@fungi.computer/oyster 0.3.2 → 0.4.0

package/dist/agent-computer-source.d.ts

@@ -0,0 +1,42 @@
+import { type ComputerConnectionOptions, type FilesPort, type KnapsackComputer } from "@fungi.computer/knapsack";
+import type { CapabilitySource } from "@fungi.computer/mycelium";
+import type { AgentComputerAdmission, AgentComputerProjection } from "./agent-computers.js";
+/** The host's captured authority namespace, Agent and attachment projection. */
+export type AgentComputerSnapshot = Readonly<{
+    scopeId: string;
+    agentId: string;
+    projection: AgentComputerProjection;
+}>;
+/** Host adapters supply transport, not a second attachment owner. */
+export type AgentComputerPorts = Readonly<{
+    files: FilesPort;
+    computer: KnapsackComputer;
+}>;
+export type AgentComputerConnection = Readonly<{
+    scopeId: string;
+    agentId: string;
+    attachment: AgentComputerProjection["attachments"][number];
+    /** Re-read on every operation; captured handles cannot follow a reattachment. */
+    admission: () => AgentComputerAdmission | null;
+}>;
+/** A host-owned projection reader and the transport for its captured attachments. */
+export type AgentComputerSourceOptions = Readonly<{
+    read: () => AgentComputerSnapshot | null;
+    subscribe: (invalidate: () => void) => () => void;
+    connect: (connection: AgentComputerConnection) => AgentComputerPorts;
+    onUnavailable?: (detail: {
+        computerId: string;
+        reason: unknown;
+    }) => void;
+}>;
+/** Capture each named Computer and its Files port under the same authority. */
+export declare function readAgentComputerConnections(options: Pick<AgentComputerSourceOptions, "read" | "connect">): readonly (ComputerConnectionOptions & {
+    attachmentId: string;
+    files: {
+        port: FilesPort;
+    };
+})[];
+/** Discover the captured connections; current admission remains a per-call host check. */
+export declare function createAgentComputerSource(options: AgentComputerSourceOptions): CapabilitySource;
+/** Advertise only the denied shape; no attachment lookup or Computer wake. */
+export declare function createAgentComputerSurface(): CapabilitySource;

package/dist/agent-computer-source.js

@@ -0,0 +1,88 @@
+import { Knapsack, } from "@fungi.computer/knapsack";
+import { computerCapabilities, computerValueSchema, } from "@fungi.computer/computer-contract";
+/** Capture each named Computer and its Files port under the same authority. */
+export function readAgentComputerConnections(options) {
+    return capturedConnections(options, options.read());
+}
+function capturedConnections(options, captured) {
+    if (captured === null)
+        return [];
+    return captured.projection.attachments.map((attachment) => {
+        const ports = options.connect({
+            scopeId: captured.scopeId,
+            agentId: captured.agentId,
+            attachment,
+            admission: () => {
+                const current = options.read();
+                if (current?.scopeId !== captured.scopeId ||
+                    current.agentId !== captured.agentId)
+                    return null;
+                return (current.projection.attachments.find((candidate) => candidate.attachmentId === attachment.attachmentId &&
+                    candidate.computerId === attachment.computerId &&
+                    candidate.version === attachment.version)?.admission ?? null);
+            },
+        });
+        return {
+            id: `computer:${attachment.attachmentId}`,
+            attachmentId: attachment.attachmentId,
+            name: attachment.name,
+            namespace: ["computers"],
+            files: { port: ports.files },
+            computer: ports.computer,
+        };
+    });
+}
+/** Discover the captured connections; current admission remains a per-call host check. */
+export function createAgentComputerSource(options) {
+    return Knapsack.computers({
+        id: "agent-computers",
+        subscribe: options.subscribe,
+        onUnavailable: (detail) => {
+            console.warn("Agent Computer unavailable", detail);
+            options.onUnavailable?.(detail);
+        },
+        read: () => {
+            const captured = options.read();
+            return {
+                version: JSON.stringify([
+                    captured?.scopeId ?? null,
+                    captured?.agentId ?? null,
+                    captured?.projection.revision ?? 0,
+                ]),
+                connections: capturedConnections(options, captured),
+            };
+        },
+    });
+}
+const refusedBeforeRun = () => Promise.reject(new Error("The tool gate refuses this call before it runs"));
+/** Advertise only the denied shape; no attachment lookup or Computer wake. */
+export function createAgentComputerSurface() {
+    return Knapsack.computers({
+        id: "agent-computers-surface",
+        subscribe: () => () => undefined,
+        onUnavailable: () => undefined,
+        read: () => ({
+            version: "surface",
+            connections: [
+                {
+                    id: "computer:surface",
+                    name: "computer",
+                    namespace: ["computers"],
+                    files: {
+                        port: {
+                            read: refusedBeforeRun,
+                            list: refusedBeforeRun,
+                            glob: refusedBeforeRun,
+                            grep: refusedBeforeRun,
+                            replace: refusedBeforeRun,
+                        },
+                    },
+                    computer: {
+                        getCapabilities: () => Promise.resolve(computerValueSchema.parse(computerCapabilities())),
+                        call: refusedBeforeRun,
+                    },
+                },
+            ],
+        }),
+    });
+}

package/dist/agent-computers.d.ts

@@ -0,0 +1,104 @@
+import type { WatchdogSqliteOwner } from "@fungi.computer/watchdog";
+import { z } from "zod";
+declare const attachmentIdentitySchema: z.ZodObject<{
+    attachmentId: z.ZodString;
+    agentId: z.ZodString;
+    computerId: z.ZodString;
+    version: z.ZodNumber;
+}, z.core.$strict>;
+export declare const projectionSchema: z.ZodObject<{
+    revision: z.ZodNumber;
+    attachments: z.ZodArray<z.ZodObject<{
+        attachmentId: z.ZodString;
+        agentId: z.ZodString;
+        computerId: z.ZodString;
+        version: z.ZodNumber;
+        name: z.ZodString;
+        admission: z.ZodNullable<z.ZodObject<{
+            grantId: z.ZodString;
+            agentId: z.ZodString;
+            attachmentId: z.ZodString;
+            operations: z.ZodArray<z.ZodEnum<{
+                "computer.list": "computer.list";
+                "computer.readFile": "computer.readFile";
+                "computer.writeFile": "computer.writeFile";
+                "computer.execute": "computer.execute";
+            }>>;
+            attachmentVersion: z.ZodNumber;
+            revision: z.ZodNumber;
+            expiresAt: z.ZodNumber;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type AgentComputerProjection = z.output<typeof projectionSchema>;
+/** The parsed admission fields shared by the projection and the host's read port. */
+export type AgentComputerAdmissionFields = NonNullable<AgentComputerProjection["attachments"][number]["admission"]>;
+/** Host-issued attachment admission; the host owns its policy and delivery. */
+export type AgentComputerAdmission = Readonly<Omit<AgentComputerAdmissionFields, "operations"> & {
+    operations: readonly AgentComputerAdmissionFields["operations"][number][];
+}>;
+export type ComputerAttachmentInput = Readonly<{
+    agentId: string;
+    attachmentId: string;
+    computerId: string;
+    requestId: string;
+}>;
+export type AttachComputer = ComputerAttachmentInput;
+export type DetachComputer = ComputerAttachmentInput;
+export type AttachmentVersion = Readonly<{
+    computerId: string;
+    agentId: string;
+    attachmentId: string;
+    version: number;
+}>;
+/** Renew a held Computer admission before its delivered grant expires. */
+export declare const AGENT_ADMISSION_RENEW_BEFORE_MS = 30000;
+export type AgentComputers = Readonly<{
+    attachComputer(c: AttachComputer): AgentComputerProjection;
+    detachComputer(c: DetachComputer): AgentComputerProjection;
+    /** The attachment owner's transactionally advanced projection generation. */
+    revision(agentId: string): number;
+    read(agentId: string): AgentComputerProjection;
+    refresh(agentId: string, force?: boolean): AgentComputerProjection;
+    /** Every live attachment, for host-wide admission renewal or suspension. */
+    attachments(): readonly AttachmentVersion[];
+    /** Git admission reads live links through their owner, without foreign SQL. */
+    attachedComputers(agentId: string): readonly string[];
+    attachedAgents(computerId: string): readonly string[];
+    nextRenewal(): number | null;
+    /** Void every live attachment's decision by moving its version past it. */
+    onLifecycle(status: "active" | "suspended", revision: number): void;
+}>;
+export declare const attachComputerInputSchema: z.ZodObject<{
+    agentId: z.ZodString;
+    attachmentId: z.ZodString;
+    computerId: z.ZodString;
+    requestId: z.ZodString;
+}, z.core.$strict>;
+export declare const detachComputerInputSchema: z.ZodObject<{
+    agentId: z.ZodString;
+    attachmentId: z.ZodString;
+    computerId: z.ZodString;
+    requestId: z.ZodString;
+}, z.core.$strict>;
+export declare const readAgentComputersInputSchema: z.ZodObject<{
+    agentId: z.ZodString;
+}, z.core.$strict>;
+export declare function createAgentComputers(options: Readonly<{
+    sql: WatchdogSqliteOwner["sql"];
+    transactionSync: <T>(body: () => T) => T;
+    /** Record Computer denial in the same transaction that detaches this relationship. */
+    revoke: (requestId: string, attachment: z.output<typeof attachmentIdentitySchema>) => void;
+    /** Read the host-owned friendly name for one attached Computer. */
+    readComputerName: (computerId: string) => string;
+    /** Stage a host-owned projection in the mutation transaction. */
+    enqueueProjection?: (agentId: string, projection: AgentComputerProjection) => void;
+    ensureAdmissions?: (attachments: AgentComputerProjection["attachments"]) => boolean;
+    readAdmission?: (attachment: {
+        agentId: string;
+        attachmentId: string;
+        computerId: string;
+        version: number;
+    }) => AgentComputerAdmission | null;
+}>): AgentComputers;
+export {};

package/dist/agent-computers.js

@@ -0,0 +1,227 @@
+import { z } from "zod";
+const text = z.string().min(1).max(256);
+const noChange = Symbol("no-change");
+const attachmentRowSchema = z.strictObject({
+    attachment_id: z.string(),
+    agent_id: z.string(),
+    computer_id: z.string(),
+    version: z.number().int().positive(),
+});
+const attachmentIdentitySchema = z.strictObject({
+    attachmentId: text,
+    agentId: text,
+    computerId: text,
+    version: z.number().int().nonnegative(),
+});
+const attachmentProjectionSchema = attachmentIdentitySchema.extend({
+    name: text,
+    admission: z
+        .strictObject({
+        grantId: text,
+        agentId: text,
+        attachmentId: text,
+        operations: z.array(z.enum([
+            "computer.list",
+            "computer.readFile",
+            "computer.writeFile",
+            "computer.execute",
+        ])),
+        attachmentVersion: z.number().int().positive(),
+        revision: z.number().int().positive(),
+        expiresAt: z.number().int().positive(),
+    })
+        .nullable(),
+});
+export const projectionSchema = z.strictObject({
+    revision: z.number().int().nonnegative(),
+    attachments: z.array(attachmentProjectionSchema),
+});
+class AgentComputersError extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+    }
+}
+/** Renew a held Computer admission before its delivered grant expires. */
+export const AGENT_ADMISSION_RENEW_BEFORE_MS = 30_000;
+const computerAttachmentInputSchema = z.strictObject({
+    agentId: text,
+    attachmentId: text,
+    computerId: text,
+    requestId: text,
+});
+export const attachComputerInputSchema = computerAttachmentInputSchema;
+export const detachComputerInputSchema = computerAttachmentInputSchema;
+export const readAgentComputersInputSchema = z.strictObject({ agentId: text });
+export function createAgentComputers(options) {
+    const { sql, transactionSync } = options;
+    const ensure = () => {
+        sql.exec("CREATE TABLE IF NOT EXISTS hub_agent_computers (attachment_id TEXT PRIMARY KEY, agent_id TEXT NOT NULL, computer_id TEXT NOT NULL, version INTEGER NOT NULL, attached INTEGER NOT NULL CHECK (attached IN (0, 1)), UNIQUE (agent_id, computer_id)) STRICT");
+        sql.exec("CREATE TABLE IF NOT EXISTS hub_agent_computer_revisions (agent_id TEXT PRIMARY KEY, revision INTEGER NOT NULL) STRICT");
+        sql.exec("CREATE TABLE IF NOT EXISTS hub_agent_computer_receipts (request_id TEXT PRIMARY KEY, agent_id TEXT NOT NULL, operation TEXT NOT NULL, input TEXT NOT NULL, attachment_id TEXT, revision INTEGER NOT NULL, result TEXT NOT NULL) STRICT");
+    };
+    transactionSync(ensure);
+    const revision = (agentId) => z
+        .number()
+        .int()
+        .nonnegative()
+        .parse(sql
+        .exec("SELECT revision FROM hub_agent_computer_revisions WHERE agent_id = ?", agentId)
+        .toArray()[0]?.revision ?? 0);
+    const read = (agentId) => {
+        const attachments = sql
+            .exec("SELECT attachment_id, agent_id, computer_id, version FROM hub_agent_computers WHERE agent_id = ? AND attached = 1 ORDER BY attachment_id", agentId)
+            .toArray()
+            .map((row) => attachmentRowSchema.parse(row))
+            .map((r) => ({
+            attachmentId: r.attachment_id,
+            agentId: r.agent_id,
+            computerId: r.computer_id,
+            version: r.version,
+            name: options.readComputerName(r.computer_id),
+            admission: options.readAdmission?.({
+                attachmentId: r.attachment_id,
+                agentId: r.agent_id,
+                computerId: r.computer_id,
+                version: r.version,
+            }) ?? null,
+        }));
+        return projectionSchema.parse({ revision: revision(agentId), attachments });
+    };
+    const commit = (agentId, operation, requestId, payload, mutate) => transactionSync(() => {
+        const input = JSON.stringify({ agentId, operation, payload });
+        const old = sql
+            .exec("SELECT agent_id, operation, input, result FROM hub_agent_computer_receipts WHERE request_id = ?", requestId)
+            .toArray()[0];
+        if (old) {
+            if (old.agent_id !== agentId ||
+                old.operation !== operation ||
+                old.input !== input)
+                throw new AgentComputersError("request_conflict");
+            return projectionSchema.parse(JSON.parse(z.string().parse(old.result)));
+        }
+        const changed = mutate();
+        const before = read(agentId);
+        if (changed === noChange) {
+            sql.exec("INSERT INTO hub_agent_computer_receipts (request_id,agent_id,operation,input,attachment_id,revision,result) VALUES (?,?,?,?,NULL,?,?)", requestId, agentId, operation, input, before.revision, JSON.stringify(before));
+            return before;
+        }
+        const revision = before.revision + 1;
+        sql.exec("INSERT INTO hub_agent_computer_revisions (agent_id,revision) VALUES (?,?) ON CONFLICT (agent_id) DO UPDATE SET revision=excluded.revision", agentId, revision);
+        const beforeAdmission = read(agentId);
+        options.ensureAdmissions?.(beforeAdmission.attachments);
+        const current = read(agentId);
+        sql.exec("INSERT INTO hub_agent_computer_receipts (request_id,agent_id,operation,input,attachment_id,revision,result) VALUES (?,?,?,?,?,?,?)", requestId, agentId, operation, input, changed, revision, JSON.stringify(current));
+        options.enqueueProjection?.(agentId, current);
+        return current;
+    });
+    const attachComputer = (raw) => {
+        const c = attachComputerInputSchema.parse(raw);
+        const payload = { attachmentId: c.attachmentId, computerId: c.computerId };
+        return commit(c.agentId, "attachComputer", c.requestId, payload, () => {
+            const row = sql
+                .exec("SELECT agent_id, computer_id, attached FROM hub_agent_computers WHERE attachment_id=?", c.attachmentId)
+                .toArray()[0];
+            if (row !== undefined &&
+                (row.agent_id !== c.agentId || row.computer_id !== c.computerId))
+                throw new AgentComputersError("attachment_identity_conflict");
+            let changed = false;
+            if (row?.attached === 0) {
+                sql.exec("UPDATE hub_agent_computers SET attached=1,version=version+1 WHERE attachment_id=?", c.attachmentId);
+                changed = true;
+            }
+            else if (row === undefined) {
+                sql.exec("INSERT INTO hub_agent_computers (attachment_id,agent_id,computer_id,version,attached) VALUES (?,?,?,1,1)", c.attachmentId, c.agentId, c.computerId);
+                changed = true;
+            }
+            return changed ? c.attachmentId : noChange;
+        });
+    };
+    const detachComputer = (raw) => {
+        const c = detachComputerInputSchema.parse(raw);
+        return commit(c.agentId, "detachComputer", c.requestId, {
+            attachmentId: c.attachmentId,
+            computerId: c.computerId,
+        }, () => {
+            const stored = sql
+                .exec("SELECT agent_id, computer_id, attached, version FROM hub_agent_computers WHERE attachment_id=?", c.attachmentId)
+                .toArray()[0];
+            if (stored !== undefined &&
+                (stored.agent_id !== c.agentId || stored.computer_id !== c.computerId))
+                throw new AgentComputersError("attachment_identity_conflict");
+            if (stored === undefined || stored.attached === 0)
+                return noChange;
+            sql.exec("UPDATE hub_agent_computers SET attached=0,version=version+1 WHERE attachment_id=?", c.attachmentId);
+            options.revoke(c.requestId, attachmentIdentitySchema.parse({
+                attachmentId: c.attachmentId,
+                agentId: stored.agent_id,
+                computerId: stored.computer_id,
+                version: stored.version,
+            }));
+            return c.attachmentId;
+        });
+    };
+    const refresh = (agentId, force = false) => transactionSync(() => {
+        const before = read(agentId);
+        const renewed = options.ensureAdmissions?.(before.attachments) ?? false;
+        if (!force && !renewed)
+            return before;
+        const revision = before.revision + 1;
+        sql.exec("INSERT INTO hub_agent_computer_revisions (agent_id,revision) VALUES (?,?) ON CONFLICT (agent_id) DO UPDATE SET revision=excluded.revision", agentId, revision);
+        const current = read(agentId);
+        options.enqueueProjection?.(agentId, current);
+        return current;
+    });
+    const attachments = () => sql
+        .exec("SELECT agent_id,attachment_id,computer_id,version FROM hub_agent_computers WHERE attached=1 ORDER BY agent_id,attachment_id")
+        .toArray()
+        .map((row) => attachmentRowSchema.parse(row))
+        .map((row) => ({
+        agentId: row.agent_id,
+        attachmentId: row.attachment_id,
+        computerId: row.computer_id,
+        version: row.version,
+    }));
+    const advanceAttachedVersions = () => {
+        sql.exec("UPDATE hub_agent_computers SET version=version+1 WHERE attached=1");
+    };
+    return {
+        attachComputer,
+        detachComputer,
+        revision,
+        read,
+        refresh,
+        attachments,
+        attachedComputers: (agentId) => sql
+            .exec("SELECT computer_id FROM hub_agent_computers WHERE agent_id=? AND attached=1", agentId)
+            .toArray()
+            .map(({ computer_id }) => z.string().parse(computer_id)),
+        attachedAgents: (computerId) => sql
+            .exec("SELECT agent_id FROM hub_agent_computers WHERE computer_id=? AND attached=1", computerId)
+            .toArray()
+            .map(({ agent_id }) => z.string().parse(agent_id)),
+        nextRenewal: () => {
+            const agentIds = new Set(attachments().map(({ agentId }) => agentId));
+            const deadlines = [...agentIds].flatMap((agentId) => read(agentId).attachments.map(({ admission }) => admission === null
+                ? Date.now()
+                : admission.expiresAt - AGENT_ADMISSION_RENEW_BEFORE_MS));
+            return deadlines.length === 0 ? null : Math.min(...deadlines);
+        },
+        onLifecycle: (status, revision) => {
+            const current = attachments();
+            if (status === "suspended") {
+                for (const attachment of current)
+                    options.revoke(JSON.stringify([
+                        "team-suspension",
+                        revision,
+                        attachment.agentId,
+                        attachment.attachmentId,
+                    ]), attachment);
+                advanceAttachedVersions();
+            }
+            for (const agentId of new Set(current.map(({ agentId }) => agentId)))
+                refresh(agentId, true);
+        },
+    };
+}

package/dist/agents.d.ts

@@ -12,6 +12,8 @@ import * as Schema from "effect/Schema";
 import { type OysterCapability, type OysterEnv, type OysterPrincipal } from "./host.js";
 import type { HostActor } from "@fungi.computer/puffball/app";
 import type { Avatar } from "@fungi.computer/sprite/avatar";
+import type { AgentModelChoice, AgentModelRefusal } from "./standalone/agent-model-choice.js";
+export type { AgentModelChoice, AgentModelRefusal, } from "./standalone/agent-model-choice.js";
 import type { MemberInboxItem, MemberInboxSession } from "@fungi.computer/puffball/inbox";
 /** One agent as Apps see it, in Agar's `appAgentSchema` shape. */
 export type OysterAgent = Readonly<{
@@ -87,6 +89,14 @@ export type OysterAgents = Readonly<{
     setAvatar(agentId: string, avatar: Avatar, principal: OysterPrincipal): Promise<OysterAgent | Readonly<{
         error: "not_found" | "not_granted";
     }>>;
+    /** Owner-only, secret-free Agent default; an unknown Agent cannot be configured. */
+    readModelChoice(agentId: string): Promise<AgentModelChoice | null>;
+    /** Parse the owner's JSON through the deployable Agent's model preference schema. */
+    decodeModelChoice(json: string): AgentModelChoice | null;
+    /** Persist a supported model and source reference for this Agent, or return an explicit refusal. */
+    setModelChoice(agentId: string, choice: AgentModelChoice, principal: OysterPrincipal): Promise<AgentModelChoice | Readonly<{
+        error: "not_found" | "not_granted" | AgentModelRefusal;
+    }>>;
     /** This Agent's App-tool policy status, or `null` for no such Agent. */
     policyStatus(agentId: string): Promise<AgentToolPolicyStatus | null>;
     /** Read this Agent's stored App-tool approval; absence requires re-approval. A key's App access is its own grants (Ear Tag), not this policy. */

package/dist/agents.js

@@ -290,6 +290,39 @@ async function approvePolicy(agents, principal, actor, agentId, body) {
 /** Host-owned direct approval under the admitted owner; never an App capability. */
 export function agentApprovalRoutes(agents) {
     return new Hono()
+        .get("/api/agent-models/:agentId", async (context) => {
+        if (context.req.raw.headers.has("X-Oyster-Installation") ||
+            !oysterPrincipalIsOwner(context.get("principal")))
+            return refusal(403, "Owner only");
+        const agentId = context.req.param("agentId");
+        if (!agentIdPattern.test(agentId))
+            return refusal(404, "No such agent");
+        const choice = await agents.readModelChoice(agentId);
+        return choice === null
+            ? refusal(404, "No such agent")
+            : Response.json(choice);
+    })
+        .put("/api/agent-models/:agentId", async (context) => {
+        if (context.req.raw.headers.has("X-Oyster-Installation") ||
+            !oysterPrincipalIsOwner(context.get("principal")))
+            return refusal(403, "Owner only");
+        const agentId = context.req.param("agentId");
+        if (!agentIdPattern.test(agentId))
+            return refusal(404, "No such agent");
+        const input = agents.decodeModelChoice(await context.req.text());
+        if (input === null)
+            return refusal(400, "Invalid model choice");
+        const choice = await agents.setModelChoice(agentId, input, context.get("principal"));
+        if ("error" in choice && choice.error === "invalid_model_choice")
+            return refusal(400, "Invalid model choice");
+        return "error" in choice
+            ? refusal(choice.error === "not_found"
+                ? 404
+                : choice.error === "not_granted"
+                    ? 403
+                    : 409, choice.error)
+            : Response.json(choice);
+    })
         .get("/api/agent-policies/:agentId", async (context) => {
         if (context.req.raw.headers.has("X-Oyster-Installation"))
             return refusal(403, "Owner direct only");

package/dist/browser/boot.d.ts

@@ -8,8 +8,8 @@ import type { BrowserSessions } from "./sessions.js";
  * (`BrowserSessions`), never a meter, so a boot check is never billed to a
  * Team, and the agent tool never receives it. It accepts no URL: it builds
  * `<origin>/_boot/<releaseId>/index.html` itself from the host's configured
- * origin. Its dedicated provider session is pinned to that host by the
- * provider guardrail (a host-level backstop). The browser's request gate
+ * origin. Browser Run also pins that host through a provider guardrail;
+ * Chromium contexts have no provider host allowlist. The browser's request gate
  * fails every request whose exact origin (scheme, host, port) differs, on
  * the page and on every frame it admits, before that frame runs. The
  * capability token is added by that gate, and only to exact-origin

package/dist/browser/boot.js

@@ -12,8 +12,8 @@ import { attachPage, navigatePage, pageLocation } from "./page.js";
  * (`BrowserSessions`), never a meter, so a boot check is never billed to a
  * Team, and the agent tool never receives it. It accepts no URL: it builds
  * `<origin>/_boot/<releaseId>/index.html` itself from the host's configured
- * origin. Its dedicated provider session is pinned to that host by the
- * provider guardrail (a host-level backstop). The browser's request gate
+ * origin. Browser Run also pins that host through a provider guardrail;
+ * Chromium contexts have no provider host allowlist. The browser's request gate
  * fails every request whose exact origin (scheme, host, port) differs, on
  * the page and on every frame it admits, before that frame runs. The
  * capability token is added by that gate, and only to exact-origin
@@ -102,7 +102,11 @@ const responseSchema = z.object({
 });
 const loadingFailedSchema = z.object({ requestId: z.string() });
 const createdSchema = z.object({
-    targetInfo: z.object({ targetId: z.string(), type: z.string() }),
+    targetInfo: z.object({
+        targetId: z.string(),
+        type: z.string(),
+        browserContextId: z.string().optional(),
+    }),
 });
 const attachedSchema = z.object({
     sessionId: z.string(),
@@ -355,6 +359,9 @@ function observe(client, recorder, pinned, target, children, pages) {
             const created = createdSchema.safeParse(params);
             if (!created.success || created.data.targetInfo.type !== "page")
                 return;
+            if (client.browserContextId !== undefined &&
+                created.data.targetInfo.browserContextId !== client.browserContextId)
+                return;
             const { targetId } = created.data.targetInfo;
             if (!pages.sealed)
                 pages.known.add(targetId);

package/dist/browser/browser.d.ts

@@ -63,7 +63,7 @@ export type BrowserLimits = Readonly<{
     maxConcurrentPerTeam: number;
     /** A lease older than this is reaped even if active. */
     maxLifetimeMs: number;
-    /** A lease idle this long is reaped; also the provider keep-alive. */
+    /** Reaped on the next operation; Browser Run also uses it as keep-alive. */
     idleTimeoutMs: number;
     /** Per-navigation load deadline. */
     navigationTimeoutMs?: number;

package/dist/browser/browser.js

@@ -56,7 +56,8 @@ export function createBrowser(host, limits) {
             const attempts = (pending?.attempts ?? 0) + 1;
             if (attempts > maxTeardownAttempts) {
                 teardowns.delete(sessionId);
-                // The provider keep-alive (the idle timeout) is the last backstop.
+                // Browser Run has an idle backstop. Chromium does not: a context
+                // abandoned here persists until Chromium restarts.
                 host.report({
                     kind: "teardown_abandoned",
                     teamId,

package/dist/browser/cdp-client.d.ts

@@ -34,6 +34,8 @@ export type HttpFetch = (url: string, init?: RequestInit) => Promise<Response>;
  */
 export declare function openCdpSocket(fetcher: HttpFetch, url: string, headers: Readonly<Record<string, string>>, signal: AbortSignal): Promise<CdpSocket>;
 export type CdpClient = Readonly<{
+    /** A Chromium context-scoped host supplies this; Browser Run leaves it absent. */
+    browserContextId?: string;
     /** One command/response round trip, optionally flattened into `sessionId`. */
     call: (method: string, params: Readonly<Record<string, Json>>, options?: Readonly<{
         sessionId?: string;

package/dist/browser/errors.d.ts

@@ -3,7 +3,7 @@ declare const CloudBrowserUrlDenied_base: new <A extends Record<string, any> = {
 } & Readonly<A>;
 /**
  * The cloud-browser backend's closed, typed failure channel. Every backend
- * (today only Cloudflare Browser Run) throws exclusively from this union;
+ * (Cloudflare Browser Run or on-box Chromium) throws from this union;
  * `agent-cloud-browser-source.ts` is the one place that maps it onto
  * Mycelium's `CapabilityFailed`, so the model only ever sees a bounded,
  * owner-admitted message (never a raw provider error body or stack).
@@ -17,7 +17,7 @@ export declare class CloudBrowserUrlDenied extends CloudBrowserUrlDenied_base<{
 declare const CloudBrowserUpstreamError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
     readonly _tag: "CloudBrowserUpstreamError";
 } & Readonly<A>;
-/** The provider (Cloudflare Browser Run) answered with a failure. */
+/** The configured provider answered with a failure or is unreachable. */
 export declare class CloudBrowserUpstreamError extends CloudBrowserUpstreamError_base<{
     readonly op: string;
     readonly status: number | null;

package/dist/browser/errors.js

@@ -1,7 +1,7 @@
 import * as Data from "effect/Data";
 /**
  * The cloud-browser backend's closed, typed failure channel. Every backend
- * (today only Cloudflare Browser Run) throws exclusively from this union;
+ * (Cloudflare Browser Run or on-box Chromium) throws from this union;
  * `agent-cloud-browser-source.ts` is the one place that maps it onto
  * Mycelium's `CapabilityFailed`, so the model only ever sees a bounded,
  * owner-admitted message (never a raw provider error body or stack).
@@ -9,7 +9,7 @@ import * as Data from "effect/Data";
 /** The target URL failed policy before any provider call was made. */
 export class CloudBrowserUrlDenied extends Data.TaggedError("CloudBrowserUrlDenied") {
 }
-/** The provider (Cloudflare Browser Run) answered with a failure. */
+/** The configured provider answered with a failure or is unreachable. */
 export class CloudBrowserUpstreamError extends Data.TaggedError("CloudBrowserUpstreamError") {
 }
 /** A call did not complete within its deadline. */

package/dist/browser/index.d.ts

@@ -1,7 +1,8 @@
 /**
  * `@fungi.computer/oyster/browser`: the one agent browser for the Hub and a
  * standalone Oyster. A host builds the port from a provider (`browserRunSessions`
- * or `bindingSessions`, plus Browser Run Quick Reads when it has them), its
+ * or `bindingSessions` or `onboxBrowserSessions` on staging, plus Browser Run
+ * Quick Reads when it has them), its
  * required metering owner and an event sink; `createBrowser` owns lease
  * ownership, egress policy and billing order; `browserCapabilitySource` is
  * the agent's `cloudBrowser` tool. Raw CDP stays internal to this directory.
@@ -13,4 +14,4 @@ export type { LeaseOwner } from "./lease-registry.js";
 export { cloudBrowserBounds, extractInputSchema, extractResultSchema, linksResultSchema, markdownInputSchema, markdownResultSchema, navigateResultSchema, openResultSchema, scrapeInputSchema, scrapeResultSchema, snapshotResultSchema, type BinaryResult, type CloudBrowserAck, type CloudBrowserClosed, type CloudBrowserOperation, type CloudBrowserOperationResult, type ExtractInput, type ExtractResult, type LinksResult, type MarkdownInput, type MarkdownResult, type NavigateResult, type OpenResult, type ScrapeInput, type ScrapeResult, type SnapshotResult, } from "./operations.js";
 export type { CdpSocket, HttpFetch } from "./cdp-client.js";
 export { browserRunQuickReads, type BrowserRunQuickReadsConfig, type QuickRead, type QuickReads, } from "./quick-reads.js";
-export { bindingSessions, browserRunSessions, type BrowserBinding, type BrowserSessions, type CdpConnect, } from "./sessions.js";
+export { bindingSessions, browserRunSessions, onboxBrowserSessions, type BrowserBinding, type BrowserSessions, type CdpConnect, } from "./sessions.js";