Computer Lives in the Dialog

Not this: a harness page next to chat · typing a server secret into /daily · shipping @cloudflare/computer on Vercel · importing DeepSeek Harness · letting a plugin merge to main.

1 · The itch

Visitors already talk in one dialog: the site-agent Console. Owner work tried to grow a second surface — a computer window on /proof with plugins, proof, and a merge gate. Two windows that share a brain is a product bug. You look at chat. The computer is somewhere else. The reply and the queue disagree about where the work lives.

The law is the same as the orb essay: the dialog is the only place answers are allowed to land. Computer is not an answer-place. It is a tool inside that place.

One Console. Fast talk stays in the transcript. Heavy work says ⚡ queued. plus one human sentence. Same window. No second screen.

2 · What actually ships (surfaces)

• Site agent — AgentChat → POST /api/chat. Visitors get the existing agent. Owner heavy commands take a fast path: bolt, spoken line (what / which proof), computer after.
• Computer dock — ComputerConsoleDock above the transcript when the owner session is on. Plugins: inspect, scratch, screenshots, checks, patch, merge-as-gate. Visitors never see it.
• /proof — a KeyShield door and a signpost. Not a harness window. The button fires open-agent-chat.
• Tools arcade — slug computer, experiment tier. Honest: not a live product. Opens the Console; links this essay.
• KeyShield — WebAuthn PRF → HKDF → AES-256-GCM on this device (Touch ID / Face ID / Windows Hello). Server holds ciphertext only. Owner rooms no longer ask for a typed secret. Production enroll without an existing owner session stays off.

3 · Call path

visitor ask     →  POST /api/chat          →  existing agent  →  dialog
owner heavy     →  Edge fast path         →  ⚡ queued. + spoken  →  dialog
                →  Node runner            →  Cloudflare worker-shell (or local shim)
owner plugin    →  POST /api/agent/computer/tasks  →  same dock
visitor scratch →  same APIs, own Durable Object   →  no git, no merge
merge plugin    →  gate only              →  GitHub merge is not a tool
unlock          →  KeyShield PRF → HKDF → AES-GCM   →  owner cookie  →  dock appears

Chat stays Edge. The runner stays Node. Production (VERCEL_ENV === 'production') turns the computer on only when COMPUTER_PROTOTYPE=1 and the Worker URL + secret are set. Without those, the APIs stay 404 — Vercel disk is not a computer.

4 · Why not a computer window

A separate harness looks serious. It also splits attention: chat says queued, the window shows plugins, merge looks like a button that might ship. The owner already has a Console. Putting computer there means the spoken line and the dock share one scroll, one orb, one input. If the computer is slow, she can still talk. That was the contract: 回复也是需要的.

/daily no longer carries an owner door. The board is paper. Unlock is KeyShield on council / cabinet / this-device rooms, then the dock in Console.

5 · KeyShield, not a typed owner secret

A password field on a public page is a setting that teaches the secret's name. The door is the same method as KeyShield: biometric unlocks a WebAuthn PRF, HKDF binds it (keyshield-prf-v1:encryption-key / keyshield-prf-v1:vault-id), AES-256-GCM seals aileena-owner-v1 in the browser. The site only stores the envelope. It cannot read the key. No fallback password. Register on localhost for the prototype. Vercel production will not bootstrap a new passkey for a stranger. Council CLI can still use a server env for the terminal; the site UI does not.

POST /api/auth/passkey/options   →  challenge cookie + ciphertext envelope
platform authenticator + PRF     →  fingerprint / Face ID / Hello
HKDF-SHA-256                     →  AES-GCM (extractable: false) + vault id
open seal in the browser         →  then POST verify
POST /api/auth/passkey/verify    →  owner session cookie
typed secret in the dialog       →  gone
server                           →  ciphertext only

6 · What this is not

• Not @cloudflare/computer. That package wants a Worker and a Durable Object. This chat is Next on Vercel.
• Not DeepSeek Harness. Do not import @deepseek-ai/dsh. Identity stays Machina + DeepSeek for talk.
• Not merge. canMerge is always false. The merge plugin is a blocked gate in the same dialog.
• Not production. Local / preview only. Do not merge this prototype because it ran on localhost.

7 · How to try it (owner, localhost)

1. Open Console. Ordinary questions still answer.
2. Unlock with KeyShield on this device (or local experiment enter on the proof door).
3. The dock appears under the transcript. Queue inspect. You should see ⚡ queued. and a spoken proof id in the same dialog — then she still talks.
4. Merge stays grey. GitHub does not move.

Related: How the Console Speaks · How the Site Remembers · Computer on the tools bench.