@intentic/machine 1.245.0 → 1.246.1

package/README.md

@@ -1,6 +1,6 @@
 # @intentic/machine
 
-The one agent that lives on a user's own computer: it lets a sandbox's agent work on the machine, and keeps the
+The one agent that lives on a user's own device: it lets a sandbox's agent work on the machine, and keeps the
 machine's folders and ports mirrored with the sandbox — one binary, one resident loop, one logon entry.
 
 It replaces two agents (`@intentic/host` and `@intentic/sync`) that shared everything about *being installed* —
@@ -10,7 +10,7 @@ running" one answer instead of two halves of one.
 
 ## Responsibilities
 
-The **computer half** (`src/computer/`, the machine side of the `host` capability):
+The **device half** (`src/device/`, the machine side of the `host` capability):
 
 - Dial each linked sandbox — one outbound WebSocket, enrollment token in the first frame, oRPC after that; the
   machine *serves* `hostContract`, so no port ever opens here. Where it dials is the shared resolver's answer
@@ -19,10 +19,18 @@ The **computer half** (`src/computer/`, the machine side of the `host` capabilit
   recoverable) as MCP carried verbatim, so a machine can learn a tool without a daemon release.
 - Enforce the owner's scopes **here**, never in the sandbox, and append every call to an audit log that
   survives uninstall.
-- Keep each local sandbox's **next update downloaded** (`src/computer/auto-prepare.ts`): a background tick
+- Manage this machine's sandboxes for a browser button or a model, under the `sandboxes` switch: list them
+  with their **share of the machine** (one `docker inspect` per listing: memory and CPU caps, privileged, GPU,
+  and who asked for each directive, the approved environment or the owner), start/stop/restart, run the `ic`
+  flows (prepare, update, rebuild, rollback, reshape, remove) narrating their output line by line, and tail
+  their logs. `reshape` changes a sandbox's share or privileges through `ic sandbox reshape` on the same
+  switch as the swaps, because another reshape undoes it; its ask is a closed form (two caps, two switches)
+  spelled into `ic` flags here, so nothing a browser or a model sends reaches docker as text. `describe`
+  reports the docker engine's size beside the OS, which is the ceiling those caps are held to.
+- Keep each local sandbox's **next update downloaded** (`src/device/auto-prepare.ts`): a background tick
   runs `ic sandbox prepare <slug> --auto` every few hours, so the web app's update card offers a half-minute
-  restart instead of minutes of pulling. On by default; the switch is `intentic-machine computer updates
-  --off` (cached in `computer.json`). Nothing in any sandbox can start or steer the tick — a sandbox only
+  restart instead of minutes of pulling. On by default; the switch is `intentic-machine device updates
+  --off` (cached in `device.json`). Nothing in any sandbox can start or steer the tick — a sandbox only
   learns the outcome through the staged marker `ic` writes, the way it always has.
 
 The **sync half** (`src/sync/`, the machine side of desktop sync):
@@ -32,9 +40,9 @@ The **sync half** (`src/sync/`, the machine side of desktop sync):
 - Serve the SSH transport itself on loopback (the sandbox's sshd reached over its HTTPS surface), mirror every
   workspace port onto this machine's localhost, and bridge git so commits appear in local clones.
 - Own the **port-mirroring switch** (`sync mirror off|on`, optionally `--sandbox <id>`): mirroring is the one
-  thing here that writes to *this* computer's localhost, so the flag lives on this side, survives a restart, and
+  thing here that writes to *this* device's localhost, so the flag lives on this side, survives a restart, and
   is read every tick. File sync, the state backup and the git bridge are untouched by it — the point is to stop
-  the ports without unpairing the sandbox. The sandbox's Computers tab has a button for it, and that button runs
+  the ports without unpairing the sandbox. The sandbox's Devices tab has a button for it, and that button runs
   this very command over the `host` capability, so the two can never disagree. The same is true of the other
   three verbs — `sync pause`, `sync resume` and `sync uninstall --sandbox <id>`.
 
@@ -53,12 +61,12 @@ The **sync half** (`src/sync/`, the machine side of desktop sync):
 app's tray reads), self-`upgrade` with automatic rollback, the autostart spec, and **where a sandbox's daemon is
 dialled** ([src/daemon-base.ts](src/daemon-base.ts)). A sandbox usually runs in a container on this very
 machine, which publishes its daemon on `127.0.0.1:<port derived from the sandbox id>`, so every dial either half
-makes — the computer socket, both enrollments, the sync transport, the ports poll, the machine report — tries
+makes — the device socket, both enrollments, the sync transport, the ports poll, the machine report — tries
 that address first and the public URL last. A candidate is adopted only if the daemon's unauthenticated
 `/health` answers with the id we expected: a port is not a sandbox, and a token is what would be presented to
 whoever holds it. For the sync half the shortcut saves a multi-gigabyte Mutagen sync a trip out to the
-reachability edge and back to the same laptop. For the computer half it is reachability itself: the socket used
-to dial the public URL and nothing else, so a sandbox whose tunnel was down read "offline" on its own Computers
+reachability edge and back to the same laptop. For the device half it is reachability itself: the socket used
+to dial the public URL and nothing else, so a sandbox whose tunnel was down read "offline" on its own Devices
 tab, with every button there gone, while this same process was polling it over loopback. The watcher re-probes
 a pairing sitting on the public URL each minute, so a container started later is promoted with no restart; the
 socket re-resolves on every reconnect.
@@ -68,7 +76,7 @@ socket re-resolves on every reconnect.
 `intentic-machine run --foreground` (what systemd, launchd and the Windows launcher stub run) serves both
 halves in one process ([src/resident.ts](src/resident.ts)):
 
-- The sync half re-reads its pairing list every tick; the computer half's link list is fixed at startup, which
+- The sync half re-reads its pairing list every tick; the device half's link list is fixed at startup, which
   is why every `setup`/`uninstall` restarts the loop (`reconcileResidency`) instead of poking it.
 - The process exits — and takes the login entry with it — only when **both** halves have nothing to serve.
 - On a signal it exits `128+signal`, never 0: a supervisor must restart what it did not stop, and the incident
@@ -86,7 +94,7 @@ report stamped its own version into the one field, so the same machine answered
 its loop posts to and its installed build to one reading over a `host` capability.
 
 - `intentic-machine status` says which is which, and the summary the tray reads leads with `OLD BUILD RUNNING`.
-- The Computers row says it beside the pid, with the two commands that close it.
+- The Devices row says it beside the pid, with the two commands that close it.
 - `intentic-machine upgrade` restarts a loop that is behind the installed binary even when there is nothing to
   download, and after a swap it verifies that the loop which came up **is** the new build rather than that some
   process is alive — the check the old agent passed just as well as the new one.
@@ -95,21 +103,22 @@ its loop posts to and its installed build to one reading over a `host` capabilit
 
 ## Key files
 
-- [src/commands.ts](src/commands.ts) — the CLI surface: `computer setup|uninstall|updates`, `sync setup|pause|resume|mirror|uninstall`, shared `run|status|version|upgrade|uninstall`.
+- [src/commands.ts](src/commands.ts) — the CLI surface: `device setup|uninstall|updates`, `sync setup|pause|resume|mirror|uninstall`, shared `run|status|version|upgrade|uninstall`.
 - [src/install.ts](src/install.ts) — what every `setup` runs first: self-update (then re-exec), PATH repair, the Windows launcher stub. Everything the install scripts used to decide, decided once here.
 - [src/upgrade.ts](src/upgrade.ts) — `upgrade`: what is published, then download → probe → stop → swap → start, with a rollback behind every step, and a restart when the file is current but the loop is not.
 - [src/installed.ts](src/installed.ts) — which build the *file* at `bin/intentic-machine` is, as opposed to the one running: free while the two agree, one probe per swap after they stop.
 - [src/daemon-base.ts](src/daemon-base.ts) — where a sandbox's daemon is dialled, for both halves: loopback first when `/health` proves it is ours, the public URL as the floor.
 - [src/resident.ts](src/resident.ts) — the one loop, its pidfile, and `reconcileResidency`.
-- [src/computer/auto-prepare.ts](src/computer/auto-prepare.ts) — the background update-download tick; the judgement about *what* to download stays in `ic sandbox prepare --auto`, on purpose.
+- [src/device/auto-prepare.ts](src/device/auto-prepare.ts) — the background update-download tick; the judgement about *what* to download stays in `ic sandbox prepare --auto`, on purpose.
 - [src/status.ts](src/status.ts) — both halves as one answer; `--json` is what the desktop app and tray read.
-- [src/computer/policy.ts](src/computer/policy.ts) — what the sandbox is permitted to do here; the security surface.
+- [src/device/policy.ts](src/device/policy.ts) — what the sandbox is permitted to do here; the security surface.
+- [src/device/tools/sandboxes.ts](src/device/tools/sandboxes.ts) — the fleet: the `docker ps`/`inspect` readers, the docker verbs, and the `ic` flows (swap, reshape, remove, runners) with the pure argv builders beside them.
 - [src/sync/mirror.ts](src/sync/mirror.ts) — the sync tick: ports reconcile, git bridge, revocation handling.
 - [src/sync/mutagen.ts](src/sync/mutagen.ts) — driving the Mutagen binary, sessions and its daemon's autostart.
 
 ## How it fits
 
-Runs on the user's machine, not in the sandbox. Installed by `computer.{sh,ps1}` / `sync.{sh,ps1}` (both cards
+Runs on the user's machine, not in the sandbox. Installed by `device.{sh,ps1}` / `sync.{sh,ps1}` (both cards
 put the same binary in `~/.intentic/machine/bin`), shipped as a bun-compiled binary per platform, self-updated
 by `upgrade`.
 
@@ -124,13 +133,13 @@ place. The shims' remaining bootstrap blocks are held identical per dialect by
 
 The install-and-stay-alive plumbing is
 [`@intentic/local-agent`](../local-agent)'s; the windowless Windows logon start is
-[`_computers/win-launcher`](../win-launcher)'s.
+[`_devices/win-launcher`](../win-launcher)'s.
 
 ## Conventions & gotchas
 
 - **Bidirectional sync has no undo.** The integration tests here run against real directories and a real
   Mutagen for exactly that reason; a unit test that mocks the sync proves nothing about the case that loses work.
-- **The two halves keep separate state files** (`computer.json`, `sync.json`) in the one home: the loop rewrites
+- **The two halves keep separate state files** (`device.json`, `sync.json`) in the one home: the loop rewrites
   one half's state while a concurrent `setup` writes the other's, and separate files make cross-half torn
   writes impossible rather than unlikely.
 - **Scopes are a cache.** The sandbox pushes the real grant on every connect; what is stored only governs the

package/dist/app.js

@@ -3,7 +3,7 @@ import { buildApplication, buildRouteMap, text_en } from "@stricli/core";
 import { commands } from "./commands.js";
 export const app = buildApplication(buildRouteMap({
     routes: commands,
-    docs: { brief: "intentic-machine, connect this computer to your intentic sandboxes" },
+    docs: { brief: "intentic-machine, connect this device to your intentic sandboxes" },
 }), {
     name: "intentic-machine",
     scanner: { caseStyle: "allow-kebab-for-camel" },

package/dist/app.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAMzC,MAAM,CAAC,MAAM,GAAG,GAAG,gBAAgB,CAC/B,aAAa,CAAC;IACV,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,EAAE,KAAK,EAAE,oEAAoE,EAAE;CACxF,CAAC,EACF;IACI,IAAI,EAAE,kBAAkB;IACxB,OAAO,EAAE,EAAE,SAAS,EAAE,uBAAuB,EAAE;IAE/C,YAAY,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,EAAE;CAC1E,CACJ,CAAC"}
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAMzC,MAAM,CAAC,MAAM,GAAG,GAAG,gBAAgB,CAC/B,aAAa,CAAC;IACV,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,EAAE,KAAK,EAAE,kEAAkE,EAAE;CACtF,CAAC,EACF;IACI,IAAI,EAAE,kBAAkB;IACxB,OAAO,EAAE,EAAE,SAAS,EAAE,uBAAuB,EAAE;IAE/C,YAAY,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,EAAE;CAC1E,CACJ,CAAC"}

package/dist/autostart.js

@@ -3,7 +3,7 @@ export const MACHINE_AUTOSTART = {
     id: "intentic-machine",
     windowsRunValue: "IntenticMachine",
     desktopName: "Intentic Machine Agent",
-    desktopComment: "Connect this computer to your intentic sandboxes: agent access, file sync, port mirroring",
+    desktopComment: "Connect this device to your intentic sandboxes: agent access, file sync, port mirroring",
     logPath: runLogPath,
     launchAgent: { label: "dev.intentic.machine" },
     detachedArgs: ["run"],

package/dist/autostart.js.map

@@ -1 +1 @@
-{"version":3,"file":"autostart.js","sourceRoot":"","sources":["../src/autostart.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAWzC,MAAM,CAAC,MAAM,iBAAiB,GAAkB;IAC5C,EAAE,EAAE,kBAAkB;IACtB,eAAe,EAAE,iBAAiB;IAClC,WAAW,EAAE,wBAAwB;IACrC,cAAc,EAAE,2FAA2F;IAG3G,OAAO,EAAE,UAAU;IACnB,WAAW,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE;IAC9C,YAAY,EAAE,CAAC,KAAK,CAAC;IACrB,cAAc,EAAE,CAAC,KAAK,EAAE,cAAc,CAAC;IACvC,WAAW,EAAE,CAAC,MAAM,EAAE,EAAE,CACpB,mEAAmE,MAAM,uFAAuF,UAAU,EAAE;CACnL,CAAC"}
+{"version":3,"file":"autostart.js","sourceRoot":"","sources":["../src/autostart.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAWzC,MAAM,CAAC,MAAM,iBAAiB,GAAkB;IAC5C,EAAE,EAAE,kBAAkB;IACtB,eAAe,EAAE,iBAAiB;IAClC,WAAW,EAAE,wBAAwB;IACrC,cAAc,EAAE,yFAAyF;IAGzG,OAAO,EAAE,UAAU;IACnB,WAAW,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE;IAC9C,YAAY,EAAE,CAAC,KAAK,CAAC;IACrB,cAAc,EAAE,CAAC,KAAK,EAAE,cAAc,CAAC;IACvC,WAAW,EAAE,CAAC,MAAM,EAAE,EAAE,CACpB,mEAAmE,MAAM,uFAAuF,UAAU,EAAE;CACnL,CAAC"}

package/dist/commands.d.ts

@@ -1,6 +1,6 @@
 import { type CommandContext } from "@stricli/core";
 export declare const commands: {
-    computer: import("@stricli/core").RouteMap<CommandContext>;
+    device: import("@stricli/core").RouteMap<CommandContext>;
     sync: import("@stricli/core").RouteMap<CommandContext>;
     run: import("@stricli/core").Command<CommandContext>;
     status: import("@stricli/core").Command<CommandContext>;

package/dist/commands.js

@@ -1,5 +1,5 @@
 import { buildCommand, buildRouteMap } from "@stricli/core";
-import { computerCommands, computerUninstall } from "./computer/commands.js";
+import { deviceCommands, deviceUninstall } from "./device/commands.js";
 import { ensureWindowsLauncher, machineUpgradeExec } from "./install.js";
 import { reconcileResidency, runForeground, stopResident } from "./resident.js";
 import { status } from "./status.js";
@@ -58,14 +58,14 @@ const uninstall = buildCommand({
     async func() {
         const out = (message) => void this.process.stdout.write(`${message}\n`);
         await syncUninstall(out);
-        await computerUninstall(out);
+        await deviceUninstall(out);
         out("Nothing intentic stays resident on this machine.");
     },
 });
 export const commands = {
-    computer: buildRouteMap({
-        routes: computerCommands,
-        docs: { brief: "Let a sandbox work on this computer (the Connect-this-computer card)" },
+    device: buildRouteMap({
+        routes: deviceCommands,
+        docs: { brief: "Let a sandbox work on this device (the Connect-this-device card)" },
     }),
     sync: buildRouteMap({
         routes: syncCommands,

package/dist/commands.js.map

@@ -1 +1 @@
-{"version":3,"file":"commands.js","sourceRoot":"","sources":["../src/commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAuB,MAAM,eAAe,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAChF,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAiB/C,MAAM,GAAG,GAAG,YAAY,CAAW;IAC/B,IAAI,EAAE,EAAE,KAAK,EAAE,sGAAsG,EAAE;IACvH,UAAU,EAAE;QACR,KAAK,EAAE;YACH,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,yDAAyD,EAAE;YACjG,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,0BAA0B,EAAE;SAC/D;KACJ;IACD,KAAK,CAAC,IAAI,CAAuB,KAAe;QAC5C,MAAM,GAAG,GAAG,CAAC,OAAe,EAAQ,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;QACtF,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,MAAM,YAAY,EAAE,CAAC;YACjC,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;YAClE,OAAO;QACX,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YAGpB,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;YAC9B,OAAO;QACX,CAAC;QAED,MAAM,aAAa,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC;IACnH,CAAC;CACJ,CAAC,CAAC;AAMH,MAAM,OAAO,GAAG,YAAY,CAAC;IACzB,IAAI,EAAE,EAAE,KAAK,EAAE,4BAA4B,EAAE;IAC7C,UAAU,EAAE,EAAE;IACd,IAAI;QACA,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,eAAe,IAAI,CAAC,CAAC;QAClD,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC;CACJ,CAAC,CAAC;AAeH,MAAM,OAAO,GAAG,YAAY,CAAe;IACvC,IAAI,EAAE,EAAE,KAAK,EAAE,0EAA0E,EAAE;IAC3F,UAAU,EAAE;QACR,KAAK,EAAE;YACH,KAAK,EAAE;gBACH,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,6FAA6F;aACvG;SACJ;KACJ;IACD,KAAK,CAAC,IAAI,CAAuB,KAAmB;QAChD,MAAM,GAAG,GAAG,CAAC,OAAe,EAAQ,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;QACtF,GAAG,CAAC,cAAc,CAAC,MAAM,UAAU,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAE5G,MAAM,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;CACJ,CAAC,CAAC;AAKH,MAAM,SAAS,GAAG,YAAY,CAAC;IAC3B,IAAI,EAAE,EAAE,KAAK,EAAE,+FAA+F,EAAE;IAChH,UAAU,EAAE,EAAE;IACd,KAAK,CAAC,IAAI;QACN,MAAM,GAAG,GAAG,CAAC,OAAe,EAAQ,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;QACtF,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC7B,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAC5D,CAAC;CACJ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACpB,QAAQ,EAAE,aAAa,CAAC;QACpB,MAAM,EAAE,gBAAgB;QACxB,IAAI,EAAE,EAAE,KAAK,EAAE,sEAAsE,EAAE;KAC1F,CAAC;IACF,IAAI,EAAE,aAAa,CAAC;QAChB,MAAM,EAAE,YAAY;QACpB,IAAI,EAAE,EAAE,KAAK,EAAE,8EAA8E,EAAE;KAClG,CAAC;IACF,GAAG;IACH,MAAM;IACN,OAAO;IACP,OAAO;IACP,SAAS;CACZ,CAAC"}
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../src/commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAuB,MAAM,eAAe,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAChF,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAiB/C,MAAM,GAAG,GAAG,YAAY,CAAW;IAC/B,IAAI,EAAE,EAAE,KAAK,EAAE,sGAAsG,EAAE;IACvH,UAAU,EAAE;QACR,KAAK,EAAE;YACH,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,yDAAyD,EAAE;YACjG,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,0BAA0B,EAAE;SAC/D;KACJ;IACD,KAAK,CAAC,IAAI,CAAuB,KAAe;QAC5C,MAAM,GAAG,GAAG,CAAC,OAAe,EAAQ,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;QACtF,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,MAAM,YAAY,EAAE,CAAC;YACjC,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;YAClE,OAAO;QACX,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YAGpB,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;YAC9B,OAAO;QACX,CAAC;QAED,MAAM,aAAa,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC;IACnH,CAAC;CACJ,CAAC,CAAC;AAMH,MAAM,OAAO,GAAG,YAAY,CAAC;IACzB,IAAI,EAAE,EAAE,KAAK,EAAE,4BAA4B,EAAE;IAC7C,UAAU,EAAE,EAAE;IACd,IAAI;QACA,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,eAAe,IAAI,CAAC,CAAC;QAClD,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC;CACJ,CAAC,CAAC;AAeH,MAAM,OAAO,GAAG,YAAY,CAAe;IACvC,IAAI,EAAE,EAAE,KAAK,EAAE,0EAA0E,EAAE;IAC3F,UAAU,EAAE;QACR,KAAK,EAAE;YACH,KAAK,EAAE;gBACH,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,6FAA6F;aACvG;SACJ;KACJ;IACD,KAAK,CAAC,IAAI,CAAuB,KAAmB;QAChD,MAAM,GAAG,GAAG,CAAC,OAAe,EAAQ,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;QACtF,GAAG,CAAC,cAAc,CAAC,MAAM,UAAU,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAE5G,MAAM,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;CACJ,CAAC,CAAC;AAKH,MAAM,SAAS,GAAG,YAAY,CAAC;IAC3B,IAAI,EAAE,EAAE,KAAK,EAAE,+FAA+F,EAAE;IAChH,UAAU,EAAE,EAAE;IACd,KAAK,CAAC,IAAI;QACN,MAAM,GAAG,GAAG,CAAC,OAAe,EAAQ,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;QACtF,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QAC3B,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAC5D,CAAC;CACJ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACpB,MAAM,EAAE,aAAa,CAAC;QAClB,MAAM,EAAE,cAAc;QACtB,IAAI,EAAE,EAAE,KAAK,EAAE,kEAAkE,EAAE;KACtF,CAAC;IACF,IAAI,EAAE,aAAa,CAAC;QAChB,MAAM,EAAE,YAAY;QACpB,IAAI,EAAE,EAAE,KAAK,EAAE,8EAA8E,EAAE;KAClG,CAAC;IACF,GAAG;IACH,MAAM;IACN,OAAO;IACP,OAAO;IACP,SAAS;CACZ,CAAC"}

package/dist/config.d.ts

@@ -1,4 +1,5 @@
 export declare const baseDir: string;
 export declare const runPidPath: string;
 export declare const runLogPath: string;
+export declare const agentLogPath: string;
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,OAAO,QAAW,CAAC;AAQhC,eAAO,MAAM,UAAU,QAA+B,CAAC;AACvD,eAAO,MAAM,UAAU,QAA+B,CAAC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,OAAO,QAAW,CAAC;AAQhC,eAAO,MAAM,UAAU,QAA+B,CAAC;AACvD,eAAO,MAAM,UAAU,QAA+B,CAAC;AASvD,eAAO,MAAM,YAAY,QAAsC,CAAC"}

package/dist/config.js

@@ -4,4 +4,5 @@ const home = agentHome("machine");
 export const baseDir = home.dir;
 export const runPidPath = join(baseDir, "machine.pid");
 export const runLogPath = join(baseDir, "machine.log");
+export const agentLogPath = join(baseDir, "machine-update.log");
 //# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AASlD,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;AAClC,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC;AAQhC,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AACvD,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AASlD,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;AAClC,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC;AAQhC,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AACvD,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AASvD,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC"}

package/dist/device/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/device/audit.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,KAAK,UAAiB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,KAAG,OAAO,CAAC,IAAI,CAO9F,CAAC"}

package/dist/device/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/device/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAWxC,MAAM,CAAC,MAAM,KAAK,GAAG,KAAK,EAAE,KAAoD,EAAiB,EAAE;IAC/F,IAAI,CAAC;QACD,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvD,MAAM,UAAU,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtI,CAAC;IAAC,MAAM,CAAC;IAET,CAAC;AACL,CAAC,CAAC"}

package/dist/{computer → device}/auto-prepare.d.ts

@@ -1,6 +1,6 @@
 import type { Log } from "@intentic/local-agent";
-import type { MachineSandbox } from "@intentic/sandbox-contract";
-export declare const prepareTargets: (boxes: readonly MachineSandbox[]) => string[];
+import type { DeviceSandbox } from "@intentic/sandbox-contract";
+export declare const prepareTargets: (boxes: readonly DeviceSandbox[]) => string[];
 export declare const ticksToSkip: (failures: number) => number;
 export declare const autoPrepareArgs: (slug: string) => string[];
 export interface AutoPrepareState {
@@ -8,7 +8,7 @@ export interface AutoPrepareState {
     readonly waits: Map<string, number>;
 }
 export declare const newState: () => AutoPrepareState;
-export declare const runTick: (state: AutoPrepareState, boxes: readonly MachineSandbox[], prepare: (slug: string) => Promise<{
+export declare const runTick: (state: AutoPrepareState, boxes: readonly DeviceSandbox[], prepare: (slug: string) => Promise<{
     code: number;
     output: string;
 }>, log: Log, busy?: ReadonlySet<string>) => Promise<void>;

package/dist/device/auto-prepare.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto-prepare.d.ts","sourceRoot":"","sources":["../../src/device/auto-prepare.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AA2ChE,eAAO,MAAM,cAAc,UAAW,SAAS,aAAa,EAAE,KAAG,MAAM,EACyB,CAAC;AAGjG,eAAO,MAAM,WAAW,aAAc,MAAM,KAAG,MAA6E,CAAC;AAI7H,eAAO,MAAM,eAAe,SAAU,MAAM,KAAG,MAAM,EAA4C,CAAC;AAIlG,MAAM,WAAW,gBAAgB;IAC7B,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC;AAED,eAAO,MAAM,QAAQ,QAAO,gBAA+D,CAAC;AAyC5F,eAAO,MAAM,OAAO,UACT,gBAAgB,SAChB,SAAS,aAAa,EAAE,WACtB,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,OAC/D,GAAG,SACF,WAAW,CAAC,MAAM,CAAC,KAC1B,OAAO,CAAC,IAAI,CAuBd,CAAC;AAMF,eAAO,MAAM,gBAAgB,QAAS,GAAG,KAAG;IAAE,IAAI,EAAE,MAAM,IAAI,CAAA;CA4B7D,CAAC"}

package/dist/device/auto-prepare.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto-prepare.js","sourceRoot":"","sources":["../../src/device/auto-prepare.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAGrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAyBhE,MAAM,aAAa,GAAG,CAAC,GAAG,MAAM,CAAC;AAGjC,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;AAEhC,MAAM,SAAS,GAAG,EAAE,GAAG,MAAM,CAAC;AAG9B,MAAM,cAAc,GAAG,CAAC,CAAC;AAQzB,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAA+B,EAAY,EAAE,CACxE,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAGjG,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC;AAI7H,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAY,EAAY,EAAE,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;AASlG,MAAM,CAAC,MAAM,QAAQ,GAAG,GAAqB,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;AAI5F,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAsB,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAEtH,MAAM,UAAU,GAAG,KAAK,EACpB,KAAuB,EACvB,IAAY,EACZ,OAAoE,EACpE,GAAQ,EACK,EAAE;IACf,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrB,IAAI,GAAqC,CAAC;IAC1C,IAAI,CAAC;QACD,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAGb,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACnD,CAAC;YAAS,CAAC;QACP,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACjB,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5B,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,GAAG,CAAC,gBAAgB,IAAI,KAAK,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;QAC/D,OAAO;IACX,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACrD,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACnC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7C,GAAG,CACC,gBAAgB,IAAI,qBAAqB,QAAQ,oBAAoB,WAAW,CAAC,QAAQ,CAAC,eAAe,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,WAAW,EAAE,CACjJ,CAAC;AACN,CAAC,CAAC;AAMF,MAAM,CAAC,MAAM,OAAO,GAAG,KAAK,EACxB,KAAuB,EACvB,KAA+B,EAC/B,OAAoE,EACpE,GAAQ,EACR,IAAI,GAAwB,UAAU,EACzB,EAAE;IACf,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAGtC,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5B,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;IACL,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAEzB,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACjB,SAAS;QACb,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;YACX,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;YAChC,SAAS;QACb,CAAC;QAED,MAAM,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC;AACL,CAAC,CAAC;AAMF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAQ,EAAwB,EAAE;IAC/D,IAAI,KAAiC,CAAC;IACtC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IACzB,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAQ,EAAE;QACrC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;QACnC,IAAI,CAAC;YACD,IAAI,MAAM,kBAAkB,EAAE,EAAE,CAAC;gBAC7B,MAAM,OAAO,CAAC,KAAK,EAAE,MAAM,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;YAClH,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAGb,GAAG,CAAC,sCAAsC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC;QAC9D,CAAC;IACL,CAAC,CAAC;IACF,QAAQ,CAAC,aAAa,CAAC,CAAC;IACxB,OAAO;QACH,IAAI,EAAE,GAAS,EAAE;YACb,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;KACJ,CAAC;AACN,CAAC,CAAC"}

package/dist/{computer → device}/commands.d.ts

@@ -1,7 +1,7 @@
 import { type Log } from "@intentic/local-agent";
 import { type CommandContext } from "@stricli/core";
-export declare const computerUninstall: (out: Log, sandbox?: string) => Promise<void>;
-export declare const computerCommands: {
+export declare const deviceUninstall: (out: Log, sandbox?: string) => Promise<void>;
+export declare const deviceCommands: {
     setup: import("@stricli/core").Command<CommandContext>;
     uninstall: import("@stricli/core").Command<CommandContext>;
     updates: import("@stricli/core").Command<CommandContext>;

package/dist/device/commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../src/device/commands.ts"],"names":[],"mappings":"AAEA,OAAO,EAAY,KAAK,GAAG,EAA0B,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAwKlE,eAAO,MAAM,eAAe,QAAe,GAAG,YAAY,MAAM,KAAG,OAAO,CAAC,IAAI,CA2B9E,CAAC;AA6CF,eAAO,MAAM,cAAc;;;;CAAgC,CAAC"}

package/dist/{computer → device}/commands.js

@@ -23,7 +23,7 @@ const enroll = async (sandboxUrl, pairToken, { attempts = 10, delayMs = 3000 } =
             continue;
         }
         if (response.status === 401) {
-            throw new Error("that pairing has expired: click Connect again on the computer's card in your sandbox for a fresh command.");
+            throw new Error("that pairing has expired: click Connect again on the device's card in your sandbox for a fresh command.");
         }
         if (response.status >= 500 && attempt < attempts) {
             process.stderr.write(`connecting: the sandbox is warming up (HTTP ${response.status}), retrying (${attempt}/${attempts})…\n`);
@@ -31,24 +31,24 @@ const enroll = async (sandboxUrl, pairToken, { attempts = 10, delayMs = 3000 } =
             continue;
         }
         if (!response.ok) {
-            throw new Error(`connecting this computer failed (${response.status}): ${await response.text()}`);
+            throw new Error(`connecting this device failed (${response.status}): ${await response.text()}`);
         }
         return (await response.json());
     }
 };
 const setup = buildCommand({
-    docs: { brief: "Connect this computer to an intentic sandbox using a one-time pairing token" },
+    docs: { brief: "Connect this device to an intentic sandbox using a one-time pairing token" },
     parameters: {
         flags: {
             url: { kind: "parsed", parse: String, brief: "The sandbox's URL (e.g. https://sandbox-xxx.example.dev)" },
-            pair: { kind: "parsed", parse: String, brief: "The one-time pairing token from the computer's capability card" },
+            pair: { kind: "parsed", parse: String, brief: "The one-time pairing token from the device's capability card" },
         },
     },
     async func(flags) {
         await prepareSetup((message) => void this.process.stdout.write(`${message}\n`), process.argv.slice(2));
         const ui = createUi(this.process);
         const out = ui.note;
-        ui.begin("intentic · connect this computer", SETUP_PLAN);
+        ui.begin("intentic · connect this device", SETUP_PLAN);
         try {
             await runSetup(ui, out, flags);
         }
@@ -58,31 +58,31 @@ const setup = buildCommand({
     },
 });
 const SETUP_PLAN = [
-    { phase: "computer-enrolling", label: "Enrol this computer", weight: 10 },
-    { phase: "computer-starting", label: "Start the agent", weight: 15 },
+    { phase: "device-enrolling", label: "Enrol this device", weight: 10 },
+    { phase: "device-starting", label: "Start the agent", weight: 15 },
 ];
 const runSetup = async (ui, out, flags) => {
-    ui.step("computer-enrolling", "enrolling this computer with your sandbox…");
-    const { id, hostToken } = await enroll(flags.url, flags.pair);
+    ui.step("device-enrolling", "enrolling this device with your sandbox…");
+    const { id, token } = await enroll(flags.url, flags.pair);
     const link = {
         sandboxUrl: flags.url,
         id,
-        token: hostToken,
+        token,
         scopes: { shell: "off", write: "off", screen: "off", control: "off", sandboxes: "off", sandboxRemove: "off", destructive: "off" },
     };
     const links = await upsertLink(link);
-    ui.step("computer-starting", "starting the agent on this computer…");
+    ui.step("device-starting", "starting the agent on this device…");
     await reconcileResidency(out);
     const others = links.length - 1;
-    ui.finished("This computer is connected.", id, others === 0
+    ui.finished("This device is connected.", id, others === 0
         ? "Its permissions are set in the sandbox, on the same card you got this command from."
         : `Its permissions are set in the sandbox, on the same card you got this command from. Still connected to ${others} other sandbox${others === 1 ? "" : "es"}.`, [
         ["check it", "intentic-machine status"],
-        ["disconnect", "intentic-machine computer uninstall"],
+        ["disconnect", "intentic-machine device uninstall"],
     ]);
 };
 const uninstall = buildCommand({
-    docs: { brief: "Disconnect this computer from one sandbox, or from all of them" },
+    docs: { brief: "Disconnect this device from one sandbox, or from all of them" },
     parameters: {
         flags: {
             sandbox: { kind: "parsed", parse: String, brief: "Disconnect only this sandbox URL (default: every one)", optional: true },
@@ -90,15 +90,15 @@ const uninstall = buildCommand({
     },
     async func(flags) {
         const out = (message) => void this.process.stdout.write(`${message}\n`);
-        await computerUninstall(out, flags.sandbox);
+        await deviceUninstall(out, flags.sandbox);
     },
 });
-export const computerUninstall = async (out, sandbox) => {
+export const deviceUninstall = async (out, sandbox) => {
     const only = sandbox === undefined || sandbox === "" ? undefined : sandbox;
     const dropped = await removeLinks(only);
     const left = await readLinks();
     if (only !== undefined && dropped.length === 0) {
-        out(`This computer is not connected to ${only}. Nothing changed.`);
+        out(`This device is not connected to ${only}. Nothing changed.`);
         return;
     }
     if (left.length === 0) {
@@ -111,7 +111,7 @@ export const computerUninstall = async (out, sandbox) => {
     }
     out(dropped.length === 0
         ? "Nothing was connected. Removed any leftovers."
-        : `Disconnected from ${dropped.map((link) => link.sandboxUrl).join(", ")}. Each sandbox still lists this computer until it is removed there, its access is already gone.`);
+        : `Disconnected from ${dropped.map((link) => link.sandboxUrl).join(", ")}. Each sandbox still lists this device until it is removed there, its access is already gone.`);
     out(`Your record of what this agent did stays at ${auditPath}.`);
 };
 const updates = buildCommand({
@@ -140,5 +140,5 @@ const updates = buildCommand({
             : "Background update downloads are off. The update card in your sandbox still downloads and applies on demand.");
     },
 });
-export const computerCommands = { setup, uninstall, updates };
+export const deviceCommands = { setup, uninstall, updates };
 //# sourceMappingURL=commands.js.map

package/dist/device/commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../../src/device/commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtC,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAoC,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAE,YAAY,EAAuB,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAiB,SAAS,EAAE,kBAAkB,EAAE,WAAW,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAgBhJ,MAAM,MAAM,GAAG,KAAK,EAChB,UAAkB,EAClB,SAAiB,EACjB,EAAE,QAAQ,GAAG,EAAE,EAAE,OAAO,GAAG,IAAI,EAAE,GAA4C,EAAE,EACzC,EAAE;IACxC,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;QAOhC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,GAAG,IAAI,sBAAsB,CAAC;QAC1C,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACD,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,iBAAiB,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAC/F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;gBACtB,MAAM,KAAK,CAAC;YAChB,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0DAA0D,OAAO,IAAI,QAAQ,MAAM,CAAC,CAAC;YAC1G,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;YACrB,SAAS;QACb,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,yGAAyG,CAAC,CAAC;QAC/H,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,OAAO,GAAG,QAAQ,EAAE,CAAC;YAC/C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,QAAQ,CAAC,MAAM,gBAAgB,OAAO,IAAI,QAAQ,MAAM,CAAC,CAAC;YAC9H,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;YACrB,SAAS;QACb,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,CAAC,MAAM,MAAM,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkC,CAAC;IACpE,CAAC;AACL,CAAC,CAAC;AAOF,MAAM,KAAK,GAAG,YAAY,CAAa;IACnC,IAAI,EAAE,EAAE,KAAK,EAAE,2EAA2E,EAAE;IAC5F,UAAU,EAAE;QACR,KAAK,EAAE;YACH,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,0DAA0D,EAAE;YACzG,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,8DAA8D,EAAE;SACjH;KACJ;IACD,KAAK,CAAC,IAAI,CAAuB,KAAiB;QAI9C,MAAM,YAAY,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAKvG,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,GAAG,GAAQ,EAAE,CAAC,IAAI,CAAC;QACzB,EAAE,CAAC,KAAK,CAAC,gCAAgC,EAAE,UAAU,CAAC,CAAC;QACvD,IAAI,CAAC;YACD,MAAM,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC;gBAAS,CAAC;YACP,EAAE,CAAC,KAAK,EAAE,CAAC;QACf,CAAC;IACL,CAAC;CACJ,CAAC,CAAC;AAMH,MAAM,UAAU,GAAwB;IACpC,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,EAAE,EAAE;IACrE,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,EAAE,EAAE;CACrE,CAAC;AAEF,MAAM,QAAQ,GAAG,KAAK,EAAE,EAAM,EAAE,GAAQ,EAAE,KAAiB,EAAiB,EAAE;IAC1E,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,0CAA0C,CAAC,CAAC;IACxE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAK1D,MAAM,IAAI,GAAa;QACnB,UAAU,EAAE,KAAK,CAAC,GAAG;QACrB,EAAE;QACF,KAAK;QACL,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE;KACpI,CAAC;IAOF,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;IACrC,EAAE,CAAC,IAAI,CAAC,iBAAiB,EAAE,oCAAoC,CAAC,CAAC;IAKjE,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAG9B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAChC,EAAE,CAAC,QAAQ,CACP,2BAA2B,EAC3B,EAAE,EACF,MAAM,KAAK,CAAC;QACR,CAAC,CAAC,qFAAqF;QACvF,CAAC,CAAC,0GAA0G,MAAM,iBAAiB,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,EAClK;QACI,CAAC,UAAU,EAAE,yBAAyB,CAAC;QACvC,CAAC,YAAY,EAAE,mCAAmC,CAAC;KACtD,CACJ,CAAC;AACN,CAAC,CAAC;AAMF,MAAM,SAAS,GAAG,YAAY,CAAiB;IAC3C,IAAI,EAAE,EAAE,KAAK,EAAE,8DAA8D,EAAE;IAC/E,UAAU,EAAE;QACR,KAAK,EAAE;YAGH,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,uDAAuD,EAAE,QAAQ,EAAE,IAAI,EAAE;SAC7H;KACJ;IACD,KAAK,CAAC,IAAI,CAAuB,KAAqB;QAClD,MAAM,GAAG,GAAG,CAAC,OAAe,EAAQ,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;QACtF,MAAM,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;CACJ,CAAC,CAAC;AAOH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,GAAQ,EAAE,OAAgB,EAAiB,EAAE;IAC/E,MAAM,IAAI,GAAG,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;IAC3E,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,MAAM,SAAS,EAAE,CAAC;IAC/B,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,mCAAmC,IAAI,oBAAoB,CAAC,CAAC;QACjE,OAAO;IACX,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAIpB,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClB,GAAG,CACC,qBAAqB,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,IAAI,CAAC,MAAM,WAAW,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CACvJ,CAAC;QACF,OAAO;IACX,CAAC;IACD,GAAG,CACC,OAAO,CAAC,MAAM,KAAK,CAAC;QAChB,CAAC,CAAC,+CAA+C;QACjD,CAAC,CAAC,qBAAqB,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,+FAA+F,CAC9K,CAAC;IACF,GAAG,CAAC,+CAA+C,SAAS,GAAG,CAAC,CAAC;AACrE,CAAC,CAAC;AAWF,MAAM,OAAO,GAAG,YAAY,CAAe;IACvC,IAAI,EAAE,EAAE,KAAK,EAAE,iHAAiH,EAAE;IAClI,UAAU,EAAE;QACR,KAAK,EAAE;YACH,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,kDAAkD,EAAE;YAClF,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,4CAA4C,EAAE;SAChF;KACJ;IACD,KAAK,CAAC,IAAI,CAAuB,KAAmB;QAChD,MAAM,GAAG,GAAG,CAAC,OAAe,EAAQ,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;QACtF,IAAI,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YAC1B,GAAG,CACC,CAAC,MAAM,kBAAkB,EAAE,CAAC;gBACxB,CAAC,CAAC,uJAAuJ;gBACzJ,CAAC,CAAC,0IAA0I,CACnJ,CAAC;YACF,OAAO;QACX,CAAC;QACD,MAAM,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAIpC,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC9B,GAAG,CACC,KAAK,CAAC,EAAE;YACJ,CAAC,CAAC,kEAAkE;YACpE,CAAC,CAAC,6GAA6G,CACtH,CAAC;IACN,CAAC;CACJ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC"}

package/dist/device/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/device/config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAS7D,eAAO,MAAM,UAAU,QAA+B,CAAC;AACvD,eAAO,MAAM,SAAS,QAA+B,CAAC;AActD,MAAM,WAAW,QAAQ;IAErB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;CAC/B;AAcD,MAAM,WAAW,cAAc;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,QAAQ,EAAE,CAAC;IAMpC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;CACrC;AAED,eAAO,MAAM,cAAc,QAAa,OAAO,CAAC,cAAc,CAAqE,CAAC;AAEpI,eAAO,MAAM,eAAe,WAAkB,cAAc,KAAG,OAAO,CAAC,IAAI,CACS,CAAC;AAarF,eAAO,MAAM,SAAS,QAAa,OAAO,CAAC,SAAS,QAAQ,EAAE,CAAiE,CAAC;AAMhI,eAAO,MAAM,UAAU,SAAgB,QAAQ,KAAG,OAAO,CAAC,SAAS,QAAQ,EAAE,CAM5E,CAAC;AAGF,eAAO,MAAM,WAAW,gBAAuB,MAAM,KAAG,OAAO,CAAC,SAAS,QAAQ,EAAE,CAKlF,CAAC;AAIF,eAAO,MAAM,cAAc,eAAsB,MAAM,UAAU,UAAU,KAAG,OAAO,CAAC,IAAI,CAQzF,CAAC;AAIF,eAAO,MAAM,kBAAkB,QAAa,OAAO,CAAC,OAAO,CAA8E,CAAC;AAE1I,eAAO,MAAM,mBAAmB,OAAc,OAAO,KAAG,OAAO,CAAC,IAAI,CAEnE,CAAC"}

package/dist/{computer → device}/config.js

@@ -2,7 +2,7 @@ import { readFile } from "node:fs/promises";
 import { join } from "node:path";
 import { writeSecretFile } from "@intentic/local-agent";
 import { baseDir } from "../config.js";
-export const configPath = join(baseDir, "computer.json");
+export const configPath = join(baseDir, "device.json");
 export const auditPath = join(baseDir, "audit.jsonl");
 export const readHostConfig = async () => JSON.parse(await readFile(configPath, "utf8"));
 export const writeHostConfig = async (config) => await writeSecretFile(configPath, baseDir, JSON.stringify(config, undefined, 2));

package/dist/device/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/device/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAQvC,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AACvD,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AA6CtD,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,IAA6B,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAmB,CAAC;AAEpI,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,MAAsB,EAAiB,EAAE,CAC3E,MAAM,eAAe,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;AAIrF,MAAM,gBAAgB,GAAG,KAAK,EAAE,MAAkD,EAA2B,EAAE;IAC3G,MAAM,MAAM,GAAG,CAAC,MAAM,cAAc,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAChF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC;AAChB,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,IAAkC,EAAE,CAAC,CAAC,MAAM,cAAc,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;AAMhI,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAAE,IAAc,EAAgC,EAAE;IAC7E,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAChD,GAAG,MAAM;QACT,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC;KAC/F,CAAC,CAAC,CAAC;IACJ,OAAO,OAAO,CAAC,KAAK,CAAC;AACzB,CAAC,CAAC;AAGF,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,UAAmB,EAAgC,EAAE;IACnF,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;IAC1G,MAAM,gBAAgB,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxJ,OAAO,OAAO,CAAC;AACnB,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,UAAkB,EAAE,MAAkB,EAAiB,EAAE;IAC1F,MAAM,gBAAgB,CAAC,CAAC,MAAM,EAAE,EAAE;QAC9B,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;QAG5E,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC9B,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IAC1G,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC9B,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,IAAsB,EAAE,CAAC,CAAC,MAAM,cAAc,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,cAAc,KAAK,KAAK,CAAC;AAE1I,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,EAAW,EAAiB,EAAE;IACpE,MAAM,gBAAgB,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAC5E,CAAC,CAAC"}

package/dist/{computer → device}/connection.d.ts

@@ -1,13 +1,10 @@
 import type { Log } from "@intentic/local-agent";
+import { type PeerLink } from "@intentic/sandbox-contract/peer-dial";
 import { type DaemonBase } from "../daemon-base.js";
 import { type HostLink } from "./config.js";
-export interface HostConnection {
-    readonly done: Promise<void>;
-    readonly stop: () => void;
-}
 export interface Dial {
     readonly resolveBase: (sandboxUrl: string) => Promise<DaemonBase>;
     readonly socket: (url: string) => WebSocket;
 }
-export declare const connect: (config: HostLink, version: string, log: Log, dial?: Dial) => HostConnection;
+export declare const connect: (config: HostLink, version: string, log: Log, dial?: Dial) => PeerLink;
 //# sourceMappingURL=connection.d.ts.map

package/dist/device/connection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../src/device/connection.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,uBAAuB,CAAC;AAEjD,OAAO,EAA+B,KAAK,QAAQ,EAAE,MAAM,sCAAsC,CAAC;AAElG,OAAO,EAAE,KAAK,UAAU,EAAqB,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,KAAK,QAAQ,EAAkB,MAAM,aAAa,CAAC;AAuB5D,MAAM,WAAW,IAAI;IACjB,QAAQ,CAAC,WAAW,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IAClE,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,SAAS,CAAC;CAC/C;AAID,eAAO,MAAM,OAAO,WAAY,QAAQ,WAAW,MAAM,OAAO,GAAG,SAAQ,IAAI,KAAc,QAyC5F,CAAC"}

package/dist/device/connection.js

@@ -0,0 +1,37 @@
+import { createBackoff } from "@intentic/base/async";
+import { hostConnectUrl } from "@intentic/sandbox-contract";
+import { dialPeer, PEER_LINK_BACKOFF } from "@intentic/sandbox-contract/peer-dial";
+import { RPCHandler } from "@orpc/server/websocket";
+import { resolveDaemonBase } from "../daemon-base.js";
+import { rememberScopes } from "./config.js";
+import { createHostRouter } from "./router.js";
+const realDial = { resolveBase: resolveDaemonBase, socket: (url) => new WebSocket(url) };
+export const connect = (config, version, log, dial = realDial) => {
+    let scopes = config.scopes;
+    const handler = new RPCHandler(createHostRouter({
+        scopes: () => scopes,
+        setScopes: (next) => {
+            scopes = next;
+            void rememberScopes(config.sandboxUrl, next);
+        },
+        log,
+    }));
+    return dialPeer({
+        open: async (signal) => {
+            const { base, local } = await dial.resolveBase(config.sandboxUrl);
+            if (signal.aborted) {
+                return undefined;
+            }
+            return {
+                socket: dial.socket(hostConnectUrl(base)),
+                said: `connected to ${config.sandboxUrl}${local ? ` over loopback (${base})` : ""} as "${config.id}"`,
+            };
+        },
+        hello: () => ({ type: "hello", token: config.token, version }),
+        attach: (ws) => handler.upgrade(ws),
+        backoff: createBackoff(PEER_LINK_BACKOFF),
+        log,
+        revoked: () => log("the sandbox refused this device's enrollment: it was revoked there. Run `intentic-machine device uninstall` to clean up, or connect again from the sandbox."),
+    });
+};
+//# sourceMappingURL=connection.js.map

package/dist/device/connection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.js","sourceRoot":"","sources":["../../src/device/connection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,EAAE,cAAc,EAAmB,MAAM,4BAA4B,CAAC;AAC7E,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAiB,MAAM,sCAAsC,CAAC;AAClG,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAmB,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAiB,cAAc,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AA2B/C,MAAM,QAAQ,GAAS,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;AAE/F,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,MAAgB,EAAE,OAAe,EAAE,GAAQ,EAAE,IAAI,GAAS,QAAQ,EAAY,EAAE;IAIpG,IAAI,MAAM,GAAe,MAAM,CAAC,MAAM,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,UAAU,CAC1B,gBAAgB,CAAC;QACb,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM;QACpB,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE;YAChB,MAAM,GAAG,IAAI,CAAC;YAMd,KAAK,cAAc,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACjD,CAAC;QACD,GAAG;KACN,CAAC,CACL,CAAC;IAEF,OAAO,QAAQ,CAAY;QACvB,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACnB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAClE,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,OAAO,SAAS,CAAC;YACrB,CAAC;YACD,OAAO;gBACH,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;gBAGzC,IAAI,EAAE,gBAAgB,MAAM,CAAC,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,mBAAmB,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,MAAM,CAAC,EAAE,GAAG;aACxG,CAAC;QACN,CAAC;QACD,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;QAC9D,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,aAAa,CAAC,iBAAiB,CAAC;QACzC,GAAG;QACH,OAAO,EAAE,GAAG,EAAE,CACV,GAAG,CAAC,6JAA6J,CAAC;KACzK,CAAC,CAAC;AACP,CAAC,CAAC"}

package/dist/device/mcp.d.ts

@@ -0,0 +1,11 @@
+export declare const handleMcpMessage: (message: unknown, ctx: {
+    shell: "off" | "on";
+    write: "off" | "on";
+    screen: "off" | "on";
+    control: "off" | "on";
+    sandboxes: "off" | "on";
+    sandboxRemove: "off" | "on";
+    destructive: "off" | "on";
+    roots?: string | undefined;
+}) => Promise<Record<string, unknown> | undefined>;
+//# sourceMappingURL=mcp.d.ts.map

package/dist/device/mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/device/mcp.ts"],"names":[],"mappings":"AAuVA,eAAO,MAAM,gBAAgB;;;;;;;;;kDAQ3B,CAAC"}