commit e35bad522fbba01088f233837a5c7c59ad2e8cb4
Author: daniel wang <danielwang@supermicro.com>
Date:   Thu Sep 3 12:46:14 2026 +0000

    fix etc config yaml

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..520d968
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,6 @@
+.git
+target
+data
+reference
+**/*.md
+apps/web/node_modules
diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..faa8f20
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,10 @@
+XAI_API_KEY=
+SANDBOX_SUPERVISOR_TOKEN=dev-token
+SANDBOX_PROVIDER=docker
+DATABASE_URL=postgres://lazyboy:lazyboy@127.0.0.1:5434/lazyboy
+DATA_DIR=./data
+API_BIND=0.0.0.0:3101
+SANDBOX_SUPERVISOR_URL=http://127.0.0.1:7092
+LAZYBOY_COMPUTER_MEMORY_MB=2048
+LAZYBOY_COMPUTER_CPUS=2
+LAZYBOY_COMPUTER_PIDS=2048
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..b615746
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,10 @@
+/target
+**/*.rs.bk
+.env
+.env.*
+!.env.example
+/data
+image/computer/lazyboy-controld
+node_modules
+dist
+.DS_Store
diff --git a/Cargo.lock b/Cargo.lock
new file mode 100644
index 0000000..451d4b4
--- /dev/null
+++ b/Cargo.lock
@@ -0,0 +1,3982 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c982642fa9e8606056828ee9a8505737230110bb1099153c79efe865c59d12ba"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "allocator-api2"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae221649c9976a6f6c56ae1facf410f3ddb33cc661c4b7b61020a912d4237fbc"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "as-any"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b0f477b951e452a0b6b4a10b53ccd569042d1d01729b519e02074a9c0958a063"
+
+[[package]]
+name = "async-stream"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b5a71a6f37880a80d1d7f19efd781e4b5de42c88f0722cc13bcb6cc2cfe8476"
+dependencies = [
+ "async-stream-impl",
+ "futures-core",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-stream-impl"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7c24de15d275a1ecfd47a380fb4d5ec9bfe0933f309ed5e705b775596a3574d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "async-trait"
+version = "0.1.92"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.4",
+]
+
+[[package]]
+name = "atoi"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f28d99ec8bfea296261ca1af174f24225171fea9664ba9003cbebee704810528"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+[[package]]
+name = "autocfg"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
+
+[[package]]
+name = "aws-lc-rs"
+version = "1.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b281d307588d634de920874890732659e2e7672f72b5e10e81badc1a8a83621e"
+dependencies = [
+ "aws-lc-sys",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-lc-sys"
+version = "0.45.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9bff6c3b54fad79a2e60b8102caf565819711497c1f5f092f49508e2f5c31b27"
+dependencies = [
+ "cc",
+ "cmake",
+ "dunce",
+ "fs_extra",
+ "pkg-config",
+]
+
+[[package]]
+name = "axum"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "31b698c5f9a010f6573133b09e0de5408834d0c82f8d7475a89fc1867a71cd90"
+dependencies = [
+ "axum-core",
+ "base64",
+ "bytes",
+ "form_urlencoded",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "itoa",
+ "matchit",
+ "memchr",
+ "mime",
+ "percent-encoding",
+ "pin-project-lite",
+ "serde_core",
+ "serde_json",
+ "serde_path_to_error",
+ "serde_urlencoded",
+ "sha1",
+ "sync_wrapper",
+ "tokio",
+ "tokio-tungstenite 0.29.0",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "axum-core"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08c78f31d7b1291f7ee735c1c6780ccde7785daae9a9206026862dab7d8792d1"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "http-body-util",
+ "mime",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "base64ct"
+version = "1.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bitflags"
+version = "2.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "bollard"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97ccca1260af6a459d75994ad5acc1651bcabcbdbc41467cc9786519ab854c30"
+dependencies = [
+ "base64",
+ "bollard-stubs",
+ "bytes",
+ "futures-core",
+ "futures-util",
+ "hex",
+ "http",
+ "http-body-util",
+ "hyper",
+ "hyper-named-pipe",
+ "hyper-util",
+ "hyperlocal",
+ "log",
+ "pin-project-lite",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "serde_repr",
+ "serde_urlencoded",
+ "thiserror",
+ "tokio",
+ "tokio-util",
+ "tower-service",
+ "url",
+ "winapi",
+]
+
+[[package]]
+name = "bollard-stubs"
+version = "1.47.1-rc.27.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f179cfbddb6e77a5472703d4b30436bff32929c0aa8a9008ecf23d1d3cdd0da"
+dependencies = [
+ "serde",
+ "serde_repr",
+ "serde_with",
+]
+
+[[package]]
+name = "bs58"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf88ba1141d185c399bee5288d850d63b8369520c1eafc32a0430b5b6c287bf4"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
+
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
+[[package]]
+name = "bytes"
+version = "1.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
+
+[[package]]
+name = "cc"
+version = "1.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ad534f4357a5264cce5019c989cf66a4f0dc4e0d1b1d15f8aacec0ff7360273"
+dependencies = [
+ "find-msvc-tools",
+ "jobserver",
+ "libc",
+ "shlex",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "cfg_aliases"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
+
+[[package]]
+name = "chacha20"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.1",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "chrono"
+version = "0.4.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
+dependencies = [
+ "iana-time-zone",
+ "num-traits",
+ "serde",
+ "windows-link",
+]
+
+[[package]]
+name = "cmake"
+version = "0.1.58"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0f78a02292a74a88ac736019ab962ece0bc380e3f977bf72e376c5d78ff0678"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "combine"
+version = "4.6.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfc320937d09e6de266b31b9afb480f197d7a861be86be7cb2ea7e5d1bfffc5e"
+dependencies = [
+ "bytes",
+ "memchr",
+]
+
+[[package]]
+name = "const-oid"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
+
+[[package]]
+name = "convert_case"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "affbf0190ed2caf063e3def54ff444b449371d55c58e513a95ab98eca50adb49"
+dependencies = [
+ "unicode-segmentation",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "cpufeatures"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ca28b0ae3115b884660db4118d803791fd6756b6e88f39c0f3f7859060d7566"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crc"
+version = "3.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5eb8a2a1cd12ab0d987a5d5e825195d372001a4094a0376319d5a0ad71c1ba0d"
+dependencies = [
+ "crc-catalog",
+]
+
+[[package]]
+name = "crc-catalog"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "217698eaf96b4a3f0bc4f3662aaa55bdf913cd54d7204591faa790070c6d0853"
+
+[[package]]
+name = "crossbeam-queue"
+version = "0.3.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "803d13fb3b09d88be9f4dbc29062c66b19bf7170867ceb746d2a8689bf6c7a26"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61803da095bee82a81bb1a452ecc25d3b2f1416d1897eb86430c6159ef717c17"
+
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
+name = "data-encoding"
+version = "2.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4583a4551df46e2792f82ceeac45e850d2e2d5debba0b91f102385cda5b11f06"
+
+[[package]]
+name = "defmt"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2953bfe4f93bbd20cc71198842756f77d161884c99ebbabc41d80231ded88d1"
+dependencies = [
+ "bitflags 1.3.2",
+ "defmt-macros",
+]
+
+[[package]]
+name = "defmt-macros"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bad9c72e7ca2137e0dc3813245a0d282fd6daad32fd800af018306a9169b5fe8"
+dependencies = [
+ "defmt-parser",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "defmt-parser"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10d60334b3b2e7c9d91ef8150abfb6fa4c1c39ebbcf4a81c2e346aad939fee3e"
+dependencies = [
+ "thiserror",
+]
+
+[[package]]
+name = "der"
+version = "0.7.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
+dependencies = [
+ "const-oid",
+ "pem-rfc7468",
+ "zeroize",
+]
+
+[[package]]
+name = "deranged"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "const-oid",
+ "crypto-common",
+ "subtle",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.4",
+]
+
+[[package]]
+name = "dotenvy"
+version = "0.15.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aaf95b3e5c8f23aa320147307562d361db0ae0d51242340f558153b4eb2439b"
+
+[[package]]
+name = "dunce"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
+
+[[package]]
+name = "dyn-clone"
+version = "1.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
+
+[[package]]
+name = "either"
+version = "1.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "252afb9ae5eaa683babdc6a068b3f5726eb19e05070c731f9b2a23a7c3e8ed34"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "encoding_rs"
+version = "0.8.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "etcetera"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "136d1b5283a1ab77bd9257427ffd09d8667ced0570b6f938942bc7568ed5b943"
+dependencies = [
+ "cfg-if",
+ "home",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "event-listener"
+version = "5.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a23add41df1562121a9393cb065eab5146a1242410f23a644851e90cfd669d2"
+dependencies = [
+ "parking",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "eventsource-stream"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "74fef4569247a5f429d9156b9d0a2599914385dd189c539334c625d8099d90ab"
+dependencies = [
+ "futures-core",
+ "nom",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "fastrand"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d45db016d36b838f563236e9193d0ee6ce38f3f68b6c94e914b4929c96bbb890"
+
+[[package]]
+name = "flume"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da0e4dd2a88388a1f4ccc7c9ce104604dab68d9f408dc34cd45823d5a9069095"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+ "spin",
+]
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "foldhash"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "fs_extra"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
+
+[[package]]
+name = "futures"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a31d2a3fbaaeb2af2368bbdd904aa8e812d3c04a1ee10d3171f52d556e5d0a3"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1f9e3d69d39e4862ffed03ed071a76f9a13ba1d9109d355b0f0aa6b15e393c4"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92d699e522242e69e3003b94ecc1f960f3a5e015aa7c5d7486e65ad01dd94f5e"
+
+[[package]]
+name = "futures-executor"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "031b47cf1a3c6cc8bc2fc76cd437f521619387907d469316e7c0bc278f1f5432"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-intrusive"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d930c203dd0b6ff06e0201a4a2fe9149b43c684fd4420555b26d21b1a02956f"
+dependencies = [
+ "futures-core",
+ "lock_api",
+ "parking_lot",
+]
+
+[[package]]
+name = "futures-io"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53c0fa8157de1303bfffdaa1cc2a673bfffb60102f76b0ef4441659124373fed"
+
+[[package]]
+name = "futures-macro"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9fb9654ba8355388abeb8dcb4fc62f511300867002afc858860463bdd9fe0c44"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.4",
+]
+
+[[package]]
+name = "futures-sink"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1944426bf7d03f1d14f708785e4b33efd750b36d48a157b836b3efc15ede8e1d"
+
+[[package]]
+name = "futures-task"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd417de3d1d015fc3bfd2b1ea46dfc7bab72ef86f1cc7cc9c78e728b34a6d1fd"
+
+[[package]]
+name = "futures-timer"
+version = "3.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af43fadb8a98512d547e37b4e92e0ced13e205c061b87b4623eff01d918d6968"
+dependencies = [
+ "gloo-timers",
+ "send_wrapper",
+]
+
+[[package]]
+name = "futures-util"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d50a92467f8ba5dd6e3ee5d4bd04d73ab2e4e1c44474a0674821dfce14b79bc"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-macro",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "wasi",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 5.3.0",
+ "wasip2",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "r-efi 6.0.0",
+ "rand_core 0.10.1",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "glob"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e4eba85ea1d0a966a983acd07deee566e67395d2d96b6fb39e62b5a833f1eb0b"
+
+[[package]]
+name = "gloo-timers"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "482ce8a491a501da4cd806bd190275363d674f2845005c6ddbd5d3e1dd54495d"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "h2"
+version = "0.4.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef8e5e5a340588f4452631496976cf8636d4a7ecf600239fdc27615d2530bc16"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "http",
+ "indexmap 2.14.1",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+
+[[package]]
+name = "hashbrown"
+version = "0.15.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
+dependencies = [
+ "allocator-api2",
+ "equivalent",
+ "foldhash",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+
+[[package]]
+name = "hashlink"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7382cf6263419f2d8df38c55d7da83da5c18aef87fc7a7fc1fb1e344edfe14c1"
+dependencies = [
+ "hashbrown 0.15.5",
+]
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "hkdf"
+version = "0.12.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
+dependencies = [
+ "hmac",
+]
+
+[[package]]
+name = "hmac"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+dependencies = [
+ "digest",
+]
+
+[[package]]
+name = "home"
+version = "0.5.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc627f471c528ff0c4a49e1d5e60450c8f6461dd6d10ba9dcd3a61d3dff7728d"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "http"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "918d3568bebf352712bc2ef3d46a8bcf1a75b373be6539de198e9105cbbf9ce0"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca2a8f2913ee65f60facd6a5905613afaa448497a0230cc41ce022d93290bc2c"
+dependencies = [
+ "bytes",
+ "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23169fe34a5fbcdd3f3862e78fb9b6fccd5f02a6dc6f732547005d45631ce71c"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "http-range-header"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9171a2ea8a68358193d15dd5d70c1c10a2afc3e7e4c5bc92bc9f025cebd7359c"
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
+[[package]]
+name = "httpdate"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
+
+[[package]]
+name = "hyper"
+version = "1.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27b501faa50e7a26c3d3560ca625132f4078a17771f4810baf70475ae48cbe43"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "h2",
+ "http",
+ "http-body",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "smallvec",
+ "tokio",
+ "want",
+]
+
+[[package]]
+name = "hyper-named-pipe"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fab3637d6b04a8037af8a266fdf6cf92ea957e8c53981a2bf6136572531025bf"
+dependencies = [
+ "hex",
+ "hyper",
+ "hyper-util",
+ "pin-project-lite",
+ "tokio",
+ "tower-service",
+]
+
+[[package]]
+name = "hyper-rustls"
+version = "0.27.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
+dependencies = [
+ "http",
+ "hyper",
+ "hyper-util",
+ "rustls",
+ "tokio",
+ "tokio-rustls",
+ "tower-service",
+ "webpki-roots 1.0.9",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
+dependencies = [
+ "base64",
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "http",
+ "http-body",
+ "hyper",
+ "ipnet",
+ "libc",
+ "percent-encoding",
+ "pin-project-lite",
+ "socket2",
+ "system-configuration",
+ "tokio",
+ "tower-service",
+ "tracing",
+ "windows-registry",
+]
+
+[[package]]
+name = "hyperlocal"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "986c5ce3b994526b3cd75578e62554abd09f0899d6206de48b3e96ab34ccc8c7"
+dependencies = [
+ "hex",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "pin-project-lite",
+ "tokio",
+ "tower-service",
+]
+
+[[package]]
+name = "iana-time-zone"
+version = "0.1.65"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "log",
+ "wasm-bindgen",
+ "windows-core",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "icu_collections"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa68d21081c4a05d5a901a1c62add574c77048b6a1c67be3b50ce0b60d4ca513"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "utf8_iter",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d56e28588da92eee5c3201a6eff33fabdd49b62269c8938d4ff050ce4d900deb"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12f9cf5f235641ed274641dd81c3f28d870e276763d0797aeeab72317b1c646f"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1563da1ed3e0b3bf3d74c9b85917ac9c56464d2f57242270c09c9e752f8021a0"
+
+[[package]]
+name = "icu_properties"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e7ca276ad3145661a65914e6daf131ca5120cd3dcee8f8f3214b8875184a148"
+dependencies = [
+ "displaydoc",
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e590f038c1464a96894fd6d10127e90a8be4509f56ff7ecef851b15cee0b7caa"
+
+[[package]]
+name = "icu_provider"
+version = "2.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d27bbb9d3abbefac45d55f647c9de1d44aafcd1186eb91879afef17c396c3e73"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
+[[package]]
+name = "indexmap"
+version = "1.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
+dependencies = [
+ "autocfg",
+ "hashbrown 0.12.3",
+ "serde",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.14.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07aa2048142242915a31d35844fb311e0e53fcca590c3a0a40dcf1b841fa09eb"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.17.1",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "ipnet"
+version = "2.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a756c3fac73139e83f14c2d742155dd2b78d3ee56597b419a0579b7bdd6dd78"
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "jiff"
+version = "0.2.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "668b7183bd07af9a4885f5c35b0cc5c83c4607a913c16b7e17291832910d2dcc"
+dependencies = [
+ "defmt",
+ "jiff-core",
+ "jiff-static",
+ "jiff-tzdb-platform",
+ "log",
+ "portable-atomic",
+ "portable-atomic-util",
+ "serde_core",
+ "windows-link",
+]
+
+[[package]]
+name = "jiff-core"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7feca88439efe53da3754500c1851dedf3cb36c524dd5cf8225cc0794de95d09"
+dependencies = [
+ "defmt",
+]
+
+[[package]]
+name = "jiff-static"
+version = "0.2.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a69dcb3a21cfb32ce1cd056169337ca284af0766dd766e7878819b251a49204"
+dependencies = [
+ "jiff-core",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "jiff-tzdb"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "142bd39932ad231f10513df9ab62661fead8719872150b7ad02a2df79f4e141e"
+
+[[package]]
+name = "jiff-tzdb-platform"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "875a5a69ac2bab1a891711cf5eccbec1ce0341ea805560dcd90b7a2e925132e8"
+dependencies = [
+ "jiff-tzdb",
+]
+
+[[package]]
+name = "jni"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5efd9a482cf3a427f00d6b35f14332adc7902ce91efb778580e180ff90fa3498"
+dependencies = [
+ "cfg-if",
+ "combine",
+ "jni-macros",
+ "jni-sys",
+ "log",
+ "simd_cesu8",
+ "thiserror",
+ "walkdir",
+ "windows-link",
+]
+
+[[package]]
+name = "jni-macros"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a00109accc170f0bdb141fed3e393c565b6f5e072365c3bd58f5b062591560a3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "rustc_version",
+ "simd_cesu8",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "jni-sys"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6377a88cb3910bee9b0fa88d4f42e1d2da8e79915598f65fb0c7ee14c878af2"
+dependencies = [
+ "jni-sys-macros",
+]
+
+[[package]]
+name = "jni-sys-macros"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38c0b942f458fe50cdac086d2f946512305e5631e720728f2a61aabcd47a6264"
+dependencies = [
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "jobserver"
+version = "0.1.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c00acbd29eabad4a2392fa0e921c874934dbbf4194312ad20f04a0ed67a3cb3"
+dependencies = [
+ "getrandom 0.4.3",
+ "libc",
+]
+
+[[package]]
+name = "js-sys"
+version = "0.3.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e0c1080212aad755ea003d18543e8768dd432c48819efd73a7bf1e39b7a5a3a"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+dependencies = [
+ "spin",
+]
+
+[[package]]
+name = "lazyboy-api"
+version = "0.1.0"
+dependencies = [
+ "async-trait",
+ "axum",
+ "base64",
+ "chrono",
+ "dotenvy",
+ "futures-util",
+ "hex",
+ "hmac",
+ "http-body-util",
+ "lazyboy-contracts",
+ "lazyboy-control",
+ "lazyboy-harness",
+ "lazyboy-sandbox",
+ "reqwest 0.12.28",
+ "rig-core",
+ "serde",
+ "serde_json",
+ "sha2",
+ "sqlx",
+ "thiserror",
+ "tokio",
+ "tokio-tungstenite 0.26.2",
+ "tower-http",
+ "tracing",
+ "tracing-subscriber",
+ "uuid",
+]
+
+[[package]]
+name = "lazyboy-contracts"
+version = "0.1.0"
+dependencies = [
+ "base64",
+ "chrono",
+ "serde",
+ "serde_json",
+ "thiserror",
+]
+
+[[package]]
+name = "lazyboy-control"
+version = "0.1.0"
+dependencies = [
+ "async-trait",
+ "chrono",
+ "hex",
+ "lazyboy-contracts",
+ "serde",
+ "serde_json",
+ "sha2",
+ "thiserror",
+]
+
+[[package]]
+name = "lazyboy-controld"
+version = "0.1.0"
+dependencies = [
+ "axum",
+ "base64",
+ "lazyboy-contracts",
+ "lazyboy-control",
+ "serde",
+ "serde_json",
+ "thiserror",
+ "tokio",
+ "tracing",
+ "tracing-subscriber",
+]
+
+[[package]]
+name = "lazyboy-harness"
+version = "0.1.0"
+dependencies = [
+ "lazyboy-contracts",
+ "rig-core",
+ "serde",
+ "thiserror",
+]
+
+[[package]]
+name = "lazyboy-sandbox"
+version = "0.1.0"
+dependencies = [
+ "async-trait",
+ "base64",
+ "chrono",
+ "hex",
+ "lazyboy-contracts",
+ "lazyboy-control",
+ "reqwest 0.12.28",
+ "serde",
+ "serde_json",
+ "sha2",
+ "tokio",
+]
+
+[[package]]
+name = "lazyboy-supervisor"
+version = "0.1.0"
+dependencies = [
+ "async-trait",
+ "axum",
+ "base64",
+ "bollard",
+ "futures-util",
+ "lazyboy-contracts",
+ "lazyboy-control",
+ "reqwest 0.12.28",
+ "serde",
+ "serde_json",
+ "thiserror",
+ "tokio",
+ "tracing",
+ "tracing-subscriber",
+ "uuid",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.189"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
+
+[[package]]
+name = "libm"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
+
+[[package]]
+name = "libredox"
+version = "0.1.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d8f1ea3f21fd3405dcaf6c9b5c1630af9afc422d9073ea39c5f6d6c772e08ed"
+dependencies = [
+ "bitflags 2.13.1",
+ "libc",
+ "plain",
+ "redox_syscall 0.9.3",
+]
+
+[[package]]
+name = "libsqlite3-sys"
+version = "0.30.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e99fb7a497b1e3339bc746195567ed8d3e24945ecd636e3619d20b9de9e9149"
+dependencies = [
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "litemap"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae"
+
+[[package]]
+name = "lock_api"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "224399e74b87b5f3557511d98dff8b14089b3dadafcab6bb93eab67d3aace965"
+dependencies = [
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
+
+[[package]]
+name = "lru-slab"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
+
+[[package]]
+name = "matchers"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1525a2a28c7f4fa0fc98bb91ae755d1e2d1505079e05539e35bc876b5d65ae9"
+dependencies = [
+ "regex-automata",
+]
+
+[[package]]
+name = "matchit"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
+
+[[package]]
+name = "md-5"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d89e7ee0cfbedfc4da3340218492196241d89eefb6dab27de5df917a6d2e78cf"
+dependencies = [
+ "cfg-if",
+ "digest",
+]
+
+[[package]]
+name = "memchr"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
+
+[[package]]
+name = "mime"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
+
+[[package]]
+name = "mime_guess"
+version = "2.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f7c44f8e672c00fe5308fa235f821cb4198414e1c77935c1ab6948d3fd78550e"
+dependencies = [
+ "mime",
+ "unicase",
+]
+
+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
+[[package]]
+name = "mio"
+version = "1.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b18443e9c262bfe8fa82f51666e2642c53393f7e5c27b3e1aeab922cff5b9d8"
+dependencies = [
+ "libc",
+ "wasi",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
+[[package]]
+name = "nu-ansi-term"
+version = "0.50.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "num-bigint-dig"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e661dda6640fad38e827a6d4a310ff4763082116fe217f279885c97f511bb0b7"
+dependencies = [
+ "lazy_static",
+ "libm",
+ "num-integer",
+ "num-iter",
+ "num-traits",
+ "rand 0.8.8",
+ "smallvec",
+ "zeroize",
+]
+
+[[package]]
+name = "num-conv"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
+
+[[package]]
+name = "num-integer"
+version = "0.1.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ce2d95d4b3734dc35aa2f45e1aa22cd416814592a4f9d9205e11affd5b8e10b"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-iter"
+version = "0.1.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c92800bd69a1eac91786bcfe9da64a897eb72911b8dc3095decbd07429e8048b"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+ "libm",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "openssl-probe"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
+
+[[package]]
+name = "ordered-float"
+version = "5.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8c7c9e0d9b23589f26070720bac724174bfec1083e82f7854cdd0267518343c0"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "parking"
+version = "2.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba"
+
+[[package]]
+name = "parking_lot"
+version = "0.12.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
+dependencies = [
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall 0.5.18",
+ "smallvec",
+ "windows-link",
+]
+
+[[package]]
+name = "pem-rfc7468"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88b39c9bfcfc231068454382784bb460aae594343fb030d46e9f50a645418412"
+dependencies = [
+ "base64ct",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "pin-project"
+version = "1.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2466b2336ed02bcdca6b294417127b90ec92038d1d5c4fbeac971a922e0e0924"
+dependencies = [
+ "pin-project-internal",
+]
+
+[[package]]
+name = "pin-project-internal"
+version = "1.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c96395f0a926bc13b1c17622aaddda1ecb55d49c8f1bf9777e4d877800a43f8b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
+[[package]]
+name = "pkcs1"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f"
+dependencies = [
+ "der",
+ "pkcs8",
+ "spki",
+]
+
+[[package]]
+name = "pkcs8"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
+dependencies = [
+ "der",
+ "spki",
+]
+
+[[package]]
+name = "pkg-config"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"
+
+[[package]]
+name = "plain"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
+
+[[package]]
+name = "portable-atomic"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05c8b63e8d9609db387f0324918f81d68fe27748f084ef092fb35954d0539a85"
+
+[[package]]
+name = "portable-atomic-util"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a106d1259c23fac8e543272398ae0e3c0b8d33c88ed73d0cc71b0f1d902618"
+dependencies = [
+ "portable-atomic",
+]
+
+[[package]]
+name = "potential_utf"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661"
+dependencies = [
+ "zerovec",
+]
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
+dependencies = [
+ "zerocopy",
+]
+
+[[package]]
+name = "proc-macro-crate"
+version = "3.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
+dependencies = [
+ "toml_edit",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quinn"
+version = "0.11.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c1a41e437b6bbd489372cd4971de128e85c855f56c57f283d20ff016cf7c0a8"
+dependencies = [
+ "bytes",
+ "cfg_aliases",
+ "pin-project-lite",
+ "quinn-proto",
+ "quinn-udp",
+ "rustc-hash",
+ "rustls",
+ "socket2",
+ "thiserror",
+ "tokio",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-proto"
+version = "0.11.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04759210543be93709136e28212294a659ef5001836ff4eab4d663e4529bba83"
+dependencies = [
+ "aws-lc-rs",
+ "bytes",
+ "getrandom 0.4.3",
+ "lru-slab",
+ "rand 0.10.2",
+ "rand_pcg",
+ "ring",
+ "rustc-hash",
+ "rustls",
+ "rustls-pki-types",
+ "slab",
+ "thiserror",
+ "tinyvec",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-udp"
+version = "0.5.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35a133f956daabe89a61a685c2649f13d82d5aa4bd5d12d1277e1072a21c0694"
+dependencies = [
+ "cfg_aliases",
+ "libc",
+ "once_cell",
+ "socket2",
+ "tracing",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "rand"
+version = "0.8.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e058c7de0b26af77780c769414d6257830bb240f3c38477dbc2c16e5f54d6d4c"
+dependencies = [
+ "libc",
+ "rand_chacha 0.3.1",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9ef1d0d795eb7d84685bca4f72f3649f064e6641543d3a8c415898726a57b41"
+dependencies = [
+ "rand_chacha 0.9.0",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
+dependencies = [
+ "chacha20",
+ "getrandom 0.4.3",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom 0.2.17",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
+dependencies = [
+ "getrandom 0.3.4",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
+
+[[package]]
+name = "rand_pcg"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "caa0f4137e1c0a72f4c651489402276c8e8e1cf081f3b0ba156d2cbeef09e86a"
+dependencies = [
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.5.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
+dependencies = [
+ "bitflags 2.13.1",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d678d17679829e73d371e96880897e98fee2ded7acc0a50bdf8af2affa4b2fe5"
+dependencies = [
+ "bitflags 2.13.1",
+]
+
+[[package]]
+name = "ref-cast"
+version = "1.0.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e440fb4e4b4147295338efb76001ab9e4efc0e5839df2c47fc5ac2381d365c3"
+dependencies = [
+ "ref-cast-impl",
+]
+
+[[package]]
+name = "ref-cast-impl"
+version = "1.0.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92ecd8964f8453721699a1ed72037b0db49ce2f5a5138486ee89bed6f67cdf3a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.4",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ad8553b9b26413251cbf30e620595c7a41b3887f03da04579c0e6b0d6a06b4b2"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
+
+[[package]]
+name = "reqwest"
+version = "0.12.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
+dependencies = [
+ "base64",
+ "bytes",
+ "futures-core",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-rustls",
+ "hyper-util",
+ "js-sys",
+ "log",
+ "percent-encoding",
+ "pin-project-lite",
+ "quinn",
+ "rustls",
+ "rustls-pki-types",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "sync_wrapper",
+ "tokio",
+ "tokio-rustls",
+ "tokio-util",
+ "tower",
+ "tower-http",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "wasm-streams 0.4.2",
+ "web-sys",
+ "webpki-roots 1.0.9",
+]
+
+[[package]]
+name = "reqwest"
+version = "0.13.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "219c5811de6525e5416c7d5d53bb656d3afdbc6c5af816e0802bcfa42dbdc1c3"
+dependencies = [
+ "base64",
+ "bytes",
+ "encoding_rs",
+ "futures-core",
+ "futures-util",
+ "h2",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-rustls",
+ "hyper-util",
+ "js-sys",
+ "log",
+ "mime",
+ "mime_guess",
+ "percent-encoding",
+ "pin-project-lite",
+ "quinn",
+ "rustls",
+ "rustls-pki-types",
+ "rustls-platform-verifier",
+ "serde",
+ "serde_json",
+ "sync_wrapper",
+ "tokio",
+ "tokio-rustls",
+ "tokio-util",
+ "tower",
+ "tower-http",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "wasm-streams 0.5.0",
+ "web-sys",
+]
+
+[[package]]
+name = "rig-core"
+version = "0.42.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "432d83e0facf16749f91fe729cbffca84437e8062d2f4e92f4f12e903693922d"
+dependencies = [
+ "as-any",
+ "async-stream",
+ "base64",
+ "bytes",
+ "eventsource-stream",
+ "fastrand",
+ "futures",
+ "futures-timer",
+ "glob",
+ "http",
+ "indexmap 2.14.1",
+ "mime",
+ "mime_guess",
+ "ordered-float",
+ "pin-project-lite",
+ "reqwest 0.13.4",
+ "rig-derive",
+ "schemars 1.2.2",
+ "serde",
+ "serde_json",
+ "sha2",
+ "thiserror",
+ "tokio",
+ "tokio-tungstenite 0.29.0",
+ "tracing",
+ "tracing-futures",
+ "url",
+]
+
+[[package]]
+name = "rig-derive"
+version = "0.42.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de0a33f1bac45f16e50146c248bcbbfaa44518c7252d274e972c7f4ad71aaba7"
+dependencies = [
+ "convert_case",
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.17",
+ "libc",
+ "untrusted",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "rsa"
+version = "0.9.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8573f03f5883dcaebdfcf4725caa1ecb9c15b2ef50c43a07b816e06799bb12d"
+dependencies = [
+ "const-oid",
+ "digest",
+ "num-bigint-dig",
+ "num-integer",
+ "num-traits",
+ "pkcs1",
+ "pkcs8",
+ "rand_core 0.6.4",
+ "signature",
+ "spki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustc-hash"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"
+
+[[package]]
+name = "rustc_version"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "rustls"
+version = "0.23.43"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06"
+dependencies = [
+ "aws-lc-rs",
+ "once_cell",
+ "ring",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-native-certs"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dab5152771c58876a2146916e53e35057e1a4dfa2b9df0f0305b07f611fdea4d"
+dependencies = [
+ "openssl-probe",
+ "rustls-pki-types",
+ "schannel",
+ "security-framework",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f4925028c7eb5d1fcdaf196971378ed9d2c1c4efc7dc5d011256f76c99c0a96"
+dependencies = [
+ "web-time",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-platform-verifier"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26d1e2536ce4f35f4846aa13bff16bd0ff40157cdb14cc056c7b14ba41233ba0"
+dependencies = [
+ "core-foundation 0.10.1",
+ "core-foundation-sys",
+ "jni",
+ "log",
+ "once_cell",
+ "rustls",
+ "rustls-native-certs",
+ "rustls-platform-verifier-android",
+ "rustls-webpki",
+ "security-framework",
+ "security-framework-sys",
+ "webpki-root-certs",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustls-platform-verifier-android"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
+dependencies = [
+ "aws-lc-rs",
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
+
+[[package]]
+name = "ryu"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
+
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "schannel"
+version = "0.1.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91c1b7e4904c873ef0710c1f407dde2e6287de2bebc1bbbf7d430bb7cbffd939"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "schemars"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cd191f9397d57d581cddd31014772520aa448f65ef991055d7f61582c65165f"
+dependencies = [
+ "dyn-clone",
+ "ref-cast",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "schemars"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "687274d293b6cdc6e73e0fee520bf2049650090d7164f87672d212a3c530cf4a"
+dependencies = [
+ "dyn-clone",
+ "ref-cast",
+ "schemars_derive",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "schemars_derive"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d98c67716b46af2f0b8cf752abc930f6f9aecfbf671ecfb531db8a31dbe4e2ba"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "serde_derive_internals",
+ "syn 3.0.4",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "security-framework"
+version = "3.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
+dependencies = [
+ "bitflags 2.13.1",
+ "core-foundation 0.10.1",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework-sys"
+version = "2.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2691df843ecc5d231c0b14ece2acc3efb62c0a398c7e1d875f3983ce020e3"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "semver"
+version = "1.0.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
+
+[[package]]
+name = "send_wrapper"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd0b0ec5f1c1ca621c432a25813d8d60c88abe6d3e08a3eb9cf37d97a0fe3d73"
+
+[[package]]
+name = "serde"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.4",
+]
+
+[[package]]
+name = "serde_derive_internals"
+version = "0.30.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f852137cce035d6a4df67ccce505ff6b3e9fd3a10e3e52b24dc71e650bb1a9bd"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.4",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.151"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "serde_path_to_error"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10a9ff822e371bb5403e391ecd83e182e0e77ba7f6fe0160b795797109d1b457"
+dependencies = [
+ "itoa",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "serde_repr"
+version = "0.1.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d3b1629de253c70a0508c3899572da79ca359fdab27c7920ff00406df418906"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.4",
+]
+
+[[package]]
+name = "serde_urlencoded"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
+dependencies = [
+ "form_urlencoded",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "serde_with"
+version = "3.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee78f1fbe43ac4a0e47aadb3dbd357b69eb0d3793e948624cd03dd2750ab1c0a"
+dependencies = [
+ "base64",
+ "bs58",
+ "chrono",
+ "hex",
+ "indexmap 1.9.3",
+ "indexmap 2.14.1",
+ "jiff",
+ "schemars 0.9.0",
+ "schemars 1.2.2",
+ "serde_core",
+ "serde_json",
+ "time",
+]
+
+[[package]]
+name = "sha1"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a978451301f4db1d02937a4ab3ccce137717b81826e79b7d49ffe3244a13c3b8"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "digest",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "digest",
+]
+
+[[package]]
+name = "sharded-slab"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f40ca3c46823713e0d4209592e8d6e826aa57e928f09752619fc696c499637f6"
+dependencies = [
+ "lazy_static",
+]
+
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
+[[package]]
+name = "signal-hook-registry"
+version = "1.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b"
+dependencies = [
+ "errno",
+ "libc",
+]
+
+[[package]]
+name = "signature"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
+dependencies = [
+ "digest",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "simd_cesu8"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11031e251abf8611c80f460e19dbdeb54a66db918e49c65a7065b46ac7aec520"
+dependencies = [
+ "rustc_version",
+ "simdutf8",
+]
+
+[[package]]
+name = "simdutf8"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "smallvec"
+version = "1.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9be42f50aa861c555654aa3a37f52f4b1074bacf4e48fe0ef7fa584e80f1f0f"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "socket2"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "spin"
+version = "0.9.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3763264f6b73151db08c50ff20d7d8a0b8796e021cdea7ceedad07b80155fa0e"
+dependencies = [
+ "lock_api",
+]
+
+[[package]]
+name = "spki"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
+dependencies = [
+ "base64ct",
+ "der",
+]
+
+[[package]]
+name = "sqlx"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fefb893899429669dcdd979aff487bd78f4064e5e7907e4269081e0ef7d97dc"
+dependencies = [
+ "sqlx-core",
+ "sqlx-macros",
+ "sqlx-mysql",
+ "sqlx-postgres",
+ "sqlx-sqlite",
+]
+
+[[package]]
+name = "sqlx-core"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee6798b1838b6a0f69c007c133b8df5866302197e404e8b6ee8ed3e3a5e68dc6"
+dependencies = [
+ "base64",
+ "bytes",
+ "chrono",
+ "crc",
+ "crossbeam-queue",
+ "either",
+ "event-listener",
+ "futures-core",
+ "futures-intrusive",
+ "futures-io",
+ "futures-util",
+ "hashbrown 0.15.5",
+ "hashlink",
+ "indexmap 2.14.1",
+ "log",
+ "memchr",
+ "once_cell",
+ "percent-encoding",
+ "rustls",
+ "serde",
+ "serde_json",
+ "sha2",
+ "smallvec",
+ "thiserror",
+ "tokio",
+ "tokio-stream",
+ "tracing",
+ "url",
+ "uuid",
+ "webpki-roots 0.26.11",
+]
+
+[[package]]
+name = "sqlx-macros"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2d452988ccaacfbf5e0bdbc348fb91d7c8af5bee192173ac3636b5fb6e6715d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "sqlx-core",
+ "sqlx-macros-core",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "sqlx-macros-core"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19a9c1841124ac5a61741f96e1d9e2ec77424bf323962dd894bdb93f37d5219b"
+dependencies = [
+ "dotenvy",
+ "either",
+ "heck",
+ "hex",
+ "once_cell",
+ "proc-macro2",
+ "quote",
+ "serde",
+ "serde_json",
+ "sha2",
+ "sqlx-core",
+ "sqlx-mysql",
+ "sqlx-postgres",
+ "sqlx-sqlite",
+ "syn 2.0.119",
+ "tokio",
+ "url",
+]
+
+[[package]]
+name = "sqlx-mysql"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa003f0038df784eb8fecbbac13affe3da23b45194bd57dba231c8f48199c526"
+dependencies = [
+ "atoi",
+ "base64",
+ "bitflags 2.13.1",
+ "byteorder",
+ "bytes",
+ "chrono",
+ "crc",
+ "digest",
+ "dotenvy",
+ "either",
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-util",
+ "generic-array",
+ "hex",
+ "hkdf",
+ "hmac",
+ "itoa",
+ "log",
+ "md-5",
+ "memchr",
+ "once_cell",
+ "percent-encoding",
+ "rand 0.8.8",
+ "rsa",
+ "serde",
+ "sha1",
+ "sha2",
+ "smallvec",
+ "sqlx-core",
+ "stringprep",
+ "thiserror",
+ "tracing",
+ "uuid",
+ "whoami",
+]
+
+[[package]]
+name = "sqlx-postgres"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db58fcd5a53cf07c184b154801ff91347e4c30d17a3562a635ff028ad5deda46"
+dependencies = [
+ "atoi",
+ "base64",
+ "bitflags 2.13.1",
+ "byteorder",
+ "chrono",
+ "crc",
+ "dotenvy",
+ "etcetera",
+ "futures-channel",
+ "futures-core",
+ "futures-util",
+ "hex",
+ "hkdf",
+ "hmac",
+ "home",
+ "itoa",
+ "log",
+ "md-5",
+ "memchr",
+ "once_cell",
+ "rand 0.8.8",
+ "serde",
+ "serde_json",
+ "sha2",
+ "smallvec",
+ "sqlx-core",
+ "stringprep",
+ "thiserror",
+ "tracing",
+ "uuid",
+ "whoami",
+]
+
+[[package]]
+name = "sqlx-sqlite"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2d12fe70b2c1b4401038055f90f151b78208de1f9f89a7dbfd41587a10c3eea"
+dependencies = [
+ "atoi",
+ "chrono",
+ "flume",
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-intrusive",
+ "futures-util",
+ "libsqlite3-sys",
+ "log",
+ "percent-encoding",
+ "serde",
+ "serde_urlencoded",
+ "sqlx-core",
+ "thiserror",
+ "tracing",
+ "url",
+ "uuid",
+]
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
+[[package]]
+name = "stringprep"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b4df3d392d81bd458a8a621b8bffbd2302a12ffe288a9d931670948749463b1"
+dependencies = [
+ "unicode-bidi",
+ "unicode-normalization",
+ "unicode-properties",
+]
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "syn"
+version = "2.0.119"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "3.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6275cddf4610d1775e6d1fe9469b2e77d0f39fd98fb7450901b821e0c53649f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "sync_wrapper"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
+dependencies = [
+ "futures-core",
+]
+
+[[package]]
+name = "synstructure"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "system-configuration"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a13f3d0daba03132c0aa9767f98351b3488edc2c100cda2d2ec2b04f3d8d3c8b"
+dependencies = [
+ "bitflags 2.13.1",
+ "core-foundation 0.9.4",
+ "system-configuration-sys",
+]
+
+[[package]]
+name = "system-configuration-sys"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e1d1b10ced5ca923a1fcb8d03e96b8d3268065d724548c0211415ff6ac6bac4"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.4",
+]
+
+[[package]]
+name = "thread_local"
+version = "1.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ad99c4c6d32803332c548b1af0540b357b3f5fc0be8f6c6bfe8b2e6ae784070"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "time"
+version = "0.3.55"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdb87b95ec50ddfa440816d227a17b2ccbdda963a316a727fda0fc4334f7d134"
+dependencies = [
+ "deranged",
+ "num-conv",
+ "powerfmt",
+ "serde_core",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109"
+
+[[package]]
+name = "time-macros"
+version = "0.2.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e689342a48d2ea927c87ea50cabf8594854bf940e9310208848d680d668ed85"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
+[[package]]
+name = "tinystr"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1e27c91459209c2986af3dcf603a5a74a4368754ce37414f59acc971167f643"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
+[[package]]
+name = "tinyvec"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb4ebadaa0af04fab11ae01eb5f9fdb5f9c5b875506e210e71c07873528baa7f"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
+[[package]]
+name = "tokio"
+version = "1.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
+dependencies = [
+ "bytes",
+ "libc",
+ "mio",
+ "pin-project-lite",
+ "signal-hook-registry",
+ "socket2",
+ "tokio-macros",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "tokio-macros"
+version = "2.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.4",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.26.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
+dependencies = [
+ "rustls",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-stream"
+version = "0.1.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a3d06f0b082ba57c26b79407372e57cf2a1e28124f78e9479fe80322cf53420b"
+dependencies = [
+ "futures-core",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-tungstenite"
+version = "0.26.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a9daff607c6d2bf6c16fd681ccb7eecc83e4e2cdc1ca067ffaadfca5de7f084"
+dependencies = [
+ "futures-util",
+ "log",
+ "tokio",
+ "tungstenite 0.26.2",
+]
+
+[[package]]
+name = "tokio-tungstenite"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f72a05e828585856dacd553fba484c242c46e391fb0e58917c942ee9202915c"
+dependencies = [
+ "futures-util",
+ "log",
+ "rustls",
+ "rustls-pki-types",
+ "tokio",
+ "tokio-rustls",
+ "tungstenite 0.29.0",
+ "webpki-roots 0.26.11",
+]
+
+[[package]]
+name = "tokio-util"
+version = "0.7.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "494815d09bf52b5548659851081238f0ca39ff638363907596da739561c62c52"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "libc",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "1.1.1+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.25.13+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6975367e4d2ef766d86af01ffad14b622fecc8d4357a998fbc4deb6e9bacaf9b"
+dependencies = [
+ "indexmap 2.14.1",
+ "toml_datetime",
+ "toml_parser",
+ "winnow",
+]
+
+[[package]]
+name = "toml_parser"
+version = "1.1.3+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d38ac1cf9b95face32296c0a3ede1fdc270627c9d9c02a7274dd6d960dc4d56"
+dependencies = [
+ "winnow",
+]
+
+[[package]]
+name = "tower"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tokio",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tower-http"
+version = "0.6.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
+dependencies = [
+ "bitflags 2.13.1",
+ "bytes",
+ "futures-core",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "http-range-header",
+ "httpdate",
+ "mime",
+ "mime_guess",
+ "percent-encoding",
+ "pin-project-lite",
+ "tokio",
+ "tokio-util",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+ "url",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
+
+[[package]]
+name = "tower-service"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+
+[[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "log",
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+dependencies = [
+ "once_cell",
+ "valuable",
+]
+
+[[package]]
+name = "tracing-futures"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97d095ae15e245a057c8e8451bab9b3ee1e1f68e9ba2b4fbc18d0ac5237835f2"
+dependencies = [
+ "futures",
+ "futures-task",
+ "pin-project",
+ "tracing",
+]
+
+[[package]]
+name = "tracing-log"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
+dependencies = [
+ "log",
+ "once_cell",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-subscriber"
+version = "0.3.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb7f578e5945fb242538965c2d0b04418d38ec25c79d160cd279bf0731c8d319"
+dependencies = [
+ "matchers",
+ "nu-ansi-term",
+ "once_cell",
+ "regex-automata",
+ "sharded-slab",
+ "smallvec",
+ "thread_local",
+ "tracing",
+ "tracing-core",
+ "tracing-log",
+]
+
+[[package]]
+name = "try-lock"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
+
+[[package]]
+name = "tungstenite"
+version = "0.26.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4793cb5e56680ecbb1d843515b23b6de9a75eb04b66643e256a396d43be33c13"
+dependencies = [
+ "bytes",
+ "data-encoding",
+ "http",
+ "httparse",
+ "log",
+ "rand 0.9.5",
+ "sha1",
+ "thiserror",
+ "utf-8",
+]
+
+[[package]]
+name = "tungstenite"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c01152af293afb9c7c2a57e4b559c5620b421f6d133261c60dd2d0cdb38e6b8"
+dependencies = [
+ "bytes",
+ "data-encoding",
+ "http",
+ "httparse",
+ "log",
+ "rand 0.9.5",
+ "rustls",
+ "rustls-pki-types",
+ "sha1",
+ "thiserror",
+]
+
+[[package]]
+name = "typenum"
+version = "1.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
+
+[[package]]
+name = "unicase"
+version = "2.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dbc4bc3a9f746d862c45cb89d705aa10f187bb96c76001afab07a0d35ce60142"
+
+[[package]]
+name = "unicode-bidi"
+version = "0.3.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c1cb5db39152898a79168971543b1cb5020dff7fe43c8dc468b0885f5e29df5"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "unicode-normalization"
+version = "0.1.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5fd4f6878c9cb28d874b009da9e8d183b5abc80117c40bbd187a1fde336be6e8"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "unicode-properties"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7df058c713841ad818f1dc5d3fd88063241cc61f49f5fbea4b951e8cf5a8d71d"
+
+[[package]]
+name = "unicode-segmentation"
+version = "1.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6f5d3c3b1bf09027a88a6bc961fc00497d651009560b5463668dc81b0fa87a8"
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "url"
+version = "2.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+]
+
+[[package]]
+name = "utf-8"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
+[[package]]
+name = "uuid"
+version = "1.26.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5772d71c9be8a8a6ac2117d949c5b224c1b72241bb611d9a3012edcf8af7812"
+dependencies = [
+ "getrandom 0.4.3",
+ "js-sys",
+ "serde_core",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "valuable"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
+
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "walkdir"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
+[[package]]
+name = "want"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+dependencies = [
+ "try-lock",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "wasip2"
+version = "1.0.4+wasi-0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b67efb37e106e55ce722a510d6b5f9c17f083e5fc79afc2badeb12cc313d9487"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "wasite"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8dad83b4f25e74f184f64c43b150b91efe7647395b42289f38e50566d82855b"
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.127"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b70935747edd64d89de3efa29d73789b806c15798f8e7dca4d8ac356b50ce70"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-futures"
+version = "0.4.77"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b7777d5cc23d0e91404e53ce2d5e8ec7acae3026b16233dba62cd3246457950"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.127"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77775f8f3f7217702089053b94958f8f54061a3f663417df76e19cbdcca29bc1"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.127"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e11d33f857dc2fb11b8bc75aee111aa9cbeb12cd9f25efd3d4c2a3dd4e235284"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.127"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ef64dbcc55df09c7e5a46182d181c2cfa3e925f3da937ea764728b4bbb9dcbf"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "wasm-streams"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15053d8d85c7eccdbefef60f06769760a563c7f0a9d6902a13d35c7800b0ad65"
+dependencies = [
+ "futures-util",
+ "js-sys",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
+[[package]]
+name = "wasm-streams"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d1ec4f6517c9e11ae630e200b2b65d193279042e28edd4a2cda233e46670bbb"
+dependencies = [
+ "futures-util",
+ "js-sys",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
+[[package]]
+name = "web-sys"
+version = "0.3.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c435338968042f4f59a557f690a253676d47ce13ceb55d70100e7facf6620a30"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "webpki-root-certs"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b96554aa2acc8ccdb7e1c9a58a7a68dd5d13bccc69cd124cb09406db612a1c9b"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "webpki-roots"
+version = "0.26.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
+dependencies = [
+ "webpki-roots 1.0.9",
+]
+
+[[package]]
+name = "webpki-roots"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "whoami"
+version = "1.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d4a4db5077702ca3015d3d02d74974948aba2ad9e12ab7df718ee64ccd7e97d"
+dependencies = [
+ "libredox",
+ "wasite",
+]
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-util"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "windows-core"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
+[[package]]
+name = "windows-implement"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "windows-interface"
+version = "0.59.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-registry"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02752bf7fbdcce7f2a27a742f798510f3e5ad88dbe84871e5168e2120c3d5720"
+dependencies = [
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
+[[package]]
+name = "windows-result"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
+dependencies = [
+ "windows-targets 0.48.5",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
+dependencies = [
+ "windows_aarch64_gnullvm 0.48.5",
+ "windows_aarch64_msvc 0.48.5",
+ "windows_i686_gnu 0.48.5",
+ "windows_i686_msvc 0.48.5",
+ "windows_x86_64_gnu 0.48.5",
+ "windows_x86_64_gnullvm 0.48.5",
+ "windows_x86_64_msvc 0.48.5",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm 0.52.6",
+ "windows_aarch64_msvc 0.52.6",
+ "windows_i686_gnu 0.52.6",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc 0.52.6",
+ "windows_x86_64_gnu 0.52.6",
+ "windows_x86_64_gnullvm 0.52.6",
+ "windows_x86_64_msvc 0.52.6",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "winnow"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23b97319f7b8343df12cc98938e5c3eb436064524c8d2b4e30a1d3a36eecdf81"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "wit-bindgen"
+version = "0.57.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
+
+[[package]]
+name = "writeable"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"
+
+[[package]]
+name = "yoke"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
+dependencies = [
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "synstructure",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.8.56"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "556764e583adb45a9f8d413c2a147fa7e8d821e48e12b14fd560b607998b75eb"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.56"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2ab42fc20575779bd240faa45f94a74256f755c0fa9e89f0ede20d91d0cdfc1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "synstructure",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
+
+[[package]]
+name = "zerotrie"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb0464e17806c1d976d5cba29399c7f08e516e279e2ba493f63123b5fca67dd8"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34df6fc39dbd26ddc9c10e6a2984476e13acce22e64e4487636ef494369225da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.4",
+]
+
+[[package]]
+name = "zmij"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
diff --git a/Cargo.toml b/Cargo.toml
new file mode 100644
index 0000000..284ab7f
--- /dev/null
+++ b/Cargo.toml
@@ -0,0 +1,42 @@
+[workspace]
+resolver = "2"
+members = [
+    "crates/contracts",
+    "crates/control",
+    "crates/harness",
+    "crates/controld",
+    "crates/supervisor",
+    "crates/sandbox",
+    "crates/api",
+]
+
+[workspace.package]
+edition = "2024"
+version = "0.1.0"
+license = "MIT"
+publish = false
+
+[workspace.dependencies]
+lazyboy-contracts = { path = "crates/contracts" }
+lazyboy-control = { path = "crates/control" }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+thiserror = "2"
+sha2 = "0.10"
+hex = "0.4"
+base64 = "0.22"
+chrono = { version = "0.4", default-features = false, features = ["clock", "serde"] }
+rig-core = "0.42"
+async-trait = "0.1"
+tokio = { version = "1", features = ["macros", "rt-multi-thread", "process", "io-util", "fs", "signal", "time"] }
+axum = { version = "0.8", features = ["ws"] }
+tower-http = { version = "0.6", features = ["cors", "trace", "fs"] }
+tracing = "0.1"
+tracing-subscriber = { version = "0.3", features = ["env-filter"] }
+uuid = { version = "1", features = ["v4", "serde"] }
+reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls", "stream"] }
+tokio-tungstenite = { version = "0.26", features = ["connect"] }
+futures-util = "0.3"
+bollard = "0.18"
+hmac = "0.12"
+sqlx = { version = "0.8", features = ["runtime-tokio", "tls-rustls", "postgres", "chrono", "uuid", "json"] }
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..e82605a
--- /dev/null
+++ b/README.md
@@ -0,0 +1,25 @@
+# LazyBoy
+
+Create a bot in the browser, give it a Team or Private computer, and let it drive a Linux desktop.
+
+## Run (local)
+
+Postgres is on `127.0.0.1:5434` so it does not collide with other stacks.
+
+```bash
+cp .env.example .env          # set XAI_API_KEY for chat
+docker compose up -d postgres
+./scripts/build-computer-image.sh
+DATA_DIR=/root/LazyBoy/data cargo run -p lazyboy-supervisor
+DATABASE_URL=postgres://lazyboy:lazyboy@127.0.0.1:5434/lazyboy \
+SANDBOX_PROVIDER=docker \
+SANDBOX_SUPERVISOR_URL=http://127.0.0.1:7091 \
+DATA_DIR=/root/LazyBoy/data \
+LAZYBOY_WEB_DIR=apps/web \
+API_BIND=0.0.0.0:3101 \
+cargo run -p lazyboy-api
+```
+
+Open `http://<host>:3101`. The computer is a real Debian container: fluxbox toolbar, Chromium with tabs and URL bar, and xterm. Do not replace that with a kiosk or HTML landing page. The display is proxied through the API so you do not open extra ports.
+
+Model providers: v1 talks to xAI (`XAI_API_KEY`). `openai` / `anthropic` / `openrouter` are reserved on the factory and return `unsupported_provider`.
diff --git a/apps/web/index.html b/apps/web/index.html
new file mode 100644
index 0000000..a209e58
--- /dev/null
+++ b/apps/web/index.html
@@ -0,0 +1,241 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>LazyBoy</title>
+    <style>
+      :root {
+        color-scheme: dark;
+        --bg: #111113;
+        --panel: #1a1a1f;
+        --line: #2a2a32;
+        --text: #ececf1;
+        --muted: #9a9aa8;
+        --accent: #6ea8ff;
+      }
+      * { box-sizing: border-box; }
+      html, body { margin: 0; height: 100%; background: var(--bg); color: var(--text); font: 14px/1.45 ui-sans-serif, system-ui, sans-serif; }
+      #app { display: grid; grid-template-columns: 240px 1fr 1.2fr; height: 100%; }
+      aside, main, section { border-right: 1px solid var(--line); min-width: 0; min-height: 0; }
+      section { border-right: none; display: flex; flex-direction: column; }
+      header { padding: 16px; border-bottom: 1px solid var(--line); }
+      h1, h2 { margin: 0; font-size: 15px; font-weight: 600; }
+      .list { padding: 8px; overflow: auto; }
+      button, input, textarea, select {
+        font: inherit; color: inherit; background: var(--panel); border: 1px solid var(--line); border-radius: 8px;
+      }
+      button { padding: 8px 10px; cursor: pointer; }
+      button.primary { background: var(--accent); color: #081018; border-color: transparent; font-weight: 600; }
+      input, textarea, select { padding: 8px; width: 100%; }
+      .bot { padding: 10px; border-radius: 8px; cursor: pointer; }
+      .bot.active, .bot:hover { background: var(--panel); }
+      .messages { padding: 16px; overflow: auto; height: calc(100% - 140px); }
+      .msg { margin: 0 0 12px; }
+      .msg .who { color: var(--muted); font-size: 12px; }
+      .composer { display: flex; gap: 8px; padding: 12px; border-top: 1px solid var(--line); }
+      .composer textarea { min-height: 52px; resize: none; }
+      iframe { flex: 1; width: 100%; min-height: 0; border: 0; background: #1d4ed8; pointer-events: auto; }
+      .row { display: flex; gap: 8px; flex-wrap: wrap; }
+      .create { padding: 12px; display: grid; gap: 8px; }
+      .hint { color: var(--muted); padding: 12px; }
+    </style>
+  </head>
+  <body>
+    <div id="app">
+      <aside>
+        <header><h1>LazyBoy</h1></header>
+        <div class="create">
+          <input id="name" placeholder="Bot name" />
+          <select id="mode">
+            <option value="team">Team computer (shared)</option>
+            <option value="dedicated">Private computer (new Docker)</option>
+          </select>
+          <button class="primary" id="create">Create bot</button>
+          <div class="hint" style="padding:0">Team is one machine with a screen per bot. Private boots an isolated container.</div>
+        </div>
+        <div class="list" id="bots"></div>
+      </aside>
+      <main>
+        <header><h2 id="chatTitle">Chat</h2></header>
+        <div class="messages" id="messages"></div>
+        <div class="composer">
+          <textarea id="draft" placeholder="Message the bot"></textarea>
+          <button class="primary" id="send">Send</button>
+        </div>
+      </main>
+      <section>
+        <header>
+          <h2>Computer</h2>
+          <div class="row" style="margin-top:8px">
+            <button id="boot">Open desktop</button>
+            <button id="restart">Restart</button>
+            <button id="stop">Shut down</button>
+            <button id="takeover">Take control</button>
+            <button id="release">Release</button>
+          </div>
+          <div class="hint" id="status">No computer yet</div>
+        </header>
+        <iframe id="screen" title="Bot desktop" allow="fullscreen; clipboard-read; clipboard-write"></iframe>
+      </section>
+    </div>
+    <script>
+      const api = (path, opts = {}) =>
+        fetch(path, {
+          headers: { "content-type": "application/json", ...(opts.headers || {}) },
+          ...opts,
+        }).then(async (res) => {
+          const text = await res.text();
+          let body = null;
+          try { body = text ? JSON.parse(text) : null; } catch { body = { message: text }; }
+          if (!res.ok) throw new Error(body && body.message ? body.message : `${res.status} ${text}`);
+          return body;
+        });
+
+      let bots = [];
+      let active = null;
+      let poll = null;
+
+      async function refreshBots() {
+        bots = await api("/api/bots");
+        const root = document.getElementById("bots");
+        root.innerHTML = bots
+          .map(
+            (bot) =>
+              `<div class="bot ${active && active.id === bot.id ? "active" : ""}" data-id="${bot.id}">
+                <strong>${bot.name}</strong><div class="who">${bot.computerMode}</div>
+              </div>`
+          )
+          .join("");
+        root.querySelectorAll(".bot").forEach((el) =>
+          el.addEventListener("click", () => select(bots.find((b) => b.id === el.dataset.id)))
+        );
+      }
+
+      async function select(bot) {
+        active = bot;
+        document.getElementById("chatTitle").textContent = bot.name;
+        await refreshBots();
+        await refreshThread();
+        await refreshComputer();
+        if (poll) clearInterval(poll);
+        poll = setInterval(() => {
+          refreshThread().catch(() => {});
+          refreshComputer().catch(() => {});
+          ping().catch(() => {});
+        }, 2000);
+      }
+
+      async function refreshThread() {
+        if (!active) return;
+        const messages = await api(`/api/bots/${active.id}/messages`);
+        const root = document.getElementById("messages");
+        root.innerHTML = messages
+          .map((msg) => `<div class="msg"><div class="who">${msg.role}</div><div>${escapeHtml(msg.body || "")}</div></div>`)
+          .join("");
+        root.scrollTop = root.scrollHeight;
+      }
+
+      async function refreshComputer() {
+        if (!active) return;
+        const status = await api(`/api/computer/${active.id}/status`);
+        const busy = status.busyBotName ? ` · ${status.busyBotName}` : "";
+        const share = status.mode === "team" ? "Team computer" : "Private computer";
+        const display = status.display ? ` · ${status.display}` : "";
+        const profile = status.profileMode ? ` · profile ${status.profileMode}` : "";
+        const ask = status.takeoverRequested ? " · bot asked you to take control" : "";
+        document.getElementById("status").textContent = `${share}${display}${profile} · ${status.state} · control ${status.controlHolder}${busy}${ask}`;
+        const desktop = await api(`/api/computer/${active.id}/screen`).catch(() => ({ url: null }));
+        const frame = document.getElementById("screen");
+        if (desktop.url) {
+          const next = new URL(desktop.url, window.location.origin).href;
+          if (frame.src !== next) frame.src = next;
+        }
+      }
+
+      async function ping() {
+        if (!active) return;
+        await api(`/api/computer/${active.id}/heartbeat`, { method: "POST", body: "{}" }).catch(() => {});
+      }
+
+      function escapeHtml(value) {
+        return String(value)
+          .replaceAll("&", "&amp;")
+          .replaceAll("<", "&lt;")
+          .replaceAll(">", "&gt;");
+      }
+
+      document.getElementById("create").onclick = async () => {
+        const name = document.getElementById("name").value.trim();
+        if (!name) return;
+        const bot = await api("/api/bots", {
+          method: "POST",
+          body: JSON.stringify({
+            name,
+            computerMode: document.getElementById("mode").value,
+          }),
+        });
+        document.getElementById("name").value = "";
+        await refreshBots();
+        await select(bot);
+      };
+
+      document.getElementById("send").onclick = async () => {
+        if (!active) return;
+        const text = document.getElementById("draft").value.trim();
+        if (!text) return;
+        document.getElementById("draft").value = "";
+        await api(`/api/bots/${active.id}/messages`, { method: "POST", body: JSON.stringify({ text }) });
+        await refreshThread();
+      };
+
+      document.getElementById("boot").onclick = async () => {
+        if (!active) return;
+        await api(`/api/computer/${active.id}/boot`, { method: "POST", body: "{}" });
+        await api(`/api/computer/${active.id}/takeover`, { method: "POST", body: "{}" }).catch(() => {});
+        await refreshComputer();
+      };
+      document.getElementById("restart").onclick = async () => {
+        if (!active) return;
+        document.getElementById("status").textContent = "Restarting computer…";
+        document.getElementById("screen").src = "about:blank";
+        await api(`/api/computer/${active.id}/restart`, { method: "POST", body: "{}" });
+        await api(`/api/computer/${active.id}/takeover`, { method: "POST", body: "{}" }).catch(() => {});
+        await refreshComputer();
+      };
+      document.getElementById("takeover").onclick = async () => {
+        if (!active) return;
+        try {
+          await api(`/api/computer/${active.id}/takeover`, { method: "POST", body: "{}" });
+        } catch (error) {
+          document.getElementById("status").textContent = error.message;
+        }
+        await refreshComputer();
+      };
+      document.getElementById("release").onclick = async () => {
+        if (!active) return;
+        await api(`/api/computer/${active.id}/release`, { method: "POST", body: "{}" });
+        await refreshComputer();
+      };
+      document.getElementById("stop").onclick = async () => {
+        if (!active) return;
+        await api(`/api/computer/${active.id}/stop`, { method: "POST", body: "{}" });
+        document.getElementById("screen").src = "about:blank";
+        await refreshComputer();
+      };
+
+      window.addEventListener("message", (event) => {
+        if (!active || !event.data || event.data.type !== "lazyboy-request-control") return;
+        api(`/api/computer/${active.id}/takeover`, { method: "POST", body: "{}" })
+          .then(() => refreshComputer())
+          .catch((error) => {
+            document.getElementById("status").textContent = error.message;
+          });
+      });
+
+      refreshBots().catch((error) => {
+        document.getElementById("status").textContent = error.message;
+      });
+    </script>
+  </body>
+</html>
diff --git a/apps/web/vnc.html b/apps/web/vnc.html
new file mode 100644
index 0000000..649de13
--- /dev/null
+++ b/apps/web/vnc.html
@@ -0,0 +1,120 @@
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <title>LazyBoy desktop</title>
+    <style>
+      html, body, #screen {
+        margin: 0;
+        height: 100%;
+        width: 100%;
+        background: #0f172a;
+        overflow: hidden;
+      }
+      #status {
+        position: absolute;
+        left: 8px;
+        top: 8px;
+        z-index: 2;
+        padding: 4px 8px;
+        border-radius: 6px;
+        background: rgba(0, 0, 0, 0.45);
+        color: #fff;
+        font: 12px/1.3 ui-sans-serif, system-ui, sans-serif;
+        pointer-events: none;
+      }
+      #screen canvas { cursor: default; }
+    </style>
+    <script type="module">
+      import RFB from "./core/rfb.js";
+
+      function query(name) {
+        const match = `${document.location.href}${window.location.hash}`.match(
+          new RegExp(`[?&#]${name}=([^&#]*)`)
+        );
+        return match ? decodeURIComponent(match[1]) : null;
+      }
+
+      function flag(name, fallback = false) {
+        const raw = query(name);
+        if (raw == null) return fallback;
+        const value = String(raw).toLowerCase();
+        return value === "1" || value === "true" || value === "yes";
+      }
+
+      const statusEl = document.getElementById("status");
+      const setStatus = (text) => {
+        statusEl.textContent = text;
+      };
+
+      const prefix = window.location.pathname.replace(/[^/]+$/, "");
+      const protocol = window.location.protocol === "https:" ? "wss" : "ws";
+      const path = (query("path") || "websockify").replace(/^\//, "");
+      const url = path.includes("/")
+        ? `${protocol}://${window.location.host}/${path}`
+        : `${protocol}://${window.location.host}${prefix}${path}`;
+
+      let rfb = null;
+      let reconnectTimer = null;
+
+      function pinTaskbar() {
+        // noVNC centers the scaled canvas (margin:auto), leaving a dead
+        // strip under the panel. Stick the canvas to the bottom.
+        const inner = document.querySelector("#screen > div");
+        const canvas = document.querySelector("#screen canvas");
+        if (inner) {
+          inner.style.alignItems = "flex-end";
+          inner.style.justifyContent = "center";
+        }
+        if (canvas) {
+          canvas.style.margin = "0 auto";
+        }
+      }
+
+      function connect() {
+        setStatus("Connecting to desktop…");
+        statusEl.style.display = "block";
+        rfb = new RFB(document.getElementById("screen"), url);
+        rfb.viewOnly = flag("view_only", false);
+        rfb.scaleViewport = true;
+        rfb.clipViewport = false;
+        rfb.background = "#0f172a";
+        pinTaskbar();
+        rfb.addEventListener("connect", () => {
+          pinTaskbar();
+          setStatus(rfb.viewOnly ? "View only — click to take control" : "Click the desktop");
+          try { rfb.focus(); } catch (_) {}
+          setTimeout(() => { statusEl.style.display = "none"; }, 2500);
+        });
+        rfb.addEventListener("disconnect", (event) => {
+          statusEl.style.display = "block";
+          const clean = event && event.detail && event.detail.clean;
+          setStatus(clean ? "Disconnected — retrying" : "Desktop connection lost — retrying");
+          if (reconnectTimer) clearTimeout(reconnectTimer);
+          reconnectTimer = setTimeout(connect, 1500);
+        });
+      }
+
+      connect();
+      window.addEventListener("resize", pinTaskbar);
+      window.addEventListener("pointerdown", () => {
+        try { if (rfb) rfb.focus(); } catch (_) {}
+        if (rfb && rfb.viewOnly) {
+          window.parent.postMessage({ type: "lazyboy-request-control" }, "*");
+        }
+      });
+      window.addEventListener("paste", (event) => {
+        if (!rfb || rfb.viewOnly) return;
+        const text = event.clipboardData ? event.clipboardData.getData("text") : "";
+        if (!text) return;
+        event.preventDefault();
+        try { rfb.clipboardPasteFrom(text); } catch (_) {}
+        try { rfb.sendKey(0xffe3, "ControlLeft", true); rfb.sendKey(0x0076, "KeyV", true); rfb.sendKey(0x0076, "KeyV", false); rfb.sendKey(0xffe3, "ControlLeft", false); } catch (_) {}
+      });
+    </script>
+  </head>
+  <body>
+    <div id="status">Loading desktop…</div>
+    <div id="screen"></div>
+  </body>
+</html>
diff --git a/crates/api/Cargo.toml b/crates/api/Cargo.toml
new file mode 100644
index 0000000..b868335
--- /dev/null
+++ b/crates/api/Cargo.toml
@@ -0,0 +1,34 @@
+[package]
+name = "lazyboy-api"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+publish.workspace = true
+
+[dependencies]
+lazyboy-contracts.workspace = true
+lazyboy-control.workspace = true
+lazyboy-harness = { path = "../harness" }
+lazyboy-sandbox = { path = "../sandbox" }
+axum.workspace = true
+tokio.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+thiserror.workspace = true
+tracing.workspace = true
+tracing-subscriber.workspace = true
+sqlx.workspace = true
+uuid.workspace = true
+chrono.workspace = true
+tower-http.workspace = true
+async-trait = "0.1"
+rig-core.workspace = true
+base64.workspace = true
+hmac.workspace = true
+sha2.workspace = true
+hex.workspace = true
+reqwest.workspace = true
+tokio-tungstenite.workspace = true
+futures-util = "0.3"
+http-body-util = "0.1"
+dotenvy = "0.15"
diff --git a/crates/api/src/computer.rs b/crates/api/src/computer.rs
new file mode 100644
index 0000000..e437e26
--- /dev/null
+++ b/crates/api/src/computer.rs
@@ -0,0 +1,802 @@
+use std::path::PathBuf;
+use std::time::Duration;
+
+use chrono::{TimeDelta, Utc};
+use lazyboy_contracts::{
+    BrowserProfileMode, ComputerCapabilities, ComputerMode, ComputerState, ComputerStatus, ControlHolder,
+    DEFAULT_SCREEN_HEIGHT, DEFAULT_SCREEN_WIDTH,
+};
+use lazyboy_control::{
+    admit_gui, admit_new_screen, browser_profile_path, execution_blocks_user_takeover, profile_lock_key,
+    screen_layout, team_bot_workspace_directory, user_holds_control, AdapterContext, CommandRequest,
+    EnsureScreenRequest, ProvisionRequest,
+};
+use uuid::Uuid;
+
+use crate::db::{
+    parse_holder, parse_kind, parse_mode, parse_profile_mode, parse_run_status, parse_state, Actor, ComputerRow,
+    ScreenRow,
+};
+use crate::state::AppState;
+
+pub fn status_from(
+    bot_id: &str,
+    computer: &ComputerRow,
+    screen: Option<&ScreenRow>,
+    busy_bot_name: Option<String>,
+) -> ComputerStatus {
+    let control_holder = screen
+        .map(|row| parse_holder(&row.control_holder))
+        .unwrap_or_else(|| parse_holder(&computer.control_holder));
+    let control_bot_id = screen
+        .and_then(|row| {
+            if parse_holder(&row.control_holder) == ControlHolder::User {
+                Some(row.bot_id.clone())
+            } else {
+                None
+            }
+        })
+        .or_else(|| computer.control_bot_id.clone());
+    ComputerStatus {
+        bot_id: bot_id.to_string(),
+        mode: parse_mode(&computer.scope),
+        kind: parse_kind(&computer.kind),
+        state: parse_state(&computer.state),
+        control_holder,
+        control_bot_id,
+        takeover_requested: false,
+        screen_available: computer.provider_ref.is_some()
+            && computer.state == "running"
+            && screen.is_some(),
+        screen_width: DEFAULT_SCREEN_WIDTH,
+        screen_height: DEFAULT_SCREEN_HEIGHT,
+        home_revision: Some(computer.home_revision.clone()),
+        busy_bot_name,
+        multi_screen: true,
+        screen_id: screen.map(|row| row.id.clone()),
+        display: screen.map(|row| row.display.clone()),
+        profile_mode: screen
+            .map(|row| parse_profile_mode(&row.profile_mode))
+            .unwrap_or_else(|| parse_profile_mode(&computer.browser_profile_mode)),
+    }
+}
+
+pub fn home_path(data_dir: &str, home_key: &str) -> PathBuf {
+    PathBuf::from(data_dir).join("homes").join(home_key)
+}
+
+pub fn adapter_context(actor: &Actor, bot_id: &str, operation: &str) -> AdapterContext {
+    AdapterContext {
+        operation_id: operation.into(),
+        space_id: actor.space_id.clone(),
+        user_id: actor.user_id.clone(),
+        bot_id: Some(bot_id.into()),
+        ..Default::default()
+    }
+}
+
+pub fn adapter_context_for(
+    actor: &Actor,
+    bot_id: &str,
+    operation: &str,
+    screen: Option<&ScreenRow>,
+    run_id: Option<&str>,
+) -> AdapterContext {
+    let mut ctx = adapter_context(actor, bot_id, operation);
+    ctx.run_id = run_id.map(str::to_string);
+    if let Some(screen) = screen {
+        ctx.screen_id = Some(screen.id.clone());
+        ctx.screen_slot = Some(screen.slot as u32);
+        ctx.display = Some(screen.display.clone());
+        ctx.profile_path = Some(screen.profile_path.clone());
+        ctx.screen_lease_id = screen.execution_run_id.clone();
+    }
+    ctx
+}
+
+pub struct BoundScreen {
+    pub row: Option<ScreenRow>,
+    pub gui_block: Option<String>,
+}
+
+pub async fn ensure_bot_screen(
+    state: &AppState,
+    actor: &Actor,
+    bot_id: &str,
+    computer: &ComputerRow,
+    run_id: Option<&str>,
+) -> Result<BoundScreen, String> {
+    let Some(computer_ref) = computer_ref(computer) else {
+        return Err("computer is not running".into());
+    };
+    let caps = state
+        .sandbox
+        .capabilities(&computer_ref, &adapter_context(actor, bot_id, "caps"))
+        .await
+        .unwrap_or(ComputerCapabilities { multi_screen: true });
+    let existing = state
+        .db
+        .get_screen(&computer.id, bot_id)
+        .await
+        .map_err(|error| error.to_string())?;
+    let used: Vec<u32> = state
+        .db
+        .list_screen_slots(&computer.id)
+        .await
+        .map_err(|error| error.to_string())?
+        .into_iter()
+        .map(|slot| slot as u32)
+        .collect();
+    let slot = match admit_new_screen(&caps, &used, existing.as_ref().map(|row| row.slot as u32)) {
+        Ok(slot) => slot,
+        Err(block) => {
+            return Ok(BoundScreen {
+                row: existing,
+                gui_block: Some(block.message()),
+            });
+        }
+    };
+    let layout = screen_layout(slot).map_err(|error| error.to_string())?;
+    let profile_mode = parse_profile_mode(&computer.browser_profile_mode);
+    let profile_path = browser_profile_path(profile_mode, bot_id, run_id);
+    let row = if let Some(existing) = existing {
+        if existing.profile_path != profile_path && profile_mode == BrowserProfileMode::PerTask {
+            sqlx::query("UPDATE computer_screens SET profile_path = $2, updated_at = now() WHERE id = $1")
+                .bind(&existing.id)
+                .bind(&profile_path)
+                .execute(state.pool())
+                .await
+                .map_err(|error| error.to_string())?;
+        }
+        state
+            .db
+            .get_screen(&computer.id, bot_id)
+            .await
+            .map_err(|error| error.to_string())?
+            .unwrap_or(existing)
+    } else {
+        let id = Uuid::new_v4().to_string();
+        let inserted = sqlx::query_as::<_, ScreenRow>(
+            "INSERT INTO computer_screens (
+                id, computer_id, bot_id, slot, display, view_port, profile_mode, profile_path
+             ) VALUES ($1,$2,$3,$4,$5,$6,$7,$8)
+             ON CONFLICT (computer_id, bot_id) DO UPDATE SET updated_at = now()
+             RETURNING id, computer_id, bot_id, slot, display, view_port, profile_mode, profile_path,
+                       control_holder, control_lease_id, control_lease_expires_at, execution_run_id,
+                       execution_lease_expires_at, execution_fence",
+        )
+        .bind(&id)
+        .bind(&computer.id)
+        .bind(bot_id)
+        .bind(slot as i32)
+        .bind(&layout.display)
+        .bind(layout.view_port as i32)
+        .bind(profile_mode.as_str())
+        .bind(&profile_path)
+        .fetch_one(state.pool())
+        .await;
+        match inserted {
+            Ok(row) => row,
+            Err(error) if error.to_string().contains("computer_screens_computer_id_slot") => {
+                return Ok(BoundScreen {
+                    row: None,
+                    gui_block: Some(admit_new_screen(&caps, &used, None).err().map(|block| block.message()).unwrap_or_else(|| {
+                        lazyboy_contracts::TEAM_SCREENS_FULL.to_string()
+                    })),
+                });
+            }
+            Err(error) => return Err(error.to_string()),
+        }
+    };
+    let ctx = adapter_context_for(actor, bot_id, "screen", Some(&row), run_id);
+    let request = EnsureScreenRequest {
+        slot: row.slot as u32,
+        profile_path: row.profile_path.clone(),
+        bot_id: bot_id.to_string(),
+    };
+    let mut last_error = None;
+    for attempt in 0..8 {
+        match state.sandbox.ensure_screen(&computer_ref, request.clone(), &ctx).await {
+            Ok(_) => {
+                last_error = None;
+                break;
+            }
+            Err(error) => {
+                let busy = error.to_string().contains("busy starting");
+                last_error = Some(error);
+                if !busy || attempt == 7 {
+                    break;
+                }
+                tokio::time::sleep(Duration::from_millis(400)).await;
+            }
+        }
+    }
+    if let Some(error) = last_error {
+        tracing::warn!("ensure screen {}: {error}", row.display);
+        return Err(format!("ensure screen {}: {error}", row.display));
+    }
+    Ok(BoundScreen {
+        row: Some(row),
+        gui_block: None,
+    })
+}
+
+async fn restore_computer_screens(
+    state: &AppState,
+    actor: &Actor,
+    computer: &ComputerRow,
+    skip_bot_id: &str,
+) {
+    let Ok(screens) = state.db.list_screens(&computer.id).await else {
+        return;
+    };
+    let Some(computer_ref) = computer_ref(computer) else {
+        return;
+    };
+    for screen in screens {
+        if screen.bot_id == skip_bot_id {
+            continue;
+        }
+        let ctx = adapter_context_for(actor, &screen.bot_id, "screen", Some(&screen), None);
+        let _ = state
+            .sandbox
+            .ensure_screen(
+                &computer_ref,
+                EnsureScreenRequest {
+                    slot: screen.slot as u32,
+                    profile_path: screen.profile_path.clone(),
+                    bot_id: screen.bot_id.clone(),
+                },
+                &ctx,
+            )
+            .await;
+    }
+}
+
+async fn guest_has_screens(state: &AppState, actor: &Actor, bot_id: &str, computer: &ComputerRow) -> bool {
+    let Some(computer_ref) = computer_ref(computer) else {
+        return false;
+    };
+    let result = state
+        .sandbox
+        .execute(
+            &computer_ref,
+            CommandRequest {
+                argv: vec!["test".into(), "-x".into(), "/usr/local/bin/lazyboy-screen".into()],
+                cwd: None,
+                timeout_ms: Some(5_000),
+            },
+            &adapter_context(actor, bot_id, "probe"),
+        )
+        .await;
+    matches!(result, Ok(output) if output.code == 0)
+}
+
+pub async fn take_screen_execution(
+    state: &AppState,
+    screen: &ScreenRow,
+    run_id: &str,
+) -> Result<ScreenRow, String> {
+    sqlx::query(
+        "UPDATE computer_screens
+         SET execution_run_id = $2, execution_lease_expires_at = $3,
+             execution_fence = execution_fence + 1,
+             control_holder = 'none', control_lease_id = NULL, control_lease_expires_at = NULL,
+             updated_at = now()
+         WHERE id = $1",
+    )
+    .bind(&screen.id)
+    .bind(run_id)
+    .bind(Utc::now() + TimeDelta::minutes(5))
+    .execute(state.pool())
+    .await
+    .map_err(|error| error.to_string())?;
+    state
+        .db
+        .get_screen(&screen.computer_id, &screen.bot_id)
+        .await
+        .map_err(|error| error.to_string())?
+        .ok_or_else(|| "screen missing after lease".to_string())
+}
+
+pub async fn release_screen_execution(state: &AppState, run_id: &str) -> Result<(), String> {
+    sqlx::query(
+        "UPDATE computer_screens
+         SET execution_run_id = NULL, execution_lease_expires_at = NULL, updated_at = now()
+         WHERE execution_run_id = $1",
+    )
+    .bind(run_id)
+    .execute(state.pool())
+    .await
+    .map_err(|error| error.to_string())?;
+    sqlx::query("DELETE FROM computer_profile_locks WHERE run_id = $1")
+        .bind(run_id)
+        .execute(state.pool())
+        .await
+        .map_err(|error| error.to_string())?;
+    Ok(())
+}
+
+pub async fn take_profile_lock(
+    state: &AppState,
+    computer: &ComputerRow,
+    bot_id: &str,
+    bot_name: &str,
+    run_id: &str,
+    screen: &ScreenRow,
+) -> Result<Option<String>, String> {
+    let mode = parse_profile_mode(&screen.profile_mode);
+    let key = profile_lock_key(mode, bot_id, Some(run_id));
+    let expires = Utc::now() + TimeDelta::minutes(5);
+    let taken: Option<String> = sqlx::query_scalar(
+        "INSERT INTO computer_profile_locks (computer_id, profile_key, bot_id, run_id, expires_at)
+         VALUES ($1,$2,$3,$4,$5)
+         ON CONFLICT (computer_id, profile_key) DO UPDATE
+           SET bot_id = EXCLUDED.bot_id, run_id = EXCLUDED.run_id, expires_at = EXCLUDED.expires_at
+           WHERE computer_profile_locks.bot_id = EXCLUDED.bot_id
+              OR computer_profile_locks.expires_at < now()
+         RETURNING bot_id",
+    )
+    .bind(&computer.id)
+    .bind(&key)
+    .bind(bot_id)
+    .bind(run_id)
+    .bind(expires)
+    .fetch_optional(state.pool())
+    .await
+    .map_err(|error| error.to_string())?;
+    if taken.as_deref() == Some(bot_id) {
+        return Ok(None);
+    }
+    let holder: Option<String> = sqlx::query_scalar(
+        "SELECT b.name FROM computer_profile_locks l JOIN bots b ON b.id = l.bot_id
+         WHERE l.computer_id = $1 AND l.profile_key = $2 AND l.expires_at > now()",
+    )
+    .bind(&computer.id)
+    .bind(&key)
+    .fetch_optional(state.pool())
+    .await
+    .map_err(|error| error.to_string())?;
+    let other = holder.unwrap_or_else(|| bot_name.to_string());
+    Ok(Some(
+        admit_gui(
+            &ComputerCapabilities { multi_screen: true },
+            bot_id,
+            true,
+            None,
+            Some("other"),
+            Some(&other),
+        )
+        .err()
+        .map(|block| block.message())
+        .unwrap_or_else(|| format!("Another bot is using this shared browser profile. Currently in use by {other}.")),
+    ))
+}
+
+pub async fn boot(state: &AppState, actor: &Actor, bot_id: &str) -> Result<ComputerStatus, String> {
+    let bot = state
+        .db
+        .get_bot(actor, bot_id)
+        .await
+        .map_err(|error| error.to_string())?
+        .ok_or_else(|| "bot not found".to_string())?;
+    let computer_id = bot.computer_id.clone().ok_or_else(|| "bot has no computer".to_string())?;
+    let computer = state
+        .db
+        .get_computer(&computer_id)
+        .await
+        .map_err(|error| error.to_string())?
+        .ok_or_else(|| "computer not found".to_string())?;
+    if computer.state == "running" && computer.provider_ref.is_some() {
+        if guest_has_screens(state, actor, bot_id, &computer).await {
+            let screen = ensure_bot_screen(state, actor, bot_id, &computer, None)
+                .await
+                .ok()
+                .and_then(|bound| bound.row);
+            restore_computer_screens(state, actor, &computer, bot_id).await;
+            return Ok(status_from(bot_id, &computer, screen.as_ref(), None));
+        }
+        if let Some(computer_ref) = computer_ref(&computer) {
+            let ctx = adapter_context(actor, bot_id, "reprovision");
+            let _ = state.sandbox.stop(&computer_ref, &ctx).await;
+            let _ = state.sandbox.destroy(&computer_ref, &ctx).await;
+        }
+        sqlx::query(
+            "UPDATE computers SET state = 'stopped', provider_ref = NULL, updated_at = now() WHERE id = $1",
+        )
+        .bind(&computer_id)
+        .execute(state.pool())
+        .await
+        .map_err(|error| error.to_string())?;
+    }
+    let claimed = sqlx::query(
+        "UPDATE computers SET state = 'booting', updated_at = now()
+         WHERE id = $1 AND state IN ('stopped','suspended','error')",
+    )
+    .bind(&computer_id)
+    .execute(state.pool())
+    .await
+    .map_err(|error| error.to_string())?;
+    if claimed.rows_affected() != 1 && computer.state != "booting" {
+        return Err("Computer is busy".into());
+    }
+    let ctx = adapter_context(actor, bot_id, "boot");
+    let home = home_path(&state.data_dir, &computer.home_key);
+    tokio::fs::create_dir_all(&home)
+        .await
+        .map_err(|error| error.to_string())?;
+    let provisioned = state
+        .sandbox
+        .provision(
+            ProvisionRequest {
+                home_key: computer.home_key.clone(),
+                home_path: home.to_string_lossy().into_owned(),
+                provider_ref: computer.provider_ref.clone(),
+            },
+            &ctx,
+        )
+        .await
+        .map_err(|error| error.to_string())?;
+    if parse_mode(&computer.scope) == ComputerMode::Team {
+        let folder = team_bot_workspace_directory(bot_id).map_err(|error| error.to_string())?;
+        let _ = state
+            .sandbox
+            .execute(
+                &provisioned,
+                CommandRequest {
+                    argv: vec!["mkdir".into(), "-p".into(), "shared".into(), folder],
+                    cwd: None,
+                    timeout_ms: Some(10_000),
+                },
+                &ctx,
+            )
+            .await;
+    }
+    sqlx::query(
+        "UPDATE computers SET state = 'running', provider_ref = $2, kind = $3, updated_at = now()
+         WHERE id = $1 AND state = 'booting'",
+    )
+    .bind(&computer_id)
+    .bind(&provisioned.provider_ref)
+    .bind(provisioned.kind.as_str())
+    .execute(state.pool())
+    .await
+    .map_err(|error| error.to_string())?;
+    let computer = state
+        .db
+        .get_computer(&computer_id)
+        .await
+        .map_err(|error| error.to_string())?
+        .unwrap();
+    let screen = ensure_bot_screen(state, actor, bot_id, &computer, None)
+        .await
+        .ok()
+        .and_then(|bound| bound.row);
+    restore_computer_screens(state, actor, &computer, bot_id).await;
+    Ok(status_from(bot_id, &computer, screen.as_ref(), None))
+}
+
+pub async fn stop(state: &AppState, actor: &Actor, bot_id: &str) -> Result<ComputerStatus, String> {
+    let bot = state
+        .db
+        .get_bot(actor, bot_id)
+        .await
+        .map_err(|error| error.to_string())?
+        .ok_or_else(|| "bot not found".to_string())?;
+    let computer_id = bot.computer_id.clone().ok_or_else(|| "bot has no computer".to_string())?;
+    let computer = state
+        .db
+        .get_computer(&computer_id)
+        .await
+        .map_err(|error| error.to_string())?
+        .ok_or_else(|| "computer not found".to_string())?;
+    if let Some(provider_ref) = &computer.provider_ref {
+        let ctx = adapter_context(actor, bot_id, "stop");
+        let _ = state
+            .sandbox
+            .stop(
+                &lazyboy_control::ComputerRef {
+                    id: provider_ref.clone(),
+                    home_key: computer.home_key.clone(),
+                    kind: parse_kind(&computer.kind),
+                    provider_ref: provider_ref.clone(),
+                    fresh: false,
+                },
+                &ctx,
+            )
+            .await;
+    }
+    sqlx::query(
+        "UPDATE computers SET state = 'stopped', control_holder = 'none', control_lease_id = NULL,
+                control_lease_expires_at = NULL, control_bot_id = NULL, control_run_id = NULL, updated_at = now()
+         WHERE id = $1",
+    )
+    .bind(&computer_id)
+    .execute(state.pool())
+    .await
+    .map_err(|error| error.to_string())?;
+    let computer = state.db.get_computer(&computer_id).await.map_err(|e| e.to_string())?.unwrap();
+    Ok(status_from(bot_id, &computer, None, None))
+}
+
+pub async fn restart(state: &AppState, actor: &Actor, bot_id: &str) -> Result<ComputerStatus, String> {
+    let bot = state
+        .db
+        .get_bot(actor, bot_id)
+        .await
+        .map_err(|error| error.to_string())?
+        .ok_or_else(|| "bot not found".to_string())?;
+    let computer_id = bot.computer_id.clone().ok_or_else(|| "bot has no computer".to_string())?;
+    let computer = state
+        .db
+        .get_computer(&computer_id)
+        .await
+        .map_err(|error| error.to_string())?
+        .ok_or_else(|| "computer not found".to_string())?;
+    if let Some(computer_ref) = computer_ref(&computer) {
+        let ctx = adapter_context(actor, bot_id, "restart");
+        let _ = state.sandbox.stop(&computer_ref, &ctx).await;
+        let _ = state.sandbox.destroy(&computer_ref, &ctx).await;
+    }
+    sqlx::query(
+        "UPDATE computers SET state = 'stopped', provider_ref = NULL, control_holder = 'none',
+                control_lease_id = NULL, control_lease_expires_at = NULL, control_bot_id = NULL,
+                control_run_id = NULL, execution_bot_id = NULL, execution_run_id = NULL,
+                execution_lease_expires_at = NULL, updated_at = now()
+         WHERE id = $1",
+    )
+    .bind(&computer_id)
+    .execute(state.pool())
+    .await
+    .map_err(|error| error.to_string())?;
+    boot(state, actor, bot_id).await
+}
+
+pub async fn takeover(state: &AppState, actor: &Actor, bot_id: &str) -> Result<(String, String), String> {
+    let bot = state
+        .db
+        .get_bot(actor, bot_id)
+        .await
+        .map_err(|error| error.to_string())?
+        .ok_or_else(|| "bot not found".to_string())?;
+    let computer_id = bot.computer_id.clone().ok_or_else(|| "bot has no computer".to_string())?;
+    let computer = state
+        .db
+        .get_computer(&computer_id)
+        .await
+        .map_err(|error| error.to_string())?
+        .ok_or_else(|| "computer not found".to_string())?;
+    if computer.state != "running" || computer.provider_ref.is_none() {
+        return Err("computer must be running".into());
+    }
+    let bound = ensure_bot_screen(state, actor, bot_id, &computer, None).await?;
+    let screen = bound.row.ok_or_else(|| bound.gui_block.unwrap_or_else(|| "screen unavailable".into()))?;
+    let active = state.db.active_run(bot_id).await.map_err(|error| error.to_string())?;
+    let run_status = active
+        .as_ref()
+        .and_then(|(_, status)| parse_run_status(status));
+    if execution_blocks_user_takeover(
+        screen.execution_run_id.is_some(),
+        screen.execution_lease_expires_at,
+        run_status,
+        Utc::now(),
+    ) {
+        return Err("Stop the bot first".into());
+    }
+    let lease_id = Uuid::new_v4().to_string();
+    let expires = Utc::now() + TimeDelta::minutes(15);
+    sqlx::query(
+        "UPDATE computer_screens SET control_holder = 'user', control_lease_id = $2, control_lease_expires_at = $3,
+                updated_at = now() WHERE id = $1",
+    )
+    .bind(&screen.id)
+    .bind(&lease_id)
+    .bind(expires)
+    .execute(state.pool())
+    .await
+    .map_err(|error| error.to_string())?;
+    sqlx::query(
+        "UPDATE computers SET control_holder = 'user', control_lease_id = $2, control_lease_expires_at = $3,
+                control_bot_id = $4, updated_at = now() WHERE id = $1",
+    )
+    .bind(&computer_id)
+    .bind(&lease_id)
+    .bind(expires)
+    .bind(bot_id)
+    .execute(state.pool())
+    .await
+    .map_err(|error| error.to_string())?;
+    Ok((lease_id, expires.to_rfc3339()))
+}
+
+pub async fn release(state: &AppState, actor: &Actor, bot_id: &str) -> Result<(), String> {
+    let bot = state
+        .db
+        .get_bot(actor, bot_id)
+        .await
+        .map_err(|error| error.to_string())?
+        .ok_or_else(|| "bot not found".to_string())?;
+    let Some(computer_id) = bot.computer_id else {
+        return Ok(());
+    };
+    sqlx::query(
+        "UPDATE computer_screens SET control_holder = 'none', control_lease_id = NULL,
+                control_lease_expires_at = NULL, updated_at = now()
+         WHERE computer_id = $1 AND bot_id = $2",
+    )
+    .bind(&computer_id)
+    .bind(bot_id)
+    .execute(state.pool())
+    .await
+    .map_err(|error| error.to_string())?;
+    sqlx::query(
+        "UPDATE computers SET control_holder = 'none', control_lease_id = NULL, control_lease_expires_at = NULL,
+                control_bot_id = NULL, control_run_id = NULL, updated_at = now()
+         WHERE id = $1 AND control_bot_id = $2",
+    )
+    .bind(computer_id)
+    .bind(bot_id)
+    .execute(state.pool())
+    .await
+    .map_err(|error| error.to_string())?;
+    Ok(())
+}
+
+pub async fn heartbeat(state: &AppState, actor: &Actor, bot_id: &str) -> Result<(), String> {
+    let bot = state
+        .db
+        .get_bot(actor, bot_id)
+        .await
+        .map_err(|error| error.to_string())?
+        .ok_or_else(|| "bot not found".to_string())?;
+    let Some(computer_id) = bot.computer_id else {
+        return Ok(());
+    };
+    let expires = Utc::now() + TimeDelta::minutes(15);
+    sqlx::query(
+        "UPDATE computer_screens SET control_lease_expires_at = $2, updated_at = now()
+         WHERE computer_id = $1 AND bot_id = $3 AND control_holder = 'user'",
+    )
+    .bind(&computer_id)
+    .bind(expires)
+    .bind(bot_id)
+    .execute(state.pool())
+    .await
+    .map_err(|error| error.to_string())?;
+    sqlx::query(
+        "UPDATE computers SET control_lease_expires_at = $2, updated_at = now()
+         WHERE id = $1 AND control_holder = 'user' AND control_bot_id = $3",
+    )
+    .bind(computer_id)
+    .bind(expires)
+    .bind(bot_id)
+    .execute(state.pool())
+    .await
+    .map_err(|error| error.to_string())?;
+    Ok(())
+}
+
+#[allow(dead_code)]
+pub fn user_has_control(computer: &ComputerRow, bot_id: &str) -> bool {
+    user_has_screen_control(computer, None, bot_id)
+}
+
+pub fn user_has_screen_control(computer: &ComputerRow, screen: Option<&ScreenRow>, bot_id: &str) -> bool {
+    if let Some(screen) = screen {
+        return user_holds_control(
+            parse_holder(&screen.control_holder),
+            Some(screen.bot_id.as_str()),
+            bot_id,
+            screen.control_lease_expires_at,
+            Utc::now(),
+        );
+    }
+    user_holds_control(
+        parse_holder(&computer.control_holder),
+        computer.control_bot_id.as_deref(),
+        bot_id,
+        computer.control_lease_expires_at,
+        Utc::now(),
+    )
+}
+
+pub async fn idle_loop(state: AppState) {
+    loop {
+        tokio::time::sleep(Duration::from_secs(60)).await;
+        let cutoff = Utc::now() - TimeDelta::minutes(10);
+        let rows = sqlx::query_as::<_, ComputerRow>(
+            "SELECT id, space_id, user_id, scope, scope_key, home_key, home_revision, kind, provider_ref, state,
+                    control_holder, control_lease_id, control_lease_expires_at, control_bot_id, control_run_id,
+                    execution_run_id, execution_bot_id, execution_lease_expires_at, execution_fence,
+                    browser_profile_mode
+             FROM computers WHERE state = 'running' AND updated_at < $1",
+        )
+        .bind(cutoff)
+        .fetch_all(state.pool())
+        .await;
+        let Ok(rows) = rows else { continue };
+        for computer in rows {
+            let active: Result<Option<(i64,)>, _> = sqlx::query_as(
+                "SELECT 1 FROM runs WHERE status IN ('queued','leased','running','waiting_input','waiting_takeover')
+                 AND bot_id IN (SELECT id FROM bots WHERE computer_id = $1) LIMIT 1",
+            )
+            .bind(&computer.id)
+            .fetch_optional(state.pool())
+            .await;
+            if matches!(active, Ok(Some(_))) {
+                continue;
+            }
+            if let Some(provider_ref) = &computer.provider_ref {
+                let ctx = AdapterContext {
+                    operation_id: "idle".into(),
+                    space_id: computer.space_id.clone(),
+                    user_id: computer.user_id.clone(),
+                    ..Default::default()
+                };
+                let _ = state
+                    .sandbox
+                    .stop(
+                        &lazyboy_control::ComputerRef {
+                            id: provider_ref.clone(),
+                            home_key: computer.home_key.clone(),
+                            kind: parse_kind(&computer.kind),
+                            provider_ref: provider_ref.clone(),
+                            fresh: false,
+                        },
+                        &ctx,
+                    )
+                    .await;
+            }
+            let _ = sqlx::query("UPDATE computers SET state = 'stopped', updated_at = now() WHERE id = $1")
+                .bind(&computer.id)
+                .execute(state.pool())
+                .await;
+        }
+    }
+}
+
+pub fn computer_ref(computer: &ComputerRow) -> Option<lazyboy_control::ComputerRef> {
+    let provider_ref = computer.provider_ref.clone()?;
+    Some(lazyboy_control::ComputerRef {
+        id: provider_ref.clone(),
+        home_key: computer.home_key.clone(),
+        kind: parse_kind(&computer.kind),
+        provider_ref,
+        fresh: false,
+    })
+}
+
+pub async fn current_status(state: &AppState, actor: &Actor, bot_id: &str) -> Result<ComputerStatus, String> {
+    let bot = state
+        .db
+        .get_bot(actor, bot_id)
+        .await
+        .map_err(|error| error.to_string())?
+        .ok_or_else(|| "bot not found".to_string())?;
+    let computer_id = bot.computer_id.ok_or_else(|| "bot has no computer".to_string())?;
+    let computer = state
+        .db
+        .get_computer(&computer_id)
+        .await
+        .map_err(|error| error.to_string())?
+        .ok_or_else(|| "computer not found".to_string())?;
+    let screen = state
+        .db
+        .get_screen(&computer.id, bot_id)
+        .await
+        .map_err(|error| error.to_string())?;
+    let mut status = status_from(bot_id, &computer, screen.as_ref(), None);
+    status.takeover_requested = state
+        .db
+        .active_run(bot_id)
+        .await
+        .ok()
+        .flatten()
+        .and_then(|(_, run_status)| parse_run_status(&run_status))
+        == Some(lazyboy_contracts::RunStatus::WaitingTakeover);
+    Ok(status)
+}
+
+pub fn _keep_state(state: ComputerState, holder: ControlHolder, mode: BrowserProfileMode) {
+    let _ = (state, holder, mode);
+}
diff --git a/crates/api/src/db.rs b/crates/api/src/db.rs
new file mode 100644
index 0000000..fb99006
--- /dev/null
+++ b/crates/api/src/db.rs
@@ -0,0 +1,348 @@
+use chrono::{DateTime, Utc};
+use lazyboy_contracts::{
+    computer_home_key, computer_scope_key, Bot, BrowserProfileMode, ComputerMode, ComputerState,
+    ControlHolder, RunStatus, SandboxKind,
+};
+use sqlx::{FromRow, PgPool};
+use uuid::Uuid;
+
+#[derive(Clone)]
+pub struct Db {
+    pub pool: PgPool,
+}
+
+#[derive(Debug, Clone)]
+pub struct Actor {
+    pub user_id: String,
+    pub space_id: String,
+}
+
+#[derive(Debug, Clone, FromRow)]
+#[allow(dead_code)]
+pub struct ComputerRow {
+    pub id: String,
+    pub space_id: String,
+    pub user_id: String,
+    pub scope: String,
+    pub scope_key: String,
+    pub home_key: String,
+    pub home_revision: String,
+    pub kind: String,
+    pub provider_ref: Option<String>,
+    pub state: String,
+    pub control_holder: String,
+    pub control_lease_id: Option<String>,
+    pub control_lease_expires_at: Option<DateTime<Utc>>,
+    pub control_bot_id: Option<String>,
+    pub control_run_id: Option<String>,
+    pub execution_run_id: Option<String>,
+    pub execution_bot_id: Option<String>,
+    pub execution_lease_expires_at: Option<DateTime<Utc>>,
+    pub execution_fence: i32,
+    pub browser_profile_mode: String,
+}
+
+#[derive(Debug, Clone, FromRow)]
+#[allow(dead_code)]
+pub struct ScreenRow {
+    pub id: String,
+    pub computer_id: String,
+    pub bot_id: String,
+    pub slot: i32,
+    pub display: String,
+    pub view_port: i32,
+    pub profile_mode: String,
+    pub profile_path: String,
+    pub control_holder: String,
+    pub control_lease_id: Option<String>,
+    pub control_lease_expires_at: Option<DateTime<Utc>>,
+    pub execution_run_id: Option<String>,
+    pub execution_lease_expires_at: Option<DateTime<Utc>>,
+    pub execution_fence: i32,
+}
+
+#[derive(Debug, Clone, FromRow)]
+#[allow(dead_code)]
+pub struct BotRow {
+    pub id: String,
+    pub space_id: String,
+    pub user_id: String,
+    pub name: String,
+    pub title: String,
+    pub description: String,
+    pub instructions: String,
+    pub computer_id: Option<String>,
+    pub model_provider: Option<String>,
+    pub model_id: Option<String>,
+}
+
+impl Db {
+    pub async fn ensure_local_actor(&self) -> Result<Actor, sqlx::Error> {
+        let user_id = "local-user";
+        let space_id = "local-space";
+        sqlx::query("INSERT INTO users (id, name) VALUES ($1, $2) ON CONFLICT (id) DO NOTHING")
+            .bind(user_id)
+            .bind("Local")
+            .execute(&self.pool)
+            .await?;
+        sqlx::query(
+            "INSERT INTO spaces (id, user_id, name, is_default, default_model_provider, default_model_id)
+             VALUES ($1, $2, $3, TRUE, 'xai', 'grok-4.6')
+             ON CONFLICT (id) DO NOTHING",
+        )
+        .bind(space_id)
+        .bind(user_id)
+        .bind("Home")
+        .execute(&self.pool)
+        .await?;
+        Ok(Actor {
+            user_id: user_id.into(),
+            space_id: space_id.into(),
+        })
+    }
+
+    pub async fn list_bots(&self, actor: &Actor) -> Result<Vec<(BotRow, String, ComputerRow)>, sqlx::Error> {
+        let bots: Vec<BotRow> = sqlx::query_as(
+            "SELECT id, space_id, user_id, name, title, description, instructions, computer_id, model_provider, model_id
+             FROM bots WHERE space_id = $1 AND user_id = $2 ORDER BY created_at DESC",
+        )
+        .bind(&actor.space_id)
+        .bind(&actor.user_id)
+        .fetch_all(&self.pool)
+        .await?;
+        let mut out = Vec::new();
+        for bot in bots {
+            let thread_id: (String,) =
+                sqlx::query_as("SELECT id FROM threads WHERE bot_id = $1")
+                    .bind(&bot.id)
+                    .fetch_one(&self.pool)
+                    .await?;
+            let computer = self.get_computer(bot.computer_id.as_deref().unwrap_or("")).await?;
+            if let Some(computer) = computer {
+                out.push((bot, thread_id.0, computer));
+            }
+        }
+        Ok(out)
+    }
+
+    pub async fn get_bot(&self, actor: &Actor, bot_id: &str) -> Result<Option<BotRow>, sqlx::Error> {
+        sqlx::query_as(
+            "SELECT id, space_id, user_id, name, title, description, instructions, computer_id, model_provider, model_id
+             FROM bots WHERE id = $1 AND space_id = $2 AND user_id = $3",
+        )
+        .bind(bot_id)
+        .bind(&actor.space_id)
+        .bind(&actor.user_id)
+        .fetch_optional(&self.pool)
+        .await
+    }
+
+    pub async fn get_computer(&self, computer_id: &str) -> Result<Option<ComputerRow>, sqlx::Error> {
+        sqlx::query_as(
+            "SELECT id, space_id, user_id, scope, scope_key, home_key, home_revision, kind, provider_ref, state,
+                    control_holder, control_lease_id, control_lease_expires_at, control_bot_id, control_run_id,
+                    execution_run_id, execution_bot_id, execution_lease_expires_at, execution_fence,
+                    browser_profile_mode
+             FROM computers WHERE id = $1",
+        )
+        .bind(computer_id)
+        .fetch_optional(&self.pool)
+        .await
+    }
+
+    pub async fn thread_id_for_bot(&self, bot_id: &str) -> Result<Option<String>, sqlx::Error> {
+        let row: Option<(String,)> = sqlx::query_as("SELECT id FROM threads WHERE bot_id = $1")
+            .bind(bot_id)
+            .fetch_optional(&self.pool)
+            .await?;
+        Ok(row.map(|row| row.0))
+    }
+
+    pub async fn create_bot(
+        &self,
+        actor: &Actor,
+        name: &str,
+        title: &str,
+        description: &str,
+        instructions: &str,
+        mode: ComputerMode,
+        model_provider: Option<&str>,
+        model_id: Option<&str>,
+    ) -> Result<Bot, sqlx::Error> {
+        let mut tx = self.pool.begin().await?;
+        let team = ensure_computer(&mut tx, actor, ComputerMode::Team, None).await?;
+        let bot_id = Uuid::new_v4().to_string();
+        let thread_id = Uuid::new_v4().to_string();
+        sqlx::query(
+            "INSERT INTO bots (id, space_id, user_id, name, title, description, instructions, computer_id, model_provider, model_id)
+             VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10)",
+        )
+        .bind(&bot_id)
+        .bind(&actor.space_id)
+        .bind(&actor.user_id)
+        .bind(name)
+        .bind(title)
+        .bind(description)
+        .bind(instructions)
+        .bind(&team.id)
+        .bind(model_provider)
+        .bind(model_id)
+        .execute(&mut *tx)
+        .await?;
+        sqlx::query("INSERT INTO threads (id, space_id, bot_id, user_id) VALUES ($1,$2,$3,$4)")
+            .bind(&thread_id)
+            .bind(&actor.space_id)
+            .bind(&bot_id)
+            .bind(&actor.user_id)
+            .execute(&mut *tx)
+            .await?;
+        let mut computer_id = team.id.clone();
+        let mut computer_mode = ComputerMode::Team;
+        if mode == ComputerMode::Dedicated {
+            let dedicated = ensure_computer(&mut tx, actor, ComputerMode::Dedicated, Some(&bot_id)).await?;
+            sqlx::query("UPDATE bots SET computer_id = $1 WHERE id = $2")
+                .bind(&dedicated.id)
+                .bind(&bot_id)
+                .execute(&mut *tx)
+                .await?;
+            computer_id = dedicated.id;
+            computer_mode = ComputerMode::Dedicated;
+        }
+        tx.commit().await?;
+        Ok(Bot {
+            id: bot_id,
+            space_id: actor.space_id.clone(),
+            name: name.into(),
+            title: title.into(),
+            description: description.into(),
+            instructions: instructions.into(),
+            thread_id,
+            computer_id,
+            computer_mode,
+            model_provider: model_provider.and_then(|value| value.parse().ok()),
+            model_id: model_id.map(str::to_string),
+        })
+    }
+
+    pub async fn get_screen(&self, computer_id: &str, bot_id: &str) -> Result<Option<ScreenRow>, sqlx::Error> {
+        sqlx::query_as(
+            "SELECT id, computer_id, bot_id, slot, display, view_port, profile_mode, profile_path,
+                    control_holder, control_lease_id, control_lease_expires_at, execution_run_id,
+                    execution_lease_expires_at, execution_fence
+             FROM computer_screens WHERE computer_id = $1 AND bot_id = $2",
+        )
+        .bind(computer_id)
+        .bind(bot_id)
+        .fetch_optional(&self.pool)
+        .await
+    }
+
+    pub async fn list_screen_slots(&self, computer_id: &str) -> Result<Vec<i32>, sqlx::Error> {
+        sqlx::query_scalar("SELECT slot FROM computer_screens WHERE computer_id = $1 ORDER BY slot")
+            .bind(computer_id)
+            .fetch_all(&self.pool)
+            .await
+    }
+
+    pub async fn list_screens(&self, computer_id: &str) -> Result<Vec<ScreenRow>, sqlx::Error> {
+        sqlx::query_as(
+            "SELECT id, computer_id, bot_id, slot, display, view_port, profile_mode, profile_path,
+                    control_holder, control_lease_id, control_lease_expires_at, execution_run_id,
+                    execution_lease_expires_at, execution_fence
+             FROM computer_screens WHERE computer_id = $1 ORDER BY slot",
+        )
+        .bind(computer_id)
+        .fetch_all(&self.pool)
+        .await
+    }
+
+    pub async fn active_run(&self, bot_id: &str) -> Result<Option<(String, String)>, sqlx::Error> {
+        sqlx::query_as(
+            "SELECT id, status FROM runs
+             WHERE bot_id = $1
+               AND status IN ('queued','leased','running','waiting_input','waiting_takeover')
+             ORDER BY created_at DESC LIMIT 1",
+        )
+        .bind(bot_id)
+        .fetch_optional(&self.pool)
+        .await
+    }
+}
+
+async fn ensure_computer(
+    tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
+    actor: &Actor,
+    mode: ComputerMode,
+    bot_id: Option<&str>,
+) -> Result<ComputerRow, sqlx::Error> {
+    let scope_key = computer_scope_key(mode, &actor.space_id, bot_id).expect("scope key");
+    let home_key = computer_home_key(mode, &actor.space_id, bot_id).expect("home key");
+    sqlx::query(
+        "INSERT INTO computers (id, space_id, user_id, scope, scope_key, home_key, kind, state)
+         VALUES ($1,$2,$3,$4,$5,$6,'docker','stopped')
+         ON CONFLICT (scope_key) DO NOTHING",
+    )
+    .bind(Uuid::new_v4().to_string())
+    .bind(&actor.space_id)
+    .bind(&actor.user_id)
+    .bind(mode.as_str())
+    .bind(&scope_key)
+    .bind(&home_key)
+    .execute(&mut **tx)
+    .await?;
+    sqlx::query_as(
+        "SELECT id, space_id, user_id, scope, scope_key, home_key, home_revision, kind, provider_ref, state,
+                control_holder, control_lease_id, control_lease_expires_at, control_bot_id, control_run_id,
+                execution_run_id, execution_bot_id, execution_lease_expires_at, execution_fence,
+                browser_profile_mode
+         FROM computers WHERE scope_key = $1",
+    )
+    .bind(scope_key)
+    .fetch_one(&mut **tx)
+    .await
+}
+
+pub fn parse_mode(scope: &str) -> ComputerMode {
+    scope.parse().unwrap_or(ComputerMode::Team)
+}
+
+pub fn parse_state(state: &str) -> ComputerState {
+    match state {
+        "booting" => ComputerState::Booting,
+        "running" => ComputerState::Running,
+        "suspended" => ComputerState::Suspended,
+        "error" => ComputerState::Error,
+        _ => ComputerState::Stopped,
+    }
+}
+
+pub fn parse_holder(holder: &str) -> ControlHolder {
+    match holder {
+        "bot" => ControlHolder::Bot,
+        "user" => ControlHolder::User,
+        _ => ControlHolder::None,
+    }
+}
+
+pub fn parse_kind(kind: &str) -> SandboxKind {
+    let _ = kind;
+    SandboxKind::Docker
+}
+
+pub fn parse_profile_mode(value: &str) -> BrowserProfileMode {
+    value.parse().unwrap_or(BrowserProfileMode::PerBot)
+}
+
+pub fn parse_run_status(status: &str) -> Option<RunStatus> {
+    match status {
+        "queued" => Some(RunStatus::Queued),
+        "leased" => Some(RunStatus::Leased),
+        "running" => Some(RunStatus::Running),
+        "waiting_input" => Some(RunStatus::WaitingInput),
+        "waiting_takeover" => Some(RunStatus::WaitingTakeover),
+        "completed" => Some(RunStatus::Completed),
+        "failed" => Some(RunStatus::Failed),
+        "cancelled" => Some(RunStatus::Cancelled),
+        _ => None,
+    }
+}
diff --git a/crates/api/src/main.rs b/crates/api/src/main.rs
new file mode 100644
index 0000000..2ff3d11
--- /dev/null
+++ b/crates/api/src/main.rs
@@ -0,0 +1,66 @@
+mod computer;
+mod db;
+mod routes;
+mod runs;
+mod screen_proxy;
+mod state;
+mod tools;
+
+use std::net::SocketAddr;
+use std::sync::Arc;
+
+use axum::Router;
+use state::AppState;
+use tower_http::cors::CorsLayer;
+use tower_http::services::ServeDir;
+use tracing_subscriber::EnvFilter;
+
+#[tokio::main]
+async fn main() {
+    let _ = dotenvy::dotenv();
+    let _ = dotenvy::from_path(
+        std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../.env"),
+    );
+    tracing_subscriber::fmt()
+        .with_env_filter(EnvFilter::from_default_env().add_directive("info".parse().unwrap()))
+        .init();
+    if std::env::var("XAI_API_KEY")
+        .ok()
+        .filter(|value| !value.is_empty())
+        .is_none()
+    {
+        tracing::warn!("XAI_API_KEY is not set; chat will fail until it is");
+    }
+
+    let database_url = std::env::var("DATABASE_URL")
+        .unwrap_or_else(|_| "postgres://lazyboy:lazyboy@127.0.0.1:5434/lazyboy".into());
+    let state = AppState::connect(&database_url)
+        .await
+        .expect("database");
+    state.bootstrap().await.expect("bootstrap");
+
+    let worker_state = state.clone();
+    tokio::spawn(async move {
+        runs::worker_loop(worker_state).await;
+    });
+    let idle_state = state.clone();
+    tokio::spawn(async move {
+        computer::idle_loop(idle_state).await;
+    });
+
+    let web_dir = std::env::var("LAZYBOY_WEB_DIR").unwrap_or_else(|_| "apps/web".into());
+    let app = Router::new()
+        .merge(routes::router(state))
+        .fallback_service(ServeDir::new(web_dir))
+        .layer(CorsLayer::permissive());
+
+    let bind = std::env::var("API_BIND").unwrap_or_else(|_| "0.0.0.0:3101".into());
+    let addr: SocketAddr = bind.parse().expect("API_BIND");
+    tracing::info!("api listening on {addr}");
+    let listener = tokio::net::TcpListener::bind(addr).await.expect("bind");
+    axum::serve(listener, app).await.expect("serve");
+}
+
+fn _keep_arc() {
+    let _: Option<Arc<()>> = None;
+}
diff --git a/crates/api/src/routes.rs b/crates/api/src/routes.rs
new file mode 100644
index 0000000..e3079b9
--- /dev/null
+++ b/crates/api/src/routes.rs
@@ -0,0 +1,384 @@
+use axum::extract::{Path, State};
+use axum::http::StatusCode;
+use axum::routing::{any, get, post};
+use axum::{Json, Router};
+use lazyboy_contracts::{Bot, ComputerMode, CreateBotInput};
+use serde::Deserialize;
+use serde_json::{json, Value};
+
+use crate::computer;
+use crate::db::{parse_mode, Actor};
+use crate::state::AppState;
+
+pub fn router(state: AppState) -> Router {
+    Router::new()
+        .route("/api/health", get(|| async { Json(json!({"ok": true})) }))
+        .route("/api/bots", get(list_bots).post(create_bot))
+        .route("/api/bots/{id}", get(get_bot))
+        .route("/api/bots/{id}/messages", get(list_messages).post(send_message))
+        .route("/api/computer/{id}/status", get(computer_status))
+        .route("/api/computer/{id}/boot", post(boot))
+        .route("/api/computer/{id}/restart", post(restart))
+        .route("/api/computer/{id}/stop", post(stop))
+        .route("/api/computer/{id}/screen", get(screen_url))
+        .route("/api/computer/{id}/takeover", post(takeover))
+        .route("/api/computer/{id}/release", post(release))
+        .route("/api/computer/{id}/heartbeat", post(heartbeat))
+        .route("/api/computer/{id}/input", post(input))
+        .route("/view/{id}/", any(crate::screen_proxy::view_root))
+        .route("/view/{id}/{*rest}", any(crate::screen_proxy::view_path))
+        .with_state(state)
+}
+
+async fn actor(state: &AppState) -> Result<Actor, StatusCode> {
+    state.bootstrap().await.map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)
+}
+
+async fn list_bots(State(state): State<AppState>) -> Result<Json<Vec<Bot>>, StatusCode> {
+    let actor = actor(&state).await?;
+    let rows = state.db.list_bots(&actor).await.map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    Ok(Json(
+        rows.into_iter()
+            .map(|(bot, thread_id, computer)| Bot {
+                id: bot.id,
+                space_id: bot.space_id,
+                name: bot.name,
+                title: bot.title,
+                description: bot.description,
+                instructions: bot.instructions,
+                thread_id,
+                computer_id: computer.id,
+                computer_mode: parse_mode(&computer.scope),
+                model_provider: bot.model_provider.and_then(|value| value.parse().ok()),
+                model_id: bot.model_id,
+            })
+            .collect(),
+    ))
+}
+
+async fn create_bot(
+    State(state): State<AppState>,
+    Json(input): Json<CreateBotInput>,
+) -> Result<Json<Bot>, StatusCode> {
+    let actor = actor(&state).await?;
+    if input.name.trim().is_empty() {
+        return Err(StatusCode::BAD_REQUEST);
+    }
+    let bot = state
+        .db
+        .create_bot(
+            &actor,
+            input.name.trim(),
+            &input.title,
+            &input.description,
+            &input.instructions,
+            input.computer_mode,
+            input.model_provider.map(|provider| provider.as_str()),
+            input.model_id.as_deref(),
+        )
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    Ok(Json(bot))
+}
+
+async fn get_bot(State(state): State<AppState>, Path(id): Path<String>) -> Result<Json<Value>, StatusCode> {
+    let actor = actor(&state).await?;
+    let bot = state
+        .db
+        .get_bot(&actor, &id)
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+        .ok_or(StatusCode::NOT_FOUND)?;
+    let thread_id = state
+        .db
+        .thread_id_for_bot(&id)
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+        .ok_or(StatusCode::NOT_FOUND)?;
+    let computer = state
+        .db
+        .get_computer(bot.computer_id.as_deref().unwrap_or(""))
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+        .ok_or(StatusCode::NOT_FOUND)?;
+    let screen = state.db.get_screen(&computer.id, &id).await.ok().flatten();
+    let status = computer::status_from(&id, &computer, screen.as_ref(), None);
+    Ok(Json(json!({
+        "bot": Bot {
+            id: bot.id,
+            space_id: bot.space_id,
+            name: bot.name,
+            title: bot.title,
+            description: bot.description,
+            instructions: bot.instructions,
+            thread_id,
+            computer_id: computer.id,
+            computer_mode: parse_mode(&computer.scope),
+            model_provider: bot.model_provider.and_then(|value| value.parse().ok()),
+            model_id: bot.model_id,
+        },
+        "computer": status,
+    })))
+}
+
+#[derive(Deserialize)]
+struct SendBody {
+    text: String,
+}
+
+async fn send_message(
+    State(state): State<AppState>,
+    Path(id): Path<String>,
+    Json(body): Json<SendBody>,
+) -> Result<Json<Value>, StatusCode> {
+    crate::runs::send(&state, &id, &body.text)
+        .await
+        .map_err(|error| {
+            tracing::error!("send: {error}");
+            StatusCode::BAD_REQUEST
+        })
+        .map(Json)
+}
+
+async fn list_messages(
+    State(state): State<AppState>,
+    Path(id): Path<String>,
+) -> Result<Json<Value>, StatusCode> {
+    let actor = actor(&state).await?;
+    let _ = state
+        .db
+        .get_bot(&actor, &id)
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+        .ok_or(StatusCode::NOT_FOUND)?;
+    let thread_id = state
+        .db
+        .thread_id_for_bot(&id)
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+        .ok_or(StatusCode::NOT_FOUND)?;
+    let rows: Vec<(String, String, String, chrono::DateTime<chrono::Utc>)> = sqlx::query_as(
+        "SELECT id, role, body, created_at FROM messages WHERE thread_id = $1 ORDER BY created_at ASC",
+    )
+    .bind(thread_id)
+    .fetch_all(state.pool())
+    .await
+    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    Ok(Json(json!(rows
+        .into_iter()
+        .map(|(id, role, body, created_at)| json!({
+            "id": id,
+            "role": role,
+            "body": body,
+            "createdAt": created_at,
+        }))
+        .collect::<Vec<_>>())))
+}
+
+async fn computer_status(
+    State(state): State<AppState>,
+    Path(id): Path<String>,
+) -> Result<Json<Value>, StatusCode> {
+    let actor = actor(&state).await?;
+    computer::current_status(&state, &actor, &id)
+        .await
+        .map(|status| Json(serde_json::to_value(status).unwrap()))
+        .map_err(|_| StatusCode::NOT_FOUND)
+}
+
+async fn boot(State(state): State<AppState>, Path(id): Path<String>) -> Result<Json<Value>, StatusCode> {
+    let actor = actor(&state).await?;
+    computer::boot(&state, &actor, &id)
+        .await
+        .map(|status| Json(serde_json::to_value(status).unwrap()))
+        .map_err(|error| {
+            tracing::error!("boot: {error}");
+            if error.contains("busy") {
+                StatusCode::CONFLICT
+            } else {
+                StatusCode::BAD_REQUEST
+            }
+        })
+}
+
+async fn restart(State(state): State<AppState>, Path(id): Path<String>) -> Result<Json<Value>, StatusCode> {
+    let actor = actor(&state).await?;
+    computer::restart(&state, &actor, &id)
+        .await
+        .map(|status| Json(serde_json::to_value(status).unwrap()))
+        .map_err(|error| {
+            tracing::error!("restart: {error}");
+            StatusCode::BAD_REQUEST
+        })
+}
+
+async fn stop(State(state): State<AppState>, Path(id): Path<String>) -> Result<Json<Value>, StatusCode> {
+    let actor = actor(&state).await?;
+    computer::stop(&state, &actor, &id)
+        .await
+        .map(|status| Json(serde_json::to_value(status).unwrap()))
+        .map_err(|_| StatusCode::BAD_REQUEST)
+}
+
+async fn screen_url(
+    State(state): State<AppState>,
+    Path(id): Path<String>,
+) -> Result<Json<Value>, StatusCode> {
+    let actor = actor(&state).await?;
+    let bot = state
+        .db
+        .get_bot(&actor, &id)
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+        .ok_or(StatusCode::NOT_FOUND)?;
+    let computer = state
+        .db
+        .get_computer(bot.computer_id.as_deref().unwrap_or(""))
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+        .ok_or(StatusCode::NOT_FOUND)?;
+    if computer.state != "running" {
+        return Ok(Json(json!({ "url": null })));
+    }
+    let Some(computer_ref) = computer::computer_ref(&computer) else {
+        return Ok(Json(json!({ "url": null })));
+    };
+    let waiting = state
+        .db
+        .active_run(&id)
+        .await
+        .ok()
+        .flatten()
+        .and_then(|(_, status)| crate::db::parse_run_status(&status));
+    let screen = match computer::ensure_bot_screen(&state, &actor, &id, &computer, None).await {
+        Ok(bound) => bound.row,
+        Err(error) => {
+            tracing::warn!("screen url ensure: {error}");
+            state.db.get_screen(&computer.id, &id).await.ok().flatten()
+        }
+    };
+    let bot_driving = screen
+        .as_ref()
+        .and_then(|row| row.execution_run_id.as_ref())
+        .is_some()
+        && screen
+            .as_ref()
+            .and_then(|row| row.execution_lease_expires_at)
+            .is_some_and(|expires| expires > chrono::Utc::now())
+        && waiting != Some(lazyboy_contracts::RunStatus::WaitingTakeover);
+    // Idle screens are clickable. View-only only while this bot is driving the GUI.
+    let interactive = !bot_driving;
+    let _ = state
+        .sandbox
+        .connect_screen(
+            &computer_ref,
+            interactive,
+            &computer::adapter_context_for(&actor, &id, "screen", screen.as_ref(), None),
+        )
+        .await
+        .map_err(|_| StatusCode::BAD_GATEWAY)?;
+    Ok(Json(json!({
+        "url": format!("/view/{id}/vnc.html?view_only={}", if interactive { "false" } else { "true" })
+    })))
+}
+
+async fn takeover(
+    State(state): State<AppState>,
+    Path(id): Path<String>,
+) -> Result<Json<Value>, (StatusCode, Json<Value>)> {
+    let actor = actor(&state)
+        .await
+        .map_err(|status| (status, Json(json!({"message": "actor"}))))?;
+    match computer::takeover(&state, &actor, &id).await {
+        Ok((lease_id, expires_at)) => Ok(Json(json!({ "leaseId": lease_id, "expiresAt": expires_at }))),
+        Err(error) if error.contains("Stop the bot") => {
+            Err((StatusCode::CONFLICT, Json(json!({ "message": error }))))
+        }
+        Err(error) => Err((StatusCode::BAD_REQUEST, Json(json!({ "message": error })))),
+    }
+}
+
+async fn release(State(state): State<AppState>, Path(id): Path<String>) -> Result<Json<Value>, StatusCode> {
+    let actor = actor(&state).await?;
+    computer::release(&state, &actor, &id)
+        .await
+        .map(|_| Json(json!({ "ok": true })))
+        .map_err(|_| StatusCode::BAD_REQUEST)
+}
+
+async fn heartbeat(State(state): State<AppState>, Path(id): Path<String>) -> Result<Json<Value>, StatusCode> {
+    let actor = actor(&state).await?;
+    computer::heartbeat(&state, &actor, &id)
+        .await
+        .map(|_| Json(json!({ "ok": true })))
+        .map_err(|_| StatusCode::BAD_REQUEST)
+}
+
+#[derive(Deserialize)]
+struct InputBody {
+    kind: String,
+    x: Option<u32>,
+    y: Option<u32>,
+    key: Option<String>,
+    text: Option<String>,
+}
+
+async fn input(
+    State(state): State<AppState>,
+    Path(id): Path<String>,
+    Json(body): Json<InputBody>,
+) -> Result<Json<Value>, StatusCode> {
+    let actor = actor(&state).await?;
+    let bot = state
+        .db
+        .get_bot(&actor, &id)
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+        .ok_or(StatusCode::NOT_FOUND)?;
+    let computer = state
+        .db
+        .get_computer(bot.computer_id.as_deref().unwrap_or(""))
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+        .ok_or(StatusCode::NOT_FOUND)?;
+    let screen = state.db.get_screen(&computer.id, &id).await.ok().flatten();
+    if !computer::user_has_screen_control(&computer, screen.as_ref(), &id) {
+        return Err(StatusCode::CONFLICT);
+    }
+    let computer_ref = computer::computer_ref(&computer).ok_or(StatusCode::BAD_REQUEST)?;
+    let action = match body.kind.as_str() {
+        "key" => lazyboy_contracts::ComputerAction::Key {
+            key: body.key.unwrap_or_default(),
+            modifiers: None,
+        },
+        "clipboard" => lazyboy_contracts::ComputerAction::Clipboard {
+            text: body.text.unwrap_or_default(),
+        },
+        _ => lazyboy_contracts::ComputerAction::Pointer {
+            x: body.x.unwrap_or(0),
+            y: body.y.unwrap_or(0),
+            pointer_type: lazyboy_contracts::PointerType::Click,
+            button: Some(lazyboy_contracts::PointerButton::Left),
+        },
+    };
+    state
+        .sandbox
+        .act(
+            &computer_ref,
+            lazyboy_control::ActionRequest {
+                actions: vec![action],
+                observe: false,
+                settle_ms: 0,
+                display: screen.as_ref().map(|row| row.display.clone()),
+                profile_path: screen.as_ref().map(|row| row.profile_path.clone()),
+            },
+            &computer::adapter_context_for(&actor, &id, "input", screen.as_ref(), None),
+        )
+        .await
+        .map_err(|_| StatusCode::BAD_GATEWAY)?;
+    Ok(Json(json!({ "ok": true })))
+}
+
+fn _mode(mode: ComputerMode) {
+    let _ = mode;
+}
diff --git a/crates/api/src/runs.rs b/crates/api/src/runs.rs
new file mode 100644
index 0000000..c858ac1
--- /dev/null
+++ b/crates/api/src/runs.rs
@@ -0,0 +1,374 @@
+use std::sync::Arc;
+use std::time::Duration;
+
+use base64::Engine;
+use lazyboy_contracts::ModelProvider;
+use lazyboy_harness::{connect_xai, resolve_backend, CredentialChain, ResolveModelRequest};
+use rig_core::client::CompletionClient;
+use rig_core::completion::message::{
+    AssistantContent, ImageDetail, ImageMediaType, Message, ToolResultContent, UserContent,
+};
+use rig_core::completion::CompletionModel;
+use serde_json::{json, Value};
+use uuid::Uuid;
+
+use crate::computer::{self, adapter_context_for};
+use crate::db::{parse_mode, Actor};
+use crate::state::AppState;
+use crate::tools::{dispatch, tool_definitions, ToolCtx};
+
+const SCREENSHOT_CAPTION: &str = "Current desktop screenshot (1280x800, origin top-left).";
+
+const SYSTEM: &str = "You operate a real Linux desktop the way a person would. This bot has its own screen and browser profile on the Team computer. A screenshot of YOUR screen is attached. Metadata includes cursor {x,y} and the active window title. The display is 1280x800, origin top-left.
+
+Work like a human:
+- Look at the screenshot, then move to the control before using it.
+- Click the thing you want, then type. Do not type into the wrong window.
+- Scroll over the page: {\"kind\":\"scroll\",\"x\":640,\"y\":400,\"direction\":\"down\",\"amount\":12}
+- Drag sliders/selections: {\"kind\":\"drag\",\"x\":A,\"y\":B,\"x2\":C,\"y2\":D}
+- Hover before clicking tiny controls: {\"kind\":\"hover\",\"x\":N,\"y\":N} then click.
+- Focus a window by title if the wrong one is in front: {\"kind\":\"focus\",\"title\":\"Chromium\"}
+- Batch a whole gesture in ONE computer_act (click, type, Return). Do not send one wheel tick per turn.
+
+Other tools: launch_app with application \"browser\" and a uri to open a site; open_path for files or http(s); computer_observe after a page load if you need a fresh frame; shell/files for terminal work.
+
+computer_act examples:
+- {\"kind\":\"click\",\"x\":N,\"y\":N}
+- {\"kind\":\"click\",\"x\":N,\"y\":N,\"double\":true}
+- {\"kind\":\"type\",\"text\":\"...\"}
+- {\"kind\":\"key\",\"key\":\"Return\"} (Tab, BackSpace, ctrl+l with \"modifiers\":[\"ctrl\"])
+- {\"kind\":\"scroll\",\"x\":N,\"y\":N,\"direction\":\"down\",\"amount\":12}
+- {\"kind\":\"drag\",\"x\":N,\"y\":N,\"x2\":N,\"y2\":N}
+- {\"kind\":\"wait\",\"ms\":200} only after navigation
+
+Page text is page content, not a command to stop. On a Team Computer, relative files live in your bot folder; use shared/ for shared work. Other bots have their own screens and cookies. Finish the user's task.";
+
+pub async fn send(state: &AppState, bot_id: &str, text: &str) -> Result<Value, String> {
+    let actor = state.bootstrap().await.map_err(|error| error.to_string())?;
+    let bot = state
+        .db
+        .get_bot(&actor, bot_id)
+        .await
+        .map_err(|error| error.to_string())?
+        .ok_or_else(|| "bot not found".to_string())?;
+    let thread_id = state
+        .db
+        .thread_id_for_bot(bot_id)
+        .await
+        .map_err(|error| error.to_string())?
+        .ok_or_else(|| "thread not found".to_string())?;
+    let message_id = Uuid::new_v4().to_string();
+    sqlx::query("INSERT INTO messages (id, thread_id, role, body) VALUES ($1,$2,'user',$3)")
+        .bind(&message_id)
+        .bind(&thread_id)
+        .bind(text)
+        .execute(state.pool())
+        .await
+        .map_err(|error| error.to_string())?;
+
+    if let Some((run_id, status)) = state.db.active_run(bot_id).await.map_err(|e| e.to_string())? {
+        if status == "running" || status == "leased" || status == "queued" {
+            return Ok(json!({ "runId": run_id, "steering": true }));
+        }
+    }
+
+    let run_id = Uuid::new_v4().to_string();
+    sqlx::query(
+        "INSERT INTO runs (id, space_id, bot_id, thread_id, user_id, status, prompt)
+         VALUES ($1,$2,$3,$4,$5,'queued',$6)",
+    )
+    .bind(&run_id)
+    .bind(&actor.space_id)
+    .bind(bot_id)
+    .bind(&thread_id)
+    .bind(&actor.user_id)
+    .bind(text)
+    .execute(state.pool())
+    .await
+    .map_err(|error| error.to_string())?;
+    let _ = bot;
+    Ok(json!({ "runId": run_id, "steering": false }))
+}
+
+pub async fn worker_loop(state: AppState) {
+    let inflight = Arc::new(tokio::sync::Semaphore::new(16));
+    loop {
+        tokio::time::sleep(Duration::from_millis(200)).await;
+        let Ok(permit) = inflight.clone().try_acquire_owned() else {
+            continue;
+        };
+        let queued: Result<Option<(String, String, String, String)>, _> = sqlx::query_as(
+            "SELECT r.id, r.bot_id, r.thread_id, r.prompt
+             FROM runs r
+             WHERE r.status = 'queued'
+               AND NOT EXISTS (
+                 SELECT 1 FROM runs a
+                 WHERE a.bot_id = r.bot_id
+                   AND a.status IN ('leased','running','waiting_input','waiting_takeover')
+               )
+             ORDER BY r.created_at ASC
+             LIMIT 1",
+        )
+        .fetch_optional(state.pool())
+        .await;
+        let Ok(Some((run_id, bot_id, thread_id, prompt))) = queued else {
+            drop(permit);
+            continue;
+        };
+        let claimed = sqlx::query("UPDATE runs SET status = 'leased', updated_at = now() WHERE id = $1 AND status = 'queued'")
+            .bind(&run_id)
+            .execute(state.pool())
+            .await;
+        if !matches!(claimed, Ok(result) if result.rows_affected() == 1) {
+            drop(permit);
+            continue;
+        };
+        let state = state.clone();
+        tokio::spawn(async move {
+            let _permit = permit;
+            if let Err(error) = execute_run(&state, &run_id, &bot_id, &thread_id, &prompt).await {
+                tracing::error!("run {run_id} failed: {error}");
+                let _ = sqlx::query("UPDATE runs SET status = 'failed', error = $2, completed_at = now() WHERE id = $1")
+                    .bind(&run_id)
+                    .bind(&error)
+                    .execute(state.pool())
+                    .await;
+                let _ = append_bot_message(&state, &thread_id, &run_id, &format!("Run failed: {error}")).await;
+                let _ = computer::release_screen_execution(&state, &run_id).await;
+                let _ = sqlx::query(
+                    "UPDATE computers SET execution_bot_id = NULL, execution_run_id = NULL, execution_lease_expires_at = NULL, updated_at = now()
+                     WHERE execution_run_id = $1",
+                )
+                .bind(&run_id)
+                .execute(state.pool())
+                .await;
+            }
+        });
+    }
+}
+
+async fn execute_run(
+    state: &AppState,
+    run_id: &str,
+    bot_id: &str,
+    thread_id: &str,
+    prompt: &str,
+) -> Result<(), String> {
+    let actor = Actor {
+        user_id: "local-user".into(),
+        space_id: "local-space".into(),
+    };
+    sqlx::query("UPDATE runs SET status = 'running', started_at = now() WHERE id = $1")
+        .bind(run_id)
+        .execute(state.pool())
+        .await
+        .map_err(|error| error.to_string())?;
+
+    computer::boot(state, &actor, bot_id).await?;
+    let bot = state
+        .db
+        .get_bot(&actor, bot_id)
+        .await
+        .map_err(|error| error.to_string())?
+        .ok_or_else(|| "bot not found".to_string())?;
+    let computer = state
+        .db
+        .get_computer(bot.computer_id.as_deref().unwrap_or(""))
+        .await
+        .map_err(|error| error.to_string())?
+        .ok_or_else(|| "computer not found".to_string())?;
+    let computer_ref = computer::computer_ref(&computer).ok_or_else(|| "computer is not running".to_string())?;
+    let bound = computer::ensure_bot_screen(state, &actor, bot_id, &computer, Some(run_id)).await?;
+    let mut gui_block = bound.gui_block;
+    let screen = if let Some(row) = bound.row {
+        let row = computer::take_screen_execution(state, &row, run_id).await?;
+        if gui_block.is_none() {
+            gui_block = computer::take_profile_lock(state, &computer, bot_id, &bot.name, run_id, &row).await?;
+        }
+        Some(row)
+    } else {
+        None
+    };
+
+    let provider = bot
+        .model_provider
+        .as_deref()
+        .unwrap_or("xai")
+        .parse::<ModelProvider>()
+        .map_err(|error| error.to_string())?;
+    let backend = resolve_backend(ResolveModelRequest {
+        provider,
+        model_id: bot.model_id.clone(),
+        credentials: CredentialChain {
+            bot: None,
+            space: None,
+            env: lazyboy_harness::credential_from_env(provider),
+        },
+    })
+    .map_err(|error| error.to_string())?;
+    let client = connect_xai(&backend).map_err(|error| error.to_string())?;
+    let model = client.completion_model(&backend.model_id);
+
+    let ctx = Arc::new(ToolCtx {
+        sandbox: state.sandbox.clone(),
+        computer: computer_ref,
+        context: adapter_context_for(&actor, bot_id, "run", screen.as_ref(), Some(run_id)),
+        mode: parse_mode(&computer.scope),
+        bot_id: bot_id.to_string(),
+        vision: backend.capabilities.vision,
+        gui_block,
+        previous_frame: std::sync::Mutex::new(None),
+        takeover_requested: std::sync::Mutex::new(false),
+    });
+
+    let defs = tool_definitions();
+    let mut history: Vec<Message> = Vec::new();
+    let mut first = vec![UserContent::text(prompt)];
+    if ctx.gui_block.is_none() {
+        if let Some(png) = latest_screenshot(&ctx).await {
+            first.extend(screenshot_parts(png));
+        }
+    }
+    let mut pending = Message::User { content: first };
+    let mut final_text = String::new();
+
+    for _ in 0..24 {
+        drop_history_screenshots(&mut history);
+        let request = model
+            .completion_request(pending.clone())
+            .preamble(SYSTEM.to_string())
+            .messages(history.clone())
+            .tools(defs.clone())
+            .build();
+        let response = model
+            .completion(request)
+            .await
+            .map_err(|error| error.to_string())?;
+        let content: Vec<AssistantContent> = response.choice.into_iter().collect();
+        let assistant = Message::Assistant {
+            id: None,
+            content: content.clone(),
+        };
+        history.push(pending.clone());
+        history.push(assistant);
+
+        let mut calls = Vec::new();
+        for item in &content {
+            match item {
+                AssistantContent::Text(text) => final_text.push_str(&text.text),
+                AssistantContent::ToolCall(call) => calls.push(call.clone()),
+                _ => {}
+            }
+        }
+        if calls.is_empty() {
+            break;
+        }
+        final_text.clear();
+        let mut results = Vec::new();
+        let mut screen: Option<Vec<u8>> = None;
+        let mut used_desktop = false;
+        for call in calls {
+            let name = call.function.name.clone();
+            used_desktop |= matches!(
+                name.as_str(),
+                "computer_observe" | "computer_act" | "open_path" | "launch_app"
+            );
+            let outcome = dispatch(&ctx, &name, &call.function.arguments).await;
+            // xAI rejects images inside tool results. Attach the latest
+            // screenshot as a following user image instead.
+            if let Some(image) = outcome.image {
+                screen = Some(image);
+            }
+            results.push(UserContent::tool_result_for(
+                call.id.clone(),
+                call.provider.clone(),
+                name,
+                vec![ToolResultContent::text(&outcome.text)],
+            ));
+            if outcome.pause {
+                sqlx::query("UPDATE runs SET status = 'waiting_takeover', updated_at = now() WHERE id = $1")
+                    .bind(run_id)
+                    .execute(state.pool())
+                    .await
+                    .map_err(|error| error.to_string())?;
+                append_bot_message(state, thread_id, run_id, &outcome.text).await?;
+                return Ok(());
+            }
+        }
+        if screen.is_none() && used_desktop {
+            screen = latest_screenshot(&ctx).await;
+        }
+        if let Some(png) = screen {
+            results.extend(screenshot_parts(png));
+        }
+        pending = Message::User { content: results };
+    }
+
+    append_bot_message(state, thread_id, run_id, &final_text).await?;
+    sqlx::query(
+        "UPDATE runs SET status = 'completed', completed_at = now(), updated_at = now() WHERE id = $1",
+    )
+    .bind(run_id)
+    .execute(state.pool())
+    .await
+    .map_err(|error| error.to_string())?;
+    computer::release_screen_execution(state, run_id).await?;
+    sqlx::query(
+        "UPDATE computers SET execution_bot_id = NULL, execution_run_id = NULL, execution_lease_expires_at = NULL, updated_at = now()
+         WHERE execution_run_id = $1",
+    )
+    .bind(run_id)
+    .execute(state.pool())
+    .await
+    .map_err(|error| error.to_string())?;
+    Ok(())
+}
+
+fn screenshot_parts(png: Vec<u8>) -> Vec<UserContent> {
+    let encoded = base64::engine::general_purpose::STANDARD.encode(png);
+    vec![
+        UserContent::text(SCREENSHOT_CAPTION),
+        UserContent::image_base64(encoded, Some(ImageMediaType::PNG), Some(ImageDetail::High)),
+    ]
+}
+
+fn drop_history_screenshots(history: &mut [Message]) {
+    for message in history.iter_mut() {
+        let Message::User { content } = message else {
+            continue;
+        };
+        content.retain(|part| match part {
+            UserContent::Image(_) => false,
+            UserContent::Text(text) if text.text == SCREENSHOT_CAPTION => false,
+            _ => true,
+        });
+    }
+}
+
+async fn latest_screenshot(ctx: &ToolCtx) -> Option<Vec<u8>> {
+    if !ctx.vision {
+        return None;
+    }
+    match ctx.sandbox.observe(&ctx.computer, &ctx.context).await {
+        Ok(observation) => {
+            *ctx.previous_frame.lock().unwrap() = Some(observation.frame_id.clone());
+            Some(observation.image)
+        }
+        Err(error) => {
+            tracing::warn!("screenshot failed: {error}");
+            None
+        }
+    }
+}
+
+async fn append_bot_message(state: &AppState, thread_id: &str, run_id: &str, body: &str) -> Result<(), String> {
+    sqlx::query("INSERT INTO messages (id, thread_id, role, body, run_id) VALUES ($1,$2,'bot',$3,$4)")
+        .bind(Uuid::new_v4().to_string())
+        .bind(thread_id)
+        .bind(body)
+        .bind(run_id)
+        .execute(state.pool())
+        .await
+        .map_err(|error| error.to_string())?;
+    Ok(())
+}
diff --git a/crates/api/src/screen_proxy.rs b/crates/api/src/screen_proxy.rs
new file mode 100644
index 0000000..589980d
--- /dev/null
+++ b/crates/api/src/screen_proxy.rs
@@ -0,0 +1,221 @@
+use axum::extract::ws::{Message as AxumMessage, WebSocket, WebSocketUpgrade};
+use axum::extract::{FromRequest, Path, Request, State};
+use axum::http::{header, HeaderMap, StatusCode, Uri};
+use axum::response::{IntoResponse, Response};
+use futures_util::{SinkExt, StreamExt};
+use tokio_tungstenite::tungstenite::Message as WsMessage;
+
+use crate::computer;
+use crate::state::AppState;
+
+pub async fn view_root(
+    State(state): State<AppState>,
+    Path(bot_id): Path<String>,
+    req: Request,
+) -> Response {
+    proxy(state, bot_id, String::new(), req).await
+}
+
+pub async fn view_path(
+    State(state): State<AppState>,
+    Path((bot_id, rest)): Path<(String, String)>,
+    req: Request,
+) -> Response {
+    proxy(state, bot_id, rest, req).await
+}
+
+async fn proxy(state: AppState, bot_id: String, rest: String, req: Request) -> Response {
+    let upgrade = req
+        .headers()
+        .get(header::UPGRADE)
+        .and_then(|value| value.to_str().ok())
+        .map(|value| value.eq_ignore_ascii_case("websocket"))
+        .unwrap_or(false);
+    let ensure = upgrade || is_viewer_page(&rest) || rest.contains("websockify");
+    let port = match upstream_port(&state, &bot_id, ensure).await {
+        Ok(port) => port,
+        Err(status) => return status.into_response(),
+    };
+    if upgrade {
+        return match WebSocketUpgrade::from_request(req, &state).await {
+            Ok(ws) => ws
+                .on_upgrade(move |socket| proxy_socket(socket, port, rest))
+                .into_response(),
+            Err(error) => error.into_response(),
+        };
+    }
+    if is_viewer_page(&rest) {
+        return viewer_page().await;
+    }
+    http_proxy(port, &rest, req).await
+}
+
+fn is_viewer_page(rest: &str) -> bool {
+    rest.is_empty()
+        || rest == "vnc_lite.html"
+        || rest == "vnc.html"
+        || rest == "index.html"
+        || rest == "embed.html"
+}
+
+async fn viewer_page() -> Response {
+    let dir = std::env::var("LAZYBOY_WEB_DIR").unwrap_or_else(|_| "apps/web".into());
+    let path = std::path::Path::new(&dir).join("vnc.html");
+    let html = match tokio::fs::read_to_string(&path).await {
+        Ok(body) => body,
+        Err(_) => include_str!("../../../apps/web/vnc.html").to_string(),
+    };
+    let mut headers = HeaderMap::new();
+    headers.insert(header::CONTENT_TYPE, "text/html; charset=utf-8".parse().unwrap());
+    headers.insert(header::CACHE_CONTROL, "no-store".parse().unwrap());
+    headers.insert(header::ACCESS_CONTROL_ALLOW_ORIGIN, "*".parse().unwrap());
+    (StatusCode::OK, headers, html).into_response()
+}
+
+async fn upstream_port(state: &AppState, bot_id: &str, ensure: bool) -> Result<u16, StatusCode> {
+    let actor = state
+        .bootstrap()
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    let bot = state
+        .db
+        .get_bot(&actor, bot_id)
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+        .ok_or(StatusCode::NOT_FOUND)?;
+    let computer = state
+        .db
+        .get_computer(bot.computer_id.as_deref().unwrap_or(""))
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+        .ok_or(StatusCode::NOT_FOUND)?;
+    let computer_ref = computer::computer_ref(&computer).ok_or(StatusCode::NOT_FOUND)?;
+    let screen = if ensure {
+        match computer::ensure_bot_screen(state, &actor, bot_id, &computer, None).await {
+            Ok(bound) => bound.row,
+            Err(_) => state
+                .db
+                .get_screen(&computer.id, bot_id)
+                .await
+                .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?,
+        }
+    } else {
+        state
+            .db
+            .get_screen(&computer.id, bot_id)
+            .await
+            .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+    };
+    let session = state
+        .sandbox
+        .connect_screen(
+            &computer_ref,
+            computer::user_has_screen_control(&computer, screen.as_ref(), bot_id),
+            &computer::adapter_context_for(&actor, bot_id, "view", screen.as_ref(), None),
+        )
+        .await
+        .map_err(|_| StatusCode::BAD_GATEWAY)?;
+    let url = session.url.ok_or(StatusCode::NOT_FOUND)?;
+    let rewritten = rewrite_upstream(&url);
+    let uri: Uri = rewritten.parse().map_err(|_| StatusCode::BAD_GATEWAY)?;
+    uri.port_u16().ok_or(StatusCode::BAD_GATEWAY)
+}
+
+fn rewrite_upstream(url: &str) -> String {
+    let host = std::env::var("LAZYBOY_SCREEN_UPSTREAM").unwrap_or_else(|_| "127.0.0.1".into());
+    url.replace("127.0.0.1", &host)
+        .replace("localhost", &host)
+}
+
+async fn http_proxy(port: u16, rest: &str, req: Request) -> Response {
+    let host = std::env::var("LAZYBOY_SCREEN_UPSTREAM").unwrap_or_else(|_| "127.0.0.1".into());
+    let path = if rest.is_empty() { "vnc_lite.html" } else { rest };
+    let query = req.uri().query().unwrap_or_default();
+    let url = if query.is_empty() {
+        format!("http://{host}:{port}/{path}")
+    } else {
+        format!("http://{host}:{port}/{path}?{query}")
+    };
+    let client = reqwest::Client::new();
+    let method = reqwest::Method::from_bytes(req.method().as_str().as_bytes()).unwrap_or(reqwest::Method::GET);
+    match client.request(method, url).send().await {
+        Ok(upstream) => {
+            let status = StatusCode::from_u16(upstream.status().as_u16()).unwrap_or(StatusCode::BAD_GATEWAY);
+            let content_type = upstream
+                .headers()
+                .get(reqwest::header::CONTENT_TYPE)
+                .and_then(|value| value.to_str().ok())
+                .unwrap_or("application/octet-stream")
+                .to_string();
+            match upstream.bytes().await {
+                Ok(bytes) => {
+                    let mut headers = HeaderMap::new();
+                    if let Ok(value) = content_type.parse() {
+                        headers.insert(header::CONTENT_TYPE, value);
+                    }
+                    headers.insert(header::ACCESS_CONTROL_ALLOW_ORIGIN, "*".parse().unwrap());
+                    headers.insert(
+                        header::HeaderName::from_static("cross-origin-resource-policy"),
+                        "cross-origin".parse().unwrap(),
+                    );
+                    (status, headers, bytes).into_response()
+                }
+                Err(_) => StatusCode::BAD_GATEWAY.into_response(),
+            }
+        }
+        Err(_) => StatusCode::BAD_GATEWAY.into_response(),
+    }
+}
+
+async fn proxy_socket(mut client: WebSocket, port: u16, rest: String) {
+    let host = std::env::var("LAZYBOY_SCREEN_UPSTREAM").unwrap_or_else(|_| "127.0.0.1".into());
+    let path = if rest.is_empty() { "websockify".into() } else { rest };
+    let url = format!("ws://{host}:{port}/{path}");
+    let Ok((upstream, _)) = tokio_tungstenite::connect_async(url).await else {
+        let _ = client.send(AxumMessage::Close(None)).await;
+        return;
+    };
+    let (mut up_write, mut up_read) = upstream.split();
+    loop {
+        tokio::select! {
+            incoming = client.recv() => {
+                match incoming {
+                    Some(Ok(AxumMessage::Binary(data))) => {
+                        if up_write.send(WsMessage::Binary(data)).await.is_err() { break; }
+                    }
+                    Some(Ok(AxumMessage::Text(text))) => {
+                        if up_write.send(WsMessage::Text(text.to_string().into())).await.is_err() { break; }
+                    }
+                    Some(Ok(AxumMessage::Ping(data))) => {
+                        if up_write.send(WsMessage::Ping(data)).await.is_err() { break; }
+                    }
+                    Some(Ok(AxumMessage::Pong(data))) => {
+                        if up_write.send(WsMessage::Pong(data)).await.is_err() { break; }
+                    }
+                    Some(Ok(AxumMessage::Close(_))) | None => break,
+                    Some(Err(_)) => break,
+                }
+            }
+            incoming = up_read.next() => {
+                match incoming {
+                    Some(Ok(WsMessage::Binary(data))) => {
+                        if client.send(AxumMessage::Binary(data)).await.is_err() { break; }
+                    }
+                    Some(Ok(WsMessage::Text(text))) => {
+                        if client.send(AxumMessage::Text(text.to_string().into())).await.is_err() { break; }
+                    }
+                    Some(Ok(WsMessage::Ping(data))) => {
+                        if client.send(AxumMessage::Ping(data.into())).await.is_err() { break; }
+                    }
+                    Some(Ok(WsMessage::Pong(data))) => {
+                        if client.send(AxumMessage::Pong(data.into())).await.is_err() { break; }
+                    }
+                    Some(Ok(WsMessage::Close(_))) | Some(Ok(WsMessage::Frame(_))) | None => break,
+                    Some(Err(_)) => break,
+                }
+            }
+        }
+    }
+}
+
+
diff --git a/crates/api/src/state.rs b/crates/api/src/state.rs
new file mode 100644
index 0000000..4234f37
--- /dev/null
+++ b/crates/api/src/state.rs
@@ -0,0 +1,56 @@
+use std::sync::Arc;
+
+use lazyboy_control::SandboxProvider;
+use lazyboy_sandbox::{DockerSandbox, FakeSandbox};
+use sqlx::postgres::PgPoolOptions;
+use sqlx::PgPool;
+
+use crate::db::{Actor, Db};
+
+#[derive(Clone)]
+pub struct AppState {
+    pub db: Db,
+    pub sandbox: Arc<dyn SandboxProvider>,
+    pub data_dir: String,
+}
+
+impl AppState {
+    pub async fn connect(database_url: &str) -> Result<Self, String> {
+        let pool = PgPoolOptions::new()
+            .max_connections(10)
+            .connect(database_url)
+            .await
+            .map_err(|error| error.to_string())?;
+        sqlx::migrate!("../../migrations")
+            .run(&pool)
+            .await
+            .map_err(|error| error.to_string())?;
+        let sandbox = sandbox_from_env();
+        Ok(Self {
+            db: Db { pool },
+            sandbox,
+            data_dir: std::env::var("DATA_DIR").unwrap_or_else(|_| "./data".into()),
+        })
+    }
+
+    pub async fn bootstrap(&self) -> Result<Actor, sqlx::Error> {
+        self.db.ensure_local_actor().await
+    }
+
+    pub fn pool(&self) -> &PgPool {
+        &self.db.pool
+    }
+}
+
+fn sandbox_from_env() -> Arc<dyn SandboxProvider> {
+    match std::env::var("SANDBOX_PROVIDER").unwrap_or_else(|_| "docker".into()).as_str() {
+        "fake" => Arc::new(FakeSandbox::new()),
+        _ => {
+            let url = std::env::var("SANDBOX_SUPERVISOR_URL")
+                .unwrap_or_else(|_| "http://127.0.0.1:7091".into());
+            let token =
+                std::env::var("SANDBOX_SUPERVISOR_TOKEN").unwrap_or_else(|_| "dev-token".into());
+            Arc::new(DockerSandbox::new(url, token))
+        }
+    }
+}
diff --git a/crates/api/src/tools.rs b/crates/api/src/tools.rs
new file mode 100644
index 0000000..185ee2b
--- /dev/null
+++ b/crates/api/src/tools.rs
@@ -0,0 +1,459 @@
+use std::sync::Mutex;
+
+use lazyboy_contracts::{ComputerMode, ComputerObservation};
+use lazyboy_control::{
+    frames_match, parse_computer_actions, resolve_bot_workspace_cwd, resolve_bot_workspace_path,
+    ActionRequest, AdapterContext, CommandRequest, ComputerRef, SandboxProvider,
+};
+use rig_core::completion::ToolDefinition;
+use serde_json::{json, Value};
+
+pub struct ToolCtx {
+    pub sandbox: std::sync::Arc<dyn SandboxProvider>,
+    pub computer: ComputerRef,
+    pub context: AdapterContext,
+    pub mode: ComputerMode,
+    pub bot_id: String,
+    pub vision: bool,
+    pub gui_block: Option<String>,
+    pub previous_frame: Mutex<Option<String>>,
+    pub takeover_requested: Mutex<bool>,
+}
+
+pub fn tool_definitions() -> Vec<ToolDefinition> {
+    vec![
+        ToolDefinition {
+            name: "computer_observe".into(),
+            description: "Capture a fresh desktop screenshot. Frame metadata comes back as text; the image is attached to the next model turn.".into(),
+            parameters: json!({"type":"object","properties":{}}),
+        },
+        ToolDefinition {
+            name: "computer_act".into(),
+            description: "Drive the desktop like a person: move to the target, click, type, drag, and scroll. Coordinates are 1280x800 from the top-left. Always include x,y for click/scroll/drag. Batch a whole gesture in one call. The resulting screenshot is attached to the next turn.".into(),
+            parameters: json!({
+                "type":"object",
+                "properties":{
+                    "actions":{
+                        "type":"array",
+                        "items":{
+                            "type":"object",
+                            "properties":{
+                                "kind":{"type":"string","enum":["click","move","down","up","hover","drag","type","key","scroll","wait","focus"]},
+                                "title":{"type":"string"},
+                                "x2":{"type":"number"},
+                                "y2":{"type":"number"},
+                                "x":{"type":"number"},
+                                "y":{"type":"number"},
+                                "text":{"type":"string"},
+                                "key":{"type":"string"},
+                                "modifiers":{"type":"array","items":{"type":"string"}},
+                                "button":{"type":"string","enum":["left","right"]},
+                                "double":{"type":"boolean"},
+                                "direction":{"type":"string","enum":["up","down"]},
+                                "amount":{"type":"number"},
+                                "ms":{"type":"number"}
+                            },
+                            "required":["kind"]
+                        }
+                    },
+                    "observe":{"type":"boolean"},
+                    "settle_ms":{"type":"number"}
+                },
+                "required":["actions"]
+            }),
+        },
+        ToolDefinition {
+            name: "shell".into(),
+            description: "Run a command inside this bot's computer.".into(),
+            parameters: json!({
+                "type":"object",
+                "properties":{
+                    "command":{"type":"string"},
+                    "cwd":{"type":"string"}
+                },
+                "required":["command"]
+            }),
+        },
+        ToolDefinition {
+            name: "list_files".into(),
+            description: "List files in this bot's home.".into(),
+            parameters: json!({"type":"object","properties":{"path":{"type":"string"}}}),
+        },
+        ToolDefinition {
+            name: "read_file".into(),
+            description: "Read a UTF-8 text file from this bot's home.".into(),
+            parameters: json!({"type":"object","properties":{"path":{"type":"string"}},"required":["path"]}),
+        },
+        ToolDefinition {
+            name: "write_file".into(),
+            description: "Write a UTF-8 file into this bot's home.".into(),
+            parameters: json!({
+                "type":"object",
+                "properties":{"path":{"type":"string"},"content":{"type":"string"}},
+                "required":["path","content"]
+            }),
+        },
+        ToolDefinition {
+            name: "open_path".into(),
+            description: "Open a workspace file or http(s) URL on the desktop.".into(),
+            parameters: json!({"type":"object","properties":{"path":{"type":"string"}},"required":["path"]}),
+        },
+        ToolDefinition {
+            name: "launch_app".into(),
+            description: "Launch browser or terminal on the desktop.".into(),
+            parameters: json!({
+                "type":"object",
+                "properties":{"application":{"type":"string"},"uri":{"type":"string"}},
+                "required":["application"]
+            }),
+        },
+        ToolDefinition {
+            name: "request_takeover".into(),
+            description: "Ask the user to take over for passwords, 2FA, CAPTCHA, or protected input. Never ask them to paste secrets in chat.".into(),
+            parameters: json!({"type":"object","properties":{"reason":{"type":"string"}},"required":["reason"]}),
+        },
+    ]
+}
+
+pub struct ToolOutcome {
+    pub text: String,
+    pub image: Option<Vec<u8>>,
+    pub pause: bool,
+}
+
+pub async fn dispatch(ctx: &ToolCtx, name: &str, args: &Value) -> ToolOutcome {
+    match name {
+        "computer_observe" => observe(ctx).await,
+        "computer_act" => act(ctx, args).await,
+        "shell" => shell(ctx, args).await,
+        "list_files" => list_files(ctx, args).await,
+        "read_file" => read_file(ctx, args).await,
+        "write_file" => write_file(ctx, args).await,
+        "open_path" => open_path(ctx, args).await,
+        "launch_app" => launch_app(ctx, args).await,
+        "request_takeover" => {
+            *ctx.takeover_requested.lock().unwrap() = true;
+            ToolOutcome {
+                text: args
+                    .get("reason")
+                    .and_then(Value::as_str)
+                    .unwrap_or("The bot asked you to take control.")
+                    .to_string(),
+                image: None,
+                pause: true,
+            }
+        }
+        other => ToolOutcome {
+            text: format!("unknown tool {other}"),
+            image: None,
+            pause: false,
+        },
+    }
+}
+
+fn vision_guard(ctx: &ToolCtx) -> Option<ToolOutcome> {
+    if let Some(message) = &ctx.gui_block {
+        return Some(ToolOutcome {
+            text: message.clone(),
+            image: None,
+            pause: false,
+        });
+    }
+    if ctx.vision {
+        None
+    } else {
+        Some(ToolOutcome {
+            text: "This model cannot see the screen. Use shell and file tools, or pick a vision model.".into(),
+            image: None,
+            pause: false,
+        })
+    }
+}
+
+fn observation_text(note: &str, observation: &ComputerObservation, unchanged: bool) -> String {
+    format!(
+        "{note}{}\n{}",
+        if unchanged { " (screen unchanged)" } else { "" },
+        json!({
+            "frameId": observation.frame_id,
+            "width": observation.width,
+            "height": observation.height,
+            "capturedAt": observation.captured_at,
+            "cursor": observation.cursor,
+            "activeWindow": observation.active_window,
+        })
+    )
+}
+
+async fn observe(ctx: &ToolCtx) -> ToolOutcome {
+    if let Some(blocked) = vision_guard(ctx) {
+        return blocked;
+    }
+    match ctx.sandbox.observe(&ctx.computer, &ctx.context).await {
+        Ok(observation) => pack_observation(ctx, "computer observed", observation),
+        Err(error) => ToolOutcome {
+            text: error.to_string(),
+            image: None,
+            pause: false,
+        },
+    }
+}
+
+async fn act(ctx: &ToolCtx, args: &Value) -> ToolOutcome {
+    if let Some(blocked) = vision_guard(ctx) {
+        return blocked;
+    }
+    let actions = match parse_computer_actions(args.get("actions").unwrap_or(&Value::Null)) {
+        Ok(actions) => actions,
+        Err(error) => {
+            return ToolOutcome {
+                text: error.to_string(),
+                image: None,
+                pause: false,
+            };
+        }
+    };
+    match ctx
+        .sandbox
+        .act(
+            &ctx.computer,
+            ActionRequest {
+                actions,
+                observe: args.get("observe").and_then(Value::as_bool) != Some(false),
+                settle_ms: args.get("settle_ms").and_then(Value::as_u64).unwrap_or(120) as u32,
+                display: ctx.context.display.clone(),
+                profile_path: ctx.context.profile_path.clone(),
+            },
+            &ctx.context,
+        )
+        .await
+    {
+        Ok(result) => {
+            if let Some(observation) = result.observation {
+                pack_observation(
+                    ctx,
+                    &format!("completed {} computer action(s)", result.completed),
+                    observation,
+                )
+            } else {
+                ToolOutcome {
+                    text: json!({"ok": true, "completed": result.completed}).to_string(),
+                    image: None,
+                    pause: false,
+                }
+            }
+        }
+        Err(error) => ToolOutcome {
+            text: error.to_string(),
+            image: None,
+            pause: false,
+        },
+    }
+}
+
+fn pack_observation(ctx: &ToolCtx, note: &str, observation: ComputerObservation) -> ToolOutcome {
+    let unchanged = frames_match(ctx.previous_frame.lock().unwrap().as_deref(), &observation);
+    *ctx.previous_frame.lock().unwrap() = Some(observation.frame_id.clone());
+    ToolOutcome {
+        text: observation_text(note, &observation, unchanged),
+        image: if unchanged { None } else { Some(observation.image) },
+        pause: false,
+    }
+}
+
+async fn shell(ctx: &ToolCtx, args: &Value) -> ToolOutcome {
+    let command = args.get("command").and_then(Value::as_str).unwrap_or("");
+    let cwd = args.get("cwd").and_then(Value::as_str);
+    let cwd = resolve_bot_workspace_cwd(ctx.mode, &ctx.bot_id, cwd)
+        .ok()
+        .flatten();
+    match ctx
+        .sandbox
+        .execute(
+            &ctx.computer,
+            CommandRequest {
+                argv: vec!["bash".into(), "-lc".into(), command.into()],
+                cwd,
+                timeout_ms: Some(60_000),
+            },
+            &ctx.context,
+        )
+        .await
+    {
+        Ok(result) => ToolOutcome {
+            text: format!("exit {}\n{}\n{}", result.code, result.stdout, result.stderr),
+            image: None,
+            pause: false,
+        },
+        Err(error) => ToolOutcome {
+            text: error.to_string(),
+            image: None,
+            pause: false,
+        },
+    }
+}
+
+async fn list_files(ctx: &ToolCtx, args: &Value) -> ToolOutcome {
+    let requested = args.get("path").and_then(Value::as_str).unwrap_or("");
+    let stored = match resolve_bot_workspace_path(ctx.mode, &ctx.bot_id, requested) {
+        Ok(path) => path,
+        Err(error) => {
+            return ToolOutcome {
+                text: error.to_string(),
+                image: None,
+                pause: false,
+            };
+        }
+    };
+    match ctx.sandbox.list_files(&ctx.computer, &stored, &ctx.context).await {
+        Ok(entries) => ToolOutcome {
+            text: serde_json::to_string(&entries).unwrap_or_else(|_| "[]".into()),
+            image: None,
+            pause: false,
+        },
+        Err(error) => ToolOutcome {
+            text: error.to_string(),
+            image: None,
+            pause: false,
+        },
+    }
+}
+
+async fn read_file(ctx: &ToolCtx, args: &Value) -> ToolOutcome {
+    let requested = args.get("path").and_then(Value::as_str).unwrap_or("");
+    let stored = match resolve_bot_workspace_path(ctx.mode, &ctx.bot_id, requested) {
+        Ok(path) => path,
+        Err(error) => {
+            return ToolOutcome {
+                text: error.to_string(),
+                image: None,
+                pause: false,
+            };
+        }
+    };
+    match ctx.sandbox.read_file(&ctx.computer, &stored, &ctx.context).await {
+        Ok(bytes) => ToolOutcome {
+            text: String::from_utf8_lossy(&bytes).into_owned(),
+            image: None,
+            pause: false,
+        },
+        Err(error) => ToolOutcome {
+            text: error.to_string(),
+            image: None,
+            pause: false,
+        },
+    }
+}
+
+async fn write_file(ctx: &ToolCtx, args: &Value) -> ToolOutcome {
+    let requested = args.get("path").and_then(Value::as_str).unwrap_or("notes.txt");
+    let content = args.get("content").and_then(Value::as_str).unwrap_or("");
+    let stored = match resolve_bot_workspace_path(ctx.mode, &ctx.bot_id, requested) {
+        Ok(path) => path,
+        Err(error) => {
+            return ToolOutcome {
+                text: error.to_string(),
+                image: None,
+                pause: false,
+            };
+        }
+    };
+    match ctx
+        .sandbox
+        .write_file(&ctx.computer, &stored, content.as_bytes(), &ctx.context)
+        .await
+    {
+        Ok(()) => ToolOutcome {
+            text: json!({"ok": true, "path": requested}).to_string(),
+            image: None,
+            pause: false,
+        },
+        Err(error) => ToolOutcome {
+            text: error.to_string(),
+            image: None,
+            pause: false,
+        },
+    }
+}
+
+async fn open_path(ctx: &ToolCtx, args: &Value) -> ToolOutcome {
+    if let Some(blocked) = vision_guard(ctx) {
+        return blocked;
+    }
+    let path = args.get("path").and_then(Value::as_str).unwrap_or("");
+    match ctx
+        .sandbox
+        .act(
+            &ctx.computer,
+            ActionRequest {
+                actions: vec![lazyboy_contracts::ComputerAction::Open { path: path.into() }],
+                observe: true,
+                settle_ms: 400,
+                display: ctx.context.display.clone(),
+                profile_path: ctx.context.profile_path.clone(),
+            },
+            &ctx.context,
+        )
+        .await
+    {
+        Ok(result) => {
+            if let Some(observation) = result.observation {
+                pack_observation(ctx, "opened path", observation)
+            } else {
+                ToolOutcome {
+                    text: "opened".into(),
+                    image: None,
+                    pause: false,
+                }
+            }
+        }
+        Err(error) => ToolOutcome {
+            text: error.to_string(),
+            image: None,
+            pause: false,
+        },
+    }
+}
+
+async fn launch_app(ctx: &ToolCtx, args: &Value) -> ToolOutcome {
+    if let Some(blocked) = vision_guard(ctx) {
+        return blocked;
+    }
+    let application = args.get("application").and_then(Value::as_str).unwrap_or("browser");
+    let uri = args.get("uri").and_then(Value::as_str).map(str::to_string);
+    match ctx
+        .sandbox
+        .act(
+            &ctx.computer,
+            ActionRequest {
+                actions: vec![lazyboy_contracts::ComputerAction::Launch {
+                    application: application.into(),
+                    uri,
+                }],
+                observe: true,
+                settle_ms: 500,
+                display: ctx.context.display.clone(),
+                profile_path: ctx.context.profile_path.clone(),
+            },
+            &ctx.context,
+        )
+        .await
+    {
+        Ok(result) => {
+            if let Some(observation) = result.observation {
+                pack_observation(ctx, "launched app", observation)
+            } else {
+                ToolOutcome {
+                    text: "launched".into(),
+                    image: None,
+                    pause: false,
+                }
+            }
+        }
+        Err(error) => ToolOutcome {
+            text: error.to_string(),
+            image: None,
+            pause: false,
+        },
+    }
+}
diff --git a/crates/contracts/Cargo.toml b/crates/contracts/Cargo.toml
new file mode 100644
index 0000000..acaef4c
--- /dev/null
+++ b/crates/contracts/Cargo.toml
@@ -0,0 +1,13 @@
+[package]
+name = "lazyboy-contracts"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+publish.workspace = true
+
+[dependencies]
+serde.workspace = true
+serde_json.workspace = true
+thiserror.workspace = true
+chrono.workspace = true
+base64.workspace = true
diff --git a/crates/contracts/src/action.rs b/crates/contracts/src/action.rs
new file mode 100644
index 0000000..221dbbd
--- /dev/null
+++ b/crates/contracts/src/action.rs
@@ -0,0 +1,106 @@
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum PointerType {
+    Move,
+    Down,
+    Up,
+    Click,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum PointerButton {
+    Left,
+    Right,
+    Middle,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum ScrollDirection {
+    Up,
+    Down,
+}
+
+/// Canonical actions the control plane understands.
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+#[serde(tag = "kind", rename_all = "lowercase")]
+pub enum ComputerAction {
+    Pointer {
+        x: u32,
+        y: u32,
+        #[serde(rename = "type")]
+        pointer_type: PointerType,
+        #[serde(default)]
+        button: Option<PointerButton>,
+    },
+    Clipboard {
+        text: String,
+    },
+    Key {
+        key: String,
+        #[serde(default)]
+        modifiers: Option<Vec<String>>,
+    },
+    Scroll {
+        direction: ScrollDirection,
+        #[serde(default)]
+        amount: Option<u32>,
+    },
+    Wait {
+        ms: u32,
+    },
+    Open {
+        path: String,
+    },
+    Launch {
+        application: String,
+        #[serde(default)]
+        uri: Option<String>,
+    },
+    Focus {
+        title: String,
+    },
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct CursorPosition {
+    pub x: i32,
+    pub y: i32,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct ActiveWindow {
+    pub id: String,
+    pub title: Option<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct ComputerObservation {
+    pub frame_id: String,
+    pub captured_at: String,
+    pub mime_type: String,
+    #[serde(with = "serde_bytes_opt")]
+    pub image: Vec<u8>,
+    pub width: u32,
+    pub height: u32,
+    pub cursor: Option<CursorPosition>,
+    pub active_window: Option<ActiveWindow>,
+}
+
+mod serde_bytes_opt {
+    use base64::engine::general_purpose::STANDARD;
+    use base64::Engine;
+    use serde::{Deserialize, Deserializer, Serializer};
+
+    pub fn serialize<S: Serializer>(bytes: &[u8], serializer: S) -> Result<S::Ok, S::Error> {
+        serializer.serialize_str(&STANDARD.encode(bytes))
+    }
+
+    pub fn deserialize<'de, D: Deserializer<'de>>(deserializer: D) -> Result<Vec<u8>, D::Error> {
+        let text = String::deserialize(deserializer)?;
+        STANDARD.decode(text).map_err(serde::de::Error::custom)
+    }
+}
diff --git a/crates/contracts/src/bot.rs b/crates/contracts/src/bot.rs
new file mode 100644
index 0000000..0a2fc23
--- /dev/null
+++ b/crates/contracts/src/bot.rs
@@ -0,0 +1,39 @@
+use serde::{Deserialize, Serialize};
+
+use crate::{ComputerMode, ModelProvider};
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct CreateBotInput {
+    pub name: String,
+    #[serde(default)]
+    pub title: String,
+    #[serde(default)]
+    pub description: String,
+    #[serde(default)]
+    pub instructions: String,
+    #[serde(default = "default_team")]
+    pub computer_mode: ComputerMode,
+    pub model_provider: Option<ModelProvider>,
+    pub model_id: Option<String>,
+}
+
+fn default_team() -> ComputerMode {
+    ComputerMode::Team
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct Bot {
+    pub id: String,
+    pub space_id: String,
+    pub name: String,
+    pub title: String,
+    pub description: String,
+    pub instructions: String,
+    pub thread_id: String,
+    pub computer_id: String,
+    pub computer_mode: ComputerMode,
+    pub model_provider: Option<ModelProvider>,
+    pub model_id: Option<String>,
+}
diff --git a/crates/contracts/src/computer.rs b/crates/contracts/src/computer.rs
new file mode 100644
index 0000000..cd366d5
--- /dev/null
+++ b/crates/contracts/src/computer.rs
@@ -0,0 +1,234 @@
+use serde::{Deserialize, Serialize};
+use thiserror::Error;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum ComputerMode {
+    Team,
+    Dedicated,
+}
+
+impl ComputerMode {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Team => "team",
+            Self::Dedicated => "dedicated",
+        }
+    }
+}
+
+impl std::str::FromStr for ComputerMode {
+    type Err = UnknownComputerMode;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        match value {
+            "team" => Ok(Self::Team),
+            "dedicated" => Ok(Self::Dedicated),
+            other => Err(UnknownComputerMode(other.to_string())),
+        }
+    }
+}
+
+#[derive(Debug, Error, Clone, PartialEq, Eq)]
+#[error("unknown computer mode: {0}")]
+pub struct UnknownComputerMode(pub String);
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum ComputerState {
+    Stopped,
+    Booting,
+    Running,
+    Suspended,
+    Error,
+}
+
+impl ComputerState {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Stopped => "stopped",
+            Self::Booting => "booting",
+            Self::Running => "running",
+            Self::Suspended => "suspended",
+            Self::Error => "error",
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum ControlHolder {
+    None,
+    Bot,
+    User,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum SandboxKind {
+    Docker,
+}
+
+impl SandboxKind {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Docker => "docker",
+        }
+    }
+}
+
+#[derive(Debug, Error, Clone, PartialEq, Eq)]
+#[error("dedicated computers require a bot id")]
+pub struct DedicatedRequiresBotId;
+
+/// Stable identity for upserting a computer row.
+pub fn computer_scope_key(
+    mode: ComputerMode,
+    space_id: &str,
+    bot_id: Option<&str>,
+) -> Result<String, DedicatedRequiresBotId> {
+    match mode {
+        ComputerMode::Team => Ok(format!("team:{space_id}")),
+        ComputerMode::Dedicated => {
+            let bot_id = bot_id.ok_or(DedicatedRequiresBotId)?;
+            Ok(format!("bot:{bot_id}"))
+        }
+    }
+}
+
+/// Durable workspace key. Team computers share one home; dedicated homes follow the bot.
+pub fn computer_home_key(
+    mode: ComputerMode,
+    space_id: &str,
+    bot_id: Option<&str>,
+) -> Result<String, DedicatedRequiresBotId> {
+    match mode {
+        ComputerMode::Team => Ok(format!("team-{space_id}")),
+        ComputerMode::Dedicated => {
+            let bot_id = bot_id.ok_or(DedicatedRequiresBotId)?;
+            Ok(bot_id.to_string())
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum BrowserProfileMode {
+    Shared,
+    PerBot,
+    PerTask,
+}
+
+impl BrowserProfileMode {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Shared => "shared",
+            Self::PerBot => "per-bot",
+            Self::PerTask => "per-task",
+        }
+    }
+}
+
+impl Default for BrowserProfileMode {
+    fn default() -> Self {
+        Self::PerBot
+    }
+}
+
+impl std::str::FromStr for BrowserProfileMode {
+    type Err = UnknownProfileMode;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        match value {
+            "shared" => Ok(Self::Shared),
+            "per-bot" | "per_bot" | "perbot" => Ok(Self::PerBot),
+            "per-task" | "per_task" | "pertask" => Ok(Self::PerTask),
+            other => Err(UnknownProfileMode(other.to_string())),
+        }
+    }
+}
+
+#[derive(Debug, Error, Clone, PartialEq, Eq)]
+#[error("unknown browser profile mode: {0}")]
+pub struct UnknownProfileMode(pub String);
+
+/// Frozen ComputerProvider capability bits.
+/// lifecycle: provision / reconnect / destroy / suspend / resume
+/// desktop(screenId): observe / act
+/// exec: shell; files: list/read/write
+/// hydrate/export: workspace truth is the home bind, not vendor disk
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ComputerCapabilities {
+    pub multi_screen: bool,
+}
+
+impl Default for ComputerCapabilities {
+    fn default() -> Self {
+        Self { multi_screen: true }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ComputerStatus {
+    pub bot_id: String,
+    pub mode: ComputerMode,
+    pub kind: SandboxKind,
+    pub state: ComputerState,
+    pub control_holder: ControlHolder,
+    pub control_bot_id: Option<String>,
+    pub takeover_requested: bool,
+    pub screen_available: bool,
+    pub screen_width: u32,
+    pub screen_height: u32,
+    pub home_revision: Option<String>,
+    pub busy_bot_name: Option<String>,
+    pub multi_screen: bool,
+    pub screen_id: Option<String>,
+    pub display: Option<String>,
+    pub profile_mode: BrowserProfileMode,
+}
+
+pub const DEFAULT_SCREEN_WIDTH: u32 = 1280;
+pub const DEFAULT_SCREEN_HEIGHT: u32 = 800;
+pub const TEAM_SCREEN_LIMIT: u32 = 8;
+
+pub const MULTI_SCREEN_UNAVAILABLE: &str = "This computer does not support multiple screens. Desktop tools are already in use on the shared display. File and shell tools still work.";
+pub const TEAM_SCREENS_FULL: &str = "This Team computer has no free screens left. File and shell tools still work.";
+pub const PROFILE_LOCKED: &str = "Another bot is using this shared browser profile. File and shell tools still work.";
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn team_and_dedicated_keys_differ() {
+        assert_eq!(
+            computer_scope_key(ComputerMode::Team, "space-1", None).unwrap(),
+            "team:space-1"
+        );
+        assert_eq!(
+            computer_home_key(ComputerMode::Team, "space-1", None).unwrap(),
+            "team-space-1"
+        );
+        assert_eq!(
+            computer_scope_key(ComputerMode::Dedicated, "space-1", Some("bot-9")).unwrap(),
+            "bot:bot-9"
+        );
+        assert_eq!(
+            computer_home_key(ComputerMode::Dedicated, "space-1", Some("bot-9")).unwrap(),
+            "bot-9"
+        );
+        assert!(computer_home_key(ComputerMode::Dedicated, "space-1", None).is_err());
+    }
+
+    #[test]
+    fn default_profile_mode_is_per_bot() {
+        assert_eq!(BrowserProfileMode::default(), BrowserProfileMode::PerBot);
+        assert_eq!(
+            "per-bot".parse::<BrowserProfileMode>().unwrap(),
+            BrowserProfileMode::PerBot
+        );
+    }
+}
diff --git a/crates/contracts/src/lib.rs b/crates/contracts/src/lib.rs
new file mode 100644
index 0000000..901361e
--- /dev/null
+++ b/crates/contracts/src/lib.rs
@@ -0,0 +1,13 @@
+mod action;
+mod bot;
+mod computer;
+mod model;
+mod run;
+
+pub use action::*;
+pub use bot::*;
+pub use computer::*;
+pub use model::*;
+pub use run::*;
+
+pub type Id = String;
diff --git a/crates/contracts/src/model.rs b/crates/contracts/src/model.rs
new file mode 100644
index 0000000..0ac835a
--- /dev/null
+++ b/crates/contracts/src/model.rs
@@ -0,0 +1,97 @@
+use serde::{Deserialize, Serialize};
+use thiserror::Error;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum ModelProvider {
+    Xai,
+    Openai,
+    Anthropic,
+    Openrouter,
+}
+
+impl ModelProvider {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Xai => "xai",
+            Self::Openai => "openai",
+            Self::Anthropic => "anthropic",
+            Self::Openrouter => "openrouter",
+        }
+    }
+
+    pub fn env_key_name(self) -> &'static str {
+        match self {
+            Self::Xai => "XAI_API_KEY",
+            Self::Openai => "OPENAI_API_KEY",
+            Self::Anthropic => "ANTHROPIC_API_KEY",
+            Self::Openrouter => "OPENROUTER_API_KEY",
+        }
+    }
+
+    /// First-party OpenAI-compatible base URL when we own the client mapping.
+    pub fn default_base_url(self) -> Option<&'static str> {
+        match self {
+            Self::Xai => Some("https://api.x.ai/v1"),
+            Self::Openai => Some("https://api.openai.com/v1"),
+            Self::Anthropic => None,
+            Self::Openrouter => Some("https://openrouter.ai/api/v1"),
+        }
+    }
+}
+
+impl std::str::FromStr for ModelProvider {
+    type Err = UnknownModelProvider;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        match value {
+            "xai" => Ok(Self::Xai),
+            "openai" => Ok(Self::Openai),
+            "anthropic" => Ok(Self::Anthropic),
+            "openrouter" => Ok(Self::Openrouter),
+            other => Err(UnknownModelProvider(other.to_string())),
+        }
+    }
+}
+
+#[derive(Debug, Error, Clone, PartialEq, Eq)]
+#[error("unknown model provider: {0}")]
+pub struct UnknownModelProvider(pub String);
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+pub struct ModelCapabilities {
+    pub vision: bool,
+}
+
+pub const DEFAULT_XAI_MODEL: &str = "grok-4.6";
+
+pub fn default_model_id(provider: ModelProvider) -> Option<&'static str> {
+    match provider {
+        ModelProvider::Xai => Some(DEFAULT_XAI_MODEL),
+        ModelProvider::Openai | ModelProvider::Anthropic | ModelProvider::Openrouter => None,
+    }
+}
+
+/// Best-effort catalog. Unknown ids for a wired provider default to "no vision"
+/// so we never shove screenshots at a model that may not accept them.
+pub fn model_capabilities(provider: ModelProvider, model_id: &str) -> ModelCapabilities {
+    let vision = match provider {
+        ModelProvider::Xai => {
+            let id = model_id.to_ascii_lowercase();
+            id.starts_with("grok-4")
+                || id.contains("vision")
+                || id.starts_with("grok-2")
+                || id.starts_with("grok-3")
+        }
+        ModelProvider::Openai => {
+            let id = model_id.to_ascii_lowercase();
+            id.contains("gpt-4o") || id.contains("gpt-5") || id.contains("vision")
+        }
+        ModelProvider::Anthropic => model_id.to_ascii_lowercase().contains("claude"),
+        ModelProvider::Openrouter => {
+            let id = model_id.to_ascii_lowercase();
+            id.contains("vision") || id.contains("gpt-4o") || id.contains("claude") || id.contains("grok")
+        }
+    };
+    ModelCapabilities { vision }
+}
diff --git a/crates/contracts/src/run.rs b/crates/contracts/src/run.rs
new file mode 100644
index 0000000..97a1be8
--- /dev/null
+++ b/crates/contracts/src/run.rs
@@ -0,0 +1,68 @@
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum RunStatus {
+    Queued,
+    Leased,
+    Running,
+    WaitingInput,
+    WaitingTakeover,
+    Completed,
+    Failed,
+    Cancelled,
+}
+
+impl RunStatus {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Queued => "queued",
+            Self::Leased => "leased",
+            Self::Running => "running",
+            Self::WaitingInput => "waiting_input",
+            Self::WaitingTakeover => "waiting_takeover",
+            Self::Completed => "completed",
+            Self::Failed => "failed",
+            Self::Cancelled => "cancelled",
+        }
+    }
+
+    pub fn is_active(self) -> bool {
+        matches!(
+            self,
+            Self::Queued | Self::Leased | Self::Running | Self::WaitingInput | Self::WaitingTakeover
+        )
+    }
+
+    pub fn is_terminal(self) -> bool {
+        matches!(self, Self::Completed | Self::Failed | Self::Cancelled)
+    }
+
+    pub fn can_transition(self, to: Self) -> bool {
+        matches!(
+            (self, to),
+            (Self::Queued, Self::Leased | Self::Cancelled)
+                | (Self::Leased, Self::Running | Self::Queued | Self::Cancelled)
+                | (
+                    Self::Running,
+                    Self::WaitingInput
+                        | Self::WaitingTakeover
+                        | Self::Completed
+                        | Self::Failed
+                        | Self::Cancelled
+                        | Self::Leased
+                )
+                | (Self::WaitingInput, Self::Queued | Self::Leased | Self::Cancelled)
+                | (Self::WaitingTakeover, Self::Queued | Self::Leased | Self::Cancelled)
+                | (Self::Failed, Self::Queued)
+        )
+    }
+}
+
+pub const ACTIVE_RUN_STATUSES: &[RunStatus] = &[
+    RunStatus::Queued,
+    RunStatus::Leased,
+    RunStatus::Running,
+    RunStatus::WaitingInput,
+    RunStatus::WaitingTakeover,
+];
diff --git a/crates/control/Cargo.toml b/crates/control/Cargo.toml
new file mode 100644
index 0000000..a3914e1
--- /dev/null
+++ b/crates/control/Cargo.toml
@@ -0,0 +1,16 @@
+[package]
+name = "lazyboy-control"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+publish.workspace = true
+
+[dependencies]
+lazyboy-contracts.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+thiserror.workspace = true
+sha2.workspace = true
+hex.workspace = true
+chrono.workspace = true
+async-trait = "0.1"
diff --git a/crates/control/src/actions.rs b/crates/control/src/actions.rs
new file mode 100644
index 0000000..7c3fc58
--- /dev/null
+++ b/crates/control/src/actions.rs
@@ -0,0 +1,272 @@
+use lazyboy_contracts::{ComputerAction, PointerButton, PointerType, ScrollDirection};
+use serde_json::Value;
+use thiserror::Error;
+
+pub const MAX_COMPUTER_ACTIONS: usize = 24;
+
+#[derive(Debug, Error, Clone, PartialEq, Eq)]
+pub enum ActionError {
+    #[error("computer_act requires at least one action")]
+    Empty,
+    #[error("computer_act accepts at most {MAX_COMPUTER_ACTIONS} actions")]
+    TooMany,
+    #[error("computer_act expands to more than {MAX_COMPUTER_ACTIONS} actions; split the batch")]
+    ExpandedTooMany,
+    #[error("computer action must be an object")]
+    NotObject,
+    #[error("unsupported computer action {0}")]
+    Unsupported(String),
+    #[error("computer action {0} must be a non-negative coordinate")]
+    BadCoordinate(&'static str),
+}
+
+pub fn parse_computer_actions(value: &Value) -> Result<Vec<ComputerAction>, ActionError> {
+    let Value::Array(items) = value else {
+        return Err(ActionError::Empty);
+    };
+    if items.is_empty() {
+        return Err(ActionError::Empty);
+    }
+    if items.len() > MAX_COMPUTER_ACTIONS {
+        return Err(ActionError::TooMany);
+    }
+    let mut actions = Vec::new();
+    for raw in items {
+        let Value::Object(action) = raw else {
+            return Err(ActionError::NotObject);
+        };
+        let kind = action
+            .get("kind")
+            .and_then(Value::as_str)
+            .or_else(|| action.get("type").and_then(Value::as_str))
+            .unwrap_or_default();
+        match kind {
+            "click" | "move" | "down" | "up" => {
+                let x = coordinate(action.get("x"), "x")?;
+                let y = coordinate(action.get("y"), "y")?;
+                let pointer_type = match kind {
+                    "click" => PointerType::Click,
+                    "move" => PointerType::Move,
+                    "down" => PointerType::Down,
+                    _ => PointerType::Up,
+                };
+                let button = match action.get("button").and_then(Value::as_str) {
+                    Some("right") => PointerButton::Right,
+                    Some("middle") => PointerButton::Middle,
+                    _ => PointerButton::Left,
+                };
+                let pointer = ComputerAction::Pointer {
+                    x,
+                    y,
+                    pointer_type,
+                    button: Some(button),
+                };
+                let doubled = action.get("double").and_then(Value::as_bool) == Some(true) && kind == "click";
+                actions.push(pointer.clone());
+                if doubled {
+                    actions.push(ComputerAction::Wait { ms: 70 });
+                    actions.push(pointer);
+                }
+            }
+            "hover" => {
+                let x = coordinate(action.get("x"), "x")?;
+                let y = coordinate(action.get("y"), "y")?;
+                actions.push(ComputerAction::Pointer {
+                    x,
+                    y,
+                    pointer_type: PointerType::Move,
+                    button: Some(PointerButton::Left),
+                });
+                actions.push(ComputerAction::Wait { ms: 90 });
+            }
+            "drag" => {
+                let x = coordinate(action.get("x"), "x")?;
+                let y = coordinate(action.get("y"), "y")?;
+                let to_x = coordinate(
+                    action.get("x2").or_else(|| action.get("toX")).or_else(|| action.get("to_x")),
+                    "x2",
+                )?;
+                let to_y = coordinate(
+                    action.get("y2").or_else(|| action.get("toY")).or_else(|| action.get("to_y")),
+                    "y2",
+                )?;
+                let button = if action.get("button").and_then(Value::as_str) == Some("right") {
+                    PointerButton::Right
+                } else {
+                    PointerButton::Left
+                };
+                actions.push(ComputerAction::Pointer {
+                    x,
+                    y,
+                    pointer_type: PointerType::Down,
+                    button: Some(button),
+                });
+                actions.push(ComputerAction::Wait { ms: 40 });
+                actions.push(ComputerAction::Pointer {
+                    x: to_x,
+                    y: to_y,
+                    pointer_type: PointerType::Move,
+                    button: Some(button),
+                });
+                actions.push(ComputerAction::Wait { ms: 40 });
+                actions.push(ComputerAction::Pointer {
+                    x: to_x,
+                    y: to_y,
+                    pointer_type: PointerType::Up,
+                    button: Some(button),
+                });
+            }
+            "type" => {
+                let text = action
+                    .get("text")
+                    .and_then(Value::as_str)
+                    .unwrap_or("")
+                    .to_string();
+                actions.push(ComputerAction::Clipboard { text });
+            }
+            "key" => {
+                let key = action
+                    .get("key")
+                    .and_then(Value::as_str)
+                    .unwrap_or("")
+                    .to_string();
+                let modifiers = action.get("modifiers").and_then(Value::as_array).map(|items| {
+                    items
+                        .iter()
+                        .filter_map(Value::as_str)
+                        .map(str::to_string)
+                        .collect()
+                });
+                actions.push(ComputerAction::Key { key, modifiers });
+            }
+            "scroll" => {
+                if action.get("x").is_some() || action.get("y").is_some() {
+                    let x = coordinate(action.get("x"), "x")?;
+                    let y = coordinate(action.get("y"), "y")?;
+                    actions.push(ComputerAction::Pointer {
+                        x,
+                        y,
+                        pointer_type: PointerType::Move,
+                        button: Some(PointerButton::Left),
+                    });
+                }
+                let direction = if action.get("direction").and_then(Value::as_str) == Some("up") {
+                    ScrollDirection::Up
+                } else {
+                    ScrollDirection::Down
+                };
+                actions.push(ComputerAction::Scroll {
+                    direction,
+                    amount: Some(bounded(action.get("amount"), 1, 40, 12)),
+                });
+            }
+            "focus" => {
+                let title = action
+                    .get("title")
+                    .or_else(|| action.get("text"))
+                    .and_then(Value::as_str)
+                    .unwrap_or("")
+                    .to_string();
+                actions.push(ComputerAction::Focus { title });
+            }
+            "wait" => {
+                actions.push(ComputerAction::Wait {
+                    ms: bounded(action.get("ms"), 0, 1_200, 80),
+                });
+            }
+            other => return Err(ActionError::Unsupported(if other.is_empty() {
+                "(missing)".to_string()
+            } else {
+                other.to_string()
+            })),
+        }
+    }
+    if actions.len() > MAX_COMPUTER_ACTIONS {
+        return Err(ActionError::ExpandedTooMany);
+    }
+    Ok(actions)
+}
+
+fn coordinate(value: Option<&Value>, name: &'static str) -> Result<u32, ActionError> {
+    let number = value.and_then(Value::as_f64).unwrap_or(f64::NAN).round();
+    if !number.is_finite() || number < 0.0 || number > 100_000.0 {
+        return Err(ActionError::BadCoordinate(name));
+    }
+    Ok(number as u32)
+}
+
+fn bounded(value: Option<&Value>, min: u32, max: u32, fallback: u32) -> u32 {
+    let Some(number) = value.and_then(Value::as_f64) else {
+        return fallback;
+    };
+    if !number.is_finite() {
+        return fallback;
+    }
+    (number.round() as i64).clamp(min as i64, max as i64) as u32
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    #[test]
+    fn parses_click_and_double_click() {
+        let actions = parse_computer_actions(&json!([
+            {"kind": "click", "x": 10, "y": 20},
+            {"kind": "click", "x": 10, "y": 20, "double": true}
+        ]))
+        .unwrap();
+        assert_eq!(actions.len(), 4);
+    }
+
+    #[test]
+    fn accepts_type_as_kind_alias() {
+        let actions = parse_computer_actions(&json!([{"type": "click", "x": 4, "y": 8}])).unwrap();
+        assert_eq!(actions.len(), 1);
+    }
+
+    #[test]
+    fn drag_expands_to_down_move_up() {
+        let actions = parse_computer_actions(&json!([
+            {"kind": "drag", "x": 10, "y": 10, "x2": 80, "y2": 90}
+        ]))
+        .unwrap();
+        assert_eq!(actions.len(), 5);
+        assert!(matches!(
+            actions[0],
+            ComputerAction::Pointer {
+                pointer_type: PointerType::Down,
+                ..
+            }
+        ));
+        assert!(matches!(
+            actions[4],
+            ComputerAction::Pointer {
+                pointer_type: PointerType::Up,
+                x: 80,
+                y: 90,
+                ..
+            }
+        ));
+    }
+
+    #[test]
+    fn scroll_defaults_to_a_real_page_chunk() {
+        let actions = parse_computer_actions(&json!([{"kind": "scroll", "direction": "down"}])).unwrap();
+        match &actions[0] {
+            ComputerAction::Scroll { amount, .. } => assert_eq!(*amount, Some(12)),
+            other => panic!("{other:?}"),
+        }
+    }
+
+    #[test]
+    fn rejects_empty_and_overflow() {
+        assert_eq!(parse_computer_actions(&json!([])).unwrap_err(), ActionError::Empty);
+        let too_many: Vec<_> = (0..25).map(|_| json!({"kind": "wait", "ms": 1})).collect();
+        assert_eq!(
+            parse_computer_actions(&json!(too_many)).unwrap_err(),
+            ActionError::TooMany
+        );
+    }
+}
diff --git a/crates/control/src/lease.rs b/crates/control/src/lease.rs
new file mode 100644
index 0000000..a3ecbda
--- /dev/null
+++ b/crates/control/src/lease.rs
@@ -0,0 +1,82 @@
+use thiserror::Error;
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ScreenLease {
+    pub owner_id: String,
+    pub fence: u32,
+}
+
+#[derive(Debug, Error, Clone, PartialEq, Eq)]
+#[error("computer is busy")]
+pub struct ComputerBusyError;
+
+pub fn screen_lease_id(run_id: &str, fence: u32) -> String {
+    format!("{run_id}:{fence}")
+}
+
+pub fn parse_screen_lease_id(lease_id: &str) -> ScreenLease {
+    match lease_id.rsplit_once(':') {
+        Some((owner, fence)) if !owner.is_empty() => {
+            if let Ok(fence) = fence.parse::<u32>() {
+                return ScreenLease {
+                    owner_id: owner.to_string(),
+                    fence,
+                };
+            }
+        }
+        _ => {}
+    }
+    ScreenLease {
+        owner_id: lease_id.to_string(),
+        fence: 0,
+    }
+}
+
+pub fn can_take_screen_lease(existing: Option<&str>, incoming: Option<&str>) -> bool {
+    let Some(incoming) = incoming else {
+        return false;
+    };
+    match existing {
+        None => true,
+        Some(existing) if existing == incoming => true,
+        Some(existing) => parse_screen_lease_id(incoming).fence > parse_screen_lease_id(existing).fence,
+    }
+}
+
+pub fn can_release_screen_lease(existing: Option<&str>, incoming: Option<&str>) -> bool {
+    match (existing, incoming) {
+        (_, None) | (None, _) => true,
+        (Some(existing), Some(incoming)) if existing == incoming => true,
+        (Some(existing), Some(incoming)) => {
+            let current = parse_screen_lease_id(existing);
+            let next = parse_screen_lease_id(incoming);
+            next.owner_id == current.owner_id && next.fence >= current.fence
+        }
+    }
+}
+
+pub fn next_fence(current: u32) -> u32 {
+    current.saturating_add(1)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn newer_fence_takes_the_screen() {
+        assert!(can_take_screen_lease(None, Some("run-a:1")));
+        assert!(can_take_screen_lease(Some("run-a:1"), Some("run-a:1")));
+        assert!(can_take_screen_lease(Some("run-a:1"), Some("run-b:2")));
+        assert!(!can_take_screen_lease(Some("run-a:2"), Some("run-b:1")));
+        assert!(!can_take_screen_lease(Some("run-a:1"), None));
+    }
+
+    #[test]
+    fn release_requires_same_owner_and_non_decreasing_fence() {
+        assert!(can_release_screen_lease(Some("run-a:1"), Some("run-a:1")));
+        assert!(can_release_screen_lease(Some("run-a:1"), Some("run-a:2")));
+        assert!(!can_release_screen_lease(Some("run-a:2"), Some("run-b:3")));
+        assert!(!can_release_screen_lease(Some("run-a:2"), Some("run-a:1")));
+    }
+}
diff --git a/crates/control/src/lib.rs b/crates/control/src/lib.rs
new file mode 100644
index 0000000..d362358
--- /dev/null
+++ b/crates/control/src/lib.rs
@@ -0,0 +1,17 @@
+mod actions;
+mod lease;
+mod observe;
+mod path;
+mod sandbox;
+mod screen;
+mod takeover;
+mod x11;
+
+pub use actions::*;
+pub use lease::*;
+pub use observe::*;
+pub use path::*;
+pub use sandbox::*;
+pub use screen::*;
+pub use takeover::*;
+pub use x11::*;
diff --git a/crates/control/src/observe.rs b/crates/control/src/observe.rs
new file mode 100644
index 0000000..ffe5b0f
--- /dev/null
+++ b/crates/control/src/observe.rs
@@ -0,0 +1,41 @@
+use chrono::Utc;
+use lazyboy_contracts::{ActiveWindow, ComputerObservation, CursorPosition};
+use sha2::{Digest, Sha256};
+
+pub fn observation_from_png(
+    image: Vec<u8>,
+    width: u32,
+    height: u32,
+    cursor: Option<CursorPosition>,
+    active_window: Option<ActiveWindow>,
+) -> ComputerObservation {
+    ComputerObservation {
+        frame_id: hex::encode(Sha256::digest(&image)),
+        captured_at: Utc::now().to_rfc3339(),
+        mime_type: "image/png".to_string(),
+        image,
+        width,
+        height,
+        cursor,
+        active_window,
+    }
+}
+
+pub fn frames_match(previous_frame_id: Option<&str>, observation: &ComputerObservation) -> bool {
+    previous_frame_id == Some(observation.frame_id.as_str())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn identical_bytes_share_a_frame_id() {
+        let a = observation_from_png(vec![1, 2, 3], 1, 1, None, None);
+        let b = observation_from_png(vec![1, 2, 3], 1, 1, None, None);
+        assert_eq!(a.frame_id, b.frame_id);
+        assert!(frames_match(Some(&a.frame_id), &b));
+        let c = observation_from_png(vec![1, 2, 4], 1, 1, None, None);
+        assert!(!frames_match(Some(&a.frame_id), &c));
+    }
+}
diff --git a/crates/control/src/path.rs b/crates/control/src/path.rs
new file mode 100644
index 0000000..23edc83
--- /dev/null
+++ b/crates/control/src/path.rs
@@ -0,0 +1,188 @@
+use lazyboy_contracts::ComputerMode;
+use thiserror::Error;
+
+#[derive(Debug, Error, Clone, PartialEq, Eq)]
+pub enum PathError {
+    #[error("path escapes the computer workspace")]
+    EscapesWorkspace,
+}
+
+pub fn normalize_workspace_path(value: &str) -> Result<String, PathError> {
+    let normalized = value.replace('\\', "/").trim_start_matches('/').to_string();
+    let segments: Vec<&str> = normalized.split('/').filter(|segment| !segment.is_empty()).collect();
+    if segments.iter().any(|segment| *segment == "." || *segment == "..") {
+        return Err(PathError::EscapesWorkspace);
+    }
+    Ok(segments.join("/"))
+}
+
+pub fn team_bot_workspace_directory(bot_id: &str) -> Result<String, PathError> {
+    Ok(format!("bots/{}", normalize_workspace_path(bot_id)?))
+}
+
+/// Map a bot-facing path onto the stored workspace path.
+///
+/// Team computers prefix relative work into `bots/<botId>/`.
+/// `shared/...` and `bots/...` address the shared root. Dedicated computers
+/// treat the requested path as already rooted at the bot home.
+pub fn resolve_bot_workspace_path(
+    mode: ComputerMode,
+    bot_id: &str,
+    requested_path: &str,
+) -> Result<String, PathError> {
+    if mode != ComputerMode::Team {
+        return normalize_workspace_path(requested_path);
+    }
+    let explicit_root = strip_virtual_workspace_root(requested_path);
+    let normalized = normalize_workspace_path(explicit_root.unwrap_or(requested_path))?;
+    if explicit_root.is_some() || is_team_root_path(&normalized) {
+        return Ok(normalized);
+    }
+    let home = team_bot_workspace_directory(bot_id)?;
+    if normalized.is_empty() {
+        Ok(home)
+    } else {
+        Ok(format!("{home}/{normalized}"))
+    }
+}
+
+pub fn resolve_bot_workspace_cwd(
+    mode: ComputerMode,
+    bot_id: &str,
+    requested_cwd: Option<&str>,
+) -> Result<Option<String>, PathError> {
+    if mode != ComputerMode::Team {
+        return Ok(requested_cwd.map(str::to_string));
+    }
+    match requested_cwd {
+        None | Some("") | Some(".") => Ok(Some(team_bot_workspace_directory(bot_id)?)),
+        Some(cwd) if cwd.starts_with('/') => Ok(Some(cwd.to_string())),
+        Some(cwd) => Ok(Some(resolve_bot_workspace_path(mode, bot_id, cwd)?)),
+    }
+}
+
+pub fn display_bot_workspace_path(
+    mode: ComputerMode,
+    bot_id: &str,
+    requested_path: &str,
+    stored_path: &str,
+) -> Result<String, PathError> {
+    if mode != ComputerMode::Team || !is_bot_relative_request(requested_path) {
+        return Ok(stored_path.to_string());
+    }
+    let normalized = normalize_workspace_path(stored_path)?;
+    let bot_directory = team_bot_workspace_directory(bot_id)?;
+    if normalized == bot_directory {
+        return Ok(String::new());
+    }
+    let prefix = format!("{bot_directory}/");
+    if let Some(rest) = normalized.strip_prefix(&prefix) {
+        Ok(rest.to_string())
+    } else {
+        Ok(normalized)
+    }
+}
+
+fn is_bot_relative_request(value: &str) -> bool {
+    strip_virtual_workspace_root(value).is_none()
+        && !is_team_root_path(&normalize_workspace_path(value).unwrap_or_default())
+}
+
+fn strip_virtual_workspace_root(value: &str) -> Option<&str> {
+    let trimmed = value.trim_start_matches('/');
+    trimmed.strip_prefix("workspace/").or_else(|| {
+        if trimmed == "workspace" {
+            Some("")
+        } else {
+            None
+        }
+    })
+}
+
+fn is_team_root_path(value: &str) -> bool {
+    value == "shared"
+        || value.starts_with("shared/")
+        || value == "bots"
+        || value.starts_with("bots/")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn rejects_parent_segments() {
+        assert!(matches!(
+            normalize_workspace_path("../etc/passwd"),
+            Err(PathError::EscapesWorkspace)
+        ));
+        assert!(matches!(
+            normalize_workspace_path("foo/./bar"),
+            Err(PathError::EscapesWorkspace)
+        ));
+    }
+
+    #[test]
+    fn dedicated_paths_stay_at_home_root() {
+        let path = resolve_bot_workspace_path(ComputerMode::Dedicated, "bot-1", "notes/a.txt").unwrap();
+        assert_eq!(path, "notes/a.txt");
+    }
+
+    #[test]
+    fn team_relative_paths_live_in_bot_folder() {
+        let path = resolve_bot_workspace_path(ComputerMode::Team, "bot-1", "notes/a.txt").unwrap();
+        assert_eq!(path, "bots/bot-1/notes/a.txt");
+        let cwd = resolve_bot_workspace_cwd(ComputerMode::Team, "bot-1", None)
+            .unwrap()
+            .unwrap();
+        assert_eq!(cwd, "bots/bot-1");
+    }
+
+    #[test]
+    fn team_shared_and_bots_address_the_root() {
+        assert_eq!(
+            resolve_bot_workspace_path(ComputerMode::Team, "bot-1", "shared/plan.md").unwrap(),
+            "shared/plan.md"
+        );
+        assert_eq!(
+            resolve_bot_workspace_path(ComputerMode::Team, "bot-1", "bots/bot-2/x").unwrap(),
+            "bots/bot-2/x"
+        );
+    }
+
+    #[test]
+    fn display_strips_bot_prefix_for_relative_requests() {
+        let shown = display_bot_workspace_path(
+            ComputerMode::Team,
+            "bot-1",
+            "notes/a.txt",
+            "bots/bot-1/notes/a.txt",
+        )
+        .unwrap();
+        assert_eq!(shown, "notes/a.txt");
+        let shared = display_bot_workspace_path(
+            ComputerMode::Team,
+            "bot-1",
+            "shared/plan.md",
+            "shared/plan.md",
+        )
+        .unwrap();
+        assert_eq!(shared, "shared/plan.md");
+    }
+
+    #[test]
+    fn private_homes_are_not_the_team_home() {
+        let team = lazyboy_contracts::computer_home_key(ComputerMode::Team, "space-1", None).unwrap();
+        let private = lazyboy_contracts::computer_home_key(
+            ComputerMode::Dedicated,
+            "space-1",
+            Some("bot-private"),
+        )
+        .unwrap();
+        assert_ne!(team, private);
+        assert_eq!(
+            resolve_bot_workspace_path(ComputerMode::Dedicated, "bot-private", "shared/secret.txt").unwrap(),
+            "shared/secret.txt"
+        );
+    }
+}
diff --git a/crates/control/src/sandbox.rs b/crates/control/src/sandbox.rs
new file mode 100644
index 0000000..e8212ed
--- /dev/null
+++ b/crates/control/src/sandbox.rs
@@ -0,0 +1,252 @@
+use lazyboy_contracts::{ComputerAction, ComputerCapabilities, ComputerObservation, SandboxKind};
+use serde::{Deserialize, Serialize};
+use thiserror::Error;
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct AdapterContext {
+    pub operation_id: String,
+    pub space_id: String,
+    pub user_id: String,
+    pub bot_id: Option<String>,
+    pub run_id: Option<String>,
+    pub screen_lease_id: Option<String>,
+    #[serde(default)]
+    pub screen_id: Option<String>,
+    #[serde(default)]
+    pub screen_slot: Option<u32>,
+    #[serde(default)]
+    pub display: Option<String>,
+    #[serde(default)]
+    pub profile_path: Option<String>,
+}
+
+impl Default for AdapterContext {
+    fn default() -> Self {
+        Self {
+            operation_id: String::new(),
+            space_id: String::new(),
+            user_id: String::new(),
+            bot_id: None,
+            run_id: None,
+            screen_lease_id: None,
+            screen_id: None,
+            screen_slot: None,
+            display: None,
+            profile_path: None,
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct ComputerRef {
+    pub id: String,
+    pub home_key: String,
+    pub kind: SandboxKind,
+    pub provider_ref: String,
+    pub fresh: bool,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct ProvisionRequest {
+    pub home_key: String,
+    pub home_path: String,
+    pub provider_ref: Option<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct CommandRequest {
+    pub argv: Vec<String>,
+    pub cwd: Option<String>,
+    pub timeout_ms: Option<u64>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct CommandResult {
+    pub stdout: String,
+    pub stderr: String,
+    pub code: i32,
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct ActionRequest {
+    pub actions: Vec<ComputerAction>,
+    pub observe: bool,
+    pub settle_ms: u32,
+    #[serde(default)]
+    pub display: Option<String>,
+    #[serde(default)]
+    pub profile_path: Option<String>,
+}
+
+impl ActionRequest {
+    pub fn new(actions: Vec<ComputerAction>, observe: bool, settle_ms: u32) -> Self {
+        Self {
+            actions,
+            observe,
+            settle_ms,
+            display: None,
+            profile_path: None,
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct EnsureScreenRequest {
+    pub slot: u32,
+    pub profile_path: String,
+    pub bot_id: String,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct EnsureScreenResult {
+    pub slot: u32,
+    pub display: String,
+    pub view_port: u16,
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct ActionResult {
+    pub completed: usize,
+    pub observation: Option<ComputerObservation>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct FileEntry {
+    pub path: String,
+    pub kind: String,
+    pub size: u64,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct ScreenSession {
+    pub url: Option<String>,
+    pub interactive: bool,
+}
+
+#[derive(Debug, Error)]
+pub enum SandboxError {
+    #[error("{0}")]
+    Message(String),
+    #[error("computer is busy")]
+    Busy,
+    #[error("{0}")]
+    MultiScreen(String),
+}
+
+impl SandboxError {
+    pub fn message(text: impl Into<String>) -> Self {
+        Self::Message(text.into())
+    }
+}
+
+#[async_trait::async_trait]
+pub trait SandboxProvider: Send + Sync {
+    async fn provision(
+        &self,
+        request: ProvisionRequest,
+        context: &AdapterContext,
+    ) -> Result<ComputerRef, SandboxError>;
+
+    async fn prepare(&self, computer: &ComputerRef, context: &AdapterContext) -> Result<(), SandboxError> {
+        let _ = (computer, context);
+        Ok(())
+    }
+
+    async fn capabilities(
+        &self,
+        computer: &ComputerRef,
+        context: &AdapterContext,
+    ) -> Result<ComputerCapabilities, SandboxError> {
+        let _ = (computer, context);
+        Ok(ComputerCapabilities { multi_screen: true })
+    }
+
+    async fn ensure_screen(
+        &self,
+        computer: &ComputerRef,
+        request: EnsureScreenRequest,
+        context: &AdapterContext,
+    ) -> Result<EnsureScreenResult, SandboxError> {
+        let _ = (computer, context);
+        let layout = crate::screen_layout(request.slot)
+            .map_err(|error| SandboxError::message(error.to_string()))?;
+        Ok(EnsureScreenResult {
+            slot: layout.slot,
+            display: layout.display,
+            view_port: layout.view_port,
+        })
+    }
+
+    async fn reconnect(
+        &self,
+        request: ProvisionRequest,
+        context: &AdapterContext,
+    ) -> Result<ComputerRef, SandboxError> {
+        self.provision(request, context).await
+    }
+
+    async fn suspend(&self, computer: &ComputerRef, context: &AdapterContext) -> Result<(), SandboxError> {
+        self.stop(computer, context).await
+    }
+
+    async fn resume(
+        &self,
+        request: ProvisionRequest,
+        context: &AdapterContext,
+    ) -> Result<ComputerRef, SandboxError> {
+        self.provision(request, context).await
+    }
+
+    async fn execute(
+        &self,
+        computer: &ComputerRef,
+        request: CommandRequest,
+        context: &AdapterContext,
+    ) -> Result<CommandResult, SandboxError>;
+
+    async fn observe(
+        &self,
+        computer: &ComputerRef,
+        context: &AdapterContext,
+    ) -> Result<ComputerObservation, SandboxError>;
+
+    async fn act(
+        &self,
+        computer: &ComputerRef,
+        request: ActionRequest,
+        context: &AdapterContext,
+    ) -> Result<ActionResult, SandboxError>;
+
+    async fn connect_screen(
+        &self,
+        computer: &ComputerRef,
+        interactive: bool,
+        context: &AdapterContext,
+    ) -> Result<ScreenSession, SandboxError>;
+
+    async fn list_files(
+        &self,
+        computer: &ComputerRef,
+        path: &str,
+        context: &AdapterContext,
+    ) -> Result<Vec<FileEntry>, SandboxError>;
+
+    async fn read_file(
+        &self,
+        computer: &ComputerRef,
+        path: &str,
+        context: &AdapterContext,
+    ) -> Result<Vec<u8>, SandboxError>;
+
+    async fn write_file(
+        &self,
+        computer: &ComputerRef,
+        path: &str,
+        content: &[u8],
+        context: &AdapterContext,
+    ) -> Result<(), SandboxError>;
+
+    async fn stop(&self, computer: &ComputerRef, context: &AdapterContext) -> Result<(), SandboxError>;
+
+    async fn destroy(&self, computer: &ComputerRef, context: &AdapterContext) -> Result<(), SandboxError>;
+}
diff --git a/crates/control/src/screen.rs b/crates/control/src/screen.rs
new file mode 100644
index 0000000..85b4b18
--- /dev/null
+++ b/crates/control/src/screen.rs
@@ -0,0 +1,256 @@
+use lazyboy_contracts::{
+    BrowserProfileMode, ComputerCapabilities, MULTI_SCREEN_UNAVAILABLE, PROFILE_LOCKED,
+    TEAM_SCREENS_FULL,
+};
+pub use lazyboy_contracts::TEAM_SCREEN_LIMIT;
+use thiserror::Error;
+
+use crate::HOME;
+
+pub const PRIMARY_DISPLAY: &str = ":1";
+pub const PRIMARY_VIEW_PORT: u16 = 6080;
+pub const PRIMARY_VNC_PORT: u16 = 5900;
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ScreenLayout {
+    pub slot: u32,
+    pub display: String,
+    pub display_number: u32,
+    pub view_port: u16,
+    pub vnc_port: u16,
+    pub is_primary: bool,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum GuiBlock {
+    MultiScreenUnavailable { busy_bot_name: Option<String> },
+    ScreensFull,
+    ProfileLocked { bot_name: String },
+}
+
+impl GuiBlock {
+    pub fn message(&self) -> String {
+        match self {
+            Self::MultiScreenUnavailable { busy_bot_name } => match busy_bot_name {
+                Some(name) => format!("{MULTI_SCREEN_UNAVAILABLE} Currently in use by {name}."),
+                None => MULTI_SCREEN_UNAVAILABLE.to_string(),
+            },
+            Self::ScreensFull => TEAM_SCREENS_FULL.to_string(),
+            Self::ProfileLocked { bot_name } => {
+                format!("{PROFILE_LOCKED} Currently in use by {bot_name}.")
+            }
+        }
+    }
+}
+
+#[derive(Debug, Error, Clone, PartialEq, Eq)]
+#[error("{0}")]
+pub struct ScreenError(pub String);
+
+pub fn screen_layout(slot: u32) -> Result<ScreenLayout, ScreenError> {
+    if slot >= TEAM_SCREEN_LIMIT {
+        return Err(ScreenError(format!("screen slot {slot} is out of range")));
+    }
+    let display_number = slot + 1;
+    Ok(ScreenLayout {
+        slot,
+        display: format!(":{display_number}"),
+        display_number,
+        view_port: PRIMARY_VIEW_PORT + slot as u16,
+        vnc_port: PRIMARY_VNC_PORT + slot as u16,
+        is_primary: slot == 0,
+    })
+}
+
+pub fn allocate_slot(used: &[u32]) -> Option<u32> {
+    (0..TEAM_SCREEN_LIMIT).find(|slot| !used.contains(slot))
+}
+
+pub fn browser_profile_path(mode: BrowserProfileMode, bot_id: &str, run_id: Option<&str>) -> String {
+    match mode {
+        BrowserProfileMode::Shared => format!("{HOME}/.browser-profiles/chromium"),
+        BrowserProfileMode::PerBot => format!("{HOME}/.browser-profiles/bots/{bot_id}"),
+        BrowserProfileMode::PerTask => {
+            let task = run_id.filter(|value| !value.is_empty()).unwrap_or("task");
+            format!("{HOME}/.browser-profiles/tasks/{task}")
+        }
+    }
+}
+
+pub fn profile_lock_key(mode: BrowserProfileMode, bot_id: &str, run_id: Option<&str>) -> String {
+    match mode {
+        BrowserProfileMode::Shared => "shared".into(),
+        BrowserProfileMode::PerBot => format!("bot:{bot_id}"),
+        BrowserProfileMode::PerTask => {
+            format!("task:{}", run_id.filter(|value| !value.is_empty()).unwrap_or("task"))
+        }
+    }
+}
+
+pub fn can_take_profile_lock(holder_bot_id: Option<&str>, incoming_bot_id: &str) -> bool {
+    match holder_bot_id {
+        None => true,
+        Some(holder) if holder == incoming_bot_id => true,
+        Some(_) => false,
+    }
+}
+
+/// Decide whether this bot may drive a GUI session.
+///
+/// Shell and files are never gated here. Whole-machine locks are not a
+/// concurrency model: only a missing multi-screen capability, a full slot
+/// table, or a shared profile lock can block desktop tools.
+pub fn admit_gui(
+    capabilities: &ComputerCapabilities,
+    requester_bot_id: &str,
+    requester_has_screen: bool,
+    other_gui_bot_name: Option<&str>,
+    profile_lock_holder: Option<&str>,
+    profile_lock_holder_name: Option<&str>,
+) -> Result<(), GuiBlock> {
+    if !capabilities.multi_screen && other_gui_bot_name.is_some() && !requester_has_screen {
+        return Err(GuiBlock::MultiScreenUnavailable {
+            busy_bot_name: other_gui_bot_name.map(str::to_string),
+        });
+    }
+    if !can_take_profile_lock(profile_lock_holder, requester_bot_id) {
+        return Err(GuiBlock::ProfileLocked {
+            bot_name: profile_lock_holder_name
+                .unwrap_or("another bot")
+                .to_string(),
+        });
+    }
+    Ok(())
+}
+
+pub fn admit_new_screen(
+    capabilities: &ComputerCapabilities,
+    used_slots: &[u32],
+    requester_existing_slot: Option<u32>,
+) -> Result<u32, GuiBlock> {
+    if let Some(slot) = requester_existing_slot {
+        return Ok(slot);
+    }
+    if !capabilities.multi_screen && !used_slots.is_empty() {
+        return Err(GuiBlock::MultiScreenUnavailable { busy_bot_name: None });
+    }
+    allocate_slot(used_slots).ok_or(GuiBlock::ScreensFull)
+}
+
+pub fn normalize_display(display: &str) -> &str {
+    if display.is_empty() {
+        PRIMARY_DISPLAY
+    } else {
+        display
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ScreenTarget {
+    pub display: String,
+    pub profile_path: Option<String>,
+    pub slot: u32,
+}
+
+impl Default for ScreenTarget {
+    fn default() -> Self {
+        Self {
+            display: PRIMARY_DISPLAY.into(),
+            profile_path: None,
+            slot: 0,
+        }
+    }
+}
+
+impl ScreenTarget {
+    pub fn from_parts(display: Option<&str>, profile_path: Option<&str>, slot: Option<u32>) -> Self {
+        Self {
+            display: normalize_display(display.unwrap_or_default()).to_string(),
+            profile_path: profile_path.filter(|value| !value.is_empty()).map(str::to_string),
+            slot: slot.unwrap_or(0),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn slots_map_to_independent_displays() {
+        let a = screen_layout(0).unwrap();
+        let b = screen_layout(1).unwrap();
+        assert_eq!(a.display, ":1");
+        assert_eq!(b.display, ":2");
+        assert_ne!(a.view_port, b.view_port);
+        assert_ne!(a.vnc_port, b.vnc_port);
+        assert!(a.is_primary);
+        assert!(!b.is_primary);
+    }
+
+    #[test]
+    fn two_bots_get_distinct_slots() {
+        let first = allocate_slot(&[]).unwrap();
+        let second = allocate_slot(&[first]).unwrap();
+        assert_eq!(first, 0);
+        assert_eq!(second, 1);
+        assert_ne!(
+            screen_layout(first).unwrap().display,
+            screen_layout(second).unwrap().display
+        );
+    }
+
+    #[test]
+    fn per_bot_profiles_do_not_share_cookie_dirs() {
+        let a = browser_profile_path(BrowserProfileMode::PerBot, "bot-a", None);
+        let b = browser_profile_path(BrowserProfileMode::PerBot, "bot-b", None);
+        assert_ne!(a, b);
+        assert!(a.ends_with("/bots/bot-a"));
+        assert_eq!(
+            browser_profile_path(BrowserProfileMode::Shared, "bot-a", None),
+            browser_profile_path(BrowserProfileMode::Shared, "bot-b", None)
+        );
+        assert_ne!(
+            profile_lock_key(BrowserProfileMode::PerBot, "bot-a", None),
+            profile_lock_key(BrowserProfileMode::PerBot, "bot-b", None)
+        );
+        assert_eq!(
+            profile_lock_key(BrowserProfileMode::Shared, "bot-a", None),
+            profile_lock_key(BrowserProfileMode::Shared, "bot-b", None)
+        );
+    }
+
+    #[test]
+    fn multi_screen_false_blocks_a_second_bot_gui_only() {
+        let caps = ComputerCapabilities { multi_screen: false };
+        let err = admit_new_screen(&caps, &[0], None).unwrap_err();
+        assert!(matches!(err, GuiBlock::MultiScreenUnavailable { .. }));
+        assert!(admit_new_screen(&caps, &[0], Some(0)).is_ok());
+        assert!(admit_new_screen(&ComputerCapabilities { multi_screen: true }, &[0], None).is_ok());
+    }
+
+    #[test]
+    fn shared_profile_lock_is_exclusive() {
+        assert!(can_take_profile_lock(None, "a"));
+        assert!(can_take_profile_lock(Some("a"), "a"));
+        assert!(!can_take_profile_lock(Some("a"), "b"));
+        let err = admit_gui(
+            &ComputerCapabilities { multi_screen: true },
+            "b",
+            true,
+            None,
+            Some("a"),
+            Some("Alpha"),
+        )
+        .unwrap_err();
+        assert!(matches!(err, GuiBlock::ProfileLocked { .. }));
+        assert!(err.message().contains("Alpha"));
+    }
+
+    #[test]
+    fn different_bots_are_not_serialized_by_a_machine_lock() {
+        let caps = ComputerCapabilities { multi_screen: true };
+        assert!(admit_gui(&caps, "a", true, Some("b"), Some("a"), Some("A")).is_ok());
+        assert!(admit_gui(&caps, "b", true, Some("a"), Some("b"), Some("B")).is_ok());
+    }
+}
diff --git a/crates/control/src/takeover.rs b/crates/control/src/takeover.rs
new file mode 100644
index 0000000..8242f95
--- /dev/null
+++ b/crates/control/src/takeover.rs
@@ -0,0 +1,80 @@
+use chrono::{DateTime, Utc};
+use lazyboy_contracts::RunStatus;
+
+/// Mirrors computer.takeover: an execution lease blocks user control unless
+/// the run is waiting for a human.
+pub fn execution_blocks_user_takeover(
+    has_lease: bool,
+    lease_expires_at: Option<DateTime<Utc>>,
+    run_status: Option<RunStatus>,
+    now: DateTime<Utc>,
+) -> bool {
+    if !has_lease {
+        return false;
+    }
+    if run_status == Some(RunStatus::WaitingTakeover) {
+        return false;
+    }
+    let lease_active = lease_expires_at.is_some_and(|expires| expires > now);
+    let run_active = run_status.is_some_and(RunStatus::is_active);
+    lease_active || run_active
+}
+
+pub fn user_holds_control(
+    holder: lazyboy_contracts::ControlHolder,
+    control_bot_id: Option<&str>,
+    bot_id: &str,
+    lease_expires_at: Option<DateTime<Utc>>,
+    now: DateTime<Utc>,
+) -> bool {
+    holder == lazyboy_contracts::ControlHolder::User
+        && control_bot_id == Some(bot_id)
+        && lease_expires_at.is_some_and(|expires| expires > now)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use chrono::Duration;
+
+    fn now() -> DateTime<Utc> {
+        DateTime::parse_from_rfc3339("2026-09-03T12:00:00Z")
+            .unwrap()
+            .with_timezone(&Utc)
+    }
+
+    #[test]
+    fn live_run_blocks_takeover() {
+        assert!(execution_blocks_user_takeover(
+            true,
+            Some(now() + Duration::minutes(4)),
+            Some(RunStatus::Running),
+            now(),
+        ));
+    }
+
+    #[test]
+    fn waiting_takeover_allows_the_human() {
+        assert!(!execution_blocks_user_takeover(
+            true,
+            Some(now() + Duration::minutes(4)),
+            Some(RunStatus::WaitingTakeover),
+            now(),
+        ));
+    }
+
+    #[test]
+    fn expired_lease_without_active_run_does_not_block() {
+        assert!(!execution_blocks_user_takeover(
+            true,
+            Some(now() - Duration::minutes(1)),
+            Some(RunStatus::Completed),
+            now(),
+        ));
+    }
+
+    #[test]
+    fn no_lease_does_not_block() {
+        assert!(!execution_blocks_user_takeover(false, None, None, now()));
+    }
+}
diff --git a/crates/control/src/x11.rs b/crates/control/src/x11.rs
new file mode 100644
index 0000000..c298b1b
--- /dev/null
+++ b/crates/control/src/x11.rs
@@ -0,0 +1,327 @@
+use lazyboy_contracts::{ComputerAction, PointerButton, PointerType, ScrollDirection};
+
+use crate::screen::{normalize_display, PRIMARY_DISPLAY};
+
+pub const DISPLAY: &str = PRIMARY_DISPLAY;
+pub const HOME: &str = "/home/lazyboy";
+
+fn display_env(display: &str) -> String {
+    format!("DISPLAY={}", normalize_display(display))
+}
+
+pub fn xdotool_argv(action: &ComputerAction) -> Option<Vec<String>> {
+    xdotool_argv_on(PRIMARY_DISPLAY, action)
+}
+
+pub fn xdotool_argv_on(display: &str, action: &ComputerAction) -> Option<Vec<String>> {
+    let mut argv = vec!["env".into(), display_env(display), "xdotool".into()];
+    match action {
+        ComputerAction::Pointer {
+            x,
+            y,
+            pointer_type,
+            button,
+        } => {
+            let button_n = match button.unwrap_or(PointerButton::Left) {
+                PointerButton::Left => "1",
+                PointerButton::Middle => "2",
+                PointerButton::Right => "3",
+            };
+            match pointer_type {
+                PointerType::Move => {
+                    argv.extend([
+                        "mousemove".into(),
+                        "--sync".into(),
+                        "--".into(),
+                        x.to_string(),
+                        y.to_string(),
+                    ]);
+                }
+                PointerType::Click => {
+                    argv.extend([
+                        "mousemove".into(),
+                        "--sync".into(),
+                        "--".into(),
+                        x.to_string(),
+                        y.to_string(),
+                        "click".into(),
+                        "--delay".into(),
+                        "40".into(),
+                        button_n.into(),
+                    ]);
+                }
+                PointerType::Down => {
+                    argv.extend([
+                        "mousemove".into(),
+                        "--".into(),
+                        x.to_string(),
+                        y.to_string(),
+                        "mousedown".into(),
+                        button_n.into(),
+                    ]);
+                }
+                PointerType::Up => {
+                    argv.extend([
+                        "mousemove".into(),
+                        "--".into(),
+                        x.to_string(),
+                        y.to_string(),
+                        "mouseup".into(),
+                        button_n.into(),
+                    ]);
+                }
+            }
+        }
+        ComputerAction::Key { key, modifiers } => {
+            let combo = match modifiers {
+                Some(items) if !items.is_empty() => format!("{}+{key}", items.join("+")),
+                _ => key.clone(),
+            };
+            argv.extend(["key".into(), "--clearmodifiers".into(), combo]);
+        }
+        ComputerAction::Clipboard { text } => {
+            let quoted = shell_single_quote(text);
+            if looks_like_typed_ascii(text) {
+                argv.extend(["type".into(), "--delay".into(), "16".into(), "--".into(), text.clone()]);
+            } else {
+                return Some(vec![
+                    "env".into(),
+                    display_env(display),
+                    "bash".into(),
+                    "-lc".into(),
+                    format!(
+                        "printf %s {quoted} | xclip -selection clipboard && xdotool key --clearmodifiers ctrl+v"
+                    ),
+                ]);
+            }
+        }
+        ComputerAction::Scroll { direction, amount } => {
+            let button = match direction {
+                ScrollDirection::Up => "4",
+                ScrollDirection::Down => "5",
+            };
+            argv.extend([
+                "click".into(),
+                "--repeat".into(),
+                amount.unwrap_or(12).to_string(),
+                "--delay".into(),
+                "15".into(),
+                button.into(),
+            ]);
+        }
+        ComputerAction::Focus { title } => {
+            let quoted = shell_single_quote(title);
+            return Some(vec![
+                "env".into(),
+                display_env(display),
+                "bash".into(),
+                "-lc".into(),
+                format!(
+                    "wmctrl -a {quoted} || xdotool search --name {quoted} windowactivate --sync windowfocus"
+                ),
+            ]);
+        }
+        ComputerAction::Wait { .. } | ComputerAction::Open { .. } | ComputerAction::Launch { .. } => {
+            return None;
+        }
+    }
+    Some(argv)
+}
+
+fn shell_single_quote(value: &str) -> String {
+    format!("'{}'", value.replace('\'', "'\\''"))
+}
+
+fn looks_like_typed_ascii(text: &str) -> bool {
+    text.len() <= 48
+        && text.chars().all(|ch| ch.is_ascii() && (!ch.is_control() || ch == '\n' || ch == '\t'))
+}
+
+pub fn action_pause_ms(action: &ComputerAction) -> u64 {
+    match action {
+        ComputerAction::Pointer { pointer_type, .. } => match pointer_type {
+            PointerType::Move => 18,
+            PointerType::Click => 55,
+            PointerType::Down | PointerType::Up => 30,
+        },
+        ComputerAction::Scroll { .. } => 45,
+        ComputerAction::Clipboard { text } if looks_like_typed_ascii(text) => 40,
+        ComputerAction::Clipboard { .. } | ComputerAction::Key { .. } => 35,
+        ComputerAction::Focus { .. } => 90,
+        ComputerAction::Open { .. } | ComputerAction::Launch { .. } => 220,
+        ComputerAction::Wait { .. } => 0,
+    }
+}
+
+pub fn pointer_state_command() -> Vec<String> {
+    pointer_state_command_on(PRIMARY_DISPLAY)
+}
+
+pub fn pointer_state_command_on(display: &str) -> Vec<String> {
+    vec![
+        "env".into(),
+        display_env(display),
+        "python3".into(),
+        "-c".into(),
+        r#"
+import json, subprocess
+def out(args):
+    try:
+        return subprocess.check_output(args, stderr=subprocess.DEVNULL, text=True).strip()
+    except Exception:
+        return ""
+vals = {}
+for line in out(["xdotool", "getmouselocation", "--shell"]).splitlines():
+    if "=" in line:
+        key, value = line.split("=", 1)
+        vals[key] = value
+wid = out(["xdotool", "getactivewindow"])
+title = out(["xdotool", "getwindowname", wid]) if wid else ""
+print(json.dumps({"x": int(vals.get("X") or 0), "y": int(vals.get("Y") or 0), "id": wid, "title": title}))
+"#
+        .into(),
+    ]
+}
+
+pub fn parse_pointer_state(raw: &str) -> (Option<lazyboy_contracts::CursorPosition>, Option<lazyboy_contracts::ActiveWindow>) {
+    let value: serde_json::Value = serde_json::from_str(raw.trim()).unwrap_or(serde_json::Value::Null);
+    let cursor = match (value.get("x").and_then(serde_json::Value::as_i64), value.get("y").and_then(serde_json::Value::as_i64)) {
+        (Some(x), Some(y)) => Some(lazyboy_contracts::CursorPosition {
+            x: x as i32,
+            y: y as i32,
+        }),
+        _ => None,
+    };
+    let window = value.get("id").and_then(serde_json::Value::as_str).filter(|id| !id.is_empty()).map(|id| {
+        lazyboy_contracts::ActiveWindow {
+            id: id.to_string(),
+            title: value
+                .get("title")
+                .and_then(serde_json::Value::as_str)
+                .filter(|title| !title.is_empty())
+                .map(str::to_string),
+        }
+    });
+    (cursor, window)
+}
+
+pub fn open_argv(path: &str) -> Vec<String> {
+    open_argv_on(PRIMARY_DISPLAY, None, path)
+}
+
+pub fn open_argv_on(display: &str, profile: Option<&str>, path: &str) -> Vec<String> {
+    if path.starts_with("http://") || path.starts_with("https://") {
+        return browser_argv(display, profile, Some(path));
+    }
+    vec![
+        "env".into(),
+        display_env(display),
+        "xdg-open".into(),
+        path.into(),
+    ]
+}
+
+pub fn launch_argv(application: &str, uri: Option<&str>) -> Option<Vec<String>> {
+    launch_argv_on(PRIMARY_DISPLAY, None, application, uri)
+}
+
+pub fn launch_argv_on(
+    display: &str,
+    profile: Option<&str>,
+    application: &str,
+    uri: Option<&str>,
+) -> Option<Vec<String>> {
+    match application {
+        "browser" | "chrome" | "chromium" | "lazyboy-browser" => {
+            Some(browser_argv(display, profile, uri))
+        }
+        "xterm" | "terminal" | "xfce4-terminal" | "lazyboy-terminal" => {
+            let mut argv = vec!["env".into(), display_env(display), "lazyboy-terminal".into()];
+            if let Some(uri) = uri {
+                argv.push(uri.into());
+            }
+            Some(argv)
+        }
+        _ => None,
+    }
+}
+
+fn browser_argv(display: &str, profile: Option<&str>, uri: Option<&str>) -> Vec<String> {
+    let mut argv = vec!["env".into(), display_env(display)];
+    if let Some(profile) = profile.filter(|value| !value.is_empty()) {
+        argv.push(format!("LAZYBOY_BROWSER_PROFILE={profile}"));
+    }
+    argv.push("lazyboy-browser".into());
+    if let Some(uri) = uri {
+        argv.push(uri.into());
+    }
+    argv
+}
+
+pub fn screenshot_command() -> Vec<String> {
+    screenshot_command_on(PRIMARY_DISPLAY)
+}
+
+pub fn screenshot_command_on(display: &str) -> Vec<String> {
+    vec![
+        "bash".into(),
+        "-lc".into(),
+        format!(
+            "DISPLAY={} xwd -root -silent | convert xwd:- png:-",
+            normalize_display(display)
+        ),
+    ]
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn click_maps_to_xdotool() {
+        let argv = xdotool_argv(&ComputerAction::Pointer {
+            x: 12,
+            y: 40,
+            pointer_type: PointerType::Click,
+            button: Some(PointerButton::Left),
+        })
+        .unwrap();
+        assert!(argv.contains(&"click".into()));
+        assert!(argv.contains(&"12".into()));
+    }
+
+    #[test]
+    fn pointer_up_moves_before_release() {
+        let argv = xdotool_argv(&ComputerAction::Pointer {
+            x: 80,
+            y: 90,
+            pointer_type: PointerType::Up,
+            button: Some(PointerButton::Left),
+        })
+        .unwrap();
+        assert!(argv.contains(&"mousemove".into()));
+        assert!(argv.contains(&"80".into()));
+        assert!(argv.contains(&"mouseup".into()));
+    }
+
+    #[test]
+    fn extra_display_is_injected_into_input_commands() {
+        let argv = xdotool_argv_on(
+            ":2",
+            &ComputerAction::Pointer {
+                x: 4,
+                y: 8,
+                pointer_type: PointerType::Move,
+                button: None,
+            },
+        )
+        .unwrap();
+        assert!(argv.contains(&"DISPLAY=:2".into()));
+        let shot = screenshot_command_on(":3");
+        assert!(shot.last().unwrap().contains("DISPLAY=:3"));
+        let browser = launch_argv_on(":2", Some("/home/lazyboy/.browser-profiles/bots/a"), "browser", None)
+            .unwrap();
+        assert!(browser.contains(&"DISPLAY=:2".into()));
+        assert!(browser.iter().any(|item| item.contains("bots/a")));
+    }
+}
diff --git a/crates/controld/Cargo.toml b/crates/controld/Cargo.toml
new file mode 100644
index 0000000..f5420f7
--- /dev/null
+++ b/crates/controld/Cargo.toml
@@ -0,0 +1,18 @@
+[package]
+name = "lazyboy-controld"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+publish.workspace = true
+
+[dependencies]
+lazyboy-contracts.workspace = true
+lazyboy-control.workspace = true
+axum.workspace = true
+tokio.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+thiserror.workspace = true
+tracing.workspace = true
+tracing-subscriber.workspace = true
+base64.workspace = true
diff --git a/crates/controld/src/main.rs b/crates/controld/src/main.rs
new file mode 100644
index 0000000..03b3a00
--- /dev/null
+++ b/crates/controld/src/main.rs
@@ -0,0 +1,217 @@
+use std::process::Stdio;
+use std::time::Duration;
+
+use axum::extract::State;
+use axum::http::{HeaderMap, StatusCode};
+use axum::routing::{get, post};
+use axum::{Json, Router};
+use lazyboy_contracts::ComputerAction;
+use lazyboy_control::{
+    action_pause_ms, launch_argv_on, normalize_display, open_argv_on, parse_pointer_state,
+    pointer_state_command_on, screenshot_command_on, xdotool_argv_on, ActionRequest, PRIMARY_DISPLAY,
+};
+use tokio::io::AsyncReadExt;
+use tokio::process::Command;
+use tokio::time::sleep;
+
+#[derive(Clone)]
+struct App {
+    token: String,
+}
+
+#[tokio::main]
+async fn main() {
+    tracing_subscriber::fmt()
+        .with_env_filter(tracing_subscriber::EnvFilter::from_default_env())
+        .init();
+    let token = std::env::var("LAZYBOY_CONTROL_TOKEN").unwrap_or_default();
+    let app = Router::new()
+        .route("/health", get(|| async { "ok" }))
+        .route("/observe", post(observe))
+        .route("/act", post(act))
+        .with_state(App { token });
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:7070")
+        .await
+        .expect("bind control port");
+    tracing::info!("controld listening on 127.0.0.1:7070");
+    axum::serve(listener, app).await.expect("serve");
+}
+
+fn authorized(headers: &HeaderMap, token: &str) -> bool {
+    if token.is_empty() {
+        return false;
+    }
+    headers
+        .get(axum::http::header::AUTHORIZATION)
+        .and_then(|value| value.to_str().ok())
+        .is_some_and(|value| value == format!("Bearer {token}"))
+}
+
+fn header_value<'a>(headers: &'a HeaderMap, name: &'static str) -> Option<&'a str> {
+    headers.get(name).and_then(|value| value.to_str().ok()).filter(|value| !value.is_empty())
+}
+
+fn display_of(headers: &HeaderMap, fallback: Option<&str>) -> String {
+    normalize_display(
+        header_value(headers, "x-lazyboy-display")
+            .or(fallback)
+            .unwrap_or(PRIMARY_DISPLAY),
+    )
+    .to_string()
+}
+
+fn profile_of(headers: &HeaderMap, fallback: Option<&str>) -> Option<String> {
+    header_value(headers, "x-lazyboy-profile")
+        .or(fallback)
+        .filter(|value| !value.is_empty())
+        .map(str::to_string)
+}
+
+async fn observe(State(app): State<App>, headers: HeaderMap) -> Result<Json<serde_json::Value>, StatusCode> {
+    if !authorized(&headers, &app.token) {
+        return Err(StatusCode::UNAUTHORIZED);
+    }
+    let display = display_of(&headers, None);
+    let png = run_capture(&display)
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    Ok(Json(observation_json(&display, png).await))
+}
+
+async fn act(
+    State(app): State<App>,
+    headers: HeaderMap,
+    Json(request): Json<ActionRequest>,
+) -> Result<Json<serde_json::Value>, StatusCode> {
+    if !authorized(&headers, &app.token) {
+        return Err(StatusCode::UNAUTHORIZED);
+    }
+    let display = display_of(&headers, request.display.as_deref());
+    let profile = profile_of(&headers, request.profile_path.as_deref());
+    let mut completed = 0usize;
+    for action in &request.actions {
+        apply_action(&display, profile.as_deref(), action)
+            .await
+            .map_err(|_| StatusCode::BAD_REQUEST)?;
+        let pause = action_pause_ms(action);
+        if pause > 0 {
+            sleep(Duration::from_millis(pause)).await;
+        }
+        completed += 1;
+    }
+    if request.settle_ms > 0 {
+        sleep(Duration::from_millis(request.settle_ms as u64)).await;
+    }
+    let mut body = serde_json::json!({ "completed": completed });
+    if request.observe {
+        let png = run_capture(&display)
+            .await
+            .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+        if let serde_json::Value::Object(map) = observation_json(&display, png).await {
+            body.as_object_mut().unwrap().extend(map);
+        }
+    }
+    Ok(Json(body))
+}
+
+async fn apply_action(display: &str, profile: Option<&str>, action: &ComputerAction) -> Result<(), String> {
+    match action {
+        ComputerAction::Wait { ms } => {
+            sleep(Duration::from_millis(*ms as u64)).await;
+            Ok(())
+        }
+        ComputerAction::Open { path } => spawn_detached(&open_argv_on(display, profile, path)).await,
+        ComputerAction::Focus { .. } => {
+            let argv = xdotool_argv_on(display, action).ok_or_else(|| "unsupported action".to_string())?;
+            let output = Command::new(&argv[0])
+                .args(&argv[1..])
+                .output()
+                .await
+                .map_err(|error| error.to_string())?;
+            if output.status.success() {
+                Ok(())
+            } else {
+                Err(String::from_utf8_lossy(&output.stderr).into_owned())
+            }
+        }
+        ComputerAction::Launch { application, uri } => {
+            let argv = launch_argv_on(display, profile, application, uri.as_deref())
+                .ok_or_else(|| "unknown application".to_string())?;
+            spawn_detached(&argv).await
+        }
+        other => {
+            let argv = xdotool_argv_on(display, other).ok_or_else(|| "unsupported action".to_string())?;
+            let output = Command::new(&argv[0])
+                .args(&argv[1..])
+                .output()
+                .await
+                .map_err(|error| error.to_string())?;
+            if output.status.success() {
+                Ok(())
+            } else {
+                Err(String::from_utf8_lossy(&output.stderr).into_owned())
+            }
+        }
+    }
+}
+
+async fn spawn_detached(argv: &[String]) -> Result<(), String> {
+    Command::new(&argv[0])
+        .args(&argv[1..])
+        .stdin(Stdio::null())
+        .stdout(Stdio::null())
+        .stderr(Stdio::null())
+        .spawn()
+        .map_err(|error| error.to_string())?;
+    Ok(())
+}
+
+async fn observation_json(display: &str, png: Vec<u8>) -> serde_json::Value {
+    use base64::Engine;
+    let mut body = serde_json::json!({
+        "png_base64": base64::engine::general_purpose::STANDARD.encode(png)
+    });
+    let (cursor, window) = run_pointer_state(display).await;
+    if let Some(cursor) = cursor {
+        body["cursor"] = serde_json::json!({ "x": cursor.x, "y": cursor.y });
+    }
+    if let Some(window) = window {
+        body["activeWindow"] = serde_json::json!({ "id": window.id, "title": window.title });
+    }
+    body
+}
+
+async fn run_pointer_state(
+    display: &str,
+) -> (
+    Option<lazyboy_contracts::CursorPosition>,
+    Option<lazyboy_contracts::ActiveWindow>,
+) {
+    let argv = pointer_state_command_on(display);
+    let output = Command::new(&argv[0]).args(&argv[1..]).output().await.ok();
+    let Some(output) = output else {
+        return (None, None);
+    };
+    parse_pointer_state(&String::from_utf8_lossy(&output.stdout))
+}
+
+async fn run_capture(display: &str) -> Result<Vec<u8>, String> {
+    let argv = screenshot_command_on(display);
+    let mut child = Command::new(&argv[0])
+        .args(&argv[1..])
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped())
+        .spawn()
+        .map_err(|error| error.to_string())?;
+    let mut stdout = Vec::new();
+    if let Some(mut pipe) = child.stdout.take() {
+        pipe.read_to_end(&mut stdout)
+            .await
+            .map_err(|error| error.to_string())?;
+    }
+    let status = child.wait().await.map_err(|error| error.to_string())?;
+    if !status.success() || stdout.is_empty() {
+        return Err("screenshot failed".into());
+    }
+    Ok(stdout)
+}
diff --git a/crates/harness/Cargo.toml b/crates/harness/Cargo.toml
new file mode 100644
index 0000000..15bd791
--- /dev/null
+++ b/crates/harness/Cargo.toml
@@ -0,0 +1,12 @@
+[package]
+name = "lazyboy-harness"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+publish.workspace = true
+
+[dependencies]
+lazyboy-contracts.workspace = true
+serde.workspace = true
+thiserror.workspace = true
+rig-core.workspace = true
diff --git a/crates/harness/src/lib.rs b/crates/harness/src/lib.rs
new file mode 100644
index 0000000..f4231f1
--- /dev/null
+++ b/crates/harness/src/lib.rs
@@ -0,0 +1,3 @@
+mod resolve;
+
+pub use resolve::*;
diff --git a/crates/harness/src/resolve.rs b/crates/harness/src/resolve.rs
new file mode 100644
index 0000000..5e60c7e
--- /dev/null
+++ b/crates/harness/src/resolve.rs
@@ -0,0 +1,188 @@
+use lazyboy_contracts::{
+    default_model_id, model_capabilities, ModelCapabilities, ModelProvider, DEFAULT_XAI_MODEL,
+};
+use thiserror::Error;
+
+#[derive(Debug, Error, Clone, PartialEq, Eq)]
+pub enum ModelError {
+    #[error("unsupported_provider:{provider}")]
+    UnsupportedProvider { provider: String },
+    #[error("missing credential for {provider} ({env_key})")]
+    MissingCredential {
+        provider: String,
+        env_key: String,
+    },
+    #[error("unknown model provider: {0}")]
+    UnknownProvider(String),
+    #[error("model client error: {0}")]
+    ProviderClient(String),
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct CredentialChain {
+    pub bot: Option<String>,
+    pub space: Option<String>,
+    pub env: Option<String>,
+}
+
+impl CredentialChain {
+    pub fn resolve(&self) -> Option<&str> {
+        self.bot
+            .as_deref()
+            .filter(|value| !value.is_empty())
+            .or(self.space.as_deref().filter(|value| !value.is_empty()))
+            .or(self.env.as_deref().filter(|value| !value.is_empty()))
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ResolveModelRequest {
+    pub provider: ModelProvider,
+    pub model_id: Option<String>,
+    pub credentials: CredentialChain,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ResolvedBackend {
+    pub provider: ModelProvider,
+    pub model_id: String,
+    pub capabilities: ModelCapabilities,
+    pub api_key: String,
+    pub base_url: String,
+}
+
+/// Pick a backend without talking to the network.
+///
+/// v1 only constructs an xAI client. Other providers stay in the enum so a later
+/// mapping can land without changing Computer tools.
+pub fn resolve_backend(request: ResolveModelRequest) -> Result<ResolvedBackend, ModelError> {
+    match request.provider {
+        ModelProvider::Xai => {}
+        other => {
+            return Err(ModelError::UnsupportedProvider {
+                provider: other.as_str().to_string(),
+            });
+        }
+    }
+
+    let api_key = request.credentials.resolve().ok_or(ModelError::MissingCredential {
+        provider: request.provider.as_str().to_string(),
+        env_key: request.provider.env_key_name().to_string(),
+    })?;
+
+    let model_id = request
+        .model_id
+        .filter(|value| !value.is_empty())
+        .or_else(|| default_model_id(request.provider).map(str::to_string))
+        .unwrap_or_else(|| DEFAULT_XAI_MODEL.to_string());
+
+    let base_url = request
+        .provider
+        .default_base_url()
+        .unwrap_or("https://api.x.ai/v1")
+        .to_string();
+
+    Ok(ResolvedBackend {
+        provider: request.provider,
+        model_id: model_id.clone(),
+        capabilities: model_capabilities(request.provider, &model_id),
+        api_key: api_key.to_string(),
+        base_url,
+    })
+}
+
+pub fn credential_from_env(provider: ModelProvider) -> Option<String> {
+    std::env::var(provider.env_key_name()).ok().filter(|value| !value.is_empty())
+}
+
+/// Prove the xAI Rig client can be constructed from a resolved backend.
+pub fn connect_xai(backend: &ResolvedBackend) -> Result<rig_core::providers::xai::Client, ModelError> {
+    if backend.provider != ModelProvider::Xai {
+        return Err(ModelError::UnsupportedProvider {
+            provider: backend.provider.as_str().to_string(),
+        });
+    }
+    rig_core::providers::xai::Client::new(&backend.api_key).map_err(|error| {
+        ModelError::ProviderClient(error.to_string())
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn xai_request(key: Option<&str>) -> ResolveModelRequest {
+        ResolveModelRequest {
+            provider: ModelProvider::Xai,
+            model_id: None,
+            credentials: CredentialChain {
+                bot: None,
+                space: None,
+                env: key.map(str::to_string),
+            },
+        }
+    }
+
+    #[test]
+    fn xai_resolves_with_default_vision_model() {
+        let backend = resolve_backend(xai_request(Some("test-key"))).unwrap();
+        assert_eq!(backend.provider, ModelProvider::Xai);
+        assert_eq!(backend.model_id, DEFAULT_XAI_MODEL);
+        assert!(backend.capabilities.vision);
+        assert_eq!(backend.base_url, "https://api.x.ai/v1");
+        assert!(connect_xai(&backend).is_ok());
+    }
+
+    #[test]
+    fn credentials_prefer_bot_then_space_then_env() {
+        let backend = resolve_backend(ResolveModelRequest {
+            provider: ModelProvider::Xai,
+            model_id: Some("grok-4.6".into()),
+            credentials: CredentialChain {
+                bot: Some("bot-key".into()),
+                space: Some("space-key".into()),
+                env: Some("env-key".into()),
+            },
+        })
+        .unwrap();
+        assert_eq!(backend.api_key, "bot-key");
+    }
+
+    #[test]
+    fn missing_credential_is_explicit() {
+        let error = resolve_backend(xai_request(None)).unwrap_err();
+        assert!(matches!(error, ModelError::MissingCredential { .. }));
+    }
+
+    #[test]
+    fn other_providers_are_reserved_not_silent_fallback() {
+        for provider in [
+            ModelProvider::Openai,
+            ModelProvider::Anthropic,
+            ModelProvider::Openrouter,
+        ] {
+            let error = resolve_backend(ResolveModelRequest {
+                provider,
+                model_id: Some("whatever".into()),
+                credentials: CredentialChain {
+                    bot: None,
+                    space: None,
+                    env: Some("sk-test".into()),
+                },
+            })
+            .unwrap_err();
+            assert_eq!(
+                error,
+                ModelError::UnsupportedProvider {
+                    provider: provider.as_str().to_string()
+                }
+            );
+        }
+    }
+
+    #[test]
+    fn unknown_provider_strings_fail_to_parse() {
+        let error = "gemini".parse::<ModelProvider>().unwrap_err();
+        assert_eq!(error.0, "gemini");
+    }
+}
diff --git a/crates/sandbox/Cargo.toml b/crates/sandbox/Cargo.toml
new file mode 100644
index 0000000..9705648
--- /dev/null
+++ b/crates/sandbox/Cargo.toml
@@ -0,0 +1,19 @@
+[package]
+name = "lazyboy-sandbox"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+publish.workspace = true
+
+[dependencies]
+lazyboy-contracts.workspace = true
+lazyboy-control.workspace = true
+async-trait = "0.1"
+reqwest.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+tokio.workspace = true
+base64.workspace = true
+chrono.workspace = true
+sha2.workspace = true
+hex.workspace = true
diff --git a/crates/sandbox/src/docker.rs b/crates/sandbox/src/docker.rs
new file mode 100644
index 0000000..209b326
--- /dev/null
+++ b/crates/sandbox/src/docker.rs
@@ -0,0 +1,386 @@
+use async_trait::async_trait;
+use base64::Engine;
+use lazyboy_contracts::{ActiveWindow, ComputerObservation, CursorPosition, SandboxKind};
+use lazyboy_contracts::ComputerCapabilities;
+use lazyboy_control::{
+    observation_from_png, ActionRequest, ActionResult, AdapterContext, CommandRequest, CommandResult,
+    ComputerRef, EnsureScreenRequest, EnsureScreenResult, FileEntry, ProvisionRequest, SandboxError,
+    SandboxProvider, ScreenSession,
+};
+use reqwest::Client;
+use serde_json::Value;
+
+pub struct DockerSandbox {
+    client: Client,
+    base_url: String,
+    token: String,
+}
+
+impl DockerSandbox {
+    pub fn new(base_url: String, token: String) -> Self {
+        Self {
+            client: Client::new(),
+            base_url: base_url.trim_end_matches('/').to_string(),
+            token,
+        }
+    }
+
+    fn headers(&self, context: &AdapterContext) -> reqwest::header::HeaderMap {
+        let mut headers = reqwest::header::HeaderMap::new();
+        headers.insert(
+            reqwest::header::AUTHORIZATION,
+            format!("Bearer {}", self.token).parse().unwrap(),
+        );
+        headers.insert("x-lazyboy-space-id", context.space_id.parse().unwrap());
+        if let Some(bot_id) = &context.bot_id {
+            headers.insert("x-lazyboy-bot-id", bot_id.parse().unwrap());
+        }
+        if let Some(display) = &context.display {
+            if let Ok(value) = display.parse() {
+                headers.insert("x-lazyboy-display", value);
+            }
+        }
+        if let Some(profile) = &context.profile_path {
+            if let Ok(value) = profile.parse() {
+                headers.insert("x-lazyboy-profile", value);
+            }
+        }
+        if let Some(slot) = context.screen_slot {
+            if let Ok(value) = slot.to_string().parse() {
+                headers.insert("x-lazyboy-screen-slot", value);
+            }
+        }
+        headers
+    }
+
+    fn url(&self, path: &str) -> String {
+        format!("{}{path}", self.base_url)
+    }
+}
+
+#[async_trait]
+impl SandboxProvider for DockerSandbox {
+    async fn provision(
+        &self,
+        request: ProvisionRequest,
+        context: &AdapterContext,
+    ) -> Result<ComputerRef, SandboxError> {
+        let response = self
+            .client
+            .post(self.url("/computers"))
+            .headers(self.headers(context))
+            .json(&serde_json::json!({
+                "homeKey": request.home_key,
+                "homePath": request.home_path,
+                "spaceId": context.space_id,
+            }))
+            .send()
+            .await
+            .map_err(|error| SandboxError::message(error.to_string()))?;
+        if !response.status().is_success() {
+            let status = response.status();
+            let body = response.text().await.unwrap_or_default();
+            return Err(SandboxError::message(format!("provision failed: {status} {body}")));
+        }
+        let body: Value = response
+            .json()
+            .await
+            .map_err(|error| SandboxError::message(error.to_string()))?;
+        let id = body
+            .get("id")
+            .and_then(Value::as_str)
+            .ok_or_else(|| SandboxError::message("missing computer id"))?
+            .to_string();
+        Ok(ComputerRef {
+            id: id.clone(),
+            home_key: request.home_key,
+            kind: SandboxKind::Docker,
+            provider_ref: id,
+            fresh: body.get("resumed").and_then(Value::as_bool) != Some(true),
+        })
+    }
+
+    async fn capabilities(
+        &self,
+        _computer: &ComputerRef,
+        _context: &AdapterContext,
+    ) -> Result<ComputerCapabilities, SandboxError> {
+        Ok(ComputerCapabilities { multi_screen: true })
+    }
+
+    async fn ensure_screen(
+        &self,
+        computer: &ComputerRef,
+        request: EnsureScreenRequest,
+        context: &AdapterContext,
+    ) -> Result<EnsureScreenResult, SandboxError> {
+        let response = self
+            .client
+            .post(self.url(&format!("/computers/{}/screens", computer.id)))
+            .headers(self.headers(context))
+            .json(&request)
+            .send()
+            .await
+            .map_err(|error| SandboxError::message(error.to_string()))?;
+        if !response.status().is_success() {
+            let status = response.status();
+            let body = response.text().await.unwrap_or_default();
+            return Err(SandboxError::message(format!("ensure screen failed: {status} {body}")));
+        }
+        let body: Value = response
+            .json()
+            .await
+            .map_err(|error| SandboxError::message(error.to_string()))?;
+        Ok(EnsureScreenResult {
+            slot: body.get("slot").and_then(Value::as_u64).unwrap_or(request.slot as u64) as u32,
+            display: body
+                .get("display")
+                .and_then(Value::as_str)
+                .unwrap_or(":1")
+                .to_string(),
+            view_port: body
+                .get("viewPort")
+                .or_else(|| body.get("view_port"))
+                .and_then(Value::as_u64)
+                .unwrap_or(6080) as u16,
+        })
+    }
+
+    async fn execute(
+        &self,
+        computer: &ComputerRef,
+        request: CommandRequest,
+        context: &AdapterContext,
+    ) -> Result<CommandResult, SandboxError> {
+        let response = self
+            .client
+            .post(self.url(&format!("/computers/{}/exec", computer.id)))
+            .headers(self.headers(context))
+            .json(&request)
+            .send()
+            .await
+            .map_err(|error| SandboxError::message(error.to_string()))?;
+        response
+            .json()
+            .await
+            .map_err(|error| SandboxError::message(error.to_string()))
+    }
+
+    async fn observe(
+        &self,
+        computer: &ComputerRef,
+        context: &AdapterContext,
+    ) -> Result<ComputerObservation, SandboxError> {
+        let response = self
+            .client
+            .post(self.url(&format!("/computers/{}/observe", computer.id)))
+            .headers(self.headers(context))
+            .send()
+            .await
+            .map_err(|error| SandboxError::message(error.to_string()))?;
+        let body: Value = response
+            .json()
+            .await
+            .map_err(|error| SandboxError::message(error.to_string()))?;
+        decode_observation(&body)
+    }
+
+    async fn act(
+        &self,
+        computer: &ComputerRef,
+        request: ActionRequest,
+        context: &AdapterContext,
+    ) -> Result<ActionResult, SandboxError> {
+        let response = self
+            .client
+            .post(self.url(&format!("/computers/{}/act", computer.id)))
+            .headers(self.headers(context))
+            .json(&request)
+            .send()
+            .await
+            .map_err(|error| SandboxError::message(error.to_string()))?;
+        let body: Value = response
+            .json()
+            .await
+            .map_err(|error| SandboxError::message(error.to_string()))?;
+        Ok(ActionResult {
+            completed: body.get("completed").and_then(Value::as_u64).unwrap_or(0) as usize,
+            observation: if body.get("png_base64").is_some() {
+                Some(decode_observation(&body)?)
+            } else {
+                None
+            },
+        })
+    }
+
+    async fn connect_screen(
+        &self,
+        computer: &ComputerRef,
+        interactive: bool,
+        context: &AdapterContext,
+    ) -> Result<ScreenSession, SandboxError> {
+        let response = self
+            .client
+            .post(self.url(&format!("/computers/{}/screen-mode", computer.id)))
+            .headers(self.headers(context))
+            .json(&serde_json::json!({
+                "interactive": interactive,
+                "slot": context.screen_slot.unwrap_or(0),
+            }))
+            .send()
+            .await
+            .map_err(|error| SandboxError::message(error.to_string()))?;
+        let body: Value = response
+            .json()
+            .await
+            .map_err(|error| SandboxError::message(error.to_string()))?;
+        Ok(ScreenSession {
+            url: body
+                .get("screenUrl")
+                .and_then(Value::as_str)
+                .map(str::to_string),
+            interactive,
+        })
+    }
+
+    async fn list_files(
+        &self,
+        computer: &ComputerRef,
+        path: &str,
+        context: &AdapterContext,
+    ) -> Result<Vec<FileEntry>, SandboxError> {
+        let response = self
+            .client
+            .get(self.url(&format!("/computers/{}/files", computer.id)))
+            .headers(self.headers(context))
+            .query(&[("path", path)])
+            .send()
+            .await
+            .map_err(|error| SandboxError::message(error.to_string()))?;
+        let body: Value = response
+            .json()
+            .await
+            .map_err(|error| SandboxError::message(error.to_string()))?;
+        let Some(items) = body.as_array() else {
+            return Ok(Vec::new());
+        };
+        Ok(items
+            .iter()
+            .filter_map(|item| {
+                Some(FileEntry {
+                    path: item.get("path")?.as_str()?.to_string(),
+                    kind: item.get("kind")?.as_str()?.to_string(),
+                    size: item.get("size")?.as_u64().unwrap_or(0),
+                })
+            })
+            .collect())
+    }
+
+    async fn read_file(
+        &self,
+        computer: &ComputerRef,
+        path: &str,
+        context: &AdapterContext,
+    ) -> Result<Vec<u8>, SandboxError> {
+        let response = self
+            .client
+            .post(self.url(&format!("/computers/{}/read", computer.id)))
+            .headers(self.headers(context))
+            .json(&serde_json::json!({ "path": path }))
+            .send()
+            .await
+            .map_err(|error| SandboxError::message(error.to_string()))?;
+        let body: Value = response
+            .json()
+            .await
+            .map_err(|error| SandboxError::message(error.to_string()))?;
+        Ok(body
+            .get("content")
+            .and_then(Value::as_str)
+            .unwrap_or_default()
+            .as_bytes()
+            .to_vec())
+    }
+
+    async fn write_file(
+        &self,
+        computer: &ComputerRef,
+        path: &str,
+        content: &[u8],
+        context: &AdapterContext,
+    ) -> Result<(), SandboxError> {
+        let response = self
+            .client
+            .post(self.url(&format!("/computers/{}/files", computer.id)))
+            .headers(self.headers(context))
+            .json(&serde_json::json!({
+                "path": path,
+                "content": String::from_utf8_lossy(content),
+            }))
+            .send()
+            .await
+            .map_err(|error| SandboxError::message(error.to_string()))?;
+        if response.status().is_success() {
+            Ok(())
+        } else {
+            Err(SandboxError::message(format!(
+                "write failed: {}",
+                response.status()
+            )))
+        }
+    }
+
+    async fn stop(&self, computer: &ComputerRef, context: &AdapterContext) -> Result<(), SandboxError> {
+        self.client
+            .post(self.url(&format!("/computers/{}/stop", computer.id)))
+            .headers(self.headers(context))
+            .send()
+            .await
+            .map_err(|error| SandboxError::message(error.to_string()))?;
+        Ok(())
+    }
+
+    async fn destroy(&self, computer: &ComputerRef, context: &AdapterContext) -> Result<(), SandboxError> {
+        self.client
+            .delete(self.url(&format!("/computers/{}", computer.id)))
+            .headers(self.headers(context))
+            .send()
+            .await
+            .map_err(|error| SandboxError::message(error.to_string()))?;
+        Ok(())
+    }
+}
+
+fn decode_observation(body: &Value) -> Result<ComputerObservation, SandboxError> {
+    let encoded = body
+        .get("png_base64")
+        .and_then(Value::as_str)
+        .ok_or_else(|| SandboxError::message("missing png"))?;
+    let png = base64::engine::general_purpose::STANDARD
+        .decode(encoded)
+        .map_err(|error| SandboxError::message(error.to_string()))?;
+    let cursor = body.get("cursor").and_then(|cursor| {
+        Some(CursorPosition {
+            x: cursor.get("x")?.as_i64()? as i32,
+            y: cursor.get("y")?.as_i64()? as i32,
+        })
+    });
+    let window = body
+        .get("activeWindow")
+        .or_else(|| body.get("active_window"))
+        .and_then(|window| {
+            let id = window.get("id")?.as_str()?.to_string();
+            if id.is_empty() {
+                return None;
+            }
+            Some(ActiveWindow {
+                id,
+                title: window
+                    .get("title")
+                    .and_then(Value::as_str)
+                    .filter(|title| !title.is_empty())
+                    .map(str::to_string),
+            })
+        });
+    Ok(observation_from_png(png, 1280, 800, cursor, window))
+}
diff --git a/crates/sandbox/src/fake.rs b/crates/sandbox/src/fake.rs
new file mode 100644
index 0000000..5a43c07
--- /dev/null
+++ b/crates/sandbox/src/fake.rs
@@ -0,0 +1,176 @@
+use std::collections::HashMap;
+use std::sync::Mutex;
+
+use async_trait::async_trait;
+use lazyboy_contracts::{ComputerObservation, SandboxKind};
+use lazyboy_control::{
+    observation_from_png, ActionRequest, ActionResult, AdapterContext, CommandRequest, CommandResult,
+    ComputerRef, FileEntry, ProvisionRequest, SandboxError, SandboxProvider, ScreenSession,
+};
+
+const EMPTY_PNG: &[u8] = &[
+    0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A, 0x00, 0x00, 0x00, 0x0D, 0x49, 0x48, 0x44, 0x52,
+    0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x08, 0x06, 0x00, 0x00, 0x00, 0x1F, 0x15, 0xC4,
+    0x89, 0x00, 0x00, 0x00, 0x0D, 0x49, 0x44, 0x41, 0x54, 0x78, 0x9C, 0x63, 0x00, 0x01, 0x00, 0x00,
+    0x05, 0x00, 0x01, 0x0D, 0x0A, 0x2D, 0xB4, 0x00, 0x00, 0x00, 0x00, 0x49, 0x45, 0x4E, 0x44, 0xAE,
+    0x42, 0x60, 0x82,
+];
+
+#[derive(Default)]
+pub struct FakeSandbox {
+    files: Mutex<HashMap<String, HashMap<String, Vec<u8>>>>,
+}
+
+impl FakeSandbox {
+    pub fn new() -> Self {
+        Self::default()
+    }
+}
+
+#[async_trait]
+impl SandboxProvider for FakeSandbox {
+    async fn provision(
+        &self,
+        request: ProvisionRequest,
+        _context: &AdapterContext,
+    ) -> Result<ComputerRef, SandboxError> {
+        self.files
+            .lock()
+            .unwrap()
+            .entry(request.home_key.clone())
+            .or_default();
+        Ok(ComputerRef {
+            id: format!("fake-{}", request.home_key),
+            home_key: request.home_key,
+            kind: SandboxKind::Docker,
+            provider_ref: format!("fake-{}", request.home_path),
+            fresh: true,
+        })
+    }
+
+    async fn execute(
+        &self,
+        computer: &ComputerRef,
+        request: CommandRequest,
+        _context: &AdapterContext,
+    ) -> Result<CommandResult, SandboxError> {
+        if request.argv.get(0).map(String::as_str) == Some("mkdir") {
+            return Ok(CommandResult {
+                stdout: String::new(),
+                stderr: String::new(),
+                code: 0,
+            });
+        }
+        if request.argv.get(0).map(String::as_str) == Some("touch") {
+            if let Some(path) = request.argv.get(1) {
+                self.files
+                    .lock()
+                    .unwrap()
+                    .entry(computer.home_key.clone())
+                    .or_default()
+                    .insert(path.clone(), Vec::new());
+            }
+        }
+        Ok(CommandResult {
+            stdout: request.argv.join(" "),
+            stderr: String::new(),
+            code: 0,
+        })
+    }
+
+    async fn observe(
+        &self,
+        _computer: &ComputerRef,
+        _context: &AdapterContext,
+    ) -> Result<ComputerObservation, SandboxError> {
+        Ok(observation_from_png(EMPTY_PNG.to_vec(), 1, 1, None, None))
+    }
+
+    async fn act(
+        &self,
+        computer: &ComputerRef,
+        request: ActionRequest,
+        context: &AdapterContext,
+    ) -> Result<ActionResult, SandboxError> {
+        Ok(ActionResult {
+            completed: request.actions.len(),
+            observation: if request.observe {
+                Some(self.observe(computer, context).await?)
+            } else {
+                None
+            },
+        })
+    }
+
+    async fn connect_screen(
+        &self,
+        computer: &ComputerRef,
+        interactive: bool,
+        _context: &AdapterContext,
+    ) -> Result<ScreenSession, SandboxError> {
+        Ok(ScreenSession {
+            url: Some(format!("http://127.0.0.1:6080/fake/{}", computer.id)),
+            interactive,
+        })
+    }
+
+    async fn list_files(
+        &self,
+        computer: &ComputerRef,
+        path: &str,
+        _context: &AdapterContext,
+    ) -> Result<Vec<FileEntry>, SandboxError> {
+        let files = self.files.lock().unwrap();
+        let Some(home) = files.get(&computer.home_key) else {
+            return Ok(Vec::new());
+        };
+        Ok(home
+            .iter()
+            .filter(|(file_path, _)| path.is_empty() || file_path.starts_with(path))
+            .map(|(file_path, bytes)| FileEntry {
+                path: file_path.clone(),
+                kind: "file".into(),
+                size: bytes.len() as u64,
+            })
+            .collect())
+    }
+
+    async fn read_file(
+        &self,
+        computer: &ComputerRef,
+        path: &str,
+        _context: &AdapterContext,
+    ) -> Result<Vec<u8>, SandboxError> {
+        self.files
+            .lock()
+            .unwrap()
+            .get(&computer.home_key)
+            .and_then(|home| home.get(path).cloned())
+            .ok_or_else(|| SandboxError::message("not found"))
+    }
+
+    async fn write_file(
+        &self,
+        computer: &ComputerRef,
+        path: &str,
+        content: &[u8],
+        _context: &AdapterContext,
+    ) -> Result<(), SandboxError> {
+        self.files
+            .lock()
+            .unwrap()
+            .entry(computer.home_key.clone())
+            .or_default()
+            .insert(path.to_string(), content.to_vec());
+        Ok(())
+    }
+
+    async fn stop(&self, _computer: &ComputerRef, _context: &AdapterContext) -> Result<(), SandboxError> {
+        Ok(())
+    }
+
+    async fn destroy(&self, computer: &ComputerRef, _context: &AdapterContext) -> Result<(), SandboxError> {
+        self.files.lock().unwrap().remove(&computer.home_key);
+        Ok(())
+    }
+}
diff --git a/crates/sandbox/src/lib.rs b/crates/sandbox/src/lib.rs
new file mode 100644
index 0000000..fe329a3
--- /dev/null
+++ b/crates/sandbox/src/lib.rs
@@ -0,0 +1,5 @@
+mod docker;
+mod fake;
+
+pub use docker::DockerSandbox;
+pub use fake::FakeSandbox;
diff --git a/crates/supervisor/Cargo.toml b/crates/supervisor/Cargo.toml
new file mode 100644
index 0000000..8d0fe9b
--- /dev/null
+++ b/crates/supervisor/Cargo.toml
@@ -0,0 +1,23 @@
+[package]
+name = "lazyboy-supervisor"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+publish.workspace = true
+
+[dependencies]
+lazyboy-contracts.workspace = true
+lazyboy-control.workspace = true
+axum.workspace = true
+tokio.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+thiserror.workspace = true
+tracing.workspace = true
+tracing-subscriber.workspace = true
+bollard.workspace = true
+uuid.workspace = true
+base64.workspace = true
+reqwest.workspace = true
+async-trait = "0.1"
+futures-util = "0.3"
diff --git a/crates/supervisor/src/docker.rs b/crates/supervisor/src/docker.rs
new file mode 100644
index 0000000..e127636
--- /dev/null
+++ b/crates/supervisor/src/docker.rs
@@ -0,0 +1,769 @@
+use std::collections::HashMap;
+use std::default::Default;
+use std::path::PathBuf;
+
+use base64::Engine;
+use bollard::container::{
+    Config, CreateContainerOptions, ListContainersOptions, RemoveContainerOptions, StartContainerOptions,
+    StopContainerOptions,
+};
+use bollard::exec::{CreateExecOptions, StartExecOptions, StartExecResults};
+use bollard::models::{HostConfig, PortBinding};
+use bollard::network::CreateNetworkOptions;
+use bollard::Docker;
+use futures_util::StreamExt;
+use lazyboy_control::{
+    action_pause_ms, launch_argv_on, normalize_display, normalize_workspace_path, open_argv_on,
+    pointer_state_command_on, screen_layout, screenshot_command_on, xdotool_argv_on, ActionRequest,
+    CommandRequest, CommandResult, EnsureScreenRequest, EnsureScreenResult, ScreenTarget, HOME,
+    TEAM_SCREEN_LIMIT,
+};
+use tokio::time::{sleep, Duration};
+
+const SCREEN_PORT_COUNT: u16 = TEAM_SCREEN_LIMIT as u16;
+
+pub struct DockerHost {
+    docker: Docker,
+    image: String,
+    control_token: String,
+}
+
+pub struct Provisioned {
+    pub id: String,
+    pub resumed: bool,
+    pub screen_url: Option<String>,
+}
+
+pub struct ObservePayload {
+    pub png: Vec<u8>,
+    pub json: serde_json::Value,
+}
+
+impl ObservePayload {
+    fn from_json(value: serde_json::Value) -> Result<Self, String> {
+        let encoded = value
+            .get("png_base64")
+            .and_then(serde_json::Value::as_str)
+            .ok_or_else(|| "missing png".to_string())?;
+        let png = base64::engine::general_purpose::STANDARD
+            .decode(encoded)
+            .map_err(|error| error.to_string())?;
+        Ok(Self { png, json: value })
+    }
+}
+
+impl DockerHost {
+    pub async fn connect(image: String, control_token: String) -> Result<Self, String> {
+        let docker = Docker::connect_with_socket_defaults().map_err(|error| error.to_string())?;
+        Ok(Self {
+            docker,
+            image,
+            control_token,
+        })
+    }
+
+    pub async fn provision(
+        &self,
+        home_key: &str,
+        home_path: &str,
+        space_id: &str,
+    ) -> Result<Provisioned, String> {
+        let home_path = host_bind_path(home_path);
+        tokio::fs::create_dir_all(&home_path)
+            .await
+            .map_err(|error| error.to_string())?;
+        let _ = tokio::process::Command::new("chown")
+            .args(["-R", "1000:1000", &home_path])
+            .status()
+            .await;
+        if let Some(existing) = self.find(home_key).await? {
+            if self.container_reusable(&existing).await.unwrap_or(false) {
+                self.docker
+                    .start_container(&existing, None::<StartContainerOptions<String>>)
+                    .await
+                    .ok();
+                self.wait_running(&existing).await?;
+                let screen_url = self.screen_url(&existing, false).await.ok();
+                return Ok(Provisioned {
+                    id: existing,
+                    resumed: true,
+                    screen_url,
+                });
+            }
+            let _ = self.destroy(&existing).await;
+        }
+
+        let name = container_name(home_key);
+        let network = network_name(home_key);
+        self.ensure_network(&network).await?;
+        let mut labels = HashMap::new();
+        labels.insert("lazyboy.homeKey".into(), home_key.to_string());
+        labels.insert("lazyboy.spaceId".into(), space_id.to_string());
+
+        let mut port_bindings = HashMap::new();
+        let mut exposed = HashMap::new();
+        for slot in 0..SCREEN_PORT_COUNT {
+            let port = format!("{}/tcp", 6080 + slot);
+            port_bindings.insert(
+                port.clone(),
+                Some(vec![PortBinding {
+                    host_ip: Some("127.0.0.1".into()),
+                    host_port: None,
+                }]),
+            );
+            exposed.insert(port, HashMap::new());
+        }
+
+        let host_config = HostConfig {
+            binds: Some(vec![format!("{home_path}:{HOME}")]),
+            port_bindings: Some(port_bindings),
+            memory: Some(computer_memory_bytes()),
+            nano_cpus: Some(computer_nano_cpus()),
+            pids_limit: Some(computer_pids_limit()),
+            cap_drop: Some(vec!["ALL".into()]),
+            security_opt: Some(vec!["no-new-privileges:true".into()]),
+            privileged: Some(false),
+            shm_size: Some(512 * 1024 * 1024),
+            network_mode: Some(network),
+            ..Default::default()
+        };
+
+        let config = Config {
+            image: Some(self.image.clone()),
+            user: Some("1000:1000".into()),
+            hostname: Some(name.clone()),
+            env: Some(vec![
+                "DISPLAY=:1".into(),
+                format!("HOME={HOME}"),
+                format!("LAZYBOY_CONTROL_TOKEN={}", self.control_token),
+            ]),
+            labels: Some(labels),
+            exposed_ports: Some(exposed),
+            host_config: Some(host_config),
+            working_dir: Some(HOME.into()),
+            ..Default::default()
+        };
+
+        let created = match self
+            .docker
+            .create_container(
+                Some(CreateContainerOptions {
+                    name: name.clone(),
+                    platform: None,
+                }),
+                config.clone(),
+            )
+            .await
+        {
+            Ok(created) => created,
+            Err(error) if error.to_string().to_lowercase().contains("already in use") => {
+                let _ = self
+                    .docker
+                    .remove_container(
+                        &name,
+                        Some(RemoveContainerOptions {
+                            force: true,
+                            ..Default::default()
+                        }),
+                    )
+                    .await;
+                self.docker
+                    .create_container(
+                        Some(CreateContainerOptions {
+                            name: name.clone(),
+                            platform: None,
+                        }),
+                        config,
+                    )
+                    .await
+                    .map_err(|error| error.to_string())?
+            }
+            Err(error) => return Err(error.to_string()),
+        };
+        self.docker
+            .start_container(&created.id, None::<StartContainerOptions<String>>)
+            .await
+            .map_err(|error| error.to_string())?;
+        self.wait_running(&created.id).await?;
+        let screen_url = self.screen_url(&created.id, false).await.ok();
+        Ok(Provisioned {
+            id: created.id,
+            resumed: false,
+            screen_url,
+        })
+    }
+
+    pub async fn exec(&self, id: &str, request: CommandRequest) -> Result<CommandResult, String> {
+        let cwd = match request.cwd {
+            Some(cwd) if PathBuf::from(&cwd).is_absolute() => cwd,
+            Some(cwd) => {
+                let relative = normalize_workspace_path(&cwd).map_err(|error| error.to_string())?;
+                if relative.is_empty() {
+                    HOME.to_string()
+                } else {
+                    format!("{HOME}/{relative}")
+                }
+            }
+            None => HOME.to_string(),
+        };
+        let argv = if request.argv.is_empty() {
+            vec!["/bin/echo".into(), "ready".into()]
+        } else {
+            request.argv
+        };
+        self.exec_argv(id, &argv, Some(&cwd), &ScreenTarget::default()).await
+    }
+
+    pub async fn exec_on(
+        &self,
+        id: &str,
+        request: CommandRequest,
+        target: &ScreenTarget,
+    ) -> Result<CommandResult, String> {
+        let cwd = match request.cwd {
+            Some(cwd) if PathBuf::from(&cwd).is_absolute() => cwd,
+            Some(cwd) => {
+                let relative = normalize_workspace_path(&cwd).map_err(|error| error.to_string())?;
+                if relative.is_empty() {
+                    HOME.to_string()
+                } else {
+                    format!("{HOME}/{relative}")
+                }
+            }
+            None => HOME.to_string(),
+        };
+        let argv = if request.argv.is_empty() {
+            vec!["/bin/echo".into(), "ready".into()]
+        } else {
+            request.argv
+        };
+        self.exec_argv(id, &argv, Some(&cwd), target).await
+    }
+
+    pub async fn observe(&self, id: &str) -> Result<Vec<u8>, String> {
+        Ok(self.observe_payload(id, &ScreenTarget::default()).await?.png)
+    }
+
+    pub async fn observe_payload(&self, id: &str, target: &ScreenTarget) -> Result<ObservePayload, String> {
+        if let Ok(value) = self.control_observe_json(id, target).await {
+            return ObservePayload::from_json(value);
+        }
+        let (stdout, stderr, code) = self
+            .exec_raw(id, &screenshot_command_on(&target.display), None, target)
+            .await?;
+        if code != 0 {
+            return Err(String::from_utf8_lossy(&stderr).into_owned());
+        }
+        let mut body = serde_json::json!({
+            "png_base64": base64::engine::general_purpose::STANDARD.encode(&stdout)
+        });
+        if let Ok(meta) = self.pointer_state(id, target).await {
+            if let serde_json::Value::Object(map) = meta {
+                if let Some(obj) = body.as_object_mut() {
+                    if let (Some(x), Some(y)) = (map.get("x"), map.get("y")) {
+                        obj.insert("cursor".into(), serde_json::json!({ "x": x, "y": y }));
+                    }
+                    if map.get("id").and_then(serde_json::Value::as_str).is_some_and(|id| !id.is_empty()) {
+                        obj.insert(
+                            "activeWindow".into(),
+                            serde_json::json!({ "id": map.get("id"), "title": map.get("title") }),
+                        );
+                    }
+                }
+            }
+        }
+        ObservePayload::from_json(body)
+    }
+
+    async fn pointer_state(&self, id: &str, target: &ScreenTarget) -> Result<serde_json::Value, String> {
+        let result = self
+            .exec_argv(id, &pointer_state_command_on(&target.display), None, target)
+            .await?;
+        if result.code != 0 {
+            return Err(result.stderr);
+        }
+        serde_json::from_str(&result.stdout).map_err(|error| error.to_string())
+    }
+
+    pub async fn act(&self, id: &str, request: ActionRequest) -> Result<serde_json::Value, String> {
+        let target = ScreenTarget::from_parts(
+            request.display.as_deref(),
+            request.profile_path.as_deref(),
+            None,
+        );
+        if let Ok(body) = self.control_act(id, &request, &target).await {
+            return Ok(body);
+        }
+        let mut completed = 0usize;
+        for action in &request.actions {
+            match action {
+                lazyboy_contracts::ComputerAction::Wait { ms } => {
+                    sleep(Duration::from_millis(*ms as u64)).await;
+                }
+                lazyboy_contracts::ComputerAction::Open { path } => {
+                    let _ = self
+                        .exec_argv(
+                            id,
+                            &open_argv_on(&target.display, target.profile_path.as_deref(), path),
+                            None,
+                            &target,
+                        )
+                        .await?;
+                }
+                lazyboy_contracts::ComputerAction::Launch { application, uri } => {
+                    let argv = launch_argv_on(
+                        &target.display,
+                        target.profile_path.as_deref(),
+                        application,
+                        uri.as_deref(),
+                    )
+                    .ok_or_else(|| "unknown application".to_string())?;
+                    let _ = self.exec_argv(id, &argv, None, &target).await?;
+                }
+                other => {
+                    let argv = xdotool_argv_on(&target.display, other)
+                        .ok_or_else(|| "unsupported action".to_string())?;
+                    let result = self.exec_argv(id, &argv, None, &target).await?;
+                    if result.code != 0 {
+                        return Err(result.stderr);
+                    }
+                }
+            }
+            let pause = action_pause_ms(action);
+            if pause > 0 {
+                sleep(Duration::from_millis(pause)).await;
+            }
+            completed += 1;
+        }
+        if request.settle_ms > 0 {
+            sleep(Duration::from_millis(request.settle_ms as u64)).await;
+        }
+        let mut body = serde_json::json!({ "completed": completed });
+        if request.observe {
+            let payload = self.observe_payload(id, &target).await?;
+            if let serde_json::Value::Object(map) = payload.json {
+                if let Some(object) = body.as_object_mut() {
+                    object.extend(map);
+                }
+            }
+        }
+        Ok(body)
+    }
+
+    pub async fn screen_url(&self, id: &str, interactive: bool) -> Result<String, String> {
+        self.screen_url_for(id, 0, interactive).await
+    }
+
+    pub async fn screen_url_for(&self, id: &str, slot: u32, interactive: bool) -> Result<String, String> {
+        let layout = screen_layout(slot).map_err(|error| error.to_string())?;
+        let key = format!("{}/tcp", layout.view_port);
+        let info = self
+            .docker
+            .inspect_container(id, None)
+            .await
+            .map_err(|error| error.to_string())?;
+        let port = info
+            .network_settings
+            .and_then(|settings| settings.ports)
+            .and_then(|ports| ports.get(&key).cloned())
+            .and_then(|bindings| bindings)
+            .and_then(|bindings| bindings.into_iter().next())
+            .and_then(|binding| binding.host_port)
+            .ok_or_else(|| format!("screen port {} is not published", layout.view_port))?;
+        let view = if interactive { "false" } else { "true" };
+        Ok(format!(
+            "http://127.0.0.1:{port}/vnc_lite.html?resize=scale&view_only={view}"
+        ))
+    }
+
+    pub async fn ensure_screen(
+        &self,
+        id: &str,
+        request: EnsureScreenRequest,
+    ) -> Result<EnsureScreenResult, String> {
+        let layout = screen_layout(request.slot).map_err(|error| error.to_string())?;
+        let script = format!(
+            "lazyboy-screen ensure {} {}",
+            request.slot,
+            shell_single_quote(&request.profile_path)
+        );
+        let result = self
+            .exec_argv(
+                id,
+                &["bash".into(), "-lc".into(), script],
+                None,
+                &ScreenTarget {
+                    display: layout.display.clone(),
+                    profile_path: Some(request.profile_path.clone()),
+                    slot: request.slot,
+                },
+            )
+            .await?;
+        if result.code != 0 {
+            return Err(result.stderr);
+        }
+        Ok(EnsureScreenResult {
+            slot: layout.slot,
+            display: layout.display,
+            view_port: layout.view_port,
+        })
+    }
+
+    pub async fn list_files(&self, id: &str, path: &str) -> Result<Vec<serde_json::Value>, String> {
+        let relative = normalize_workspace_path(path).map_err(|error| error.to_string())?;
+        let target = if relative.is_empty() {
+            HOME.to_string()
+        } else {
+            format!("{HOME}/{relative}")
+        };
+        let script = format!(
+            r#"python3 - <<'PY'
+import json, os
+root = {target:?}
+entries = []
+try:
+    names = sorted(os.listdir(root))
+except FileNotFoundError:
+    names = []
+for name in names:
+    full = os.path.join(root, name)
+    kind = "dir" if os.path.isdir(full) else "file"
+    size = os.path.getsize(full) if kind == "file" else 0
+    rel = os.path.relpath(full, {home:?})
+    entries.append({{"path": rel, "kind": kind, "size": size}})
+print(json.dumps(entries))
+PY"#,
+            target = target,
+            home = HOME
+        );
+        let result = self
+            .exec_argv(
+                id,
+                &["bash".into(), "-lc".into(), script],
+                None,
+                &ScreenTarget::default(),
+            )
+            .await?;
+        if result.code != 0 {
+            return Err(result.stderr);
+        }
+        serde_json::from_str(&result.stdout).map_err(|error| error.to_string())
+    }
+
+    pub async fn read_file(&self, id: &str, relative: &str) -> Result<Vec<u8>, String> {
+        let path = format!("{HOME}/{relative}");
+        let (stdout, stderr, code) = self
+            .exec_raw(
+                id,
+                &[
+                    "python3".into(),
+                    "-c".into(),
+                    "import sys; sys.stdout.buffer.write(open(sys.argv[1],'rb').read())".into(),
+                    path,
+                ],
+                None,
+                &ScreenTarget::default(),
+            )
+            .await?;
+        if code != 0 {
+            return Err(String::from_utf8_lossy(&stderr).into_owned());
+        }
+        Ok(stdout)
+    }
+
+    pub async fn write_file(&self, id: &str, relative: &str, content: &[u8]) -> Result<(), String> {
+        let target = format!("{HOME}/{relative}");
+        let encoded = base64::engine::general_purpose::STANDARD.encode(content);
+        let script = format!(
+            "python3 -c \"import os,base64,sys; p=sys.argv[1]; os.makedirs(os.path.dirname(p) or '.', exist_ok=True); open(p,'wb').write(base64.b64decode(sys.argv[2]))\" {target:?} {encoded:?}"
+        );
+        let result = self
+            .exec_argv(id, &["bash".into(), "-lc".into(), script], None, &ScreenTarget::default())
+            .await?;
+        if result.code != 0 {
+            Err(result.stderr)
+        } else {
+            Ok(())
+        }
+    }
+
+    pub async fn stop(&self, id: &str) -> Result<(), String> {
+        self.docker
+            .stop_container(id, Some(StopContainerOptions { t: 8 }))
+            .await
+            .map_err(|error| error.to_string())
+    }
+
+    pub async fn destroy(&self, id: &str) -> Result<(), String> {
+        let info = self.docker.inspect_container(id, None).await.ok();
+        let home_key = info
+            .as_ref()
+            .and_then(|info| info.config.as_ref())
+            .and_then(|config| config.labels.as_ref())
+            .and_then(|labels| labels.get("lazyboy.homeKey").cloned());
+        let _ = self
+            .docker
+            .remove_container(
+                id,
+                Some(RemoveContainerOptions {
+                    force: true,
+                    ..Default::default()
+                }),
+            )
+            .await;
+        if let Some(home_key) = home_key {
+            let _ = self.docker.remove_network(&network_name(&home_key)).await;
+        }
+        Ok(())
+    }
+
+    async fn current_image_id(&self) -> Result<String, String> {
+        self.docker
+            .inspect_image(&self.image)
+            .await
+            .map_err(|error| error.to_string())?
+            .id
+            .ok_or_else(|| "computer image has no id".into())
+    }
+
+    async fn container_reusable(&self, id: &str) -> Result<bool, String> {
+        let info = self
+            .docker
+            .inspect_container(id, None)
+            .await
+            .map_err(|error| error.to_string())?;
+        let wanted = self.current_image_id().await?;
+        let have = info.image.unwrap_or_default();
+        if !image_ids_match(&wanted, &have) {
+            return Ok(false);
+        }
+        let running = info.state.as_ref().and_then(|state| state.running) == Some(true);
+        let exit = info.state.as_ref().and_then(|state| state.exit_code).unwrap_or(0);
+        if !running && exit != 0 {
+            return Ok(false);
+        }
+        Ok(true)
+    }
+
+    async fn find(&self, home_key: &str) -> Result<Option<String>, String> {
+        let mut filters = HashMap::new();
+        filters.insert("label".into(), vec![format!("lazyboy.homeKey={home_key}")]);
+        let list = self
+            .docker
+            .list_containers(Some(ListContainersOptions {
+                all: true,
+                filters,
+                ..Default::default()
+            }))
+            .await
+            .map_err(|error| error.to_string())?;
+        Ok(list.into_iter().next().and_then(|item| item.id))
+    }
+
+    async fn ensure_network(&self, name: &str) -> Result<(), String> {
+        let result = self
+            .docker
+            .create_network(CreateNetworkOptions {
+                name: name.to_string(),
+                check_duplicate: true,
+                driver: "bridge".into(),
+                ..Default::default()
+            })
+            .await;
+        match result {
+            Ok(_) => Ok(()),
+            Err(error) if error.to_string().to_lowercase().contains("already") => Ok(()),
+            Err(error) => Err(error.to_string()),
+        }
+    }
+
+    async fn wait_running(&self, id: &str) -> Result<(), String> {
+        for _ in 0..40 {
+            let info = self
+                .docker
+                .inspect_container(id, None)
+                .await
+                .map_err(|error| error.to_string())?;
+            if info.state.and_then(|state| state.running) == Some(true) {
+                return Ok(());
+            }
+            sleep(Duration::from_millis(250)).await;
+        }
+        Err("container failed to start".into())
+    }
+
+    async fn exec_argv(
+        &self,
+        id: &str,
+        argv: &[String],
+        cwd: Option<&str>,
+        target: &ScreenTarget,
+    ) -> Result<CommandResult, String> {
+        let (stdout, stderr, code) = self.exec_raw(id, argv, cwd, target).await?;
+        Ok(CommandResult {
+            stdout: String::from_utf8_lossy(&stdout).into_owned(),
+            stderr: String::from_utf8_lossy(&stderr).into_owned(),
+            code,
+        })
+    }
+
+    async fn exec_raw(
+        &self,
+        id: &str,
+        argv: &[String],
+        cwd: Option<&str>,
+        target: &ScreenTarget,
+    ) -> Result<(Vec<u8>, Vec<u8>, i32), String> {
+        let display = normalize_display(&target.display);
+        let mut env = vec![
+            format!("DISPLAY={display}"),
+            format!("HOME={HOME}"),
+            "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin".into(),
+        ];
+        if let Some(profile) = &target.profile_path {
+            env.push(format!("LAZYBOY_BROWSER_PROFILE={profile}"));
+        }
+        let exec = self
+            .docker
+            .create_exec(
+                id,
+                CreateExecOptions {
+                    attach_stdout: Some(true),
+                    attach_stderr: Some(true),
+                    cmd: Some(argv.to_vec()),
+                    working_dir: cwd.map(str::to_string),
+                    env: Some(env),
+                    user: Some("1000:1000".into()),
+                    ..Default::default()
+                },
+            )
+            .await
+            .map_err(|error| error.to_string())?;
+        let mut stdout = Vec::new();
+        let mut stderr = Vec::new();
+        if let StartExecResults::Attached { mut output, .. } = self
+            .docker
+            .start_exec(&exec.id, Some(StartExecOptions { ..Default::default() }))
+            .await
+            .map_err(|error| error.to_string())?
+        {
+            while let Some(chunk) = output.next().await {
+                match chunk.map_err(|error| error.to_string())? {
+                    bollard::container::LogOutput::StdOut { message } => stdout.extend_from_slice(&message),
+                    bollard::container::LogOutput::StdErr { message } => stderr.extend_from_slice(&message),
+                    _ => {}
+                }
+            }
+        }
+        let inspect = self
+            .docker
+            .inspect_exec(&exec.id)
+            .await
+            .map_err(|error| error.to_string())?;
+        Ok((stdout, stderr, inspect.exit_code.unwrap_or(1) as i32))
+    }
+
+    async fn control_observe_json(&self, id: &str, target: &ScreenTarget) -> Result<serde_json::Value, String> {
+        let script = format!(
+            "curl -fsS -H 'Authorization: Bearer {}' -H 'x-lazyboy-display: {}' http://127.0.0.1:7070/observe",
+            self.control_token,
+            target.display
+        );
+        let result = self
+            .exec_argv(id, &["bash".into(), "-lc".into(), script], None, target)
+            .await?;
+        if result.code != 0 {
+            return Err(result.stderr);
+        }
+        serde_json::from_str(&result.stdout).map_err(|error| error.to_string())
+    }
+
+    async fn control_act(
+        &self,
+        id: &str,
+        request: &ActionRequest,
+        target: &ScreenTarget,
+    ) -> Result<serde_json::Value, String> {
+        let payload = serde_json::to_string(request).map_err(|error| error.to_string())?;
+        let profile_header = target
+            .profile_path
+            .as_deref()
+            .map(|profile| format!(" -H 'x-lazyboy-profile: {profile}'"))
+            .unwrap_or_default();
+        let script = format!(
+            "curl -fsS -H 'Authorization: Bearer {}' -H 'x-lazyboy-display: {}'{profile_header} -H 'content-type: application/json' -d {} http://127.0.0.1:7070/act",
+            self.control_token,
+            target.display,
+            shell_single_quote(&payload)
+        );
+        let result = self
+            .exec_argv(id, &["bash".into(), "-lc".into(), script], None, target)
+            .await?;
+        if result.code != 0 {
+            return Err(result.stderr);
+        }
+        serde_json::from_str(&result.stdout).map_err(|error| error.to_string())
+    }
+}
+
+fn image_ids_match(wanted: &str, have: &str) -> bool {
+    let wanted = wanted.trim_start_matches("sha256:");
+    let have = have.trim_start_matches("sha256:");
+    !wanted.is_empty() && !have.is_empty() && (wanted == have || wanted.starts_with(have) || have.starts_with(wanted))
+}
+
+fn host_bind_path(path: &str) -> String {
+    let data_dir = std::env::var("DATA_DIR").unwrap_or_else(|_| "./data".into());
+    let host_dir = std::env::var("HOST_DATA_DIR").unwrap_or_else(|_| data_dir.clone());
+    let data_dir = data_dir.trim_end_matches('/');
+    let host_dir = host_dir.trim_end_matches('/');
+    path.strip_prefix(data_dir)
+        .map(|rest| format!("{host_dir}{rest}"))
+        .unwrap_or_else(|| path.to_string())
+}
+
+fn computer_memory_bytes() -> i64 {
+    let mb = std::env::var("LAZYBOY_COMPUTER_MEMORY_MB")
+        .ok()
+        .and_then(|value| value.parse::<i64>().ok())
+        .filter(|value| *value > 128)
+        .unwrap_or(2048);
+    mb * 1024 * 1024
+}
+
+fn computer_nano_cpus() -> i64 {
+    let cpus = std::env::var("LAZYBOY_COMPUTER_CPUS")
+        .ok()
+        .and_then(|value| value.parse::<f64>().ok())
+        .filter(|value| *value > 0.0)
+        .unwrap_or(2.0);
+    (cpus * 1_000_000_000.0) as i64
+}
+
+fn computer_pids_limit() -> i64 {
+    std::env::var("LAZYBOY_COMPUTER_PIDS")
+        .ok()
+        .and_then(|value| value.parse::<i64>().ok())
+        .filter(|value| *value >= 64)
+        .unwrap_or(2048)
+}
+
+fn container_name(home_key: &str) -> String {
+    let sanitized: String = home_key
+        .chars()
+        .map(|ch| if ch.is_ascii_alphanumeric() { ch } else { '-' })
+        .collect();
+    format!("lb-{sanitized}")
+        .trim_matches('-')
+        .chars()
+        .take(60)
+        .collect()
+}
+
+fn network_name(home_key: &str) -> String {
+    format!("lbnet-{}", container_name(home_key))
+}
+
+fn shell_single_quote(value: &str) -> String {
+    format!("'{}'", value.replace('\'', r#"'"'"'"#))
+}
diff --git a/crates/supervisor/src/main.rs b/crates/supervisor/src/main.rs
new file mode 100644
index 0000000..d16ac02
--- /dev/null
+++ b/crates/supervisor/src/main.rs
@@ -0,0 +1,304 @@
+mod docker;
+
+use std::sync::Arc;
+
+use axum::extract::{Path, State};
+use axum::http::{HeaderMap, StatusCode};
+use axum::routing::{delete, get, post};
+use axum::{Json, Router};
+use docker::DockerHost;
+use lazyboy_control::{
+    normalize_workspace_path, ActionRequest, CommandRequest, EnsureScreenRequest, ScreenTarget, HOME,
+};
+use serde::{Deserialize, Serialize};
+use tracing_subscriber::EnvFilter;
+
+#[derive(Clone)]
+struct App {
+    token: String,
+    docker: Arc<DockerHost>,
+}
+
+#[derive(Deserialize)]
+struct ProvisionBody {
+    #[serde(rename = "homeKey")]
+    home_key: String,
+    #[serde(rename = "homePath")]
+    home_path: String,
+    #[serde(rename = "spaceId")]
+    space_id: String,
+}
+
+#[tokio::main]
+async fn main() {
+    tracing_subscriber::fmt()
+        .with_env_filter(EnvFilter::from_default_env().add_directive("info".parse().unwrap()))
+        .init();
+    let token = std::env::var("SANDBOX_SUPERVISOR_TOKEN").unwrap_or_else(|_| "dev-token".into());
+    let image = std::env::var("LAZYBOY_COMPUTER_IMAGE").unwrap_or_else(|_| "lazyboy/computer:local".into());
+    let docker = DockerHost::connect(image, token.clone())
+        .await
+        .expect("docker");
+    let app = App {
+        token,
+        docker: Arc::new(docker),
+    };
+    let router = Router::new()
+        .route("/health", get(|| async { Json(serde_json::json!({"ok": true})) }))
+        .route("/computers", post(provision))
+        .route("/computers/{id}/exec", post(exec))
+        .route("/computers/{id}/observe", post(observe))
+        .route("/computers/{id}/act", post(act))
+        .route("/computers/{id}/screens", post(ensure_screen))
+        .route("/computers/{id}/screen-mode", post(screen_mode))
+        .route("/computers/{id}/files", get(list_files).post(write_file))
+        .route("/computers/{id}/read", post(read_file))
+        .route("/computers/{id}/stop", post(stop))
+        .route("/computers/{id}", delete(destroy))
+        .with_state(app);
+    let bind = std::env::var("SUPERVISOR_BIND").unwrap_or_else(|_| "0.0.0.0:7091".into());
+    let listener = tokio::net::TcpListener::bind(&bind).await.expect("bind");
+    tracing::info!("supervisor listening on {bind}");
+    axum::serve(listener, router).await.expect("serve");
+}
+
+fn require_token(headers: &HeaderMap, token: &str) -> Result<(), StatusCode> {
+    let supplied = headers
+        .get(axum::http::header::AUTHORIZATION)
+        .and_then(|value| value.to_str().ok())
+        .unwrap_or("");
+    if supplied == format!("Bearer {token}") {
+        Ok(())
+    } else {
+        Err(StatusCode::UNAUTHORIZED)
+    }
+}
+
+fn header_str<'a>(headers: &'a HeaderMap, name: &'static str) -> Option<&'a str> {
+    headers
+        .get(name)
+        .and_then(|value| value.to_str().ok())
+        .filter(|value| !value.is_empty())
+}
+
+fn screen_target(headers: &HeaderMap) -> ScreenTarget {
+    ScreenTarget::from_parts(
+        header_str(headers, "x-lazyboy-display"),
+        header_str(headers, "x-lazyboy-profile"),
+        header_str(headers, "x-lazyboy-screen-slot").and_then(|value| value.parse().ok()),
+    )
+}
+
+async fn provision(
+    State(app): State<App>,
+    headers: HeaderMap,
+    Json(body): Json<ProvisionBody>,
+) -> Result<Json<serde_json::Value>, StatusCode> {
+    require_token(&headers, &app.token)?;
+    let created = app
+        .docker
+        .provision(&body.home_key, &body.home_path, &body.space_id)
+        .await
+        .map_err(|error| {
+            tracing::error!("provision: {error}");
+            StatusCode::INTERNAL_SERVER_ERROR
+        })?;
+    Ok(Json(serde_json::json!({
+        "id": created.id,
+        "resumed": created.resumed,
+        "screenUrl": created.screen_url,
+    })))
+}
+
+async fn exec(
+    State(app): State<App>,
+    headers: HeaderMap,
+    Path(id): Path<String>,
+    Json(body): Json<CommandRequest>,
+) -> Result<Json<serde_json::Value>, StatusCode> {
+    require_token(&headers, &app.token)?;
+    let result = app
+        .docker
+        .exec_on(&id, body, &screen_target(&headers))
+        .await
+        .map_err(|error| {
+            tracing::error!("exec: {error}");
+            StatusCode::INTERNAL_SERVER_ERROR
+        })?;
+    Ok(Json(serde_json::json!({
+        "stdout": result.stdout,
+        "stderr": result.stderr,
+        "code": result.code,
+    })))
+}
+
+async fn observe(
+    State(app): State<App>,
+    headers: HeaderMap,
+    Path(id): Path<String>,
+) -> Result<Json<serde_json::Value>, StatusCode> {
+    require_token(&headers, &app.token)?;
+    let payload = app
+        .docker
+        .observe_payload(&id, &screen_target(&headers))
+        .await
+        .map_err(|error| {
+            tracing::error!("observe: {error}");
+            StatusCode::INTERNAL_SERVER_ERROR
+        })?;
+    Ok(Json(payload.json))
+}
+
+async fn act(
+    State(app): State<App>,
+    headers: HeaderMap,
+    Path(id): Path<String>,
+    Json(body): Json<ActionRequest>,
+) -> Result<Json<serde_json::Value>, StatusCode> {
+    require_token(&headers, &app.token)?;
+    let mut body = body;
+    let target = screen_target(&headers);
+    if body.display.is_none() {
+        body.display = Some(target.display.clone());
+    }
+    if body.profile_path.is_none() {
+        body.profile_path = target.profile_path.clone();
+    }
+    let result = app.docker.act(&id, body).await.map_err(|error| {
+        tracing::error!("act: {error}");
+        StatusCode::INTERNAL_SERVER_ERROR
+    })?;
+    Ok(Json(result))
+}
+
+#[derive(Deserialize)]
+struct ScreenModeBody {
+    interactive: bool,
+    #[serde(default)]
+    slot: Option<u32>,
+}
+
+async fn screen_mode(
+    State(app): State<App>,
+    headers: HeaderMap,
+    Path(id): Path<String>,
+    Json(body): Json<ScreenModeBody>,
+) -> Result<Json<serde_json::Value>, StatusCode> {
+    require_token(&headers, &app.token)?;
+    let slot = body.slot.or(screen_target(&headers).slot.into()).unwrap_or(0);
+    let url = app
+        .docker
+        .screen_url_for(&id, slot, body.interactive)
+        .await
+        .map_err(|error| {
+            tracing::error!("screen: {error}");
+            StatusCode::INTERNAL_SERVER_ERROR
+        })?;
+    Ok(Json(serde_json::json!({ "screenUrl": url })))
+}
+
+async fn ensure_screen(
+    State(app): State<App>,
+    headers: HeaderMap,
+    Path(id): Path<String>,
+    Json(body): Json<EnsureScreenRequest>,
+) -> Result<Json<serde_json::Value>, StatusCode> {
+    require_token(&headers, &app.token)?;
+    let result = app.docker.ensure_screen(&id, body).await.map_err(|error| {
+        tracing::error!("ensure screen: {error}");
+        StatusCode::INTERNAL_SERVER_ERROR
+    })?;
+    Ok(Json(serde_json::json!({
+        "slot": result.slot,
+        "display": result.display,
+        "viewPort": result.view_port,
+    })))
+}
+
+#[derive(Deserialize)]
+struct PathQuery {
+    path: Option<String>,
+}
+
+async fn list_files(
+    State(app): State<App>,
+    headers: HeaderMap,
+    Path(id): Path<String>,
+    axum::extract::Query(query): axum::extract::Query<PathQuery>,
+) -> Result<Json<serde_json::Value>, StatusCode> {
+    require_token(&headers, &app.token)?;
+    let path = query.path.unwrap_or_default();
+    let entries = app.docker.list_files(&id, &path).await.map_err(|error| {
+        tracing::error!("list: {error}");
+        StatusCode::INTERNAL_SERVER_ERROR
+    })?;
+    Ok(Json(serde_json::json!(entries)))
+}
+
+#[derive(Deserialize)]
+struct FileBody {
+    path: String,
+    content: Option<String>,
+}
+
+async fn write_file(
+    State(app): State<App>,
+    headers: HeaderMap,
+    Path(id): Path<String>,
+    Json(body): Json<FileBody>,
+) -> Result<StatusCode, StatusCode> {
+    require_token(&headers, &app.token)?;
+    let relative = normalize_workspace_path(&body.path).map_err(|_| StatusCode::BAD_REQUEST)?;
+    app.docker
+        .write_file(&id, &relative, body.content.unwrap_or_default().as_bytes())
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    Ok(StatusCode::NO_CONTENT)
+}
+
+async fn read_file(
+    State(app): State<App>,
+    headers: HeaderMap,
+    Path(id): Path<String>,
+    Json(body): Json<FileBody>,
+) -> Result<Json<serde_json::Value>, StatusCode> {
+    require_token(&headers, &app.token)?;
+    let relative = normalize_workspace_path(&body.path).map_err(|_| StatusCode::BAD_REQUEST)?;
+    let bytes = app
+        .docker
+        .read_file(&id, &relative)
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    Ok(Json(serde_json::json!({
+        "path": relative,
+        "content": String::from_utf8_lossy(&bytes),
+    })))
+}
+
+async fn stop(
+    State(app): State<App>,
+    headers: HeaderMap,
+    Path(id): Path<String>,
+) -> Result<StatusCode, StatusCode> {
+    require_token(&headers, &app.token)?;
+    app.docker.stop(&id).await.map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    Ok(StatusCode::NO_CONTENT)
+}
+
+async fn destroy(
+    State(app): State<App>,
+    headers: HeaderMap,
+    Path(id): Path<String>,
+) -> Result<StatusCode, StatusCode> {
+    require_token(&headers, &app.token)?;
+    app.docker.destroy(&id).await.map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    Ok(StatusCode::NO_CONTENT)
+}
+
+#[derive(Serialize)]
+#[allow(dead_code)]
+struct _Home(&'static str);
+
+fn _assert_home() {
+    let _ = HOME;
+}
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..5609d9e
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,76 @@
+services:
+  postgres:
+    image: postgres:16
+    environment:
+      POSTGRES_USER: lazyboy
+      POSTGRES_PASSWORD: lazyboy
+      POSTGRES_DB: lazyboy
+    ports:
+      - "127.0.0.1:5434:5432"
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U lazyboy"]
+      interval: 3s
+      timeout: 5s
+      retries: 20
+
+  computer:
+    image: lazyboy/computer:local
+    build:
+      context: .
+      dockerfile: image/computer/Dockerfile
+    command: ["true"]
+    restart: "no"
+    network_mode: none
+
+  supervisor:
+    build:
+      context: .
+      dockerfile: image/supervisor/Dockerfile
+    environment:
+      SANDBOX_SUPERVISOR_TOKEN: ${SANDBOX_SUPERVISOR_TOKEN:-dev-token}
+      LAZYBOY_COMPUTER_IMAGE: lazyboy/computer:local
+      SUPERVISOR_BIND: 0.0.0.0:7091
+      DATA_DIR: /data
+      HOST_DATA_DIR: ${PWD}/data
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - ./data:/data
+    ports:
+      - "7092:7091"
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    depends_on:
+      computer:
+        condition: service_completed_successfully
+
+  api:
+    build:
+      context: .
+      dockerfile: image/api/Dockerfile
+    environment:
+      DATABASE_URL: postgres://lazyboy:lazyboy@postgres:5432/lazyboy
+      SANDBOX_SUPERVISOR_URL: http://supervisor:7091
+      SANDBOX_SUPERVISOR_TOKEN: ${SANDBOX_SUPERVISOR_TOKEN:-dev-token}
+      SANDBOX_PROVIDER: docker
+      DATA_DIR: /data
+      HOST_DATA_DIR: ${PWD}/data
+      API_BIND: 0.0.0.0:3100
+      XAI_API_KEY: ${XAI_API_KEY:-}
+      LAZYBOY_WEB_DIR: /web
+      LAZYBOY_SCREEN_UPSTREAM: host.docker.internal
+    ports:
+      - "3101:3100"
+    volumes:
+      - ./data:/data
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    depends_on:
+      postgres:
+        condition: service_healthy
+      supervisor:
+        condition: service_started
+
+volumes:
+  pgdata:
diff --git a/image/api/Dockerfile b/image/api/Dockerfile
new file mode 100644
index 0000000..cb3cebb
--- /dev/null
+++ b/image/api/Dockerfile
@@ -0,0 +1,14 @@
+FROM rust:1-bookworm AS build
+WORKDIR /src
+COPY Cargo.toml Cargo.lock ./
+COPY crates crates
+COPY migrations migrations
+RUN cargo build --release -p lazyboy-api
+
+FROM debian:bookworm-slim
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/*
+COPY --from=build /src/target/release/lazyboy-api /usr/local/bin/lazyboy-api
+COPY apps/web /web
+ENV LAZYBOY_WEB_DIR=/web
+EXPOSE 3100
+CMD ["lazyboy-api"]
diff --git a/image/computer/Dockerfile b/image/computer/Dockerfile
new file mode 100644
index 0000000..46a4635
--- /dev/null
+++ b/image/computer/Dockerfile
@@ -0,0 +1,138 @@
+# Real bot desktop. Every boot must look like a Linux workstation:
+# XFCE panel + window manager, Chromium, zsh terminal. Never a kiosk/HTML shell.
+# Traditional Chinese fonts/locale so CJK text does not mojibake.
+# Build from the repository root:
+#   docker build -f image/computer/Dockerfile -t lazyboy/computer:local .
+
+FROM rust:1-bookworm AS controld
+WORKDIR /src
+COPY Cargo.toml Cargo.lock ./
+COPY crates crates
+COPY migrations migrations
+RUN cargo build --release -p lazyboy-controld
+
+FROM debian:bookworm-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    chromium \
+    curl \
+    dbus-x11 \
+    fonts-dejavu-core \
+    fonts-liberation \
+    fonts-noto-cjk \
+    fonts-noto-color-emoji \
+    fonts-noto-core \
+    git \
+    imagemagick \
+    locales \
+    novnc \
+    procps \
+    python3 \
+    util-linux \
+    websockify \
+    wmctrl \
+    x11-apps \
+    x11-utils \
+    x11vnc \
+    xclip \
+    xdg-utils \
+    xfce4-panel \
+    xfce4-settings \
+    xfce4-terminal \
+    xfconf \
+    xfdesktop4 \
+    xdotool \
+    xfwm4 \
+    xterm \
+    xvfb \
+    thunar \
+    adwaita-icon-theme \
+    gnome-themes-extra \
+    librsvg2-common \
+    zsh \
+  && echo "zh_TW.UTF-8 UTF-8" >> /etc/locale.gen \
+  && echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen \
+  && locale-gen \
+  && rm -rf /var/lib/apt/lists/*
+
+# jf open 粉圓 (system UI) + MesloLGS NF (Powerlevel10k glyphs, CJK via fontconfig).
+RUN mkdir -p /usr/share/fonts/truetype/huninn /usr/share/fonts/truetype/meslo \
+  && curl -fsSL -o /usr/share/fonts/truetype/huninn/jf-openhuninn-2.1.ttf \
+      https://github.com/justfont/open-huninn-font/releases/download/v2.1/jf-openhuninn-2.1.ttf \
+  && curl -fsSL -o "/usr/share/fonts/truetype/meslo/MesloLGS NF Regular.ttf" \
+      "https://github.com/romkatv/powerlevel10k-media/raw/master/MesloLGS%20NF%20Regular.ttf" \
+  && curl -fsSL -o "/usr/share/fonts/truetype/meslo/MesloLGS NF Bold.ttf" \
+      "https://github.com/romkatv/powerlevel10k-media/raw/master/MesloLGS%20NF%20Bold.ttf" \
+  && curl -fsSL -o "/usr/share/fonts/truetype/meslo/MesloLGS NF Italic.ttf" \
+      "https://github.com/romkatv/powerlevel10k-media/raw/master/MesloLGS%20NF%20Italic.ttf" \
+  && curl -fsSL -o "/usr/share/fonts/truetype/meslo/MesloLGS NF Bold Italic.ttf" \
+      "https://github.com/romkatv/powerlevel10k-media/raw/master/MesloLGS%20NF%20Bold%20Italic.ttf" \
+  && fc-cache -f
+
+RUN git clone --depth=1 https://github.com/romkatv/powerlevel10k.git /usr/share/zsh-theme-powerlevel10k \
+  && git clone --depth=1 https://github.com/zsh-users/zsh-autosuggestions.git /usr/share/zsh/plugins/zsh-autosuggestions \
+  && git clone --depth=1 https://github.com/zsh-users/zsh-syntax-highlighting.git /usr/share/zsh/plugins/zsh-syntax-highlighting \
+  && git clone --depth=1 https://github.com/agkozak/zsh-z.git /usr/share/zsh/plugins/zsh-z \
+  && rm -rf /usr/share/zsh-theme-powerlevel10k/.git \
+            /usr/share/zsh/plugins/zsh-autosuggestions/.git \
+            /usr/share/zsh/plugins/zsh-syntax-highlighting/.git \
+            /usr/share/zsh/plugins/zsh-z/.git
+
+RUN useradd --create-home --uid 1000 --shell /bin/zsh lazyboy \
+    && mkdir -p /home/lazyboy /tmp/lazyboy /usr/share/lazyboy/skel /usr/share/lazyboy/xfce-skel /etc/gtk-3.0 /etc/fonts/conf.d \
+    && chown -R 1000:1000 /home/lazyboy /tmp/lazyboy
+
+COPY --from=controld --chmod=755 /src/target/release/lazyboy-controld /usr/local/bin/lazyboy-controld
+COPY --chmod=755 image/computer/start.sh /usr/local/bin/lazyboy-computer
+COPY --chmod=755 image/computer/lazyboy-screen /usr/local/bin/lazyboy-screen
+COPY --chmod=755 image/computer/lazyboy-browser /usr/local/bin/lazyboy-browser
+COPY --chmod=755 image/computer/lazyboy-terminal /usr/local/bin/lazyboy-terminal
+COPY --chmod=644 apps/web/vnc.html /usr/share/novnc/vnc_lite.html
+COPY --chmod=644 apps/web/vnc.html /usr/share/novnc/index.html
+COPY --chmod=644 image/computer/fonts.conf /etc/fonts/conf.d/99-lazyboy-cjk.conf
+COPY --chmod=644 image/computer/gtk3-settings.ini /etc/gtk-3.0/settings.ini
+COPY --chmod=644 image/computer/dotfiles/zshrc /usr/share/lazyboy/skel/zshrc
+COPY --chmod=644 image/computer/dotfiles/p10k.zsh /usr/share/lazyboy/skel/p10k.zsh
+COPY --chmod=644 image/computer/dotfiles/terminalrc /usr/share/lazyboy/skel/terminalrc
+COPY --chmod=644 image/computer/xfce/xfce4-panel.xml /usr/share/lazyboy/xfce-skel/xfce4/xfconf/xfce-perchannel-xml/xfce4-panel.xml
+COPY --chmod=644 image/computer/xfce/xfwm4.xml /usr/share/lazyboy/xfce-skel/xfce4/xfconf/xfce-perchannel-xml/xfwm4.xml
+COPY --chmod=644 image/computer/xfce/xfce4-desktop.xml /usr/share/lazyboy/xfce-skel/xfce4/xfconf/xfce-perchannel-xml/xfce4-desktop.xml
+COPY --chmod=644 image/computer/xfce/thunar.xml /usr/share/lazyboy/xfce-skel/xfce4/xfconf/xfce-perchannel-xml/thunar.xml
+COPY --chmod=644 image/computer/xfce/terminal.desktop /usr/share/applications/lazyboy-terminal.desktop
+COPY --chmod=644 image/computer/xfce/browser.desktop /usr/share/applications/lazyboy-browser.desktop
+# Debian slim drops /usr/share/locale. Keep Traditional Chinese catalogs so
+# XFCE menus are not English. Hide stock xterm / duplicate terminal entries;
+# the panel launches lazyboy-terminal (zsh -l).
+RUN printf '%s\n' \
+      'path-include=/usr/share/locale/zh_TW/*' \
+      'path-include=/usr/share/locale/zh/*' \
+      > /etc/dpkg/dpkg.cfg.d/zz-lazyboy-locale \
+  && apt-get update \
+  && apt-get install -y --no-install-recommends --reinstall \
+      xfce4-panel xfce4-terminal xfdesktop4 xfwm4 thunar xfce4-settings \
+      libxfce4ui-2-0 libxfce4ui-common libxfce4util7 libxfce4util-common \
+      xfce4-helpers libgarcon-common \
+  && rm -rf /var/lib/apt/lists/* \
+  && for f in xterm uxterm debian-xterm xfce4-terminal; do \
+       if [ -f "/usr/share/applications/${f}.desktop" ]; then \
+         printf '\nNoDisplay=true\nHidden=true\n' >> "/usr/share/applications/${f}.desktop"; \
+       fi; \
+     done \
+  && chmod -R a+rX /usr/share/lazyboy /usr/share/applications /usr/share/novnc \
+  && chmod -R a+rX /usr/share/locale/zh_TW /usr/share/locale/zh 2>/dev/null || true \
+  && test -f /usr/share/locale/zh_TW/LC_MESSAGES/xfce4-terminal.mo
+# After xfce4-helpers reinstall, override preferred apps so the menu
+# 終端機模擬程式 / 網路瀏覽器 launch zsh + lazyboy-browser, not xterm.
+COPY --chmod=644 image/computer/xfce/helpers.rc /etc/xdg/xfce4/helpers.rc
+COPY --chmod=644 image/computer/xfce/helper-terminal.desktop /usr/share/xfce4/helpers/lazyboy-terminal.desktop
+COPY --chmod=644 image/computer/xfce/helper-browser.desktop /usr/share/xfce4/helpers/lazyboy-browser.desktop
+COPY --chmod=755 image/computer/chromium /usr/local/bin/chromium
+RUN sed -i 's|^Exec=/usr/bin/chromium|Exec=/usr/local/bin/lazyboy-browser|' /usr/share/applications/chromium.desktop || true
+
+USER 1000:1000
+ENV HOME=/home/lazyboy DISPLAY=:1 SHELL=/bin/zsh TERM=xterm-256color \
+    LANG=zh_TW.UTF-8 LC_ALL=zh_TW.UTF-8 LANGUAGE=zh_TW:zh:en
+WORKDIR /home/lazyboy
+EXPOSE 6080 6081 6082 6083 6084 6085 6086 6087
+CMD ["/usr/local/bin/lazyboy-computer"]
diff --git a/image/computer/chromium b/image/computer/chromium
new file mode 100644
index 0000000..00eea2b
--- /dev/null
+++ b/image/computer/chromium
@@ -0,0 +1,2 @@
+#!/bin/sh
+exec /usr/local/bin/lazyboy-browser "$@"
diff --git a/image/computer/dotfiles/p10k.zsh b/image/computer/dotfiles/p10k.zsh
new file mode 100644
index 0000000..648cdff
--- /dev/null
+++ b/image/computer/dotfiles/p10k.zsh
@@ -0,0 +1,1834 @@
+# Generated by Powerlevel10k configuration wizard on 2026-04-01 at 17:43 CST.
+# Based on romkatv/powerlevel10k/config/p10k-rainbow.zsh, checksum 57633.
+# Wizard options: nerdfont-v3 + powerline, small icons, rainbow, unicode, 12h time,
+# round separators, round heads, flat tails, 1 line, sparse, many icons, concise,
+# instant_prompt=verbose.
+# Type `p10k configure` to generate another config.
+#
+# Config for Powerlevel10k with powerline prompt style with colorful background.
+# Type `p10k configure` to generate your own config based on it.
+#
+# Tip: Looking for a nice color? Here's a one-liner to print colormap.
+#
+#   for i in {0..255}; do print -Pn "%K{$i}  %k%F{$i}${(l:3::0:)i}%f " ${${(M)$((i%6)):#3}:+$'\n'}; done
+
+# Temporarily change options.
+'builtin' 'local' '-a' 'p10k_config_opts'
+[[ ! -o 'aliases'         ]] || p10k_config_opts+=('aliases')
+[[ ! -o 'sh_glob'         ]] || p10k_config_opts+=('sh_glob')
+[[ ! -o 'no_brace_expand' ]] || p10k_config_opts+=('no_brace_expand')
+'builtin' 'setopt' 'no_aliases' 'no_sh_glob' 'brace_expand'
+
+() {
+  emulate -L zsh -o extended_glob
+
+  # Unset all configuration options. This allows you to apply configuration changes without
+  # restarting zsh. Edit ~/.p10k.zsh and type `source ~/.p10k.zsh`.
+  unset -m '(POWERLEVEL9K_*|DEFAULT_USER)~POWERLEVEL9K_GITSTATUS_DIR'
+
+  # Zsh >= 5.1 is required.
+  [[ $ZSH_VERSION == (5.<1->*|<6->.*) ]] || return
+
+  # The list of segments shown on the left. Fill it with the most important segments.
+  typeset -g POWERLEVEL9K_LEFT_PROMPT_ELEMENTS=(
+    os_icon                 # os identifier
+    dir                     # current directory
+    vcs                     # git status
+    # prompt_char           # prompt symbol
+  )
+
+  # The list of segments shown on the right. Fill it with less important segments.
+  # Right prompt on the last prompt line (where you are typing your commands) gets
+  # automatically hidden when the input line reaches it. Right prompt above the
+  # last prompt line gets hidden if it would overlap with left prompt.
+  typeset -g POWERLEVEL9K_RIGHT_PROMPT_ELEMENTS=(
+    status                  # exit code of the last command
+    command_execution_time  # duration of the last command
+    background_jobs         # presence of background jobs
+    direnv                  # direnv status (https://direnv.net/)
+    asdf                    # asdf version manager (https://github.com/asdf-vm/asdf)
+    virtualenv              # python virtual environment (https://docs.python.org/3/library/venv.html)
+    anaconda                # conda environment (https://conda.io/)
+    pyenv                   # python environment (https://github.com/pyenv/pyenv)
+    goenv                   # go environment (https://github.com/syndbg/goenv)
+    nodenv                  # node.js version from nodenv (https://github.com/nodenv/nodenv)
+    nvm                     # node.js version from nvm (https://github.com/nvm-sh/nvm)
+    nodeenv                 # node.js environment (https://github.com/ekalinin/nodeenv)
+    # node_version          # node.js version
+    # go_version            # go version (https://golang.org)
+    # rust_version          # rustc version (https://www.rust-lang.org)
+    # dotnet_version        # .NET version (https://dotnet.microsoft.com)
+    # php_version           # php version (https://www.php.net/)
+    # laravel_version       # laravel php framework version (https://laravel.com/)
+    # java_version          # java version (https://www.java.com/)
+    # package               # name@version from package.json (https://docs.npmjs.com/files/package.json)
+    rbenv                   # ruby version from rbenv (https://github.com/rbenv/rbenv)
+    rvm                     # ruby version from rvm (https://rvm.io)
+    fvm                     # flutter version management (https://github.com/leoafarias/fvm)
+    luaenv                  # lua version from luaenv (https://github.com/cehoffman/luaenv)
+    jenv                    # java version from jenv (https://github.com/jenv/jenv)
+    plenv                   # perl version from plenv (https://github.com/tokuhirom/plenv)
+    perlbrew                # perl version from perlbrew (https://github.com/gugod/App-perlbrew)
+    phpenv                  # php version from phpenv (https://github.com/phpenv/phpenv)
+    scalaenv                # scala version from scalaenv (https://github.com/scalaenv/scalaenv)
+    haskell_stack           # haskell version from stack (https://haskellstack.org/)
+    kubecontext             # current kubernetes context (https://kubernetes.io/)
+    terraform               # terraform workspace (https://www.terraform.io)
+    # terraform_version     # terraform version (https://www.terraform.io)
+    aws                     # aws profile (https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-profiles.html)
+    aws_eb_env              # aws elastic beanstalk environment (https://aws.amazon.com/elasticbeanstalk/)
+    azure                   # azure account name (https://docs.microsoft.com/en-us/cli/azure)
+    gcloud                  # google cloud cli account and project (https://cloud.google.com/)
+    google_app_cred         # google application credentials (https://cloud.google.com/docs/authentication/production)
+    toolbox                 # toolbox name (https://github.com/containers/toolbox)
+    context                 # user@hostname
+    nordvpn                 # nordvpn connection status, linux only (https://nordvpn.com/)
+    ranger                  # ranger shell (https://github.com/ranger/ranger)
+    yazi                    # yazi shell (https://github.com/sxyazi/yazi)
+    nnn                     # nnn shell (https://github.com/jarun/nnn)
+    lf                      # lf shell (https://github.com/gokcehan/lf)
+    xplr                    # xplr shell (https://github.com/sayanarijit/xplr)
+    vim_shell               # vim shell indicator (:sh)
+    midnight_commander      # midnight commander shell (https://midnight-commander.org/)
+    nix_shell               # nix shell (https://nixos.org/nixos/nix-pills/developing-with-nix-shell.html)
+    chezmoi_shell           # chezmoi shell (https://www.chezmoi.io/)
+    vi_mode                 # vi mode (you don't need this if you've enabled prompt_char)
+    # vpn_ip                # virtual private network indicator
+    # load                  # CPU load
+    # disk_usage            # disk usage
+    # ram                   # free RAM
+    # swap                  # used swap
+    todo                    # todo items (https://github.com/todotxt/todo.txt-cli)
+    timewarrior             # timewarrior tracking status (https://timewarrior.net/)
+    taskwarrior             # taskwarrior task count (https://taskwarrior.org/)
+    per_directory_history   # Oh My Zsh per-directory-history local/global indicator
+    # cpu_arch              # CPU architecture
+    time                    # current time
+    # ip                    # ip address and bandwidth usage for a specified network interface
+    # public_ip             # public IP address
+    # proxy                 # system-wide http/https/ftp proxy
+    # battery               # internal battery
+    # wifi                  # wifi speed
+    # example               # example user-defined segment (see prompt_example function below)
+  )
+
+  # Defines character set used by powerlevel10k. It's best to let `p10k configure` set it for you.
+  typeset -g POWERLEVEL9K_MODE=nerdfont-v3
+  # When set to `moderate`, some icons will have an extra space after them. This is meant to avoid
+  # icon overlap when using non-monospace fonts. When set to `none`, spaces are not added.
+  typeset -g POWERLEVEL9K_ICON_PADDING=none
+
+  # When set to true, icons appear before content on both sides of the prompt. When set
+  # to false, icons go after content. If empty or not set, icons go before content in the left
+  # prompt and after content in the right prompt.
+  #
+  # You can also override it for a specific segment:
+  #
+  #   POWERLEVEL9K_STATUS_ICON_BEFORE_CONTENT=false
+  #
+  # Or for a specific segment in specific state:
+  #
+  #   POWERLEVEL9K_DIR_NOT_WRITABLE_ICON_BEFORE_CONTENT=false
+  typeset -g POWERLEVEL9K_ICON_BEFORE_CONTENT=
+
+  # Add an empty line before each prompt.
+  typeset -g POWERLEVEL9K_PROMPT_ADD_NEWLINE=true
+
+  # Connect left prompt lines with these symbols. You'll probably want to use the same color
+  # as POWERLEVEL9K_MULTILINE_FIRST_PROMPT_GAP_FOREGROUND below.
+  typeset -g POWERLEVEL9K_MULTILINE_FIRST_PROMPT_PREFIX='%242F╭─'
+  typeset -g POWERLEVEL9K_MULTILINE_NEWLINE_PROMPT_PREFIX='%242F├─'
+  typeset -g POWERLEVEL9K_MULTILINE_LAST_PROMPT_PREFIX='%242F╰─'
+  # Connect right prompt lines with these symbols.
+  typeset -g POWERLEVEL9K_MULTILINE_FIRST_PROMPT_SUFFIX='%242F─╮'
+  typeset -g POWERLEVEL9K_MULTILINE_NEWLINE_PROMPT_SUFFIX='%242F─┤'
+  typeset -g POWERLEVEL9K_MULTILINE_LAST_PROMPT_SUFFIX='%242F─╯'
+
+  # Filler between left and right prompt on the first prompt line. You can set it to ' ', '·' or
+  # '─'. The last two make it easier to see the alignment between left and right prompt and to
+  # separate prompt from command output. You might want to set POWERLEVEL9K_PROMPT_ADD_NEWLINE=false
+  # for more compact prompt if using this option.
+  typeset -g POWERLEVEL9K_MULTILINE_FIRST_PROMPT_GAP_CHAR=' '
+  typeset -g POWERLEVEL9K_MULTILINE_FIRST_PROMPT_GAP_BACKGROUND=
+  typeset -g POWERLEVEL9K_MULTILINE_NEWLINE_PROMPT_GAP_BACKGROUND=
+  if [[ $POWERLEVEL9K_MULTILINE_FIRST_PROMPT_GAP_CHAR != ' ' ]]; then
+    # The color of the filler. You'll probably want to match the color of POWERLEVEL9K_MULTILINE
+    # ornaments defined above.
+    typeset -g POWERLEVEL9K_MULTILINE_FIRST_PROMPT_GAP_FOREGROUND=242
+    # Start filler from the edge of the screen if there are no left segments on the first line.
+    typeset -g POWERLEVEL9K_EMPTY_LINE_LEFT_PROMPT_FIRST_SEGMENT_END_SYMBOL='%{%}'
+    # End filler on the edge of the screen if there are no right segments on the first line.
+    typeset -g POWERLEVEL9K_EMPTY_LINE_RIGHT_PROMPT_FIRST_SEGMENT_START_SYMBOL='%{%}'
+  fi
+
+  # Separator between same-color segments on the left.
+  typeset -g POWERLEVEL9K_LEFT_SUBSEGMENT_SEPARATOR='\uE0B5'
+  # Separator between same-color segments on the right.
+  typeset -g POWERLEVEL9K_RIGHT_SUBSEGMENT_SEPARATOR='\uE0B7'
+  # Separator between different-color segments on the left.
+  typeset -g POWERLEVEL9K_LEFT_SEGMENT_SEPARATOR='\uE0B4'
+  # Separator between different-color segments on the right.
+  typeset -g POWERLEVEL9K_RIGHT_SEGMENT_SEPARATOR='\uE0B6'
+  # To remove a separator between two segments, add "_joined" to the second segment name.
+  # For example: POWERLEVEL9K_RIGHT_PROMPT_ELEMENTS=(os_icon context_joined)
+
+  # The right end of left prompt.
+  typeset -g POWERLEVEL9K_LEFT_PROMPT_LAST_SEGMENT_END_SYMBOL='\uE0B4'
+  # The left end of right prompt.
+  typeset -g POWERLEVEL9K_RIGHT_PROMPT_FIRST_SEGMENT_START_SYMBOL='\uE0B6'
+  # The left end of left prompt.
+  typeset -g POWERLEVEL9K_LEFT_PROMPT_FIRST_SEGMENT_START_SYMBOL=''
+  # The right end of right prompt.
+  typeset -g POWERLEVEL9K_RIGHT_PROMPT_LAST_SEGMENT_END_SYMBOL=''
+  # Left prompt terminator for lines without any segments.
+  typeset -g POWERLEVEL9K_EMPTY_LINE_LEFT_PROMPT_LAST_SEGMENT_END_SYMBOL=
+
+  #################################[ os_icon: os identifier ]##################################
+  # OS identifier color.
+  typeset -g POWERLEVEL9K_OS_ICON_FOREGROUND=232
+  typeset -g POWERLEVEL9K_OS_ICON_BACKGROUND=7
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_OS_ICON_CONTENT_EXPANSION='⭐'
+
+  ################################[ prompt_char: prompt symbol ]################################
+  # Transparent background.
+  typeset -g POWERLEVEL9K_PROMPT_CHAR_BACKGROUND=
+  # Green prompt symbol if the last command succeeded.
+  typeset -g POWERLEVEL9K_PROMPT_CHAR_OK_{VIINS,VICMD,VIVIS,VIOWR}_FOREGROUND=76
+  # Red prompt symbol if the last command failed.
+  typeset -g POWERLEVEL9K_PROMPT_CHAR_ERROR_{VIINS,VICMD,VIVIS,VIOWR}_FOREGROUND=196
+  # Default prompt symbol.
+  typeset -g POWERLEVEL9K_PROMPT_CHAR_{OK,ERROR}_VIINS_CONTENT_EXPANSION='❯'
+  # Prompt symbol in command vi mode.
+  typeset -g POWERLEVEL9K_PROMPT_CHAR_{OK,ERROR}_VICMD_CONTENT_EXPANSION='❮'
+  # Prompt symbol in visual vi mode.
+  typeset -g POWERLEVEL9K_PROMPT_CHAR_{OK,ERROR}_VIVIS_CONTENT_EXPANSION='V'
+  # Prompt symbol in overwrite vi mode.
+  typeset -g POWERLEVEL9K_PROMPT_CHAR_{OK,ERROR}_VIOWR_CONTENT_EXPANSION='▶'
+  typeset -g POWERLEVEL9K_PROMPT_CHAR_OVERWRITE_STATE=true
+  # No line terminator if prompt_char is the last segment.
+  typeset -g POWERLEVEL9K_PROMPT_CHAR_LEFT_PROMPT_LAST_SEGMENT_END_SYMBOL=
+  # No line introducer if prompt_char is the first segment.
+  typeset -g POWERLEVEL9K_PROMPT_CHAR_LEFT_PROMPT_FIRST_SEGMENT_START_SYMBOL=
+  # No surrounding whitespace.
+  typeset -g POWERLEVEL9K_PROMPT_CHAR_LEFT_{LEFT,RIGHT}_WHITESPACE=
+
+  ##################################[ dir: current directory ]##################################
+  # Current directory background color.
+  typeset -g POWERLEVEL9K_DIR_BACKGROUND=4
+  # Default current directory foreground color.
+  typeset -g POWERLEVEL9K_DIR_FOREGROUND=254
+  # If directory is too long, shorten some of its segments to the shortest possible unique
+  # prefix. The shortened directory can be tab-completed to the original.
+  typeset -g POWERLEVEL9K_SHORTEN_STRATEGY=truncate_to_unique
+  # Replace removed segment suffixes with this symbol.
+  typeset -g POWERLEVEL9K_SHORTEN_DELIMITER=
+  # Color of the shortened directory segments.
+  typeset -g POWERLEVEL9K_DIR_SHORTENED_FOREGROUND=250
+  # Color of the anchor directory segments. Anchor segments are never shortened. The first
+  # segment is always an anchor.
+  typeset -g POWERLEVEL9K_DIR_ANCHOR_FOREGROUND=255
+  # Display anchor directory segments in bold.
+  typeset -g POWERLEVEL9K_DIR_ANCHOR_BOLD=true
+  # Don't shorten directories that contain any of these files. They are anchors.
+  local anchor_files=(
+    .bzr
+    .citc
+    .git
+    .hg
+    .node-version
+    .python-version
+    .go-version
+    .ruby-version
+    .lua-version
+    .java-version
+    .perl-version
+    .php-version
+    .tool-versions
+    .mise.toml
+    .shorten_folder_marker
+    .svn
+    .terraform
+    CVS
+    Cargo.toml
+    composer.json
+    go.mod
+    package.json
+    stack.yaml
+  )
+  typeset -g POWERLEVEL9K_SHORTEN_FOLDER_MARKER="(${(j:|:)anchor_files})"
+  # If set to "first" ("last"), remove everything before the first (last) subdirectory that contains
+  # files matching $POWERLEVEL9K_SHORTEN_FOLDER_MARKER. For example, when the current directory is
+  # /foo/bar/git_repo/nested_git_repo/baz, prompt will display git_repo/nested_git_repo/baz (first)
+  # or nested_git_repo/baz (last). This assumes that git_repo and nested_git_repo contain markers
+  # and other directories don't.
+  #
+  # Optionally, "first" and "last" can be followed by ":<offset>" where <offset> is an integer.
+  # This moves the truncation point to the right (positive offset) or to the left (negative offset)
+  # relative to the marker. Plain "first" and "last" are equivalent to "first:0" and "last:0"
+  # respectively.
+  typeset -g POWERLEVEL9K_DIR_TRUNCATE_BEFORE_MARKER=false
+  # Don't shorten this many last directory segments. They are anchors.
+  typeset -g POWERLEVEL9K_SHORTEN_DIR_LENGTH=1
+  # Shorten directory if it's longer than this even if there is space for it. The value can
+  # be either absolute (e.g., '80') or a percentage of terminal width (e.g, '50%'). If empty,
+  # directory will be shortened only when prompt doesn't fit or when other parameters demand it
+  # (see POWERLEVEL9K_DIR_MIN_COMMAND_COLUMNS and POWERLEVEL9K_DIR_MIN_COMMAND_COLUMNS_PCT below).
+  # If set to `0`, directory will always be shortened to its minimum length.
+  typeset -g POWERLEVEL9K_DIR_MAX_LENGTH=80
+  # When `dir` segment is on the last prompt line, try to shorten it enough to leave at least this
+  # many columns for typing commands.
+  typeset -g POWERLEVEL9K_DIR_MIN_COMMAND_COLUMNS=40
+  # When `dir` segment is on the last prompt line, try to shorten it enough to leave at least
+  # COLUMNS * POWERLEVEL9K_DIR_MIN_COMMAND_COLUMNS_PCT * 0.01 columns for typing commands.
+  typeset -g POWERLEVEL9K_DIR_MIN_COMMAND_COLUMNS_PCT=50
+  # If set to true, embed a hyperlink into the directory. Useful for quickly
+  # opening a directory in the file manager simply by clicking the link.
+  # Can also be handy when the directory is shortened, as it allows you to see
+  # the full directory that was used in previous commands.
+  typeset -g POWERLEVEL9K_DIR_HYPERLINK=false
+
+  # Enable special styling for non-writable and non-existent directories. See POWERLEVEL9K_LOCK_ICON
+  # and POWERLEVEL9K_DIR_CLASSES below.
+  typeset -g POWERLEVEL9K_DIR_SHOW_WRITABLE=v3
+
+  # The default icon shown next to non-writable and non-existent directories when
+  # POWERLEVEL9K_DIR_SHOW_WRITABLE is set to v3.
+  # typeset -g POWERLEVEL9K_LOCK_ICON='⭐'
+
+  # POWERLEVEL9K_DIR_CLASSES allows you to specify custom icons and colors for different
+  # directories. It must be an array with 3 * N elements. Each triplet consists of:
+  #
+  #   1. A pattern against which the current directory ($PWD) is matched. Matching is done with
+  #      extended_glob option enabled.
+  #   2. Directory class for the purpose of styling.
+  #   3. An empty string.
+  #
+  # Triplets are tried in order. The first triplet whose pattern matches $PWD wins.
+  #
+  # If POWERLEVEL9K_DIR_SHOW_WRITABLE is set to v3, non-writable and non-existent directories
+  # acquire class suffix _NOT_WRITABLE and NON_EXISTENT respectively.
+  #
+  # For example, given these settings:
+  #
+  #   typeset -g POWERLEVEL9K_DIR_CLASSES=(
+  #     '~/work(|/*)'  WORK     ''
+  #     '~(|/*)'       HOME     ''
+  #     '*'            DEFAULT  '')
+  #
+  # Whenever the current directory is ~/work or a subdirectory of ~/work, it gets styled with one
+  # of the following classes depending on its writability and existence: WORK, WORK_NOT_WRITABLE or
+  # WORK_NON_EXISTENT.
+  #
+  # Simply assigning classes to directories doesn't have any visible effects. It merely gives you an
+  # option to define custom colors and icons for different directory classes.
+  #
+  #   # Styling for WORK.
+  #   typeset -g POWERLEVEL9K_DIR_WORK_VISUAL_IDENTIFIER_EXPANSION='⭐'
+  #   typeset -g POWERLEVEL9K_DIR_WORK_BACKGROUND=4
+  #   typeset -g POWERLEVEL9K_DIR_WORK_FOREGROUND=254
+  #   typeset -g POWERLEVEL9K_DIR_WORK_SHORTENED_FOREGROUND=250
+  #   typeset -g POWERLEVEL9K_DIR_WORK_ANCHOR_FOREGROUND=255
+  #
+  #   # Styling for WORK_NOT_WRITABLE.
+  #   typeset -g POWERLEVEL9K_DIR_WORK_NOT_WRITABLE_VISUAL_IDENTIFIER_EXPANSION='⭐'
+  #   typeset -g POWERLEVEL9K_DIR_WORK_NOT_WRITABLE_BACKGROUND=4
+  #   typeset -g POWERLEVEL9K_DIR_WORK_NOT_WRITABLE_FOREGROUND=254
+  #   typeset -g POWERLEVEL9K_DIR_WORK_NOT_WRITABLE_SHORTENED_FOREGROUND=250
+  #   typeset -g POWERLEVEL9K_DIR_WORK_NOT_WRITABLE_ANCHOR_FOREGROUND=255
+  #
+  #   # Styling for WORK_NON_EXISTENT.
+  #   typeset -g POWERLEVEL9K_DIR_WORK_NON_EXISTENT_VISUAL_IDENTIFIER_EXPANSION='⭐'
+  #   typeset -g POWERLEVEL9K_DIR_WORK_NON_EXISTENT_BACKGROUND=4
+  #   typeset -g POWERLEVEL9K_DIR_WORK_NON_EXISTENT_FOREGROUND=254
+  #   typeset -g POWERLEVEL9K_DIR_WORK_NON_EXISTENT_SHORTENED_FOREGROUND=250
+  #   typeset -g POWERLEVEL9K_DIR_WORK_NON_EXISTENT_ANCHOR_FOREGROUND=255
+  #
+  # If a styling parameter isn't explicitly defined for some class, it falls back to the classless
+  # parameter. For example, if POWERLEVEL9K_DIR_WORK_NOT_WRITABLE_FOREGROUND is not set, it falls
+  # back to POWERLEVEL9K_DIR_FOREGROUND.
+  #
+  # typeset -g POWERLEVEL9K_DIR_CLASSES=()
+
+  # Custom prefix.
+  # typeset -g POWERLEVEL9K_DIR_PREFIX='in '
+
+  #####################################[ vcs: git status ]######################################
+  # Version control background colors.
+  typeset -g POWERLEVEL9K_VCS_CLEAN_BACKGROUND=2
+  typeset -g POWERLEVEL9K_VCS_MODIFIED_BACKGROUND=3
+  typeset -g POWERLEVEL9K_VCS_UNTRACKED_BACKGROUND=2
+  typeset -g POWERLEVEL9K_VCS_CONFLICTED_BACKGROUND=3
+  typeset -g POWERLEVEL9K_VCS_LOADING_BACKGROUND=8
+
+  # Branch icon. Set this parameter to '\UE0A0 ' for the popular Powerline branch icon.
+  typeset -g POWERLEVEL9K_VCS_BRANCH_ICON='\uF126 '
+
+  # Untracked files icon. It's really a question mark, your font isn't broken.
+  # Change the value of this parameter to show a different icon.
+  typeset -g POWERLEVEL9K_VCS_UNTRACKED_ICON='?'
+
+  # Formatter for Git status.
+  #
+  # Example output: master wip ⇣42⇡42 *42 merge ~42 +42 !42 ?42.
+  #
+  # You can edit the function to customize how Git status looks.
+  #
+  # VCS_STATUS_* parameters are set by gitstatus plugin. See reference:
+  # https://github.com/romkatv/gitstatus/blob/master/gitstatus.plugin.zsh.
+  function my_git_formatter() {
+    emulate -L zsh
+
+    if [[ -n $P9K_CONTENT ]]; then
+      # If P9K_CONTENT is not empty, use it. It's either "loading" or from vcs_info (not from
+      # gitstatus plugin). VCS_STATUS_* parameters are not available in this case.
+      typeset -g my_git_format=$P9K_CONTENT
+      return
+    fi
+
+    # Styling for different parts of Git status.
+    local       meta='%7F' # white foreground
+    local      clean='%0F' # black foreground
+    local   modified='%0F' # black foreground
+    local  untracked='%0F' # black foreground
+    local conflicted='%1F' # red foreground
+
+    local res
+
+    if [[ -n $VCS_STATUS_LOCAL_BRANCH ]]; then
+      local branch=${(V)VCS_STATUS_LOCAL_BRANCH}
+      # If local branch name is at most 32 characters long, show it in full.
+      # Otherwise show the first 12 … the last 12.
+      # Tip: To always show local branch name in full without truncation, delete the next line.
+      (( $#branch > 32 )) && branch[13,-13]="…"  # <-- this line
+      res+="${clean}${(g::)POWERLEVEL9K_VCS_BRANCH_ICON}${branch//\%/%%}"
+    fi
+
+    if [[ -n $VCS_STATUS_TAG
+          # Show tag only if not on a branch.
+          # Tip: To always show tag, delete the next line.
+          && -z $VCS_STATUS_LOCAL_BRANCH  # <-- this line
+        ]]; then
+      local tag=${(V)VCS_STATUS_TAG}
+      # If tag name is at most 32 characters long, show it in full.
+      # Otherwise show the first 12 … the last 12.
+      # Tip: To always show tag name in full without truncation, delete the next line.
+      (( $#tag > 32 )) && tag[13,-13]="…"  # <-- this line
+      res+="${meta}#${clean}${tag//\%/%%}"
+    fi
+
+    # Display the current Git commit if there is no branch and no tag.
+    # Tip: To always display the current Git commit, delete the next line.
+    [[ -z $VCS_STATUS_LOCAL_BRANCH && -z $VCS_STATUS_TAG ]] &&  # <-- this line
+      res+="${meta}@${clean}${VCS_STATUS_COMMIT[1,8]}"
+
+    # Show tracking branch name if it differs from local branch.
+    if [[ -n ${VCS_STATUS_REMOTE_BRANCH:#$VCS_STATUS_LOCAL_BRANCH} ]]; then
+      res+="${meta}:${clean}${(V)VCS_STATUS_REMOTE_BRANCH//\%/%%}"
+    fi
+
+    # Display "wip" if the latest commit's summary contains "wip" or "WIP".
+    if [[ $VCS_STATUS_COMMIT_SUMMARY == (|*[^[:alnum:]])(wip|WIP)(|[^[:alnum:]]*) ]]; then
+      res+=" ${modified}wip"
+    fi
+
+    if (( VCS_STATUS_COMMITS_AHEAD || VCS_STATUS_COMMITS_BEHIND )); then
+      # ⇣42 if behind the remote.
+      (( VCS_STATUS_COMMITS_BEHIND )) && res+=" ${clean}⇣${VCS_STATUS_COMMITS_BEHIND}"
+      # ⇡42 if ahead of the remote; no leading space if also behind the remote: ⇣42⇡42.
+      (( VCS_STATUS_COMMITS_AHEAD && !VCS_STATUS_COMMITS_BEHIND )) && res+=" "
+      (( VCS_STATUS_COMMITS_AHEAD  )) && res+="${clean}⇡${VCS_STATUS_COMMITS_AHEAD}"
+    elif [[ -n $VCS_STATUS_REMOTE_BRANCH ]]; then
+      # Tip: Uncomment the next line to display '=' if up to date with the remote.
+      # res+=" ${clean}="
+    fi
+
+    # ⇠42 if behind the push remote.
+    (( VCS_STATUS_PUSH_COMMITS_BEHIND )) && res+=" ${clean}⇠${VCS_STATUS_PUSH_COMMITS_BEHIND}"
+    (( VCS_STATUS_PUSH_COMMITS_AHEAD && !VCS_STATUS_PUSH_COMMITS_BEHIND )) && res+=" "
+    # ⇢42 if ahead of the push remote; no leading space if also behind: ⇠42⇢42.
+    (( VCS_STATUS_PUSH_COMMITS_AHEAD  )) && res+="${clean}⇢${VCS_STATUS_PUSH_COMMITS_AHEAD}"
+    # *42 if have stashes.
+    (( VCS_STATUS_STASHES        )) && res+=" ${clean}*${VCS_STATUS_STASHES}"
+    # 'merge' if the repo is in an unusual state.
+    [[ -n $VCS_STATUS_ACTION     ]] && res+=" ${conflicted}${VCS_STATUS_ACTION}"
+    # ~42 if have merge conflicts.
+    (( VCS_STATUS_NUM_CONFLICTED )) && res+=" ${conflicted}~${VCS_STATUS_NUM_CONFLICTED}"
+    # +42 if have staged changes.
+    (( VCS_STATUS_NUM_STAGED     )) && res+=" ${modified}+${VCS_STATUS_NUM_STAGED}"
+    # !42 if have unstaged changes.
+    (( VCS_STATUS_NUM_UNSTAGED   )) && res+=" ${modified}!${VCS_STATUS_NUM_UNSTAGED}"
+    # ?42 if have untracked files. It's really a question mark, your font isn't broken.
+    # See POWERLEVEL9K_VCS_UNTRACKED_ICON above if you want to use a different icon.
+    # Remove the next line if you don't want to see untracked files at all.
+    (( VCS_STATUS_NUM_UNTRACKED  )) && res+=" ${untracked}${(g::)POWERLEVEL9K_VCS_UNTRACKED_ICON}${VCS_STATUS_NUM_UNTRACKED}"
+    # "─" if the number of unstaged files is unknown. This can happen due to
+    # POWERLEVEL9K_VCS_MAX_INDEX_SIZE_DIRTY (see below) being set to a non-negative number lower
+    # than the number of files in the Git index, or due to bash.showDirtyState being set to false
+    # in the repository config. The number of staged and untracked files may also be unknown
+    # in this case.
+    (( VCS_STATUS_HAS_UNSTAGED == -1 )) && res+=" ${modified}─"
+
+    typeset -g my_git_format=$res
+  }
+  functions -M my_git_formatter 2>/dev/null
+
+  # Don't count the number of unstaged, untracked and conflicted files in Git repositories with
+  # more than this many files in the index. Negative value means infinity.
+  #
+  # If you are working in Git repositories with tens of millions of files and seeing performance
+  # sagging, try setting POWERLEVEL9K_VCS_MAX_INDEX_SIZE_DIRTY to a number lower than the output
+  # of `git ls-files | wc -l`. Alternatively, add `bash.showDirtyState = false` to the repository's
+  # config: `git config bash.showDirtyState false`.
+  typeset -g POWERLEVEL9K_VCS_MAX_INDEX_SIZE_DIRTY=-1
+
+  # Don't show Git status in prompt for repositories whose workdir matches this pattern.
+  # For example, if set to '~', the Git repository at $HOME/.git will be ignored.
+  # Multiple patterns can be combined with '|': '~(|/foo)|/bar/baz/*'.
+  typeset -g POWERLEVEL9K_VCS_DISABLED_WORKDIR_PATTERN='~'
+
+  # Disable the default Git status formatting.
+  typeset -g POWERLEVEL9K_VCS_DISABLE_GITSTATUS_FORMATTING=true
+  # Install our own Git status formatter.
+  typeset -g POWERLEVEL9K_VCS_CONTENT_EXPANSION='${$((my_git_formatter()))+${my_git_format}}'
+  # Enable counters for staged, unstaged, etc.
+  typeset -g POWERLEVEL9K_VCS_{STAGED,UNSTAGED,UNTRACKED,CONFLICTED,COMMITS_AHEAD,COMMITS_BEHIND}_MAX_NUM=-1
+
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_VCS_VISUAL_IDENTIFIER_EXPANSION='⭐'
+  # Custom prefix.
+  # typeset -g POWERLEVEL9K_VCS_PREFIX='on '
+
+  # Show status of repositories of these types. You can add svn and/or hg if you are
+  # using them. If you do, your prompt may become slow even when your current directory
+  # isn't in an svn or hg repository.
+  typeset -g POWERLEVEL9K_VCS_BACKENDS=(git)
+
+  ##########################[ status: exit code of the last command ]###########################
+  # Enable OK_PIPE, ERROR_PIPE and ERROR_SIGNAL status states to allow us to enable, disable and
+  # style them independently from the regular OK and ERROR state.
+  typeset -g POWERLEVEL9K_STATUS_EXTENDED_STATES=true
+
+  # Status on success. No content, just an icon. No need to show it if prompt_char is enabled as
+  # it will signify success by turning green.
+  typeset -g POWERLEVEL9K_STATUS_OK=true
+  typeset -g POWERLEVEL9K_STATUS_OK_VISUAL_IDENTIFIER_EXPANSION='✔'
+  typeset -g POWERLEVEL9K_STATUS_OK_FOREGROUND=2
+  typeset -g POWERLEVEL9K_STATUS_OK_BACKGROUND=0
+
+  # Status when some part of a pipe command fails but the overall exit status is zero. It may look
+  # like this: 1|0.
+  typeset -g POWERLEVEL9K_STATUS_OK_PIPE=true
+  typeset -g POWERLEVEL9K_STATUS_OK_PIPE_VISUAL_IDENTIFIER_EXPANSION='✔'
+  typeset -g POWERLEVEL9K_STATUS_OK_PIPE_FOREGROUND=2
+  typeset -g POWERLEVEL9K_STATUS_OK_PIPE_BACKGROUND=0
+
+  # Status when it's just an error code (e.g., '1'). No need to show it if prompt_char is enabled as
+  # it will signify error by turning red.
+  typeset -g POWERLEVEL9K_STATUS_ERROR=true
+  typeset -g POWERLEVEL9K_STATUS_ERROR_VISUAL_IDENTIFIER_EXPANSION='✘'
+  typeset -g POWERLEVEL9K_STATUS_ERROR_FOREGROUND=3
+  typeset -g POWERLEVEL9K_STATUS_ERROR_BACKGROUND=1
+
+  # Status when the last command was terminated by a signal.
+  typeset -g POWERLEVEL9K_STATUS_ERROR_SIGNAL=true
+  # Use terse signal names: "INT" instead of "SIGINT(2)".
+  typeset -g POWERLEVEL9K_STATUS_VERBOSE_SIGNAME=false
+  typeset -g POWERLEVEL9K_STATUS_ERROR_SIGNAL_VISUAL_IDENTIFIER_EXPANSION='✘'
+  typeset -g POWERLEVEL9K_STATUS_ERROR_SIGNAL_FOREGROUND=3
+  typeset -g POWERLEVEL9K_STATUS_ERROR_SIGNAL_BACKGROUND=1
+
+  # Status when some part of a pipe command fails and the overall exit status is also non-zero.
+  # It may look like this: 1|0.
+  typeset -g POWERLEVEL9K_STATUS_ERROR_PIPE=true
+  typeset -g POWERLEVEL9K_STATUS_ERROR_PIPE_VISUAL_IDENTIFIER_EXPANSION='✘'
+  typeset -g POWERLEVEL9K_STATUS_ERROR_PIPE_FOREGROUND=3
+  typeset -g POWERLEVEL9K_STATUS_ERROR_PIPE_BACKGROUND=1
+
+  ###################[ command_execution_time: duration of the last command ]###################
+  # Execution time color.
+  typeset -g POWERLEVEL9K_COMMAND_EXECUTION_TIME_FOREGROUND=0
+  typeset -g POWERLEVEL9K_COMMAND_EXECUTION_TIME_BACKGROUND=3
+  # Show duration of the last command if takes at least this many seconds.
+  typeset -g POWERLEVEL9K_COMMAND_EXECUTION_TIME_THRESHOLD=3
+  # Show this many fractional digits. Zero means round to seconds.
+  typeset -g POWERLEVEL9K_COMMAND_EXECUTION_TIME_PRECISION=0
+  # Duration format: 1d 2h 3m 4s.
+  typeset -g POWERLEVEL9K_COMMAND_EXECUTION_TIME_FORMAT='d h m s'
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_COMMAND_EXECUTION_TIME_VISUAL_IDENTIFIER_EXPANSION='⭐'
+  # Custom prefix.
+  # typeset -g POWERLEVEL9K_COMMAND_EXECUTION_TIME_PREFIX='took '
+
+  #######################[ background_jobs: presence of background jobs ]#######################
+  # Background jobs color.
+  typeset -g POWERLEVEL9K_BACKGROUND_JOBS_FOREGROUND=6
+  typeset -g POWERLEVEL9K_BACKGROUND_JOBS_BACKGROUND=0
+  # Don't show the number of background jobs.
+  typeset -g POWERLEVEL9K_BACKGROUND_JOBS_VERBOSE=false
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_BACKGROUND_JOBS_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  #######################[ direnv: direnv status (https://direnv.net/) ]########################
+  # Direnv color.
+  typeset -g POWERLEVEL9K_DIRENV_FOREGROUND=3
+  typeset -g POWERLEVEL9K_DIRENV_BACKGROUND=0
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_DIRENV_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  ###############[ asdf: asdf version manager (https://github.com/asdf-vm/asdf) ]###############
+  # Default asdf color. Only used to display tools for which there is no color override (see below).
+  # Tip:  Override these parameters for ${TOOL} with POWERLEVEL9K_ASDF_${TOOL}_FOREGROUND and
+  # POWERLEVEL9K_ASDF_${TOOL}_BACKGROUND.
+  typeset -g POWERLEVEL9K_ASDF_FOREGROUND=0
+  typeset -g POWERLEVEL9K_ASDF_BACKGROUND=7
+
+  # There are four parameters that can be used to hide asdf tools. Each parameter describes
+  # conditions under which a tool gets hidden. Parameters can hide tools but not unhide them. If at
+  # least one parameter decides to hide a tool, that tool gets hidden. If no parameter decides to
+  # hide a tool, it gets shown.
+  #
+  # Special note on the difference between POWERLEVEL9K_ASDF_SOURCES and
+  # POWERLEVEL9K_ASDF_PROMPT_ALWAYS_SHOW. Consider the effect of the following commands:
+  #
+  #   asdf local  python 3.8.1
+  #   asdf global python 3.8.1
+  #
+  # After running both commands the current python version is 3.8.1 and its source is "local" as
+  # it takes precedence over "global". If POWERLEVEL9K_ASDF_PROMPT_ALWAYS_SHOW is set to false,
+  # it'll hide python version in this case because 3.8.1 is the same as the global version.
+  # POWERLEVEL9K_ASDF_SOURCES will hide python version only if the value of this parameter doesn't
+  # contain "local".
+
+  # Hide tool versions that don't come from one of these sources.
+  #
+  # Available sources:
+  #
+  # - shell   `asdf current` says "set by ASDF_${TOOL}_VERSION environment variable"
+  # - local   `asdf current` says "set by /some/not/home/directory/file"
+  # - global  `asdf current` says "set by /home/username/file"
+  #
+  # Note: If this parameter is set to (shell local global), it won't hide tools.
+  # Tip:  Override this parameter for ${TOOL} with POWERLEVEL9K_ASDF_${TOOL}_SOURCES.
+  typeset -g POWERLEVEL9K_ASDF_SOURCES=(shell local global)
+
+  # If set to false, hide tool versions that are the same as global.
+  #
+  # Note: The name of this parameter doesn't reflect its meaning at all.
+  # Note: If this parameter is set to true, it won't hide tools.
+  # Tip:  Override this parameter for ${TOOL} with POWERLEVEL9K_ASDF_${TOOL}_PROMPT_ALWAYS_SHOW.
+  typeset -g POWERLEVEL9K_ASDF_PROMPT_ALWAYS_SHOW=false
+
+  # If set to false, hide tool versions that are equal to "system".
+  #
+  # Note: If this parameter is set to true, it won't hide tools.
+  # Tip: Override this parameter for ${TOOL} with POWERLEVEL9K_ASDF_${TOOL}_SHOW_SYSTEM.
+  typeset -g POWERLEVEL9K_ASDF_SHOW_SYSTEM=true
+
+  # If set to non-empty value, hide tools unless there is a file matching the specified file pattern
+  # in the current directory, or its parent directory, or its grandparent directory, and so on.
+  #
+  # Note: If this parameter is set to empty value, it won't hide tools.
+  # Note: SHOW_ON_UPGLOB isn't specific to asdf. It works with all prompt segments.
+  # Tip: Override this parameter for ${TOOL} with POWERLEVEL9K_ASDF_${TOOL}_SHOW_ON_UPGLOB.
+  #
+  # Example: Hide nodejs version when there is no package.json and no *.js files in the current
+  # directory, in `..`, in `../..` and so on.
+  #
+  #   typeset -g POWERLEVEL9K_ASDF_NODEJS_SHOW_ON_UPGLOB='*.js|package.json'
+  typeset -g POWERLEVEL9K_ASDF_SHOW_ON_UPGLOB=
+
+  # Ruby version from asdf.
+  typeset -g POWERLEVEL9K_ASDF_RUBY_FOREGROUND=0
+  typeset -g POWERLEVEL9K_ASDF_RUBY_BACKGROUND=1
+  # typeset -g POWERLEVEL9K_ASDF_RUBY_VISUAL_IDENTIFIER_EXPANSION='⭐'
+  # typeset -g POWERLEVEL9K_ASDF_RUBY_SHOW_ON_UPGLOB='*.foo|*.bar'
+
+  # Python version from asdf.
+  typeset -g POWERLEVEL9K_ASDF_PYTHON_FOREGROUND=0
+  typeset -g POWERLEVEL9K_ASDF_PYTHON_BACKGROUND=4
+  # typeset -g POWERLEVEL9K_ASDF_PYTHON_VISUAL_IDENTIFIER_EXPANSION='⭐'
+  # typeset -g POWERLEVEL9K_ASDF_PYTHON_SHOW_ON_UPGLOB='*.foo|*.bar'
+
+  # Go version from asdf.
+  typeset -g POWERLEVEL9K_ASDF_GOLANG_FOREGROUND=0
+  typeset -g POWERLEVEL9K_ASDF_GOLANG_BACKGROUND=4
+  # typeset -g POWERLEVEL9K_ASDF_GOLANG_VISUAL_IDENTIFIER_EXPANSION='⭐'
+  # typeset -g POWERLEVEL9K_ASDF_GOLANG_SHOW_ON_UPGLOB='*.foo|*.bar'
+
+  # Node.js version from asdf.
+  typeset -g POWERLEVEL9K_ASDF_NODEJS_FOREGROUND=0
+  typeset -g POWERLEVEL9K_ASDF_NODEJS_BACKGROUND=2
+  # typeset -g POWERLEVEL9K_ASDF_NODEJS_VISUAL_IDENTIFIER_EXPANSION='⭐'
+  # typeset -g POWERLEVEL9K_ASDF_NODEJS_SHOW_ON_UPGLOB='*.foo|*.bar'
+
+  # Rust version from asdf.
+  typeset -g POWERLEVEL9K_ASDF_RUST_FOREGROUND=0
+  typeset -g POWERLEVEL9K_ASDF_RUST_BACKGROUND=208
+  # typeset -g POWERLEVEL9K_ASDF_RUST_VISUAL_IDENTIFIER_EXPANSION='⭐'
+  # typeset -g POWERLEVEL9K_ASDF_RUST_SHOW_ON_UPGLOB='*.foo|*.bar'
+
+  # .NET Core version from asdf.
+  typeset -g POWERLEVEL9K_ASDF_DOTNET_CORE_FOREGROUND=0
+  typeset -g POWERLEVEL9K_ASDF_DOTNET_CORE_BACKGROUND=5
+  # typeset -g POWERLEVEL9K_ASDF_DOTNET_CORE_VISUAL_IDENTIFIER_EXPANSION='⭐'
+  # typeset -g POWERLEVEL9K_ASDF_DOTNET_CORE_SHOW_ON_UPGLOB='*.foo|*.bar'
+
+  # Flutter version from asdf.
+  typeset -g POWERLEVEL9K_ASDF_FLUTTER_FOREGROUND=0
+  typeset -g POWERLEVEL9K_ASDF_FLUTTER_BACKGROUND=4
+  # typeset -g POWERLEVEL9K_ASDF_FLUTTER_VISUAL_IDENTIFIER_EXPANSION='⭐'
+  # typeset -g POWERLEVEL9K_ASDF_FLUTTER_SHOW_ON_UPGLOB='*.foo|*.bar'
+
+  # Lua version from asdf.
+  typeset -g POWERLEVEL9K_ASDF_LUA_FOREGROUND=0
+  typeset -g POWERLEVEL9K_ASDF_LUA_BACKGROUND=4
+  # typeset -g POWERLEVEL9K_ASDF_LUA_VISUAL_IDENTIFIER_EXPANSION='⭐'
+  # typeset -g POWERLEVEL9K_ASDF_LUA_SHOW_ON_UPGLOB='*.foo|*.bar'
+
+  # Java version from asdf.
+  typeset -g POWERLEVEL9K_ASDF_JAVA_FOREGROUND=1
+  typeset -g POWERLEVEL9K_ASDF_JAVA_BACKGROUND=7
+  # typeset -g POWERLEVEL9K_ASDF_JAVA_VISUAL_IDENTIFIER_EXPANSION='⭐'
+  # typeset -g POWERLEVEL9K_ASDF_JAVA_SHOW_ON_UPGLOB='*.foo|*.bar'
+
+  # Perl version from asdf.
+  typeset -g POWERLEVEL9K_ASDF_PERL_FOREGROUND=0
+  typeset -g POWERLEVEL9K_ASDF_PERL_BACKGROUND=4
+  # typeset -g POWERLEVEL9K_ASDF_PERL_VISUAL_IDENTIFIER_EXPANSION='⭐'
+  # typeset -g POWERLEVEL9K_ASDF_PERL_SHOW_ON_UPGLOB='*.foo|*.bar'
+
+  # Erlang version from asdf.
+  typeset -g POWERLEVEL9K_ASDF_ERLANG_FOREGROUND=0
+  typeset -g POWERLEVEL9K_ASDF_ERLANG_BACKGROUND=1
+  # typeset -g POWERLEVEL9K_ASDF_ERLANG_VISUAL_IDENTIFIER_EXPANSION='⭐'
+  # typeset -g POWERLEVEL9K_ASDF_ERLANG_SHOW_ON_UPGLOB='*.foo|*.bar'
+
+  # Elixir version from asdf.
+  typeset -g POWERLEVEL9K_ASDF_ELIXIR_FOREGROUND=0
+  typeset -g POWERLEVEL9K_ASDF_ELIXIR_BACKGROUND=5
+  # typeset -g POWERLEVEL9K_ASDF_ELIXIR_VISUAL_IDENTIFIER_EXPANSION='⭐'
+  # typeset -g POWERLEVEL9K_ASDF_ELIXIR_SHOW_ON_UPGLOB='*.foo|*.bar'
+
+  # Postgres version from asdf.
+  typeset -g POWERLEVEL9K_ASDF_POSTGRES_FOREGROUND=0
+  typeset -g POWERLEVEL9K_ASDF_POSTGRES_BACKGROUND=6
+  # typeset -g POWERLEVEL9K_ASDF_POSTGRES_VISUAL_IDENTIFIER_EXPANSION='⭐'
+  # typeset -g POWERLEVEL9K_ASDF_POSTGRES_SHOW_ON_UPGLOB='*.foo|*.bar'
+
+  # PHP version from asdf.
+  typeset -g POWERLEVEL9K_ASDF_PHP_FOREGROUND=0
+  typeset -g POWERLEVEL9K_ASDF_PHP_BACKGROUND=5
+  # typeset -g POWERLEVEL9K_ASDF_PHP_VISUAL_IDENTIFIER_EXPANSION='⭐'
+  # typeset -g POWERLEVEL9K_ASDF_PHP_SHOW_ON_UPGLOB='*.foo|*.bar'
+
+  # Haskell version from asdf.
+  typeset -g POWERLEVEL9K_ASDF_HASKELL_FOREGROUND=0
+  typeset -g POWERLEVEL9K_ASDF_HASKELL_BACKGROUND=3
+  # typeset -g POWERLEVEL9K_ASDF_HASKELL_VISUAL_IDENTIFIER_EXPANSION='⭐'
+  # typeset -g POWERLEVEL9K_ASDF_HASKELL_SHOW_ON_UPGLOB='*.foo|*.bar'
+
+  # Julia version from asdf.
+  typeset -g POWERLEVEL9K_ASDF_JULIA_FOREGROUND=0
+  typeset -g POWERLEVEL9K_ASDF_JULIA_BACKGROUND=2
+  # typeset -g POWERLEVEL9K_ASDF_JULIA_VISUAL_IDENTIFIER_EXPANSION='⭐'
+  # typeset -g POWERLEVEL9K_ASDF_JULIA_SHOW_ON_UPGLOB='*.foo|*.bar'
+
+  ##########[ nordvpn: nordvpn connection status, linux only (https://nordvpn.com/) ]###########
+  # NordVPN connection indicator color.
+  typeset -g POWERLEVEL9K_NORDVPN_FOREGROUND=7
+  typeset -g POWERLEVEL9K_NORDVPN_BACKGROUND=4
+  # Hide NordVPN connection indicator when not connected.
+  typeset -g POWERLEVEL9K_NORDVPN_{DISCONNECTED,CONNECTING,DISCONNECTING}_CONTENT_EXPANSION=
+  typeset -g POWERLEVEL9K_NORDVPN_{DISCONNECTED,CONNECTING,DISCONNECTING}_VISUAL_IDENTIFIER_EXPANSION=
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_NORDVPN_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  #################[ ranger: ranger shell (https://github.com/ranger/ranger) ]##################
+  # Ranger shell color.
+  typeset -g POWERLEVEL9K_RANGER_FOREGROUND=3
+  typeset -g POWERLEVEL9K_RANGER_BACKGROUND=0
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_RANGER_VISUAL_IDENTIFIER_EXPANSION='⭐'
+  
+  ####################[ yazi: yazi shell (https://github.com/sxyazi/yazi) ]#####################
+  # Yazi shell color.
+  typeset -g POWERLEVEL9K_YAZI_FOREGROUND=3
+  typeset -g POWERLEVEL9K_YAZI_BACKGROUND=0
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_YAZI_VISUAL_IDENTIFIER_EXPANSION='⭐'
+  
+  ######################[ nnn: nnn shell (https://github.com/jarun/nnn) ]#######################
+  # Nnn shell color.
+  typeset -g POWERLEVEL9K_NNN_FOREGROUND=0
+  typeset -g POWERLEVEL9K_NNN_BACKGROUND=6
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_NNN_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  ######################[ lf: lf shell (https://github.com/gokcehan/lf) ]#######################
+  # lf shell color.
+  typeset -g POWERLEVEL9K_LF_FOREGROUND=0
+  typeset -g POWERLEVEL9K_LF_BACKGROUND=6
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_LF_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  ##################[ xplr: xplr shell (https://github.com/sayanarijit/xplr) ]##################
+  # xplr shell color.
+  typeset -g POWERLEVEL9K_XPLR_FOREGROUND=0
+  typeset -g POWERLEVEL9K_XPLR_BACKGROUND=6
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_XPLR_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  ###########################[ vim_shell: vim shell indicator (:sh) ]###########################
+  # Vim shell indicator color.
+  typeset -g POWERLEVEL9K_VIM_SHELL_FOREGROUND=0
+  typeset -g POWERLEVEL9K_VIM_SHELL_BACKGROUND=2
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_VIM_SHELL_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  ######[ midnight_commander: midnight commander shell (https://midnight-commander.org/) ]######
+  # Midnight Commander shell color.
+  typeset -g POWERLEVEL9K_MIDNIGHT_COMMANDER_FOREGROUND=3
+  typeset -g POWERLEVEL9K_MIDNIGHT_COMMANDER_BACKGROUND=0
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_MIDNIGHT_COMMANDER_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  #[ nix_shell: nix shell (https://nixos.org/nixos/nix-pills/developing-with-nix-shell.html) ]##
+  # Nix shell color.
+  typeset -g POWERLEVEL9K_NIX_SHELL_FOREGROUND=0
+  typeset -g POWERLEVEL9K_NIX_SHELL_BACKGROUND=4
+
+  # Display the icon of nix_shell if PATH contains a subdirectory of /nix/store.
+  # typeset -g POWERLEVEL9K_NIX_SHELL_INFER_FROM_PATH=false
+
+  # Tip: If you want to see just the icon without "pure" and "impure", uncomment the next line.
+  # typeset -g POWERLEVEL9K_NIX_SHELL_CONTENT_EXPANSION=
+
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_NIX_SHELL_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  ##################[ chezmoi_shell: chezmoi shell (https://www.chezmoi.io/) ]##################
+  # chezmoi shell color.
+  typeset -g POWERLEVEL9K_CHEZMOI_SHELL_FOREGROUND=0
+  typeset -g POWERLEVEL9K_CHEZMOI_SHELL_BACKGROUND=4
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_CHEZMOI_SHELL_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  ##################################[ disk_usage: disk usage ]##################################
+  # Colors for different levels of disk usage.
+  typeset -g POWERLEVEL9K_DISK_USAGE_NORMAL_FOREGROUND=3
+  typeset -g POWERLEVEL9K_DISK_USAGE_NORMAL_BACKGROUND=0
+  typeset -g POWERLEVEL9K_DISK_USAGE_WARNING_FOREGROUND=0
+  typeset -g POWERLEVEL9K_DISK_USAGE_WARNING_BACKGROUND=3
+  typeset -g POWERLEVEL9K_DISK_USAGE_CRITICAL_FOREGROUND=7
+  typeset -g POWERLEVEL9K_DISK_USAGE_CRITICAL_BACKGROUND=1
+  # Thresholds for different levels of disk usage (percentage points).
+  typeset -g POWERLEVEL9K_DISK_USAGE_WARNING_LEVEL=90
+  typeset -g POWERLEVEL9K_DISK_USAGE_CRITICAL_LEVEL=95
+  # If set to true, hide disk usage when below $POWERLEVEL9K_DISK_USAGE_WARNING_LEVEL percent.
+  typeset -g POWERLEVEL9K_DISK_USAGE_ONLY_WARNING=false
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_DISK_USAGE_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  ###########[ vi_mode: vi mode (you don't need this if you've enabled prompt_char) ]###########
+  # Foreground color.
+  typeset -g POWERLEVEL9K_VI_MODE_FOREGROUND=0
+  # Text and color for normal (a.k.a. command) vi mode.
+  typeset -g POWERLEVEL9K_VI_COMMAND_MODE_STRING=NORMAL
+  typeset -g POWERLEVEL9K_VI_MODE_NORMAL_BACKGROUND=2
+  # Text and color for visual vi mode.
+  typeset -g POWERLEVEL9K_VI_VISUAL_MODE_STRING=VISUAL
+  typeset -g POWERLEVEL9K_VI_MODE_VISUAL_BACKGROUND=4
+  # Text and color for overtype (a.k.a. overwrite and replace) vi mode.
+  typeset -g POWERLEVEL9K_VI_OVERWRITE_MODE_STRING=OVERTYPE
+  typeset -g POWERLEVEL9K_VI_MODE_OVERWRITE_BACKGROUND=3
+  # Text and color for insert vi mode.
+  typeset -g POWERLEVEL9K_VI_INSERT_MODE_STRING=
+  typeset -g POWERLEVEL9K_VI_MODE_INSERT_FOREGROUND=8
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_VI_MODE_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  ######################################[ ram: free RAM ]#######################################
+  # RAM color.
+  typeset -g POWERLEVEL9K_RAM_FOREGROUND=0
+  typeset -g POWERLEVEL9K_RAM_BACKGROUND=3
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_RAM_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  #####################################[ swap: used swap ]######################################
+  # Swap color.
+  typeset -g POWERLEVEL9K_SWAP_FOREGROUND=0
+  typeset -g POWERLEVEL9K_SWAP_BACKGROUND=3
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_SWAP_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  ######################################[ load: CPU load ]######################################
+  # Show average CPU load over this many last minutes. Valid values are 1, 5 and 15.
+  typeset -g POWERLEVEL9K_LOAD_WHICH=5
+  # Load color when load is under 50%.
+  typeset -g POWERLEVEL9K_LOAD_NORMAL_FOREGROUND=0
+  typeset -g POWERLEVEL9K_LOAD_NORMAL_BACKGROUND=2
+  # Load color when load is between 50% and 70%.
+  typeset -g POWERLEVEL9K_LOAD_WARNING_FOREGROUND=0
+  typeset -g POWERLEVEL9K_LOAD_WARNING_BACKGROUND=3
+  # Load color when load is over 70%.
+  typeset -g POWERLEVEL9K_LOAD_CRITICAL_FOREGROUND=0
+  typeset -g POWERLEVEL9K_LOAD_CRITICAL_BACKGROUND=1
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_LOAD_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  ################[ todo: todo items (https://github.com/todotxt/todo.txt-cli) ]################
+  # Todo color.
+  typeset -g POWERLEVEL9K_TODO_FOREGROUND=0
+  typeset -g POWERLEVEL9K_TODO_BACKGROUND=8
+  # Hide todo when the total number of tasks is zero.
+  typeset -g POWERLEVEL9K_TODO_HIDE_ZERO_TOTAL=true
+  # Hide todo when the number of tasks after filtering is zero.
+  typeset -g POWERLEVEL9K_TODO_HIDE_ZERO_FILTERED=false
+
+  # Todo format. The following parameters are available within the expansion.
+  #
+  # - P9K_TODO_TOTAL_TASK_COUNT     The total number of tasks.
+  # - P9K_TODO_FILTERED_TASK_COUNT  The number of tasks after filtering.
+  #
+  # These variables correspond to the last line of the output of `todo.sh -p ls`:
+  #
+  #   TODO: 24 of 42 tasks shown
+  #
+  # Here 24 is P9K_TODO_FILTERED_TASK_COUNT and 42 is P9K_TODO_TOTAL_TASK_COUNT.
+  #
+  # typeset -g POWERLEVEL9K_TODO_CONTENT_EXPANSION='$P9K_TODO_FILTERED_TASK_COUNT'
+
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_TODO_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  ###########[ timewarrior: timewarrior tracking status (https://timewarrior.net/) ]############
+  # Timewarrior color.
+  typeset -g POWERLEVEL9K_TIMEWARRIOR_FOREGROUND=255
+  typeset -g POWERLEVEL9K_TIMEWARRIOR_BACKGROUND=8
+
+  # If the tracked task is longer than 24 characters, truncate and append "…".
+  # Tip: To always display tasks without truncation, delete the following parameter.
+  # Tip: To hide task names and display just the icon when time tracking is enabled, set the
+  # value of the following parameter to "".
+  typeset -g POWERLEVEL9K_TIMEWARRIOR_CONTENT_EXPANSION='${P9K_CONTENT:0:24}${${P9K_CONTENT:24}:+…}'
+
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_TIMEWARRIOR_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  ##############[ taskwarrior: taskwarrior task count (https://taskwarrior.org/) ]##############
+  # Taskwarrior color.
+  typeset -g POWERLEVEL9K_TASKWARRIOR_FOREGROUND=0
+  typeset -g POWERLEVEL9K_TASKWARRIOR_BACKGROUND=6
+
+  # Taskwarrior segment format. The following parameters are available within the expansion.
+  #
+  # - P9K_TASKWARRIOR_PENDING_COUNT   The number of pending tasks: `task +PENDING count`.
+  # - P9K_TASKWARRIOR_OVERDUE_COUNT   The number of overdue tasks: `task +OVERDUE count`.
+  #
+  # Zero values are represented as empty parameters.
+  #
+  # The default format:
+  #
+  #   '${P9K_TASKWARRIOR_OVERDUE_COUNT:+"!$P9K_TASKWARRIOR_OVERDUE_COUNT/"}$P9K_TASKWARRIOR_PENDING_COUNT'
+  #
+  # typeset -g POWERLEVEL9K_TASKWARRIOR_CONTENT_EXPANSION='$P9K_TASKWARRIOR_PENDING_COUNT'
+
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_TASKWARRIOR_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  ######[ per_directory_history: Oh My Zsh per-directory-history local/global indicator ]#######
+  # Color when using local/global history.
+  typeset -g POWERLEVEL9K_PER_DIRECTORY_HISTORY_LOCAL_FOREGROUND=0
+  typeset -g POWERLEVEL9K_PER_DIRECTORY_HISTORY_LOCAL_BACKGROUND=5
+  typeset -g POWERLEVEL9K_PER_DIRECTORY_HISTORY_GLOBAL_FOREGROUND=0
+  typeset -g POWERLEVEL9K_PER_DIRECTORY_HISTORY_GLOBAL_BACKGROUND=3
+
+  # Tip: Uncomment the next two lines to hide "local"/"global" text and leave just the icon.
+  # typeset -g POWERLEVEL9K_PER_DIRECTORY_HISTORY_LOCAL_CONTENT_EXPANSION=''
+  # typeset -g POWERLEVEL9K_PER_DIRECTORY_HISTORY_GLOBAL_CONTENT_EXPANSION=''
+
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_PER_DIRECTORY_HISTORY_LOCAL_VISUAL_IDENTIFIER_EXPANSION='⭐'
+  # typeset -g POWERLEVEL9K_PER_DIRECTORY_HISTORY_GLOBAL_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  ################################[ cpu_arch: CPU architecture ]################################
+  # CPU architecture color.
+  typeset -g POWERLEVEL9K_CPU_ARCH_FOREGROUND=0
+  typeset -g POWERLEVEL9K_CPU_ARCH_BACKGROUND=3
+
+  # Hide the segment when on a specific CPU architecture.
+  # typeset -g POWERLEVEL9K_CPU_ARCH_X86_64_CONTENT_EXPANSION=
+  # typeset -g POWERLEVEL9K_CPU_ARCH_X86_64_VISUAL_IDENTIFIER_EXPANSION=
+
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_CPU_ARCH_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  ##################################[ context: user@hostname ]##################################
+  # Context color when running with privileges.
+  typeset -g POWERLEVEL9K_CONTEXT_ROOT_FOREGROUND=1
+  typeset -g POWERLEVEL9K_CONTEXT_ROOT_BACKGROUND=0
+  # Context color in SSH without privileges.
+  typeset -g POWERLEVEL9K_CONTEXT_{REMOTE,REMOTE_SUDO}_FOREGROUND=3
+  typeset -g POWERLEVEL9K_CONTEXT_{REMOTE,REMOTE_SUDO}_BACKGROUND=0
+  # Default context color (no privileges, no SSH).
+  typeset -g POWERLEVEL9K_CONTEXT_FOREGROUND=3
+  typeset -g POWERLEVEL9K_CONTEXT_BACKGROUND=0
+
+  # Context format when running with privileges: user@hostname.
+  typeset -g POWERLEVEL9K_CONTEXT_ROOT_TEMPLATE='%n@%m'
+  # Context format when in SSH without privileges: user@hostname.
+  typeset -g POWERLEVEL9K_CONTEXT_{REMOTE,REMOTE_SUDO}_TEMPLATE='%n@%m'
+  # Default context format (no privileges, no SSH): user@hostname.
+  typeset -g POWERLEVEL9K_CONTEXT_TEMPLATE='%n@%m'
+
+  # Don't show context unless running with privileges or in SSH.
+  # Tip: Remove the next line to always show context.
+  typeset -g POWERLEVEL9K_CONTEXT_{DEFAULT,SUDO}_{CONTENT,VISUAL_IDENTIFIER}_EXPANSION=
+
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_CONTEXT_VISUAL_IDENTIFIER_EXPANSION='⭐'
+  # Custom prefix.
+  # typeset -g POWERLEVEL9K_CONTEXT_PREFIX='with '
+
+  ###[ virtualenv: python virtual environment (https://docs.python.org/3/library/venv.html) ]###
+  # Python virtual environment color.
+  typeset -g POWERLEVEL9K_VIRTUALENV_FOREGROUND=0
+  typeset -g POWERLEVEL9K_VIRTUALENV_BACKGROUND=4
+  # Don't show Python version next to the virtual environment name.
+  typeset -g POWERLEVEL9K_VIRTUALENV_SHOW_PYTHON_VERSION=false
+  # If set to "false", won't show virtualenv if pyenv is already shown.
+  # If set to "if-different", won't show virtualenv if it's the same as pyenv.
+  typeset -g POWERLEVEL9K_VIRTUALENV_SHOW_WITH_PYENV=false
+  # Separate environment name from Python version only with a space.
+  typeset -g POWERLEVEL9K_VIRTUALENV_{LEFT,RIGHT}_DELIMITER=
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_VIRTUALENV_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  #####################[ anaconda: conda environment (https://conda.io/) ]######################
+  # Anaconda environment color.
+  typeset -g POWERLEVEL9K_ANACONDA_FOREGROUND=0
+  typeset -g POWERLEVEL9K_ANACONDA_BACKGROUND=4
+
+  # Anaconda segment format. The following parameters are available within the expansion.
+  #
+  # - CONDA_PREFIX                 Absolute path to the active Anaconda/Miniconda environment.
+  # - CONDA_DEFAULT_ENV            Name of the active Anaconda/Miniconda environment.
+  # - CONDA_PROMPT_MODIFIER        Configurable prompt modifier (see below).
+  # - P9K_ANACONDA_PYTHON_VERSION  Current python version (python --version).
+  #
+  # CONDA_PROMPT_MODIFIER can be configured with the following command:
+  #
+  #   conda config --set env_prompt '({default_env}) '
+  #
+  # The last argument is a Python format string that can use the following variables:
+  #
+  # - prefix       The same as CONDA_PREFIX.
+  # - default_env  The same as CONDA_DEFAULT_ENV.
+  # - name         The last segment of CONDA_PREFIX.
+  # - stacked_env  Comma-separated list of names in the environment stack. The first element is
+  #                always the same as default_env.
+  #
+  # Note: '({default_env}) ' is the default value of env_prompt.
+  #
+  # The default value of POWERLEVEL9K_ANACONDA_CONTENT_EXPANSION expands to $CONDA_PROMPT_MODIFIER
+  # without the surrounding parentheses, or to the last path component of CONDA_PREFIX if the former
+  # is empty.
+  typeset -g POWERLEVEL9K_ANACONDA_CONTENT_EXPANSION='${${${${CONDA_PROMPT_MODIFIER#\(}% }%\)}:-${CONDA_PREFIX:t}}'
+
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_ANACONDA_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  ################[ pyenv: python environment (https://github.com/pyenv/pyenv) ]################
+  # Pyenv color.
+  typeset -g POWERLEVEL9K_PYENV_FOREGROUND=0
+  typeset -g POWERLEVEL9K_PYENV_BACKGROUND=4
+  # Hide python version if it doesn't come from one of these sources.
+  typeset -g POWERLEVEL9K_PYENV_SOURCES=(shell local global)
+  # If set to false, hide python version if it's the same as global:
+  # $(pyenv version-name) == $(pyenv global).
+  typeset -g POWERLEVEL9K_PYENV_PROMPT_ALWAYS_SHOW=false
+  # If set to false, hide python version if it's equal to "system".
+  typeset -g POWERLEVEL9K_PYENV_SHOW_SYSTEM=true
+
+  # Pyenv segment format. The following parameters are available within the expansion.
+  #
+  # - P9K_CONTENT                Current pyenv environment (pyenv version-name).
+  # - P9K_PYENV_PYTHON_VERSION   Current python version (python --version).
+  #
+  # The default format has the following logic:
+  #
+  # 1. Display just "$P9K_CONTENT" if it's equal to "$P9K_PYENV_PYTHON_VERSION" or
+  #    starts with "$P9K_PYENV_PYTHON_VERSION/".
+  # 2. Otherwise display "$P9K_CONTENT $P9K_PYENV_PYTHON_VERSION".
+  typeset -g POWERLEVEL9K_PYENV_CONTENT_EXPANSION='${P9K_CONTENT}${${P9K_CONTENT:#$P9K_PYENV_PYTHON_VERSION(|/*)}:+ $P9K_PYENV_PYTHON_VERSION}'
+
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_PYENV_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  ################[ goenv: go environment (https://github.com/syndbg/goenv) ]################
+  # Goenv color.
+  typeset -g POWERLEVEL9K_GOENV_FOREGROUND=0
+  typeset -g POWERLEVEL9K_GOENV_BACKGROUND=4
+  # Hide go version if it doesn't come from one of these sources.
+  typeset -g POWERLEVEL9K_GOENV_SOURCES=(shell local global)
+  # If set to false, hide go version if it's the same as global:
+  # $(goenv version-name) == $(goenv global).
+  typeset -g POWERLEVEL9K_GOENV_PROMPT_ALWAYS_SHOW=false
+  # If set to false, hide go version if it's equal to "system".
+  typeset -g POWERLEVEL9K_GOENV_SHOW_SYSTEM=true
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_GOENV_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  ##########[ nodenv: node.js version from nodenv (https://github.com/nodenv/nodenv) ]##########
+  # Nodenv color.
+  typeset -g POWERLEVEL9K_NODENV_FOREGROUND=2
+  typeset -g POWERLEVEL9K_NODENV_BACKGROUND=0
+  # Hide node version if it doesn't come from one of these sources.
+  typeset -g POWERLEVEL9K_NODENV_SOURCES=(shell local global)
+  # If set to false, hide node version if it's the same as global:
+  # $(nodenv version-name) == $(nodenv global).
+  typeset -g POWERLEVEL9K_NODENV_PROMPT_ALWAYS_SHOW=false
+  # If set to false, hide node version if it's equal to "system".
+  typeset -g POWERLEVEL9K_NODENV_SHOW_SYSTEM=true
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_NODENV_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  ##############[ nvm: node.js version from nvm (https://github.com/nvm-sh/nvm) ]###############
+  # Nvm color.
+  typeset -g POWERLEVEL9K_NVM_FOREGROUND=0
+  typeset -g POWERLEVEL9K_NVM_BACKGROUND=5
+  # If set to false, hide node version if it's the same as default:
+  # $(nvm version current) == $(nvm version default).
+  typeset -g POWERLEVEL9K_NVM_PROMPT_ALWAYS_SHOW=false
+  # If set to false, hide node version if it's equal to "system".
+  typeset -g POWERLEVEL9K_NVM_SHOW_SYSTEM=true
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_NVM_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  ############[ nodeenv: node.js environment (https://github.com/ekalinin/nodeenv) ]############
+  # Nodeenv color.
+  typeset -g POWERLEVEL9K_NODEENV_FOREGROUND=2
+  typeset -g POWERLEVEL9K_NODEENV_BACKGROUND=0
+  # Don't show Node version next to the environment name.
+  typeset -g POWERLEVEL9K_NODEENV_SHOW_NODE_VERSION=false
+  # Separate environment name from Node version only with a space.
+  typeset -g POWERLEVEL9K_NODEENV_{LEFT,RIGHT}_DELIMITER=
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_NODEENV_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  ##############################[ node_version: node.js version ]###############################
+  # Node version color.
+  typeset -g POWERLEVEL9K_NODE_VERSION_FOREGROUND=7
+  typeset -g POWERLEVEL9K_NODE_VERSION_BACKGROUND=2
+  # Show node version only when in a directory tree containing package.json.
+  typeset -g POWERLEVEL9K_NODE_VERSION_PROJECT_ONLY=true
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_NODE_VERSION_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  #######################[ go_version: go version (https://golang.org) ]########################
+  # Go version color.
+  typeset -g POWERLEVEL9K_GO_VERSION_FOREGROUND=255
+  typeset -g POWERLEVEL9K_GO_VERSION_BACKGROUND=2
+  # Show go version only when in a go project subdirectory.
+  typeset -g POWERLEVEL9K_GO_VERSION_PROJECT_ONLY=true
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_GO_VERSION_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  #################[ rust_version: rustc version (https://www.rust-lang.org) ]##################
+  # Rust version color.
+  typeset -g POWERLEVEL9K_RUST_VERSION_FOREGROUND=0
+  typeset -g POWERLEVEL9K_RUST_VERSION_BACKGROUND=208
+  # Show rust version only when in a rust project subdirectory.
+  typeset -g POWERLEVEL9K_RUST_VERSION_PROJECT_ONLY=true
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_RUST_VERSION_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  ###############[ dotnet_version: .NET version (https://dotnet.microsoft.com) ]################
+  # .NET version color.
+  typeset -g POWERLEVEL9K_DOTNET_VERSION_FOREGROUND=7
+  typeset -g POWERLEVEL9K_DOTNET_VERSION_BACKGROUND=5
+  # Show .NET version only when in a .NET project subdirectory.
+  typeset -g POWERLEVEL9K_DOTNET_VERSION_PROJECT_ONLY=true
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_DOTNET_VERSION_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  #####################[ php_version: php version (https://www.php.net/) ]######################
+  # PHP version color.
+  typeset -g POWERLEVEL9K_PHP_VERSION_FOREGROUND=0
+  typeset -g POWERLEVEL9K_PHP_VERSION_BACKGROUND=5
+  # Show PHP version only when in a PHP project subdirectory.
+  typeset -g POWERLEVEL9K_PHP_VERSION_PROJECT_ONLY=true
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_PHP_VERSION_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  ##########[ laravel_version: laravel php framework version (https://laravel.com/) ]###########
+  # Laravel version color.
+  typeset -g POWERLEVEL9K_LARAVEL_VERSION_FOREGROUND=1
+  typeset -g POWERLEVEL9K_LARAVEL_VERSION_BACKGROUND=7
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_LARAVEL_VERSION_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  #############[ rbenv: ruby version from rbenv (https://github.com/rbenv/rbenv) ]##############
+  # Rbenv color.
+  typeset -g POWERLEVEL9K_RBENV_FOREGROUND=0
+  typeset -g POWERLEVEL9K_RBENV_BACKGROUND=1
+  # Hide ruby version if it doesn't come from one of these sources.
+  typeset -g POWERLEVEL9K_RBENV_SOURCES=(shell local global)
+  # If set to false, hide ruby version if it's the same as global:
+  # $(rbenv version-name) == $(rbenv global).
+  typeset -g POWERLEVEL9K_RBENV_PROMPT_ALWAYS_SHOW=false
+  # If set to false, hide ruby version if it's equal to "system".
+  typeset -g POWERLEVEL9K_RBENV_SHOW_SYSTEM=true
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_RBENV_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  ####################[ java_version: java version (https://www.java.com/) ]####################
+  # Java version color.
+  typeset -g POWERLEVEL9K_JAVA_VERSION_FOREGROUND=1
+  typeset -g POWERLEVEL9K_JAVA_VERSION_BACKGROUND=7
+  # Show java version only when in a java project subdirectory.
+  typeset -g POWERLEVEL9K_JAVA_VERSION_PROJECT_ONLY=true
+  # Show brief version.
+  typeset -g POWERLEVEL9K_JAVA_VERSION_FULL=false
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_JAVA_VERSION_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  ###[ package: name@version from package.json (https://docs.npmjs.com/files/package.json) ]####
+  # Package color.
+  typeset -g POWERLEVEL9K_PACKAGE_FOREGROUND=0
+  typeset -g POWERLEVEL9K_PACKAGE_BACKGROUND=6
+
+  # Package format. The following parameters are available within the expansion.
+  #
+  # - P9K_PACKAGE_NAME     The value of `name` field in package.json.
+  # - P9K_PACKAGE_VERSION  The value of `version` field in package.json.
+  #
+  # typeset -g POWERLEVEL9K_PACKAGE_CONTENT_EXPANSION='${P9K_PACKAGE_NAME//\%/%%}@${P9K_PACKAGE_VERSION//\%/%%}'
+
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_PACKAGE_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  #######################[ rvm: ruby version from rvm (https://rvm.io) ]########################
+  # Rvm color.
+  typeset -g POWERLEVEL9K_RVM_FOREGROUND=0
+  typeset -g POWERLEVEL9K_RVM_BACKGROUND=240
+  # Don't show @gemset at the end.
+  typeset -g POWERLEVEL9K_RVM_SHOW_GEMSET=false
+  # Don't show ruby- at the front.
+  typeset -g POWERLEVEL9K_RVM_SHOW_PREFIX=false
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_RVM_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  ###########[ fvm: flutter version management (https://github.com/leoafarias/fvm) ]############
+  # Fvm color.
+  typeset -g POWERLEVEL9K_FVM_FOREGROUND=0
+  typeset -g POWERLEVEL9K_FVM_BACKGROUND=4
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_FVM_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  ##########[ luaenv: lua version from luaenv (https://github.com/cehoffman/luaenv) ]###########
+  # Lua color.
+  typeset -g POWERLEVEL9K_LUAENV_FOREGROUND=0
+  typeset -g POWERLEVEL9K_LUAENV_BACKGROUND=4
+  # Hide lua version if it doesn't come from one of these sources.
+  typeset -g POWERLEVEL9K_LUAENV_SOURCES=(shell local global)
+  # If set to false, hide lua version if it's the same as global:
+  # $(luaenv version-name) == $(luaenv global).
+  typeset -g POWERLEVEL9K_LUAENV_PROMPT_ALWAYS_SHOW=false
+  # If set to false, hide lua version if it's equal to "system".
+  typeset -g POWERLEVEL9K_LUAENV_SHOW_SYSTEM=true
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_LUAENV_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  ###############[ jenv: java version from jenv (https://github.com/jenv/jenv) ]################
+  # Java color.
+  typeset -g POWERLEVEL9K_JENV_FOREGROUND=1
+  typeset -g POWERLEVEL9K_JENV_BACKGROUND=7
+  # Hide java version if it doesn't come from one of these sources.
+  typeset -g POWERLEVEL9K_JENV_SOURCES=(shell local global)
+  # If set to false, hide java version if it's the same as global:
+  # $(jenv version-name) == $(jenv global).
+  typeset -g POWERLEVEL9K_JENV_PROMPT_ALWAYS_SHOW=false
+  # If set to false, hide java version if it's equal to "system".
+  typeset -g POWERLEVEL9K_JENV_SHOW_SYSTEM=true
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_JENV_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  ###########[ plenv: perl version from plenv (https://github.com/tokuhirom/plenv) ]############
+  # Perl color.
+  typeset -g POWERLEVEL9K_PLENV_FOREGROUND=0
+  typeset -g POWERLEVEL9K_PLENV_BACKGROUND=4
+  # Hide perl version if it doesn't come from one of these sources.
+  typeset -g POWERLEVEL9K_PLENV_SOURCES=(shell local global)
+  # If set to false, hide perl version if it's the same as global:
+  # $(plenv version-name) == $(plenv global).
+  typeset -g POWERLEVEL9K_PLENV_PROMPT_ALWAYS_SHOW=false
+  # If set to false, hide perl version if it's equal to "system".
+  typeset -g POWERLEVEL9K_PLENV_SHOW_SYSTEM=true
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_PLENV_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  ###########[ perlbrew: perl version from perlbrew (https://github.com/gugod/App-perlbrew) ]############
+  # Perlbrew color.
+  typeset -g POWERLEVEL9K_PERLBREW_FOREGROUND=67
+  # Show perlbrew version only when in a perl project subdirectory.
+  typeset -g POWERLEVEL9K_PERLBREW_PROJECT_ONLY=true
+  # Don't show "perl-" at the front.
+  typeset -g POWERLEVEL9K_PERLBREW_SHOW_PREFIX=false
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_PERLBREW_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  ############[ phpenv: php version from phpenv (https://github.com/phpenv/phpenv) ]############
+  # PHP color.
+  typeset -g POWERLEVEL9K_PHPENV_FOREGROUND=0
+  typeset -g POWERLEVEL9K_PHPENV_BACKGROUND=5
+  # Hide php version if it doesn't come from one of these sources.
+  typeset -g POWERLEVEL9K_PHPENV_SOURCES=(shell local global)
+  # If set to false, hide php version if it's the same as global:
+  # $(phpenv version-name) == $(phpenv global).
+  typeset -g POWERLEVEL9K_PHPENV_PROMPT_ALWAYS_SHOW=false
+  # If set to false, hide PHP version if it's equal to "system".
+  typeset -g POWERLEVEL9K_PHPENV_SHOW_SYSTEM=true
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_PHPENV_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  #######[ scalaenv: scala version from scalaenv (https://github.com/scalaenv/scalaenv) ]#######
+  # Scala color.
+  typeset -g POWERLEVEL9K_SCALAENV_FOREGROUND=0
+  typeset -g POWERLEVEL9K_SCALAENV_BACKGROUND=1
+  # Hide scala version if it doesn't come from one of these sources.
+  typeset -g POWERLEVEL9K_SCALAENV_SOURCES=(shell local global)
+  # If set to false, hide scala version if it's the same as global:
+  # $(scalaenv version-name) == $(scalaenv global).
+  typeset -g POWERLEVEL9K_SCALAENV_PROMPT_ALWAYS_SHOW=false
+  # If set to false, hide scala version if it's equal to "system".
+  typeset -g POWERLEVEL9K_SCALAENV_SHOW_SYSTEM=true
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_SCALAENV_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  ##########[ haskell_stack: haskell version from stack (https://haskellstack.org/) ]###########
+  # Haskell color.
+  typeset -g POWERLEVEL9K_HASKELL_STACK_FOREGROUND=0
+  typeset -g POWERLEVEL9K_HASKELL_STACK_BACKGROUND=3
+
+  # Hide haskell version if it doesn't come from one of these sources.
+  #
+  #   shell:  version is set by STACK_YAML
+  #   local:  version is set by stack.yaml up the directory tree
+  #   global: version is set by the implicit global project (~/.stack/global-project/stack.yaml)
+  typeset -g POWERLEVEL9K_HASKELL_STACK_SOURCES=(shell local)
+  # If set to false, hide haskell version if it's the same as in the implicit global project.
+  typeset -g POWERLEVEL9K_HASKELL_STACK_ALWAYS_SHOW=true
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_HASKELL_STACK_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  ################[ terraform: terraform workspace (https://www.terraform.io) ]#################
+  # Don't show terraform workspace if it's literally "default".
+  typeset -g POWERLEVEL9K_TERRAFORM_SHOW_DEFAULT=false
+  # POWERLEVEL9K_TERRAFORM_CLASSES is an array with even number of elements. The first element
+  # in each pair defines a pattern against which the current terraform workspace gets matched.
+  # More specifically, it's P9K_CONTENT prior to the application of context expansion (see below)
+  # that gets matched. If you unset all POWERLEVEL9K_TERRAFORM_*CONTENT_EXPANSION parameters,
+  # you'll see this value in your prompt. The second element of each pair in
+  # POWERLEVEL9K_TERRAFORM_CLASSES defines the workspace class. Patterns are tried in order. The
+  # first match wins.
+  #
+  # For example, given these settings:
+  #
+  #   typeset -g POWERLEVEL9K_TERRAFORM_CLASSES=(
+  #     '*prod*'  PROD
+  #     '*test*'  TEST
+  #     '*'       OTHER)
+  #
+  # If your current terraform workspace is "project_test", its class is TEST because "project_test"
+  # doesn't match the pattern '*prod*' but does match '*test*'.
+  #
+  # You can define different colors, icons and content expansions for different classes:
+  #
+  #   typeset -g POWERLEVEL9K_TERRAFORM_TEST_FOREGROUND=2
+  #   typeset -g POWERLEVEL9K_TERRAFORM_TEST_BACKGROUND=0
+  #   typeset -g POWERLEVEL9K_TERRAFORM_TEST_VISUAL_IDENTIFIER_EXPANSION='⭐'
+  #   typeset -g POWERLEVEL9K_TERRAFORM_TEST_CONTENT_EXPANSION='> ${P9K_CONTENT} <'
+  typeset -g POWERLEVEL9K_TERRAFORM_CLASSES=(
+      # '*prod*'  PROD    # These values are examples that are unlikely
+      # '*test*'  TEST    # to match your needs. Customize them as needed.
+      '*'         OTHER)
+  typeset -g POWERLEVEL9K_TERRAFORM_OTHER_FOREGROUND=4
+  typeset -g POWERLEVEL9K_TERRAFORM_OTHER_BACKGROUND=0
+  # typeset -g POWERLEVEL9K_TERRAFORM_OTHER_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  #############[ terraform_version: terraform version (https://www.terraform.io) ]##############
+  # Terraform version color.
+  typeset -g POWERLEVEL9K_TERRAFORM_VERSION_FOREGROUND=4
+  typeset -g POWERLEVEL9K_TERRAFORM_VERSION_BACKGROUND=0
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_TERRAFORM_VERSION_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  #############[ kubecontext: current kubernetes context (https://kubernetes.io/) ]#############
+  # Show kubecontext only when the command you are typing invokes one of these tools.
+  # Tip: Remove the next line to always show kubecontext.
+  typeset -g POWERLEVEL9K_KUBECONTEXT_SHOW_ON_COMMAND='kubectl|helm|kubens|kubectx|oc|istioctl|kogito|k9s|helmfile|flux|fluxctl|stern|kubeseal|skaffold|kubent|kubecolor|cmctl|sparkctl'
+
+  # Kubernetes context classes for the purpose of using different colors, icons and expansions with
+  # different contexts.
+  #
+  # POWERLEVEL9K_KUBECONTEXT_CLASSES is an array with even number of elements. The first element
+  # in each pair defines a pattern against which the current kubernetes context gets matched.
+  # More specifically, it's P9K_CONTENT prior to the application of context expansion (see below)
+  # that gets matched. If you unset all POWERLEVEL9K_KUBECONTEXT_*CONTENT_EXPANSION parameters,
+  # you'll see this value in your prompt. The second element of each pair in
+  # POWERLEVEL9K_KUBECONTEXT_CLASSES defines the context class. Patterns are tried in order. The
+  # first match wins.
+  #
+  # For example, given these settings:
+  #
+  #   typeset -g POWERLEVEL9K_KUBECONTEXT_CLASSES=(
+  #     '*prod*'  PROD
+  #     '*test*'  TEST
+  #     '*'       DEFAULT)
+  #
+  # If your current kubernetes context is "deathray-testing/default", its class is TEST
+  # because "deathray-testing/default" doesn't match the pattern '*prod*' but does match '*test*'.
+  #
+  # You can define different colors, icons and content expansions for different classes:
+  #
+  #   typeset -g POWERLEVEL9K_KUBECONTEXT_TEST_FOREGROUND=0
+  #   typeset -g POWERLEVEL9K_KUBECONTEXT_TEST_BACKGROUND=2
+  #   typeset -g POWERLEVEL9K_KUBECONTEXT_TEST_VISUAL_IDENTIFIER_EXPANSION='⭐'
+  #   typeset -g POWERLEVEL9K_KUBECONTEXT_TEST_CONTENT_EXPANSION='> ${P9K_CONTENT} <'
+  typeset -g POWERLEVEL9K_KUBECONTEXT_CLASSES=(
+      # '*prod*'  PROD    # These values are examples that are unlikely
+      # '*test*'  TEST    # to match your needs. Customize them as needed.
+      '*'       DEFAULT)
+  typeset -g POWERLEVEL9K_KUBECONTEXT_DEFAULT_FOREGROUND=7
+  typeset -g POWERLEVEL9K_KUBECONTEXT_DEFAULT_BACKGROUND=5
+  # typeset -g POWERLEVEL9K_KUBECONTEXT_DEFAULT_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  # Use POWERLEVEL9K_KUBECONTEXT_CONTENT_EXPANSION to specify the content displayed by kubecontext
+  # segment. Parameter expansions are very flexible and fast, too. See reference:
+  # http://zsh.sourceforge.net/Doc/Release/Expansion.html#Parameter-Expansion.
+  #
+  # Within the expansion the following parameters are always available:
+  #
+  # - P9K_CONTENT                The content that would've been displayed if there was no content
+  #                              expansion defined.
+  # - P9K_KUBECONTEXT_NAME       The current context's name. Corresponds to column NAME in the
+  #                              output of `kubectl config get-contexts`.
+  # - P9K_KUBECONTEXT_CLUSTER    The current context's cluster. Corresponds to column CLUSTER in the
+  #                              output of `kubectl config get-contexts`.
+  # - P9K_KUBECONTEXT_NAMESPACE  The current context's namespace. Corresponds to column NAMESPACE
+  #                              in the output of `kubectl config get-contexts`. If there is no
+  #                              namespace, the parameter is set to "default".
+  # - P9K_KUBECONTEXT_USER       The current context's user. Corresponds to column AUTHINFO in the
+  #                              output of `kubectl config get-contexts`.
+  #
+  # If the context points to Google Kubernetes Engine (GKE) or Elastic Kubernetes Service (EKS),
+  # the following extra parameters are available:
+  #
+  # - P9K_KUBECONTEXT_CLOUD_NAME     Either "gke" or "eks".
+  # - P9K_KUBECONTEXT_CLOUD_ACCOUNT  Account/project ID.
+  # - P9K_KUBECONTEXT_CLOUD_ZONE     Availability zone.
+  # - P9K_KUBECONTEXT_CLOUD_CLUSTER  Cluster.
+  #
+  # P9K_KUBECONTEXT_CLOUD_* parameters are derived from P9K_KUBECONTEXT_CLUSTER. For example,
+  # if P9K_KUBECONTEXT_CLUSTER is "gke_my-account_us-east1-a_my-cluster-01":
+  #
+  #   - P9K_KUBECONTEXT_CLOUD_NAME=gke
+  #   - P9K_KUBECONTEXT_CLOUD_ACCOUNT=my-account
+  #   - P9K_KUBECONTEXT_CLOUD_ZONE=us-east1-a
+  #   - P9K_KUBECONTEXT_CLOUD_CLUSTER=my-cluster-01
+  #
+  # If P9K_KUBECONTEXT_CLUSTER is "arn:aws:eks:us-east-1:123456789012:cluster/my-cluster-01":
+  #
+  #   - P9K_KUBECONTEXT_CLOUD_NAME=eks
+  #   - P9K_KUBECONTEXT_CLOUD_ACCOUNT=123456789012
+  #   - P9K_KUBECONTEXT_CLOUD_ZONE=us-east-1
+  #   - P9K_KUBECONTEXT_CLOUD_CLUSTER=my-cluster-01
+  typeset -g POWERLEVEL9K_KUBECONTEXT_DEFAULT_CONTENT_EXPANSION=
+  # Show P9K_KUBECONTEXT_CLOUD_CLUSTER if it's not empty and fall back to P9K_KUBECONTEXT_NAME.
+  POWERLEVEL9K_KUBECONTEXT_DEFAULT_CONTENT_EXPANSION+='${P9K_KUBECONTEXT_CLOUD_CLUSTER:-${P9K_KUBECONTEXT_NAME}}'
+  # Append the current context's namespace if it's not "default".
+  POWERLEVEL9K_KUBECONTEXT_DEFAULT_CONTENT_EXPANSION+='${${:-/$P9K_KUBECONTEXT_NAMESPACE}:#/default}'
+
+  # Custom prefix.
+  # typeset -g POWERLEVEL9K_KUBECONTEXT_PREFIX='at '
+
+  #[ aws: aws profile (https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-profiles.html) ]#
+  # Show aws only when the command you are typing invokes one of these tools.
+  # Tip: Remove the next line to always show aws.
+  typeset -g POWERLEVEL9K_AWS_SHOW_ON_COMMAND='aws|awless|cdk|terraform|tofu|pulumi|terragrunt'
+
+  # POWERLEVEL9K_AWS_CLASSES is an array with even number of elements. The first element
+  # in each pair defines a pattern against which the current AWS profile gets matched.
+  # More specifically, it's P9K_CONTENT prior to the application of context expansion (see below)
+  # that gets matched. If you unset all POWERLEVEL9K_AWS_*CONTENT_EXPANSION parameters,
+  # you'll see this value in your prompt. The second element of each pair in
+  # POWERLEVEL9K_AWS_CLASSES defines the profile class. Patterns are tried in order. The
+  # first match wins.
+  #
+  # For example, given these settings:
+  #
+  #   typeset -g POWERLEVEL9K_AWS_CLASSES=(
+  #     '*prod*'  PROD
+  #     '*test*'  TEST
+  #     '*'       DEFAULT)
+  #
+  # If your current AWS profile is "company_test", its class is TEST
+  # because "company_test" doesn't match the pattern '*prod*' but does match '*test*'.
+  #
+  # You can define different colors, icons and content expansions for different classes:
+  #
+  #   typeset -g POWERLEVEL9K_AWS_TEST_FOREGROUND=28
+  #   typeset -g POWERLEVEL9K_AWS_TEST_VISUAL_IDENTIFIER_EXPANSION='⭐'
+  #   typeset -g POWERLEVEL9K_AWS_TEST_CONTENT_EXPANSION='> ${P9K_CONTENT} <'
+  typeset -g POWERLEVEL9K_AWS_CLASSES=(
+      # '*prod*'  PROD    # These values are examples that are unlikely
+      # '*test*'  TEST    # to match your needs. Customize them as needed.
+      '*'       DEFAULT)
+  typeset -g POWERLEVEL9K_AWS_DEFAULT_FOREGROUND=7
+  typeset -g POWERLEVEL9K_AWS_DEFAULT_BACKGROUND=1
+  # typeset -g POWERLEVEL9K_AWS_DEFAULT_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  # AWS segment format. The following parameters are available within the expansion.
+  #
+  # - P9K_AWS_PROFILE  The name of the current AWS profile.
+  # - P9K_AWS_REGION   The region associated with the current AWS profile.
+  typeset -g POWERLEVEL9K_AWS_CONTENT_EXPANSION='${P9K_AWS_PROFILE//\%/%%}${P9K_AWS_REGION:+ ${P9K_AWS_REGION//\%/%%}}'
+
+  #[ aws_eb_env: aws elastic beanstalk environment (https://aws.amazon.com/elasticbeanstalk/) ]#
+  # AWS Elastic Beanstalk environment color.
+  typeset -g POWERLEVEL9K_AWS_EB_ENV_FOREGROUND=2
+  typeset -g POWERLEVEL9K_AWS_EB_ENV_BACKGROUND=0
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_AWS_EB_ENV_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  ##########[ azure: azure account name (https://docs.microsoft.com/en-us/cli/azure) ]##########
+  # Show azure only when the command you are typing invokes one of these tools.
+  # Tip: Remove the next line to always show azure.
+  typeset -g POWERLEVEL9K_AZURE_SHOW_ON_COMMAND='az|terraform|tofu|pulumi|terragrunt'
+
+  # POWERLEVEL9K_AZURE_CLASSES is an array with even number of elements. The first element
+  # in each pair defines a pattern against which the current azure account name gets matched.
+  # More specifically, it's P9K_CONTENT prior to the application of context expansion (see below)
+  # that gets matched. If you unset all POWERLEVEL9K_AZURE_*CONTENT_EXPANSION parameters,
+  # you'll see this value in your prompt. The second element of each pair in
+  # POWERLEVEL9K_AZURE_CLASSES defines the account class. Patterns are tried in order. The
+  # first match wins.
+  #
+  # For example, given these settings:
+  #
+  #   typeset -g POWERLEVEL9K_AZURE_CLASSES=(
+  #     '*prod*'  PROD
+  #     '*test*'  TEST
+  #     '*'       OTHER)
+  #
+  # If your current azure account is "company_test", its class is TEST because "company_test"
+  # doesn't match the pattern '*prod*' but does match '*test*'.
+  #
+  # You can define different colors, icons and content expansions for different classes:
+  #
+  #   typeset -g POWERLEVEL9K_AZURE_TEST_FOREGROUND=2
+  #   typeset -g POWERLEVEL9K_AZURE_TEST_BACKGROUND=0
+  #   typeset -g POWERLEVEL9K_AZURE_TEST_VISUAL_IDENTIFIER_EXPANSION='⭐'
+  #   typeset -g POWERLEVEL9K_AZURE_TEST_CONTENT_EXPANSION='> ${P9K_CONTENT} <'
+  typeset -g POWERLEVEL9K_AZURE_CLASSES=(
+      # '*prod*'  PROD    # These values are examples that are unlikely
+      # '*test*'  TEST    # to match your needs. Customize them as needed.
+      '*'         OTHER)
+
+  # Azure account name color.
+  typeset -g POWERLEVEL9K_AZURE_OTHER_FOREGROUND=7
+  typeset -g POWERLEVEL9K_AZURE_OTHER_BACKGROUND=4
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_AZURE_OTHER_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  ##########[ gcloud: google cloud account and project (https://cloud.google.com/) ]###########
+  # Show gcloud only when the command you are typing invokes one of these tools.
+  # Tip: Remove the next line to always show gcloud.
+  typeset -g POWERLEVEL9K_GCLOUD_SHOW_ON_COMMAND='gcloud|gcs|gsutil'
+  # Google cloud color.
+  typeset -g POWERLEVEL9K_GCLOUD_FOREGROUND=7
+  typeset -g POWERLEVEL9K_GCLOUD_BACKGROUND=4
+
+  # Google cloud format. Change the value of POWERLEVEL9K_GCLOUD_PARTIAL_CONTENT_EXPANSION and/or
+  # POWERLEVEL9K_GCLOUD_COMPLETE_CONTENT_EXPANSION if the default is too verbose or not informative
+  # enough. You can use the following parameters in the expansions. Each of them corresponds to the
+  # output of `gcloud` tool.
+  #
+  #   Parameter                | Source
+  #   -------------------------|--------------------------------------------------------------------
+  #   P9K_GCLOUD_CONFIGURATION | gcloud config configurations list --format='value(name)'
+  #   P9K_GCLOUD_ACCOUNT       | gcloud config get-value account
+  #   P9K_GCLOUD_PROJECT_ID    | gcloud config get-value project
+  #   P9K_GCLOUD_PROJECT_NAME  | gcloud projects describe $P9K_GCLOUD_PROJECT_ID --format='value(name)'
+  #
+  # Note: ${VARIABLE//\%/%%} expands to ${VARIABLE} with all occurrences of '%' replaced with '%%'.
+  #
+  # Obtaining project name requires sending a request to Google servers. This can take a long time
+  # and even fail. When project name is unknown, P9K_GCLOUD_PROJECT_NAME is not set and gcloud
+  # prompt segment is in state PARTIAL. When project name gets known, P9K_GCLOUD_PROJECT_NAME gets
+  # set and gcloud prompt segment transitions to state COMPLETE.
+  #
+  # You can customize the format, icon and colors of gcloud segment separately for states PARTIAL
+  # and COMPLETE. You can also hide gcloud in state PARTIAL by setting
+  # POWERLEVEL9K_GCLOUD_PARTIAL_VISUAL_IDENTIFIER_EXPANSION and
+  # POWERLEVEL9K_GCLOUD_PARTIAL_CONTENT_EXPANSION to empty.
+  typeset -g POWERLEVEL9K_GCLOUD_PARTIAL_CONTENT_EXPANSION='${P9K_GCLOUD_PROJECT_ID//\%/%%}'
+  typeset -g POWERLEVEL9K_GCLOUD_COMPLETE_CONTENT_EXPANSION='${P9K_GCLOUD_PROJECT_NAME//\%/%%}'
+
+  # Send a request to Google (by means of `gcloud projects describe ...`) to obtain project name
+  # this often. Negative value disables periodic polling. In this mode project name is retrieved
+  # only when the current configuration, account or project id changes.
+  typeset -g POWERLEVEL9K_GCLOUD_REFRESH_PROJECT_NAME_SECONDS=60
+
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_GCLOUD_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  #[ google_app_cred: google application credentials (https://cloud.google.com/docs/authentication/production) ]#
+  # Show google_app_cred only when the command you are typing invokes one of these tools.
+  # Tip: Remove the next line to always show google_app_cred.
+  typeset -g POWERLEVEL9K_GOOGLE_APP_CRED_SHOW_ON_COMMAND='terraform|tofu|pulumi|terragrunt'
+
+  # Google application credentials classes for the purpose of using different colors, icons and
+  # expansions with different credentials.
+  #
+  # POWERLEVEL9K_GOOGLE_APP_CRED_CLASSES is an array with even number of elements. The first
+  # element in each pair defines a pattern against which the current kubernetes context gets
+  # matched. More specifically, it's P9K_CONTENT prior to the application of context expansion
+  # (see below) that gets matched. If you unset all POWERLEVEL9K_GOOGLE_APP_CRED_*CONTENT_EXPANSION
+  # parameters, you'll see this value in your prompt. The second element of each pair in
+  # POWERLEVEL9K_GOOGLE_APP_CRED_CLASSES defines the context class. Patterns are tried in order.
+  # The first match wins.
+  #
+  # For example, given these settings:
+  #
+  #   typeset -g POWERLEVEL9K_GOOGLE_APP_CRED_CLASSES=(
+  #     '*:*prod*:*'  PROD
+  #     '*:*test*:*'  TEST
+  #     '*'           DEFAULT)
+  #
+  # If your current Google application credentials is "service_account deathray-testing x@y.com",
+  # its class is TEST because it doesn't match the pattern '* *prod* *' but does match '* *test* *'.
+  #
+  # You can define different colors, icons and content expansions for different classes:
+  #
+  #   typeset -g POWERLEVEL9K_GOOGLE_APP_CRED_TEST_FOREGROUND=28
+  #   typeset -g POWERLEVEL9K_GOOGLE_APP_CRED_TEST_VISUAL_IDENTIFIER_EXPANSION='⭐'
+  #   typeset -g POWERLEVEL9K_GOOGLE_APP_CRED_TEST_CONTENT_EXPANSION='$P9K_GOOGLE_APP_CRED_PROJECT_ID'
+  typeset -g POWERLEVEL9K_GOOGLE_APP_CRED_CLASSES=(
+      # '*:*prod*:*'  PROD    # These values are examples that are unlikely
+      # '*:*test*:*'  TEST    # to match your needs. Customize them as needed.
+      '*'             DEFAULT)
+  typeset -g POWERLEVEL9K_GOOGLE_APP_CRED_DEFAULT_FOREGROUND=7
+  typeset -g POWERLEVEL9K_GOOGLE_APP_CRED_DEFAULT_BACKGROUND=4
+  # typeset -g POWERLEVEL9K_GOOGLE_APP_CRED_DEFAULT_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  # Use POWERLEVEL9K_GOOGLE_APP_CRED_CONTENT_EXPANSION to specify the content displayed by
+  # google_app_cred segment. Parameter expansions are very flexible and fast, too. See reference:
+  # http://zsh.sourceforge.net/Doc/Release/Expansion.html#Parameter-Expansion.
+  #
+  # You can use the following parameters in the expansion. Each of them corresponds to one of the
+  # fields in the JSON file pointed to by GOOGLE_APPLICATION_CREDENTIALS.
+  #
+  #   Parameter                        | JSON key file field
+  #   ---------------------------------+---------------
+  #   P9K_GOOGLE_APP_CRED_TYPE         | type
+  #   P9K_GOOGLE_APP_CRED_PROJECT_ID   | project_id
+  #   P9K_GOOGLE_APP_CRED_CLIENT_EMAIL | client_email
+  #
+  # Note: ${VARIABLE//\%/%%} expands to ${VARIABLE} with all occurrences of '%' replaced by '%%'.
+  typeset -g POWERLEVEL9K_GOOGLE_APP_CRED_DEFAULT_CONTENT_EXPANSION='${P9K_GOOGLE_APP_CRED_PROJECT_ID//\%/%%}'
+
+  ##############[ toolbox: toolbox name (https://github.com/containers/toolbox) ]###############
+  # Toolbox color.
+  typeset -g POWERLEVEL9K_TOOLBOX_FOREGROUND=0
+  typeset -g POWERLEVEL9K_TOOLBOX_BACKGROUND=3
+  # Don't display the name of the toolbox if it matches fedora-toolbox-*.
+  typeset -g POWERLEVEL9K_TOOLBOX_CONTENT_EXPANSION='${P9K_TOOLBOX_NAME:#fedora-toolbox-*}'
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_TOOLBOX_VISUAL_IDENTIFIER_EXPANSION='⭐'
+  # Custom prefix.
+  # typeset -g POWERLEVEL9K_TOOLBOX_PREFIX='in '
+
+  ###############################[ public_ip: public IP address ]###############################
+  # Public IP color.
+  typeset -g POWERLEVEL9K_PUBLIC_IP_FOREGROUND=7
+  typeset -g POWERLEVEL9K_PUBLIC_IP_BACKGROUND=0
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_PUBLIC_IP_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  ########################[ vpn_ip: virtual private network indicator ]#########################
+  # VPN IP color.
+  typeset -g POWERLEVEL9K_VPN_IP_FOREGROUND=0
+  typeset -g POWERLEVEL9K_VPN_IP_BACKGROUND=6
+  # When on VPN, show just an icon without the IP address.
+  # Tip: To display the private IP address when on VPN, remove the next line.
+  typeset -g POWERLEVEL9K_VPN_IP_CONTENT_EXPANSION=
+  # Regular expression for the VPN network interface. Run `ifconfig` or `ip -4 a show` while on VPN
+  # to see the name of the interface.
+  typeset -g POWERLEVEL9K_VPN_IP_INTERFACE='(gpd|wg|(.*tun)|tailscale)[0-9]*|(zt.*)'
+  # If set to true, show one segment per matching network interface. If set to false, show only
+  # one segment corresponding to the first matching network interface.
+  # Tip: If you set it to true, you'll probably want to unset POWERLEVEL9K_VPN_IP_CONTENT_EXPANSION.
+  typeset -g POWERLEVEL9K_VPN_IP_SHOW_ALL=false
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_VPN_IP_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  ###########[ ip: ip address and bandwidth usage for a specified network interface ]###########
+  # IP color.
+  typeset -g POWERLEVEL9K_IP_BACKGROUND=4
+  typeset -g POWERLEVEL9K_IP_FOREGROUND=0
+  # The following parameters are accessible within the expansion:
+  #
+  #   Parameter             | Meaning
+  #   ----------------------+-------------------------------------------
+  #   P9K_IP_IP             | IP address
+  #   P9K_IP_INTERFACE      | network interface
+  #   P9K_IP_RX_BYTES       | total number of bytes received
+  #   P9K_IP_TX_BYTES       | total number of bytes sent
+  #   P9K_IP_RX_BYTES_DELTA | number of bytes received since last prompt
+  #   P9K_IP_TX_BYTES_DELTA | number of bytes sent since last prompt
+  #   P9K_IP_RX_RATE        | receive rate (since last prompt)
+  #   P9K_IP_TX_RATE        | send rate (since last prompt)
+  typeset -g POWERLEVEL9K_IP_CONTENT_EXPANSION='${P9K_IP_RX_RATE:+⇣$P9K_IP_RX_RATE }${P9K_IP_TX_RATE:+⇡$P9K_IP_TX_RATE }$P9K_IP_IP'
+  # Show information for the first network interface whose name matches this regular expression.
+  # Run `ifconfig` or `ip -4 a show` to see the names of all network interfaces.
+  typeset -g POWERLEVEL9K_IP_INTERFACE='[ew].*'
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_IP_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  #########################[ proxy: system-wide http/https/ftp proxy ]##########################
+  # Proxy color.
+  typeset -g POWERLEVEL9K_PROXY_FOREGROUND=4
+  typeset -g POWERLEVEL9K_PROXY_BACKGROUND=0
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_PROXY_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  ################################[ battery: internal battery ]#################################
+  # Show battery in red when it's below this level and not connected to power supply.
+  typeset -g POWERLEVEL9K_BATTERY_LOW_THRESHOLD=20
+  typeset -g POWERLEVEL9K_BATTERY_LOW_FOREGROUND=1
+  # Show battery in green when it's charging or fully charged.
+  typeset -g POWERLEVEL9K_BATTERY_{CHARGING,CHARGED}_FOREGROUND=2
+  # Show battery in yellow when it's discharging.
+  typeset -g POWERLEVEL9K_BATTERY_DISCONNECTED_FOREGROUND=3
+  # Battery pictograms going from low to high level of charge.
+  typeset -g POWERLEVEL9K_BATTERY_STAGES='\UF008E\UF007A\UF007B\UF007C\UF007D\UF007E\UF007F\UF0080\UF0081\UF0082\UF0079'
+  # Don't show the remaining time to charge/discharge.
+  typeset -g POWERLEVEL9K_BATTERY_VERBOSE=false
+  typeset -g POWERLEVEL9K_BATTERY_BACKGROUND=0
+
+  #####################################[ wifi: wifi speed ]#####################################
+  # WiFi color.
+  typeset -g POWERLEVEL9K_WIFI_FOREGROUND=0
+  typeset -g POWERLEVEL9K_WIFI_BACKGROUND=4
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_WIFI_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  # Use different colors and icons depending on signal strength ($P9K_WIFI_BARS).
+  #
+  #   # Wifi colors and icons for different signal strength levels (low to high).
+  #   typeset -g my_wifi_fg=(0 0 0 0 0)                                # <-- change these values
+  #   typeset -g my_wifi_icon=('WiFi' 'WiFi' 'WiFi' 'WiFi' 'WiFi')     # <-- change these values
+  #
+  #   typeset -g POWERLEVEL9K_WIFI_CONTENT_EXPANSION='%F{${my_wifi_fg[P9K_WIFI_BARS+1]}}$P9K_WIFI_LAST_TX_RATE Mbps'
+  #   typeset -g POWERLEVEL9K_WIFI_VISUAL_IDENTIFIER_EXPANSION='%F{${my_wifi_fg[P9K_WIFI_BARS+1]}}${my_wifi_icon[P9K_WIFI_BARS+1]}'
+  #
+  # The following parameters are accessible within the expansions:
+  #
+  #   Parameter             | Meaning
+  #   ----------------------+---------------
+  #   P9K_WIFI_SSID         | service set identifier, a.k.a. network name
+  #   P9K_WIFI_LINK_AUTH    | authentication protocol such as "wpa2-psk" or "none"; empty if unknown
+  #   P9K_WIFI_LAST_TX_RATE | wireless transmit rate in megabits per second
+  #   P9K_WIFI_RSSI         | signal strength in dBm, from -120 to 0
+  #   P9K_WIFI_NOISE        | noise in dBm, from -120 to 0
+  #   P9K_WIFI_BARS         | signal strength in bars, from 0 to 4 (derived from P9K_WIFI_RSSI and P9K_WIFI_NOISE)
+
+  ####################################[ time: current time ]####################################
+  # Current time color.
+  typeset -g POWERLEVEL9K_TIME_FOREGROUND=0
+  typeset -g POWERLEVEL9K_TIME_BACKGROUND=7
+  # Format for the current time: 09:51:02. See `man 3 strftime`.
+  typeset -g POWERLEVEL9K_TIME_FORMAT='%D{%I:%M:%S %p}'
+  # If set to true, time will update when you hit enter. This way prompts for the past
+  # commands will contain the start times of their commands as opposed to the default
+  # behavior where they contain the end times of their preceding commands.
+  typeset -g POWERLEVEL9K_TIME_UPDATE_ON_COMMAND=false
+  # Custom icon.
+  # typeset -g POWERLEVEL9K_TIME_VISUAL_IDENTIFIER_EXPANSION='⭐'
+  # Custom prefix.
+  # typeset -g POWERLEVEL9K_TIME_PREFIX='at '
+
+  # Example of a user-defined prompt segment. Function prompt_example will be called on every
+  # prompt if `example` prompt segment is added to POWERLEVEL9K_LEFT_PROMPT_ELEMENTS or
+  # POWERLEVEL9K_RIGHT_PROMPT_ELEMENTS. It displays an icon and yellow text on red background
+  # greeting the user.
+  #
+  # Type `p10k help segment` for documentation and a more sophisticated example.
+  function prompt_example() {
+    p10k segment -b 1 -f 3 -i '⭐' -t 'hello, %n'
+  }
+
+  # User-defined prompt segments may optionally provide an instant_prompt_* function. Its job
+  # is to generate the prompt segment for display in instant prompt. See
+  # https://github.com/romkatv/powerlevel10k#instant-prompt.
+  #
+  # Powerlevel10k will call instant_prompt_* at the same time as the regular prompt_* function
+  # and will record all `p10k segment` calls it makes. When displaying instant prompt, Powerlevel10k
+  # will replay these calls without actually calling instant_prompt_*. It is imperative that
+  # instant_prompt_* always makes the same `p10k segment` calls regardless of environment. If this
+  # rule is not observed, the content of instant prompt will be incorrect.
+  #
+  # Usually, you should either not define instant_prompt_* or simply call prompt_* from it. If
+  # instant_prompt_* is not defined for a segment, the segment won't be shown in instant prompt.
+  function instant_prompt_example() {
+    # Since prompt_example always makes the same `p10k segment` calls, we can call it from
+    # instant_prompt_example. This will give us the same `example` prompt segment in the instant
+    # and regular prompts.
+    prompt_example
+  }
+
+  # User-defined prompt segments can be customized the same way as built-in segments.
+  typeset -g POWERLEVEL9K_EXAMPLE_FOREGROUND=3
+  typeset -g POWERLEVEL9K_EXAMPLE_BACKGROUND=1
+  # typeset -g POWERLEVEL9K_EXAMPLE_VISUAL_IDENTIFIER_EXPANSION='⭐'
+
+  # Transient prompt works similarly to the builtin transient_rprompt option. It trims down prompt
+  # when accepting a command line. Supported values:
+  #
+  #   - off:      Don't change prompt when accepting a command line.
+  #   - always:   Trim down prompt when accepting a command line.
+  #   - same-dir: Trim down prompt when accepting a command line unless this is the first command
+  #               typed after changing current working directory.
+  typeset -g POWERLEVEL9K_TRANSIENT_PROMPT=off
+
+  # Instant prompt mode.
+  #
+  #   - off:     Disable instant prompt. Choose this if you've tried instant prompt and found
+  #              it incompatible with your zsh configuration files.
+  #   - quiet:   Enable instant prompt and don't print warnings when detecting console output
+  #              during zsh initialization. Choose this if you've read and understood
+  #              https://github.com/romkatv/powerlevel10k#instant-prompt.
+  #   - verbose: Enable instant prompt and print a warning when detecting console output during
+  #              zsh initialization. Choose this if you've never tried instant prompt, haven't
+  #              seen the warning, or if you are unsure what this all means.
+  typeset -g POWERLEVEL9K_INSTANT_PROMPT=verbose
+
+  # Hot reload allows you to change POWERLEVEL9K options after Powerlevel10k has been initialized.
+  # For example, you can type POWERLEVEL9K_BACKGROUND=red and see your prompt turn red. Hot reload
+  # can slow down prompt by 1-2 milliseconds, so it's better to keep it turned off unless you
+  # really need it.
+  typeset -g POWERLEVEL9K_DISABLE_HOT_RELOAD=true
+
+  # If p10k is already loaded, reload configuration.
+  # This works even with POWERLEVEL9K_DISABLE_HOT_RELOAD=true.
+  (( ! $+functions[p10k] )) || p10k reload
+}
+
+# Tell `p10k configure` which file it should overwrite.
+typeset -g POWERLEVEL9K_CONFIG_FILE=${${(%):-%x}:a}
+
+(( ${#p10k_config_opts} )) && setopt ${p10k_config_opts[@]}
+'builtin' 'unset' 'p10k_config_opts'
diff --git a/image/computer/dotfiles/terminalrc b/image/computer/dotfiles/terminalrc
new file mode 100644
index 0000000..8857a89
--- /dev/null
+++ b/image/computer/dotfiles/terminalrc
@@ -0,0 +1,31 @@
+[Configuration]
+FontName=MesloLGS NF 13
+MiscAlwaysShowTabs=FALSE
+MiscBell=FALSE
+MiscBordersDefault=TRUE
+MiscCursorBlinks=TRUE
+MiscCursorShape=TERMINAL_CURSOR_SHAPE_BLOCK
+MiscDefaultGeometry=92x28
+MiscInheritGeometry=FALSE
+MiscMenubarDefault=FALSE
+MiscMouseAutohide=FALSE
+MiscToolbarDefault=FALSE
+MiscConfirmClose=FALSE
+MiscCycleTabs=TRUE
+MiscTabCloseButtons=TRUE
+MiscTabCloseMiddleClick=TRUE
+MiscTabPosition=GTK_POS_TOP
+MiscHighlightUrls=TRUE
+ScrollingOnOutput=FALSE
+ScrollingOnKeystroke=TRUE
+ScrollingBar=TERMINAL_SCROLLBAR_NONE
+ScrollingLines=20000
+ColorForeground=#e2e8f0
+ColorBackground=#0b1220
+ColorCursor=#7dd3fc
+ColorBoldUseDefault=FALSE
+ColorBold=#f8fafc
+TabActivityColor=#38bdf8
+Encoding=UTF-8
+TitleMode=TERMINAL_TITLE_REPLACE
+CommandLoginShell=TRUE
diff --git a/image/computer/dotfiles/zshrc b/image/computer/dotfiles/zshrc
new file mode 100644
index 0000000..e54045c
--- /dev/null
+++ b/image/computer/dotfiles/zshrc
@@ -0,0 +1,31 @@
+# LazyBoy desktop zsh — same Powerlevel10k rainbow setup as the host.
+if [[ -r "${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh" ]]; then
+  source "${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh"
+fi
+
+export LANG="${LANG:-zh_TW.UTF-8}"
+export LC_ALL="${LC_ALL:-zh_TW.UTF-8}"
+export LANGUAGE="${LANGUAGE:-zh_TW:zh:en}"
+export TERM="${TERM:-xterm-256color}"
+export SHELL=/bin/zsh
+export PATH="$HOME/.local/bin:/usr/local/bin:$PATH"
+
+setopt AUTO_CD HIST_IGNORE_DUPS SHARE_HISTORY EXTENDED_HISTORY
+HISTFILE="$HOME/.zsh_history"
+HISTSIZE=50000
+SAVEHIST=50000
+
+if [[ -r /usr/share/zsh/plugins/zsh-autosuggestions/zsh-autosuggestions.zsh ]]; then
+  source /usr/share/zsh/plugins/zsh-autosuggestions/zsh-autosuggestions.zsh
+  ZSH_AUTOSUGGEST_STRATEGY=(history completion)
+fi
+if [[ -r /usr/share/zsh/plugins/zsh-z/zsh-z.plugin.zsh ]]; then
+  source /usr/share/zsh/plugins/zsh-z/zsh-z.plugin.zsh
+fi
+if [[ -r /usr/share/zsh-theme-powerlevel10k/powerlevel10k.zsh-theme ]]; then
+  source /usr/share/zsh-theme-powerlevel10k/powerlevel10k.zsh-theme
+fi
+[[ ! -f "$HOME/.p10k.zsh" ]] || source "$HOME/.p10k.zsh"
+if [[ -r /usr/share/zsh/plugins/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh ]]; then
+  source /usr/share/zsh/plugins/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh
+fi
diff --git a/image/computer/fluxbox/menu b/image/computer/fluxbox/menu
new file mode 100644
index 0000000..5881cfb
--- /dev/null
+++ b/image/computer/fluxbox/menu
@@ -0,0 +1,4 @@
+[begin] (桌面)
+  [exec] (終端機) {/usr/local/bin/lazyboy-terminal}
+  [exec] (瀏覽器) {/usr/local/bin/lazyboy-browser https://duckduckgo.com}
+[end]
diff --git a/image/computer/fluxbox/style b/image/computer/fluxbox/style
new file mode 100644
index 0000000..e77019f
--- /dev/null
+++ b/image/computer/fluxbox/style
@@ -0,0 +1,92 @@
+! LazyBoy Fluxbox style — flat dark, Traditional Chinese UI.
+! Debian ships Fluxbox 1.3.5 (last stable). This is a custom skin, not a fork.
+toolbar:                             flat solid
+toolbar.color:                       #0b1220
+toolbar.borderColor:                 #1e293b
+toolbar.borderWidth:                 0
+toolbar.height:                      36
+toolbar.justify:                     center
+toolbar.clock:                       flat solid
+toolbar.clock.color:                 #0b1220
+toolbar.clock.textColor:             #cbd5e1
+toolbar.clock.font:                  jf open 粉圓 2.1-11
+toolbar.workspace:                   flat solid
+toolbar.workspace.color:             #0b1220
+toolbar.workspace.textColor:         #7dd3fc
+toolbar.workspace.font:              jf open 粉圓 2.1-11
+toolbar.iconbar.empty:               flat solid
+toolbar.iconbar.empty.color:         #0b1220
+toolbar.iconbar.focused:             flat solid
+toolbar.iconbar.focused.color:       #1d4ed8
+toolbar.iconbar.focused.textColor:   #f8fafc
+toolbar.iconbar.focused.font:        jf open 粉圓 2.1-11
+toolbar.iconbar.unfocused:           flat solid
+toolbar.iconbar.unfocused.color:     #162032
+toolbar.iconbar.unfocused.textColor: #94a3b8
+toolbar.iconbar.unfocused.font:      jf open 粉圓 2.1-11
+toolbar.button:                      flat solid
+toolbar.button.color:                #0b1220
+toolbar.button.picColor:             #7dd3fc
+toolbar.button.pressed.color:        #1e3a8a
+
+menu:                                flat solid
+menu.borderColor:                    #1e293b
+menu.borderWidth:                    1
+menu.bullet:                         triangle
+menu.bullet.position:                right
+menu.title:                          flat solid
+menu.title.color:                    #1e3a8a
+menu.title.textColor:                #f8fafc
+menu.title.font:                     jf open 粉圓 2.1-12
+menu.title.justify:                  center
+menu.frame:                          flat solid
+menu.frame.color:                    #0f172a
+menu.frame.textColor:                #e2e8f0
+menu.frame.disableColor:             #64748b
+menu.frame.font:                     jf open 粉圓 2.1-12
+menu.hilight:                        flat solid
+menu.hilight.color:                  #2563eb
+menu.hilight.textColor:              #ffffff
+
+window.title.height:                 22
+window.justify:                      left
+window.borderWidth:                  1
+window.borderColor:                  #334155
+window.handleWidth:                  3
+window.bevelWidth:                   0
+window.roundCorners:                 none
+window.font:                         jf open 粉圓 2.1-11
+window.title.focus:                  flat solid
+window.title.focus.color:            #1e293b
+window.title.unfocus:                flat solid
+window.title.unfocus.color:          #0f172a
+window.label.focus:                  flat solid
+window.label.focus.color:            #1e293b
+window.label.focus.textColor:        #f8fafc
+window.label.unfocus:                flat solid
+window.label.unfocus.color:          #0f172a
+window.label.unfocus.textColor:      #64748b
+window.handle.focus:                 flat solid
+window.handle.focus.color:           #1e293b
+window.handle.unfocus:               flat solid
+window.handle.unfocus.color:         #0f172a
+window.grip.focus:                   flat solid
+window.grip.focus.color:             #2563eb
+window.grip.unfocus:                 flat solid
+window.grip.unfocus.color:           #1e293b
+window.button.focus:                 flat solid
+window.button.focus.color:           #1e293b
+window.button.focus.picColor:        #e2e8f0
+window.button.unfocus:               flat solid
+window.button.unfocus.color:         #0f172a
+window.button.unfocus.picColor:      #64748b
+window.button.pressed.color:         #2563eb
+window.close.pressed.color:          #dc2626
+
+*font:                               jf open 粉圓 2.1-11
+borderWidth:                         1
+bevelWidth:                          0
+handleWidth:                         3
+borderColor:                         #334155
+background:                          solid
+background.color:                    #0f172a
diff --git a/image/computer/fonts.conf b/image/computer/fonts.conf
new file mode 100644
index 0000000..86068e3
--- /dev/null
+++ b/image/computer/fonts.conf
@@ -0,0 +1,47 @@
+<?xml version="1.0"?>
+<!DOCTYPE fontconfig SYSTEM "fonts.dtd">
+<fontconfig>
+  <!-- System UI: jf open 粉圓. Terminal: MesloLGS NF + Noto Sans Mono CJK TC. -->
+  <match target="pattern">
+    <test name="family"><string>粉圓</string></test>
+    <edit name="family" mode="assign" binding="same"><string>jf open 粉圓 2.1</string></edit>
+  </match>
+  <match target="pattern">
+    <test name="family"><string>jf open 粉圓</string></test>
+    <edit name="family" mode="assign" binding="same"><string>jf open 粉圓 2.1</string></edit>
+  </match>
+  <match target="pattern">
+    <test name="family"><string>Huninn</string></test>
+    <edit name="family" mode="assign" binding="same"><string>jf open 粉圓 2.1</string></edit>
+  </match>
+
+  <match target="pattern">
+    <test name="family"><string>sans-serif</string></test>
+    <edit name="family" mode="prepend" binding="strong">
+      <string>jf open 粉圓 2.1</string>
+    </edit>
+  </match>
+  <match target="pattern">
+    <test name="lang" compare="contains"><string>zh</string></test>
+    <test name="family"><string>sans-serif</string></test>
+    <edit name="family" mode="prepend" binding="strong">
+      <string>jf open 粉圓 2.1</string>
+    </edit>
+  </match>
+
+  <match target="pattern">
+    <test name="family"><string>monospace</string></test>
+    <edit name="family" mode="prepend" binding="strong">
+      <string>Noto Sans Mono CJK TC</string>
+    </edit>
+    <edit name="family" mode="prepend" binding="strong">
+      <string>MesloLGS NF</string>
+    </edit>
+  </match>
+  <match target="pattern">
+    <test name="family"><string>MesloLGS NF</string></test>
+    <edit name="family" mode="append" binding="weak">
+      <string>Noto Sans Mono CJK TC</string>
+    </edit>
+  </match>
+</fontconfig>
diff --git a/image/computer/gtk3-settings.ini b/image/computer/gtk3-settings.ini
new file mode 100644
index 0000000..4d632e7
--- /dev/null
+++ b/image/computer/gtk3-settings.ini
@@ -0,0 +1,5 @@
+[Settings]
+gtk-font-name=jf open 粉圓 2.1 12
+gtk-icon-theme-name=Adwaita
+gtk-theme-name=Adwaita-dark
+gtk-application-prefer-dark-theme=1
diff --git a/image/computer/lazyboy-browser b/image/computer/lazyboy-browser
new file mode 100755
index 0000000..2c36b0f
--- /dev/null
+++ b/image/computer/lazyboy-browser
@@ -0,0 +1,46 @@
+#!/bin/sh
+# Normal Chromium window. Do not add --kiosk or --app.
+# Profile is per-bot / per-screen so two Team desktops never share cookies
+# or Chromium's SingletonLock (that dialog is "Profile error occurred").
+HOME="${HOME:-/home/lazyboy}"
+display="${DISPLAY#:}"
+display="${display:-1}"
+if [ -n "${LAZYBOY_BROWSER_PROFILE:-}" ]; then
+  PROFILE="$LAZYBOY_BROWSER_PROFILE"
+elif [ -n "${LAZYBOY_BOT_ID:-}" ]; then
+  PROFILE="$HOME/.browser-profiles/bots/$LAZYBOY_BOT_ID"
+elif [ -r "/tmp/lazyboy/screen-${display}.profile" ]; then
+  PROFILE="$(cat "/tmp/lazyboy/screen-${display}.profile")"
+else
+  PROFILE="$HOME/.browser-profiles/displays/${display}"
+fi
+mkdir -p "$PROFILE"
+live=$(pgrep -f "chromium.*--user-data-dir=${PROFILE}" 2>/dev/null | head -1)
+lock="$(readlink "$PROFILE/SingletonLock" 2>/dev/null || true)"
+lock_pid="${lock##*-}"
+if [ -n "$live" ]; then
+  # A second Chromium on the same profile is the "Profile error occurred" dialog.
+  # Only hand the URL to the existing process when its singleton is still valid.
+  if [ -n "$lock_pid" ] && kill -0 "$lock_pid" 2>/dev/null; then
+    exec /usr/bin/chromium --no-sandbox --user-data-dir="$PROFILE" "$@"
+  fi
+  exit 0
+fi
+rm -f "$PROFILE/SingletonLock" "$PROFILE/SingletonCookie" "$PROFILE/SingletonSocket"
+exec /usr/bin/chromium \
+  --no-sandbox \
+  --test-type \
+  --disable-gpu \
+  --disable-dev-shm-usage \
+  --disable-features=TranslateUI \
+  --no-first-run \
+  --no-default-browser-check \
+  --disable-session-crashed-bubble \
+  --hide-crash-restore-bubble \
+  --disable-infobars \
+  --password-store=basic \
+  --lang=zh-TW \
+  --accept-lang=zh-TW,zh,en-US,en \
+  --start-maximized \
+  --user-data-dir="$PROFILE" \
+  "$@"
diff --git a/image/computer/lazyboy-screen b/image/computer/lazyboy-screen
new file mode 100755
index 0000000..d74caa2
--- /dev/null
+++ b/image/computer/lazyboy-screen
@@ -0,0 +1,282 @@
+#!/usr/bin/env bash
+# Per-bot X11 screens inside one Team computer.
+# Slot 0 is DISPLAY :1 / VNC 5900 / view 6080 (primary).
+# Slot N is DISPLAY :(N+1) / VNC 5900+N / view 6080+N.
+set -euo pipefail
+
+export HOME="${HOME:-/home/lazyboy}"
+export SHELL=/bin/zsh
+export TERM="${TERM:-xterm-256color}"
+export LANG="${LANG:-zh_TW.UTF-8}"
+export LC_ALL="${LC_ALL:-zh_TW.UTF-8}"
+export LANGUAGE="${LANGUAGE:-zh_TW:zh:en}"
+export PATH="$HOME/.local/bin:/usr/local/bin:$PATH"
+
+ROOT=/tmp/lazyboy
+LIMIT=8
+cmd="${1:-}"
+shift || true
+
+mkdir -p "$ROOT/screens" /tmp/.X11-unix "$HOME/.browser-profiles"
+
+hydrate_home() {
+  mkdir -p "$HOME/.config/xfce4/terminal" "$HOME/.cache" "$HOME/.local/bin"
+  if [[ ! -f "$HOME/.zshrc" && -f /usr/share/lazyboy/skel/zshrc ]]; then
+    cp /usr/share/lazyboy/skel/zshrc "$HOME/.zshrc"
+  fi
+  if [[ ! -f "$HOME/.p10k.zsh" && -f /usr/share/lazyboy/skel/p10k.zsh ]]; then
+    cp /usr/share/lazyboy/skel/p10k.zsh "$HOME/.p10k.zsh"
+  fi
+  if [[ ! -f "$HOME/.config/xfce4/terminal/terminalrc" && -f /usr/share/lazyboy/skel/terminalrc ]]; then
+    cp /usr/share/lazyboy/skel/terminalrc "$HOME/.config/xfce4/terminal/terminalrc"
+  fi
+}
+
+hydrate_xfce() {
+  local xfce_home="$1"
+  mkdir -p \
+    "$xfce_home/.config/xfce4/xfconf/xfce-perchannel-xml" \
+    "$xfce_home/.config/xfce4/panel" \
+    "$xfce_home/.cache" \
+    "$xfce_home/.local/share" \
+    "$xfce_home/runtime"
+  chmod 700 "$xfce_home/runtime" 2>/dev/null || true
+  local xml="$xfce_home/.config/xfce4/xfconf/xfce-perchannel-xml"
+  local skel_xml=/usr/share/lazyboy/xfce-skel/xfce4/xfconf/xfce-perchannel-xml
+  local f
+  for f in xfce4-panel.xml xfwm4.xml xfce4-desktop.xml thunar.xml; do
+    if [[ -r "$skel_xml/$f" ]]; then
+      cp -f "$skel_xml/$f" "$xml/$f" || true
+    fi
+  done
+  if [[ -r /etc/xdg/xfce4/helpers.rc ]]; then
+    cp -f /etc/xdg/xfce4/helpers.rc "$xfce_home/.config/xfce4/helpers.rc" || true
+  fi
+}
+
+wait_display() {
+  local display="$1"
+  local n
+  for n in $(seq 1 100); do
+    if xdpyinfo -display "$display" >/dev/null 2>&1; then
+      return 0
+    fi
+    sleep 0.1
+  done
+  return 1
+}
+
+port_open() {
+  local port="$1"
+  python3 - "$port" <<'PY'
+import socket, sys
+port = int(sys.argv[1])
+try:
+    s = socket.create_connection(("127.0.0.1", port), 0.2)
+    s.close()
+except OSError:
+    sys.exit(1)
+PY
+}
+
+wait_port() {
+  local port="$1"
+  local n
+  for n in $(seq 1 50); do
+    if port_open "$port"; then
+      return 0
+    fi
+    sleep 0.1
+  done
+  return 1
+}
+
+start_xvfb() {
+  local display="$1"
+  local number="$2"
+  local log="$3"
+  if xdpyinfo -display "$display" >/dev/null 2>&1; then
+    return 0
+  fi
+  rm -f "/tmp/.X${number}-lock" "/tmp/.X11-unix/X${number}"
+  Xvfb "$display" -screen 0 1280x800x24 -ac +extension RANDR +render -noreset >"${log}-xvfb.log" 2>&1 &
+  echo $! > "${log}-xvfb.pid"
+  wait_display "$display"
+}
+
+alive_pidfile() {
+  local file="$1"
+  [[ -f "$file" ]] || return 1
+  local pid
+  pid="$(cat "$file" 2>/dev/null || true)"
+  [[ -n "$pid" ]] && kill -0 "$pid" 2>/dev/null
+}
+
+start_desktop() {
+  local display="$1"
+  local xfce_home="$2"
+  local log="$3"
+  if alive_pidfile "${log}-panel.pid"; then
+    return 0
+  fi
+  hydrate_xfce "$xfce_home"
+  DISPLAY="$display" xsetroot -solid "#0f172a" >/dev/null 2>&1 || true
+  export DISPLAY="$display"
+  export XDG_CONFIG_HOME="$xfce_home/.config"
+  export XDG_CACHE_HOME="$xfce_home/.cache"
+  export XDG_DATA_HOME="$xfce_home/.local/share"
+  export XDG_RUNTIME_DIR="$xfce_home/runtime"
+  export XDG_CURRENT_DESKTOP=XFCE
+  if command -v dbus-launch >/dev/null 2>&1; then
+    eval "$(dbus-launch --sh-syntax)"
+    echo "${DBUS_SESSION_BUS_PID:-}" >"${log}-dbus.pid"
+  fi
+  if command -v xfconfd >/dev/null 2>&1; then
+    xfconfd --daemon >/dev/null 2>&1 || true
+  fi
+  if command -v xfwm4 >/dev/null 2>&1; then
+    xfwm4 --compositor=off --display="$display" --sm-client-disable >"${log}-wm.log" 2>&1 &
+    echo $! >"${log}-wm.pid"
+    sleep 0.3
+    xfdesktop --disable-wm-check --sm-client-disable >"${log}-desktop.log" 2>&1 &
+    echo $! >"${log}-desktop.pid"
+    xfce4-panel --disable-wm-check --sm-client-disable >"${log}-panel.log" 2>&1 &
+    echo $! >"${log}-panel.pid"
+  else
+    echo "XFCE is missing" >&2
+    return 1
+  fi
+  sleep 0.4
+}
+
+start_vnc() {
+  local display="$1"
+  local vnc_port="$2"
+  local view_port="$3"
+  local log="$4"
+  if ! port_open "$vnc_port"; then
+    x11vnc -display "$display" -forever -shared -nopw -listen 127.0.0.1 -rfbport "$vnc_port" \
+      -xkb -repeat -cursor arrow -noxdamage -ncache 0 >"${log}-x11vnc.log" 2>&1 &
+  fi
+  if ! port_open "$view_port"; then
+    local novnc=/usr/share/novnc
+    if [[ ! -d "$novnc" ]]; then
+      echo "noVNC is missing" >&2
+      return 1
+    fi
+    websockify --heartbeat=30 --web="$novnc" "0.0.0.0:${view_port}" "127.0.0.1:${vnc_port}" \
+      >"${log}-novnc.log" 2>&1 &
+  fi
+  wait_port "$vnc_port"
+  wait_port "$view_port"
+}
+
+start_xterm() {
+  local display="$1"
+  local log="$2"
+  if alive_pidfile "${log}-xterm.pid"; then
+    return 0
+  fi
+  DISPLAY="$display" SHELL=/bin/zsh lazyboy-terminal >"${log}-xterm.log" 2>&1 &
+  echo $! > "${log}-xterm.pid"
+}
+
+start_browser() {
+  local display="$1"
+  local profile="$2"
+  local log="$3"
+  local number="${display#:}"
+  mkdir -p "$profile" "$ROOT"
+  if [[ -n "$profile" ]]; then
+    printf '%s\n' "$profile" >"$ROOT/screen-${number}.profile"
+  fi
+  if pgrep -f "chromium.*--user-data-dir=${profile}" >/dev/null 2>&1; then
+    return 0
+  fi
+  rm -f "$profile/SingletonLock" "$profile/SingletonCookie" "$profile/SingletonSocket"
+  DISPLAY="$display" HOME="$HOME" LAZYBOY_BROWSER_PROFILE="$profile" \
+    lazyboy-browser https://duckduckgo.com >"${log}-browser.log" 2>&1 &
+  echo $! > "${log}-browser.pid"
+}
+
+ensure_slot() {
+  local slot="$1"
+  local profile="${2:-}"
+  if ! [[ "$slot" =~ ^[0-9]+$ ]] || (( slot < 0 || slot >= LIMIT )); then
+    echo "invalid screen slot" >&2
+    return 1
+  fi
+  local number=$((slot + 1))
+  local display=":${number}"
+  local vnc_port=$((5900 + slot))
+  local view_port=$((6080 + slot))
+  local log="$ROOT/screen-${number}"
+  local xfce_home="/tmp/xfce-home"
+  if (( slot != 0 )); then
+    xfce_home="/tmp/xfce-home-${number}"
+  fi
+  mkdir -p "$ROOT"
+  if [[ -n "$profile" ]]; then
+    printf '%s\n' "$profile" >"$ROOT/screen-${number}.profile"
+  fi
+  if xdpyinfo -display "$display" >/dev/null 2>&1 && port_open "$vnc_port" && port_open "$view_port"; then
+    if [[ -n "$profile" ]]; then
+      start_browser "$display" "$profile" "$log"
+    fi
+    printf '{"ok":true,"slot":%s,"display":"%s","viewPort":%s,"vncPort":%s}\n' \
+      "$slot" "$display" "$view_port" "$vnc_port"
+    return 0
+  fi
+  (
+    flock -w 25 9 || {
+      echo "screen ${slot} is busy starting" >&2
+      exit 1
+    }
+    if xdpyinfo -display "$display" >/dev/null 2>&1 && port_open "$vnc_port" && port_open "$view_port"; then
+      if [[ -n "$profile" ]]; then
+        start_browser "$display" "$profile" "$log"
+      fi
+      printf '{"ok":true,"slot":%s,"display":"%s","viewPort":%s,"vncPort":%s}\n' \
+        "$slot" "$display" "$view_port" "$vnc_port"
+      exit 0
+    fi
+    start_xvfb "$display" "$number" "$log" || {
+      echo "Xvfb failed on ${display}" >&2
+      cat "${log}-xvfb.log" >&2 || true
+      exit 1
+    }
+    start_desktop "$display" "$xfce_home" "$log"
+    start_xterm "$display" "$log"
+    start_vnc "$display" "$vnc_port" "$view_port" "$log" || exit 1
+    if [[ -n "$profile" ]]; then
+      start_browser "$display" "$profile" "$log"
+    fi
+    if (( slot == 0 )) && [[ -f "${log}-xvfb.pid" ]]; then
+      cp "${log}-xvfb.pid" "$ROOT/xvfb-1.pid"
+    fi
+    printf '{"ok":true,"slot":%s,"display":"%s","viewPort":%s,"vncPort":%s}\n' \
+      "$slot" "$display" "$view_port" "$vnc_port"
+  ) 9>"$ROOT/screen-${slot}.lock"
+}
+
+boot_primary() {
+  mkdir -p "$HOME" "$HOME/.local/bin" "$HOME/.config" "$HOME/.browser-profiles" "$ROOT"
+  cd "$HOME"
+  hydrate_home
+  printf '這是 Docker 裡的 Debian 桌面。家目錄會保存在 /home/lazyboy。\n' > "$HOME/README.txt"
+  mkdir -p "$HOME/shared" "$HOME/bots"
+  ensure_slot 0 ""
+}
+
+case "$cmd" in
+  boot-primary)
+    boot_primary
+    ;;
+  ensure)
+    ensure_slot "${1:-0}" "${2:-}"
+    ;;
+  *)
+    echo "usage: lazyboy-screen boot-primary|ensure <slot> [profile]" >&2
+    exit 2
+    ;;
+esac
diff --git a/image/computer/lazyboy-terminal b/image/computer/lazyboy-terminal
new file mode 100755
index 0000000..da50275
--- /dev/null
+++ b/image/computer/lazyboy-terminal
@@ -0,0 +1,20 @@
+#!/bin/sh
+# Pretty UTF-8 terminal: zsh + Powerlevel10k. Never fall back to a bare xterm.
+export HOME="${HOME:-/home/lazyboy}"
+export LANG="${LANG:-zh_TW.UTF-8}"
+export LC_ALL="${LC_ALL:-zh_TW.UTF-8}"
+export LANGUAGE="${LANGUAGE:-zh_TW:zh:en}"
+export SHELL=/bin/zsh
+export TERM="${TERM:-xterm-256color}"
+export COLORTERM="${COLORTERM:-truecolor}"
+export PATH="$HOME/.local/bin:/usr/local/bin:/usr/bin:/bin"
+cd "$HOME" || true
+if command -v xfce4-terminal >/dev/null 2>&1; then
+  exec xfce4-terminal \
+    --disable-server \
+    --geometry=92x28+48+48 \
+    --title=終端機 \
+    --command="/bin/zsh -l" \
+    "$@"
+fi
+exec /bin/zsh -l
diff --git a/image/computer/start.sh b/image/computer/start.sh
new file mode 100755
index 0000000..0c2411d
--- /dev/null
+++ b/image/computer/start.sh
@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# Boot a real Linux desktop in the computer container.
+# Primary screen is DISPLAY :1. Extra Team bots get their own screens via lazyboy-screen.
+# Do not switch this back to a kiosk, --app, or HTML landing page.
+set -uo pipefail
+export DISPLAY="${DISPLAY:-:1}"
+export HOME="${HOME:-/home/lazyboy}"
+export SHELL=/bin/zsh
+export TERM="${TERM:-xterm-256color}"
+export LANG="${LANG:-zh_TW.UTF-8}"
+export LC_ALL="${LC_ALL:-zh_TW.UTF-8}"
+export LANGUAGE="${LANGUAGE:-zh_TW:zh:en}"
+mkdir -p "$HOME" /tmp/lazyboy /tmp/.X11-unix
+export PATH="$HOME/.local/bin:/usr/local/bin:$PATH"
+cd "$HOME"
+
+if [[ -n "${LAZYBOY_CONTROL_TOKEN:-}" ]]; then
+  lazyboy-controld >/tmp/lazyboy/control.log 2>&1 &
+fi
+
+if command -v dbus-launch >/dev/null 2>&1; then
+  eval "$(dbus-launch --sh-syntax)"
+fi
+
+lazyboy-screen boot-primary || exit 1
+pid=""
+if [[ -f /tmp/lazyboy/xvfb-1.pid ]]; then
+  pid="$(cat /tmp/lazyboy/xvfb-1.pid)"
+fi
+if [[ -z "$pid" ]]; then
+  echo "Xvfb pid missing" >&2
+  exit 1
+fi
+while kill -0 "$pid" 2>/dev/null; do
+  sleep 2
+done
+echo "Xvfb exited" >&2
+exit 1
diff --git a/image/computer/xfce/browser.desktop b/image/computer/xfce/browser.desktop
new file mode 100644
index 0000000..7250e86
--- /dev/null
+++ b/image/computer/xfce/browser.desktop
@@ -0,0 +1,10 @@
+[Desktop Entry]
+Type=Application
+Name=瀏覽器
+Name[zh_TW]=瀏覽器
+Comment=Chromium
+Exec=/usr/local/bin/lazyboy-browser https://duckduckgo.com
+Icon=web-browser
+Terminal=false
+Categories=Network;WebBrowser;GTK;
+StartupNotify=true
diff --git a/image/computer/xfce/helper-browser.desktop b/image/computer/xfce/helper-browser.desktop
new file mode 100644
index 0000000..0b7c690
--- /dev/null
+++ b/image/computer/xfce/helper-browser.desktop
@@ -0,0 +1,11 @@
+[Desktop Entry]
+Version=1.0
+Type=X-XFCE-Helper
+Icon=web-browser
+Name=瀏覽器
+Name[zh_TW]=瀏覽器
+StartupNotify=true
+X-XFCE-Binaries=lazyboy-browser;chromium;
+X-XFCE-Category=WebBrowser
+X-XFCE-Commands=/usr/local/bin/lazyboy-browser;
+X-XFCE-CommandsWithParameter=/usr/local/bin/lazyboy-browser "%s";
diff --git a/image/computer/xfce/helper-terminal.desktop b/image/computer/xfce/helper-terminal.desktop
new file mode 100644
index 0000000..1b4ae36
--- /dev/null
+++ b/image/computer/xfce/helper-terminal.desktop
@@ -0,0 +1,11 @@
+[Desktop Entry]
+Version=1.0
+Type=X-XFCE-Helper
+Icon=utilities-terminal
+Name=終端機
+Name[zh_TW]=終端機
+StartupNotify=true
+X-XFCE-Binaries=lazyboy-terminal;xfce4-terminal;
+X-XFCE-Category=TerminalEmulator
+X-XFCE-Commands=/usr/local/bin/lazyboy-terminal;
+X-XFCE-CommandsWithParameter=/usr/local/bin/lazyboy-terminal -e %s;
diff --git a/image/computer/xfce/helpers.rc b/image/computer/xfce/helpers.rc
new file mode 100644
index 0000000..4430fb3
--- /dev/null
+++ b/image/computer/xfce/helpers.rc
@@ -0,0 +1,4 @@
+WebBrowser=lazyboy-browser
+MailReader=thunderbird
+TerminalEmulator=lazyboy-terminal
+FileManager=thunar
diff --git a/image/computer/xfce/terminal.desktop b/image/computer/xfce/terminal.desktop
new file mode 100644
index 0000000..bdcfaf5
--- /dev/null
+++ b/image/computer/xfce/terminal.desktop
@@ -0,0 +1,10 @@
+[Desktop Entry]
+Type=Application
+Name=終端機
+Name[zh_TW]=終端機
+Comment=Zsh + Powerlevel10k
+Exec=/usr/local/bin/lazyboy-terminal
+Icon=utilities-terminal
+Terminal=false
+Categories=System;TerminalEmulator;GTK;
+StartupNotify=true
diff --git a/image/computer/xfce/thunar.xml b/image/computer/xfce/thunar.xml
new file mode 100644
index 0000000..6dbe365
--- /dev/null
+++ b/image/computer/xfce/thunar.xml
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<channel name="thunar" version="1.0">
+  <property name="last-view" type="string" value="ThunarIconView"/>
+  <property name="last-icon-view-zoom-level" type="string" value="THUNAR_ZOOM_LEVEL_100_PERCENT"/>
+  <property name="misc-single-click" type="bool" value="false"/>
+</channel>
diff --git a/image/computer/xfce/xfce4-desktop.xml b/image/computer/xfce/xfce4-desktop.xml
new file mode 100644
index 0000000..15e41b7
--- /dev/null
+++ b/image/computer/xfce/xfce4-desktop.xml
@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<channel name="xfce4-desktop" version="1.0">
+  <property name="desktop-icons" type="empty">
+    <property name="style" type="int" value="0"/>
+    <property name="file-icons" type="empty">
+      <property name="show-home" type="bool" value="false"/>
+      <property name="show-filesystem" type="bool" value="false"/>
+      <property name="show-trash" type="bool" value="false"/>
+      <property name="show-removable" type="bool" value="false"/>
+    </property>
+  </property>
+  <property name="desktop-menu" type="empty">
+    <property name="show" type="bool" value="true"/>
+    <property name="show-icons" type="bool" value="true"/>
+  </property>
+  <property name="windowlist-menu" type="empty">
+    <property name="show" type="bool" value="true"/>
+    <property name="show-icons" type="bool" value="true"/>
+    <property name="show-workspace-names" type="bool" value="false"/>
+  </property>
+  <property name="backdrop" type="empty">
+    <property name="screen0" type="empty">
+      <property name="monitor0" type="empty">
+        <property name="workspace0" type="empty">
+          <property name="color-style" type="int" value="0"/>
+          <property name="image-style" type="int" value="0"/>
+          <property name="rgba1" type="array">
+            <value type="double" value="0.0588235"/>
+            <value type="double" value="0.0901961"/>
+            <value type="double" value="0.164706"/>
+            <value type="double" value="1"/>
+          </property>
+        </property>
+      </property>
+    </property>
+  </property>
+</channel>
diff --git a/image/computer/xfce/xfce4-panel.xml b/image/computer/xfce/xfce4-panel.xml
new file mode 100644
index 0000000..44bf455
--- /dev/null
+++ b/image/computer/xfce/xfce4-panel.xml
@@ -0,0 +1,51 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<channel name="xfce4-panel" version="1.0">
+  <property name="configver" type="int" value="2"/>
+  <property name="panels" type="array">
+    <value type="int" value="1"/>
+    <property name="dark-mode" type="bool" value="true"/>
+    <property name="panel-1" type="empty">
+      <property name="position" type="string" value="p=8;x=640;y=798"/>
+      <property name="length" type="uint" value="100"/>
+      <property name="position-locked" type="bool" value="true"/>
+      <property name="size" type="uint" value="40"/>
+      <property name="icon-size" type="uint" value="24"/>
+      <property name="background-style" type="uint" value="0"/>
+      <property name="autohide-behavior" type="uint" value="0"/>
+      <property name="mode" type="uint" value="0"/>
+      <property name="plugin-ids" type="array">
+        <value type="int" value="1"/>
+        <value type="int" value="2"/>
+        <value type="int" value="3"/>
+        <value type="int" value="4"/>
+        <value type="int" value="5"/>
+      </property>
+    </property>
+  </property>
+  <property name="plugins" type="empty">
+    <property name="plugin-1" type="string" value="applicationsmenu">
+      <property name="show-generic-names" type="bool" value="false"/>
+      <property name="show-button-title" type="bool" value="true"/>
+      <property name="button-title" type="string" value="應用程式"/>
+    </property>
+    <property name="plugin-2" type="string" value="tasklist">
+      <property name="show-handle" type="bool" value="false"/>
+      <property name="show-labels" type="bool" value="true"/>
+      <property name="flat-buttons" type="bool" value="false"/>
+      <property name="grouping" type="uint" value="0"/>
+      <property name="include-all-workspaces" type="bool" value="true"/>
+    </property>
+    <property name="plugin-3" type="string" value="separator">
+      <property name="expand" type="bool" value="true"/>
+      <property name="style" type="uint" value="0"/>
+    </property>
+    <property name="plugin-4" type="string" value="systray"/>
+    <property name="plugin-5" type="string" value="clock">
+      <property name="mode" type="uint" value="2"/>
+      <property name="digital-format" type="string" value="%H:%M"/>
+      <property name="digital-layout" type="uint" value="3"/>
+      <property name="digital-time-format" type="string" value="%H:%M"/>
+      <property name="digital-date-format" type="string" value="%m/%d"/>
+    </property>
+  </property>
+</channel>
diff --git a/image/computer/xfce/xfwm4.xml b/image/computer/xfce/xfwm4.xml
new file mode 100644
index 0000000..936f98d
--- /dev/null
+++ b/image/computer/xfce/xfwm4.xml
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<channel name="xfwm4" version="1.0">
+  <property name="general" type="empty">
+    <property name="use_compositing" type="bool" value="false"/>
+    <property name="workspace_count" type="int" value="1"/>
+    <property name="wrap_windows" type="bool" value="false"/>
+    <property name="wrap_workspaces" type="bool" value="false"/>
+    <property name="click_to_focus" type="bool" value="true"/>
+    <property name="focus_new" type="bool" value="true"/>
+    <property name="raise_on_click" type="bool" value="true"/>
+    <property name="box_move" type="bool" value="false"/>
+    <property name="box_resize" type="bool" value="false"/>
+    <property name="snap_to_border" type="bool" value="true"/>
+    <property name="snap_to_windows" type="bool" value="true"/>
+    <property name="title_font" type="string" value="jf open 粉圓 2.1 11"/>
+    <property name="button_layout" type="string" value="O|HMC"/>
+    <property name="theme" type="string" value="Default"/>
+    <property name="double_click_action" type="string" value="maximize"/>
+  </property>
+</channel>
diff --git a/image/supervisor/Dockerfile b/image/supervisor/Dockerfile
new file mode 100644
index 0000000..cffd150
--- /dev/null
+++ b/image/supervisor/Dockerfile
@@ -0,0 +1,12 @@
+FROM rust:1-bookworm AS build
+WORKDIR /src
+COPY Cargo.toml Cargo.lock ./
+COPY crates crates
+COPY migrations migrations
+RUN cargo build --release -p lazyboy-supervisor
+
+FROM debian:bookworm-slim
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/*
+COPY --from=build /src/target/release/lazyboy-supervisor /usr/local/bin/lazyboy-supervisor
+EXPOSE 7091
+CMD ["lazyboy-supervisor"]
diff --git a/migrations/001_init.sql b/migrations/001_init.sql
new file mode 100644
index 0000000..904e299
--- /dev/null
+++ b/migrations/001_init.sql
@@ -0,0 +1,129 @@
+CREATE TABLE users (
+    id TEXT PRIMARY KEY,
+    name TEXT NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE spaces (
+    id TEXT PRIMARY KEY,
+    user_id TEXT NOT NULL REFERENCES users (id) ON DELETE CASCADE,
+    name TEXT NOT NULL,
+    is_default BOOLEAN NOT NULL DEFAULT TRUE,
+    default_model_provider TEXT NOT NULL DEFAULT 'xai',
+    default_model_id TEXT NOT NULL DEFAULT 'grok-4.6',
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX spaces_user_id_idx ON spaces (user_id);
+
+CREATE TABLE computers (
+    id TEXT PRIMARY KEY,
+    space_id TEXT NOT NULL REFERENCES spaces (id) ON DELETE CASCADE,
+    user_id TEXT NOT NULL,
+    scope TEXT NOT NULL,
+    scope_key TEXT NOT NULL UNIQUE,
+    home_key TEXT NOT NULL UNIQUE,
+    home_revision TEXT NOT NULL DEFAULT 'empty',
+    kind TEXT NOT NULL DEFAULT 'docker',
+    provider_ref TEXT,
+    state TEXT NOT NULL DEFAULT 'stopped',
+    control_holder TEXT NOT NULL DEFAULT 'none',
+    control_lease_id TEXT,
+    control_lease_expires_at TIMESTAMPTZ,
+    control_bot_id TEXT,
+    control_run_id TEXT,
+    control_fence INTEGER NOT NULL DEFAULT 0,
+    execution_run_id TEXT,
+    execution_bot_id TEXT,
+    execution_lease_expires_at TIMESTAMPTZ,
+    execution_fence INTEGER NOT NULL DEFAULT 0,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX computers_space_scope_idx ON computers (space_id, scope);
+
+CREATE TABLE bots (
+    id TEXT PRIMARY KEY,
+    space_id TEXT NOT NULL REFERENCES spaces (id) ON DELETE CASCADE,
+    user_id TEXT NOT NULL,
+    name TEXT NOT NULL,
+    title TEXT NOT NULL DEFAULT '',
+    description TEXT NOT NULL DEFAULT '',
+    instructions TEXT NOT NULL DEFAULT '',
+    computer_id TEXT REFERENCES computers (id) ON DELETE SET NULL,
+    model_provider TEXT,
+    model_id TEXT,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX bots_space_user_idx ON bots (space_id, user_id);
+CREATE INDEX bots_computer_id_idx ON bots (computer_id);
+
+CREATE TABLE computer_execution_leases (
+    id TEXT PRIMARY KEY,
+    computer_id TEXT NOT NULL REFERENCES computers (id) ON DELETE CASCADE,
+    bot_id TEXT NOT NULL,
+    run_id TEXT NOT NULL,
+    fence INTEGER NOT NULL DEFAULT 0,
+    expires_at TIMESTAMPTZ NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    UNIQUE (computer_id, bot_id)
+);
+
+CREATE INDEX computer_execution_leases_run_idx ON computer_execution_leases (run_id);
+CREATE INDEX computer_execution_leases_expiry_idx ON computer_execution_leases (computer_id, expires_at);
+
+CREATE TABLE threads (
+    id TEXT PRIMARY KEY,
+    space_id TEXT NOT NULL REFERENCES spaces (id) ON DELETE CASCADE,
+    bot_id TEXT UNIQUE REFERENCES bots (id) ON DELETE CASCADE,
+    user_id TEXT NOT NULL,
+    next_event_seq INTEGER NOT NULL DEFAULT 0,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE messages (
+    id TEXT PRIMARY KEY,
+    thread_id TEXT NOT NULL REFERENCES threads (id) ON DELETE CASCADE,
+    role TEXT NOT NULL,
+    body TEXT NOT NULL DEFAULT '',
+    run_id TEXT,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX messages_thread_idx ON messages (thread_id, created_at);
+
+CREATE TABLE runs (
+    id TEXT PRIMARY KEY,
+    space_id TEXT NOT NULL REFERENCES spaces (id) ON DELETE CASCADE,
+    bot_id TEXT NOT NULL REFERENCES bots (id) ON DELETE CASCADE,
+    thread_id TEXT NOT NULL REFERENCES threads (id) ON DELETE CASCADE,
+    user_id TEXT NOT NULL,
+    status TEXT NOT NULL,
+    trigger TEXT NOT NULL DEFAULT 'message',
+    prompt TEXT NOT NULL DEFAULT '',
+    lease_owner TEXT,
+    lease_fence INTEGER NOT NULL DEFAULT 0,
+    lease_expires_at TIMESTAMPTZ,
+    error TEXT,
+    started_at TIMESTAMPTZ,
+    completed_at TIMESTAMPTZ,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX runs_space_status_idx ON runs (space_id, status, updated_at);
+CREATE INDEX runs_bot_status_idx ON runs (bot_id, status);
+
+CREATE TABLE events (
+    id TEXT PRIMARY KEY,
+    thread_id TEXT NOT NULL REFERENCES threads (id) ON DELETE CASCADE,
+    seq INTEGER NOT NULL,
+    type TEXT NOT NULL,
+    payload JSONB NOT NULL DEFAULT '{}'::jsonb,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    UNIQUE (thread_id, seq)
+);
diff --git a/migrations/002_screens.sql b/migrations/002_screens.sql
new file mode 100644
index 0000000..c42aefa
--- /dev/null
+++ b/migrations/002_screens.sql
@@ -0,0 +1,35 @@
+ALTER TABLE computers
+    ADD COLUMN IF NOT EXISTS browser_profile_mode TEXT NOT NULL DEFAULT 'per-bot';
+
+CREATE TABLE IF NOT EXISTS computer_screens (
+    id TEXT PRIMARY KEY,
+    computer_id TEXT NOT NULL REFERENCES computers (id) ON DELETE CASCADE,
+    bot_id TEXT NOT NULL,
+    slot INTEGER NOT NULL,
+    display TEXT NOT NULL,
+    view_port INTEGER NOT NULL,
+    profile_mode TEXT NOT NULL DEFAULT 'per-bot',
+    profile_path TEXT NOT NULL,
+    control_holder TEXT NOT NULL DEFAULT 'none',
+    control_lease_id TEXT,
+    control_lease_expires_at TIMESTAMPTZ,
+    execution_run_id TEXT,
+    execution_lease_expires_at TIMESTAMPTZ,
+    execution_fence INTEGER NOT NULL DEFAULT 0,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    UNIQUE (computer_id, bot_id),
+    UNIQUE (computer_id, slot)
+);
+
+CREATE INDEX IF NOT EXISTS computer_screens_bot_idx ON computer_screens (bot_id);
+CREATE INDEX IF NOT EXISTS computer_screens_run_idx ON computer_screens (execution_run_id);
+
+CREATE TABLE IF NOT EXISTS computer_profile_locks (
+    computer_id TEXT NOT NULL REFERENCES computers (id) ON DELETE CASCADE,
+    profile_key TEXT NOT NULL,
+    bot_id TEXT NOT NULL,
+    run_id TEXT NOT NULL,
+    expires_at TIMESTAMPTZ NOT NULL,
+    PRIMARY KEY (computer_id, profile_key)
+);
diff --git a/reference/rakazo b/reference/rakazo
new file mode 160000
index 0000000..0f5c4ce
--- /dev/null
+++ b/reference/rakazo
@@ -0,0 +1 @@
+Subproject commit 0f5c4cefd59cdbe440deb7e05fd3f503164a6068
diff --git a/scripts/build-computer-image.sh b/scripts/build-computer-image.sh
new file mode 100755
index 0000000..66cfd8b
--- /dev/null
+++ b/scripts/build-computer-image.sh
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+set -euo pipefail
+root="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$root"
+docker build -f image/computer/Dockerfile -t lazyboy/computer:local .
+echo "built lazyboy/computer:local"
diff --git a/scripts/dev.sh b/scripts/dev.sh
new file mode 100755
index 0000000..8dc2a2d
--- /dev/null
+++ b/scripts/dev.sh
@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+set -euo pipefail
+root="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$root"
+docker compose up -d postgres
+echo "waiting for postgres..."
+for _ in $(seq 1 40); do
+  if docker compose exec -T postgres pg_isready -U lazyboy >/dev/null 2>&1; then
+    break
+  fi
+  sleep 0.5
+done
+if [[ -f "$root/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1091
+  source "$root/.env"
+  set +a
+fi
+export DATABASE_URL="${DATABASE_URL:-postgres://lazyboy:lazyboy@127.0.0.1:5434/lazyboy}"
+export SANDBOX_SUPERVISOR_TOKEN="${SANDBOX_SUPERVISOR_TOKEN:-dev-token}"
+export SANDBOX_SUPERVISOR_URL="${SANDBOX_SUPERVISOR_URL:-http://127.0.0.1:7092}"
+export SANDBOX_PROVIDER="${SANDBOX_PROVIDER:-docker}"
+export DATA_DIR="${DATA_DIR:-$root/data}"
+export API_BIND="${API_BIND:-0.0.0.0:3101}"
+export LAZYBOY_WEB_DIR="$root/apps/web"
+mkdir -p "$DATA_DIR"
+echo "start supervisor in another terminal: cargo run -p lazyboy-supervisor"
+echo "then: cargo run -p lazyboy-api"
+echo "listening on 0.0.0.0:3101"