@saadnvd1/agent-os 0.3.692 → 0.3.694

package/app/api/sessions/route.ts

@@ -61,6 +61,7 @@ export async function POST(request: NextRequest) {
     const { session, initialPrompt, repeat } = await launchSession({
       id: str(body.id),
       projectId: str(body.projectId),
+      workspaceId: str(body.workspaceId),
       project: projectRefOf(body.project),
       workingDirectory: str(body.workingDirectory),
       agentType:

package/components/Draft/DraftChips.tsx

@@ -98,11 +98,16 @@ export function DraftChips({
   }, [hostGone, onChange]);
 
   const pickProject = (id: string | null) => {
-    const next = newDraft(draft.id, real.find((p) => p.id === id) ?? null, {
-      agentType: draft.agentType,
-      model: draft.model,
-      access: draft.access,
-    });
+    const next = newDraft(
+      draft.id,
+      real.find((p) => p.id === id) ?? null,
+      {
+        agentType: draft.agentType,
+        model: draft.model,
+        access: draft.access,
+      },
+      { workspaceId: draft.workspaceId }
+    );
     onChange({
       ...next,
       openPr: !!id && draft.openPr,

package/components/Draft/DraftPanel.tsx

@@ -12,6 +12,7 @@ import { discoversModels } from "@/lib/model-catalog";
 import { useDiscoveredModels } from "@/data/agents";
 import { useHostsQuery } from "@/data/hosts";
 import { useGitCheck } from "@/data/git/queries";
+import { useSelectedWorkspace } from "@/hooks/useSelectedWorkspace";
 import { useLaunchSession } from "@/data/sessions";
 import { useCreateTask } from "@/data/tasks";
 import { usePanes } from "@/contexts/PaneContext";
@@ -50,6 +51,7 @@ export function DraftPanel({
     discovers
   );
   const launch = useLaunchSession();
+  const { workspace } = useSelectedWorkspace();
   const createTask = useCreateTask();
   const [prefill, setPrefill] = useState<{ text: string; at: number }>();
   const pending = launch.isPending || createTask.isPending;
@@ -93,6 +95,7 @@ export function DraftPanel({
       }
       const { session, initialPrompt, repeat } = await launch.mutateAsync({
         projectId: project?.id ?? null,
+        workspaceId: draft.workspaceId ?? workspace?.id ?? null,
         id: draft.id,
         hostId:
           !project || draft.hostId !== project.host_id

package/data/sessions/queries.ts

@@ -182,6 +182,8 @@ export interface LaunchSessionInput {
   // The draft's id: the session's, and a resend's key to the same one.
   id: string;
   projectId: string | null;
+  // The workspace selected: where a session in no project is filed.
+  workspaceId?: string | null;
   // A scratch chat's machine; a project's sessions run where it lives, or
   // on a linked machine.
   hostId?: string;

package/hooks/useDraftRequests.ts

@@ -46,9 +46,15 @@ export function useDraftRequests(options: Options) {
   useEffect(() => {
     hydrateDrafts();
     const open = (projectId: string | null, openPr = false) => {
-      const { projects, viewing, show } = latest.current;
+      const { projects, viewing, show, workspaceId } = latest.current;
       const drafts = Object.values(draftsStore.drafts) as Draft[];
-      const found = reusableDraft(drafts, projectId, draftHasText, openPr);
+      const found = reusableDraft(
+        drafts,
+        projectId,
+        draftHasText,
+        openPr,
+        workspaceId
+      );
       if (found) return show(found.id);
       const from = viewing.draftId ? draftsStore.drafts[viewing.draftId] : null;
       const s = viewing.session;
@@ -58,7 +64,7 @@ export function useDraftRequests(options: Options) {
           ? { agentType: s.agent_type, model: s.model, access: s.chat_access }
           : {};
       const project = projects.find((p) => p.id === projectId) ?? null;
-      const draft = makeDraft(uuid(), project, carry, { openPr });
+      const draft = makeDraft(uuid(), project, carry, { openPr, workspaceId });
       draftsActions.put(draft);
       show(draft.id);
     };

package/lib/agents/cli-path.ts

@@ -1,6 +1,7 @@
 import fs from "fs";
 import os from "os";
 import path from "path";
+import { onWindowsDrive, wslVersion } from "../wsl";
 
 // Where agent CLIs install themselves outside a login shell's PATH: a chat
 // worker and the server never source ~/.zshrc, so a CLI that lives under nvm
@@ -37,6 +38,13 @@ function executable(file: string): boolean {
   }
 }
 
+// WSL appends the Windows PATH, so a CLI installed only on Windows (an npm
+// shim under /mnt/c) would be found and run with a Windows home and config
+// over the slow drive. Only the Linux install counts.
+export function skipDir(dir: string, wsl = wslVersion()): boolean {
+  return wsl !== 0 && onWindowsDrive(dir);
+}
+
 const found = new Map<string, string | null>();
 
 // The absolute path of a CLI, or null when it isn't installed.
@@ -45,7 +53,7 @@ export function resolveCli(name: string, fresh = false): string | null {
   const dirs = [
     ...(process.env.PATH ?? "").split(path.delimiter).filter(Boolean),
     ...extraDirs(),
-  ];
+  ].filter((d) => !skipDir(d));
   const hit = dirs.map((d) => path.join(d, name)).find(executable) ?? null;
   found.set(name, hit);
   return hit;

package/lib/bus/read-scope.ts

@@ -60,7 +60,8 @@ function inScope(s: ReadableSession, scope: ReaderScope): boolean {
   if (s.role) return false;
   if (scope.workspaceId) {
     const p = s.project_id ? getProject(s.project_id) : null;
-    return !!p && p.workspace_id === scope.workspaceId;
+    // A session in no project is in the workspace it was started in.
+    return (p?.workspace_id ?? s.workspace_id) === scope.workspaceId;
   }
   return s.project_id === scope.projectId;
 }

package/lib/drafts.ts

@@ -13,6 +13,8 @@ export interface Draft {
   id: string;
   // null: a scratch chat, in no project.
   projectId: string | null;
+  // The workspace selected when it was made: where a scratch chat is filed.
+  workspaceId?: string | null;
   hostId: string;
   agentType: AgentType;
   model: string;
@@ -55,13 +57,14 @@ export function newDraft(
   id: string,
   project: DraftProject | null,
   carry: Carry,
-  opts: { openPr?: boolean; now?: number } = {}
+  opts: { openPr?: boolean; now?: number; workspaceId?: string | null } = {}
 ): Draft {
   const real = project && !project.is_uncategorized ? project : null;
   const agentType = real?.agent_type ?? carry.agentType ?? "claude";
   return {
     id,
     projectId: real?.id ?? null,
+    workspaceId: real ? null : (opts.workspaceId ?? null),
     hostId: real?.host_id || "local",
     agentType,
     model: resolveModelForAgent(
@@ -82,11 +85,18 @@ export function reusableDraft(
   drafts: Draft[],
   projectId: string | null,
   hasText: (draftId: string) => boolean,
-  openPr = false
+  openPr = false,
+  workspaceId: string | null = null
 ): Draft | null {
+  // An empty scratch chat from another workspace would file this one's
+  // session there.
   return (
     drafts.find(
-      (d) => d.projectId === projectId && d.openPr === openPr && !hasText(d.id)
+      (d) =>
+        d.projectId === projectId &&
+        d.openPr === openPr &&
+        (projectId !== null || (d.workspaceId ?? null) === workspaceId) &&
+        !hasText(d.id)
     ) ?? null
   );
 }

package/lib/ports.ts

@@ -7,13 +7,17 @@
 import { execFile } from "child_process";
 import { promisify } from "util";
 import { db } from "./db";
+import { windowsListeningPorts } from "./windows-ports";
 
 const execFileAsync = promisify(execFile);
 
 export const MAX_SLOT = 200;
 
 // Something outside AgentOS listening on it. lsof exits 1 when nothing is.
+// Under WSL 2 a Windows process on the port counts too: localhost is shared
+// with Windows, which lsof can't see. When Windows can't be asked, lsof alone.
 export async function isPortInUse(port: number): Promise<boolean> {
+  if ((await windowsListeningPorts())?.has(port)) return true;
   try {
     const { stdout } = await execFileAsync(
       "lsof",

package/lib/projects.ts

@@ -278,11 +278,12 @@ export function deleteProject(id: string): boolean {
   const project = getProject(id);
   if (!project || project.is_uncategorized) return false;
 
-  // Move all sessions to Uncategorized
-  const sessions = queries.getSessionsByProject(db).all(id) as Session[];
-  for (const session of sessions) {
-    queries.updateSessionProject(db).run("uncategorized", session.id);
-  }
+  // Its sessions go to Uncategorized, staying in the project's workspace.
+  db.prepare(
+    `UPDATE sessions SET project_id = 'uncategorized', updated_at = datetime('now'),
+       workspace_id = CASE WHEN role IS NULL THEN ? ELSE workspace_id END
+     WHERE project_id = ?`
+  ).run(project.workspace_id ?? null, id);
 
   // Delete dev server instances
   queries.deleteDevServersByProject(db).run(id);
@@ -312,7 +313,27 @@ export function moveSessionToProject(
   sessionId: string,
   projectId: string
 ): void {
-  queries.updateSessionProject(db).run(projectId, sessionId);
+  const to = getProject(projectId);
+  const from = db
+    .prepare(
+      `SELECT p.workspace_id AS workspace_id, s.workspace_id AS own
+       FROM sessions s LEFT JOIN projects p ON p.id = s.project_id WHERE s.id = ?`
+    )
+    .get(sessionId) as
+    { workspace_id: string | null; own: string | null } | undefined;
+  db.transaction(() => {
+    queries.updateSessionProject(db).run(projectId, sessionId);
+    // A project's session follows the project; one left in none keeps the
+    // workspace it was in.
+    db.prepare(
+      `UPDATE sessions SET workspace_id = ? WHERE id = ? AND role IS NULL`
+    ).run(
+      to && !to.is_uncategorized
+        ? null
+        : (from?.workspace_id ?? from?.own ?? null),
+      sessionId
+    );
+  })();
 }
 
 /**

package/lib/sessions/launch.ts

@@ -16,6 +16,7 @@ import { isDiscoveredModel } from "../chat/discovered-models";
 import { parseOverride, resolveRole, setSessionModel } from "../models/resolve";
 import { ANTHROPIC } from "../models/roles";
 import { getProject } from "../projects";
+import { getWorkspace } from "../workspaces";
 import { getHost, isRemoteHost } from "../hosts";
 import { hostLink } from "../hosts/remote-api";
 import { startOnPeer } from "../hosts/peer-actions";
@@ -78,6 +79,9 @@ export interface LaunchInput {
   // role's model (or `model`), not the interactive one's.
   startedBy?: string | null;
   startedVia?: StartVia;
+  // The workspace selected when it was started. A session in a project
+  // follows the project; one in none keeps this (see inWorkspace).
+  workspaceId?: string | null;
   groupPath?: string;
   systemPrompt?: string | null;
 }
@@ -178,6 +182,29 @@ export function launchSession(input: LaunchInput): Promise<Launched> {
   return p;
 }
 
+// The workspace a project-less session is filed under: the one it was started
+// from, else that of the orchestrator starting it. A workspace deleted since
+// the draft was made is dropped rather than failing the send.
+function homeWorkspace(input: LaunchInput): string | null {
+  const picked = input.workspaceId?.trim();
+  if (picked) return getWorkspace(picked) ? picked : null;
+  if (!input.startedBy) return null;
+  const by = db
+    .prepare(
+      `SELECT workspace_id FROM sessions WHERE id = ? AND role = 'orchestrator'`
+    )
+    .get(input.startedBy) as { workspace_id: string | null } | undefined;
+  return by?.workspace_id ?? null;
+}
+
+function setHome(id: string, workspaceId: string | null): void {
+  if (workspaceId)
+    db.prepare(`UPDATE sessions SET workspace_id = ? WHERE id = ?`).run(
+      workspaceId,
+      id
+    );
+}
+
 async function launch(input: LaunchInput, id: string): Promise<Launched> {
   const project = input.project
     ? await ensureProject(input.project)
@@ -185,6 +212,7 @@ async function launch(input: LaunchInput, id: string): Promise<Launched> {
       ? getProject(input.projectId)
       : undefined;
   const scratch = !project || project.is_uncategorized;
+  const home = scratch ? homeWorkspace(input) : null;
   const hostId = (scratch ? input.hostId : null) || project?.host_id || "local";
   // A project here can start on a linked machine, which finds or clones it.
   const carried =
@@ -210,7 +238,7 @@ async function launch(input: LaunchInput, id: string): Promise<Launched> {
   if (link) {
     if (input.images?.length || input.files?.length)
       throw new Error(`Images and files can't be sent to ${link.hostName} yet`);
-    return startOnPeer(link, {
+    const started = await startOnPeer(link, {
       id,
       project: scratch ? null : (project ?? null),
       ref: carried && project ? await projectRef(project) : undefined,
@@ -222,6 +250,10 @@ async function launch(input: LaunchInput, id: string): Promise<Launched> {
       prompt: input.prompt?.trim(),
       view: input.view ?? DEFAULT_START_VIEW,
     });
+    setHome(started.session.id, home);
+    return home
+      ? { ...started, session: { ...started.session, workspace_id: home } }
+      : started;
   }
   const projectPath = expand(folder);
   if (scratch && projectPath === SCRATCH_DIR)
@@ -242,7 +274,7 @@ async function launch(input: LaunchInput, id: string): Promise<Launched> {
   const routed =
     agentType === "claude" && (picked || !input.model?.trim()) && !remote
       ? resolveRole(role, {
-          workspaceId: project?.workspace_id,
+          workspaceId: project?.workspace_id ?? home,
           override: picked,
         })
       : null;
@@ -302,6 +334,7 @@ async function launch(input: LaunchInput, id: string): Promise<Launched> {
     input.startedVia ?? (input.startedBy ? "orchestrator" : null),
     id
   );
+  setHome(id, home);
   if (interactive) setSessionModel(id, interactive);
   if (input.access)
     db.prepare(`UPDATE sessions SET chat_access = ? WHERE id = ?`).run(

package/lib/sidebar/shelves.ts

@@ -382,7 +382,9 @@ export function doneSummary(
 }
 
 // A workspace holds its projects' sessions and its own orchestrator; no
-// workspace selected means every session.
+// workspace selected means every session. A session in a project follows the
+// project, so moving it moves them; one in no project (scratch) belongs to the
+// workspace it was started in, kept on the session.
 export function inWorkspace(
   session: Pick<Session, "project_id" | "workspace_id" | "role">,
   workspaceOf: (projectId: string) => string | null | undefined,
@@ -391,9 +393,8 @@ export function inWorkspace(
   if (!workspaceId) return true;
   if (session.role === "orchestrator")
     return session.workspace_id === workspaceId;
-  return (
-    !!session.project_id && workspaceOf(session.project_id) === workspaceId
-  );
+  const byProject = session.project_id ? workspaceOf(session.project_id) : null;
+  return (byProject ?? session.workspace_id) === workspaceId;
 }
 
 // A workspace's projects, or every project when none is selected.

package/lib/windows-ports.ts

@@ -0,0 +1,68 @@
+/**
+ * Ports Windows is listening on, seen from inside WSL 2. WSL's localhost
+ * forwarding shares ports with Windows, but lsof in the distro can't see a
+ * Windows process, so a dev server on Windows :3000 and a session's :3000
+ * collide. netstat.exe answers in ~100ms where PowerShell takes seconds to
+ * start. Any failure is "unknown": callers fall back to the lsof check and
+ * never block on this.
+ */
+
+import { execFile } from "child_process";
+import { promisify } from "util";
+import { wslVersion } from "./wsl";
+
+const execFileAsync = promisify(execFile);
+
+const TTL_MS = 3000;
+
+/**
+ * Listening ports in `netstat.exe -ano -p TCP` output. A listener has a
+ * wildcard peer (0.0.0.0:0 or [::]:0), which holds in every Windows locale;
+ * the state column ("LISTENING") is translated.
+ */
+export function parseNetstatListeners(out: string): Set<number> {
+  const ports = new Set<number>();
+  for (const line of out.split(/\r?\n/)) {
+    const cols = line.trim().split(/\s+/);
+    if (cols.length < 4 || cols[0].toUpperCase() !== "TCP") continue;
+    const [, local, peer] = cols;
+    if (!/^(0\.0\.0\.0|\[::\]):0$/.test(peer)) continue;
+    const port = Number(local.slice(local.lastIndexOf(":") + 1));
+    if (Number.isInteger(port) && port > 0) ports.add(port);
+  }
+  return ports;
+}
+
+type Run = (file: string, args: string[]) => Promise<string>;
+
+const defaultRun: Run = async (file, args) =>
+  (await execFileAsync(file, args, { timeout: 4000, maxBuffer: 8 << 20 }))
+    .stdout;
+
+let cache: { at: number; ports: Set<number> | null } | undefined;
+let inflight: Promise<Set<number> | null> | undefined;
+
+/** The ports Windows listens on, or null when unknown (not WSL 2, or it failed). */
+export async function windowsListeningPorts(
+  opts: { wsl?: number; run?: Run; now?: number } = {}
+): Promise<Set<number> | null> {
+  if ((opts.wsl ?? wslVersion()) !== 2) return null;
+  const now = opts.now ?? Date.now();
+  if (cache && now - cache.at < TTL_MS) return cache.ports;
+  inflight ??= (opts.run ?? defaultRun)("netstat.exe", ["-ano", "-p", "TCP"])
+    .then((out) => parseNetstatListeners(out))
+    .catch(() => null)
+    .then((ports) => {
+      cache = { at: now, ports };
+      return ports;
+    })
+    .finally(() => {
+      inflight = undefined;
+    });
+  return inflight;
+}
+
+export function resetWindowsPortsCache() {
+  cache = undefined;
+  inflight = undefined;
+}

package/lib/workspaces.ts

@@ -115,6 +115,11 @@ export function deleteWorkspace(id: string): void {
       `UPDATE projects SET workspace_id = NULL WHERE workspace_id = ?`
     ).run(id);
     db.prepare(`DELETE FROM workspaces WHERE id = ?`).run(id);
+    // Sessions filed here by being started here go back to "All workspaces".
+    db.prepare(
+      `UPDATE sessions SET workspace_id = NULL
+       WHERE role IS NULL AND workspace_id = ?`
+    ).run(id);
     // Its orchestrator goes with it; a running worker idles out on its own.
     db.prepare(
       `DELETE FROM sessions WHERE role = 'orchestrator' AND workspace_id = ?`
@@ -128,6 +133,7 @@ export function deleteWorkspace(id: string): void {
   })();
 }
 
+// A project's sessions follow it, so moving one needs no change to them.
 export function setProjectWorkspace(
   projectId: string,
   workspaceId: string | null

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saadnvd1/agent-os",
-  "version": "0.3.692",
+  "version": "0.3.694",
   "description": "Self-hosted web UI for managing Claude Code sessions",
   "bin": {
     "agent-os": "scripts/agent-os"

package/scripts/agent-os

@@ -65,6 +65,7 @@ source "$SCRIPT_DIR/lib/common.sh"
 source "$SCRIPT_DIR/lib/prerequisites.sh"
 source "$SCRIPT_DIR/lib/ai-clis.sh"
 source "$SCRIPT_DIR/lib/commands.sh"
+source "$SCRIPT_DIR/lib/machine.sh"
 
 # The package family the installers key off (debian, redhat, linux, macos),
 # and the WSL version (0 off WSL).
@@ -85,6 +86,7 @@ case "${1:-}" in
     passkeys)         shift; (cd "$(dirname "$SCRIPT_DIR")" && npx tsx lib/security/passkeys-cli.ts "$@") ;;
     logs)             cmd_logs ;;
     update)           cmd_update ;;
+    machine)          cmd_machine ;;
     enable)           cmd_enable ;;
     disable)          cmd_disable ;;
     uninstall)        cmd_uninstall ;;

package/scripts/ci-machine-link.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# CI check of the linked-machine path, from one AgentOS machine to another
+# (here the same box, over ssh to localhost): the exact steps lib/hosts/link.ts
+# takes. ssh in for a pairing code on the machine's own loopback, claim it over
+# HTTP, keep the device token, and call the machine's API with it. Run with
+# the server already up on $1 (default 3011) and sshd running.
+set -euo pipefail
+
+port="${1:-3011}"
+key="$(mktemp -d)/id"
+ssh-keygen -q -t ed25519 -N "" -f "$key"
+mkdir -p ~/.ssh && chmod 700 ~/.ssh
+cat "$key.pub" >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys
+
+ssh_run() {
+    ssh -i "$key" -o BatchMode=yes -o StrictHostKeyChecking=accept-new \
+        -o UserKnownHostsFile="$(dirname "$key")/known_hosts" localhost "$@"
+}
+
+code=$(ssh_run "curl -fsS -m 10 -X POST http://127.0.0.1:$port/api/pair/start" \
+    | sed -n 's/.*"code":"\([^"]*\)".*/\1/p')
+[[ -n "$code" ]] || { echo "no pairing code"; exit 1; }
+
+headers=$(curl -fsS -D - -o /dev/null -X POST "http://localhost:$port/api/pair/claim" \
+    -H 'Content-Type: application/json' \
+    -d "{\"code\":\"$code\",\"name\":\"AgentOS CI\"}")
+token=$(printf '%s' "$headers" | tr -d '\r' | sed -n 's/^[Ss]et-[Cc]ookie: *[^=]*=\([^;]*\).*/\1/p' | head -1)
+[[ -n "$token" ]] || { echo "no device token in the claim response"; exit 1; }
+
+curl -fsS -H "Authorization: Bearer $token" "http://localhost:$port/api/tasks" > /dev/null
+echo "machine link path ok (ssh -> pair -> token -> API)"

package/scripts/lib/ai-clis.sh

@@ -4,19 +4,19 @@
 detect_ai_clis() {
     local installed=()
 
-    command -v claude &> /dev/null && installed+=("claude")
-    command -v codex &> /dev/null && installed+=("codex")
-    command -v opencode &> /dev/null && installed+=("opencode")
-    command -v kilo &> /dev/null && installed+=("kilo")
-    command -v gemini &> /dev/null && installed+=("gemini")
-    command -v aider &> /dev/null && installed+=("aider")
-    command -v cursor &> /dev/null && installed+=("cursor")
+    have_cli claude && installed+=("claude")
+    have_cli codex && installed+=("codex")
+    have_cli opencode && installed+=("opencode")
+    have_cli kilo && installed+=("kilo")
+    have_cli gemini && installed+=("gemini")
+    have_cli aider && installed+=("aider")
+    have_cli cursor && installed+=("cursor")
 
     echo "${installed[*]}"
 }
 
 install_claude_code() {
-    if command -v claude &> /dev/null; then
+    if have_cli claude; then
         log_success "Claude Code already installed"
         return 0
     fi
@@ -36,7 +36,7 @@ install_claude_code() {
 }
 
 install_codex() {
-    if command -v codex &> /dev/null; then
+    if have_cli codex; then
         log_success "Codex already installed"
         return 0
     fi
@@ -51,16 +51,16 @@ install_codex() {
 }
 
 install_aider() {
-    if command -v aider &> /dev/null; then
+    if have_cli aider; then
         log_success "Aider already installed"
         return 0
     fi
 
     log_info "Installing Aider..."
 
-    if command -v pipx &> /dev/null; then
+    if have_cli pipx; then
         pipx install aider-chat
-    elif command -v pip3 &> /dev/null; then
+    elif have_cli pip3; then
         pip3 install aider-chat
     else
         log_error "Please install Python/pip first, then run: pip install aider-chat"
@@ -69,7 +69,7 @@ install_aider() {
 }
 
 install_gemini_cli() {
-    if command -v gemini &> /dev/null; then
+    if have_cli gemini; then
         log_success "Gemini CLI already installed"
         return 0
     fi
@@ -84,7 +84,7 @@ install_gemini_cli() {
 }
 
 install_kilocode_cli() {
-    if command -v kilo &> /dev/null; then
+    if have_cli kilo; then
         log_success "Kilo Code CLI already installed"
         return 0
     fi

package/scripts/lib/commands.sh

@@ -309,6 +309,50 @@ cmd_update() {
     fi
 }
 
+# Turn systemd on in wsl.conf: add [boot] systemd=true, keeping the rest of
+# the file, after a backup. Nothing is removed.
+enable_wsl_systemd() {
+    local conf="${WSL_CONF:-/etc/wsl.conf}" cur out
+    cur=$(mktemp) out=$(mktemp)
+    [[ -f "$conf" ]] && cat "$conf" > "$cur"
+    if grep -qiE '^[[:space:]]*systemd[[:space:]]*=' "$cur"; then
+        awk '{ if (tolower($0) ~ /^[ \t]*systemd[ \t]*=/) print "systemd=true"; else print }' "$cur" > "$out"
+    elif grep -qiE '^\[boot\]' "$cur"; then
+        awk '{ print } tolower($0) ~ /^\[boot\]/ { print "systemd=true" }' "$cur" > "$out"
+    else
+        { cat "$cur"; printf '\n[boot]\nsystemd=true\n'; } > "$out"
+    fi
+    local rc=0
+    if [[ -n "${WSL_CONF:-}" || "$(id -u)" == 0 ]]; then
+        { [[ ! -f "$conf" ]] || cp "$conf" "$conf.agentos-bak"; } && cp "$out" "$conf" || rc=$?
+    else
+        { [[ ! -f "$conf" ]] || sudo cp "$conf" "$conf.agentos-bak"; } && sudo cp "$out" "$conf" || rc=$?
+    fi
+    rm -f "$cur" "$out"
+    return $rc
+}
+
+# Register the Windows logon task (current user, no admin) and run it once.
+enable_wsl_logon_task() {
+    if ! command -v schtasks.exe &> /dev/null; then
+        log_warn "schtasks.exe isn't reachable from WSL; keep a terminal open or start the distro from Windows"
+        return 0
+    fi
+    if [[ -z "${WSL_DISTRO_NAME:-}" ]]; then
+        log_warn "WSL_DISTRO_NAME isn't set here, so no Windows login task was made. Run 'agent-os enable' from a normal WSL terminal."
+        return 0
+    fi
+    local name launcher
+    name=$(wsl_task_name "$WSL_DISTRO_NAME")
+    launcher=$(wsl_launcher "$WSL_DISTRO_NAME" 1)
+    if schtasks.exe /Create /F /SC ONLOGON /TN "$name" /TR "$launcher" > /dev/null 2>&1; then
+        schtasks.exe /Run /TN "$name" > /dev/null 2>&1 || true
+        log_success "Windows login task \"$name\" keeps the distro running"
+    else
+        log_warn "Couldn't create the Windows login task. Without it WSL stops the distro, and AgentOS, when no terminal is open."
+    fi
+}
+
 cmd_enable() {
     if [[ ! -d "$REPO_DIR" ]]; then
         log_error "AgentOS is not installed. Run 'agent-os install' first."
@@ -378,8 +422,12 @@ EOF
 
         systemctl --user daemon-reload
         systemctl --user enable agent-os
+        enable_linger
         log_success "Auto-start enabled (systemd)"
         echo "  Service: $service_path"
+        if [[ "${WSL:-0}" != 0 ]]; then
+            enable_wsl_logon_task
+        fi
 
     elif [[ "${WSL:-0}" != 0 ]]; then
         log_error "Auto-start under WSL needs systemd. Add this to /etc/wsl.conf:"
@@ -387,6 +435,13 @@ EOF
         echo "    systemd=true"
         echo "  then run 'wsl --shutdown' from Windows, reopen your terminal, and run"
         echo "  'agent-os enable' again."
+        if is_interactive && prompt_yn "Add it to ${WSL_CONF:-/etc/wsl.conf} for you?" "y"; then
+            if enable_wsl_systemd; then
+                echo ""
+                log_success "systemd is on for the next start. Run 'wsl --shutdown' from Windows, reopen, then 'agent-os enable'."
+                return 0
+            fi
+        fi
         exit 1
 
     else
@@ -411,7 +466,10 @@ cmd_disable() {
         systemctl --user disable agent-os 2>/dev/null || true
         rm -f "$HOME/.config/systemd/user/agent-os.service"
         systemctl --user daemon-reload
-        log_success "Auto-start disabled"
+        if [[ "${WSL:-0}" != 0 && -n "${WSL_DISTRO_NAME:-}" ]] && command -v schtasks.exe &> /dev/null; then
+            schtasks.exe /Delete /F /TN "$(wsl_task_name "$WSL_DISTRO_NAME")" > /dev/null 2>&1 || true
+        fi
+        log_success "Auto-start disabled (linger is left on; other services may use it)"
 
     else
         log_error "Could not detect init system"
@@ -503,6 +561,7 @@ cmd_help() {
     echo "  passkeys reset  Revoke every passkey (recovery; asks you to confirm)"
     echo "  logs        Tail server logs"
     echo "  update      Update to latest version"
+    echo "  machine     Make this Linux box or WSL distro linkable from another AgentOS"
     echo "  enable      Enable auto-start on boot"
     echo "  disable     Disable auto-start"
     echo "  uninstall   Remove AgentOS completely"

package/scripts/lib/common.sh

@@ -132,3 +132,45 @@ get_tailscale_ip() {
         tailscale ip -4 2>/dev/null | head -1
     fi
 }
+
+# Is this CLI installed here? Under WSL the Windows PATH is appended, and a
+# CLI only installed on Windows (/mnt/c/...) doesn't count: it would run with
+# a Windows home and config.
+have_cli() {
+    local path
+    path=$(command -v "$1" 2>/dev/null) || return 1
+    if [[ "${WSL:-0}" != 0 && "$path" == /mnt/[a-zA-Z]/* ]]; then
+        return 1
+    fi
+    return 0
+}
+
+# The Windows logon task that keeps the WSL distro running. WSL stops an idle
+# distro seconds after its last process exits, service and all, so this holds
+# one `sleep infinity` open from Windows login on.
+wsl_task_name() {
+    echo "AgentOS ($1)"
+}
+
+# conhost --headless hides the console window (Windows 11); the plain wsl.exe
+# fallback flashes one on older builds.
+wsl_launcher() {
+    local distro="$1" headless="${2:-1}"
+    if [[ "$headless" == 1 ]]; then
+        echo "conhost.exe --headless wsl.exe -d $distro --exec /bin/sleep infinity"
+    else
+        echo "wsl.exe -d $distro --exec /bin/sleep infinity"
+    fi
+}
+
+# Keep user services running without a login session (a headless box, or a
+# WSL distro with no terminal open). Tries without sudo first.
+enable_linger() {
+    command -v loginctl &> /dev/null || return 0
+    local user="${USER:-$(id -un)}"
+    if loginctl enable-linger "$user" 2>/dev/null \
+        || sudo -n loginctl enable-linger "$user" 2>/dev/null; then
+        return 0
+    fi
+    log_warn "Couldn't turn on linger, so AgentOS stops when you log out. Run: sudo loginctl enable-linger $user"
+}

package/scripts/lib/machine.sh

@@ -0,0 +1,87 @@
+#!/usr/bin/env bash
+# `agent-os machine`: make this Linux box (a WSL distro, a DGX Spark) linkable
+# from another AgentOS: sshd for pairing, Tailscale for reaching it, the
+# server kept running. It never edits sshd_config or authorized_keys.
+
+# The ssh service's unit name differs by distro (Debian: ssh, others: sshd).
+ssh_unit() {
+    if systemctl list-unit-files ssh.service 2>/dev/null | grep -q '^ssh.service'; then
+        echo ssh
+    else
+        echo sshd
+    fi
+}
+
+# MagicDNS name of this node (no trailing dot), empty when Tailscale is off.
+tailscale_name() {
+    command -v tailscale &> /dev/null || return 0
+    tailscale status --json 2>/dev/null \
+        | tr ',' '\n' \
+        | sed -n 's/.*"DNSName":"\([^"]*\)".*/\1/p' \
+        | head -1 | sed 's/\.$//'
+}
+
+cmd_machine() {
+    if [[ "$OS" == "macos" ]]; then
+        log_info "A Mac is linked from the other side: on the machine you'll link from, open Machines and add this Mac."
+        return 0
+    fi
+    if [[ ! -d "$REPO_DIR" ]]; then
+        log_error "AgentOS is not installed. Run 'agent-os install' first."
+        exit 1
+    fi
+    if ! has_systemd; then
+        if [[ "${WSL:-0}" != 0 ]]; then
+            log_error "This needs systemd. Run 'agent-os enable', which offers to turn it on, then try again."
+        else
+            log_error "This needs systemd to keep sshd and AgentOS running."
+        fi
+        exit 1
+    fi
+
+    if ! command -v sshd &> /dev/null && [[ ! -x "${SSHD_FALLBACK-/usr/sbin/sshd}" ]]; then
+        if [[ "$OS" == "debian" ]]; then
+            log_info "Installing openssh-server..."
+            apt_install openssh-server || { log_error "Couldn't install openssh-server"; exit 1; }
+        else
+            log_error "Install your distro's OpenSSH server package, then run this again."
+            exit 1
+        fi
+    fi
+    if ! sudo systemctl enable --now "$(ssh_unit)"; then
+        log_error "Couldn't start sshd"
+        exit 1
+    fi
+    log_success "sshd is running"
+
+    local name
+    name=$(tailscale_name)
+    if ! command -v tailscale &> /dev/null; then
+        log_warn "Tailscale isn't installed here. Install it inside this machine (not just on Windows):"
+        echo "    https://tailscale.com/download/linux"
+        echo "  then 'sudo tailscale up' and run 'agent-os machine' again."
+        exit 1
+    elif [[ -z "$name" ]]; then
+        log_warn "Tailscale is installed but this machine isn't signed in. Run: sudo tailscale up"
+        echo "  then run 'agent-os machine' again."
+        exit 1
+    fi
+
+    cmd_enable
+    # The server follows tailnet address changes on its own; it only needs to be up.
+    is_running || cmd_start
+
+    local user="${USER:-$(id -un)}" ip
+    ip=$(get_tailscale_ip)
+    echo ""
+    log_success "Ready to link. On the machine you'll link from (any AgentOS: a Mac, Linux or WSL), open Machines → Add:"
+    echo "    ssh host   $name"
+    echo "    user       $user"
+    echo "    url        http://$name:$PORT"
+    echo ""
+    echo "  If that machine can't ssh in yet, run this on it first:"
+    echo "    ssh-copy-id $user@$name"
+    if [[ -n "$ip" ]] && ! curl -sf "http://$ip:$PORT/api/health" > /dev/null 2>&1; then
+        log_warn "The server isn't answering on the tailnet address $ip yet. Check 'agent-os logs'."
+    fi
+}

package/scripts/lib/machine.test.ts

@@ -0,0 +1,141 @@
+import { spawnSync } from "node:child_process";
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync,
+} from "node:fs";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { tempDir } from "@/lib/test-temp";
+
+// `agent-os machine` on any OS: systemctl, sshd, tailscale and the server
+// commands are fakes that record what they were asked.
+const LIB = join(import.meta.dirname);
+const TOOLS = [
+  "tr",
+  "cat",
+  "sed",
+  "head",
+  "grep",
+  "mkdir",
+  "id",
+  "mktemp",
+  "cp",
+  "rm",
+];
+
+let dir: string;
+
+function fake(name: string, body: string) {
+  const p = join(dir, "bin", name);
+  writeFileSync(p, `#!/bin/sh\n${body}\n`);
+  chmodSync(p, 0o755);
+}
+const log = () =>
+  existsSync(join(dir, "calls.log"))
+    ? readFileSync(join(dir, "calls.log"), "utf8")
+    : "";
+const record = (name: string) =>
+  fake(name, `echo "${name} $*" >> "${dir}/calls.log"`);
+
+function machine(env: Record<string, string> = {}, os = "debian") {
+  mkdirSync(join(dir, "repo"), { recursive: true });
+  return spawnSync(
+    "/bin/bash",
+    [
+      "-euo",
+      "pipefail",
+      "-c",
+      `source "${LIB}/common.sh"; source "${LIB}/prerequisites.sh"; source "${LIB}/commands.sh"; source "${LIB}/machine.sh"; WSL=2 OS=${os} REPO_DIR="${dir}/repo" PORT=3011; has_systemd() { return 0; }; is_running() { return 0; }; cmd_enable() { echo "enable called"; }; cmd_machine`,
+      join(dir, "agent-os"),
+    ],
+    {
+      cwd: dir,
+      encoding: "utf8",
+      env: {
+        PATH: join(dir, "bin"),
+        HOME: dir,
+        USER: "tester",
+        NODE_ENV: "test",
+        SSHD_FALLBACK: "",
+        ...env,
+      },
+    }
+  );
+}
+
+beforeEach(() => {
+  dir = tempDir("aos-machine-");
+  mkdirSync(join(dir, "bin"));
+  for (const tool of TOOLS) {
+    const real = ["/usr/bin", "/bin"]
+      .map((d) => join(d, tool))
+      .find(existsSync);
+    if (real) symlinkSync(real, join(dir, "bin", tool));
+  }
+  fake("uname", 'echo "Linux"');
+  record("sudo");
+  fake("sshd", "true");
+  fake("systemctl", "exit 0");
+  fake("curl", "exit 0");
+});
+afterEach(() => rmSync(dir, { recursive: true, force: true }));
+
+describe("agent-os machine", () => {
+  it("stops with the install pointer when Tailscale is missing", () => {
+    const r = machine();
+    expect(r.status).toBe(1);
+    expect(r.stdout).toContain("Tailscale isn't installed");
+    expect(log()).toContain("sudo systemctl enable --now sshd");
+  });
+
+  it("stops with 'tailscale up' when signed out", () => {
+    fake("tailscale", "echo '{\"Self\":{}}'");
+    const r = machine();
+    expect(r.status).toBe(1);
+    expect(r.stdout).toContain("sudo tailscale up");
+  });
+
+  it("prints the values for the machine you'll link from, never a Mac-only line", () => {
+    fake(
+      "tailscale",
+      'case "$1" in ip) echo 100.64.0.9;; *) echo \'{"Self":{"DNSName":"pc-wsl.tail1234.ts.net."}}\';; esac'
+    );
+    const r = machine();
+    expect(r.status).toBe(0);
+    expect(r.stdout).toContain("enable called");
+    expect(r.stdout).toContain("pc-wsl.tail1234.ts.net");
+    expect(r.stdout).toContain("http://pc-wsl.tail1234.ts.net:3011");
+    expect(r.stdout).toContain("ssh-copy-id tester@pc-wsl.tail1234.ts.net");
+    expect(r.stdout).toContain("the machine you'll link from");
+    expect(r.stdout).not.toMatch(/on the mac\b/i);
+  });
+
+  it("installs openssh-server on Debian when sshd is missing, and never touches sshd_config", () => {
+    rmSync(join(dir, "bin", "sshd"));
+    machine();
+    expect(log()).toContain("sudo apt-get install -y openssh-server");
+    expect(log()).not.toMatch(/sshd_config|authorized_keys/);
+  });
+
+  it("needs systemd", () => {
+    mkdirSync(join(dir, "repo"), { recursive: true });
+    const r = spawnSync(
+      "/bin/bash",
+      [
+        "-c",
+        `source "${LIB}/common.sh"; source "${LIB}/machine.sh"; WSL=2 OS=debian REPO_DIR="${dir}/repo"; has_systemd() { return 1; }; cmd_machine`,
+      ],
+      {
+        encoding: "utf8",
+        env: { PATH: join(dir, "bin"), HOME: dir, NODE_ENV: "test" },
+      }
+    );
+    expect(r.status).toBe(1);
+    expect(r.stdout + r.stderr).toContain("systemd");
+  });
+});

package/scripts/lib/wsl.test.ts

@@ -18,7 +18,20 @@ import { tempDir } from "@/lib/test-temp";
 // tools) and the environment only this, so a run inside WSL sees neither
 // the real wslview nor WSL_DISTRO_NAME.
 const LIB = join(import.meta.dirname);
-const TOOLS = ["tr", "cat", "sed", "cut", "awk", "head", "grep", "mkdir"];
+const TOOLS = [
+  "tr",
+  "cat",
+  "sed",
+  "cut",
+  "awk",
+  "head",
+  "grep",
+  "mkdir",
+  "mktemp",
+  "cp",
+  "rm",
+  "id",
+];
 
 let dir: string;
 
@@ -170,6 +183,101 @@ describe("agent-os enable", () => {
   });
 });
 
+describe("agent-os enable keeping the box up", () => {
+  const log = (n: string) =>
+    existsSync(join(dir, n)) ? readFileSync(join(dir, n), "utf8") : "";
+  const setup = () => {
+    fake("ps", "echo systemd");
+    fake("systemctl", 'echo "systemctl $*" >> "' + dir + '/systemctl.log"');
+    fake("loginctl", 'echo "loginctl $*" >> "' + dir + '/loginctl.log"');
+    fake("schtasks.exe", 'echo "schtasks $*" >> "' + dir + '/schtasks.log"');
+    mkdirSync(join(dir, "repo"));
+  };
+  const enable = (env: Record<string, string> = {}) =>
+    run(`WSL=2 OS=debian REPO_DIR="${dir}/repo"; cmd_enable`, "", {
+      USER: "tester",
+      WSL_DISTRO_NAME: "Ubuntu-24.04",
+      ...env,
+    });
+
+  it("turns on linger and registers a Windows login task that runs once", () => {
+    setup();
+    const r = enable();
+    expect(r.status).toBe(0);
+    expect(log("loginctl.log")).toContain("loginctl enable-linger tester");
+    const task = log("schtasks.log");
+    expect(task).toContain(
+      "/Create /F /SC ONLOGON /TN AgentOS (Ubuntu-24.04) /TR conhost.exe --headless wsl.exe -d Ubuntu-24.04 --exec /bin/sleep infinity"
+    );
+    expect(task).toContain("/Run /TN AgentOS (Ubuntu-24.04)");
+  });
+
+  it("makes no Windows task off WSL, and none without a distro name", () => {
+    setup();
+    run(`WSL=0 OS=debian REPO_DIR="${dir}/repo"; cmd_enable`, "", {
+      USER: "tester",
+    });
+    expect(log("schtasks.log")).toBe("");
+    expect(log("loginctl.log")).toContain("enable-linger");
+    const r = enable({ WSL_DISTRO_NAME: "" });
+    expect(r.stdout + r.stderr).toContain("WSL_DISTRO_NAME");
+    expect(log("schtasks.log")).toBe("");
+  });
+
+  it("disable deletes the Windows task", () => {
+    setup();
+    const r = run(`WSL=2 OS=debian; cmd_disable`, "", {
+      WSL_DISTRO_NAME: "Ubuntu-24.04",
+    });
+    expect(r.status).toBe(0);
+    expect(log("schtasks.log")).toContain(
+      "/Delete /F /TN AgentOS (Ubuntu-24.04)"
+    );
+  });
+
+  it("adds systemd=true to wsl.conf, keeping the rest and a backup", () => {
+    const conf = join(dir, "wsl.conf");
+    writeFileSync(conf, "[user]\ndefault=me\n[boot]\ncommand=true\n");
+    const r = run("enable_wsl_systemd", "", { WSL_CONF: conf });
+    expect(r.status).toBe(0);
+    expect(readFileSync(conf, "utf8")).toBe(
+      "[user]\ndefault=me\n[boot]\nsystemd=true\ncommand=true\n"
+    );
+    expect(readFileSync(conf + ".agentos-bak", "utf8")).toContain(
+      "command=true"
+    );
+  });
+
+  it("creates [boot] when missing, and flips systemd=false", () => {
+    const conf = join(dir, "wsl.conf");
+    run("enable_wsl_systemd", "", { WSL_CONF: conf });
+    expect(readFileSync(conf, "utf8")).toContain("[boot]\nsystemd=true");
+    writeFileSync(conf, "[boot]\nsystemd=false\n");
+    run("enable_wsl_systemd", "", { WSL_CONF: conf });
+    expect(readFileSync(conf, "utf8")).toBe("[boot]\nsystemd=true\n");
+  });
+});
+
+describe("have_cli", () => {
+  it("ignores a CLI that only exists on the Windows drive, under WSL", () => {
+    const win = join(dir, "mnt", "c");
+    mkdirSync(win, { recursive: true });
+    const shim = join(win, "claude");
+    writeFileSync(shim, "#!/bin/sh\n");
+    chmodSync(shim, 0o755);
+    // The path has no /mnt/c prefix here, so check the pattern with a stub.
+    fake("command", "true");
+    const hit = (wsl: string, p: string) =>
+      run(
+        `WSL=${wsl}; command() { echo "${p}"; }; have_cli claude && echo yes || echo no`,
+        ""
+      ).stdout.trim();
+    expect(hit("2", "/mnt/c/Users/me/npm/claude")).toBe("no");
+    expect(hit("2", "/home/me/.local/bin/claude")).toBe("yes");
+    expect(hit("0", "/mnt/c/Users/me/npm/claude")).toBe("yes");
+  });
+});
+
 describe("installing prerequisites", () => {
   // sudo runs nothing, it only records what it was asked.
   const sudoLog = () => {