(
+      `Its container was made from another image, so it is made again from ${this.#image}.`
+    );
+  }
+  async #create(name, spec, token, folder) {
+    const home = homeOf(folder);
+    mkdirSync2(home, { recursive: true });
+    chmodSync3(home, 1023);
     const uid = process.getuid?.();
     const told = {
       [INNER_TOKEN_VARIABLE]: token,
@@ -68046,6 +68188,8 @@ var ContainerRuntime = class {
         ...Object.keys(told).flatMap((name2) => ["--env", name2]),
         // Files it writes in the workspace belong to whoever runs the service.
         ...uid ? ["--user", `${uid}:${process.getgid?.()}`] : [],
+        "--mount",
+        `type=bind,source=${home},target=${HOME}`,
         ...spec.workspace ? [
           "--mount",
           `type=bind,source=${spec.workspace},target=/workspace${spec.access === "read" ? ",readonly" : ""}`
@@ -68073,7 +68217,10 @@ var ContainerRuntime = class {
   async start(spec, folder, events) {
     const name = nameOf(spec.id);
     const token = this.#tokenIn(folder);
-    if (!await this.#inspect(name)) await this.#create(name, spec, token);
+    const made = await this.#inspect(name);
+    if (made && this.#imageId && made.Image !== this.#imageId)
+      await this.#remake(name, made, folder, events);
+    if (!await this.#inspect(name)) await this.#create(name, spec, token, folder);
     await docker(["start", name]);
     const inspected = await this.#inspect(name);
     const port = inspected?.NetworkSettings.Ports[`${INNER_PORT}/tcp`]?.[0]?.HostPort;
@@ -68110,6 +68257,7 @@ var ContainerRuntime = class {
     }
     return {
       browserTools: ready.browserTools,
+      version: ready.version,
       /** As they are now: nothing of a container that has stopped can be opened. */
       get surfaces() {
         return ready.surfaces.map(
@@ -68202,33 +68350,6 @@ async function forward(url3, authorization, request, response) {
   sendAnswer(upstream, response);
 }
 
-// src/handlers.ts
-var VERSION2 = "0.0.15";
-function createHandlers(computers) {
-  return {
-    getInfo: async () => ({
-      version: VERSION2,
-      isolation: computers.isolation,
-      isolationsAvailable: await computers.available()
-    }),
-    listComputers: async ({ state }) => computers.list(state),
-    createComputer: (input2) => computers.create(input2),
-    getComputer: async ({ computerID }) => computers.get(computerID),
-    killComputer: async ({ computerID }) => {
-      await computers.kill(computerID);
-      return void 0;
-    },
-    setComputerTimeout: async ({ computerID, timeout }) => computers.setTimeout(computerID, timeout),
-    stopComputer: ({ computerID }) => computers.stop(computerID),
-    startComputer: ({ computerID, timeout }) => computers.start(computerID, timeout),
-    getComputerLogs: async ({ computerID }) => ({ logs: computers.logs(computerID) }),
-    createLiveSession: async ({ computerID, surface, mode }) => computers.liveSession(computerID, surface, mode ?? "watch"),
-    openLiveSession: async () => {
-      throw new ApiError(426, "Open it as a WebSocket.");
-    }
-  };
-}
-
 // src/running.ts
 import { spawn as spawn4 } from "node:child_process";
 import { closeSync, openSync, readFileSync as readFileSync4, statSync as statSync3, writeFileSync as writeFileSync2 } from "node:fs";
@@ -69101,7 +69222,7 @@ var Computer = class _Computer {
 };
 
 // src/service.ts
-import { readFileSync as readFileSync6, rmSync as rmSync3 } from "node:fs";
+import { readFileSync as readFileSync6, rmSync as rmSync6 } from "node:fs";
 import {
   createServer as createServer5,
   STATUS_CODES as STATUS_CODES3
@@ -84921,7 +85042,7 @@ var NodeStreamableHTTPServerTransport2 = class {
 
 // src/computers.ts
 import { randomBytes as randomBytes5 } from "node:crypto";
-import { appendFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync5, rmSync as rmSync2, statSync as statSync4 } from "node:fs";
+import { appendFileSync, existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync5, rmSync as rmSync5, statSync as statSync4 } from "node:fs";
 import { isAbsolute, join as join10, resolve as resolve4 } from "node:path";
 var READ = ["about", "read", "list", "search"];
 var FILES = [...READ, "edit"];
@@ -84934,8 +85055,8 @@ var MAX_LOG2 = 256 * 1024;
 var MAX_TIMER_S = 2e6;
 var TICKET_MS = 6e4;
 var expiry = (seconds2) => new Date(Date.now() + seconds2 * 1e3).toISOString();
-var messageOf = (error62) => error62 instanceof Error ? error62.message : String(error62);
-var refusalOf = (error62) => error62 instanceof ApiError ? error62 : new ApiError(500, messageOf(error62));
+var messageOf2 = (error62) => error62 instanceof Error ? error62.message : String(error62);
+var refusalOf = (error62) => error62 instanceof ApiError ? error62 : new ApiError(500, messageOf2(error62));
 var Computers = class {
   #data;
   #base;
@@ -84969,7 +85090,7 @@ var Computers = class {
       if (stored.endAt && Date.parse(stored.endAt) <= Date.now()) {
         stored.state = "stopped";
         await this.#runtimes[stored.isolation].stopLeftover(stored.id).catch(
-          (error62) => this.#log(stored.id, `What it left running wasn't stopped: ${messageOf(error62)}`)
+          (error62) => this.#log(stored.id, `What it left running wasn't stopped: ${messageOf2(error62)}`)
         );
         continue;
       }
@@ -84977,7 +85098,7 @@ var Computers = class {
         const live = this.#live.get(stored.id);
         if (live) live.failed = true;
         this.#arm(stored);
-        this.#log(stored.id, `It didn't start again: ${messageOf(error62)}`);
+        this.#log(stored.id, `It didn't start again: ${messageOf2(error62)}`);
       });
     }
     this.#save();
@@ -85016,7 +85137,7 @@ var Computers = class {
     };
     if (!workspace && access !== "none") {
       stored.workspace = join10(this.#folder(id), "workspace");
-      mkdirSync2(stored.workspace, { recursive: true, mode: 448 });
+      mkdirSync3(stored.workspace, { recursive: true, mode: 448 });
     }
     this.#stored.set(id, stored);
     try {
@@ -85026,7 +85147,7 @@ var Computers = class {
       this.#stored.delete(id);
       await this.#runtimes[stored.isolation].remove(id).catch(() => {
       });
-      rmSync2(this.#folder(id), { recursive: true, force: true });
+      rmSync5(this.#folder(id), { recursive: true, force: true });
       throw refusalOf(error62);
     }
     this.#save();
@@ -85100,7 +85221,7 @@ var Computers = class {
     }
     this.#stored.delete(id);
     this.#save();
-    rmSync2(this.#folder(id), { recursive: true, force: true });
+    rmSync5(this.#folder(id), { recursive: true, force: true });
   }
   logs(id) {
     this.#found(id);
@@ -85201,6 +85322,7 @@ var Computers = class {
       state: stored.state === "running" && down2 ? "failed" : stored.state,
       access: stored.access,
       isolation: stored.isolation,
+      version: stored.version ?? null,
       browser: stored.browser,
       workspace: stored.workspace ?? null,
       startedAt: stored.startedAt,
@@ -85234,6 +85356,9 @@ var Computers = class {
         }
       }
     );
+    const version3 = stored.isolation === "none" ? VERSION2 : live.running.version;
+    if (version3) stored.version = version3;
+    else delete stored.version;
     this.#arm(stored);
   }
   #arm(stored) {
@@ -85271,7 +85396,7 @@ var OPENAPI = {
   "openapi": "3.1.0",
   "info": {
     "title": "AgentComputer",
-    "version": "0.0.15",
+    "version": "0.0.17",
     "description": "Computers for agents. This file is the source of truth: the HTTP API, the MCP control tools and the SDK are all generated from it. An operation with `x-mcp-tool` is also an MCP tool of that name.",
     "license": {
       "name": "Apache-2.0",
@@ -85825,6 +85950,7 @@ var OPENAPI = {
           "state",
           "access",
           "isolation",
+          "version",
           "browser",
           "workspace",
           "startedAt",
@@ -85849,6 +85975,13 @@ var OPENAPI = {
             "$ref": "#/components/schemas/Isolation",
             "description": "The isolation it was made in. It is never run in another."
           },
+          "version": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "description": "The version of the program it ran at its last start. With no isolation it is the service's `version` (see `getInfo`). In a container it is the version inside its image, and null for a container made before 0.0.17, which doesn't say, until it is made again. It is kept from its last start, so a stopped computer's can be older than the service's until it starts. Compare it with the service's to show that a computer runs an older program."
+          },
           "browser": {
             "type": "boolean"
           },
@@ -87120,6 +87253,7 @@ var OPERATIONS = [
           "state",
           "access",
           "isolation",
+          "version",
           "browser",
           "workspace",
           "startedAt",
@@ -87161,6 +87295,13 @@ var OPERATIONS = [
             ],
             "description": "The isolation it was made in. It is never run in another."
           },
+          "version": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "description": "The version of the program it ran at its last start. With no isolation it is the service's `version` (see `getInfo`). In a container it is the version inside its image, and null for a container made before 0.0.17, which doesn't say, until it is made again. It is kept from its last start, so a stopped computer's can be older than the service's until it starts. Compare it with the service's to show that a computer runs an older program."
+          },
           "browser": {
             "type": "boolean"
           },
@@ -87297,6 +87438,7 @@ var OPERATIONS = [
             "state",
             "access",
             "isolation",
+            "version",
             "browser",
             "workspace",
             "startedAt",
@@ -87338,6 +87480,13 @@ var OPERATIONS = [
               ],
               "description": "The isolation it was made in. It is never run in another."
             },
+            "version": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "The version of the program it ran at its last start. With no isolation it is the service's `version` (see `getInfo`). In a container it is the version inside its image, and null for a container made before 0.0.17, which doesn't say, until it is made again. It is kept from its last start, so a stopped computer's can be older than the service's until it starts. Compare it with the service's to show that a computer runs an older program."
+            },
             "browser": {
               "type": "boolean"
             },
@@ -87447,6 +87596,7 @@ var OPERATIONS = [
             "state",
             "access",
             "isolation",
+            "version",
             "browser",
             "workspace",
             "startedAt",
@@ -87488,6 +87638,13 @@ var OPERATIONS = [
               ],
               "description": "The isolation it was made in. It is never run in another."
             },
+            "version": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "The version of the program it ran at its last start. With no isolation it is the service's `version` (see `getInfo`). In a container it is the version inside its image, and null for a container made before 0.0.17, which doesn't say, until it is made again. It is kept from its last start, so a stopped computer's can be older than the service's until it starts. Compare it with the service's to show that a computer runs an older program."
+            },
             "browser": {
               "type": "boolean"
             },
@@ -87688,6 +87845,7 @@ var OPERATIONS = [
         "state",
         "access",
         "isolation",
+        "version",
         "browser",
         "workspace",
         "startedAt",
@@ -87729,6 +87887,13 @@ var OPERATIONS = [
           ],
           "description": "The isolation it was made in. It is never run in another."
         },
+        "version": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "description": "The version of the program it ran at its last start. With no isolation it is the service's `version` (see `getInfo`). In a container it is the version inside its image, and null for a container made before 0.0.17, which doesn't say, until it is made again. It is kept from its last start, so a stopped computer's can be older than the service's until it starts. Compare it with the service's to show that a computer runs an older program."
+        },
         "browser": {
           "type": "boolean"
         },
@@ -87822,6 +87987,7 @@ var OPERATIONS = [
         "state",
         "access",
         "isolation",
+        "version",
         "browser",
         "workspace",
         "startedAt",
@@ -87863,6 +88029,13 @@ var OPERATIONS = [
           ],
           "description": "The isolation it was made in. It is never run in another."
         },
+        "version": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "description": "The version of the program it ran at its last start. With no isolation it is the service's `version` (see `getInfo`). In a container it is the version inside its image, and null for a container made before 0.0.17, which doesn't say, until it is made again. It is kept from its last start, so a stopped computer's can be older than the service's until it starts. Compare it with the service's to show that a computer runs an older program."
+        },
         "browser": {
           "type": "boolean"
         },
@@ -87961,6 +88134,7 @@ var OPERATIONS = [
         "state",
         "access",
         "isolation",
+        "version",
         "browser",
         "workspace",
         "startedAt",
@@ -88002,6 +88176,13 @@ var OPERATIONS = [
           ],
           "description": "The isolation it was made in. It is never run in another."
         },
+        "version": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "description": "The version of the program it ran at its last start. With no isolation it is the service's `version` (see `getInfo`). In a container it is the version inside its image, and null for a container made before 0.0.17, which doesn't say, until it is made again. It is kept from its last start, so a stopped computer's can be older than the service's until it starts. Compare it with the service's to show that a computer runs an older program."
+        },
         "browser": {
           "type": "boolean"
         },
@@ -88415,7 +88596,7 @@ ${JSON.stringify({ code: status, message })}
   const scheme = options.tls ? "https" : "http";
   base = options.publicUrl?.replace(/\/+$/, "") ?? `${scheme}://${bound.family === "IPv6" ? `[${bound.address}]` : bound.address}:${bound.port}`;
   const record3 = recordOf(data);
-  rmSync3(record3, { force: true });
+  rmSync6(record3, { force: true });
   await computers.resume();
   writePrivate(
     record3,
@@ -88431,7 +88612,7 @@ ${JSON.stringify({ code: status, message })}
       process.stderr.write(`${String(error62)}
 `);
     });
-    rmSync3(record3, { force: true });
+    rmSync6(record3, { force: true });
     process.exit(0);
   };
   for (const signal of ["SIGINT", "SIGTERM"]) process.once(signal, () => void stop());

package/dist/types/generated/schema.d.ts

@@ -231,6 +231,8 @@ export interface components {
             access: components["schemas"]["Access"];
             /** @description The isolation it was made in. It is never run in another. */
             isolation: components["schemas"]["Isolation"];
+            /** @description The version of the program it ran at its last start. With no isolation it is the service's `version` (see `getInfo`). In a container it is the version inside its image, and null for a container made before 0.0.17, which doesn't say, until it is made again. It is kept from its last start, so a stopped computer's can be older than the service's until it starts. Compare it with the service's to show that a computer runs an older program. */
+            version: string | null;
             browser: boolean;
             workspace: string | null;
             /**

package/dist/types/sdk.d.ts

@@ -174,6 +174,7 @@ export declare class Computer {
         state: components["schemas"]["ComputerState"];
         access: components["schemas"]["Access"];
         isolation: components["schemas"]["Isolation"];
+        version: string | null;
         browser: boolean;
         workspace: string | null;
         startedAt: string;
@@ -195,6 +196,7 @@ export declare class Computer {
         state: components["schemas"]["ComputerState"];
         access: components["schemas"]["Access"];
         isolation: components["schemas"]["Isolation"];
+        version: string | null;
         browser: boolean;
         workspace: string | null;
         startedAt: string;
@@ -208,6 +210,7 @@ export declare class Computer {
         state: components["schemas"]["ComputerState"];
         access: components["schemas"]["Access"];
         isolation: components["schemas"]["Isolation"];
+        version: string | null;
         browser: boolean;
         workspace: string | null;
         startedAt: string;
@@ -223,6 +226,7 @@ export declare class Computer {
         state: components["schemas"]["ComputerState"];
         access: components["schemas"]["Access"];
         isolation: components["schemas"]["Isolation"];
+        version: string | null;
         browser: boolean;
         workspace: string | null;
         startedAt: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentorg/computer",
-  "version": "0.0.15",
+  "version": "0.0.17",
   "description": "Computers for agents, as a service: a terminal, files and a browser over MCP",
   "license": "Apache-2.0",
   "repository": {