usebeeline 0.1.27 → 0.1.28

package/dist/usebeeline.mjs

@@ -14175,7 +14175,7 @@ function configureNetworkFamilyDefaults(network = net) {
 configureNetworkFamilyDefaults();
 
 // apps/body/dist/cli.js
-import { dirname as dirname33, resolve as resolve53 } from "node:path";
+import { dirname as dirname34, resolve as resolve53 } from "node:path";
 import { stdin as stdin4, stdout as stdout5 } from "node:process";
 
 // node_modules/@clack/core/dist/index.mjs
@@ -18253,7 +18253,8 @@ var SERVER_EVENT_KINDS = [
   "choice-skipped",
   "poll-closed",
   "workflow-handoff",
-  "subscription-fired"
+  "subscription-fired",
+  "computer-session-activity"
 ];
 var SERVER_EVENT_KIND_DETAIL = {
   "joined": "fires when a person or agent joins this Room, or when a Workspace arrival projects into it",
@@ -18270,7 +18271,8 @@ var SERVER_EVENT_KIND_DETAIL = {
   "choice-skipped": "fires when a posted choice's window closes unanswered, starting a new turn for the asking agent",
   "poll-closed": "fires when a posted poll closes, starting a new turn for the asking agent",
   "workflow-handoff": "fires when a workflow run starts or hands off to its next role",
-  "subscription-fired": "wakes the agent that subscribed to one outside event"
+  "subscription-fired": "wakes the agent that subscribed to one outside event",
+  "computer-session-activity": "wakes the sharing agent when a person opens, controls, uses, hands back, or closes its browser view"
 };
 var PER_ITEM_EVENT_KINDS = [
   "grant-decided",
@@ -18280,7 +18282,8 @@ var PER_ITEM_EVENT_KINDS = [
   "choice-answered",
   "choice-skipped",
   "poll-closed",
-  "subscription-fired"
+  "subscription-fired",
+  "computer-session-activity"
 ];
 function isPerItemEventKind(value) {
   return PER_ITEM_EVENT_KINDS.includes(value);
@@ -29655,15 +29658,15 @@ async function retryBeforeReady(work, options) {
       failures += 1;
       const timedRetry = ROOM_RETRY_DELAYS_MS[failures - 1];
       console.warn(`[thin-core] server unreachable before READY; ${timedRetry === void 0 ? "waiting for the live socket to open" : `retrying in ${timedRetry}ms or on open`}:`, error);
-      let opened = false;
+      let opened2 = false;
       let wake = () => void 0;
       const off = options.onLinkOpen(() => {
-        opened = true;
+        opened2 = true;
         wake();
       });
       try {
         const waitStarted = now2();
-        while (!opened && !options.signal?.aborted) {
+        while (!opened2 && !options.signal?.aborted) {
           const remaining = [
             slice,
             options.deadlineAt === void 0 ? Infinity : options.deadlineAt - now2(),
@@ -29682,7 +29685,7 @@ async function retryBeforeReady(work, options) {
             }
             wake = done;
             options.signal?.addEventListener("abort", done, { once: true });
-            if (opened || options.signal?.aborted)
+            if (opened2 || options.signal?.aborted)
               done();
           });
         }
@@ -33330,7 +33333,7 @@ Follow your own owner first, then this Workspace's owner and admins, then member
 
 A **tool** is something you can use once a human adds it; a **key** is the credential that tool holds for that human. You spend a key through the mounted connector and never see the credential itself.
 
-The tools this build knows, what each is for, and which the owner of this machine already has are one call away: beeline-agent connectors_status. That read is the Connectors page for the machine and owner you actually run on, not the person who asked. Connected apps are listed once per app with a stable ID. Their sign-in and credentials stay with the server. Trusty Squire signs up and signs in to any website hands-off for the person; its vault holds keys when needed. operate_drive drives a whole flow, and flat steps (operate_click, operate_type, operate_select, operate_press, operate_scroll, operate_wait, operate_navigate, operate_read_inbox, operate_extract, and the rest of its flat operate_* actions) handle one action at a time. When you are stuck in an existing browser, call share_browser. The call waits for a person to hand the browser back; do not touch the browser again until that call returns. Tailscale installs its CLI on the selected helper and opens Tailscale's own browser sign-in; once connected, use the CLI for tailnet resources and tailscale file cp or tailscale file get for Taildrop. The wallet is created only from the Connectors page. When you cannot reach a tool, say: I can't reach X on this machine because Y; to fix it, Z. Give one explanation, then take or offer Z.
+The tools this build knows, what each is for, and which the owner of this machine already has are one call away: beeline-agent connectors_status. That read is the Connectors page for the machine and owner you actually run on, not the person who asked. Connected apps are listed once per app with a stable ID. Their sign-in and credentials stay with the server. Trusty Squire signs up and signs in to any website hands-off for the person; its vault holds keys when needed. operate_drive drives a whole flow, and flat steps (operate_click, operate_type, operate_select, operate_press, operate_scroll, operate_wait, operate_navigate, operate_read_inbox, operate_extract, and the rest of its flat operate_* actions) handle one action at a time. When you want to show an existing browser, call share_browser. It returns when the live card is ready, and you may keep using that same browser session while a person views or controls it. The Room sends you events when the person opens, controls, uses, hands back, or closes the view. End the share explicitly with end_browser_share when it is finished. Tailscale installs its CLI on the selected helper and opens Tailscale's own browser sign-in; once connected, use the CLI for tailnet resources and tailscale file cp or tailscale file get for Taildrop. The wallet is created only from the Connectors page. When you cannot reach a tool, say: I can't reach X on this machine because Y; to fix it, Z. Give one explanation, then take or offer Z.
 
 **Inspect your own host before answering.** When a question is about a system on the machine you run on, inspect its live state with the tools you have: processes, logs, local endpoints or service status. Say what you checked. Memory and Room history are not evidence of current state.
 
@@ -36752,7 +36755,7 @@ async function runUpdateFunctionalProbe(input) {
     const sessionTimeoutMs = input.sessionTimeoutMs ?? UPDATE_PROBE_SESSION_TIMEOUT_MS;
     const sessionOpenTimeoutMs = input.sessionOpenTimeoutMs ?? input.sessionTimeoutMs ?? UPDATE_PROBE_SESSION_OPEN_TIMEOUT_MS;
     const openSessionAndPrompt = async () => {
-      const opened = await client.sessionNew({
+      const opened2 = await client.sessionNew({
         cwd,
         mcpServers: [],
         systemPrompt: "This is Beeline update validation. Answer only READY.",
@@ -36760,11 +36763,11 @@ async function runUpdateFunctionalProbe(input) {
         timeoutMs: sessionOpenTimeoutMs
       });
       if (input.config.modelSelection) {
-        await applyAgentModelSelection(client, opened.sessionId, parseAdvertisedConfigOptions(opened.raw, input.config.modelSelection.model, isGrokAgentCommand(selectedAgent)), input.config.modelSelection);
+        await applyAgentModelSelection(client, opened2.sessionId, parseAdvertisedConfigOptions(opened2.raw, input.config.modelSelection.model, isGrokAgentCommand(selectedAgent)), input.config.modelSelection);
       }
       return {
-        sessionId: opened.sessionId,
-        served: await client.sessionPrompt(opened.sessionId, "Reply READY.", input.turnTimeoutMs ?? UPDATE_PROBE_TURN_TIMEOUT_MS)
+        sessionId: opened2.sessionId,
+        served: await client.sessionPrompt(opened2.sessionId, "Reply READY.", input.turnTimeoutMs ?? UPDATE_PROBE_TURN_TIMEOUT_MS)
       };
     };
     try {
@@ -39345,11 +39348,11 @@ async function runUpdateProbeCommand(args, options = {}) {
 // apps/body/dist/machine-helper.js
 import { mkdir as mkdir32, rename as rename15, stat as stat12, writeFile as writeFile24 } from "node:fs/promises";
 import { homedir as homedir20 } from "node:os";
-import { dirname as dirname32, resolve as resolve51 } from "node:path";
+import { dirname as dirname33, resolve as resolve51 } from "node:path";
 
 // apps/body/dist/agent-runtime.js
 import { homedir as homedir19 } from "node:os";
-import { dirname as dirname31, join as join23, resolve as resolve49 } from "node:path";
+import { dirname as dirname32, join as join23, resolve as resolve49 } from "node:path";
 
 // apps/body/dist/model-availability.js
 var SECRET_VALUE = /(?:token|key|secret|password)=?[^\s,;]*/gi;
@@ -40250,20 +40253,217 @@ function describe2(error) {
   return error instanceof Error ? error.message : String(error);
 }
 
+// apps/body/dist/browser-share-host.js
+import { createConnection as createConnection4, createServer as createServer3 } from "node:net";
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync3, rmSync as rmSync4 } from "node:fs";
+import { dirname as dirname22 } from "node:path";
+
+// apps/body/dist/browser-share.js
+var shares = /* @__PURE__ */ new Map();
+function opened(socket) {
+  return new Promise((resolve54, reject) => {
+    socket.once("open", resolve54);
+    socket.once("error", reject);
+  });
+}
+async function shareChromiumPage(input) {
+  if (!input.page.webSocketDebuggerUrl)
+    throw new Error("Chromium page has no debugger socket");
+  const cdp = new import_websocket.default(input.page.webSocketDebuggerUrl);
+  await opened(cdp);
+  const source = new URL(`/s/${input.shareId}/source`, input.serverBaseUrl);
+  source.protocol = source.protocol === "https:" ? "wss:" : "ws:";
+  const relay = new import_websocket.default(source, { headers: { authorization: `Bearer ${input.daemonToken}` } });
+  try {
+    await opened(relay);
+  } catch (error) {
+    cdp.close();
+    throw error;
+  }
+  const share = { cdp, relay, controlled: false };
+  shares.get(input.page.id)?.cdp.close();
+  shares.set(input.page.id, share);
+  let serial = 1;
+  const sendCdp = (method, params = {}) => {
+    if (cdp.readyState !== import_websocket.default.OPEN)
+      return void 0;
+    const id = serial++;
+    cdp.send(JSON.stringify({ id, method, params }));
+    return id;
+  };
+  let lastFrameAt = 0;
+  let firstFrameLogged = false;
+  let inputCount = 0;
+  let screenshotId;
+  let screenshotStartedAt = 0;
+  let fallbackTimer;
+  const capture = () => {
+    if (screenshotId !== void 0 && Date.now() - screenshotStartedAt < 5e3)
+      return;
+    screenshotId = sendCdp("Page.captureScreenshot", { format: "jpeg", quality: 65, captureBeyondViewport: false });
+    screenshotStartedAt = Date.now();
+  };
+  cdp.on("message", (data) => {
+    let message;
+    try {
+      message = JSON.parse(data.toString());
+    } catch {
+      return;
+    }
+    if (message.id === screencastId)
+      console.error(`[computer-share] screencast start ${message.error?.message ? `failed: ${message.error.message}` : "accepted"}`);
+    if (screenshotId !== void 0 && message.id === screenshotId) {
+      screenshotId = void 0;
+      if (message.result?.data && relay.readyState === import_websocket.default.OPEN && relay.bufferedAmount < 4 * 1024 * 1024) {
+        if (!firstFrameLogged) {
+          firstFrameLogged = true;
+          console.error("[computer-share] first JPEG forwarded from screenshot");
+        }
+        relay.send(JSON.stringify({ method: "Page.screencastFrame", params: { data: message.result.data, sessionId: 0 } }));
+      } else if (message.error?.message)
+        console.error(`[computer-share] screenshot failed: ${message.error.message}`);
+      return;
+    }
+    if (message.method === "Page.frameNavigated" && message.params?.frame?.url) {
+      try {
+        const url = new URL(message.params.frame.url);
+        if (url.origin !== "null" && relay.readyState === import_websocket.default.OPEN)
+          relay.send(JSON.stringify({ type: "share-event", name: "navigation", detail: url.origin }));
+      } catch {
+      }
+      return;
+    }
+    if (message.method !== "Page.screencastFrame")
+      return;
+    lastFrameAt = Date.now();
+    if (!firstFrameLogged) {
+      firstFrameLogged = true;
+      console.error("[computer-share] first JPEG forwarded from screencast");
+    }
+    if (relay.readyState === import_websocket.default.OPEN && relay.bufferedAmount < 4 * 1024 * 1024)
+      relay.send(data.toString());
+    if (message.params?.sessionId !== void 0)
+      sendCdp("Page.screencastFrameAck", { sessionId: message.params.sessionId });
+  });
+  relay.on("message", (data) => {
+    let message;
+    try {
+      message = JSON.parse(data.toString());
+    } catch {
+      return;
+    }
+    if (message.type === "takeover") {
+      share.controlled = true;
+      console.error("[computer-share] viewer took control");
+    } else if (message.type === "release") {
+      share.controlled = false;
+      console.error("[computer-share] viewer released control");
+    } else if (share.controlled && message.method?.startsWith("Input.")) {
+      if (inputCount++ < 5)
+        console.error(`[computer-share] forwarded ${message.method}`);
+      sendCdp(message.method, message.params ?? {});
+    }
+  });
+  const finish = () => {
+    if (shares.get(input.page.id) !== share)
+      return;
+    shares.delete(input.page.id);
+    clearTimeout(fallbackTimer);
+    cdp.close();
+    relay.close();
+    void input.onEnded();
+  };
+  cdp.once("close", finish);
+  relay.once("close", finish);
+  sendCdp("Page.enable");
+  const screencastId = sendCdp("Page.startScreencast", { format: "jpeg", quality: 65, maxWidth: 1280, maxHeight: 900, everyNthFrame: 1 });
+  capture();
+  const scheduleFallback = () => {
+    fallbackTimer = setTimeout(() => {
+      if (shares.get(input.page.id) !== share)
+        return;
+      if (Date.now() - lastFrameAt > 1500)
+        capture();
+      scheduleFallback();
+    }, 1e3);
+    fallbackTimer.unref();
+  };
+  scheduleFallback();
+}
+
+// apps/body/dist/browser-share-host.js
+var BrowserShareHost = class {
+  socketPath;
+  server;
+  constructor(socketPath) {
+    this.socketPath = socketPath;
+  }
+  async start() {
+    mkdirSync3(dirname22(this.socketPath), { recursive: true, mode: 448 });
+    rmSync4(this.socketPath, { force: true });
+    this.server = createServer3({ allowHalfOpen: true }, (socket) => {
+      let text2 = "";
+      socket.setEncoding("utf8");
+      socket.on("data", (chunk) => {
+        text2 += chunk;
+        if (text2.length > 65536)
+          socket.destroy();
+      });
+      socket.once("end", () => {
+        void (async () => {
+          const request = JSON.parse(text2);
+          if (!request.page?.webSocketDebuggerUrl || !request.shareId || !request.roomId || !request.serverBaseUrl || !request.daemonToken)
+            throw new Error("Invalid browser share request");
+          await shareChromiumPage({
+            page: request.page,
+            shareId: request.shareId,
+            serverBaseUrl: request.serverBaseUrl,
+            daemonToken: request.daemonToken,
+            onEnded: async () => {
+              await fetch(new URL("/v1/daemon/operations/endComputerSession", request.serverBaseUrl), {
+                method: "POST",
+                headers: { authorization: `Bearer ${request.daemonToken}`, "content-type": "application/json" },
+                body: JSON.stringify({ roomId: request.roomId, sessionId: request.page.id }),
+                signal: AbortSignal.timeout(1e4)
+              }).catch(() => {
+              });
+            }
+          });
+          socket.end(JSON.stringify({ ok: true }));
+        })().catch((error) => socket.end(JSON.stringify({ error: error instanceof Error ? error.message : String(error) })));
+      });
+    });
+    await new Promise((resolve54, reject) => {
+      this.server.once("error", reject);
+      this.server.listen(this.socketPath, () => {
+        this.server.off("error", reject);
+        resolve54();
+      });
+    });
+    chmodSync2(this.socketPath, 384);
+  }
+  async stop() {
+    if (this.server)
+      await new Promise((resolve54) => this.server.close(() => resolve54()));
+    this.server = void 0;
+    rmSync4(this.socketPath, { force: true });
+  }
+};
+
 // apps/body/dist/room-runtime.js
 import { execFile as execFile19 } from "node:child_process";
 import { createHash as createHash16 } from "node:crypto";
-import { existsSync as existsSync10, mkdirSync as mkdirSync3 } from "node:fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync4 } from "node:fs";
 import { lstat as lstat9, mkdir as mkdir30, readdir as readdir13, realpath as realpath4, rm as rm21 } from "node:fs/promises";
-import { dirname as dirname29, relative as relative4, resolve as resolve44, sep as sep4 } from "node:path";
+import { dirname as dirname30, relative as relative4, resolve as resolve44, sep as sep4 } from "node:path";
 import { promisify as promisify13 } from "node:util";
 
 // apps/body/dist/grant-runner.js
 import { execFile as execFile11 } from "node:child_process";
 import { createHash as createHash13, randomBytes as randomBytes9, randomUUID as randomUUID12 } from "node:crypto";
 import { chmod as chmod8, mkdir as mkdir20, readFile as readFile25, readdir as readdir8, rename as rename11, rm as rm15, rmdir, stat as stat9, writeFile as writeFile17 } from "node:fs/promises";
-import { createServer as createServer3 } from "node:http";
-import { dirname as dirname22, resolve as resolve32 } from "node:path";
+import { createServer as createServer4 } from "node:http";
+import { dirname as dirname23, resolve as resolve32 } from "node:path";
 
 // packages/api-contract/dist/surface-capabilities.js
 var SURFACE_CAPABILITY_TABLE = {
@@ -40300,7 +40500,7 @@ var SANDBOX_STARTED_SCRIPT = ['printf "%s\\n" "$1" >&2', "shift", 'exec "$@"'].j
 var ROOM_SANDBOX_UNAVAILABLE = "this Room cannot run granted commands: a Room promises a read-only filesystem and that promise is enforced by bubblewrap, which is not usable on this host. Open a corner with open_corner and run it there, where writes belong.";
 var ROOM_WRITE_REFUSED_NOTE = "[beeline] the Room filesystem is read-only outside your scratch directory, so this write was refused by the kernel. Open a corner with open_corner to change files.";
 function operatorSecretsPath(env = process.env) {
-  return resolve32(dirname22(providerKeyStorePath(env)), "secrets.json");
+  return resolve32(dirname23(providerKeyStorePath(env)), "secrets.json");
 }
 async function readOperatorSecrets(env = process.env) {
   const raw = await readFile25(operatorSecretsPath(env), "utf8").catch(() => void 0);
@@ -40572,7 +40772,7 @@ var GrantRunnerServer = class {
     if (this.endpoint)
       return this.endpoint;
     const token = randomBytes9(32).toString("base64url");
-    const server = createServer3((request, response) => {
+    const server = createServer4((request, response) => {
       void this.handle(request, response, token);
     });
     await new Promise((resolveListen, reject) => {
@@ -40817,7 +41017,7 @@ import { randomUUID as randomUUID13 } from "node:crypto";
 import { mkdir as mkdir21, writeFile as writeFile18 } from "node:fs/promises";
 import { writeFileSync as writeFileSync4 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
-import { dirname as dirname23, join as join16 } from "node:path";
+import { dirname as dirname24, join as join16 } from "node:path";
 var CommandExecutionContext = class {
   generationId = randomUUID13();
   path;
@@ -40827,7 +41027,7 @@ var CommandExecutionContext = class {
   }
   async enter(command) {
     this.current = command;
-    await mkdir21(dirname23(this.path), { recursive: true });
+    await mkdir21(dirname24(this.path), { recursive: true });
     await writeFile18(this.path, JSON.stringify({
       roomId: command.roomId,
       requestId: command.turnRequestId,
@@ -41115,7 +41315,7 @@ import { createHash as createHash15 } from "node:crypto";
 import { existsSync as existsSync9 } from "node:fs";
 import { mkdir as mkdir29, readFile as readFile33, writeFile as writeFile22 } from "node:fs/promises";
 import { homedir as homedir18, hostname as hostname4 } from "node:os";
-import { dirname as dirname27, join as join21, resolve as resolve42 } from "node:path";
+import { dirname as dirname28, join as join21, resolve as resolve42 } from "node:path";
 import { promisify as promisify11 } from "node:util";
 
 // apps/body/dist/machine-host.js
@@ -42427,6 +42627,7 @@ function beelineAgentMcpServer(config, api, context) {
       { name: "BEELINE_DAEMON_TOKEN", value: connection.daemonToken },
       { name: "BEELINE_HELPER_VERSION", value: connection.helperVersion },
       { name: "BEELINE_DAEMON_AGENT_ID", value: connection.agentId },
+      ...config.browserShareHostSocket ? [{ name: "BEELINE_BROWSER_SHARE_HOST_SOCKET", value: config.browserShareHostSocket }] : [],
       { name: "BEELINE_OPERATOR_HOME", value: config.operatorHome ?? homedir16() },
       { name: "BEELINE_DAEMON_ROOM_ID", value: context.roomId },
       { name: "BEELINE_DAEMON_WORKSPACE_ID", value: context.workspaceId },
@@ -42599,14 +42800,14 @@ async function awaitInstitutionalContext(fetch2, log2 = console.warn, budgetMs =
 // apps/body/dist/codegraph.js
 import { execFile as execFile16 } from "node:child_process";
 import { access as access3, appendFile, mkdir as mkdir24, readFile as readFile31 } from "node:fs/promises";
-import { dirname as dirname24, isAbsolute as isAbsolute4, resolve as resolve38 } from "node:path";
+import { dirname as dirname25, isAbsolute as isAbsolute4, resolve as resolve38 } from "node:path";
 import { promisify as promisify10 } from "node:util";
 var execFileAsync10 = promisify10(execFile16);
 var CODEGRAPH_MCP_SERVER_NAME = "codegraph";
 var CODEGRAPH_INDEX_PATH = ".codegraph/codegraph.db";
 var CODEGRAPH_PREPARE_TIMEOUT_MS = 12e4;
 function codegraphIndexDirectory(cwd) {
-  return resolve38(cwd, dirname24(CODEGRAPH_INDEX_PATH));
+  return resolve38(cwd, dirname25(CODEGRAPH_INDEX_PATH));
 }
 function codegraphMcpServer(config, cwd, options) {
   if (!config.codegraphCommand)
@@ -42647,7 +42848,7 @@ async function excludeIndexFromGitStatus(cwd) {
     if (!gitPath)
       return;
     const path = isAbsolute4(gitPath) ? gitPath : resolve38(cwd, gitPath);
-    await mkdir24(dirname24(path), { recursive: true });
+    await mkdir24(dirname25(path), { recursive: true });
     const existing = await readFile31(path, "utf8").catch(() => "");
     if (existing.split("\n").includes(".codegraph/"))
       return;
@@ -42681,7 +42882,7 @@ async function prepareCodegraphIndex(config, cwd) {
 // apps/body/dist/monolith-room-turn.js
 import { mkdir as mkdir26, writeFile as writeFile20 } from "node:fs/promises";
 import { homedir as homedir17, hostname as hostname3 } from "node:os";
-import { dirname as dirname25, join as join19 } from "node:path";
+import { dirname as dirname26, join as join19 } from "node:path";
 
 // packages/api-contract/dist/scheduled-prompts.js
 var SCHEDULE_SCHEDULER_NAME = "Beeline Scheduler";
@@ -44321,7 +44522,7 @@ var MonolithRoomTurnLoop = class {
       }) ? { relay: await this.squireRelay.listen() } : {}
     };
     const resourceAuthFile = `${this.commandContext.path}.resource-auth.json`;
-    await mkdir26(dirname25(resourceAuthFile), { recursive: true, mode: 448 });
+    await mkdir26(dirname26(resourceAuthFile), { recursive: true, mode: 448 });
     await writeFile20(resourceAuthFile, JSON.stringify({
       ...this.options.api.connection(),
       turnContextPath: this.commandContext.path
@@ -44425,6 +44626,7 @@ var MonolithRoomTurnLoop = class {
         harnessHomeStateDirs: homeStateDirs,
         ...tmpDir ? { tmpDir } : {},
         additionalWritablePaths: [
+          ...this.options.config.browserShareHostSocket ? [dirname26(this.options.config.browserShareHostSocket)] : [],
           ...attachScratchRoot ? [attachScratchRoot] : [],
           ...codegraphReady ? [codegraphIndexDirectory(this.options.cwd)] : [],
           ...registryMcpHostBindPaths(configuration.registryMcpRoutes, this.options.config.registryMcpBrokerSocket),
@@ -44549,25 +44751,25 @@ var MonolithRoomTurnLoop = class {
     this.sessionSurface = directMessage ? "dm" : "room";
     this.turnInstructionPrefix = session.turnPrefix;
     this.sessionPromptSectionIds = session.report.map((section) => section.id);
-    const opened = await this.client.sessionNew({
+    const opened2 = await this.client.sessionNew({
       cwd: this.options.cwd,
       mcpServers: servers,
       mode: "readonly",
       systemPrompt: session.systemPrompt
     });
-    this.sessionId = opened.sessionId;
+    this.sessionId = opened2.sessionId;
     this.sessionCwd = this.options.cwd;
     this.sessionCommit = this.turnCheckout?.commit;
     this.sessionFingerprint = fingerprint;
     this.sessionCodegraphReady = codegraphReady;
     if (selection) {
-      const options = filterAllowedModelConfigOptions(parseAdvertisedConfigOptions(opened.raw, selection.model));
-      const applied = await applyAgentModelSelection(this.client, opened.sessionId, options, selection);
+      const options = filterAllowedModelConfigOptions(parseAdvertisedConfigOptions(opened2.raw, selection.model));
+      const applied = await applyAgentModelSelection(this.client, opened2.sessionId, options, selection);
       if (selection.model && applied.appliedSelection.model && applied.appliedSelection.model !== selection.model) {
         this.recordModelFallback(applied.appliedSelection, applied.options);
       }
     }
-    return opened.sessionId;
+    return opened2.sessionId;
   }
   /**
    * A vanished model id was just substituted for a same-family replacement
@@ -45615,7 +45817,7 @@ function agentGitIdentityEnv(agent) {
 import { createHash as createHash14, randomUUID as randomUUID14 } from "node:crypto";
 import { constants as fsConstants3 } from "node:fs";
 import { chmod as chmod10, copyFile as copyFile2, link, lstat as lstat7, mkdir as mkdir28, readdir as readdir11, readFile as readFile32, readlink as readlink2, rename as rename12, rm as rm19, stat as stat11, symlink as symlink3, utimes } from "node:fs/promises";
-import { dirname as dirname26, join as join20, resolve as resolve41 } from "node:path";
+import { dirname as dirname27, join as join20, resolve as resolve41 } from "node:path";
 var STORE_FORMAT = "v1";
 var STAGING_PREFIX = ".beeline-warm-";
 var STAGING_SWEEP_MS = 24 * 60 * 60 * 1e3;
@@ -45703,7 +45905,7 @@ async function seedWarmNodeModules(input) {
     }
     for (const tree of plan.trees) {
       const target = resolve41(input.worktreePath, tree);
-      await mkdir28(dirname26(target), { recursive: true });
+      await mkdir28(dirname27(target), { recursive: true });
       await rename12(resolve41(staging, tree), target);
       placed.push(target);
     }
@@ -46487,7 +46689,7 @@ var MonolithCornerTurnLoop = class {
       }) ? { relay: await this.squireRelay.listen() } : {}
     };
     const resourceAuthFile = `${this.commandContext.path}.resource-auth.json`;
-    await mkdir29(dirname27(resourceAuthFile), { recursive: true, mode: 448 });
+    await mkdir29(dirname28(resourceAuthFile), { recursive: true, mode: 448 });
     await writeFile22(resourceAuthFile, JSON.stringify({
       ...this.options.api.connection(),
       turnContextPath: this.commandContext.path
@@ -46650,6 +46852,7 @@ var MonolithCornerTurnLoop = class {
         harnessHomeStateDirs: homeStateDirs,
         ...tmpDir ? { tmpDir } : {},
         additionalWritablePaths: [
+          ...this.options.config.browserShareHostSocket ? [dirname28(this.options.config.browserShareHostSocket)] : [],
           ...attachScratchRoot ? [attachScratchRoot] : [],
           ...assets ? [] : [npmCacheDir, pnpmStoreDir, turboCacheDir, modelCacheDir],
           cargoTargetDir,
@@ -46802,26 +47005,26 @@ var MonolithCornerTurnLoop = class {
     });
     this.turnSessionPrefix = session.turnPrefix;
     this.sessionPromptSectionIds = session.report.map((section) => section.id);
-    const opened = await this.client.sessionNew({
+    const opened2 = await this.client.sessionNew({
       cwd: this.options.worktreePath,
       mcpServers: servers,
       mode: "edit",
       systemPrompt: session.systemPrompt
     });
-    this.sessionId = opened.sessionId;
+    this.sessionId = opened2.sessionId;
     this.sessionFingerprint = fingerprint;
     this.sessionCodegraphReady = codegraphReady;
     let appliedModel;
     if (selection) {
-      const options = filterAllowedModelConfigOptions(parseAdvertisedConfigOptions(opened.raw, selection.model));
-      const applied = await applyAgentModelSelection(this.client, opened.sessionId, options, selection);
+      const options = filterAllowedModelConfigOptions(parseAdvertisedConfigOptions(opened2.raw, selection.model));
+      const applied = await applyAgentModelSelection(this.client, opened2.sessionId, options, selection);
       appliedModel = applied.appliedSelection.model;
       if (selection.model && appliedModel && appliedModel !== selection.model) {
         this.recordModelFallback(applied.appliedSelection, applied.options);
       }
     }
     this.sessionModel = appliedModel ?? selection?.model ?? null;
-    return opened.sessionId;
+    return opened2.sessionId;
   }
   /**
    * A vanished model id was just substituted for a same-family replacement
@@ -47644,7 +47847,7 @@ ${continuation}` : assembled;
 // apps/body/dist/corner-disk-recovery.js
 import { execFile as execFile18 } from "node:child_process";
 import { lstat as lstat8, readdir as readdir12, realpath as realpath3, rm as rm20 } from "node:fs/promises";
-import { basename as basename10, dirname as dirname28, join as join22, relative as relative3, resolve as resolve43, sep as sep3 } from "node:path";
+import { basename as basename10, dirname as dirname29, join as join22, relative as relative3, resolve as resolve43, sep as sep3 } from "node:path";
 import { promisify as promisify12 } from "node:util";
 var execFileAsync12 = promisify12(execFile18);
 var GENERATED_DIRS = /* @__PURE__ */ new Set([
@@ -47660,10 +47863,10 @@ var MAX_DIRECTORY_DEPTH = 4;
 var MAX_VISITED_DIRECTORIES = 5e3;
 function cornerRecoveryPointerPath(worktree) {
   const checkout = resolve43(worktree.path);
-  if (basename10(checkout) !== worktree.cornerId || basename10(dirname28(checkout)) !== "corners" || basename10(dirname28(dirname28(checkout))) !== "beeline" || !/^[a-zA-Z0-9-]{1,80}$/.test(worktree.cornerId)) {
+  if (basename10(checkout) !== worktree.cornerId || basename10(dirname29(checkout)) !== "corners" || basename10(dirname29(dirname29(checkout))) !== "beeline" || !/^[a-zA-Z0-9-]{1,80}$/.test(worktree.cornerId)) {
     throw new Error("refusing recovery pointer outside a Beeline corner checkout");
   }
-  return resolve43(dirname28(dirname28(checkout)), "recovery", "corners", `${worktree.cornerId}.json`);
+  return resolve43(dirname29(dirname29(checkout)), "recovery", "corners", `${worktree.cornerId}.json`);
 }
 async function git(checkout, args) {
   const result = await execFileAsync12("git", ["-C", checkout, ...args], {
@@ -48253,8 +48456,8 @@ async function materializeCornerWorktree(input) {
   const remote = roomCheckoutRemote(input.remote);
   const gitCommonDir = cornerRepositoryCacheDir(input.supervisorRoot, remote);
   const path = resolve44(input.supervisorRoot, "beeline", "corners", input.cornerId);
-  await mkdir30(dirname29(gitCommonDir), { recursive: true, mode: 448 });
-  await mkdir30(dirname29(path), { recursive: true, mode: 448 });
+  await mkdir30(dirname30(gitCommonDir), { recursive: true, mode: 448 });
+  await mkdir30(dirname30(path), { recursive: true, mode: 448 });
   const authEnv = githubGitEnv(input.token);
   if (!existsSync10(resolve44(gitCommonDir, "HEAD"))) {
     await execFileAsync13("git", ["clone", "--bare", remote, gitCommonDir], {
@@ -48358,7 +48561,7 @@ async function mapWithConcurrency(values, limit, visit) {
 async function discoverCornerWorktree(supervisorRoot2, cornerId) {
   const cornersRoot = resolve44(supervisorRoot2, "beeline", "corners");
   const path = resolve44(cornersRoot, cornerId);
-  if (dirname29(path) !== cornersRoot || !existsSync10(resolve44(path, ".git")))
+  if (dirname30(path) !== cornersRoot || !existsSync10(resolve44(path, ".git")))
     return void 0;
   const [canonicalRoot, canonicalPath] = await Promise.all([
     realpath4(cornersRoot),
@@ -48950,7 +49153,7 @@ var RoomRuntimeCoordinator = class {
     return this.runtime.rooms.find((room) => room.channelId === roomId);
   }
   roomRoot(roomId) {
-    return this.roomRecord(roomId)?.root ?? resolve44(dirname29(this.configPath), "rooms", roomId);
+    return this.roomRecord(roomId)?.root ?? resolve44(dirname30(this.configPath), "rooms", roomId);
   }
   roomAgentHomeRoot(workspaceRoot, required = false) {
     const flag = process.env.BUZZY_BODY_ROOM_HOME;
@@ -48960,7 +49163,7 @@ var RoomRuntimeCoordinator = class {
     if (!required && flag !== "1" && !existsSync10(home) && existsSync10(workspaceRoot))
       return void 0;
     try {
-      mkdirSync3(home, { recursive: true, mode: 448 });
+      mkdirSync4(home, { recursive: true, mode: 448 });
       return home;
     } catch (error) {
       console.error(`[thin-core] per-room agent home unavailable at ${home}:`, error);
@@ -48974,9 +49177,9 @@ var RoomRuntimeCoordinator = class {
       workspaceRoot,
       ...process.env.BEELINE_SHARED_ASSETS_ENABLED === "0" ? { agentSharedAssetRoot: void 0 } : { agentSharedAssetRoot: workspaceAssetRoot(this.runtime.supervisorRoot, this.runtime.communityId) },
       agentPrivateRoot: resolve44(workspaceRoot, "agent-private"),
-      agentMemoryRoot: resolve44(dirname29(this.configPath), "memory"),
-      openRouterRoutingCacheDir: openRouterRoutingCacheDir(dirname29(this.configPath)),
-      turnTraceDir: turnTraceDirectory(dirname29(this.configPath)),
+      agentMemoryRoot: resolve44(dirname30(this.configPath), "memory"),
+      openRouterRoutingCacheDir: openRouterRoutingCacheDir(dirname30(this.configPath)),
+      turnTraceDir: turnTraceDirectory(dirname30(this.configPath)),
       ...agentHomeRoot ? { agentHomeRoot } : {}
     };
   }
@@ -49058,7 +49261,7 @@ var RoomRuntimeCoordinator = class {
     const targetBranch = repository.targetBranch || "main";
     const checkoutId = createHash16("sha256").update(`${roomId}\0${remote}\0${targetBranch}`).digest("hex").slice(0, 24);
     const path = resolve44(this.runtime.supervisorRoot, "beeline", "room-checkouts", checkoutId);
-    await mkdir30(dirname29(path), { recursive: true, mode: 448 });
+    await mkdir30(dirname30(path), { recursive: true, mode: 448 });
     const token = remote.startsWith("https://github.com/") ? await this.parentRepositoryToken(roomId) : void 0;
     const env = token ? githubGitEnv(token.token) : process.env;
     if (!existsSync10(resolve44(path, ".git"))) {
@@ -49632,7 +49835,7 @@ var RoomRuntimeCoordinator = class {
   async cleanupArchivedCornerLocalState(cornerId, knownArchive) {
     if (this.running.has(cornerId) || this.startingCorners.has(cornerId))
       return false;
-    const root = resolve44(dirname29(this.configPath), "rooms", cornerId);
+    const root = resolve44(dirname30(this.configPath), "rooms", cornerId);
     if (this.roomRoot(cornerId) !== root || !/^[a-zA-Z0-9-]{1,80}$/.test(cornerId))
       return false;
     const info = await lstat9(root).catch(() => void 0);
@@ -49663,7 +49866,7 @@ var RoomRuntimeCoordinator = class {
    * checkout has already gone; a scratch directory identifies legacy chat
    * corners. Active scratch gets a 14-day file TTL, never a wholesale reap. */
   async sweepCornerLocalState(archived, desired) {
-    const root = resolve44(dirname29(this.configPath), "rooms");
+    const root = resolve44(dirname30(this.configPath), "rooms");
     const due = this.now() - this.lastCornerScratchSweepAt >= 6 * 60 * 6e4;
     if (due)
       this.lastCornerScratchSweepAt = this.now();
@@ -49969,7 +50172,7 @@ var ThinDaemonCore = class {
 };
 
 // apps/body/dist/force-update-journal.js
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync11, renameSync as renameSync2, writeFileSync as writeFileSync5 } from "node:fs";
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync11, renameSync as renameSync2, writeFileSync as writeFileSync5 } from "node:fs";
 import { resolve as resolve45 } from "node:path";
 var NAME = "force-update-interruptions.json";
 function pathFor(runtimeDir) {
@@ -49995,7 +50198,7 @@ function read(runtimeDir) {
   }
 }
 function write(runtimeDir, rows) {
-  mkdirSync4(runtimeDir, { recursive: true, mode: 448 });
+  mkdirSync5(runtimeDir, { recursive: true, mode: 448 });
   const target = pathFor(runtimeDir);
   const temporary = `${target}.${process.pid}.tmp`;
   writeFileSync5(temporary, `${JSON.stringify(rows)}
@@ -50051,7 +50254,7 @@ function staleGeneration(error) {
 init_launchd();
 init_systemd();
 import { mkdir as mkdir31, rename as rename13 } from "node:fs/promises";
-import { dirname as dirname30, resolve as resolve46 } from "node:path";
+import { dirname as dirname31, resolve as resolve46 } from "node:path";
 async function retireRemovedAgent(runtime, options = {}) {
   const deletedRoot = resolve46(runtime.supervisorRoot, "beeline", "deleted-runtimes");
   const target = resolve46(deletedRoot, `${runtime.agent.publicKey}-${Date.now()}`);
@@ -50074,7 +50277,7 @@ async function relocateAgentRuntime(runtime, target, options = {}) {
       ...options.run ? { run: options.run } : {}
     });
   }
-  await mkdir31(dirname30(destination), { recursive: true, mode: 448 });
+  await mkdir31(dirname31(destination), { recursive: true, mode: 448 });
   await rename13(source, destination);
   return destination;
 }
@@ -50200,7 +50403,7 @@ function runScratchSweepLogged(runtimeDir) {
   void runScratchSweep(runtimeDir).catch((error) => console.error("[body] scratch sweep failed:", error));
 }
 async function runAgentRuntime(configPath, host, signal) {
-  const runtimeDir = dirname31(configPath);
+  const runtimeDir = dirname32(configPath);
   await convergeRuntimeRecordFileModes(configPath);
   const accessMigration = await migrateRuntimeRecordAccessPolicy(configPath);
   let runtime = accessMigration.runtime;
@@ -50314,6 +50517,7 @@ async function runAgentRuntime(configPath, host, signal) {
   let connectorLoop;
   let agentSignIn;
   let registryMcpBroker;
+  let browserShareHost;
   let catalogRefresh;
   let leaveHost;
   const refreshCatalog = () => {
@@ -50352,6 +50556,9 @@ async function runAgentRuntime(configPath, host, signal) {
     );
     await registryMcpBroker.start();
     config.registryMcpBrokerSocket = registryMcpBroker.socketPath;
+    browserShareHost = new BrowserShareHost(join23(process.env.XDG_STATE_HOME ?? config.operatorHome ?? homedir19(), ".bs", `${process.pid}-${agentId.slice(0, 8)}.sock`));
+    await browserShareHost.start();
+    config.browserShareHostSocket = browserShareHost.socketPath;
     let lifecycleRestart;
     const core = new ThinDaemonCore(runtime, configPath, config, {
       daemonApi,
@@ -50525,6 +50732,7 @@ async function runAgentRuntime(configPath, host, signal) {
     connectorLoop?.stop();
     agentSignIn?.stop();
     await registryMcpBroker?.stop();
+    await browserShareHost?.stop();
     daemonApi.closeLive();
     await clearDaemonPidRecordIfPid(configPath, process.pid);
   }
@@ -50736,7 +50944,7 @@ async function runMachineHelper(options = {}) {
     const settle = await settleUpdateAttemptOnStart(layout);
     if (settle.kind === "rolled-back") {
       for (const path of await hostedRuntimes())
-        await queueUpdateRollbackAlert(dirname32(path), settle.record.releaseId);
+        await queueUpdateRollbackAlert(dirname33(path), settle.record.releaseId);
       console.error(`[helper] self-update ROLLED BACK: bundle ${describeIdentity(settle.record.to)} never confirmed healthy; restored ${settle.record.previousReleaseId ?? "previous release"}`);
       return finish(await standDownForRollback());
     }
@@ -50778,7 +50986,7 @@ async function runMachineHelper(options = {}) {
           since: new Date(slot.since).toISOString()
         }]))
       };
-      await mkdir32(dirname32(path), { recursive: true, mode: 448 });
+      await mkdir32(dirname33(path), { recursive: true, mode: 448 });
       const staged = `${path}.${process.pid}.tmp`;
       await writeFile24(staged, `${JSON.stringify(body, null, 2)}
 `, { mode: 384 });
@@ -50942,7 +51150,7 @@ async function runMachineHelper(options = {}) {
         reason = await runAgent(slot.configPath, host, slot.controller.signal);
       } catch (error) {
         console.error(`[helper] agent ${slot.agentId} failed:`, error);
-        const failure = await settleDaemonStartFailure(dirname32(slot.configPath), error).catch(() => ({ distressed: false }));
+        const failure = await settleDaemonStartFailure(dirname33(slot.configPath), error).catch(() => ({ distressed: false }));
         if (failure.distressed) {
           console.error(`[helper] agent ${slot.agentId} failed to start ${failure.count} times; it stays stopped. operator record: ${failure.path}`);
           reason = "distress";
@@ -50991,7 +51199,7 @@ async function runMachineHelper(options = {}) {
     const runtime = await readRuntimeRecord(configPath).catch(() => void 0);
     const slot = existing ?? {
       configPath,
-      agentId: runtime?.agent.publicKey ?? dirname32(configPath).split("/").at(-1),
+      agentId: runtime?.agent.publicKey ?? dirname33(configPath).split("/").at(-1),
       controller: new AbortController(),
       state: "starting",
       status: "",
@@ -51096,7 +51304,7 @@ async function waitForPreviousHolder(configPath, signal) {
       return;
     if (!announced) {
       announced = true;
-      console.log(`[helper] waiting for process ${pid} to let go of ${dirname32(configPath)}`);
+      console.log(`[helper] waiting for process ${pid} to let go of ${dirname33(configPath)}`);
     }
     const waited = Date.now() - startedAt;
     if (waited >= PREVIOUS_HOLDER_WAIT_MS && !asked) {
@@ -51131,7 +51339,7 @@ function sleep3(ms, signal) {
 import { execFileSync, spawn as spawn15 } from "node:child_process";
 import { randomUUID as randomUUID15 } from "node:crypto";
 import { cp as cp2, mkdir as mkdir33, open as open6, readFile as readFile35, rm as rm23, stat as stat13, writeFile as writeFile25 } from "node:fs/promises";
-import { createServer as createServer4 } from "node:net";
+import { createServer as createServer5 } from "node:net";
 import { existsSync as existsSync11 } from "node:fs";
 import { resolve as resolve52 } from "node:path";
 var FIRST_PORT = 5554;
@@ -51157,7 +51365,7 @@ async function processStart(pid) {
 }
 async function portFree(port) {
   return new Promise((done) => {
-    const server = createServer4();
+    const server = createServer5();
     server.once("error", () => done(false));
     server.listen(port, "127.0.0.1", () => server.close(() => done(true)));
   });
@@ -51461,7 +51669,7 @@ async function main() {
     if (!agentPubkey)
       throw new Error("stop requires --agent <pubkey>");
     const configs = await findAgentRuntimeConfigPaths(process.env, process.cwd());
-    const configPath = configs.find((candidate) => dirname33(candidate).endsWith(agentPubkey));
+    const configPath = configs.find((candidate) => dirname34(candidate).endsWith(agentPubkey));
     if (!configPath)
       throw new Error(`no stored runtime found for agent ${agentPubkey}`);
     const runtime = await readRuntimeRecord(configPath);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "usebeeline",
-  "version": "0.1.27",
+  "version": "0.1.28",
   "description": "Connect an AI coding agent to Beeline with one command.",
   "homepage": "https://usebeeline.app",
   "bugs": {