@fungi.computer/computer 0.0.0-stage → 0.1.0

package/container/pnpm-lock.yaml

@@ -0,0 +1,378 @@
+lockfileVersion: '9.0'
+
+settings:
+  autoInstallPeers: true
+  excludeLinksFromLockfile: false
+
+importers:
+
+  .:
+    dependencies:
+      esbuild:
+        specifier: 0.28.2
+        version: 0.28.2
+      fuse-native:
+        specifier: 2.2.6
+        version: 2.2.6
+      node-pty:
+        specifier: 1.1.0
+        version: 1.1.0
+      ws:
+        specifier: 8.21.3
+        version: 8.21.3
+
+packages:
+
+  '@esbuild/aix-ppc64@0.28.2':
+    resolution: {integrity: sha512-XExcO+dvLKvVtNTibSTBej1NCAbaGhWn9Ww1ZPx80qsahhPFe/8jgWP0IchNe0F3HwkU7n8ejhH8bjonqht8mQ==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [aix]
+
+  '@esbuild/android-arm64@0.28.2':
+    resolution: {integrity: sha512-5YfKeeI8qWfBZIX+u2xZC3Zlb3Os/gLS2sbEKM+I4ZOcsWmHS2WLysCcQZDAFRslDUU5Oiq44gf6PYN1vGwG5A==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [android]
+
+  '@esbuild/android-arm@0.28.2':
+    resolution: {integrity: sha512-kXXoiPVVGQcnIYGOeaovwOURpniDBpSq4A03qkQ+BMQqtGG6HYap3xne9C1O1yo4TR3qxlCX5IqqmX6fFo2Lqg==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [android]
+
+  '@esbuild/android-x64@0.28.2':
+    resolution: {integrity: sha512-O387ite7SzUyCcy3JQX4P4bLtEA7bLLkx+esve5JHnyYfNTxcVpXZo9jhdB0lTKN44gztELTdU7nS8Nr16Fs1Q==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [android]
+
+  '@esbuild/darwin-arm64@0.28.2':
+    resolution: {integrity: sha512-n4KqkOQrraxHJcgjM1RvwbigfQKIKJVpM7xp+KsxiyUSrRdIXnt73VhrPAx0fV44hgfmIVKjxMN9J1t5jySVkw==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@esbuild/darwin-x64@0.28.2':
+    resolution: {integrity: sha512-uq6suIWYP37qzGddBKPw5QEQPi6HiLGsO7UmkpfyaYNQ3D+rN6w6WfwH+nuqcGXWvawGwxOEroO4YGnFh95azw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@esbuild/freebsd-arm64@0.28.2':
+    resolution: {integrity: sha512-n+I0BTSRIoy+d6RPKnEVwql5UwBJolytvY4mAOIEJorKlqgPII8ix6slVVrfZ5Tnj7glIZvloylbB/EJPMWEXw==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [freebsd]
+
+  '@esbuild/freebsd-x64@0.28.2':
+    resolution: {integrity: sha512-78XJTJkvPs0kz2w61301PJjXl4g7q3JqiYMZ/M/yVI73EHBrCRTgkhu9oqG7vPqq+a/yadEW8aD+agKlk5xrmg==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@esbuild/linux-arm64@0.28.2':
+    resolution: {integrity: sha512-pW4AC0P3it8c7do9MVM4p51FzHzdM/TZrerurgRcHJ2WTa1VQ1CIq18xncfpBJw4ojkiZZrKW2yIBWBP92j6Ug==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [linux]
+
+  '@esbuild/linux-arm@0.28.2':
+    resolution: {integrity: sha512-XlDnu2q5yoqems+xay6wSAcg9DDD7K9RLKZEBOMZm3ckNpJBvOX20tSfby8KfrrhINDyv9V2YVZKY/SpoGJI8w==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [linux]
+
+  '@esbuild/linux-ia32@0.28.2':
+    resolution: {integrity: sha512-CYbnj78HsIeA+DhgUKgFCfvNsTHFhMMrinUrMZpDXJXKN8T3XViTZ/+wtHeVxEWY8ewSzTFN+nRmSwO2tZaLUQ==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [linux]
+
+  '@esbuild/linux-loong64@0.28.2':
+    resolution: {integrity: sha512-buwkd8nsph4R+ajRvw0qM5Hja/TXQow3ptzWO2EbG/cqcIkHloRrdlBtQlshyYGTNFvfkfJ5tpPLVkY4DtsPfQ==}
+    engines: {node: '>=18'}
+    cpu: [loong64]
+    os: [linux]
+
+  '@esbuild/linux-mips64el@0.28.2':
+    resolution: {integrity: sha512-ZVykbDyk7519VwiNb9Lcj9m8XM6v5V9uKPvrEMkkEedVewf+0itkhahp4HDpgERXhwLRpWFypsGbG/J8s0QjJA==}
+    engines: {node: '>=18'}
+    cpu: [mips64el]
+    os: [linux]
+
+  '@esbuild/linux-ppc64@0.28.2':
+    resolution: {integrity: sha512-CAXl+Dtd9UUuJd8pKKdwh6MLm3MUMiqMPmhZ3tTSXPqfyQ3vDl6R5hZdZ/kYojK4ofXtdfSv1tFq8XzWx3heNQ==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [linux]
+
+  '@esbuild/linux-riscv64@0.28.2':
+    resolution: {integrity: sha512-GeXCej4IQtU1B+QlDV8W/RRvbzI3O/Stss+/bCXv4lZls5WGRtu2a+3JkA3i4qIUlMXpcHebWpF8AkJhATowuA==}
+    engines: {node: '>=18'}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@esbuild/linux-s390x@0.28.2':
+    resolution: {integrity: sha512-3H1weTYZPxt/WOhByszQZybS9w5lKzUn1FDMsgEChbHWQwHYQQRfBxgCcZvPhjHfKyJjIievvMmEUawJrdY9Dg==}
+    engines: {node: '>=18'}
+    cpu: [s390x]
+    os: [linux]
+
+  '@esbuild/linux-x64@0.28.2':
+    resolution: {integrity: sha512-4xTZr1FUmSoQW4XIWmit3tzQrUTZM+N3P0XV8xROKYF50XfI7xeO90+1bZvNwxIufQ9hDQVRJH5YhgPVF8A/HQ==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [linux]
+
+  '@esbuild/netbsd-arm64@0.28.2':
+    resolution: {integrity: sha512-sSATRjPeDBg3pdgHoQfoYBob11Kk1FGa9lui5RIHZCoCkJa9QKlvl3/vKz2usCmYYjs7ymJR/2Nnsqe+Hjt5nw==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [netbsd]
+
+  '@esbuild/netbsd-x64@0.28.2':
+    resolution: {integrity: sha512-lqnzCV+mM0gIADaKihiCg6ifgfU2L3h5E33rNQBN1Y4MaVGnzryzmvvf7UHxprpQdE8hpqLolJ9Rl+SkIRDpyw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [netbsd]
+
+  '@esbuild/openbsd-arm64@0.28.2':
+    resolution: {integrity: sha512-AL2qJILH7lNjrDmCQDvdxMfAUIv8KMNZOvrwAQ8i8//ntL9FflhOyMJ8OZSMBb8/AWXe3/5v5S20y3zCoZWKoQ==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openbsd]
+
+  '@esbuild/openbsd-x64@0.28.2':
+    resolution: {integrity: sha512-QtiuPytchRyC4rwUKhexJdQKvDuZ6hWloi3igqPQNUJCS1/v9EiO3UTOXR6A3FoMo4fnAKbWJdqaIwhOzh8qEw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [openbsd]
+
+  '@esbuild/openharmony-arm64@0.28.2':
+    resolution: {integrity: sha512-WkhYDmpTjLvGlScA1rwjRUmhl4k8oXR3cIbtqWmELgU/dFeHHlEllxDvdWcNJV9rbzCexB5vz8gtNewWLgCT7Q==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openharmony]
+
+  '@esbuild/sunos-x64@0.28.2':
+    resolution: {integrity: sha512-GPMSkTOtMnv2U2F8gxe4Io6qmVs+YKyp832Etqqxr0hFngmXQ3rzwytelm3GIn7T4VviRUlf3sOgBOiTdvaf7g==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [sunos]
+
+  '@esbuild/win32-arm64@0.28.2':
+    resolution: {integrity: sha512-PIhhEkE9uPBleRBrQEJpUn7MBnibZzbGzYWPmY3x+YoVg/95zbjB4CxPPOQ8l5tYYM4mMaCthF8/1DIfBQQyWQ==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [win32]
+
+  '@esbuild/win32-ia32@0.28.2':
+    resolution: {integrity: sha512-YmJbfTlvU7Sdn9BB+4PRES4oB6pxgS37MAONj+hBr/cpXS1aBPKXxNnDbu+QCWPj0o9dgyxeq79g6c5P8KeuYA==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [win32]
+
+  '@esbuild/win32-x64@0.28.2':
+    resolution: {integrity: sha512-5ebpxr3nWMzrL/rnUI755Jkuee0bHL/Gq0WTF9lvcpv73wAp5eu8MfBUgWK9bhWvZjj7yX8etf/8tI8Ney695g==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [win32]
+
+  esbuild@0.28.2:
+    resolution: {integrity: sha512-HKVLS8dvII+xoKW9kmqxbRKrnWEXfJJr/FZhhJmiqIB0e053QNYFqOBouTMO/k5sID4MvCiUCvv8b9M4h32wIA==}
+    engines: {node: '>=18'}
+    hasBin: true
+
+  fuse-native@2.2.6:
+    resolution: {integrity: sha512-Y5wXd7vUsWWWIIHbjluv7jKZgPZaSVA5YWaW3I5fXIJfcGWL6IRUgoBUveQAq+D8cG9cCiGNahv9CeToccCXrw==}
+    hasBin: true
+
+  fuse-shared-library-darwin@1.1.3:
+    resolution: {integrity: sha512-4Q8gMxyMl1+gwHGpiYUoKKpi7xq8WcPo0TvJvjZzHMuCiszouu2GgEs6SJAqPB3LjfmEkl6kPV+2Oluczr0Nig==}
+
+  fuse-shared-library-linux-arm@1.0.0:
+    resolution: {integrity: sha512-Dj4ssxo1/MKGvOsVWRblSRu+o5F5OJTrVPDkjSyGDU2yKvVnIzQSwy1deiWA0qCcS/Q8iJMlZaCpCcZWSwvoug==}
+
+  fuse-shared-library-linux@1.0.1:
+    resolution: {integrity: sha512-07MQRSobrBKwW4D7oKm0gM2TwgvZWb+gC08JdiYDG4KBTncxk9ssqEDiDMKll8hpseZufsY2w1yc/feOu2DPmQ==}
+
+  fuse-shared-library@1.1.1:
+    resolution: {integrity: sha512-EfgTo/eS1euZFUe7x8KqyA40hV4DwP7kqp1VNZApu2nlPnJv8SanraBE3VXyX7ff41sxw7M0oWY7re3G3wnZVA==}
+
+  inherits@2.0.4:
+    resolution: {integrity: sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==}
+
+  nanoresource@1.3.0:
+    resolution: {integrity: sha512-OI5dswqipmlYfyL3k/YMm7mbERlh4Bd1KuKdMHpeoVD1iVxqxaTMKleB4qaA2mbQZ6/zMNSxCXv9M9P/YbqTuQ==}
+
+  napi-macros@2.2.2:
+    resolution: {integrity: sha512-hmEVtAGYzVQpCKdbQea4skABsdXW4RUh5t5mJ2zzqowJS2OyXZTU1KhDVFhx+NlWZ4ap9mqR9TcDO3LTTttd+g==}
+
+  node-addon-api@7.1.1:
+    resolution: {integrity: sha512-5m3bsyrjFWE1xf7nz7YXdN4udnVtXK6/Yfgn5qnahL6bCkf2yKt4k3nuTKAtT4r3IG8JNR2ncsIMdZuAzJjHQQ==}
+
+  node-gyp-build@4.8.4:
+    resolution: {integrity: sha512-LA4ZjwlnUblHVgq0oBF3Jl/6h/Nvs5fzBLwdEF4nuxnFdsfajde4WfxtJr3CaiH+F6ewcIB/q4jQ4UzPyid+CQ==}
+    hasBin: true
+
+  node-pty@1.1.0:
+    resolution: {integrity: sha512-20JqtutY6JPXTUnL0ij1uad7Qe1baT46lyolh2sSENDd4sTzKZ4nmAFkeAARDKwmlLjPx6XKRlwRUxwjOy+lUg==}
+
+  ws@8.21.3:
+    resolution: {integrity: sha512-201TZ/kPWxoPr/OKWjquZR1SWKXcvxdH+e1xrx89b3YbmzLMFCLfnaG1HFIgWzJOEWZ7MvpK++odZufgYR50Rw==}
+    engines: {node: '>=10.0.0'}
+    peerDependencies:
+      bufferutil: ^4.0.1
+      utf-8-validate: '>=5.0.2'
+    peerDependenciesMeta:
+      bufferutil:
+        optional: true
+      utf-8-validate:
+        optional: true
+
+snapshots:
+
+  '@esbuild/aix-ppc64@0.28.2':
+    optional: true
+
+  '@esbuild/android-arm64@0.28.2':
+    optional: true
+
+  '@esbuild/android-arm@0.28.2':
+    optional: true
+
+  '@esbuild/android-x64@0.28.2':
+    optional: true
+
+  '@esbuild/darwin-arm64@0.28.2':
+    optional: true
+
+  '@esbuild/darwin-x64@0.28.2':
+    optional: true
+
+  '@esbuild/freebsd-arm64@0.28.2':
+    optional: true
+
+  '@esbuild/freebsd-x64@0.28.2':
+    optional: true
+
+  '@esbuild/linux-arm64@0.28.2':
+    optional: true
+
+  '@esbuild/linux-arm@0.28.2':
+    optional: true
+
+  '@esbuild/linux-ia32@0.28.2':
+    optional: true
+
+  '@esbuild/linux-loong64@0.28.2':
+    optional: true
+
+  '@esbuild/linux-mips64el@0.28.2':
+    optional: true
+
+  '@esbuild/linux-ppc64@0.28.2':
+    optional: true
+
+  '@esbuild/linux-riscv64@0.28.2':
+    optional: true
+
+  '@esbuild/linux-s390x@0.28.2':
+    optional: true
+
+  '@esbuild/linux-x64@0.28.2':
+    optional: true
+
+  '@esbuild/netbsd-arm64@0.28.2':
+    optional: true
+
+  '@esbuild/netbsd-x64@0.28.2':
+    optional: true
+
+  '@esbuild/openbsd-arm64@0.28.2':
+    optional: true
+
+  '@esbuild/openbsd-x64@0.28.2':
+    optional: true
+
+  '@esbuild/openharmony-arm64@0.28.2':
+    optional: true
+
+  '@esbuild/sunos-x64@0.28.2':
+    optional: true
+
+  '@esbuild/win32-arm64@0.28.2':
+    optional: true
+
+  '@esbuild/win32-ia32@0.28.2':
+    optional: true
+
+  '@esbuild/win32-x64@0.28.2':
+    optional: true
+
+  esbuild@0.28.2:
+    optionalDependencies:
+      '@esbuild/aix-ppc64': 0.28.2
+      '@esbuild/android-arm': 0.28.2
+      '@esbuild/android-arm64': 0.28.2
+      '@esbuild/android-x64': 0.28.2
+      '@esbuild/darwin-arm64': 0.28.2
+      '@esbuild/darwin-x64': 0.28.2
+      '@esbuild/freebsd-arm64': 0.28.2
+      '@esbuild/freebsd-x64': 0.28.2
+      '@esbuild/linux-arm': 0.28.2
+      '@esbuild/linux-arm64': 0.28.2
+      '@esbuild/linux-ia32': 0.28.2
+      '@esbuild/linux-loong64': 0.28.2
+      '@esbuild/linux-mips64el': 0.28.2
+      '@esbuild/linux-ppc64': 0.28.2
+      '@esbuild/linux-riscv64': 0.28.2
+      '@esbuild/linux-s390x': 0.28.2
+      '@esbuild/linux-x64': 0.28.2
+      '@esbuild/netbsd-arm64': 0.28.2
+      '@esbuild/netbsd-x64': 0.28.2
+      '@esbuild/openbsd-arm64': 0.28.2
+      '@esbuild/openbsd-x64': 0.28.2
+      '@esbuild/openharmony-arm64': 0.28.2
+      '@esbuild/sunos-x64': 0.28.2
+      '@esbuild/win32-arm64': 0.28.2
+      '@esbuild/win32-ia32': 0.28.2
+      '@esbuild/win32-x64': 0.28.2
+
+  fuse-native@2.2.6:
+    dependencies:
+      fuse-shared-library: 1.1.1
+      nanoresource: 1.3.0
+      napi-macros: 2.2.2
+      node-gyp-build: 4.8.4
+
+  fuse-shared-library-darwin@1.1.3: {}
+
+  fuse-shared-library-linux-arm@1.0.0: {}
+
+  fuse-shared-library-linux@1.0.1: {}
+
+  fuse-shared-library@1.1.1:
+    dependencies:
+      fuse-shared-library-darwin: 1.1.3
+      fuse-shared-library-linux: 1.0.1
+      fuse-shared-library-linux-arm: 1.0.0
+
+  inherits@2.0.4: {}
+
+  nanoresource@1.3.0:
+    dependencies:
+      inherits: 2.0.4
+
+  napi-macros@2.2.2: {}
+
+  node-addon-api@7.1.1: {}
+
+  node-gyp-build@4.8.4: {}
+
+  node-pty@1.1.0:
+    dependencies:
+      node-addon-api: 7.1.1
+
+  ws@8.21.3: {}

package/container/pnpm-workspace.yaml

@@ -0,0 +1,5 @@
+# Standalone install for the Computer image; not a member of the repo workspace.
+allowBuilds:
+  node-pty: true
+  fuse-native: true
+  esbuild: true

package/container/resource-bounds.mjs

@@ -0,0 +1,54 @@
+/** The Computer ceiling shared by the platform image and on-box host. */
+export const computerResourceBounds = Object.freeze({
+  vcpus: 4,
+  memoryMib: 12_288,
+  diskGib: 20,
+  pidsMax: 256,
+  maxRuntimeMs: 24 * 60 * 60 * 1_000,
+});
+
+/** Proofs may shorten a runtime, but no start may extend the ceiling. */
+export function boundedRuntimeMs(value) {
+  if (value === undefined) return computerResourceBounds.maxRuntimeMs;
+  return boundedInteger(
+    "runtime deadline",
+    Number(value),
+    1_000,
+    computerResourceBounds.maxRuntimeMs,
+  );
+}
+
+function boundedInteger(name, value, minimum, maximum) {
+  const valid = Number.isInteger(value) && value >= minimum && value <= maximum;
+  if (!valid) throw new Error(`Computer ${name} exceeds its resource bound`);
+  return value;
+}
+
+export function computerRuntimeExpired(startedAt, now, maximumRuntimeMs) {
+  return now - startedAt >= maximumRuntimeMs;
+}
+
+/** The host may provision a smaller VM, never a larger Computer. */
+export function boundedVmResources({ vcpus, memMib, diskGib, pidsMax }) {
+  return {
+    vcpus: boundedInteger("vcpus", vcpus, 1, computerResourceBounds.vcpus),
+    memMib: boundedInteger(
+      "memMib",
+      memMib,
+      1,
+      computerResourceBounds.memoryMib,
+    ),
+    diskGib: boundedInteger(
+      "diskGib",
+      diskGib,
+      1,
+      computerResourceBounds.diskGib,
+    ),
+    pidsMax: boundedInteger(
+      "pidsMax",
+      pidsMax,
+      1,
+      computerResourceBounds.pidsMax,
+    ),
+  };
+}

package/container/runtime-privileges.cc

@@ -0,0 +1,37 @@
+#include <node_api.h>
+#include <grp.h>
+#include <sys/prctl.h>
+#include <unistd.h>
+#include <cerrno>
+#include <cstring>
+
+// This runs only after FUSE is mounted and before any runtime listener opens.
+// libc's credential calls update every thread, including FUSE's worker threads.
+static napi_value enterRuntimePhase(napi_env env, napi_callback_info info) {
+  size_t count = 1;
+  napi_value args[1];
+  uint32_t uid;
+  if (napi_get_cb_info(env, info, &count, args, nullptr, nullptr) != napi_ok ||
+      count != 1 || napi_get_value_uint32(env, args[0], &uid) != napi_ok ||
+      uid < 100000 || uid > 2000099999 || getuid() != 0) {
+    napi_throw_error(env, nullptr, "Invalid privileged mount transition");
+    return nullptr;
+  }
+  if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) != 0 ||
+      setgroups(0, nullptr) != 0 || setresgid(uid, uid, uid) != 0 ||
+      setresuid(uid, uid, uid) != 0) {
+    napi_throw_error(env, nullptr, strerror(errno));
+    return nullptr;
+  }
+  napi_value result;
+  napi_get_undefined(env, &result);
+  return result;
+}
+static napi_value initialize(napi_env env, napi_value exports) {
+  napi_value fn;
+  napi_create_function(env, "enterRuntimePhase", NAPI_AUTO_LENGTH,
+                       enterRuntimePhase, nullptr, &fn);
+  napi_set_named_property(env, exports, "enterRuntimePhase", fn);
+  return exports;
+}
+NAPI_MODULE(NODE_GYP_MODULE_NAME, initialize)

package/container/runtime-privileges.mjs

@@ -0,0 +1,11 @@
+import process from "node:process";
+import { createRequire } from "node:module";
+const loadNative = createRequire(import.meta.url);
+const native = loadNative("./runtime-privileges.node");
+
+export function enterRuntimePhase() {
+  const uid = Number(process.env.COMPUTER_RUNTIME_UID);
+  if (!Number.isSafeInteger(uid) || uid < 100_000 || uid > 2_000_099_999)
+    throw new Error("Invalid Computer runtime UID");
+  native.enterRuntimePhase(uid);
+}

package/container/terminal-assets/README.md

@@ -0,0 +1,35 @@
+# Computer shell assets
+
+`git-prompt.sh` is the supplied Git v2.34.1 contrib implementation, retaining
+its upstream license and branch detection. `bashrc` adapts the supplied
+Botanical prompt to show the numeric exit status, user/Computer and short cwd,
+with Caps/Stipe colors for the prompt and ls/grep. It honors `NO_COLOR` and
+`TERM=dumb`. An interactive guard keeps command and agent shells quiet.
+
+The retained client source is `terminal-banner.ts` from the reference snapshot
+in `.botanical/old-terminal-juice`: welcome art, status and hint belong to Shed,
+never to the shell. The spacing fix is `fdc3b2a9`; raw-terminal CRLF is
+`d7872a5b`. Shared art now lives in `packages/lantern/src/art`, exported through
+`@fungi.computer/lantern/banner` for Shed and the CLI family. No banner renderer
+or art is copied into the Computer image.
+
+The real path is Shed `TerminalPanel` → Agar `openComputerTerminal` → Hub
+Computer admission → Computer `terminalAfterAcceptance` → terminal server
+`TerminalSessions.#open` → Bash login → system bashrc/profile. The PTY's ready
+control frame supplies bounded display facts separately from shell output. Agar
+decodes them; Shed renders the width-aware welcome before reading buffered PTY
+output. Socket reconnects reuse the session; theme swaps replay Shed's bounded
+output history without opening another connection or adding a banner. A
+deliberate reopen clears the prior display and welcomes the new session.
+
+Team delivers the directory name to Computer on create/replay; Computer stores
+it locally. The admitted private PTY URL supplies the name, owning Team ID and
+`Team inference` model-door label, never credentials or provider URLs. Only the
+Computer name enters Bash's environment for its prompt. Ready metadata reports
+the terminal server's actual uptime and image package version.
+
+The existing Shed renderer is Ghostty, as in the retained Dashboard. Its browser
+proof checks real cells at wide and narrow widths, connection ordering, retries
+and theme replay. Computerd command execution is separate and receives no
+welcome bytes. Local image proof checks the prompt and absence of art/hints on
+an interactive PTY, plus quiet non-interactive startup.

package/container/terminal-assets/bashrc

@@ -0,0 +1,49 @@
+# Retained interactive Bash prompt, adapted from Botanical's shell assets.
+# This file is sourced by the image's system bashrc (including login shells).
+case $- in
+  *i*) ;;
+  *) return ;;
+esac
+[[ ${_FUNGI_SHELL_READY:-} ]] && return
+_FUNGI_SHELL_READY=1
+
+shopt -s checkwinsize histappend
+# Branches, Computer names and directories are data, not prompt shell code.
+shopt -u promptvars
+export HISTCONTROL=ignoreboth
+export HISTSIZE=10000
+. /opt/fungi/terminal-assets/git-prompt.sh
+
+# Caps mocha: coral directories, teal links, green executables, pink archives.
+if [[ -t 1 && ! ${NO_COLOR+x} && ${TERM:-dumb} != dumb ]]; then
+  export LS_COLORS='di=38;2;249;130;132:ln=38;2;148;226;213:ex=38;2;166;227;161:*.tar=38;2;245;194;231:*.gz=38;2;245;194;231:*.zip=38;2;245;194;231'
+  export GREP_COLORS='ms=38;2;249;130;132'
+  alias ls='ls --color=auto'
+  alias grep='grep --color=auto'
+else
+  unset LS_COLORS
+  alias ls='ls --color=never'
+  alias grep='grep --color=never'
+fi
+
+_FUNGI_UPDATE_PS1() {
+  local exit_code=$? mark='✓' branch='' dirty='' tint='' reset=''
+  [[ $exit_code == 0 ]] || mark="✗ $exit_code"
+  if [[ -t 1 && ! ${NO_COLOR+x} && ${TERM:-dumb} != dumb ]]; then
+    tint='\[\e[38;2;249;130;132m\]'
+    reset='\[\e[0m\]'
+  fi
+  branch=$(__git_ps1 '%s' 2>/dev/null)
+  if [[ -n $branch ]]; then
+    [[ -z $(git status --porcelain 2>/dev/null) ]] || dirty=' *'
+    branch=" git:($branch)$dirty"
+  fi
+  local computer=${FUNGI_COMPUTER_NAME:-Computer}
+  # Strip prompt escapes/control bytes from names and branch text.
+  computer=${computer//[[:cntrl:]]/}
+  computer=${computer//\\/?}
+  branch=${branch//[[:cntrl:]]/}
+  branch=${branch//\\/?}
+  PS1="$tint$mark ${USER:-fungi}@$computer \W$branch$reset ➜ "
+}
+PROMPT_COMMAND=_FUNGI_UPDATE_PS1