@talgent/computer 0.1.2 → 0.2.0

package/dist/computer.mjs

@@ -4076,7 +4076,7 @@ function num(value) {
 
 // src/run.ts
 import { homedir as homedir2 } from "node:os";
-import { join as join14 } from "node:path";
+import { join as join15 } from "node:path";
 
 // src/claude-code.ts
 import { execFile } from "node:child_process";
@@ -5566,9 +5566,10 @@ var HEADER_VALUE = /^[\x21-\x7e]+$/;
 var LOOPBACK = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "[::1]"]);
 function parseCredentials(body) {
   if (!isObject(body)) throw new InvalidCredentialsError("body must be an object");
-  const { model, gateway } = body;
+  const { model, gateway, api } = body;
   const result = { gateway: parseGateway(gateway) };
   if (model !== void 0 && model !== null) result.model = parseModel(model);
+  if (api !== void 0 && api !== null) result.api = parseApi(api, result.gateway.url);
   return result;
 }
 function parseModel(model) {
@@ -5579,6 +5580,12 @@ function parseModel(model) {
   }
   return { baseUrl: url.href, key: headerValue(model.key, "model.key") };
 }
+function parseApi(api, gatewayUrl) {
+  if (!isObject(api)) throw new InvalidCredentialsError("api must be an object");
+  const url = parseUrl(api.url, "api.url");
+  if (url.origin !== new URL(gatewayUrl).origin) throw new InvalidCredentialsError("api.url must lie on gateway.url's origin");
+  return { url: url.href };
+}
 function parseGateway(gateway) {
   if (!isObject(gateway)) throw new InvalidCredentialsError("gateway must be an object");
   const url = parseUrl(gateway.url, "gateway.url");
@@ -5924,12 +5931,12 @@ var Works = class {
   }
   // Opens or updates the Work's environment and answers its root.
   async put(workId, body) {
-    const { accessToken, environment, modelProxy, telemetry } = parseEnvironment(body);
+    const { accessToken, environment, modelProxy, platformApi, telemetry } = parseEnvironment(body);
     const root = this.root(workId);
     await mkdir6(root, { recursive: true, mode: 448 });
     await chmod5(root, 448);
     await mkdir6(this.recordsDir, { recursive: true, mode: 448 });
-    const stored = { tokenSha256: sha2562(accessToken), environment, modelProxy, telemetry };
+    const stored = { tokenSha256: sha2562(accessToken), environment, modelProxy, platformApi, telemetry };
     writeJsonAtomic(join9(this.recordsDir, `${workId}.json`), stored);
     this.cache.set(workId, stored);
     return root;
@@ -5968,7 +5975,7 @@ var Works = class {
     const expected = Buffer.from(stored.tokenSha256, "hex");
     const presented = Buffer.from(sha2562(token), "hex");
     if (token === "" || !timingSafeEqual(expected, presented)) return { kind: "denied" };
-    const work = { root: this.root(workId), environment: stored.environment, modelProxy: stored.modelProxy === true };
+    const work = { root: this.root(workId), environment: stored.environment, modelProxy: stored.modelProxy, platformApi: stored.platformApi === true };
     if (stored.telemetry !== void 0) work.telemetry = stored.telemetry;
     return { kind: "ok", work };
   }
@@ -5989,9 +5996,10 @@ var Works = class {
 };
 function parseEnvironment(body) {
   if (typeof body !== "object" || body === null || Array.isArray(body)) throw new InvalidEnvironmentError("body must be an object");
-  const { access_token: accessToken, environment = {}, model_proxy: modelProxy = false, telemetry: rawTelemetry } = body;
+  const { access_token: accessToken, environment = {}, model_proxy: modelProxy = false, platform_api: platformApi = false, telemetry: rawTelemetry } = body;
   if (typeof accessToken !== "string" || accessToken.trim() === "") throw new InvalidEnvironmentError("access_token required");
   if (typeof modelProxy !== "boolean") throw new InvalidEnvironmentError("model_proxy must be a boolean");
+  if (typeof platformApi !== "boolean") throw new InvalidEnvironmentError("platform_api must be a boolean");
   if (typeof environment !== "object" || environment === null || Array.isArray(environment)) {
     throw new InvalidEnvironmentError("environment must be an object");
   }
@@ -6009,7 +6017,7 @@ function parseEnvironment(body) {
     if (error instanceof InvalidTelemetryError) throw new InvalidEnvironmentError(error.message);
     throw error;
   }
-  return { accessToken, environment: result, modelProxy, telemetry };
+  return { accessToken, environment: result, modelProxy, platformApi, telemetry };
 }
 async function removeTree(path) {
   try {
@@ -6487,8 +6495,10 @@ var ExecdService = class {
   }
   // The machine's environment, then the Work's, then what Talgent Computer
   // owns: the machine's HOME, the Work root, the bundled Claude Code first on
-  // PATH, the run's way to the local proxy and, when the platform named it,
-  // where its telemetry goes, in place of the machine's. A Work on a Model
+  // PATH, the run's way to the local proxy and, when the platform named them,
+  // the platform's native API through the proxy and where its telemetry goes,
+  // in place of the machine's. The API address carries the run's token in
+  // its path, as a plain HTTP client presents nothing else. A Work on a Model
   // Configuration reaches its model only through the proxy, with the run's
   // token, whether or not its credentials were delivered yet: it never falls
   // back to the machine's own login.
@@ -6496,12 +6506,14 @@ var ExecdService = class {
     const { baseEnv, home, claudeBinDir: bin, proxyOrigin, platform = process.platform } = this.options;
     const proxyUrl = `${proxyOrigin()}/w/${workId}`;
     const model = work.modelProxy ? { ANTHROPIC_BASE_URL: `${proxyUrl}/model`, ANTHROPIC_AUTH_TOKEN: proxyToken } : {};
+    const api = work.platformApi ? { TALGENT_API_ADDRESS: `${proxyUrl}/api/${proxyToken}` } : {};
     const env = mergeEnvironment(platform, baseEnv, work.environment, {
       HOME: home,
       TALGENT_WORK_ROOT: work.root,
       TALGENT_PROXY_URL: proxyUrl,
       TALGENT_PROXY_TOKEN: proxyToken,
-      ...model
+      ...model,
+      ...api
     });
     if (bin !== void 0) prependPath(env, bin, platform);
     if (work.modelProxy) deleteVariable(env, "ANTHROPIC_API_KEY", platform);
@@ -6862,42 +6874,7 @@ var ContentHandles = class {
 // src/proxy/content-links.ts
 import { Transform, pipeline as pipeline2 } from "node:stream";
 
-// src/proxy/publication.ts
-var MAX_SOURCE_BYTES = 64 * 1024 * 1024;
-var MAX_REQUEST_BYTES = base64Length(MAX_SOURCE_BYTES) + 1024 * 1024;
-var TOOLS = /* @__PURE__ */ new Set(["publish_artifact", "replace_artifact"]);
-var INPUTS_DIR = "inputs";
-var completions = new Limit(2);
-var UNHELD_REQUEST_BYTES = 1024 * 1024;
-var INVALID_PARAMS = -32602;
-var INVALID_REQUEST = -32600;
-var UNREADABLE = "source_path names no readable file in the Work's workspace.";
-var TOO_LARGE = "The source file is larger than 64 MiB. Split it or compress it into a smaller archive.";
-var FROM_INPUTS = "source_path is under inputs/, the Work's read-only inputs. Publish a file outside inputs/.";
-var OVER_REQUEST = "The files published in this request exceed its size limit. Publish them in separate requests.";
-var NOT_FORWARDED = "Not forwarded: a publication in this batch was refused.";
-async function completeRequest(request, root) {
-  const encoding = request.headers["content-encoding"];
-  if (encoding !== void 0 && encoding !== "identity") return { kind: "pass", body: { chunks: [], rest: request } };
-  const head = await readHead(request, UNHELD_REQUEST_BYTES);
-  if (head.rest === void 0) {
-    const body = Buffer.concat(head.chunks);
-    const calls = publicationCalls(body);
-    if (calls === void 0) return { kind: "pass", body: head };
-    return completions.run(() => complete(calls, body, root));
-  }
-  const rest = head.rest;
-  return completions.run(async () => {
-    const read = head.chunks.reduce((size, chunk) => size + chunk.length, 0);
-    const tail = await readHead(rest, MAX_REQUEST_BYTES - read);
-    const chunks = [...head.chunks, ...tail.chunks];
-    if (tail.rest !== void 0) return { kind: "pass", body: { chunks, rest: tail.rest } };
-    const body = Buffer.concat(chunks);
-    const calls = publicationCalls(body);
-    if (calls === void 0) return { kind: "pass", body: { chunks: [body] } };
-    return complete(calls, body, root);
-  });
-}
+// src/proxy/request-body.ts
 var BODY_IDLE_MS = 3e4;
 function readHead(stream, limit, idleMs = BODY_IDLE_MS) {
   return new Promise((resolve3, reject) => {
@@ -6948,71 +6925,6 @@ function readHead(stream, limit, idleMs = BODY_IDLE_MS) {
     stream.resume();
   });
 }
-function publicationCalls(body) {
-  let parsed;
-  try {
-    parsed = JSON.parse(body.toString("utf8"));
-  } catch {
-    return void 0;
-  }
-  const batch = Array.isArray(parsed);
-  const messages = batch ? parsed : [parsed];
-  const calls = messages.flatMap((message2) => {
-    const args = argsOf(message2);
-    return args === void 0 ? [] : [{ message: message2, args }];
-  });
-  return calls.length === 0 ? void 0 : { parsed, batch, messages, calls };
-}
-async function complete({ parsed, batch, messages, calls }, body, root) {
-  let size = body.length;
-  for (const { message: message2, args } of calls) {
-    delete args.source_content;
-    if (typeof args.source_path !== "string") continue;
-    const source = await readSource(root, args.source_path, MAX_REQUEST_BYTES - size);
-    if ("refusal" in source) return { kind: "answer", body: refusal(messages, batch, message2, source.refusal) };
-    const content = source.content.toString("base64");
-    args.source_content = content;
-    size += content.length;
-  }
-  return { kind: "forward", body: Buffer.from(JSON.stringify(parsed)) };
-}
-function argsOf(message2) {
-  if (!isObject(message2) || message2.method !== "tools/call" || !isObject(message2.params)) return void 0;
-  const { name, arguments: args } = message2.params;
-  return typeof name === "string" && TOOLS.has(name) && isObject(args) ? args : void 0;
-}
-async function readSource(root, sourcePath, budget) {
-  if (sourcePath === "") return { refusal: UNREADABLE };
-  const file = await openWorkFile(root, workspaceRelative(sourcePath) ?? sourcePath).catch(() => ({ status: 500 }));
-  if ("status" in file) return { refusal: UNREADABLE };
-  try {
-    const inputs = await confined(root, INPUTS_DIR);
-    if (inputs !== void 0 && within(inputs, file.path)) return { refusal: FROM_INPUTS };
-    if (file.size > MAX_SOURCE_BYTES) return { refusal: TOO_LARGE };
-    if (base64Length(file.size) > budget) return { refusal: OVER_REQUEST };
-    const content = await readBounded(file.handle, MAX_SOURCE_BYTES);
-    if (content === void 0) return { refusal: TOO_LARGE };
-    if (base64Length(content.length) > budget) return { refusal: OVER_REQUEST };
-    return { content };
-  } catch {
-    return { refusal: UNREADABLE };
-  } finally {
-    await file.handle.close().catch(() => {
-    });
-  }
-}
-function refusal(messages, batch, refused, reason2) {
-  const answers = messages.flatMap((message2) => {
-    if (!isObject(message2) || typeof message2.method !== "string" || !("id" in message2)) return [];
-    const error = message2 === refused ? { code: INVALID_PARAMS, message: reason2 } : { code: INVALID_REQUEST, message: NOT_FORWARDED };
-    return [{ jsonrpc: "2.0", id: message2.id, error }];
-  });
-  if (answers.length === 0) return void 0;
-  return Buffer.from(JSON.stringify(batch ? answers : answers[0]));
-}
-function base64Length(bytes) {
-  return 4 * Math.ceil(bytes / 3);
-}
 
 // src/proxy/content-links.ts
 var CONTENT_PATH = "/computer/v1/storage/content";
@@ -7094,9 +7006,170 @@ function escapeRegExp2(text2) {
   return text2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
+// src/proxy/publication-source.ts
+import { lstat as lstat2, realpath as realpath3 } from "node:fs/promises";
+import { isAbsolute as isAbsolute2, join as join11, normalize, relative } from "node:path";
+var MAX_SOURCE_BYTES = 64 * 1024 * 1024;
+var MAX_REQUEST_BYTES = base64Length(MAX_SOURCE_BYTES) + 1024 * 1024;
+var UNHELD_REQUEST_BYTES = 1024 * 1024;
+var RESERVED_DIRS = ["inputs", "knowledge"];
+var completions = new Limit(2);
+function holdingCompletion(task) {
+  return completions.run(task);
+}
+var noFile = (field) => `${field} names no file in the Work's workspace.`;
+var notOneFile = (field) => `${field} is not one regular file in the Work's workspace, reached without symbolic links.`;
+var TOO_LARGE = "The source file is larger than 64 MiB. Split it or compress it into a smaller archive.";
+var reserved = (field, dir) => `${field} is under ${dir}/, which the Work only reads. Publish a file outside inputs/ and knowledge/.`;
+var OVER_REQUEST = "The files published in this request exceed its size limit. Publish them in separate requests.";
+async function readSource(root, sourcePath, field, budget) {
+  const invalid = (refusal2) => ({ refusal: refusal2, missing: false });
+  if (sourcePath === "" || sourcePath.includes("\0")) return invalid(notOneFile(field));
+  let rootReal;
+  try {
+    rootReal = await realpath3(root);
+  } catch {
+    return invalid(notOneFile(field));
+  }
+  const target = workspaceRelative(sourcePath) ?? sourcePath;
+  const named = isAbsolute2(target) ? normalize(target) : join11(rootReal, target);
+  const lexical = within(root, named) ? join11(rootReal, relative(root, named)) : named;
+  if (!within(rootReal, lexical) || lexical === rootReal) return invalid(notOneFile(field));
+  const file = await openWorkFile(root, lexical).catch(() => ({ status: 500 }));
+  if ("status" in file) {
+    const missing = file.status === 404 && await absent(lexical);
+    return missing ? { refusal: noFile(field), missing: true } : invalid(notOneFile(field));
+  }
+  try {
+    if (file.path !== lexical) return invalid(notOneFile(field));
+    for (const dir of RESERVED_DIRS) {
+      if (within(join11(rootReal, dir), file.path)) return invalid(reserved(field, dir));
+    }
+    if (file.size > MAX_SOURCE_BYTES) return invalid(TOO_LARGE);
+    if (base64Length(file.size) > budget) return invalid(OVER_REQUEST);
+    const content = await readBounded(file.handle, MAX_SOURCE_BYTES);
+    if (content === void 0) return invalid(TOO_LARGE);
+    if (base64Length(content.length) > budget) return invalid(OVER_REQUEST);
+    return { content };
+  } catch {
+    return invalid(notOneFile(field));
+  } finally {
+    await file.handle.close().catch(() => {
+    });
+  }
+}
+async function absent(path) {
+  try {
+    await lstat2(path);
+    return false;
+  } catch {
+    return true;
+  }
+}
+function base64Length(bytes) {
+  return 4 * Math.ceil(bytes / 3);
+}
+
+// src/proxy/publication.ts
+var TOOLS = /* @__PURE__ */ new Set(["publish_artifact", "replace_artifact"]);
+var INVALID_PARAMS = -32602;
+var INVALID_REQUEST = -32600;
+var NOT_FORWARDED = "Not forwarded: a publication in this batch was refused.";
+async function completeRequest(request, root) {
+  const encoding = request.headers["content-encoding"];
+  if (encoding !== void 0 && encoding !== "identity") return { kind: "pass", body: { chunks: [], rest: request } };
+  const head = await readHead(request, UNHELD_REQUEST_BYTES);
+  if (head.rest === void 0) {
+    const body = Buffer.concat(head.chunks);
+    const calls = publicationCalls(body);
+    if (calls === void 0) return { kind: "pass", body: head };
+    return holdingCompletion(() => complete(calls, body, root));
+  }
+  const rest = head.rest;
+  return holdingCompletion(async () => {
+    const read = head.chunks.reduce((size, chunk) => size + chunk.length, 0);
+    const tail = await readHead(rest, MAX_REQUEST_BYTES - read);
+    const chunks = [...head.chunks, ...tail.chunks];
+    if (tail.rest !== void 0) return { kind: "pass", body: { chunks, rest: tail.rest } };
+    const body = Buffer.concat(chunks);
+    const calls = publicationCalls(body);
+    if (calls === void 0) return { kind: "pass", body: { chunks: [body] } };
+    return complete(calls, body, root);
+  });
+}
+function publicationCalls(body) {
+  let parsed;
+  try {
+    parsed = JSON.parse(body.toString("utf8"));
+  } catch {
+    return void 0;
+  }
+  const batch = Array.isArray(parsed);
+  const messages = batch ? parsed : [parsed];
+  const calls = messages.flatMap((message2) => {
+    const args = argsOf(message2);
+    return args === void 0 ? [] : [{ message: message2, args }];
+  });
+  return calls.length === 0 ? void 0 : { parsed, batch, messages, calls };
+}
+async function complete({ parsed, batch, messages, calls }, body, root) {
+  let size = body.length;
+  for (const { message: message2, args } of calls) {
+    delete args.source_content;
+    if (typeof args.source_path !== "string") continue;
+    const source = await readSource(root, args.source_path, "source_path", MAX_REQUEST_BYTES - size);
+    if ("refusal" in source) return { kind: "answer", body: refusal(messages, batch, message2, source.refusal) };
+    const content = source.content.toString("base64");
+    args.source_content = content;
+    size += content.length;
+  }
+  return { kind: "forward", body: Buffer.from(JSON.stringify(parsed)) };
+}
+function argsOf(message2) {
+  if (!isObject(message2) || message2.method !== "tools/call" || !isObject(message2.params)) return void 0;
+  const { name, arguments: args } = message2.params;
+  return typeof name === "string" && TOOLS.has(name) && isObject(args) ? args : void 0;
+}
+function refusal(messages, batch, refused, reason2) {
+  const answers = messages.flatMap((message2) => {
+    if (!isObject(message2) || typeof message2.method !== "string" || !("id" in message2)) return [];
+    const error = message2 === refused ? { code: INVALID_PARAMS, message: reason2 } : { code: INVALID_REQUEST, message: NOT_FORWARDED };
+    return [{ jsonrpc: "2.0", id: message2.id, error }];
+  });
+  if (answers.length === 0) return void 0;
+  return Buffer.from(JSON.stringify(batch ? answers : answers[0]));
+}
+
+// src/proxy/api-publication.ts
+var ARTIFACT_COMMANDS = /* @__PURE__ */ new Set([
+  "/talgent.storage.private.v1.ArtifactService/CreateArtifact",
+  "/talgent.storage.private.v1.ArtifactService/ReplaceArtifact"
+]);
+async function completeArtifactCommand(request, root) {
+  const encoding = request.headers["content-encoding"];
+  if (encoding !== void 0 && encoding !== "identity") return { kind: "pass", body: { chunks: [], rest: request } };
+  const head = await readHead(request, UNHELD_REQUEST_BYTES);
+  if (head.rest !== void 0) return { kind: "pass", body: head };
+  const body = Buffer.concat(head.chunks);
+  let message2;
+  try {
+    message2 = JSON.parse(body.toString("utf8"));
+  } catch {
+    return { kind: "pass", body: { chunks: [body] } };
+  }
+  if (!isObject(message2) || typeof message2.path !== "string" || message2.content !== void 0) return { kind: "pass", body: { chunks: [body] } };
+  const { path, ...rest } = message2;
+  return holdingCompletion(async () => {
+    const source = await readSource(root, path, "path", MAX_REQUEST_BYTES - body.length);
+    if ("refusal" in source) return { kind: "refuse", message: source.refusal, missing: source.missing };
+    return { kind: "forward", body: Buffer.from(JSON.stringify({ ...rest, content: source.content.toString("base64") })) };
+  });
+}
+
 // src/proxy/server.ts
 var KEYED_MODEL_PATHS = /* @__PURE__ */ new Set(["/v1/messages", "/v1/messages/count_tokens"]);
-var ROUTE = /^\/w\/([^/]+)\/(model|mcp|content)(\/.*)?$/;
+var ROUTE = /^\/w\/([^/]+)\/(model|mcp|content|api)(\/.*)?$/;
+var API_PATH = /^\/([^/]+)(\/.*)$/;
 var CONTENT_HANDLE = /^\/([A-Za-z0-9_-]+)$/;
 var LocalProxy = class {
   portFile;
@@ -7183,6 +7256,7 @@ var LocalProxy = class {
     if (match === null || !validId(match[1])) return notFound2(response);
     const [, workId, route, rest = ""] = match;
     if (route === "content") return this.content(request, response, workId, rest);
+    if (route === "api") return this.api(request, response, workId, rest, search);
     if (!await this.access.tokenValid(workId, presentedToken(request.headers))) {
       return answerJson(response, 401, { code: "UNAUTHORIZED", message: "present the token of a run of this Work" });
     }
@@ -7223,6 +7297,45 @@ var LocalProxy = class {
       fail: (reason2) => this.log(`local proxy: Work ${workId} ${route} upstream failed: ${reason2}`)
     });
   }
+  // A native API call of a Work's plain HTTP client, such as curl, which
+  // presents the run's token as the first segment of the path. The proxy
+  // adds the Work's identity, and for an Artifact command naming a file of
+  // the Work, the file's bytes.
+  async api(request, response, workId, rest, search) {
+    const match = API_PATH.exec(rest);
+    if (match === null) return notFound2(response);
+    const [, token, path] = match;
+    if (!await this.access.tokenValid(workId, token)) {
+      return answerJson(response, 401, { code: "unauthenticated", message: "present the token of a run of this Work" });
+    }
+    const credentials = await this.access.credentials(workId);
+    if (credentials === void 0) {
+      return answerJson(response, 503, { code: "unavailable", message: "the Work's credentials were not delivered" });
+    }
+    if (credentials.api === void 0) return notFound2(response);
+    const target = below(credentials.api.url, path, search);
+    if (target === void 0) return notFound2(response);
+    const headers = requestHeaders(request.headers);
+    addIdentity(headers, credentials.gateway);
+    let body;
+    if (request.method === "POST" && ARTIFACT_COMMANDS.has(path)) {
+      const completed = await completeArtifactCommand(request, this.access.workRoot(workId));
+      if (completed.kind === "refuse") {
+        if (completed.missing) return answerJson(response, 404, { code: "not_found", message: completed.message });
+        return answerJson(response, 400, { code: "invalid_argument", message: completed.message });
+      }
+      if (completed.kind === "pass") body = completed.body;
+      else {
+        headers["content-length"] = String(completed.body.length);
+        body = { chunks: [completed.body] };
+      }
+    }
+    forward(request, response, target, headers, {
+      body,
+      timeouts: this.timeouts,
+      fail: (reason2) => this.log(`local proxy: Work ${workId} api upstream failed: ${reason2}`)
+    });
+  }
   // A Storage content link the MCP route rewrote into a local handle: only a
   // handle issued to this Work reaches the platform's content endpoint, with
   // the query it stands for and the Work's identity that endpoint also asks
@@ -7358,7 +7471,7 @@ function runOnce(command) {
 
 // src/service/launchd.ts
 import { mkdir as mkdir10, rm as rm8, writeFile as writeFile3 } from "node:fs/promises";
-import { join as join11 } from "node:path";
+import { join as join12 } from "node:path";
 
 // src/service/manager.ts
 import { execFile as execFile4 } from "node:child_process";
@@ -7401,13 +7514,13 @@ var LaunchAgentService = class {
   constructor(run2, home, uid, logFile) {
     this.run = run2;
     this.logFile = logFile;
-    this.plistFile = join11(home, "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
+    this.plistFile = join12(home, "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
     this.domain = `gui/${uid}`;
     this.target = `${this.domain}/${LAUNCHD_LABEL}`;
   }
   async install(spec) {
-    await mkdir10(join11(this.plistFile, ".."), { recursive: true });
-    await mkdir10(join11(spec.logFile, ".."), { recursive: true });
+    await mkdir10(join12(this.plistFile, ".."), { recursive: true });
+    await mkdir10(join12(spec.logFile, ".."), { recursive: true });
     await writeFile3(this.plistFile, launchAgentPlist(spec), { mode: 420 });
     await this.run("launchctl", ["bootout", this.target]);
     await mustRun(this.run, "launchctl", ["bootstrap", this.domain, this.plistFile]);
@@ -7489,7 +7602,7 @@ function xml(value) {
 
 // src/service/systemd.ts
 import { mkdir as mkdir11, rm as rm9, writeFile as writeFile4 } from "node:fs/promises";
-import { join as join12 } from "node:path";
+import { join as join13 } from "node:path";
 var UNIT = `${SERVICE_NAME}.service`;
 var SystemdUserService = class {
   startsAt = 'at login. To start it at boot and keep it running after you log out, run "loginctl enable-linger".';
@@ -7497,10 +7610,10 @@ var SystemdUserService = class {
   unitFile;
   constructor(run2, home) {
     this.run = run2;
-    this.unitFile = join12(home, ".config", "systemd", "user", UNIT);
+    this.unitFile = join13(home, ".config", "systemd", "user", UNIT);
   }
   async install(spec) {
-    await mkdir11(join12(this.unitFile, ".."), { recursive: true });
+    await mkdir11(join13(this.unitFile, ".."), { recursive: true });
     await writeFile4(this.unitFile, systemdUnit(spec), { mode: 420 });
     await this.systemctl("daemon-reload");
     await this.systemctl("enable", UNIT);
@@ -7566,7 +7679,7 @@ function quote(value) {
 
 // src/service/task-scheduler.ts
 import { mkdir as mkdir12, rm as rm10, writeFile as writeFile5 } from "node:fs/promises";
-import { join as join13 } from "node:path";
+import { join as join14 } from "node:path";
 var TASK_NAME = "Talgent Computer";
 var WRAPPER_FILE = "talgent-computer-service.cmd";
 var TASK_FILE = "talgent-computer-task.xml";
@@ -7586,9 +7699,9 @@ var LogonTaskService = class {
   }
   async install(spec) {
     await mkdir12(this.serviceDir, { recursive: true });
-    await mkdir12(join13(spec.logFile, ".."), { recursive: true });
-    const wrapper = join13(this.serviceDir, WRAPPER_FILE);
-    const definition = join13(this.serviceDir, TASK_FILE);
+    await mkdir12(join14(spec.logFile, ".."), { recursive: true });
+    const wrapper = join14(this.serviceDir, WRAPPER_FILE);
+    const definition = join14(this.serviceDir, TASK_FILE);
     await writeFile5(wrapper, wrapperScript(spec));
     await writeFile5(definition, Buffer.concat([Buffer.from([255, 254]), Buffer.from(logonTask(spec, this.user, wrapper), "utf16le")]));
     await this.end();
@@ -7604,7 +7717,7 @@ var LogonTaskService = class {
       installed,
       running: installed && state === "Running",
       lastExit: installed && lastResult !== void 0 && /^\d+$/.test(lastResult) && state !== "Running" ? Number(lastResult) : void 0,
-      supervisesUpgrades: installed && await definesSupervised(join13(this.serviceDir, WRAPPER_FILE)),
+      supervisesUpgrades: installed && await definesSupervised(join14(this.serviceDir, WRAPPER_FILE)),
       definition: `Task Scheduler: ${TASK_NAME}`,
       logs: this.logFile
     };
@@ -7615,8 +7728,8 @@ var LogonTaskService = class {
       await this.end();
       await mustRun(this.run, "schtasks", ["/Delete", "/TN", TASK_NAME, "/F"]);
     }
-    await rm10(join13(this.serviceDir, WRAPPER_FILE), { force: true });
-    await rm10(join13(this.serviceDir, TASK_FILE), { force: true });
+    await rm10(join14(this.serviceDir, WRAPPER_FILE), { force: true });
+    await rm10(join14(this.serviceDir, TASK_FILE), { force: true });
     return installed;
   }
   // Ending the task ends its console host only: the batch file and the run
@@ -8314,7 +8427,7 @@ function message(error) {
 // package.json
 var package_default = {
   name: "@talgent/computer",
-  version: "0.1.2",
+  version: "0.2.0",
   description: "Talgent Computer: registers a machine as a Managed Computer and keeps it connected.",
   license: "Apache-2.0",
   repository: {
@@ -8373,7 +8486,7 @@ async function runMachine(io, credential, url) {
     restarting = true;
     controller.abort();
   });
-  const copiesDir = join14(dataDir, "claude-code");
+  const copiesDir = join15(dataDir, "claude-code");
   const claudeCode = await prepareClaudeCode({ copiesDir }).catch((error) => {
     if (error instanceof ClaudeCodeMissingError) return error;
     throw error;
@@ -8416,10 +8529,10 @@ async function runMachine(io, credential, url) {
 async function connect2(options) {
   const { io, log, url, credential, claudeCode, processes, fence, upgrade } = options;
   const { dataDir } = io.paths;
-  const works = new Works({ worksDir: join14(dataDir, "works"), recordsDir: join14(dataDir, "state", "works") });
-  const credentials = new CredentialStore({ dir: join14(dataDir, "state", "credentials") });
+  const works = new Works({ worksDir: join15(dataDir, "works"), recordsDir: join15(dataDir, "state", "works") });
+  const credentials = new CredentialStore({ dir: join15(dataDir, "state", "credentials") });
   const proxy = new LocalProxy({
-    portFile: join14(dataDir, "state", "proxy.json"),
+    portFile: join15(dataDir, "state", "proxy.json"),
     access: {
       tokenValid: (workId, token) => processes.proxyTokenValid(workId, token),
       credentials: (workId) => credentials.get(workId),
@@ -8435,7 +8548,7 @@ async function connect2(options) {
     processes,
     claudeBinDir: claudeCode.binDir,
     credentials,
-    inputs: new WorkInputs({ recordsDir: join14(dataDir, "state", "inputs"), credentials, log }),
+    inputs: new WorkInputs({ recordsDir: join15(dataDir, "state", "inputs"), credentials, log }),
     proxyOrigin: () => proxy.origin(),
     baseEnv: process.env,
     home: homedir2(),
@@ -8502,22 +8615,22 @@ function selfUpgrade(dataDir, log, restart) {
     version: COMPUTER_VERSION,
     recordFile: upgradeRecordFile(dataDir),
     installer: "unavailable" in installation ? installation : new NpmInstaller(installation),
-    lock: new InstallLock({ file: join14(dataDir, "state", "upgrade.lock"), staleAfterMs: INSTALL_LOCK_MS, waitMs: INSTALL_LOCK_MS }),
+    lock: new InstallLock({ file: join15(dataDir, "state", "upgrade.lock"), staleAfterMs: INSTALL_LOCK_MS, waitMs: INSTALL_LOCK_MS }),
     restart,
     log
   });
 }
 function runRecordFile(dataDir) {
-  return join14(dataDir, ...RUN_RECORD_PATH);
+  return join15(dataDir, ...RUN_RECORD_PATH);
 }
 function upgradeRecordFile(dataDir) {
-  return join14(dataDir, "state", "upgrade.json");
+  return join15(dataDir, "state", "upgrade.json");
 }
 function processTable(dataDir, uses) {
-  return new ProcessTable({ stateRoot: join14(dataDir, "state", "processes"), shim: [process.execPath, thisProgram(), SHIM_ARG], uses });
+  return new ProcessTable({ stateRoot: join15(dataDir, "state", "processes"), shim: [process.execPath, thisProgram(), SHIM_ARG], uses });
 }
 function newFence(dataDir, processes, log) {
-  return new Fence({ stateFile: join14(dataDir, "state", "fence.json"), processes, log });
+  return new Fence({ stateFile: join15(dataDir, "state", "fence.json"), processes, log });
 }
 async function restartWhenAsked(code, io) {
   if (code !== EXIT_RESTART || supervised(process.env)) return code;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@talgent/computer",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "description": "Talgent Computer: registers a machine as a Managed Computer and keeps it connected.",
   "license": "Apache-2.0",
   "repository": {