@intentic/machine 1.233.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Artur Kurowski
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,72 @@
+# @intentic/machine
+
+The one agent that lives on a user's own computer: it lets a sandbox's agent work on the machine, and keeps the
+machine's folders and ports mirrored with the sandbox — one binary, one resident loop, one logon entry.
+
+It replaces two agents (`@intentic/host` and `@intentic/sync`) that shared everything about *being installed* —
+a resident loop, a pidfile, a login entry, an updater, a ~90 MB compiled binary — and nothing about what they
+did. Merging them halves what a machine downloads and keeps resident, and gives "is this machine's agent
+running" one answer instead of two halves of one.
+
+## Responsibilities
+
+The **computer half** (`src/computer/`, the machine side of the `host` capability):
+
+- Dial each linked sandbox — one outbound WebSocket, enrollment token in the first frame, oRPC after that; the
+  machine *serves* `hostContract`, so no port ever opens here.
+- Expose the tool surface (`run_command`, files, screenshot, `describe`; deliberately no delete — trash is
+  recoverable) as MCP carried verbatim, so a machine can learn a tool without a daemon release.
+- Enforce the owner's scopes **here**, never in the sandbox, and append every call to an audit log that
+  survives uninstall.
+
+The **sync half** (`src/sync/`, the machine side of desktop sync):
+
+- Enroll an SSH key, then drive Mutagen: bidirectional file sync of a local folder ↔ the sandbox's /work, plus
+  a one-way backup of the sandbox's own state.
+- Serve the SSH transport itself on loopback (the sandbox's sshd reached over its HTTPS surface), mirror every
+  workspace port onto this machine's localhost, and bridge git so commits appear in local clones.
+- Register Mutagen's daemon for login autostart — on Windows through the launcher stub, because Mutagen's own
+  registration flashes a console window at every boot.
+
+**Shared** (`src/`): the one resident loop (`run`), the merged `status` (and its `--json` envelope the desktop
+app's tray reads), self-`upgrade` with automatic rollback, and the autostart spec.
+
+## The resident loop
+
+`intentic-machine run --foreground` (what systemd, launchd and the Windows launcher stub run) serves both
+halves in one process ([src/resident.ts](src/resident.ts)):
+
+- The sync half re-reads its pairing list every tick; the computer half's link list is fixed at startup, which
+  is why every `setup`/`uninstall` restarts the loop (`reconcileResidency`) instead of poking it.
+- The process exits — and takes the login entry with it — only when **both** halves have nothing to serve.
+- On a signal it exits `128+signal`, never 0: a supervisor must restart what it did not stop, and the incident
+  that bought that rule is written out in [src/sync/mirror.ts](src/sync/mirror.ts).
+
+## Key files
+
+- [src/commands.ts](src/commands.ts) — the CLI surface: `computer setup|uninstall`, `sync setup|pause|resume|uninstall`, shared `run|status|version|upgrade|uninstall`.
+- [src/resident.ts](src/resident.ts) — the one loop, its pidfile, and `reconcileResidency`.
+- [src/status.ts](src/status.ts) — both halves as one answer; `--json` is what the desktop app and tray read.
+- [src/computer/policy.ts](src/computer/policy.ts) — what the sandbox is permitted to do here; the security surface.
+- [src/sync/mirror.ts](src/sync/mirror.ts) — the sync tick: ports reconcile, git bridge, revocation handling.
+- [src/sync/mutagen.ts](src/sync/mutagen.ts) — driving the Mutagen binary, sessions and its daemon's autostart.
+
+## How it fits
+
+Runs on the user's machine, not in the sandbox. Installed by `computer.{sh,ps1}` / `sync.{sh,ps1}` (both cards
+download the same binary into `~/.intentic/machine/bin`, plus `intentic-launch.exe` on Windows), shipped as a
+bun-compiled binary per platform, self-updated by `upgrade`. The install-and-stay-alive plumbing is
+[`@intentic/local-agent`](../local-agent)'s; the windowless Windows logon start is
+[`_computers/win-launcher`](../win-launcher)'s.
+
+## Conventions & gotchas
+
+- **Bidirectional sync has no undo.** The integration tests here run against real directories and a real
+  Mutagen for exactly that reason; a unit test that mocks the sync proves nothing about the case that loses work.
+- **The two halves keep separate state files** (`computer.json`, `sync.json`) in the one home: the loop rewrites
+  one half's state while a concurrent `setup` writes the other's, and separate files make cross-half torn
+  writes impossible rather than unlikely.
+- **Scopes are a cache.** The sandbox pushes the real grant on every connect; what is stored only governs the
+  seconds before the first push, and it starts at everything-off.
+- **The transport lives in the resident loop**, so `sync setup` starts the loop *before* it probes ssh or hands
+  anything to Mutagen: every step after that one needs the port to be open.

package/dist/app.d.ts

@@ -0,0 +1,2 @@
+export declare const app: import("@stricli/core").Application<import("@stricli/core").CommandContext>;
+//# sourceMappingURL=app.d.ts.map

package/dist/app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,GAAG,6EAWf,CAAC"}

package/dist/app.js

@@ -0,0 +1,12 @@
+import { agentException } from "@intentic/local-agent";
+import { buildApplication, buildRouteMap, text_en } from "@stricli/core";
+import { commands } from "./commands.js";
+export const app = buildApplication(buildRouteMap({
+    routes: commands,
+    docs: { brief: "intentic-machine, connect this computer to your intentic sandboxes" },
+}), {
+    name: "intentic-machine",
+    scanner: { caseStyle: "allow-kebab-for-camel" },
+    localization: { text: { ...text_en, formatException: agentException } },
+});
+//# sourceMappingURL=app.js.map

package/dist/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAMzC,MAAM,CAAC,MAAM,GAAG,GAAG,gBAAgB,CAC/B,aAAa,CAAC;IACV,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,EAAE,KAAK,EAAE,oEAAoE,EAAE;CACxF,CAAC,EACF;IACI,IAAI,EAAE,kBAAkB;IACxB,OAAO,EAAE,EAAE,SAAS,EAAE,uBAAuB,EAAE;IAE/C,YAAY,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,EAAE;CAC1E,CACJ,CAAC"}

package/dist/autostart.d.ts

@@ -0,0 +1,3 @@
+import type { AutostartSpec } from "@intentic/local-agent";
+export declare const MACHINE_AUTOSTART: AutostartSpec;
+//# sourceMappingURL=autostart.d.ts.map

package/dist/autostart.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"autostart.d.ts","sourceRoot":"","sources":["../src/autostart.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAY3D,eAAO,MAAM,iBAAiB,EAAE,aAa/B,CAAC"}

package/dist/autostart.js

@@ -0,0 +1,13 @@
+import { runLogPath } from "./config.js";
+export const MACHINE_AUTOSTART = {
+    id: "intentic-machine",
+    windowsRunValue: "IntenticMachine",
+    desktopName: "Intentic Machine Agent",
+    desktopComment: "Connect this computer to your intentic sandboxes: agent access, file sync, port mirroring",
+    logPath: runLogPath,
+    launchAgent: { label: "dev.intentic.machine" },
+    detachedArgs: ["run"],
+    foregroundArgs: ["run", "--foreground"],
+    failureNote: (reason) => `note: couldn't register this machine's agent to start at login (${reason}); it runs until this machine restarts, then re-run \`intentic-machine run\`. Logs: ${runLogPath}`,
+};
+//# sourceMappingURL=autostart.js.map

package/dist/autostart.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"autostart.js","sourceRoot":"","sources":["../src/autostart.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAWzC,MAAM,CAAC,MAAM,iBAAiB,GAAkB;IAC5C,EAAE,EAAE,kBAAkB;IACtB,eAAe,EAAE,iBAAiB;IAClC,WAAW,EAAE,wBAAwB;IACrC,cAAc,EAAE,2FAA2F;IAG3G,OAAO,EAAE,UAAU;IACnB,WAAW,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE;IAC9C,YAAY,EAAE,CAAC,KAAK,CAAC;IACrB,cAAc,EAAE,CAAC,KAAK,EAAE,cAAc,CAAC;IACvC,WAAW,EAAE,CAAC,MAAM,EAAE,EAAE,CACpB,mEAAmE,MAAM,uFAAuF,UAAU,EAAE;CACnL,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+import { run } from "@stricli/core";
+import { app } from "./app.js";
+await run(app, process.argv.slice(2), { process: process });
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAEpC,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE/B,MAAM,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,OAAyB,EAAE,CAAC,CAAC"}

package/dist/commands.d.ts

@@ -0,0 +1,11 @@
+import { type CommandContext } from "@stricli/core";
+export declare const commands: {
+    computer: import("@stricli/core").RouteMap<CommandContext>;
+    sync: import("@stricli/core").RouteMap<CommandContext>;
+    run: import("@stricli/core").Command<CommandContext>;
+    status: import("@stricli/core").Command<CommandContext>;
+    version: import("@stricli/core").Command<CommandContext>;
+    upgrade: import("@stricli/core").Command<CommandContext>;
+    uninstall: import("@stricli/core").Command<CommandContext>;
+};
+//# sourceMappingURL=commands.d.ts.map

package/dist/commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../src/commands.ts"],"names":[],"mappings":"AACA,OAAO,EAA+B,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AA2HjF,eAAO,MAAM,QAAQ;;;;;;;;CAcpB,CAAC"}

package/dist/commands.js

@@ -0,0 +1,91 @@
+import { setTimeout as sleep } from "node:timers/promises";
+import { buildCommand, buildRouteMap } from "@stricli/core";
+import { computerCommands, computerUninstall } from "./computer/commands.js";
+import { readResidentPid, reconcileResidency, runForeground, stopResident } from "./resident.js";
+import { status } from "./status.js";
+import { syncCommands, syncUninstall } from "./sync/commands.js";
+import { assetUrl, realUpgradeExec, runUpgrade, upgradeMessage } from "./upgrade.js";
+import { MACHINE_VERSION } from "./version.js";
+const run = buildCommand({
+    docs: { brief: "Run this machine's agent: sandbox connections, file sync, port mirroring (setup starts this for you)" },
+    parameters: {
+        flags: {
+            foreground: { kind: "boolean", brief: "Run the loop in this terminal instead of the background" },
+            stop: { kind: "boolean", brief: "Stop the background loop" },
+        },
+    },
+    async func(flags) {
+        const out = (message) => void this.process.stdout.write(`${message}\n`);
+        if (flags.stop) {
+            const pid = await stopResident();
+            out(pid === undefined ? "not running." : `stopped (pid ${pid}).`);
+            return;
+        }
+        if (!flags.foreground) {
+            await reconcileResidency(out);
+            return;
+        }
+        await runForeground((message) => void this.process.stdout.write(`[${new Date().toISOString()}] ${message}\n`));
+    },
+});
+const version = buildCommand({
+    docs: { brief: "Print this agent's version" },
+    parameters: {},
+    func() {
+        this.process.stdout.write(`${MACHINE_VERSION}\n`);
+        return Promise.resolve();
+    },
+});
+const RESIDENT_START_TIMEOUT_MS = 10_000;
+const RESIDENT_START_POLL_MS = 200;
+const residentCameUp = async () => {
+    for (let waited = 0; waited < RESIDENT_START_TIMEOUT_MS; waited += RESIDENT_START_POLL_MS) {
+        if ((await readResidentPid()) !== undefined) {
+            return true;
+        }
+        await sleep(RESIDENT_START_POLL_MS);
+    }
+    return false;
+};
+const upgrade = buildCommand({
+    docs: { brief: "Download and install the current agent, then restart the background loop" },
+    parameters: {
+        flags: {
+            force: {
+                kind: "boolean",
+                brief: "Install the published agent even over one built from source (which is otherwise left alone)",
+            },
+        },
+    },
+    async func(flags) {
+        const out = (message) => void this.process.stdout.write(`${message}\n`);
+        const exec = realUpgradeExec(stopResident, async () => await reconcileResidency(() => undefined), residentCameUp);
+        out(upgradeMessage(await runUpgrade(exec, assetUrl(), MACHINE_VERSION, flags.force, out)));
+    },
+});
+const uninstall = buildCommand({
+    docs: { brief: "Remove this machine's agent entirely: every sandbox link, every sync pairing, the login entry" },
+    parameters: {},
+    async func() {
+        const out = (message) => void this.process.stdout.write(`${message}\n`);
+        await syncUninstall(out);
+        await computerUninstall(out);
+        out("Nothing intentic stays resident on this machine.");
+    },
+});
+export const commands = {
+    computer: buildRouteMap({
+        routes: computerCommands,
+        docs: { brief: "Let a sandbox work on this computer (the Connect-this-computer card)" },
+    }),
+    sync: buildRouteMap({
+        routes: syncCommands,
+        docs: { brief: "Mirror a sandbox's files and ports onto this machine (the Desktop sync card)" },
+    }),
+    run,
+    status,
+    version,
+    upgrade,
+    uninstall,
+};
+//# sourceMappingURL=commands.js.map

package/dist/commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../src/commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,aAAa,EAAuB,MAAM,eAAe,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACjG,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAiB/C,MAAM,GAAG,GAAG,YAAY,CAAW;IAC/B,IAAI,EAAE,EAAE,KAAK,EAAE,sGAAsG,EAAE;IACvH,UAAU,EAAE;QACR,KAAK,EAAE;YACH,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,yDAAyD,EAAE;YACjG,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,0BAA0B,EAAE;SAC/D;KACJ;IACD,KAAK,CAAC,IAAI,CAAuB,KAAe;QAC5C,MAAM,GAAG,GAAG,CAAC,OAAe,EAAQ,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;QACtF,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,MAAM,YAAY,EAAE,CAAC;YACjC,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;YAClE,OAAO;QACX,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YAGpB,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;YAC9B,OAAO;QACX,CAAC;QAED,MAAM,aAAa,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC;IACnH,CAAC;CACJ,CAAC,CAAC;AAMH,MAAM,OAAO,GAAG,YAAY,CAAC;IACzB,IAAI,EAAE,EAAE,KAAK,EAAE,4BAA4B,EAAE;IAC7C,UAAU,EAAE,EAAE;IACd,IAAI;QACA,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,eAAe,IAAI,CAAC,CAAC;QAClD,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC;CACJ,CAAC,CAAC;AAIH,MAAM,yBAAyB,GAAG,MAAM,CAAC;AACzC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAEnC,MAAM,cAAc,GAAG,KAAK,IAAsB,EAAE;IAChD,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,yBAAyB,EAAE,MAAM,IAAI,sBAAsB,EAAE,CAAC;QAExF,IAAI,CAAC,MAAM,eAAe,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC,CAAC;AAeF,MAAM,OAAO,GAAG,YAAY,CAAe;IACvC,IAAI,EAAE,EAAE,KAAK,EAAE,0EAA0E,EAAE;IAC3F,UAAU,EAAE;QACR,KAAK,EAAE;YACH,KAAK,EAAE;gBACH,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,6FAA6F;aACvG;SACJ;KACJ;IACD,KAAK,CAAC,IAAI,CAAuB,KAAmB;QAChD,MAAM,GAAG,GAAG,CAAC,OAAe,EAAQ,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;QACtF,MAAM,IAAI,GAAG,eAAe,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,kBAAkB,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC,CAAC;QAClH,GAAG,CAAC,cAAc,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,eAAe,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/F,CAAC;CACJ,CAAC,CAAC;AAKH,MAAM,SAAS,GAAG,YAAY,CAAC;IAC3B,IAAI,EAAE,EAAE,KAAK,EAAE,+FAA+F,EAAE;IAChH,UAAU,EAAE,EAAE;IACd,KAAK,CAAC,IAAI;QACN,MAAM,GAAG,GAAG,CAAC,OAAe,EAAQ,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;QACtF,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC7B,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAC5D,CAAC;CACJ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACpB,QAAQ,EAAE,aAAa,CAAC;QACpB,MAAM,EAAE,gBAAgB;QACxB,IAAI,EAAE,EAAE,KAAK,EAAE,sEAAsE,EAAE;KAC1F,CAAC;IACF,IAAI,EAAE,aAAa,CAAC;QAChB,MAAM,EAAE,YAAY;QACpB,IAAI,EAAE,EAAE,KAAK,EAAE,8EAA8E,EAAE;KAClG,CAAC;IACF,GAAG;IACH,MAAM;IACN,OAAO;IACP,OAAO;IACP,SAAS;CACZ,CAAC"}

package/dist/computer/audit.d.ts

@@ -0,0 +1,6 @@
+export declare const audit: (entry: {
+    tool: string;
+    ok: boolean;
+    detail: string;
+}) => Promise<void>;
+//# sourceMappingURL=audit.d.ts.map

package/dist/computer/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/computer/audit.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,KAAK,UAAiB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,KAAG,OAAO,CAAC,IAAI,CAO9F,CAAC"}

package/dist/computer/audit.js

@@ -0,0 +1,12 @@
+import { appendFile, mkdir } from "node:fs/promises";
+import { baseDir } from "../config.js";
+import { auditPath } from "./config.js";
+export const audit = async (entry) => {
+    try {
+        await mkdir(baseDir, { recursive: true, mode: 0o700 });
+        await appendFile(auditPath, `${JSON.stringify({ at: new Date().toISOString(), ...entry })}\n`, { encoding: "utf8", mode: 0o600 });
+    }
+    catch {
+    }
+};
+//# sourceMappingURL=audit.js.map

package/dist/computer/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/computer/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAWxC,MAAM,CAAC,MAAM,KAAK,GAAG,KAAK,EAAE,KAAoD,EAAiB,EAAE;IAC/F,IAAI,CAAC;QACD,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvD,MAAM,UAAU,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtI,CAAC;IAAC,MAAM,CAAC;IAET,CAAC;AACL,CAAC,CAAC"}

package/dist/computer/commands.d.ts

@@ -0,0 +1,8 @@
+import { type Log } from "@intentic/local-agent";
+import { type CommandContext } from "@stricli/core";
+export declare const computerUninstall: (out: Log, sandbox?: string) => Promise<void>;
+export declare const computerCommands: {
+    setup: import("@stricli/core").Command<CommandContext>;
+    uninstall: import("@stricli/core").Command<CommandContext>;
+};
+//# sourceMappingURL=commands.d.ts.map

package/dist/computer/commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../src/computer/commands.ts"],"names":[],"mappings":"AACA,OAAO,EAAY,KAAK,GAAG,EAA0B,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAyJlE,eAAO,MAAM,iBAAiB,QAAe,GAAG,YAAY,MAAM,KAAG,OAAO,CAAC,IAAI,CA2BhF,CAAC;AAEF,eAAO,MAAM,gBAAgB;;;CAAuB,CAAC"}

package/dist/computer/commands.js

@@ -0,0 +1,113 @@
+import { rm } from "node:fs/promises";
+import { createUi } from "@intentic/local-agent";
+import { buildCommand } from "@stricli/core";
+import { reconcileResidency } from "../resident.js";
+import { auditPath, configPath, readLinks, removeLinks, upsertLink } from "./config.js";
+const enroll = async (sandboxUrl, pairToken, { attempts = 10, delayMs = 3000 } = {}) => {
+    const url = `${sandboxUrl.replace(/\/$/, "")}/system/hosts/enroll`;
+    for (let attempt = 1;; attempt++) {
+        let response;
+        try {
+            response = await fetch(url, { method: "POST", headers: { "x-intentic-pair": pairToken } });
+        }
+        catch (error) {
+            if (attempt >= attempts) {
+                throw error;
+            }
+            process.stderr.write(`connecting: the sandbox isn't reachable yet, retrying (${attempt}/${attempts})…\n`);
+            await new Promise((resolvePromise) => setTimeout(resolvePromise, delayMs));
+            continue;
+        }
+        if (response.status === 401) {
+            throw new Error("that pairing has expired: click Connect again on the computer's card in your sandbox for a fresh command.");
+        }
+        if (response.status >= 500 && attempt < attempts) {
+            process.stderr.write(`connecting: the sandbox is warming up (HTTP ${response.status}), retrying (${attempt}/${attempts})…\n`);
+            await new Promise((resolvePromise) => setTimeout(resolvePromise, delayMs));
+            continue;
+        }
+        if (!response.ok) {
+            throw new Error(`connecting this computer failed (${response.status}): ${await response.text()}`);
+        }
+        return (await response.json());
+    }
+};
+const setup = buildCommand({
+    docs: { brief: "Connect this computer to an intentic sandbox using a one-time pairing token" },
+    parameters: {
+        flags: {
+            url: { kind: "parsed", parse: String, brief: "The sandbox's URL (e.g. https://sandbox-xxx.example.dev)" },
+            pair: { kind: "parsed", parse: String, brief: "The one-time pairing token from the computer's capability card" },
+        },
+    },
+    async func(flags) {
+        const ui = createUi(this.process);
+        const out = ui.note;
+        ui.begin("intentic · connect this computer", SETUP_PLAN);
+        try {
+            await runSetup(ui, out, flags);
+        }
+        finally {
+            ui.close();
+        }
+    },
+});
+const SETUP_PLAN = [
+    { phase: "computer-enrolling", label: "Enrol this computer", weight: 10 },
+    { phase: "computer-starting", label: "Start the agent", weight: 15 },
+];
+const runSetup = async (ui, out, flags) => {
+    ui.step("computer-enrolling", "enrolling this computer with your sandbox…");
+    const { id, hostToken } = await enroll(flags.url, flags.pair);
+    const link = {
+        sandboxUrl: flags.url,
+        id,
+        token: hostToken,
+        scopes: { shell: "off", write: "off", screen: "off", control: "off", sandboxes: "off", sandboxRemove: "off", destructive: "off" },
+    };
+    const links = await upsertLink(link);
+    ui.step("computer-starting", "starting the agent on this computer…");
+    await reconcileResidency(out);
+    const others = links.length - 1;
+    ui.finished("This computer is connected.", id, others === 0
+        ? "Its permissions are set in the sandbox, on the same card you got this command from."
+        : `Its permissions are set in the sandbox, on the same card you got this command from. Still connected to ${others} other sandbox${others === 1 ? "" : "es"}.`, [
+        ["check it", "intentic-machine status"],
+        ["disconnect", "intentic-machine computer uninstall"],
+    ]);
+};
+const uninstall = buildCommand({
+    docs: { brief: "Disconnect this computer from one sandbox, or from all of them" },
+    parameters: {
+        flags: {
+            sandbox: { kind: "parsed", parse: String, brief: "Disconnect only this sandbox URL (default: every one)", optional: true },
+        },
+    },
+    async func(flags) {
+        const out = (message) => void this.process.stdout.write(`${message}\n`);
+        await computerUninstall(out, flags.sandbox);
+    },
+});
+export const computerUninstall = async (out, sandbox) => {
+    const only = sandbox === undefined || sandbox === "" ? undefined : sandbox;
+    const dropped = await removeLinks(only);
+    const left = await readLinks();
+    if (only !== undefined && dropped.length === 0) {
+        out(`This computer is not connected to ${only}. Nothing changed.`);
+        return;
+    }
+    if (left.length === 0) {
+        await rm(configPath, { force: true });
+    }
+    await reconcileResidency(out);
+    if (left.length > 0) {
+        out(`Disconnected from ${dropped.map((link) => link.sandboxUrl).join(", ")}. Still connected to ${left.length} sandbox${left.length === 1 ? "" : "es"}.`);
+        return;
+    }
+    out(dropped.length === 0
+        ? "Nothing was connected. Removed any leftovers."
+        : `Disconnected from ${dropped.map((link) => link.sandboxUrl).join(", ")}. Each sandbox still lists this computer until it is removed there, its access is already gone.`);
+    out(`Your record of what this agent did stays at ${auditPath}.`);
+};
+export const computerCommands = { setup, uninstall };
+//# sourceMappingURL=commands.js.map

package/dist/computer/commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../../src/computer/commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAoC,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAE,YAAY,EAAuB,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAiB,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAcvG,MAAM,MAAM,GAAG,KAAK,EAChB,UAAkB,EAClB,SAAiB,EACjB,EAAE,QAAQ,GAAG,EAAE,EAAE,OAAO,GAAG,IAAI,EAAE,GAA4C,EAAE,EACrC,EAAE;IAC5C,MAAM,GAAG,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,sBAAsB,CAAC;IACnE,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;QAChC,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACD,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,iBAAiB,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAC/F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;gBACtB,MAAM,KAAK,CAAC;YAChB,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0DAA0D,OAAO,IAAI,QAAQ,MAAM,CAAC,CAAC;YAC1G,MAAM,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC;YAC3E,SAAS;QACb,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,2GAA2G,CAAC,CAAC;QACjI,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,OAAO,GAAG,QAAQ,EAAE,CAAC;YAC/C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,QAAQ,CAAC,MAAM,gBAAgB,OAAO,IAAI,QAAQ,MAAM,CAAC,CAAC;YAC9H,MAAM,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC;YAC3E,SAAS;QACb,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,oCAAoC,QAAQ,CAAC,MAAM,MAAM,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAsC,CAAC;IACxE,CAAC;AACL,CAAC,CAAC;AAOF,MAAM,KAAK,GAAG,YAAY,CAAa;IACnC,IAAI,EAAE,EAAE,KAAK,EAAE,6EAA6E,EAAE;IAC9F,UAAU,EAAE;QACR,KAAK,EAAE;YACH,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,0DAA0D,EAAE;YACzG,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,gEAAgE,EAAE;SACnH;KACJ;IACD,KAAK,CAAC,IAAI,CAAuB,KAAiB;QAK9C,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,GAAG,GAAQ,EAAE,CAAC,IAAI,CAAC;QACzB,EAAE,CAAC,KAAK,CAAC,kCAAkC,EAAE,UAAU,CAAC,CAAC;QACzD,IAAI,CAAC;YACD,MAAM,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC;gBAAS,CAAC;YACP,EAAE,CAAC,KAAK,EAAE,CAAC;QACf,CAAC;IACL,CAAC;CACJ,CAAC,CAAC;AAMH,MAAM,UAAU,GAAwB;IACpC,EAAE,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,qBAAqB,EAAE,MAAM,EAAE,EAAE,EAAE;IACzE,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,EAAE,EAAE;CACvE,CAAC;AAEF,MAAM,QAAQ,GAAG,KAAK,EAAE,EAAM,EAAE,GAAQ,EAAE,KAAiB,EAAiB,EAAE;IAC1E,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,4CAA4C,CAAC,CAAC;IAC5E,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAK9D,MAAM,IAAI,GAAa;QACnB,UAAU,EAAE,KAAK,CAAC,GAAG;QACrB,EAAE;QACF,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE;KACpI,CAAC;IAOF,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;IACrC,EAAE,CAAC,IAAI,CAAC,mBAAmB,EAAE,sCAAsC,CAAC,CAAC;IAKrE,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAG9B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAChC,EAAE,CAAC,QAAQ,CACP,6BAA6B,EAC7B,EAAE,EACF,MAAM,KAAK,CAAC;QACR,CAAC,CAAC,qFAAqF;QACvF,CAAC,CAAC,0GAA0G,MAAM,iBAAiB,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,EAClK;QACI,CAAC,UAAU,EAAE,yBAAyB,CAAC;QACvC,CAAC,YAAY,EAAE,qCAAqC,CAAC;KACxD,CACJ,CAAC;AACN,CAAC,CAAC;AAMF,MAAM,SAAS,GAAG,YAAY,CAAiB;IAC3C,IAAI,EAAE,EAAE,KAAK,EAAE,gEAAgE,EAAE;IACjF,UAAU,EAAE;QACR,KAAK,EAAE;YAGH,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,uDAAuD,EAAE,QAAQ,EAAE,IAAI,EAAE;SAC7H;KACJ;IACD,KAAK,CAAC,IAAI,CAAuB,KAAqB;QAClD,MAAM,GAAG,GAAG,CAAC,OAAe,EAAQ,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;QACtF,MAAM,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAChD,CAAC;CACJ,CAAC,CAAC;AAOH,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,GAAQ,EAAE,OAAgB,EAAiB,EAAE;IACjF,MAAM,IAAI,GAAG,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;IAC3E,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,MAAM,SAAS,EAAE,CAAC;IAC/B,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,qCAAqC,IAAI,oBAAoB,CAAC,CAAC;QACnE,OAAO;IACX,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAIpB,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClB,GAAG,CACC,qBAAqB,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,IAAI,CAAC,MAAM,WAAW,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CACvJ,CAAC;QACF,OAAO;IACX,CAAC;IACD,GAAG,CACC,OAAO,CAAC,MAAM,KAAK,CAAC;QAChB,CAAC,CAAC,+CAA+C;QACjD,CAAC,CAAC,qBAAqB,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,iGAAiG,CAChL,CAAC;IACF,GAAG,CAAC,+CAA+C,SAAS,GAAG,CAAC,CAAC;AACrE,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC"}

package/dist/computer/config.d.ts

@@ -0,0 +1,19 @@
+import type { HostScopes } from "@intentic/sandbox-contract";
+export declare const configPath: string;
+export declare const auditPath: string;
+export interface HostLink {
+    readonly sandboxUrl: string;
+    readonly id: string;
+    readonly token: string;
+    readonly scopes: HostScopes;
+}
+export interface HostConfigFile {
+    readonly links: readonly HostLink[];
+}
+export declare const readHostConfig: () => Promise<HostConfigFile>;
+export declare const writeHostConfig: (config: HostConfigFile) => Promise<void>;
+export declare const readLinks: () => Promise<readonly HostLink[]>;
+export declare const upsertLink: (link: HostLink) => Promise<readonly HostLink[]>;
+export declare const removeLinks: (sandboxUrl?: string) => Promise<readonly HostLink[]>;
+export declare const rememberScopes: (sandboxUrl: string, scopes: HostScopes) => Promise<void>;
+//# sourceMappingURL=config.d.ts.map

package/dist/computer/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/computer/config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAS7D,eAAO,MAAM,UAAU,QAAiC,CAAC;AACzD,eAAO,MAAM,SAAS,QAA+B,CAAC;AActD,MAAM,WAAW,QAAQ;IAErB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;CAC/B;AAcD,MAAM,WAAW,cAAc;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,QAAQ,EAAE,CAAC;CACvC;AAED,eAAO,MAAM,cAAc,QAAa,OAAO,CAAC,cAAc,CAAqE,CAAC;AAEpI,eAAO,MAAM,eAAe,WAAkB,cAAc,KAAG,OAAO,CAAC,IAAI,CACS,CAAC;AAIrF,eAAO,MAAM,SAAS,QAAa,OAAO,CAAC,SAAS,QAAQ,EAAE,CAAiE,CAAC;AAMhI,eAAO,MAAM,UAAU,SAAgB,QAAQ,KAAG,OAAO,CAAC,SAAS,QAAQ,EAAE,CAK5E,CAAC;AAGF,eAAO,MAAM,WAAW,gBAAuB,MAAM,KAAG,OAAO,CAAC,SAAS,QAAQ,EAAE,CAKlF,CAAC;AAIF,eAAO,MAAM,cAAc,eAAsB,MAAM,UAAU,UAAU,KAAG,OAAO,CAAC,IAAI,CAUzF,CAAC"}

package/dist/computer/config.js

@@ -0,0 +1,31 @@
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { writeSecretFile } from "@intentic/local-agent";
+import { baseDir } from "../config.js";
+export const configPath = join(baseDir, "computer.json");
+export const auditPath = join(baseDir, "audit.jsonl");
+export const readHostConfig = async () => JSON.parse(await readFile(configPath, "utf8"));
+export const writeHostConfig = async (config) => await writeSecretFile(configPath, baseDir, JSON.stringify(config, undefined, 2));
+export const readLinks = async () => (await readHostConfig().catch(() => undefined))?.links ?? [];
+export const upsertLink = async (link) => {
+    const kept = (await readLinks()).filter((existing) => existing.sandboxUrl !== link.sandboxUrl);
+    const links = [...kept, link];
+    await writeHostConfig({ links });
+    return links;
+};
+export const removeLinks = async (sandboxUrl) => {
+    const links = await readLinks();
+    const dropped = sandboxUrl === undefined ? links : links.filter((link) => link.sandboxUrl === sandboxUrl);
+    await writeHostConfig({ links: links.filter((link) => !dropped.includes(link)) });
+    return dropped;
+};
+export const rememberScopes = async (sandboxUrl, scopes) => {
+    const links = await readLinks();
+    const at = links.findIndex((link) => link.sandboxUrl === sandboxUrl);
+    const link = links[at];
+    if (link === undefined) {
+        return;
+    }
+    await writeHostConfig({ links: links.with(at, { ...link, scopes }) }).catch(() => undefined);
+};
+//# sourceMappingURL=config.js.map

package/dist/computer/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/computer/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAQvC,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;AACzD,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AAuCtD,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,IAA6B,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAmB,CAAC;AAEpI,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,MAAsB,EAAiB,EAAE,CAC3E,MAAM,eAAe,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;AAIrF,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,IAAkC,EAAE,CAAC,CAAC,MAAM,cAAc,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;AAMhI,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAAE,IAAc,EAAgC,EAAE;IAC7E,MAAM,IAAI,GAAG,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/F,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9B,MAAM,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACjC,OAAO,KAAK,CAAC;AACjB,CAAC,CAAC;AAGF,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,UAAmB,EAAgC,EAAE;IACnF,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;IAC1G,MAAM,eAAe,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;IAClF,OAAO,OAAO,CAAC;AACnB,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,UAAkB,EAAE,MAAkB,EAAiB,EAAE;IAC1F,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;IAChC,MAAM,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;IAGrE,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;IACvB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACrB,OAAO;IACX,CAAC;IACD,MAAM,eAAe,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AACjG,CAAC,CAAC"}

package/dist/computer/connection.d.ts

@@ -0,0 +1,8 @@
+import type { Log } from "@intentic/local-agent";
+import { type HostLink } from "./config.js";
+export interface HostConnection {
+    readonly done: Promise<void>;
+    readonly stop: () => void;
+}
+export declare const connect: (config: HostLink, version: string, log: Log) => HostConnection;
+//# sourceMappingURL=connection.d.ts.map

package/dist/computer/connection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../src/computer/connection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,uBAAuB,CAAC;AAGjD,OAAO,EAAE,KAAK,QAAQ,EAAkB,MAAM,aAAa,CAAC;AA4B5D,MAAM,WAAW,cAAc;IAE3B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC;CAC7B;AAED,eAAO,MAAM,OAAO,WAAY,QAAQ,WAAW,MAAM,OAAO,GAAG,KAAG,cA8ErE,CAAC"}

package/dist/computer/connection.js

@@ -0,0 +1,63 @@
+import { hostConnectUrl } from "@intentic/sandbox-contract";
+import { RPCHandler } from "@orpc/server/websocket";
+import { rememberScopes } from "./config.js";
+import { createHostRouter } from "./router.js";
+const RETRY_MIN_MS = 1_000;
+const RETRY_MAX_MS = 30_000;
+const UNAUTHORIZED = 1008;
+export const connect = (config, version, log) => {
+    let scopes = config.scopes;
+    const handler = new RPCHandler(createHostRouter({
+        scopes: () => scopes,
+        setScopes: (next) => {
+            scopes = next;
+            void rememberScopes(config.sandboxUrl, next);
+        },
+        log,
+    }));
+    let stopped = false;
+    let socket;
+    let attempt = 0;
+    let resolveDone;
+    const done = new Promise((resolvePromise) => {
+        resolveDone = resolvePromise;
+    });
+    const open = () => {
+        const ws = new WebSocket(hostConnectUrl(config.sandboxUrl));
+        socket = ws;
+        ws.addEventListener("open", () => {
+            attempt = 0;
+            handler.upgrade(ws);
+            ws.send(JSON.stringify({ type: "hello", token: config.token, version }));
+            log(`connected to ${config.sandboxUrl} as "${config.id}"`);
+        });
+        ws.addEventListener("close", (event) => {
+            socket = undefined;
+            if (stopped) {
+                resolveDone();
+                return;
+            }
+            if (event.code === UNAUTHORIZED) {
+                log("the sandbox refused this computer's enrollment: it was revoked there. Run `intentic-machine computer uninstall` to clean up, or connect again from the sandbox.");
+                stopped = true;
+                resolveDone();
+                return;
+            }
+            attempt += 1;
+            const delay = Math.min(RETRY_MIN_MS * 2 ** (attempt - 1), RETRY_MAX_MS);
+            log(`disconnected (${event.code}); reconnecting in ${Math.round(delay / 1000)}s`);
+            setTimeout(open, delay);
+        });
+        ws.addEventListener("error", () => log("connection error"));
+    };
+    open();
+    return {
+        done,
+        stop: () => {
+            stopped = true;
+            socket?.close(1000, "stopping");
+            resolveDone();
+        },
+    };
+};
+//# sourceMappingURL=connection.js.map

package/dist/computer/connection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.js","sourceRoot":"","sources":["../../src/computer/connection.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAmB,MAAM,4BAA4B,CAAC;AAC7E,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAiB,cAAc,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAsB/C,MAAM,YAAY,GAAG,KAAK,CAAC;AAC3B,MAAM,YAAY,GAAG,MAAM,CAAC;AAE5B,MAAM,YAAY,GAAG,IAAI,CAAC;AAQ1B,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,MAAgB,EAAE,OAAe,EAAE,GAAQ,EAAkB,EAAE;IAInF,IAAI,MAAM,GAAe,MAAM,CAAC,MAAM,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,UAAU,CAC1B,gBAAgB,CAAC;QACb,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM;QACpB,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE;YAChB,MAAM,GAAG,IAAI,CAAC;YAMd,KAAK,cAAc,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACjD,CAAC;QACD,GAAG;KACN,CAAC,CACL,CAAC;IAEF,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,MAA6B,CAAC;IAClC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,WAAuB,CAAC;IAC5B,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,cAAc,EAAE,EAAE;QAC9C,WAAW,GAAG,cAAc,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,GAAS,EAAE;QACpB,MAAM,EAAE,GAAG,IAAI,SAAS,CAAC,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAC5D,MAAM,GAAG,EAAE,CAAC;QAEZ,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE;YAC7B,OAAO,GAAG,CAAC,CAAC;YAIZ,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACpB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YACzE,GAAG,CAAC,gBAAgB,MAAM,CAAC,UAAU,QAAQ,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YACnC,MAAM,GAAG,SAAS,CAAC;YACnB,IAAI,OAAO,EAAE,CAAC;gBACV,WAAW,EAAE,CAAC;gBACd,OAAO;YACX,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC9B,GAAG,CACC,iKAAiK,CACpK,CAAC;gBACF,OAAO,GAAG,IAAI,CAAC;gBACf,WAAW,EAAE,CAAC;gBACd,OAAO;YACX,CAAC;YACD,OAAO,IAAI,CAAC,CAAC;YACb,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;YACxE,GAAG,CAAC,iBAAiB,KAAK,CAAC,IAAI,sBAAsB,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;YAClF,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QAIH,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC;IAEF,IAAI,EAAE,CAAC;IAEP,OAAO;QACH,IAAI;QACJ,IAAI,EAAE,GAAG,EAAE;YACP,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAChC,WAAW,EAAE,CAAC;QAClB,CAAC;KACJ,CAAC;AACN,CAAC,CAAC"}

package/dist/computer/mcp.d.ts

@@ -0,0 +1,3 @@
+import { type HostScopes } from "@intentic/sandbox-contract";
+export declare const handleMcpMessage: (message: unknown, scopes: () => HostScopes) => Promise<Record<string, unknown> | undefined>;
+//# sourceMappingURL=mcp.d.ts.map

package/dist/computer/mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/computer/mcp.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,UAAU,EAAwB,MAAM,4BAA4B,CAAC;AAmYnF,eAAO,MAAM,gBAAgB,YAAmB,OAAO,UAAU,MAAM,UAAU,KAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CA+C9H,CAAC"}