@agentorg/computer 0.0.20 → 0.0.21

package/README.md

@@ -36,6 +36,7 @@ This computer:
 
 - **It is offered only by a service that no other machine reaches:** one that listens on loopback, with no `--tls-proxy` and no `--public-url`. A service that other machines can reach is a server, and doesn't offer its own machine. There `info` says why, attaching is refused with 409 in the same words, and a computer attached before is refused at start.
 - **`--workspace`, which `attach` needs, is its work folder.** Commands and relative paths start there, and `about` names it. But its files reach the whole machine, as whoever started the service, and so do its commands at `--access terminal`.
+- **Its commands, and a shell a person opens, get the environment the service was started with,** less every `AGENTCOMPUTER_` variable. That is no wall either: commands run in a login shell, so what the person's profile exports comes back, and with the terminal on an agent can read any of the person's processes' environment, the service's among them, with `ps -E`. So start the service from a shell holding nothing an agent shouldn't read.
 - **`kill` detaches it.** What the service kept for it goes, and nothing of the machine's.
 - **Its browser,** with `--browser`, is a headless one with a profile of its own. It runs the Chrome installed on the machine, or what `serve --browser-name` or `--browser-path` names. `info` says whether that program is there.
 - **Or the person's own browser,** with `--own-browser` (`browser: "own"`): their Chrome or Edge, whichever has remote debugging on, Chrome where both do, as they use it, signed in. Its agent works in it with the same tools, and the person watches it in the same live view.
@@ -55,7 +56,11 @@ This computer:
   - The grants are read from that driver, and listed under the outermost app the driver is inside.
   - Asked for, they are asked for by the app: the service opens it through the system with `--args grant` and each grant to ask for, `screen-recording` or `accessibility`, which it asks for in turn.
   - Once a grant changes, the app restarts its driver, which reads grants once. That ends the connections of computers using the screen, which then say Cua Driver has stopped.
-- **What the service starts of Cua Driver sends no telemetry.** The person's own Cua Driver app follows its own setting, which `cua-driver telemetry disable` turns off.
+- **What the service starts of Cua Driver sends no telemetry and checks for no updates,** so no update notice reaches a computer's log. The person's own Cua Driver app follows its own settings: `cua-driver telemetry disable` turns its telemetry off.
+
+**Upgrading from 0.0.20:**
+
+- **Commands on this computer no longer get the service's own `AGENTCOMPUTER_` variables,** such as `AGENTCOMPUTER_API_KEY` where the shell that started the service held it. A command that read one should be given what it needs another way.
 
 **Upgrading from 0.0.19:**
 
@@ -196,6 +201,7 @@ These take the control token, kept in the data folder. A computer's own endpoint
 - **The person's switches.** Each part of this computer an agent can use (`terminal`, `files`, `screen`, and `browser`, the person's own) has the person's own switch.
   - Off, agents' new calls to that part refuse with "The person turned off the screen for agents on this Mac" (or "this machine" off macOS), `info` says the same, and attaching with the screen or the person's browser is refused with 409. What an agent already started, such as a command, runs on.
   - The terminal and the screen each reach the whole machine: with the terminal on, commands read and change any file, whatever the files' switch; with the screen on, the agent acts in any app.
+  - So the switches tell an agent what it may use; they don't stop it. With the terminal, the files or the screen on, an agent acts as the person and can read the service's control token in its data folder, like any file of theirs; with the terminal or the screen, it can use it to set the other switches.
   - Any browser's calls that reach the machine answer to its switches too: `browser_run_code_unsafe` to the terminal's, and a call that names files, by `paths` or `filename`, to the files'.
   - The computer's own endpoint on this machine reads each call whole and checks it as it arrives, so it takes one JSON-RPC request in each POST, as the browser's does, and refuses a batch.
   - A service started with `--lend` starts with every switch off, for the person to turn on. Any other starts with every one on. They are kept in the data folder, so they last across a restart. A switches file that can't be read leaves every one off.

package/dist/agentcomputer.js

@@ -97884,7 +97884,8 @@ var DRIVER_TOOLS = [
   "bring_to_front"
 ];
 var INSTALL = "Install the signed app from cua.ai/download";
-var quiet = () => ({ ...process.env, DO_NOT_TRACK: "1" });
+var QUIET = { DO_NOT_TRACK: "1", CUA_DRIVER_RS_UPDATE_CHECK: "false" };
+var quiet = () => ({ ...process.env, ...QUIET });
 var program = (path) => {
   try {
     const found = statSync2(path);
@@ -98769,7 +98770,7 @@ var ProcessRuntime = class {
 };
 
 // src/handlers.ts
-var VERSION2 = "0.0.20";
+var VERSION2 = "0.0.21";
 function createHandlers(computers, connections, setup) {
   return {
     getInfo: async () => ({ version: VERSION2, ...await computers.offers() }),
@@ -100697,7 +100698,7 @@ var OPENAPI = {
   "openapi": "3.1.0",
   "info": {
     "title": "AgentComputer",
-    "version": "0.0.20",
+    "version": "0.0.21",
     "description": "Computers for agents. This file is the source of truth: the HTTP API, the MCP control tools and the SDK are all generated from it. An operation with `x-mcp-tool` is also an MCP tool of that name.",
     "license": {
       "name": "Apache-2.0",
@@ -106424,7 +106425,7 @@ var Setup = class {
   /**
    * Cua Driver's own grant, with its app running first, started through the system so that the
    * Mac names CuaDriver in what it asks, not whatever started the service. It asks in its own
-   * order, Accessibility first. Neither sends telemetry.
+   * order, Accessibility first. Neither sends telemetry nor checks for updates.
    */
   async #askScreen(driver) {
     const answers = async () => (await driverGrants(driver)).accessibility !== void 0;
@@ -106434,8 +106435,7 @@ var Setup = class {
         "-g",
         "-a",
         app.app,
-        "--env",
-        "DO_NOT_TRACK=1",
+        ...Object.entries(QUIET).flatMap(([name, value]) => ["--env", `${name}=${value}`]),
         "--args",
         "serve"
       ]);
@@ -106624,6 +106624,8 @@ async function main() {
   if (values["own-browser"] && values.browser)
     throw new UsageError("Take --browser or --own-browser: a computer has one browser.");
   if (command === "serve") {
+    for (const name of Object.keys(process.env))
+      if (name.startsWith("AGENTCOMPUTER_")) delete process.env[name];
     const switches = new Switches(data, values.lend === true);
     const { "tls-cert": cert, "tls-key": key } = values;
     if (Boolean(cert) !== Boolean(key))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentorg/computer",
-  "version": "0.0.20",
+  "version": "0.0.21",
   "description": "Computers for agents, as a service: a terminal, files and a browser over MCP",
   "license": "Apache-2.0",
   "repository": {