@agentorg/computer 0.0.17 → 0.0.19

package/dist/agentcomputer.js

@@ -3752,7 +3752,7 @@ var require_websocket_server = __commonJS({
 
 // src/main.ts
 import { homedir as homedir2 } from "node:os";
-import { isAbsolute as isAbsolute2, join as join11, resolve as resolve5 } from "node:path";
+import { isAbsolute as isAbsolute3, join as join11, resolve as resolve5 } from "node:path";
 import { parseArgs } from "node:util";
 import { isMainThread as isMainThread2 } from "node:worker_threads";
 
@@ -3767,9 +3767,11 @@ var playwright = () => {
   loaded ??= createRequire(import.meta.url)("playwright-core");
   return loaded;
 };
+var DEFAULT_CHANNEL = "chrome";
+var channelProgram = (channel) => createRequire(import.meta.url)("playwright-core/lib/coreBundle").registry.registry.findExecutable(channel)?.executablePath("javascript");
 
 // src/browser-host.ts
-var sandboxFor = (options) => options.sandbox ?? (process.platform !== "linux" || !options.executable && !["chromium", "chrome-for-testing"].includes(options.channel ?? "chrome"));
+var sandboxFor = (options) => options.sandbox ?? (process.platform !== "linux" || !options.executable && !["chromium", "chrome-for-testing"].includes(options.channel ?? DEFAULT_CHANNEL));
 async function hostBrowser(options) {
   const run3 = mkdtempSync(join("/tmp", "agentcomputer-"));
   process.env.XDG_RUNTIME_DIR = run3;
@@ -3777,7 +3779,7 @@ async function hostBrowser(options) {
   const context = await playwright().chromium.launchPersistentContext(options.profile, {
     headless: true,
     chromiumSandbox: sandboxFor(options),
-    ...options.executable ? { executablePath: options.executable } : { channel: options.channel ?? "chrome" }
+    ...options.executable ? { executablePath: options.executable } : { channel: options.channel ?? DEFAULT_CHANNEL }
   });
   const browser = context.browser();
   if (!browser) throw new Error("The browser can't be shared.");
@@ -18458,13 +18460,13 @@ var require_resolve = /* @__PURE__ */ __commonJSMin(((exports) => {
     }
     return count;
   }
-  function getFullPath(resolver, id = "", normalize) {
+  function getFullPath(resolver2, id = "", normalize) {
     if (normalize !== false) id = normalizeId(id);
-    return _getFullPath(resolver, resolver.parse(id));
+    return _getFullPath(resolver2, resolver2.parse(id));
   }
   exports.getFullPath = getFullPath;
-  function _getFullPath(resolver, p) {
-    return resolver.serialize(p).split("#")[0] + "#";
+  function _getFullPath(resolver2, p) {
+    return resolver2.serialize(p).split("#")[0] + "#";
   }
   exports._getFullPath = _getFullPath;
   const TRAILING_SLASH_HASH = /#\/?$/;
@@ -18472,9 +18474,9 @@ var require_resolve = /* @__PURE__ */ __commonJSMin(((exports) => {
     return id ? id.replace(TRAILING_SLASH_HASH, "") : "";
   }
   exports.normalizeId = normalizeId;
-  function resolveUrl(resolver, baseId, id) {
+  function resolveUrl(resolver2, baseId, id) {
     id = normalizeId(id);
-    return resolver.resolve(baseId, id);
+    return resolver2.resolve(baseId, id);
   }
   exports.resolveUrl = resolveUrl;
   const ANCHOR = /^[a-z_][-a-z0-9._]*$/i;
@@ -18956,10 +18958,10 @@ var require_ref_error = /* @__PURE__ */ __commonJSMin(((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   const resolve_1 = require_resolve();
   var MissingRefError = class extends Error {
-    constructor(resolver, baseId, ref, msg) {
+    constructor(resolver2, baseId, ref, msg) {
       super(msg || `can't resolve reference ${ref} from id ${baseId}`);
-      this.missingRef = (0, resolve_1.resolveUrl)(resolver, baseId, ref);
-      this.missingSchema = (0, resolve_1.normalizeId)((0, resolve_1.getFullPath)(resolver, this.missingRef));
+      this.missingRef = (0, resolve_1.resolveUrl)(resolver2, baseId, ref);
+      this.missingSchema = (0, resolve_1.normalizeId)((0, resolve_1.getFullPath)(resolver2, this.missingRef));
     }
   };
   exports.default = MissingRefError;
@@ -19203,10 +19205,10 @@ var require_utils = /* @__PURE__ */ __commonJSMin(((exports, module) => {
     const HEX_DIGITS = "0123456789ABCDEF";
     for (let i = 0; i < 256; i++) BYTE_HEX[i] = "%" + HEX_DIGITS[i >> 4] + HEX_DIGITS[i & 15];
   }
-  function percentEncodeNonAscii(cp) {
-    if (cp < 2048) return BYTE_HEX[192 | cp >> 6] + BYTE_HEX[128 | cp & 63];
-    if (cp < 65536) return BYTE_HEX[224 | cp >> 12] + BYTE_HEX[128 | cp >> 6 & 63] + BYTE_HEX[128 | cp & 63];
-    return BYTE_HEX[240 | cp >> 18] + BYTE_HEX[128 | cp >> 12 & 63] + BYTE_HEX[128 | cp >> 6 & 63] + BYTE_HEX[128 | cp & 63];
+  function percentEncodeNonAscii(cp2) {
+    if (cp2 < 2048) return BYTE_HEX[192 | cp2 >> 6] + BYTE_HEX[128 | cp2 & 63];
+    if (cp2 < 65536) return BYTE_HEX[224 | cp2 >> 12] + BYTE_HEX[128 | cp2 >> 6 & 63] + BYTE_HEX[128 | cp2 & 63];
+    return BYTE_HEX[240 | cp2 >> 18] + BYTE_HEX[128 | cp2 >> 12 & 63] + BYTE_HEX[128 | cp2 >> 6 & 63] + BYTE_HEX[128 | cp2 & 63];
   }
   function stringArrayToHexStripped(input2) {
     let acc = "";
@@ -19546,8 +19548,8 @@ var require_utils = /* @__PURE__ */ __commonJSMin(((exports, module) => {
   function encodeFragment(input2) {
     return encodeComponent(input2, isQueryFragmentCharacter);
   }
-  function isEscapeSafe(cp) {
-    return cp >= 48 && cp <= 57 || cp >= 65 && cp <= 90 || cp >= 97 && cp <= 122 || cp === 42 || cp === 43 || cp === 45 || cp === 46 || cp === 47 || cp === 64 || cp === 95;
+  function isEscapeSafe(cp2) {
+    return cp2 >= 48 && cp2 <= 57 || cp2 >= 65 && cp2 <= 90 || cp2 >= 97 && cp2 <= 122 || cp2 === 42 || cp2 === 43 || cp2 === 45 || cp2 === 46 || cp2 === 47 || cp2 === 64 || cp2 === 95;
   }
   function normalizeQueryFragmentEncoding(input2) {
     let output2 = "";
@@ -28109,7 +28111,7 @@ var Browser = class {
         "browser-host",
         "--profile",
         join3(folder, "profile"),
-        ...config3.path ? ["--executable", config3.path] : ["--channel", config3.browser ?? "chrome"],
+        ...config3.path ? ["--executable", config3.path] : ["--channel", config3.browser ?? DEFAULT_CHANNEL],
         ...config3.sandbox === false ? ["--no-sandbox"] : []
       ],
       { stdio: ["ignore", "pipe", "pipe"] }
@@ -28293,7 +28295,7 @@ import { spawn as spawn2 } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import { StringDecoder } from "node:string_decoder";
 import { readdirSync, readFileSync, statSync } from "node:fs";
-import { join as join22, relative, resolve as resolve2, sep as sep22 } from "node:path";
+import { isAbsolute, join as join22, relative, resolve as resolve2, sep as sep22 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { isMainThread, parentPort, Worker, workerData } from "node:worker_threads";
 var __create3 = Object.create;
@@ -56252,13 +56254,13 @@ var require_resolve2 = /* @__PURE__ */ __commonJSMin2(((exports) => {
     }
     return count;
   }
-  function getFullPath(resolver, id = "", normalize) {
+  function getFullPath(resolver2, id = "", normalize) {
     if (normalize !== false) id = normalizeId(id);
-    return _getFullPath(resolver, resolver.parse(id));
+    return _getFullPath(resolver2, resolver2.parse(id));
   }
   exports.getFullPath = getFullPath;
-  function _getFullPath(resolver, p) {
-    return resolver.serialize(p).split("#")[0] + "#";
+  function _getFullPath(resolver2, p) {
+    return resolver2.serialize(p).split("#")[0] + "#";
   }
   exports._getFullPath = _getFullPath;
   const TRAILING_SLASH_HASH = /#\/?$/;
@@ -56266,9 +56268,9 @@ var require_resolve2 = /* @__PURE__ */ __commonJSMin2(((exports) => {
     return id ? id.replace(TRAILING_SLASH_HASH, "") : "";
   }
   exports.normalizeId = normalizeId;
-  function resolveUrl(resolver, baseId, id) {
+  function resolveUrl(resolver2, baseId, id) {
     id = normalizeId(id);
-    return resolver.resolve(baseId, id);
+    return resolver2.resolve(baseId, id);
   }
   exports.resolveUrl = resolveUrl;
   const ANCHOR = /^[a-z_][-a-z0-9._]*$/i;
@@ -56750,10 +56752,10 @@ var require_ref_error2 = /* @__PURE__ */ __commonJSMin2(((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   const resolve_1 = require_resolve2();
   var MissingRefError = class extends Error {
-    constructor(resolver, baseId, ref, msg) {
+    constructor(resolver2, baseId, ref, msg) {
       super(msg || `can't resolve reference ${ref} from id ${baseId}`);
-      this.missingRef = (0, resolve_1.resolveUrl)(resolver, baseId, ref);
-      this.missingSchema = (0, resolve_1.normalizeId)((0, resolve_1.getFullPath)(resolver, this.missingRef));
+      this.missingRef = (0, resolve_1.resolveUrl)(resolver2, baseId, ref);
+      this.missingSchema = (0, resolve_1.normalizeId)((0, resolve_1.getFullPath)(resolver2, this.missingRef));
     }
   };
   exports.default = MissingRefError;
@@ -56997,10 +56999,10 @@ var require_utils2 = /* @__PURE__ */ __commonJSMin2(((exports, module) => {
     const HEX_DIGITS = "0123456789ABCDEF";
     for (let i = 0; i < 256; i++) BYTE_HEX[i] = "%" + HEX_DIGITS[i >> 4] + HEX_DIGITS[i & 15];
   }
-  function percentEncodeNonAscii(cp) {
-    if (cp < 2048) return BYTE_HEX[192 | cp >> 6] + BYTE_HEX[128 | cp & 63];
-    if (cp < 65536) return BYTE_HEX[224 | cp >> 12] + BYTE_HEX[128 | cp >> 6 & 63] + BYTE_HEX[128 | cp & 63];
-    return BYTE_HEX[240 | cp >> 18] + BYTE_HEX[128 | cp >> 12 & 63] + BYTE_HEX[128 | cp >> 6 & 63] + BYTE_HEX[128 | cp & 63];
+  function percentEncodeNonAscii(cp2) {
+    if (cp2 < 2048) return BYTE_HEX[192 | cp2 >> 6] + BYTE_HEX[128 | cp2 & 63];
+    if (cp2 < 65536) return BYTE_HEX[224 | cp2 >> 12] + BYTE_HEX[128 | cp2 >> 6 & 63] + BYTE_HEX[128 | cp2 & 63];
+    return BYTE_HEX[240 | cp2 >> 18] + BYTE_HEX[128 | cp2 >> 12 & 63] + BYTE_HEX[128 | cp2 >> 6 & 63] + BYTE_HEX[128 | cp2 & 63];
   }
   function stringArrayToHexStripped(input2) {
     let acc = "";
@@ -57340,8 +57342,8 @@ var require_utils2 = /* @__PURE__ */ __commonJSMin2(((exports, module) => {
   function encodeFragment(input2) {
     return encodeComponent(input2, isQueryFragmentCharacter);
   }
-  function isEscapeSafe(cp) {
-    return cp >= 48 && cp <= 57 || cp >= 65 && cp <= 90 || cp >= 97 && cp <= 122 || cp === 42 || cp === 43 || cp === 45 || cp === 46 || cp === 47 || cp === 64 || cp === 95;
+  function isEscapeSafe(cp2) {
+    return cp2 >= 48 && cp2 <= 57 || cp2 >= 65 && cp2 <= 90 || cp2 >= 97 && cp2 <= 122 || cp2 === 42 || cp2 === 43 || cp2 === 45 || cp2 === 46 || cp2 === 47 || cp2 === 64 || cp2 === 95;
   }
   function normalizeQueryFragmentEncoding(input2) {
     let output2 = "";
@@ -63489,8 +63491,8 @@ var WebStandardStreamableHTTPServerTransport = class {
     return timer;
   }
   /** Sets the scope challenge resolver for parsed JSON-RPC requests. */
-  setScopeChallengeResolver(resolver) {
-    this._scopeChallengeResolver = resolver;
+  setScopeChallengeResolver(resolver2) {
+    this._scopeChallengeResolver = resolver2;
   }
   /**
   * Starts the transport. This is required by the {@linkcode Transport} interface but is a no-op
@@ -65373,8 +65375,8 @@ var NodeStreamableHTTPServerTransport = class {
     this._webStandardTransport.setSupportedProtocolVersions(versions);
   }
   /** Sets the scope challenge resolver used by the wrapped Web Standard transport. */
-  setScopeChallengeResolver(resolver) {
-    this._webStandardTransport.setScopeChallengeResolver(resolver);
+  setScopeChallengeResolver(resolver2) {
+    this._webStandardTransport.setScopeChallengeResolver(resolver2);
   }
   /**
   * Handles an incoming HTTP request, whether `GET` or `POST`.
@@ -66307,28 +66309,33 @@ var refusing = async (work) => {
   }
 };
 var foldersFirst = (a, b) => Number(b.isDirectory()) - Number(a.isDirectory()) || a.name.localeCompare(b.name);
-async function inside(root, path) {
-  const refused2 = () => new ExecRefused(`${path} is outside the workspace.`);
-  const wanted = resolve(root, path);
-  const real = async (at) => {
-    try {
-      return await realpath(at);
-    } catch (error62) {
-      const { code } = error62;
-      if (code !== "ENOENT" && code !== "ENOTDIR") throw error62;
-      if (await lstat(at).then(
-        () => true,
-        () => false
-      ))
-        throw refused2();
-      const above = dirname3(at);
-      if (above === at) throw refused2();
-      return join4(await real(above), basename(at));
-    }
-  };
-  const found = await real(wanted);
-  if (found !== root && !found.startsWith(root + sep2)) throw refused2();
+var resolver = (root, reach) => async (path) => {
+  const found = await real(resolve(root, path));
+  if (reach === "machine") {
+    if (found === void 0) throw new ExecRefused(`${path} is a link to nothing.`);
+    return found;
+  }
+  if (found === void 0 || found !== root && !found.startsWith(root + sep2))
+    throw new ExecRefused(`${path} is outside the workspace.`);
   return found;
+};
+var inside = (root, path) => resolver(root, "workspace")(path);
+async function real(at) {
+  try {
+    return await realpath(at);
+  } catch (error62) {
+    const { code } = error62;
+    if (code !== "ENOENT" && code !== "ENOTDIR") throw error62;
+    if (await lstat(at).then(
+      () => true,
+      () => false
+    ))
+      return void 0;
+    const above = dirname3(at);
+    if (above === at) return void 0;
+    const placed = await real(above);
+    return placed === void 0 ? void 0 : join4(placed, basename(at));
+  }
 }
 async function aFile(path, given) {
   const found = await stat(path);
@@ -66336,8 +66343,7 @@ async function aFile(path, given) {
   if (!found.isFile()) throw new ExecRefused(`${given} isn't a file that can be read.`);
   return found;
 }
-function createFiles(root) {
-  const at = (path) => inside(root, path);
+function createFiles(at) {
   const text22 = async (path, given) => {
     await aFile(path, given);
     const bytes = await readFile(path);
@@ -66462,7 +66468,10 @@ function searched(job) {
   const matcher = new RegExp(pattern, job.ignore_case ? "i" : "");
   const limit = job.limit ?? DEFAULT_MATCHES;
   const out = [];
-  const name = (path) => relative(job.root, path) || path;
+  const name = (path) => {
+    const from = relative(job.root, path);
+    return from === ".." || from.startsWith(`..${sep22}`) || isAbsolute(from) ? path : from || path;
+  };
   const scan = (file2) => {
     const found = statSync(file2);
     if (!found.isFile() || found.size > MAX_FILE_BYTES) return;
@@ -66526,8 +66535,8 @@ function onThread(job, what) {
     });
   });
 }
-async function search(root, input2) {
-  const path = await inside(root, input2.path ?? ".");
+async function search(root, at, input2) {
+  const path = await at(input2.path ?? ".");
   return onThread({ ...input2, path, root, agentexecSearch: true }, "That search");
 }
 function changedSince(root, since) {
@@ -66565,9 +66574,9 @@ function createHostFiles(root, level) {
     read: (path, offset, length) => refusing(async () => {
       if (!Number.isSafeInteger(offset) || offset < 0 || !Number.isSafeInteger(length) || length < 1 || length > MAX_READ_BYTES)
         throw new ExecRefused("A read starts at 0 or later and takes 1 to 1,048,576 bytes.");
-      const real = await inside(root, path);
-      const found = await aFile(real, path);
-      const file2 = await open3(real, "r");
+      const real2 = await inside(root, path);
+      const found = await aFile(real2, path);
+      const file2 = await open3(real2, "r");
       try {
         const bytes = Buffer.alloc(Math.max(0, Math.min(length, found.size - offset)));
         const { bytesRead } = await file2.read(bytes, 0, bytes.length, offset);
@@ -66708,9 +66717,12 @@ var TOOLS = [
   "search",
   "edit"
 ];
-function createServer2(root, sessions, version22, level, extraTools = []) {
+function createServer2(root, sessions, version22, level, extraTools = [], reach = "workspace") {
   const server = new McpServer({ name: "agentexec", version: version22 });
-  const files = createFiles(root);
+  const at = resolver(root, reach);
+  const files = createFiles(at);
+  const where = reach === "machine" ? "Relative to the workspace, or absolute, anywhere on the machine." : "Inside the workspace; relative to it, or absolute.";
+  const orWorkspace = `${where} The workspace by default.`;
   for (const { name, description, readOnly, call } of extraTools)
     server.registerTool(
       name,
@@ -66789,7 +66801,7 @@ function createServer2(root, sessions, version22, level, extraTools = []) {
     {
       description: "Reads a text file as numbered lines, or shows a PNG, JPEG, GIF or WebP of up to 3 MiB as an image; offset and limit are for text.",
       inputSchema: {
-        path: external_exports.string().min(1).describe("Inside the workspace; relative to it, or absolute."),
+        path: external_exports.string().min(1).describe(where),
         offset: external_exports.number().int().positive().optional().describe("The first line, from 1."),
         limit: external_exports.number().int().positive().optional().describe("How many lines; 2000 by default.")
       },
@@ -66808,7 +66820,7 @@ function createServer2(root, sessions, version22, level, extraTools = []) {
     "list",
     {
       description: "Lists a folder: folders end in /, and files give their size in bytes.",
-      inputSchema: { path: external_exports.string().optional().describe("The workspace by default.") },
+      inputSchema: { path: external_exports.string().optional().describe(orWorkspace) },
       annotations: READ_ONLY
     },
     (input2) => saying(() => files.list(input2))
@@ -66816,17 +66828,17 @@ function createServer2(root, sessions, version22, level, extraTools = []) {
   server.registerTool(
     "search",
     {
-      description: "Searches text files under a folder, as path:line:text. Skips what .gitignore ignores, .git and node_modules.",
+      description: `Searches text files under a folder, as path:line:text, the path from the workspace${reach === "machine" ? ", or whole for a file outside it" : ""}. Skips what .gitignore ignores, .git and node_modules.`,
       inputSchema: {
         pattern: external_exports.string().min(1).describe("Exact text, or a regular expression with regex."),
-        path: external_exports.string().optional().describe("A folder or file; the workspace by default."),
+        path: external_exports.string().optional().describe(`A folder or file. ${orWorkspace}`),
         regex: external_exports.boolean().optional(),
         ignore_case: external_exports.boolean().optional(),
         limit: external_exports.number().int().positive().optional().describe("Most matches; 200 by default.")
       },
       annotations: READ_ONLY
     },
-    (input2) => saying(() => search(root, input2))
+    (input2) => saying(() => search(root, at, input2))
   );
   if (level !== "read")
     server.registerTool(
@@ -66834,7 +66846,7 @@ function createServer2(root, sessions, version22, level, extraTools = []) {
       {
         description: "Replaces exact text in a file and answers with a unified diff. old_text must appear exactly once unless replace_all. An empty old_text creates a new file.",
         inputSchema: {
-          path: external_exports.string().min(1).describe("Inside the workspace; relative to it, or absolute."),
+          path: external_exports.string().min(1).describe(where),
           old_text: external_exports.string().describe("The exact text to replace, whitespace included."),
           new_text: external_exports.string().describe("What to put in its place."),
           replace_all: external_exports.boolean().optional()
@@ -66845,7 +66857,7 @@ function createServer2(root, sessions, version22, level, extraTools = []) {
     );
   return server;
 }
-var VERSION = "0.0.8";
+var VERSION = "0.0.9";
 function createAgentExec(options) {
   const root = realpathSync(resolve3(options.workspace));
   const level = options.level ?? "read";
@@ -66870,7 +66882,7 @@ function createAgentExec(options) {
   }
   return {
     async handle(request, response, body) {
-      const server = createServer2(root, sessions, VERSION, level, extraTools);
+      const server = createServer2(root, sessions, VERSION, level, extraTools, options.reach);
       const transport = new NodeStreamableHTTPServerTransport({ sessionIdGenerator: void 0 });
       response.once("close", () => {
         void transport.close();
@@ -66922,7 +66934,11 @@ function aboutTool(facts, load) {
         // In a container its commands find the folder somewhere else, so the row says both.
         inside2 === outside ? { label: "Folder", value: outside, path: true } : { label: "Folder", value: `${outside} on the machine, mounted at ${inside2} in it` },
         { label: "Reaches", value: REACHES[facts.access] + (facts.browser ? ", Browser" : "") },
-        facts.contained ? { label: "Isolation", value: "A container of its own" } : { label: "Isolation", value: "None: it acts as you", caution: true }
+        facts.contained ? { label: "Isolation", value: "A container of its own" } : {
+          label: "Isolation",
+          value: "None: it acts as you, on the whole machine",
+          caution: true
+        }
       ];
       const reading = await load.now();
       if (reading)
@@ -67031,6 +67047,7 @@ var BrowserLive = class {
       } catch {
         return;
       }
+      if (typeof message !== "object" || message === null) return;
       this.#input(ws, viewer, message);
     });
     this.#begin().then(
@@ -67863,16 +67880,44 @@ var loadPty = () => {
   })();
   return pty;
 };
+function browserProgram(config3) {
+  const channel = config3.browser ?? DEFAULT_CHANNEL;
+  let path;
+  try {
+    playwright();
+    path = config3.path ?? channelProgram(channel);
+  } catch {
+    return { ready: false, reason: "Playwright isn't installed with this service." };
+  }
+  if (path && existsSync(path)) return { ready: true };
+  return {
+    ready: false,
+    reason: config3.path ? `There's no browser at ${config3.path}. Start the service with a --browser-path that exists.` : `The browser ${channel} isn't installed on this machine. Install it, or start the service with --browser-name or --browser-path.`
+  };
+}
 var ProcessRuntime = class {
   #config;
   #contained;
-  /** `contained` is for inside a container, where the computer and its load are its own. */
+  /**
+   * Outside a container it is this computer, its files reaching the whole machine. `contained` is
+   * for inside one, where the computer and its load are its own and its files stay in its
+   * workspace.
+   */
   constructor(config3, contained = false) {
     this.#config = config3;
     this.#contained = contained;
   }
-  async available() {
-    return true;
+  async offer() {
+    return {
+      ready: true,
+      capabilities: [
+        { capability: "about", ready: true },
+        { capability: "terminal", ready: true },
+        { capability: "files", ready: true },
+        { capability: "screen", ready: false, reason: "This service can't reach the screen yet." }
+      ],
+      browsers: [{ kind: "headless", ...browserProgram(this.#config) }]
+    };
   }
   async prepare() {
   }
@@ -67898,6 +67943,7 @@ var ProcessRuntime = class {
       exec = createAgentExec({
         workspace,
         level: spec.access,
+        reach: this.#contained ? "workspace" : "machine",
         pty: await loadPty(),
         extraTools: [about]
       });
@@ -67958,16 +68004,13 @@ var ProcessRuntime = class {
 };
 
 // src/handlers.ts
-var VERSION2 = "0.0.17";
+var VERSION2 = "0.0.19";
 function createHandlers(computers) {
   return {
-    getInfo: async () => ({
-      version: VERSION2,
-      isolation: computers.isolation,
-      isolationsAvailable: await computers.available()
-    }),
+    getInfo: async () => ({ version: VERSION2, ...await computers.offers() }),
     listComputers: async ({ state }) => computers.list(state),
     createComputer: (input2) => computers.create(input2),
+    attachComputer: (input2) => computers.attach(input2),
     getComputer: async ({ computerID }) => computers.get(computerID),
     killComputer: async ({ computerID }) => {
       await computers.kill(computerID);
@@ -68039,9 +68082,9 @@ async function serveInside(options) {
   server.on("upgrade", (request, socket, head) => {
     socket.on("error", () => socket.destroy());
     const given = /^Bearer (\S+)$/.exec(request.headers.authorization ?? "")?.[1];
-    const url3 = new URL(request.url ?? "/", "http://localhost");
-    const surface = /^\/live\/(terminal|files|browser|load)$/.exec(url3.pathname)?.[1];
-    const mode = url3.searchParams.get("mode");
+    const url3 = URL.parse(request.url ?? "/", "http://localhost");
+    const surface = /^\/live\/(terminal|files|browser|load)$/.exec(url3?.pathname ?? "")?.[1];
+    const mode = url3?.searchParams.get("mode");
     if (!given || !sameToken(given, digest) || !surface || mode !== "watch" && mode !== "operate")
       return void socket.end("HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n");
     running2.then((computer) => computer.openLive(surface, mode, request, socket, head)).catch(() => socket.destroy());
@@ -68058,6 +68101,7 @@ async function serveInside(options) {
 var run2 = promisify2(execFile2);
 var START_MS2 = 6e4;
 var STOP_SECONDS = "5";
+var NO_DOCKER = "A container needs Docker, which isn't answering on this machine.";
 var NOT_FORWARDED = /* @__PURE__ */ new Set([
   "authorization",
   "connection",
@@ -68104,14 +68148,22 @@ var ContainerRuntime = class {
       return false;
     }
   }
-  // Asked each time the service says what it can make, so it doesn't wait on a Docker that hangs.
-  available() {
-    return this.#answers(1e3);
+  // Docker is asked for a second each time the service says what it offers, so that doesn't wait
+  // on a Docker that hangs. Its image has its own browser.
+  async offer() {
+    return {
+      ...await this.#answers(1e3) ? { ready: true } : { ready: false, reason: NO_DOCKER },
+      capabilities: [
+        { capability: "about", ready: true },
+        { capability: "terminal", ready: true },
+        { capability: "files", ready: true }
+      ],
+      browsers: [{ kind: "headless", ready: true }]
+    };
   }
   /** Docker, or the refusal of what can't be done without it. */
   async #docker() {
-    if (!await this.#answers(1e4))
-      throw new ApiError(409, "A container needs Docker, which isn't answering on this machine.");
+    if (!await this.#answers(1e4)) throw new ApiError(409, NO_DOCKER);
   }
   async prepare() {
     await this.#docker();
@@ -68374,8 +68426,8 @@ async function running(data, said = recorded(data)) {
       signal: AbortSignal.timeout(3e3)
     });
     if (!answer.ok) return void 0;
-    const { version: version3, isolation } = await answer.json();
-    return { url: said.url, pid: said.pid, version: version3, isolation };
+    const { version: version3 } = await answer.json();
+    return { url: said.url, pid: said.pid, version: version3 };
   } catch {
     return void 0;
   }
@@ -68911,6 +68963,19 @@ var ComputerError = class extends Error {
   }
 };
 var seconds = (ms) => Math.max(1, Math.ceil(ms / 1e3));
+function requestOf(opts) {
+  const { access, browser, name, timeoutMs, metadata, apiKey, apiUrl } = opts;
+  return {
+    connection: { ...apiKey ? { apiKey } : {}, ...apiUrl ? { apiUrl } : {} },
+    body: {
+      access,
+      browser: browser ?? false,
+      ...name === void 0 ? {} : { name },
+      ...timeoutMs === void 0 ? {} : { timeout: seconds(timeoutMs) },
+      ...metadata === void 0 ? {} : { metadata }
+    }
+  };
+}
 function apiOf(opts = {}) {
   const apiKey = opts.apiKey ?? process.env.AGENTCOMPUTER_API_KEY;
   if (!apiKey) throw new ComputerError(401, "Pass apiKey, or set AGENTCOMPUTER_API_KEY.");
@@ -69110,23 +69175,30 @@ var Computer = class _Computer {
     this.files = new Files(this.#computer);
   }
   static async create(opts) {
-    const { access, browser, isolation, workspace, name, timeoutMs, metadata, apiKey, apiUrl } = opts;
-    const connection = { ...apiKey ? { apiKey } : {}, ...apiUrl ? { apiUrl } : {} };
+    const { isolation, workspace, copyFrom } = opts;
+    const { connection, body } = requestOf(opts);
     const created = answered(
       await apiOf(connection).POST("/v1/computers", {
         body: {
-          access,
-          browser: browser ?? false,
+          ...body,
           ...isolation === void 0 ? {} : { isolation },
           ...workspace === void 0 ? {} : { workspace },
-          ...name === void 0 ? {} : { name },
-          ...timeoutMs === void 0 ? {} : { timeout: seconds(timeoutMs) },
-          ...metadata === void 0 ? {} : { metadata }
+          ...copyFrom === void 0 ? {} : { copyFrom }
         }
       })
     );
     return new _Computer(connection, created, created.accessToken);
   }
+  /** This computer, attached whole. Killing it detaches it and removes nothing of the machine's. */
+  static async attach(opts) {
+    const { connection, body } = requestOf(opts);
+    const attached = answered(
+      await apiOf(connection).POST("/v1/computers/attach", {
+        body: { ...body, workspace: opts.workspace }
+      })
+    );
+    return new _Computer(connection, attached, attached.accessToken);
+  }
   /** A computer made earlier. Its token was shown when it was made, and only then. */
   static async connect(computerID, opts) {
     const { accessToken, ...connection } = opts;
@@ -75859,13 +75931,13 @@ var require_resolve3 = /* @__PURE__ */ __commonJSMin3(((exports) => {
     }
     return count;
   }
-  function getFullPath(resolver, id = "", normalize) {
+  function getFullPath(resolver2, id = "", normalize) {
     if (normalize !== false) id = normalizeId(id);
-    return _getFullPath(resolver, resolver.parse(id));
+    return _getFullPath(resolver2, resolver2.parse(id));
   }
   exports.getFullPath = getFullPath;
-  function _getFullPath(resolver, p) {
-    return resolver.serialize(p).split("#")[0] + "#";
+  function _getFullPath(resolver2, p) {
+    return resolver2.serialize(p).split("#")[0] + "#";
   }
   exports._getFullPath = _getFullPath;
   const TRAILING_SLASH_HASH = /#\/?$/;
@@ -75873,9 +75945,9 @@ var require_resolve3 = /* @__PURE__ */ __commonJSMin3(((exports) => {
     return id ? id.replace(TRAILING_SLASH_HASH, "") : "";
   }
   exports.normalizeId = normalizeId;
-  function resolveUrl(resolver, baseId, id) {
+  function resolveUrl(resolver2, baseId, id) {
     id = normalizeId(id);
-    return resolver.resolve(baseId, id);
+    return resolver2.resolve(baseId, id);
   }
   exports.resolveUrl = resolveUrl;
   const ANCHOR = /^[a-z_][-a-z0-9._]*$/i;
@@ -76357,10 +76429,10 @@ var require_ref_error3 = /* @__PURE__ */ __commonJSMin3(((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   const resolve_1 = require_resolve3();
   var MissingRefError = class extends Error {
-    constructor(resolver, baseId, ref, msg) {
+    constructor(resolver2, baseId, ref, msg) {
       super(msg || `can't resolve reference ${ref} from id ${baseId}`);
-      this.missingRef = (0, resolve_1.resolveUrl)(resolver, baseId, ref);
-      this.missingSchema = (0, resolve_1.normalizeId)((0, resolve_1.getFullPath)(resolver, this.missingRef));
+      this.missingRef = (0, resolve_1.resolveUrl)(resolver2, baseId, ref);
+      this.missingSchema = (0, resolve_1.normalizeId)((0, resolve_1.getFullPath)(resolver2, this.missingRef));
     }
   };
   exports.default = MissingRefError;
@@ -76604,10 +76676,10 @@ var require_utils3 = /* @__PURE__ */ __commonJSMin3(((exports, module) => {
     const HEX_DIGITS = "0123456789ABCDEF";
     for (let i = 0; i < 256; i++) BYTE_HEX[i] = "%" + HEX_DIGITS[i >> 4] + HEX_DIGITS[i & 15];
   }
-  function percentEncodeNonAscii(cp) {
-    if (cp < 2048) return BYTE_HEX[192 | cp >> 6] + BYTE_HEX[128 | cp & 63];
-    if (cp < 65536) return BYTE_HEX[224 | cp >> 12] + BYTE_HEX[128 | cp >> 6 & 63] + BYTE_HEX[128 | cp & 63];
-    return BYTE_HEX[240 | cp >> 18] + BYTE_HEX[128 | cp >> 12 & 63] + BYTE_HEX[128 | cp >> 6 & 63] + BYTE_HEX[128 | cp & 63];
+  function percentEncodeNonAscii(cp2) {
+    if (cp2 < 2048) return BYTE_HEX[192 | cp2 >> 6] + BYTE_HEX[128 | cp2 & 63];
+    if (cp2 < 65536) return BYTE_HEX[224 | cp2 >> 12] + BYTE_HEX[128 | cp2 >> 6 & 63] + BYTE_HEX[128 | cp2 & 63];
+    return BYTE_HEX[240 | cp2 >> 18] + BYTE_HEX[128 | cp2 >> 12 & 63] + BYTE_HEX[128 | cp2 >> 6 & 63] + BYTE_HEX[128 | cp2 & 63];
   }
   function stringArrayToHexStripped(input2) {
     let acc = "";
@@ -76947,8 +77019,8 @@ var require_utils3 = /* @__PURE__ */ __commonJSMin3(((exports, module) => {
   function encodeFragment(input2) {
     return encodeComponent(input2, isQueryFragmentCharacter);
   }
-  function isEscapeSafe(cp) {
-    return cp >= 48 && cp <= 57 || cp >= 65 && cp <= 90 || cp >= 97 && cp <= 122 || cp === 42 || cp === 43 || cp === 45 || cp === 46 || cp === 47 || cp === 64 || cp === 95;
+  function isEscapeSafe(cp2) {
+    return cp2 >= 48 && cp2 <= 57 || cp2 >= 65 && cp2 <= 90 || cp2 >= 97 && cp2 <= 122 || cp2 === 42 || cp2 === 43 || cp2 === 45 || cp2 === 46 || cp2 === 47 || cp2 === 64 || cp2 === 95;
   }
   function normalizeQueryFragmentEncoding(input2) {
     let output2 = "";
@@ -83100,8 +83172,8 @@ var WebStandardStreamableHTTPServerTransport2 = class {
     return timer;
   }
   /** Sets the scope challenge resolver for parsed JSON-RPC requests. */
-  setScopeChallengeResolver(resolver) {
-    this._scopeChallengeResolver = resolver;
+  setScopeChallengeResolver(resolver2) {
+    this._scopeChallengeResolver = resolver2;
   }
   /**
   * Starts the transport. This is required by the {@linkcode Transport} interface but is a no-op
@@ -85001,8 +85073,8 @@ var NodeStreamableHTTPServerTransport2 = class {
     this._webStandardTransport.setSupportedProtocolVersions(versions);
   }
   /** Sets the scope challenge resolver used by the wrapped Web Standard transport. */
-  setScopeChallengeResolver(resolver) {
-    this._webStandardTransport.setScopeChallengeResolver(resolver);
+  setScopeChallengeResolver(resolver2) {
+    this._webStandardTransport.setScopeChallengeResolver(resolver2);
   }
   /**
   * Handles an incoming HTTP request, whether `GET` or `POST`.
@@ -85042,8 +85114,19 @@ var NodeStreamableHTTPServerTransport2 = class {
 
 // src/computers.ts
 import { randomBytes as randomBytes5 } from "node:crypto";
-import { appendFileSync, existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync5, rmSync as rmSync5, statSync as statSync4 } from "node:fs";
-import { isAbsolute, join as join10, resolve as resolve4 } from "node:path";
+import {
+  appendFileSync,
+  chmodSync as chmodSync4,
+  existsSync as existsSync2,
+  mkdirSync as mkdirSync3,
+  readdirSync as readdirSync2,
+  readFileSync as readFileSync5,
+  realpathSync as realpathSync2,
+  rmSync as rmSync5,
+  statSync as statSync4
+} from "node:fs";
+import { cp, lstat as lstat3 } from "node:fs/promises";
+import { isAbsolute as isAbsolute2, join as join10, resolve as resolve4 } from "node:path";
 var READ = ["about", "read", "list", "search"];
 var FILES = [...READ, "edit"];
 var TOOLS2 = {
@@ -85056,32 +85139,59 @@ var MAX_TIMER_S = 2e6;
 var TICKET_MS = 6e4;
 var expiry = (seconds2) => new Date(Date.now() + seconds2 * 1e3).toISOString();
 var messageOf2 = (error62) => error62 instanceof Error ? error62.message : String(error62);
+var noLongerMade = (stored) => "A computer with no isolation is no longer made. " + (stored.workspace ? `Its folder is kept at ${stored.workspace}. Attach this computer with that folder as its work folder, or make a container whose workspace starts as a copy of it.` : "Attach this computer, or make a container.");
+function removeFolder(path) {
+  try {
+    rmSync5(path, { recursive: true, force: true });
+  } catch {
+    const open5 = (at) => {
+      chmodSync4(at, 448);
+      for (const entry of readdirSync2(at, { withFileTypes: true }))
+        if (entry.isDirectory()) open5(join10(at, entry.name));
+    };
+    open5(path);
+    rmSync5(path, { recursive: true, force: true });
+  }
+}
+function folderAt(path) {
+  let folder = false;
+  try {
+    folder = isAbsolute2(path) && statSync4(path).isDirectory();
+  } catch {
+  }
+  if (!folder) throw new ApiError(400, `There's no folder at ${path}.`);
+  return resolve4(path);
+}
 var refusalOf = (error62) => error62 instanceof ApiError ? error62 : new ApiError(500, messageOf2(error62));
 var Computers = class {
   #data;
   #base;
+  /** This computer's way of running, as `none`, and each way of making one. */
   #runtimes;
-  /** The isolation of a computer made without saying which. */
-  isolation;
+  /** Why this computer isn't offered here, where it isn't. */
+  #notHere;
   #stored = /* @__PURE__ */ new Map();
   #live = /* @__PURE__ */ new Map();
   #tickets = /* @__PURE__ */ new Map();
   #file;
-  constructor(data, base, runtimes, isolation) {
+  constructor(data, base, runtimes, notHere) {
     this.#data = data;
     this.#base = base;
     this.#runtimes = runtimes;
-    this.isolation = isolation;
+    this.#notHere = notHere;
     this.#file = join10(data, "computers.json");
     if (existsSync2(this.#file))
       for (const entry of JSON.parse(readFileSync5(this.#file, "utf8")))
-        this.#stored.set(entry.id, { ...entry, isolation: entry.isolation ?? isolation });
-  }
-  /** The isolations a computer can be made in now. */
-  async available() {
-    const all = Object.keys(this.#runtimes);
-    const can = await Promise.all(all.map((one) => this.#runtimes[one].available()));
-    return all.filter((_, index) => can[index]);
+        this.#stored.set(entry.id, { ...entry, isolation: entry.isolation ?? "none" });
+  }
+  /** What it offers: this computer, and each kind it makes, with whether it can be now. */
+  async offers() {
+    const offered = await this.#runtimes.none.offer();
+    const thisComputer = this.#notHere ? { ...offered, ready: false, reason: this.#notHere } : offered;
+    const made = await Promise.all(
+      Object.keys(this.#runtimes).filter((isolation) => isolation !== "none").map(async (isolation) => ({ isolation, ...await this.#runtimes[isolation].offer() }))
+    );
+    return { thisComputer, made };
   }
   /** Bring back what was running when the service last stopped. */
   async resume() {
@@ -85104,20 +85214,34 @@ var Computers = class {
     this.#save();
   }
   async create(input2) {
+    if (input2.isolation === "none")
+      throw new ApiError(
+        400,
+        "A computer with no isolation is no longer made. Attach this computer, or make a container."
+      );
+    return this.#make(input2, input2.isolation ?? "container");
+  }
+  /** This computer, attached with its work folder. Nothing is made for it. */
+  attach(input2) {
+    return this.#make(input2, "none");
+  }
+  async #make(input2, isolation) {
     const { access, name, timeout, metadata } = input2;
     const browser = input2.browser === true;
     if (access === "none" && !browser)
       throw new ApiError(400, "With no files, no commands and no browser, there's no computer.");
-    let workspace;
-    if (input2.workspace !== void 0) {
-      let folder = false;
-      try {
-        folder = isAbsolute(input2.workspace) && statSync4(input2.workspace).isDirectory();
-      } catch {
-      }
-      if (!folder) throw new ApiError(400, `There's no folder at ${input2.workspace}.`);
-      workspace = resolve4(input2.workspace);
-    }
+    if (input2.copyFrom !== void 0 && input2.workspace !== void 0)
+      throw new ApiError(
+        400,
+        "Give workspace or copyFrom, not both: copyFrom fills a workspace the service makes."
+      );
+    if (input2.copyFrom !== void 0 && access === "none")
+      throw new ApiError(
+        400,
+        "With access none there is no workspace. Give access read, files or terminal, or leave out copyFrom."
+      );
+    const workspace = input2.workspace === void 0 ? void 0 : folderAt(input2.workspace);
+    const from = input2.copyFrom === void 0 ? void 0 : realpathSync2(folderAt(input2.copyFrom));
     const id = `c_${randomBytes5(9).toString("hex")}`;
     const token = newToken();
     const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -85125,7 +85249,8 @@ var Computers = class {
       id,
       name: name ?? id,
       access,
-      isolation: input2.isolation ?? this.isolation,
+      isolation,
+      ...isolation === "none" ? { attached: true } : {},
       browser,
       ...workspace ? { workspace } : {},
       metadata: metadata ?? {},
@@ -85136,8 +85261,21 @@ var Computers = class {
       ...timeout === void 0 ? {} : { endAt: expiry(timeout) }
     };
     if (!workspace && access !== "none") {
-      stored.workspace = join10(this.#folder(id), "workspace");
-      mkdirSync3(stored.workspace, { recursive: true, mode: 448 });
+      const own3 = join10(this.#folder(id), "workspace");
+      mkdirSync3(own3, { recursive: true, mode: 448 });
+      stored.workspace = own3;
+      if (from)
+        await cp(from, own3, {
+          recursive: true,
+          verbatimSymlinks: true,
+          filter: async (path) => {
+            const found = await lstat3(path);
+            return found.isFile() || found.isDirectory() || found.isSymbolicLink();
+          }
+        }).catch((error62) => {
+          removeFolder(this.#folder(id));
+          throw refusalOf(error62);
+        });
     }
     this.#stored.set(id, stored);
     try {
@@ -85147,7 +85285,10 @@ var Computers = class {
       this.#stored.delete(id);
       await this.#runtimes[stored.isolation].remove(id).catch(() => {
       });
-      rmSync5(this.#folder(id), { recursive: true, force: true });
+      try {
+        removeFolder(this.#folder(id));
+      } catch {
+      }
       throw refusalOf(error62);
     }
     this.#save();
@@ -85221,7 +85362,12 @@ var Computers = class {
     }
     this.#stored.delete(id);
     this.#save();
-    rmSync5(this.#folder(id), { recursive: true, force: true });
+    const folder = this.#folder(id);
+    if (stored.isolation === "none" && !stored.attached && existsSync2(join10(folder, "workspace")))
+      for (const entry of readdirSync2(folder)) {
+        if (entry !== "workspace") removeFolder(join10(folder, entry));
+      }
+    else removeFolder(folder);
   }
   logs(id) {
     this.#found(id);
@@ -85322,6 +85468,7 @@ var Computers = class {
       state: stored.state === "running" && down2 ? "failed" : stored.state,
       access: stored.access,
       isolation: stored.isolation,
+      attached: stored.attached === true,
       version: stored.version ?? null,
       browser: stored.browser,
       workspace: stored.workspace ?? null,
@@ -85337,6 +85484,9 @@ var Computers = class {
   async #start(stored) {
     const live = {};
     this.#live.set(stored.id, live);
+    if (stored.isolation === "none" && !stored.attached)
+      throw new ApiError(409, noLongerMade(stored));
+    if (stored.attached && this.#notHere) throw new ApiError(409, this.#notHere);
     stored.startedAt = (/* @__PURE__ */ new Date()).toISOString();
     const runtime = this.#runtimes[stored.isolation];
     await runtime.prepare();
@@ -85396,7 +85546,7 @@ var OPENAPI = {
   "openapi": "3.1.0",
   "info": {
     "title": "AgentComputer",
-    "version": "0.0.17",
+    "version": "0.0.19",
     "description": "Computers for agents. This file is the source of truth: the HTTP API, the MCP control tools and the SDK are all generated from it. An operation with `x-mcp-tool` is also an MCP tool of that name.",
     "license": {
       "name": "Apache-2.0",
@@ -85419,7 +85569,7 @@ var OPENAPI = {
       "get": {
         "operationId": "getInfo",
         "x-mcp-tool": "service_info",
-        "summary": "What this service is and how it isolates its computers.",
+        "summary": "What this service offers: this computer, the kinds of computer it can make, and the browsers that can go with each, every one ready or not and why.",
         "responses": {
           "200": {
             "description": "The service.",
@@ -85501,6 +85651,47 @@ var OPENAPI = {
           },
           "401": {
             "$ref": "#/components/responses/Unauthorized"
+          },
+          "409": {
+            "$ref": "#/components/responses/Error"
+          }
+        }
+      }
+    },
+    "/v1/computers/attach": {
+      "post": {
+        "operationId": "attachComputer",
+        "x-mcp-tool": "computer_attach",
+        "summary": "Attach this computer, the machine the service runs on, whole: its files and commands reach all of it, as whoever started the service. Each call attaches it as a computer of its own, with its own id and token. Killing one detaches it and removes nothing of the machine's. Refused with 409 by a service that other machines can reach, which doesn't offer it.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/AttachComputer"
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "It, with its access token, shown only now.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/CreatedComputer"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/Error"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "409": {
+            "$ref": "#/components/responses/Error"
           }
         }
       }
@@ -85674,6 +85865,9 @@ var OPENAPI = {
           },
           "404": {
             "$ref": "#/components/responses/Error"
+          },
+          "409": {
+            "$ref": "#/components/responses/Error"
           }
         }
       }
@@ -85898,9 +86092,48 @@ var OPENAPI = {
             "maxLength": 4096,
             "description": "The full path of a folder that exists, on the service's machine. With none, the service makes a folder, which goes when the computer is killed. A folder named here never does."
           },
+          "copyFrom": {
+            "type": "string",
+            "maxLength": 4096,
+            "description": "The full path of a folder on the service's machine. The workspace the service makes starts with a copy of what is in it, taken once when the computer is made; the folder itself is never mounted or changed. Links are copied as they are, and sockets, pipes and devices are left out. Use it instead of workspace; it needs access other than none."
+          },
           "isolation": {
             "$ref": "#/components/schemas/Isolation",
-            "description": "How it is isolated, which it keeps for as long as it exists. Left out, it is the service's own, the `isolation` that `getInfo` answers."
+            "description": "How it is isolated, which it keeps for as long as it exists: container, the default. One with no isolation is no longer made, and asking for one is refused: attach this computer instead."
+          },
+          "timeout": {
+            "$ref": "#/components/schemas/Timeout"
+          },
+          "metadata": {
+            "$ref": "#/components/schemas/Metadata"
+          }
+        }
+      },
+      "AttachComputer": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "access",
+          "workspace"
+        ],
+        "properties": {
+          "name": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 128
+          },
+          "access": {
+            "$ref": "#/components/schemas/Access"
+          },
+          "browser": {
+            "type": "boolean",
+            "default": false,
+            "description": "Whether it has a headless browser of its own. With access none, it must."
+          },
+          "workspace": {
+            "type": "string",
+            "maxLength": 4096,
+            "description": "Its work folder: the full path of a folder that exists. Commands and relative paths start there and its agent is told to work there, but nothing keeps its files inside it. Detaching never removes it."
           },
           "timeout": {
             "$ref": "#/components/schemas/Timeout"
@@ -85916,7 +86149,7 @@ var OPENAPI = {
           "none",
           "container"
         ],
-        "description": "none: processes of whoever started the service. container: a container of its own, which needs Docker on the service's machine."
+        "description": "none: processes of whoever started the service, which only this computer has now; a computer made with no isolation before can't start again. container: a container of its own, which needs Docker on the service's machine."
       },
       "Endpoints": {
         "type": "object",
@@ -85950,6 +86183,7 @@ var OPENAPI = {
           "state",
           "access",
           "isolation",
+          "attached",
           "version",
           "browser",
           "workspace",
@@ -85975,12 +86209,16 @@ var OPENAPI = {
             "$ref": "#/components/schemas/Isolation",
             "description": "The isolation it was made in. It is never run in another."
           },
+          "attached": {
+            "type": "boolean",
+            "description": "Whether it is this computer, attached rather than made: the service's machine, whole, acting as whoever started the service, with no isolation. False with isolation none marks a computer made with no isolation by an earlier version, which can't start again; its workspace is kept."
+          },
           "version": {
             "type": [
               "string",
               "null"
             ],
-            "description": "The version of the program it ran at its last start. With no isolation it is the service's `version` (see `getInfo`). In a container it is the version inside its image, and null for a container made before 0.0.17, which doesn't say, until it is made again. It is kept from its last start, so a stopped computer's can be older than the service's until it starts. Compare it with the service's to show that a computer runs an older program."
+            "description": "The version of the program it ran at its last start. For this computer it is the service's `version` (see `getInfo`). In a container it is the version inside its image, and null for a container made before 0.0.17, which doesn't say, until it is made again. It is kept from its last start, so a stopped computer's can be older than the service's until it starts. Compare it with the service's to show that a computer runs an older program."
           },
           "browser": {
             "type": "boolean"
@@ -86764,7 +87002,7 @@ var OPENAPI = {
               "computer",
               "machine"
             ],
-            "description": "Whose numbers these are. computer: this computer's own, which a container's are. machine: the whole machine's, which a computer with no isolation shares with whatever else runs there, so every computer of that service reads the same; and a container's where it can't read its own."
+            "description": "Whose numbers these are. computer: the computer's own, as a container's are. machine: the whole machine's, as this computer's are, which it shares with whatever else runs there; and a container's where it can't read its own."
           },
           "cpuUsedPct": {
             "type": "number",
@@ -87136,27 +87374,143 @@ var OPENAPI = {
           }
         }
       },
+      "Readiness": {
+        "type": "object",
+        "required": [
+          "ready"
+        ],
+        "properties": {
+          "ready": {
+            "type": "boolean"
+          },
+          "reason": {
+            "type": "string",
+            "description": "Why it isn't ready, in a line a person reads. Only when it isn't."
+          }
+        }
+      },
+      "Capability": {
+        "type": "string",
+        "enum": [
+          "about",
+          "terminal",
+          "files",
+          "screen"
+        ],
+        "description": "What a computer offers its agent and the person: what it is, its terminals, its files and its screen."
+      },
+      "CapabilityState": {
+        "allOf": [
+          {
+            "$ref": "#/components/schemas/Readiness"
+          },
+          {
+            "type": "object",
+            "required": [
+              "capability"
+            ],
+            "properties": {
+              "capability": {
+                "$ref": "#/components/schemas/Capability"
+              }
+            }
+          }
+        ]
+      },
+      "BrowserKind": {
+        "type": "string",
+        "enum": [
+          "headless"
+        ],
+        "description": "headless: a headless browser with a profile of its own, beside the computer, which a person watches and controls through its live view."
+      },
+      "BrowserState": {
+        "allOf": [
+          {
+            "$ref": "#/components/schemas/Readiness"
+          },
+          {
+            "type": "object",
+            "required": [
+              "kind"
+            ],
+            "properties": {
+              "kind": {
+                "$ref": "#/components/schemas/BrowserKind"
+              }
+            }
+          }
+        ]
+      },
+      "Offer": {
+        "allOf": [
+          {
+            "$ref": "#/components/schemas/Readiness"
+          },
+          {
+            "type": "object",
+            "required": [
+              "capabilities",
+              "browsers"
+            ],
+            "properties": {
+              "capabilities": {
+                "type": "array",
+                "description": "What such a computer has, each ready or not.",
+                "items": {
+                  "$ref": "#/components/schemas/CapabilityState"
+                }
+              },
+              "browsers": {
+                "type": "array",
+                "description": "The browsers that can go with it, each ready or not.",
+                "items": {
+                  "$ref": "#/components/schemas/BrowserState"
+                }
+              }
+            }
+          }
+        ]
+      },
+      "MadeKind": {
+        "allOf": [
+          {
+            "$ref": "#/components/schemas/Offer"
+          },
+          {
+            "type": "object",
+            "required": [
+              "isolation"
+            ],
+            "properties": {
+              "isolation": {
+                "$ref": "#/components/schemas/Isolation"
+              }
+            }
+          }
+        ]
+      },
       "ServiceInfo": {
         "type": "object",
         "required": [
           "version",
-          "isolation",
-          "isolationsAvailable"
+          "thisComputer",
+          "made"
         ],
         "properties": {
           "version": {
             "type": "string"
           },
-          "isolation": {
-            "$ref": "#/components/schemas/Isolation",
-            "description": "The isolation of a computer made without saying which, chosen when the service is started."
+          "thisComputer": {
+            "$ref": "#/components/schemas/Offer",
+            "description": "This computer, the machine the service runs on, attached whole, as whoever started the service. It can be attached while ready: only where the service listens on loopback, with no proxy in front and no public address. Elsewhere it isn't offered, and one attached before is refused at start."
           },
-          "isolationsAvailable": {
+          "made": {
             "type": "array",
+            "description": "Each kind of computer it makes, ready while it can be made now. A container is ready while Docker answers on the service's machine: asked for a second here and for ten when one is made, so one that is slow can be not ready here and still be made.",
             "items": {
-              "$ref": "#/components/schemas/Isolation"
-            },
-            "description": "The isolations a computer can be made in now, `none` first. `container` is among them while Docker answers on the service's machine. It is what to offer, not a promise: Docker is asked for a second here and for ten when a container is made, so one that is slow can be missing here and still be made. If `isolation` itself is missing, a computer made without saying which is refused with 409."
+              "$ref": "#/components/schemas/MadeKind"
+            }
           }
         }
       }
@@ -87169,7 +87523,7 @@ var OPERATIONS = [
     "method": "GET",
     "path": "/v1/info",
     "tool": "service_info",
-    "summary": "What this service is and how it isolates its computers.",
+    "summary": "What this service offers: this computer, the kinds of computer it can make, and the browsers that can go with each, every one ready or not and why.",
     "status": 200,
     "hasBody": false,
     "pathParameters": [],
@@ -87184,32 +87538,251 @@ var OPERATIONS = [
       "type": "object",
       "required": [
         "version",
-        "isolation",
-        "isolationsAvailable"
+        "thisComputer",
+        "made"
       ],
       "properties": {
         "version": {
           "type": "string"
         },
-        "isolation": {
-          "type": "string",
-          "enum": [
-            "none",
-            "container"
+        "thisComputer": {
+          "allOf": [
+            {
+              "type": "object",
+              "required": [
+                "ready"
+              ],
+              "properties": {
+                "ready": {
+                  "type": "boolean"
+                },
+                "reason": {
+                  "type": "string",
+                  "description": "Why it isn't ready, in a line a person reads. Only when it isn't."
+                }
+              }
+            },
+            {
+              "type": "object",
+              "required": [
+                "capabilities",
+                "browsers"
+              ],
+              "properties": {
+                "capabilities": {
+                  "type": "array",
+                  "description": "What such a computer has, each ready or not.",
+                  "items": {
+                    "allOf": [
+                      {
+                        "type": "object",
+                        "required": [
+                          "ready"
+                        ],
+                        "properties": {
+                          "ready": {
+                            "type": "boolean"
+                          },
+                          "reason": {
+                            "type": "string",
+                            "description": "Why it isn't ready, in a line a person reads. Only when it isn't."
+                          }
+                        }
+                      },
+                      {
+                        "type": "object",
+                        "required": [
+                          "capability"
+                        ],
+                        "properties": {
+                          "capability": {
+                            "type": "string",
+                            "enum": [
+                              "about",
+                              "terminal",
+                              "files",
+                              "screen"
+                            ],
+                            "description": "What a computer offers its agent and the person: what it is, its terminals, its files and its screen."
+                          }
+                        }
+                      }
+                    ]
+                  }
+                },
+                "browsers": {
+                  "type": "array",
+                  "description": "The browsers that can go with it, each ready or not.",
+                  "items": {
+                    "allOf": [
+                      {
+                        "type": "object",
+                        "required": [
+                          "ready"
+                        ],
+                        "properties": {
+                          "ready": {
+                            "type": "boolean"
+                          },
+                          "reason": {
+                            "type": "string",
+                            "description": "Why it isn't ready, in a line a person reads. Only when it isn't."
+                          }
+                        }
+                      },
+                      {
+                        "type": "object",
+                        "required": [
+                          "kind"
+                        ],
+                        "properties": {
+                          "kind": {
+                            "type": "string",
+                            "enum": [
+                              "headless"
+                            ],
+                            "description": "headless: a headless browser with a profile of its own, beside the computer, which a person watches and controls through its live view."
+                          }
+                        }
+                      }
+                    ]
+                  }
+                }
+              }
+            }
           ],
-          "description": "The isolation of a computer made without saying which, chosen when the service is started."
+          "description": "This computer, the machine the service runs on, attached whole, as whoever started the service. It can be attached while ready: only where the service listens on loopback, with no proxy in front and no public address. Elsewhere it isn't offered, and one attached before is refused at start."
         },
-        "isolationsAvailable": {
+        "made": {
           "type": "array",
+          "description": "Each kind of computer it makes, ready while it can be made now. A container is ready while Docker answers on the service's machine: asked for a second here and for ten when one is made, so one that is slow can be not ready here and still be made.",
           "items": {
-            "type": "string",
-            "enum": [
-              "none",
-              "container"
-            ],
-            "description": "none: processes of whoever started the service. container: a container of its own, which needs Docker on the service's machine."
-          },
-          "description": "The isolations a computer can be made in now, `none` first. `container` is among them while Docker answers on the service's machine. It is what to offer, not a promise: Docker is asked for a second here and for ten when a container is made, so one that is slow can be missing here and still be made. If `isolation` itself is missing, a computer made without saying which is refused with 409."
+            "allOf": [
+              {
+                "allOf": [
+                  {
+                    "type": "object",
+                    "required": [
+                      "ready"
+                    ],
+                    "properties": {
+                      "ready": {
+                        "type": "boolean"
+                      },
+                      "reason": {
+                        "type": "string",
+                        "description": "Why it isn't ready, in a line a person reads. Only when it isn't."
+                      }
+                    }
+                  },
+                  {
+                    "type": "object",
+                    "required": [
+                      "capabilities",
+                      "browsers"
+                    ],
+                    "properties": {
+                      "capabilities": {
+                        "type": "array",
+                        "description": "What such a computer has, each ready or not.",
+                        "items": {
+                          "allOf": [
+                            {
+                              "type": "object",
+                              "required": [
+                                "ready"
+                              ],
+                              "properties": {
+                                "ready": {
+                                  "type": "boolean"
+                                },
+                                "reason": {
+                                  "type": "string",
+                                  "description": "Why it isn't ready, in a line a person reads. Only when it isn't."
+                                }
+                              }
+                            },
+                            {
+                              "type": "object",
+                              "required": [
+                                "capability"
+                              ],
+                              "properties": {
+                                "capability": {
+                                  "type": "string",
+                                  "enum": [
+                                    "about",
+                                    "terminal",
+                                    "files",
+                                    "screen"
+                                  ],
+                                  "description": "What a computer offers its agent and the person: what it is, its terminals, its files and its screen."
+                                }
+                              }
+                            }
+                          ]
+                        }
+                      },
+                      "browsers": {
+                        "type": "array",
+                        "description": "The browsers that can go with it, each ready or not.",
+                        "items": {
+                          "allOf": [
+                            {
+                              "type": "object",
+                              "required": [
+                                "ready"
+                              ],
+                              "properties": {
+                                "ready": {
+                                  "type": "boolean"
+                                },
+                                "reason": {
+                                  "type": "string",
+                                  "description": "Why it isn't ready, in a line a person reads. Only when it isn't."
+                                }
+                              }
+                            },
+                            {
+                              "type": "object",
+                              "required": [
+                                "kind"
+                              ],
+                              "properties": {
+                                "kind": {
+                                  "type": "string",
+                                  "enum": [
+                                    "headless"
+                                  ],
+                                  "description": "headless: a headless browser with a profile of its own, beside the computer, which a person watches and controls through its live view."
+                                }
+                              }
+                            }
+                          ]
+                        }
+                      }
+                    }
+                  }
+                ]
+              },
+              {
+                "type": "object",
+                "required": [
+                  "isolation"
+                ],
+                "properties": {
+                  "isolation": {
+                    "type": "string",
+                    "enum": [
+                      "none",
+                      "container"
+                    ],
+                    "description": "none: processes of whoever started the service, which only this computer has now; a computer made with no isolation before can't start again. container: a container of its own, which needs Docker on the service's machine."
+                  }
+                }
+              }
+            ]
+          }
         }
       }
     },
@@ -87253,6 +87826,7 @@ var OPERATIONS = [
           "state",
           "access",
           "isolation",
+          "attached",
           "version",
           "browser",
           "workspace",
@@ -87295,12 +87869,16 @@ var OPERATIONS = [
             ],
             "description": "The isolation it was made in. It is never run in another."
           },
+          "attached": {
+            "type": "boolean",
+            "description": "Whether it is this computer, attached rather than made: the service's machine, whole, acting as whoever started the service, with no isolation. False with isolation none marks a computer made with no isolation by an earlier version, which can't start again; its workspace is kept."
+          },
           "version": {
             "type": [
               "string",
               "null"
             ],
-            "description": "The version of the program it ran at its last start. With no isolation it is the service's `version` (see `getInfo`). In a container it is the version inside its image, and null for a container made before 0.0.17, which doesn't say, until it is made again. It is kept from its last start, so a stopped computer's can be older than the service's until it starts. Compare it with the service's to show that a computer runs an older program."
+            "description": "The version of the program it ran at its last start. For this computer it is the service's `version` (see `getInfo`). In a container it is the version inside its image, and null for a container made before 0.0.17, which doesn't say, until it is made again. It is kept from its last start, so a stopped computer's can be older than the service's until it starts. Compare it with the service's to show that a computer runs an older program."
           },
           "browser": {
             "type": "boolean"
@@ -87401,13 +87979,18 @@ var OPERATIONS = [
           "maxLength": 4096,
           "description": "The full path of a folder that exists, on the service's machine. With none, the service makes a folder, which goes when the computer is killed. A folder named here never does."
         },
+        "copyFrom": {
+          "type": "string",
+          "maxLength": 4096,
+          "description": "The full path of a folder on the service's machine. The workspace the service makes starts with a copy of what is in it, taken once when the computer is made; the folder itself is never mounted or changed. Links are copied as they are, and sockets, pipes and devices are left out. Use it instead of workspace; it needs access other than none."
+        },
         "isolation": {
           "type": "string",
           "enum": [
             "none",
             "container"
           ],
-          "description": "How it is isolated, which it keeps for as long as it exists. Left out, it is the service's own, the `isolation` that `getInfo` answers."
+          "description": "How it is isolated, which it keeps for as long as it exists: container, the default. One with no isolation is no longer made, and asking for one is refused: attach this computer instead."
         },
         "timeout": {
           "type": "integer",
@@ -87438,6 +88021,203 @@ var OPERATIONS = [
             "state",
             "access",
             "isolation",
+            "attached",
+            "version",
+            "browser",
+            "workspace",
+            "startedAt",
+            "endAt",
+            "metadata",
+            "endpoints"
+          ],
+          "properties": {
+            "computerID": {
+              "type": "string"
+            },
+            "name": {
+              "type": "string"
+            },
+            "state": {
+              "type": "string",
+              "enum": [
+                "running",
+                "stopped",
+                "failed"
+              ],
+              "description": "failed: it was to be running and isn't, because its browser or container ended by itself, or because it couldn't be brought back when the service started. Its logs say why. Stop it and start it again."
+            },
+            "access": {
+              "type": "string",
+              "enum": [
+                "none",
+                "read",
+                "files",
+                "terminal"
+              ],
+              "description": "How far it reaches into files and commands, each level containing the one before: `read` has about, read, list and search; `files` adds edit; `terminal` adds exec_command, write_stdin and list_sessions. Below terminal, the browser's code-running tool is hidden."
+            },
+            "isolation": {
+              "type": "string",
+              "enum": [
+                "none",
+                "container"
+              ],
+              "description": "The isolation it was made in. It is never run in another."
+            },
+            "attached": {
+              "type": "boolean",
+              "description": "Whether it is this computer, attached rather than made: the service's machine, whole, acting as whoever started the service, with no isolation. False with isolation none marks a computer made with no isolation by an earlier version, which can't start again; its workspace is kept."
+            },
+            "version": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "The version of the program it ran at its last start. For this computer it is the service's `version` (see `getInfo`). In a container it is the version inside its image, and null for a container made before 0.0.17, which doesn't say, until it is made again. It is kept from its last start, so a stopped computer's can be older than the service's until it starts. Compare it with the service's to show that a computer runs an older program."
+            },
+            "browser": {
+              "type": "boolean"
+            },
+            "workspace": {
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "startedAt": {
+              "type": "string",
+              "format": "date-time",
+              "description": "When it last started."
+            },
+            "endAt": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "format": "date-time",
+              "description": "When it will stop; null if it has no timeout."
+            },
+            "metadata": {
+              "type": "object",
+              "additionalProperties": {
+                "type": "string",
+                "maxLength": 1024
+              },
+              "maxProperties": 64,
+              "description": "Your own labels, kept and returned as given."
+            },
+            "endpoints": {
+              "type": "object",
+              "required": [
+                "computer",
+                "browser"
+              ],
+              "description": "MCP over Streamable HTTP, each taking the computer's access token as a bearer.",
+              "properties": {
+                "computer": {
+                  "type": [
+                    "string",
+                    "null"
+                  ],
+                  "description": "The terminal and files."
+                },
+                "browser": {
+                  "type": [
+                    "string",
+                    "null"
+                  ],
+                  "description": "The browser."
+                }
+              }
+            }
+          }
+        },
+        {
+          "type": "object",
+          "required": [
+            "accessToken"
+          ],
+          "properties": {
+            "accessToken": {
+              "type": "string",
+              "description": "Good only for this computer's endpoints. Shown only now."
+            }
+          }
+        }
+      ]
+    },
+    "websocket": false
+  },
+  {
+    "operationId": "attachComputer",
+    "method": "POST",
+    "path": "/v1/computers/attach",
+    "tool": "computer_attach",
+    "summary": "Attach this computer, the machine the service runs on, whole: its files and commands reach all of it, as whoever started the service. Each call attaches it as a computer of its own, with its own id and token. Killing one detaches it and removes nothing of the machine's. Refused with 409 by a service that other machines can reach, which doesn't offer it.",
+    "status": 201,
+    "hasBody": true,
+    "pathParameters": [],
+    "queryParameters": [],
+    "input": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "name": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 128
+        },
+        "access": {
+          "type": "string",
+          "enum": [
+            "none",
+            "read",
+            "files",
+            "terminal"
+          ],
+          "description": "How far it reaches into files and commands, each level containing the one before: `read` has about, read, list and search; `files` adds edit; `terminal` adds exec_command, write_stdin and list_sessions. Below terminal, the browser's code-running tool is hidden."
+        },
+        "browser": {
+          "type": "boolean",
+          "default": false,
+          "description": "Whether it has a headless browser of its own. With access none, it must."
+        },
+        "workspace": {
+          "type": "string",
+          "maxLength": 4096,
+          "description": "Its work folder: the full path of a folder that exists. Commands and relative paths start there and its agent is told to work there, but nothing keeps its files inside it. Detaching never removes it."
+        },
+        "timeout": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "Seconds from now until the computer stops."
+        },
+        "metadata": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "string",
+            "maxLength": 1024
+          },
+          "maxProperties": 64,
+          "description": "Your own labels, kept and returned as given."
+        }
+      },
+      "required": [
+        "access",
+        "workspace"
+      ]
+    },
+    "output": {
+      "allOf": [
+        {
+          "type": "object",
+          "required": [
+            "computerID",
+            "name",
+            "state",
+            "access",
+            "isolation",
+            "attached",
             "version",
             "browser",
             "workspace",
@@ -87480,12 +88260,16 @@ var OPERATIONS = [
               ],
               "description": "The isolation it was made in. It is never run in another."
             },
+            "attached": {
+              "type": "boolean",
+              "description": "Whether it is this computer, attached rather than made: the service's machine, whole, acting as whoever started the service, with no isolation. False with isolation none marks a computer made with no isolation by an earlier version, which can't start again; its workspace is kept."
+            },
             "version": {
               "type": [
                 "string",
                 "null"
               ],
-              "description": "The version of the program it ran at its last start. With no isolation it is the service's `version` (see `getInfo`). In a container it is the version inside its image, and null for a container made before 0.0.17, which doesn't say, until it is made again. It is kept from its last start, so a stopped computer's can be older than the service's until it starts. Compare it with the service's to show that a computer runs an older program."
+              "description": "The version of the program it ran at its last start. For this computer it is the service's `version` (see `getInfo`). In a container it is the version inside its image, and null for a container made before 0.0.17, which doesn't say, until it is made again. It is kept from its last start, so a stopped computer's can be older than the service's until it starts. Compare it with the service's to show that a computer runs an older program."
             },
             "browser": {
               "type": "boolean"
@@ -87596,6 +88380,7 @@ var OPERATIONS = [
             "state",
             "access",
             "isolation",
+            "attached",
             "version",
             "browser",
             "workspace",
@@ -87638,12 +88423,16 @@ var OPERATIONS = [
               ],
               "description": "The isolation it was made in. It is never run in another."
             },
+            "attached": {
+              "type": "boolean",
+              "description": "Whether it is this computer, attached rather than made: the service's machine, whole, acting as whoever started the service, with no isolation. False with isolation none marks a computer made with no isolation by an earlier version, which can't start again; its workspace is kept."
+            },
             "version": {
               "type": [
                 "string",
                 "null"
               ],
-              "description": "The version of the program it ran at its last start. With no isolation it is the service's `version` (see `getInfo`). In a container it is the version inside its image, and null for a container made before 0.0.17, which doesn't say, until it is made again. It is kept from its last start, so a stopped computer's can be older than the service's until it starts. Compare it with the service's to show that a computer runs an older program."
+              "description": "The version of the program it ran at its last start. For this computer it is the service's `version` (see `getInfo`). In a container it is the version inside its image, and null for a container made before 0.0.17, which doesn't say, until it is made again. It is kept from its last start, so a stopped computer's can be older than the service's until it starts. Compare it with the service's to show that a computer runs an older program."
             },
             "browser": {
               "type": "boolean"
@@ -87845,6 +88634,7 @@ var OPERATIONS = [
         "state",
         "access",
         "isolation",
+        "attached",
         "version",
         "browser",
         "workspace",
@@ -87887,12 +88677,16 @@ var OPERATIONS = [
           ],
           "description": "The isolation it was made in. It is never run in another."
         },
+        "attached": {
+          "type": "boolean",
+          "description": "Whether it is this computer, attached rather than made: the service's machine, whole, acting as whoever started the service, with no isolation. False with isolation none marks a computer made with no isolation by an earlier version, which can't start again; its workspace is kept."
+        },
         "version": {
           "type": [
             "string",
             "null"
           ],
-          "description": "The version of the program it ran at its last start. With no isolation it is the service's `version` (see `getInfo`). In a container it is the version inside its image, and null for a container made before 0.0.17, which doesn't say, until it is made again. It is kept from its last start, so a stopped computer's can be older than the service's until it starts. Compare it with the service's to show that a computer runs an older program."
+          "description": "The version of the program it ran at its last start. For this computer it is the service's `version` (see `getInfo`). In a container it is the version inside its image, and null for a container made before 0.0.17, which doesn't say, until it is made again. It is kept from its last start, so a stopped computer's can be older than the service's until it starts. Compare it with the service's to show that a computer runs an older program."
         },
         "browser": {
           "type": "boolean"
@@ -87987,6 +88781,7 @@ var OPERATIONS = [
         "state",
         "access",
         "isolation",
+        "attached",
         "version",
         "browser",
         "workspace",
@@ -88029,12 +88824,16 @@ var OPERATIONS = [
           ],
           "description": "The isolation it was made in. It is never run in another."
         },
+        "attached": {
+          "type": "boolean",
+          "description": "Whether it is this computer, attached rather than made: the service's machine, whole, acting as whoever started the service, with no isolation. False with isolation none marks a computer made with no isolation by an earlier version, which can't start again; its workspace is kept."
+        },
         "version": {
           "type": [
             "string",
             "null"
           ],
-          "description": "The version of the program it ran at its last start. With no isolation it is the service's `version` (see `getInfo`). In a container it is the version inside its image, and null for a container made before 0.0.17, which doesn't say, until it is made again. It is kept from its last start, so a stopped computer's can be older than the service's until it starts. Compare it with the service's to show that a computer runs an older program."
+          "description": "The version of the program it ran at its last start. For this computer it is the service's `version` (see `getInfo`). In a container it is the version inside its image, and null for a container made before 0.0.17, which doesn't say, until it is made again. It is kept from its last start, so a stopped computer's can be older than the service's until it starts. Compare it with the service's to show that a computer runs an older program."
         },
         "browser": {
           "type": "boolean"
@@ -88134,6 +88933,7 @@ var OPERATIONS = [
         "state",
         "access",
         "isolation",
+        "attached",
         "version",
         "browser",
         "workspace",
@@ -88176,12 +88976,16 @@ var OPERATIONS = [
           ],
           "description": "The isolation it was made in. It is never run in another."
         },
+        "attached": {
+          "type": "boolean",
+          "description": "Whether it is this computer, attached rather than made: the service's machine, whole, acting as whoever started the service, with no isolation. False with isolation none marks a computer made with no isolation by an earlier version, which can't start again; its workspace is kept."
+        },
         "version": {
           "type": [
             "string",
             "null"
           ],
-          "description": "The version of the program it ran at its last start. With no isolation it is the service's `version` (see `getInfo`). In a container it is the version inside its image, and null for a container made before 0.0.17, which doesn't say, until it is made again. It is kept from its last start, so a stopped computer's can be older than the service's until it starts. Compare it with the service's to show that a computer runs an older program."
+          "description": "The version of the program it ran at its last start. For this computer it is the service's `version` (see `getInfo`). In a container it is the version inside its image, and null for a container made before 0.0.17, which doesn't say, until it is made again. It is kept from its last start, so a stopped computer's can be older than the service's until it starts. Compare it with the service's to show that a computer runs an older program."
         },
         "browser": {
           "type": "boolean"
@@ -88425,6 +89229,8 @@ var OPERATIONS = [
 var LOOPBACK = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "::1"]);
 var WILDCARD = /* @__PURE__ */ new Set(["0.0.0.0", "::"]);
 var MAX_BODY2 = 64 * 1024;
+var NOT_HERE = "This service can be reached from other machines, so it doesn't offer the machine it runs on. Make a computer in a container, or attach this computer through a service that only this machine reaches.";
+var onlyThisMachine = (host, options) => LOOPBACK.has(host) && !options.tlsProxy && !options.publicUrl;
 function checkExposure(host, options) {
   const { tls, tlsProxy, publicUrl } = options;
   if (tls && tlsProxy) throw new Error("--tls-cert and --tls-proxy are alternatives.");
@@ -88474,8 +89280,12 @@ async function serve(options) {
   if (live)
     throw new Error(`A service is already running with its data in ${data}, at ${live.url}.`);
   let base = "";
-  await options.runtimes[options.isolation].prepare();
-  const computers = new Computers(data, () => base, options.runtimes, options.isolation);
+  const computers = new Computers(
+    data,
+    () => base,
+    options.runtimes,
+    onlyThisMachine(host, options) ? void 0 : NOT_HERE
+  );
   const handlers = createHandlers(computers);
   const routes = OPERATIONS.map((operation) => ({
     operation,
@@ -88577,13 +89387,13 @@ Connection: close\r
 ${JSON.stringify({ code: status, message })}
 `
     );
-    const { pathname } = new URL(request.url ?? "/", "http://localhost");
+    const pathname = URL.parse(request.url ?? "/", "http://localhost")?.pathname ?? "";
     const ticket = /^\/v1\/live\/([^/]+)$/.exec(pathname)?.[1];
     if (!ticket) return refuse(404, "Not found.");
     const origin = request.headers.origin;
     if (origin !== void 0 && !allowed.has(origin))
       return refuse(403, `A live session isn't opened from ${origin.slice(0, 200)}.`);
-    computers.openLive(decodeURIComponent(ticket), request, socket, head).catch((error62) => {
+    computers.openLive(ticket, request, socket, head).catch((error62) => {
       if (error62 instanceof ApiError) refuse(error62.status, error62.message);
       else socket.destroy();
     });
@@ -88598,10 +89408,7 @@ ${JSON.stringify({ code: status, message })}
   const record3 = recordOf(data);
   rmSync6(record3, { force: true });
   await computers.resume();
-  writePrivate(
-    record3,
-    JSON.stringify({ url: base, pid: process.pid, isolation: options.isolation })
-  );
+  writePrivate(record3, JSON.stringify({ url: base, pid: process.pid }));
   process.stdout.write(`AgentComputer on ${base}, data in ${data}
 `);
   let stopping = false;
@@ -88621,7 +89428,7 @@ ${JSON.stringify({ code: status, message })}
 // src/main.ts
 var USAGE = `Usage: agentcomputer <command> [--data DIR]
 
-  serve [--listen HOST:PORT] [--isolation none|container] [--image IMAGE]
+  serve [--listen HOST:PORT] [--image IMAGE]
         [--tls-cert FILE --tls-key FILE | --tls-proxy] [--public-url URL] [--allow-origin ORIGIN]...
         [--browser-name NAME] [--browser-path PATH]
                                     run the service; 127.0.0.1:7878 by default, and
@@ -88630,11 +89437,16 @@ var USAGE = `Usage: agentcomputer <command> [--data DIR]
                                     answers, printing where; one running is left as it is
   down                              stop the service, and its computers with it
   status                            where the service is running, if it is
-  info                              the service's version, the isolation it gives a computer
-                                    made without saying, and the ones it can make now
-  create --access none|read|files|terminal [--browser] [--workspace DIR] [--name NAME]
-         [--isolation none|container] [--timeout SECONDS] [--metadata KEY=VALUE]...
-                                    make a computer; prints its endpoints and token, once
+  info                              the service's version and what it offers: this computer,
+                                    the kinds it makes, and their browsers, each ready or not
+  create --access none|read|files|terminal [--browser] [--workspace DIR | --copy-from DIR]
+         [--name NAME] [--isolation container] [--timeout SECONDS] [--metadata KEY=VALUE]...
+                                    make a computer, in a container; prints its endpoints and
+                                    token, once
+  attach --access none|read|files|terminal --workspace DIR [--browser] [--name NAME]
+         [--timeout SECONDS] [--metadata KEY=VALUE]...
+                                    attach this computer, whole and acting as you, with DIR its
+                                    work folder; prints its endpoints and token, once
   list [--state running|stopped|failed]
                                     the computers
   get <id>                          one computer
@@ -88644,7 +89456,8 @@ var USAGE = `Usage: agentcomputer <command> [--data DIR]
   logs <id>                         what its servers wrote
   live <id> --surface terminal|files|browser|load [--mode watch|operate]
                                     a one-time ticket to open one live, as a WebSocket
-  kill <id>                         stop it and remove what the service made
+  kill <id>                         stop it and remove what the service made, or detach this
+                                    computer
 
 --version prints this program's version, with no service.
 
@@ -88657,7 +89470,7 @@ var UsageError = class extends Error {
 function dataFolder(given) {
   const xdg = process.env.XDG_DATA_HOME;
   return resolve5(
-    given ?? process.env.AGENTCOMPUTER_DATA ?? (xdg && isAbsolute2(xdg) ? join11(xdg, "agentcomputer") : join11(homedir2(), ".local", "share", "agentcomputer"))
+    given ?? process.env.AGENTCOMPUTER_DATA ?? (xdg && isAbsolute3(xdg) ? join11(xdg, "agentcomputer") : join11(homedir2(), ".local", "share", "agentcomputer"))
   );
 }
 var none = (data) => `No service is running with its data in ${data}. Start one: agentcomputer up`;
@@ -88694,6 +89507,7 @@ async function main() {
       output: { type: "string" },
       access: { type: "string" },
       workspace: { type: "string" },
+      "copy-from": { type: "string" },
       name: { type: "string" },
       timeout: { type: "string" },
       state: { type: "string" },
@@ -88731,8 +89545,9 @@ async function main() {
   };
   const milliseconds = (seconds2) => Number(seconds2) * 1e3;
   const { isolation } = values;
-  if (isolation !== void 0 && isolation !== "none" && isolation !== "container")
-    throw new UsageError("--isolation is none or container.");
+  for (const flag of ["isolation", "copy-from"])
+    if (values[flag] !== void 0 && command !== "create")
+      throw new UsageError(`Only create takes --${flag}.`);
   if (command === "serve") {
     const { "tls-cert": cert, "tls-key": key } = values;
     if (Boolean(cert) !== Boolean(key))
@@ -88744,7 +89559,6 @@ async function main() {
       tlsProxy: values["tls-proxy"],
       publicUrl: values["public-url"],
       allowOrigins: values["allow-origin"],
-      isolation: isolation ?? "none",
       runtimes: {
         none: new ProcessRuntime({ browser: values["browser-name"], path: values["browser-path"] }),
         container: new ContainerRuntime(values.image ?? `${IMAGE}:${VERSION2}`)
@@ -88769,31 +89583,43 @@ async function main() {
       browser: values.browser === true
     });
   const connection = connectionTo(data);
+  const making = () => {
+    if (!values.access) throw new UsageError(`${command} takes --access.`);
+    return {
+      ...connection,
+      access: values.access,
+      ...values.browser ? { browser: true } : {},
+      ...values.name ? { name: values.name } : {},
+      ...values.timeout ? { timeoutMs: milliseconds(values.timeout) } : {},
+      ...values.metadata ? {
+        metadata: Object.fromEntries(
+          values.metadata.map((pair) => {
+            const at = pair.indexOf("=");
+            if (at < 1) throw new UsageError("--metadata takes KEY=VALUE.");
+            return [pair.slice(0, at), pair.slice(at + 1)];
+          })
+        )
+      } : {}
+    };
+  };
+  const printMade = async (computer) => out({ ...await computer.getInfo(), accessToken: computer.getMcpToken() });
   switch (command) {
     case "info":
       return out(await Computer.serviceInfo(connection));
-    case "create": {
-      if (!values.access) throw new UsageError("create takes --access.");
-      const computer = await Computer.create({
-        ...connection,
-        access: values.access,
-        ...values.browser ? { browser: true } : {},
-        ...isolation ? { isolation } : {},
-        ...values.workspace ? { workspace: resolve5(values.workspace) } : {},
-        ...values.name ? { name: values.name } : {},
-        ...values.timeout ? { timeoutMs: milliseconds(values.timeout) } : {},
-        ...values.metadata ? {
-          metadata: Object.fromEntries(
-            values.metadata.map((pair) => {
-              const at = pair.indexOf("=");
-              if (at < 1) throw new UsageError("--metadata takes KEY=VALUE.");
-              return [pair.slice(0, at), pair.slice(at + 1)];
-            })
-          )
-        } : {}
-      });
-      return out({ ...await computer.getInfo(), accessToken: computer.getMcpToken() });
-    }
+    case "create":
+      return printMade(
+        await Computer.create({
+          ...making(),
+          ...isolation ? { isolation } : {},
+          ...values.workspace ? { workspace: resolve5(values.workspace) } : {},
+          ...values["copy-from"] ? { copyFrom: resolve5(values["copy-from"]) } : {}
+        })
+      );
+    case "attach":
+      if (!values.workspace) throw new UsageError("attach takes --workspace.");
+      return printMade(
+        await Computer.attach({ ...making(), workspace: resolve5(values.workspace) })
+      );
     case "list":
       return out(
         await Computer.list({