omp: Use the AI Subscriptions You Already Pay For, From Any App

November 8, 2026 elias AI / LLM claude-code, coding-agents, omp

One local address for every AI plan you already pay for: how omp’s auth broker and gateway work, and how to run Claude Code through them.

If you’re like many people, you pay for more than one AI plan: ChatGPT Plus for work, Claude Pro, Max or Ultra for writing, GitHub Copilot or Cursor through your job, maybe a Z.AI GLM Coding Plan on the side. Each one works only inside its vendor’s own app.

Then you find a tool you’d like to try: an editor plugin, a notes app with an "AI" button, a script a friend shared, a different coding agent. It asks for an API key. That’s a separate product, billed per token, on top of the subscription you already pay for.

There’s a way around that. omp is an open-source coding agent, and it ships a small server that most people never notice: the auth gateway. You log in to your subscriptions once, and it gives every app on your machine one address to talk to. It speaks the same "API language" as OpenAI and Anthropic, which most AI tools already understand.

What that gets you:

One address for all your plans. Claude, ChatGPT/Codex, Copilot, Cursor, OpenCode, Z.AI and DeepSeek all sit behind http://127.0.0.1:4000, and the model name in each request decides which plan answers.
Tools that already work with it. Anything with a "custom base URL" or "OpenAI-compatible" setting connects: SDKs, editor plugins, curl, Claude Code, Codex CLI.
Your real logins stay put. Apps get one gateway token that you can rotate. Your passwords and OAuth tokens never leave omp’s vault.
Mix and match. Run Claude Code on a GPT model, or point an OpenAI-SDK script at Claude.

Here is the whole idea, start to finish:

omp auth-broker login openai-codex                     # 1. log in once, in your browser
omp auth-broker serve                                  # 2. the vault (leave it running)
OMP_AUTH_BROKER_URL=http://127.0.0.1:8765 \
  omp auth-gateway serve                               # 3. the gateway, in a second terminal
# 4. in any app: base URL http://127.0.0.1:4000/v1, API key = the output of `omp auth-gateway token`

The rest of this article covers the CLI, the setup in five phases, and then a worked example: setting up Claude Code to run through the gateway. Before you connect a consumer plan, read the note on subscription terms at the end.

Written against omp 18.18.1 (November 2026). The gateway is moving fast; check omp auth-gateway --help on your version.

How the pieces fit

  any client (curl, SDKs, Claude Code, Codex CLI, editor plugins…)
        │  Authorization: Bearer <gateway token>
        ▼
  omp auth-gateway serve      127.0.0.1:4000   /v1/messages, /v1/chat/completions, /v1/responses, …
        │  broker token (the gateway only)
        ▼
  omp auth-broker serve       127.0.0.1:8765   SQLite vault, background OAuth refresher
        │
        ▼
  api.anthropic.com · chatgpt.com (Codex) · api.githubcopilot.com · opencode.ai · …

The broker is the only process that holds OAuth refresh tokens. It refreshes them in the background (it checks every 60 s and renews anything due to expire within 5 minutes). It is not the endpoint clients call.
The gateway is a broker client. It receives a redacted credential snapshot, in which every refresh token is replaced by a sentinel, and asks the broker to refresh a credential when its access token expires. Each request goes through omp’s own provider code, so the request shaping, provider quirks and refresh-on-401 are the same ones omp’s agent uses. There is no raw passthrough.
Neither service runs omp’s agent loop. The client keeps its own planning, tools and conversation; omp supplies only upstream auth and format translation.

The CLI

Two command families, each with a handful of verbs.

`omp auth-broker`: the vault

omp auth-broker serve   [--bind=host:port] [--trust-proxy-headers]   # run the vault (default 127.0.0.1:8765)
omp auth-broker token   [--regenerate] [--json]                      # print or rotate the broker token
omp auth-broker list                                                 # every provider omp can log in to
omp auth-broker login   [<provider>] [--via=user@host] [--dry-run]   # log in (no provider: pick from a menu)
omp auth-broker logout  [<provider>]
omp auth-broker import  <file|dir> [--provider=<id>] [--dry-run]     # bring in exported credentials
omp auth-broker migrate --from-local [--include-oauth] [--include-env] [--dry-run]
omp auth-broker status  [--json]

omp auth-broker list is worth running once. On 18.18.1 it lists about sixty providers. The big ones:

Provider id	What it is
`anthropic`	Claude Pro, Max and Ultra plans
`openai-codex`	ChatGPT Plus/Pro (Codex subscription); `openai-codex-device` for headless logins
`github-copilot`	GitHub Copilot
`cursor`	Cursor (browser login; serves Claude, GPT and more)
`zai-coding-plan`, `zai`	Z.AI GLM Coding Plan: browser sign-in, or an API key (`ZAI_API_KEY`)
`opencode-go`, `opencode-zen`	OpenCode plans (API key, `OPENCODE_API_KEY`)
`deepseek`	DeepSeek (API key, `DEEPSEEK_API_KEY`)
`openrouter`, `kimi-code`, `google-gemini-cli`, `xai-oauth`, …	the long tail

`omp auth-gateway`: the HTTP front end

omp auth-gateway serve  [--bind=host:port] [--no-auth] [--clients=<file>] [--trust-proxy-headers]
omp auth-gateway token  [--regenerate] [--json]     # the token clients send (created on first run)
omp auth-gateway status [--json]                    # local token file + broker reachability
omp auth-gateway check  [--strict] [--json]         # probe every credential; --strict spends a little quota
omp auth-gateway stdio                              # same routes as JSON lines, for one parent process

serve needs to know where the broker is, through OMP_AUTH_BROKER_URL (or auth.broker.url in config.yml). The default bind is 127.0.0.1:4000.

Setup, in phases

Do every phase as the same OS user, with the same omp config. The broker reads the credential store that your logins wrote, and a different user or profile means a different, empty store.

Phase 1: log in to your subscriptions

omp auth-broker login anthropic          # Claude Pro/Max/Ultra
omp auth-broker login openai-codex       # ChatGPT Plus/Pro (Codex)
omp auth-broker login github-copilot     # Copilot
omp auth-broker login cursor             # Cursor
omp auth-broker login zai-coding-plan    # Z.AI GLM Coding Plan

Each one prints a URL to open in a browser, and some ask you to paste a code back. API-key providers such as OpenCode and DeepSeek go through omp’s interactive login instead: run omp, type /login, and pick the provider. For OpenCode it points you to https://opencode.ai/auth and stores the key as OPENCODE_API_KEY; DeepSeek works the same way with DEEPSEEK_API_KEY.

Check each login before going further:

omp models openai-codex
omp -p --no-session --model openai-codex/gpt-5.6-sol "Reply with exactly: PONG"

Phase 2: start the broker

omp auth-broker serve

On first start it writes its token to <config-dir>/auth-broker.token (mode 0600). Leave it running in its own terminal, screen or tmux window, or service.

Phase 3: start the gateway

In a second terminal:

OMP_AUTH_BROKER_URL=http://127.0.0.1:8765 omp auth-gateway serve

On the same host and user, the gateway finds the broker token file by itself. A gateway on another host or user needs the broker token passed explicitly.

The gateway rebuilds its model catalog every 15 minutes and checks for credential changes every 10 seconds. Still, restart the gateway after adding or removing a login. It is the quickest way to be sure /v1/models reflects the change.

Phase 4: choose how clients authenticate

By default every route except /healthz requires the gateway token:

export OMP_GATEWAY_TOKEN="$(omp auth-gateway token)"

There are two alternatives.

--no-auth turns the bearer check off. Any process that can reach the listener can spend your subscriptions, so use it only on loopback, and keep --bind explicit, because the flag doesn’t force a loopback bind:
```
OMP_AUTH_BROKER_URL=http://127.0.0.1:8765 \
  omp auth-gateway serve --bind=127.0.0.1:4000 --no-auth
```
--clients=<file> admits extra, scoped tokens. Each one is limited to a list of models and accounts. The file stores only SHA-256 digests and is re-read every 10 seconds while the gateway runs:
```
{
  "ci": {
    "tokenSha256": "<printf %s \"$TOKEN\" | shasum -a 256>",
    "models": ["openai-codex/*", "anthropic/claude-haiku-5-5"]
  }
}
```
A model outside the list answers 404 Unknown model, and that client’s /v1/models shows only what it was granted.

Phase 5: smoke test

G=http://127.0.0.1:4000
AUTH="Authorization: Bearer $OMP_GATEWAY_TOKEN"

curl -s $G/healthz                                   # {"ok":true,"version":"18.18.1"}
curl -s $G/v1/models -H "$AUTH" | jq -r '.data[].id'

/v1/models is the authoritative list of what you can call: the catalog, filtered to the providers you hold credentials for. Each row carries more than an ID:

{
  "id": "anthropic/claude-fable-5",
  "owned_by": "anthropic",
  "api": "anthropic-messages",
  "display_name": "Claude Fable 5",
  "input_modalities": ["text", "image"],
  "context_length": 1000000,
  "max_output_tokens": 128000
}

Then one request per chat format:

# Anthropic Messages
curl -s $G/v1/messages -H "$AUTH" -H 'anthropic-version: 2023-06-01' -H 'Content-Type: application/json' \
  -d '{"model":"anthropic/claude-haiku-5-5","max_tokens":100,
       "messages":[{"role":"user","content":"What is 17*3?"}]}'

# OpenAI Chat Completions
curl -s $G/v1/chat/completions -H "$AUTH" -H 'Content-Type: application/json' \
  -d '{"model":"openai-codex/gpt-5.6-sol","messages":[{"role":"user","content":"What is 17*3?"}]}'

# OpenAI Responses
curl -s $G/v1/responses -H "$AUTH" -H 'Content-Type: application/json' \
  -d '{"model":"openai-codex/gpt-6.1-sol","input":"What is 17*3?"}'

Add "stream": true to get SSE back in the same wire format.

Routing: the path picks the format, `model` picks the backend

Path	Wire format
`POST /v1/messages`	Anthropic Messages
`POST /v1/chat/completions`	OpenAI Chat Completions
`POST /v1/responses`	OpenAI Responses
`POST /v1/pi/stream`	omp’s native stream format

The gateway never guesses the format from the body. The backend comes only from the model field, as provider/model-id, so the two are independent. Here is an Anthropic-format request answered by a Codex subscription, a real reply:

{
  "type": "message",
  "role": "assistant",
  "model": "openai-codex/gpt-5.6-sol",
  "content": [{ "type": "text", "text": "17 × 3 is 51." }],
  "stop_reason": "end_turn",
  "usage": { "input_tokens": 18, "output_tokens": 12, "cache_read_input_tokens": 0, "cache_creation_input_tokens": 0 }
}

Bare IDs work too. gpt-5.6-sol with no prefix goes to the highest-ranked provider that serves it. Native accounts (openai-codex, anthropic, openai) rank ahead of aggregators, and modelProviderOrder in config.yml overrides the ranking. Use the prefixed form when it matters which account pays.

Beyond chat

The gateway has more routes than chat. They are real, but omp doesn’t generate audio or images itself. Each route forwards to a provider that offers that kind of model, so it only works once the broker holds a login for such a provider:

Route	What	Who serves it (omp 18.18.1)
`POST /v1/images/generations`, `/v1/images/edits`	image generation and edits (OpenAI Images wire)	Codex subscription (`gpt-image-2`), OpenAI API key, OpenRouter
`POST /v1/audio/speech`	text-to-speech, returns raw audio	xAI (`grok-tts`: API key, or the SuperGrok / X Premium+ login), OpenRouter, DeepInfra
`POST /v1/audio/transcriptions`	speech-to-text (multipart `file`, 25 MiB cap)	OpenAI API key, OpenRouter
`POST /v1/embeddings`	embeddings (OpenAI wire)	OpenAI API key, OpenRouter
`POST /v1/rerank`	rerank (OpenRouter wire)	OpenRouter
`POST /v1/videos`, `GET /v1/videos/:id[/content]`	video jobs: submit, poll, download	OpenRouter
`GET /v1/usage`	your subscription usage windows, across every account	every login
`GET /v1/credentials/check`	per-credential health, handy when something starts returning 401	every login

Of the big subscriptions, only Codex adds anything here: image generation. Claude, Copilot, Cursor, OpenCode, Z.AI and DeepSeek are chat-only through the gateway. An OpenRouter key turns on almost every route, and the "OpenAI API key" rows mean a direct OPENAI_API_KEY, not the Codex login.

/v1/models marks non-chat rows with a kind field (image, tts, stt, embedding, rerank, video, …), so check there what your logins actually unlock. With no provider for a modality, its route has no model to call and the request is refused. Sending a chat route a non-chat model fails with a 400 that names the route to use instead.

omp auth-gateway stdio serves all of these to a single parent process over stdin/stdout, with no port and no token. It suits editor plugins and scripts:

echo '{"id":1,"path":"/v1/chat/completions","body":{"model":"@smol","messages":[{"role":"user","content":"hi"}]}}' \
  | omp auth-gateway stdio

Unlike serve, stdio uses your normal omp setup, including models.yml, extension providers and role selectors like @smol.

Worked example: Claude Code on the gateway

Claude Code speaks Anthropic Messages, and it lets you replace its endpoint and credential through environment variables.

1. The essentials

export ANTHROPIC_BASE_URL=http://127.0.0.1:4000          # no /v1: Claude Code appends it
export ANTHROPIC_AUTH_TOKEN="$OMP_GATEWAY_TOKEN"          # sent as Authorization: Bearer
unset ANTHROPIC_API_KEY
export CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1       # let /model list the gateway's models
claude

Use ANTHROPIC_AUTH_TOKEN, not ANTHROPIC_API_KEY. The gateway accepts only Authorization: Bearer, and ANTHROPIC_API_KEY sends x-api-key, which gets a 401. With --no-auth the token is ignored, but set it to a placeholder such as unused if a client insists on one.

Inside Claude Code, run /status to confirm the base URL, and /model to pick from what the gateway serves. A gateway ID that’s missing from the picker can be added with ANTHROPIC_CUSTOM_MODEL_OPTION=anthropic/claude-sonnet-5-5.

2. Pin every model slot

Claude Code doesn’t use one model for everything. Background tasks, the "fast" model and subagents each pick their own. If you don’t set them, they ask the gateway for model names it may not serve. Pin them all:

M=anthropic/claude-sonnet-5-5
export ANTHROPIC_MODEL=$M
export ANTHROPIC_DEFAULT_OPUS_MODEL=$M
export ANTHROPIC_DEFAULT_SONNET_MODEL=$M
export ANTHROPIC_DEFAULT_HAIKU_MODEL=anthropic/claude-haiku-5-5   # cheaper model for background work
export ANTHROPIC_DEFAULT_FABLE_MODEL=$M
export CLAUDE_CODE_SUBAGENT_MODEL=$M

3. Or: Claude Code’s harness, a GPT brain

Because the backend is just the model field, you can point the same Claude Code at your Codex subscription:

M=gpt-5.6-sol            # bare ID; resolves to openai-codex/gpt-5.6-sol
export ANTHROPIC_MODEL=$M ANTHROPIC_DEFAULT_OPUS_MODEL=$M ANTHROPIC_DEFAULT_SONNET_MODEL=$M \
       ANTHROPIC_DEFAULT_HAIKU_MODEL=$M ANTHROPIC_DEFAULT_FABLE_MODEL=$M CLAUDE_CODE_SUBAGENT_MODEL=$M
export CLAUDE_CODE_EFFORT_LEVEL=high
claude

This works day to day. The tool calls translate, streaming works and the agent loop runs. Anthropic doesn’t support Claude Code on non-Claude models, though, and features that exist on only one side (prompt caching details, some thinking controls, server-side tools) don’t translate into each other.

4. Wrap it

Put the block in a small launcher script (claude-omp) and keep Claude Code’s state separate from your normal setup with CLAUDE_CONFIG_DIR=~/.claude-omp. Then your regular claude stays on its own login, and claude-omp runs on the gateway.

Other clients, briefly

OpenAI SDKs and tools use base_url="http://127.0.0.1:4000/v1" with the gateway token as the API key.
Codex CLI needs a custom provider with base URL http://127.0.0.1:4000/v1, the responses wire API, the gateway token, and an exact model ID from /v1/models. Its own ChatGPT login has nothing to do with omp’s Codex login.
Anything Anthropic-shaped uses the Claude Code variables above.

Two tokens, different power

Token	File	Grants	Give it to
Gateway token	`<config-dir>/auth-gateway.token`	inference through the gateway, never the upstream credentials	your clients
Broker token	`<config-dir>/auth-broker.token`	credential snapshots: real OAuth access tokens and stored API keys	the gateway, and nothing else

"Clients need no API keys" means clients never receive an upstream credential. It doesn’t mean the gateway is open. The gateway token is a real secret, and anyone holding it can spend your quota. Transport security is up to you: the gateway speaks plain HTTP, so if it leaves loopback, put TLS or a private network in front of it. A request that carries the gateway token in its URL, or in a logged or forwarded header, is rejected before any credential lookup, which keeps the token out of logs.

Limits and gotchas

models.yml is ignored by serve. Your custom providers, local base URLs and overrides are deliberately left out, so local config can’t redirect broker-backed traffic. (stdio honours them.)
No aliases and no default model. Clients must send a model the gateway serves.
No web-search route. Clients’ built-in web-search tools aren’t backed by omp’s search engines.
A catalog entry is not account access. /v1/models lists what your credentials can reach in principle, and your plan decides the rest.
Envelope translation is not feature parity. A cross-format request carries text, images, tools and streaming, not every vendor-specific knob.
Same user, same config. Most "it lists no models" problems come from a broker started under a different user or profile from the one that did the logins.

A note on subscription terms

The gateway makes it easy to use a consumer subscription from any client. Whether your subscription allows that is a separate question, and the answer differs by vendor and changes over time. Claude Pro/Max/Ultra in particular is meant for Anthropic’s own apps and Claude Code, and re-exposing it to other clients can get an account flagged. omp offering a login doesn’t make every use of it allowed. Read the current terms for each plan you wire in. Where it matters, use the provider’s API-key option, which the gateway routes the same way.

Originally published in TheBigPromptLibrary on GitHub (view source).
⭐ Star the library on GitHub for more system prompts and research.

Full system inventory of the Perplexity Computer VM

October 23, 2026November 9, 2026 elias AI / LLM perplexity, sandbox

Perplexity Computer runs on a VM. Behind the answer engine is a real Linux machine with a shell, a package manager, compilers, an office suite, and a headless X desktop. The agent can write and run code there, convert and generate documents, drive GUI applications, and keep files on disk for the length of the session.

So the same question I asked about the ChatGPT Work VM applies here: what is the machine? How many cores, how much RAM, how much disk, what is preinstalled, and what does the agent run as? This is the full inventory: CPU, memory, storage, cgroup limits, mounts, devices, privileges, toolchains, the desktop stack, and the complete Debian, Python, and Node package lists.

Captured 2026-10-23 03:05:48 UTC from a live session. Every figure below is a reading taken at that moment, not the model’s recollection of its own environment. No environment-variable values, credentials, network addresses, or machine identifiers were collected.

Not a pristine image. SWI-Prolog and its dependencies were installed earlier in the same conversation, so they appear in the package lists below. Everything else is what the session came with.

Practical capacity, up front

If you are sizing up what to run in this thing, the useful limits are:

2 vCPUs (Intel Xeon, Ice Lake-SP class, AVX-512)
7.8 GiB guest RAM, with a cgroup ceiling of 7.646 GiB (memory.max = 8,210,063,360 bytes)
No swap
20 GB ext4 root disk, about 13 GB available
Passwordless sudo, so you can apt install whatever is missing
847 Debian packages, 145 Python distributions, and a handful of global Node CLIs
A headless desktop stack: Xvfb, Openbox, xfce4-panel, Alacritty, plus the full LibreOffice suite
No GPU, Docker/Podman, clang, CMake, Ninja, gdb, Java, Go, or Rust preinstalled

This is a small box. It is good for document work (office files, PDFs, OCR, media conversion), scripting in Python/Node, and small C/C++ builds. It is not the place for heavy parallel builds or anything that needs more than ~7 GiB of RAM. Because you have root, most missing tools are one sudo apt install away, which is how SWI-Prolog got there.

The rest of this article is the evidence behind those numbers.

Important scope note

This describes the execution sandbox used for shell commands, not the infrastructure that serves the language model. Physical host resources, model weights, inference accelerators, and any external tool-service machines are not observable from inside it.

Unlike the ChatGPT Work VM, this guest does not hide /proc and /sys. Standard tools such as lscpu, free, df, and lsblk work normally, and the raw output is reproduced below.

Resource usage is a point-in-time reading. A device node or an installed package does not by itself prove that a physical device is attached or that a service is running.

Operating system

Item	Value
Distribution	Ubuntu 26.04.1 LTS
Codename	Resolute Raccoon
Kernel	Linux 6.1.155
Kernel build	`#1 SMP PREEMPT_DYNAMIC @1760348006`
Architecture	x86_64
Virtualization	KVM (full)
Hostname	`space-sandbox`
User	`uid=2000(user) gid=2000(user) groups=2000(user)`
Init	systemd 259.5

The userland is very new (Ubuntu 26.04, GCC 15, Python 3.14), but the kernel is a 6.1 LTS build. That is a custom guest kernel supplied by the VM platform, not Ubuntu’s stock kernel. The space-sandbox hostname and the space.slice cgroup (see below) are the only Perplexity-specific names at the OS level.

Linux space-sandbox 6.1.155 #1 SMP PREEMPT_DYNAMIC @1760348006 x86_64 GNU/Linux
PRETTY_NAME="Ubuntu 26.04.1 LTS"
NAME="Ubuntu"
VERSION_ID="26.04"
VERSION="26.04.1 LTS (Resolute Raccoon)"
VERSION_CODENAME=resolute
ID=ubuntu
ID_LIKE=debian
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=resolute
LOGO=ubuntu-logo
uid=2000(user) gid=2000(user) groups=2000(user)

CPU

Item	Value
Assigned processors	2 vCPUs (IDs 0–1)
Model name	Intel Xeon Processor @ 2.90 GHz
Family / model / stepping	6 / 106 / 6 (Ice Lake-SP)
Threads per core	1
Cores per socket / sockets	2 / 1
Address sizes	46 bits physical, 57 bits virtual
L1d / L1i	96 KiB / 64 KiB (2 instances)
L2	2.5 MiB (2 instances)
L3	54 MiB (1 instance)
NUMA nodes	1
Hypervisor	KVM

Family 6 model 106 is Ice Lake-SP (3rd-gen Xeon Scalable). The model string is generic ("Intel(R) Xeon(R) Processor"), which is typical of cloud guests that mask the exact SKU. One thread per core means no SMT siblings are exposed to the guest.

Exposed instruction support includes SSE through SSE4.2, AVX, AVX2, FMA, BMI1/2, AES, PCLMUL, VAES, VPCLMULQDQ, SHA-NI, GFNI, RDRAND, RDSEED, and AVX-512 F, DQ, CD, BW, VL, IFMA, VBMI, VBMI2, VNNI, BITALG, and VPOPCNTDQ. The guest reports standard mitigations for Spectre v1/v2, Speculative Store Bypass, and MMIO stale data, with TSX disabled.

Full lscpu output:

Architecture:                            x86_64
CPU op-mode(s):                          32-bit, 64-bit
Address sizes:                           46 bits physical, 57 bits virtual
Byte Order:                              Little Endian
CPU(s):                                  2
On-line CPU(s) list:                     0,1
Vendor ID:                               GenuineIntel
Model name:                              Intel(R) Xeon(R) Processor @ 2.90GHz
CPU family:                              6
Model:                                   106
Thread(s) per core:                      1
Core(s) per socket:                      2
Socket(s):                               1
Stepping:                                6
BogoMIPS:                                5799.92
Flags:                                   fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts mmx fxsr sse sse2 ss ht syscall nx pdpe1gb rdtscp lm constant_tsc pebs bts rep_good nopl xtopology nonstop_tsc cpuid tsc_known_freq pni pclmulqdq dtes64 ssse3 fma cx16 pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand hypervisor lahf_lm abm 3dnowprefetch cpuid_fault invpcid_single ssbd ibrs ibpb stibp ibrs_enhanced fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid avx512f avx512dq rdseed adx smap avx512ifma clflushopt clwb avx512cd sha_ni avx512bw avx512vl xsaveopt xsavec xgetbv1 xsaves wbnoinvd arat avx512vbmi umip pku ospke avx512_vbmi2 gfni vaes vpclmulqdq avx512_vnni avx512_bitalg avx512_vpopcntdq rdpid fsrm md_clear flush_l1d arch_capabilities
Hypervisor vendor:                       KVM
Virtualization type:                     full
L1d cache:                               96 KiB (2 instances)
L1i cache:                               64 KiB (2 instances)
L2 cache:                                2.5 MiB (2 instances)
L3 cache:                                54 MiB (1 instance)
NUMA node(s):                            1
NUMA node0 CPU(s):                       0,1
Vulnerability Gather data sampling:      Not affected
Vulnerability Indirect target selection: Mitigation; Aligned branch/return thunks
Vulnerability Itlb multihit:             Not affected
Vulnerability L1tf:                      Not affected
Vulnerability Mds:                       Not affected
Vulnerability Meltdown:                  Not affected
Vulnerability Mmio stale data:           Mitigation; Clear CPU buffers; SMT Host state unknown
Vulnerability Reg file data sampling:    Not affected
Vulnerability Retbleed:                  Not affected
Vulnerability Spec rstack overflow:      Not affected
Vulnerability Spec store bypass:         Mitigation; Speculative Store Bypass disabled via prctl
Vulnerability Spectre v1:                Mitigation; usercopy/swapgs barriers and __user pointer sanitization
Vulnerability Spectre v2:                Mitigation; Enhanced / Automatic IBRS; IBPB conditional; PBRSB-eIBRS SW sequence; BHI SW loop, KVM SW loop
Vulnerability Srbds:                     Not affected
Vulnerability Tsa:                       Not affected
Vulnerability Tsx async abort:           Mitigation; TSX disabled
Vulnerability Vmscape:                   Not affected

Memory and storage

Item	Value
Total RAM	7.8 GiB
Used at capture	345 MiB
Free	7.2 GiB
Available	7.4 GiB
Swap	0
Root filesystem	`/dev/root` (ext4 on `vda`), 20 GB
Root used / available	6.7 GB / 13 GB (35%)
`/dev/shm` (tmpfs)	3.9 GiB
`/run` (tmpfs)	1.6 GiB

No swap. Whatever you run either fits in roughly 7.6 GiB or the cgroup OOM-kills it. The root disk is a single virtio block device, and a third of it is already used by the base image.

               total        used        free      shared  buff/cache   available
Mem:           7.8Gi       345Mi       7.2Gi       6.8Mi       526Mi       7.4Gi
Swap:             0B          0B          0B
Filesystem     Type   Size  Used Avail Use% Mounted on
/dev/root      ext4    20G  6.7G   13G  35% /
tmpfs          tmpfs  3.9G     0  3.9G   0% /dev/shm
tmpfs          tmpfs  1.6G  6.1M  1.6G   1% /run
NAME TYPE SIZE FSTYPE MOUNTPOINTS MODEL
vda  disk  20G        /

Cgroup resource limits

The workload runs inside a two-level cgroup v2 hierarchy:

Limit	`space.slice`	`space-workloads.service/workloads`
`memory.max`	8,210,063,360 (7.646 GiB)	8,210,063,360 (7.646 GiB)
`memory.current`	438,935,552	429,068,288
`memory.swap.max`	max	max
`cpu.max`	max 100000 (no quota)	max 100000 (no quota)
`cpuset.cpus.effective`	0-1	—
`pids.max`	32,000	28,000

There is no CPU quota, so you get both vCPUs at full speed. The real ceilings are memory and process count.

/sys/fs/cgroup/space.slice
memory.max: 8210063360
memory.current: 438935552
memory.swap.max: max
cpu.max: max 100000
cpuset.cpus.effective: 0-1
pids.max: 32000

/sys/fs/cgroup/space.slice/space-workloads.service/workloads
memory.max: 8210063360
memory.current: 429068288
memory.swap.max: max
cpu.max: max 100000
pids.max: 28000

Mounts

A conventional systemd guest: an ext4 root on /dev/vda, with proc, sysfs, and a cgroup2 hierarchy mounted normally. securityfs, selinuxfs, bpf, tracefs, and pstore are also mounted. Nothing here is a bind-mounted overlay or a hidden pseudo-filesystem, which is quite different from the locked-down ChatGPT box.

/ /dev/vda ext4 rw,relatime
/dev devtmpfs devtmpfs rw,relatime,size=4071212k,nr_inodes=1017803,mode=755
/proc proc proc rw,nosuid,nodev,noexec,relatime
/sys sysfs sysfs rw,nosuid,nodev,noexec,relatime
/sys/kernel/security securityfs securityfs rw,nosuid,nodev,noexec,relatime
/sys/fs/selinux selinuxfs selinuxfs rw,nosuid,noexec,relatime
/dev/shm tmpfs tmpfs rw,nosuid,nodev
/dev/pts devpts devpts rw,nosuid,noexec,relatime,gid=5,mode=600,ptmxmode=000
/run tmpfs tmpfs rw,nosuid,nodev,size=1629744k,nr_inodes=819200,mode=755
/sys/fs/cgroup cgroup2 cgroup2 rw,nosuid,nodev,noexec,relatime,nsdelegate,memory_recursiveprot
/sys/fs/pstore pstore pstore rw,nosuid,nodev,noexec,relatime
/sys/fs/bpf bpf bpf rw,nosuid,nodev,noexec,relatime,mode=700
/proc/sys/fs/binfmt_misc systemd-1 autofs rw,relatime,fd=35,pgrp=1,timeout=0,minproto=5,maxproto=5,direct
/sys/kernel/tracing tracefs tracefs rw,nosuid,nodev,noexec,relatime
/run/credentials/systemd-journald.service none ramfs ro,nosuid,nodev,noexec,relatime,nosymfollow,mode=700

Devices

No PCI or USB devices are enumerated, and there are no GPU device nodes.
Three virtio devices: virtio_blk (the root disk), virtio_net, and vmw_vsock_virtio_transport (a host↔guest vsock channel, typically used by the orchestrator to talk to an in-guest agent).
An emulated AT Raw Set 2 keyboard.
/dev/vmclock0, /dev/sysgenid, and /dev/ptp0. These are VM clock and generation-ID devices used by snapshot/restore-capable microVM platforms. They let a guest notice it has been cloned or resumed from a snapshot and resync its clock and random state. Together with the absence of PCI, this points to a Firecracker-style microVM restored from a warm snapshot, rather than a conventional full VM.

PCI:

USB:

Virtio drivers:
virtio0: ../../../../bus/virtio/drivers/virtio_blk
virtio1: ../../../../bus/virtio/drivers/virtio_net
virtio2: ../../../../bus/virtio/drivers/vmw_vsock_virtio_transport

Input device:
AT Raw Set 2 keyboard

Device nodes:
total 0
crw-r--r-- 1 root root  10, 235 Oct 22 22:37 autofs
crw------- 1 root root   5,   1 Oct 23 03:04 console
lrwxrwxrwx 1 root root      11 Oct 22 22:37 core -> /proc/kcore
drwxr-xr-x 4 root root      80 Oct 22 22:37 cpu
crw------- 1 root root  10, 122 Oct 22 22:37 cpu_dma_latency
lrwxrwxrwx 1 root root      13 Oct 22 22:37 fd -> /proc/self/fd
crw-rw-rw- 1 root root   1,   7 Oct 22 22:37 full
crw------- 1 root root  10, 183 Oct 22 22:37 hwrng
drwxr-xr-x 2 root root      60 Oct 22 22:37 input
crw-r--r-- 1 root root   1,  11 Oct 22 22:37 kmsg
lrwxrwxrwx 1 root root      28 Oct 22 22:37 log -> /run/systemd/journal/dev-log
crw-rw---- 1 root disk  10, 237 Oct 22 22:37 loop-control
brw------- 1 root root   7,   0 Oct 22 22:37 loop0
brw------- 1 root root   7,   1 Oct 22 22:37 loop1
brw------- 1 root root   7,   2 Oct 22 22:37 loop2
brw------- 1 root root   7,   3 Oct 22 22:37 loop3
brw------- 1 root root   7,   4 Oct 22 22:37 loop4
brw------- 1 root root   7,   5 Oct 22 22:37 loop5
brw------- 1 root root   7,   6 Oct 22 22:37 loop6
brw------- 1 root root   7,   7 Oct 22 22:37 loop7
crw------- 1 root root   1,   1 Oct 22 22:37 mem
crw-rw-rw- 1 root root   1,   3 Oct 22 22:37 null
crw------- 1 root root   1,   4 Oct 22 22:37 port
crw-rw-rw- 1 root root   5,   2 Oct 22 22:37 ptmx
crw------- 1 root root 250,   0 Oct 22 22:37 ptp0
drwxr-xr-x 2 root root       0 Oct 22 22:37 pts
crw-rw-rw- 1 root root   1,   8 Oct 22 22:37 random
drwxrwxrwt 2 root root      40 Oct 22 22:37 shm
crw------- 1 root root  10, 231 Oct 22 22:37 snapshot
lrwxrwxrwx 1 root root      15 Oct 22 22:37 stderr -> /proc/self/fd/2
lrwxrwxrwx 1 root root      15 Oct 22 22:37 stdin -> /proc/self/fd/0
lrwxrwxrwx 1 root root      15 Oct 22 22:37 stdout -> /proc/self/fd/1
crw------- 1 root root  10, 125 Oct 22 22:37 sysgenid
crw-rw-rw- 1 root root   5,   0 Oct 22 22:37 tty
crw------- 1 root root   4,   0 Oct 22 22:37 tty0
crw------- 1 root root   4,   1 Oct 22 22:37 tty1
crw------- 1 root root   4,  10 Oct 22 22:37 tty10
crw------- 1 root root   4,  11 Oct 22 22:37 tty11
crw------- 1 root root   4,  12 Oct 22 22:37 tty12
crw------- 1 root root   4,  13 Oct 22 22:37 tty13
crw------- 1 root root   4,  14 Oct 22 22:37 tty14
crw------- 1 root root   4,  15 Oct 22 22:37 tty15
crw------- 1 root root   4,  16 Oct 22 22:37 tty16
crw------- 1 root root   4,  17 Oct 22 22:37 tty17
crw------- 1 root root   4,  18 Oct 22 22:37 tty18
crw------- 1 root root   4,  19 Oct 22 22:37 tty19
crw------- 1 root root   4,   2 Oct 22 22:37 tty2
crw------- 1 root root   4,  20 Oct 22 22:37 tty20
crw------- 1 root root   4,  21 Oct 22 22:37 tty21
crw------- 1 root root   4,  22 Oct 22 22:37 tty22
crw------- 1 root root   4,  23 Oct 22 22:37 tty23
crw------- 1 root root   4,  24 Oct 22 22:37 tty24
crw------- 1 root root   4,  25 Oct 22 22:37 tty25
crw------- 1 root root   4,  26 Oct 22 22:37 tty26
crw------- 1 root root   4,  27 Oct 22 22:37 tty27
crw------- 1 root root   4,  28 Oct 22 22:37 tty28
crw------- 1 root root   4,  29 Oct 22 22:37 tty29
crw------- 1 root root   4,   3 Oct 22 22:37 tty3
crw------- 1 root root   4,  30 Oct 22 22:37 tty30
crw------- 1 root root   4,  31 Oct 22 22:37 tty31
crw------- 1 root root   4,  32 Oct 22 22:37 tty32
crw------- 1 root root   4,  33 Oct 22 22:37 tty33
crw------- 1 root root   4,  34 Oct 22 22:37 tty34
crw------- 1 root root   4,  35 Oct 22 22:37 tty35
crw------- 1 root root   4,  36 Oct 22 22:37 tty36
crw------- 1 root root   4,  37 Oct 22 22:37 tty37
crw------- 1 root root   4,  38 Oct 22 22:37 tty38
crw------- 1 root root   4,  39 Oct 22 22:37 tty39
crw------- 1 root root   4,   4 Oct 22 22:37 tty4
crw------- 1 root root   4,  40 Oct 22 22:37 tty40
crw------- 1 root root   4,  41 Oct 22 22:37 tty41
crw------- 1 root root   4,  42 Oct 22 22:37 tty42
crw------- 1 root root   4,  43 Oct 22 22:37 tty43
crw------- 1 root root   4,  44 Oct 22 22:37 tty44
crw------- 1 root root   4,  45 Oct 22 22:37 tty45
crw------- 1 root root   4,  46 Oct 22 22:37 tty46
crw------- 1 root root   4,  47 Oct 22 22:37 tty47
crw------- 1 root root   4,  48 Oct 22 22:37 tty48
crw------- 1 root root   4,  49 Oct 22 22:37 tty49
crw------- 1 root root   4,   5 Oct 22 22:37 tty5
crw------- 1 root root   4,  50 Oct 22 22:37 tty50
crw------- 1 root root   4,  51 Oct 22 22:37 tty51
crw------- 1 root root   4,  52 Oct 22 22:37 tty52
crw------- 1 root root   4,  53 Oct 22 22:37 tty53
crw------- 1 root root   4,  54 Oct 22 22:37 tty54
crw------- 1 root root   4,  55 Oct 22 22:37 tty55
crw------- 1 root root   4,  56 Oct 22 22:37 tty56
crw------- 1 root root   4,  57 Oct 22 22:37 tty57
crw------- 1 root root   4,  58 Oct 22 22:37 tty58
crw------- 1 root root   4,  59 Oct 22 22:37 tty59
crw------- 1 root root   4,   6 Oct 22 22:37 tty6
crw------- 1 root root   4,  60 Oct 22 22:37 tty60
crw------- 1 root root   4,  61 Oct 22 22:37 tty61
crw------- 1 root root   4,  62 Oct 22 22:37 tty62
crw------- 1 root root   4,  63 Oct 22 22:37 tty63
crw------- 1 root root   4,   7 Oct 22 22:37 tty7
crw------- 1 root root   4,   8 Oct 22 22:37 tty8
crw------- 1 root root   4,   9 Oct 22 22:37 tty9
crw-rw-rw- 1 root root   1,   9 Oct 22 22:37 urandom
crw------- 1 root root  10, 126 Oct 22 22:37 userfaultfd
crw------- 1 root root   7,   0 Oct 22 22:37 vcs
crw------- 1 root root   7,   1 Oct 22 22:37 vcs1
crw------- 1 root root   7, 128 Oct 22 22:37 vcsa
crw------- 1 root root   7, 129 Oct 22 22:37 vcsa1
crw------- 1 root root   7,  64 Oct 22 22:37 vcsu
crw------- 1 root root   7,  65 Oct 22 22:37 vcsu1
brw------- 1 root root 254,   0 Oct 22 22:37 vda
crw------- 1 root root  10, 127 Oct 22 22:37 vga_arbiter
crw------- 1 root root  10, 124 Oct 22 22:37 vmclock0
crw------- 1 root root  10, 123 Oct 22 22:37 vsock
crw-rw-rw- 1 root root   1,   5 Oct 22 22:37 zero

GPU nodes:

Privileges and process resource limits

The sandbox user has passwordless sudo, so the agent is effectively root inside the VM. That is the biggest practical difference from the ChatGPT Work VM: here apt install just works.

Limit	Value
Open files	4,096
Max user processes	31,806
Pending signals	31,806
Stack	8 MiB
Max locked memory	8 MiB
Core file size	0 (disabled)
CPU time / virtual memory / file size	unlimited

Passwordless sudo available in sandbox
real-time non-blocking time  (microseconds, -R) unlimited
core file size              (blocks, -c) 0
data seg size               (kbytes, -d) unlimited
scheduling priority                 (-e) 0
file size                   (blocks, -f) unlimited
pending signals                     (-i) 31806
max locked memory           (kbytes, -l) 8192
max memory size             (kbytes, -m) unlimited
open files                          (-n) 4096
pipe size                (512 bytes, -p) 8
POSIX message queues         (bytes, -q) 819200
real-time priority                  (-r) 0
stack size                  (kbytes, -s) 8192
cpu time                   (seconds, -t) unlimited
max user processes                  (-u) 31806
virtual memory              (kbytes, -v) unlimited
file locks                          (-x) unlimited

Main development software

Software	Version	Path
GCC / G++	15.2.0 (Ubuntu 15.2.0-16ubuntu1)	`/usr/bin/gcc`, `/usr/bin/g++`
GNU Make	4.4.1	`/usr/bin/make`
Python	3.14.8 (`/usr/local` build) and 3.14.4 (distro `python3.14`)	`/usr/local/bin/python`, `/usr/local/bin/python3`
pip	26.2.2	`/usr/local/bin/pip`
Node.js	v20.20.2	`/usr/local/bin/node`
npm	10.8.2	`/usr/local/bin/npm`
Git	2.53.0	`/usr/bin/git`
SWI-Prolog	9.2.9 (installed during this session)	`/usr/bin/swipl`

Also present from the Debian package list: build-essential, binutils 2.46, autoconf, automake, libtool, pkgconf, curl, wget, jq, ripgrep, rsync, socat, screen, sqlite3, xxd, openssh-client/openssh-server, bubblewrap, and the supabase CLI. Ubuntu 26.04’s Rust rewrites are also in place: rust-coreutils and sudo-rs.

Not found on PATH: clang, clang++, cmake, ninja, gdb, lldb, java, rustc, cargo, go, docker, podman.

The interpreter version check printed two versions, 3.14.8 and 3.14.4. The distro python3.14 package is 3.14.4, so the /usr/local build that owns pip and the Python inventory below is the newer 3.14.8. Node is the older 20.x LTS line, even though everything else on the box is recent.

gcc: /usr/bin/gcc
g++: /usr/bin/g++
clang: not found on PATH
clang++: not found on PATH
cmake: not found on PATH
make: /usr/bin/make
ninja: not found on PATH
gdb: not found on PATH
lldb: not found on PATH
python: /usr/local/bin/python
python3: /usr/local/bin/python3
pip: /usr/local/bin/pip
node: /usr/local/bin/node
npm: /usr/local/bin/npm
git: /usr/bin/git
swipl: /usr/bin/swipl
java: not found on PATH
rustc: not found on PATH
cargo: not found on PATH
go: not found on PATH
docker: not found on PATH
podman: not found on PATH
gcc (Ubuntu 15.2.0-16ubuntu1) 15.2.0
GNU Make 4.4.1
Python 3.14.8
Python 3.14.4
pip 26.2.2 from /usr/local/lib/python3.14/site-packages/pip (python 3.14)
v20.20.2
10.8.2
git version 2.53.0
SWI-Prolog version 9.2.9 for x86_64-linux

The desktop and computer-use stack

This is what makes the box a computer and not just a code interpreter. The image ships a complete headless X11 desktop:

Component	Package / version
Virtual X server	`xvfb` 21.1.22
Window manager	`openbox` 3.6.1
Panel / settings	`xfce4-panel` 4.20.7, `xfconf`, `xsettingsd`
Terminal	`alacritty` 0.16.1
X utilities	`x11-utils`, `x11-xserver-utils`, `x11-xkb-utils`, `xauth`, `xdg-utils`
GUI toolkit / accessibility	GTK 3.24.52, `at-spi2-core` 2.60.4, D-Bus 1.16.2
Rendering	Mesa 26.0.8 (`libgallium`, software rendering since there is no GPU)
Office suite	LibreOffice 26.2.6 (Writer, Calc, Impress, Draw, Math, Base) + `python3-uno`
Fonts	DejaVu, Liberation, Noto (incl. CJK and color emoji), Roboto, Lato, Carlito/Caladea, URW base35, `ttf-mscorefonts-installer`

No web browser package (Chromium, Firefox) is installed, so web browsing is presumably handled by a separate tool service rather than inside this VM. The UI automation helper (screenshots, input injection) is not visible as a Debian package either. It most likely talks to the X server directly, or runs over the vsock channel noted above.

Document, image, and media tooling:

Software	Version
FFmpeg	8.0.1
ImageMagick	7.1.2-18 (Q16)
libvips / `libvips-tools`	present (plus `pyvips` in Python)
Pandoc	3.7.0.2
Tesseract OCR	5.5.0 (eng + osd)
Poppler utils	26.01.0
Ghostscript	10.06.0
qpdf	present
ExifTool	`libimage-exiftool-perl`
librsvg	present

Installed Python packages

145 distributions visible to the default Python. The interesting ones:

Perplexity internals: pplx_sdk, pplx-python-sdks-llm-api, and three idl-protobuf-perplexity-llm-api-* packages (protobuf/gRPC stubs for Perplexity’s internal LLM API). One of them is versioned 2026.10.22.1792629890+b7907f3, a build stamped the day before capture, so the image is rebuilt frequently.
Third-party model SDKs: anthropic 2.1.0 and openai 3.36.0.
Infrastructure: modal 1.5.2 (Modal serverless compute client), boto3/s3transfer, git-remote-s3, grpcio/grpclib, fastapi/uvicorn/Flask.
Observability: ddtrace 4.16.0, ddtrace-internal, datadog, opentelemetry-api.
Document conversion: markitdown, markdownify, pdf2docx, pymupdf, pdfplumber, pypdf, pypdfium2, python-docx, python-pptx, openpyxl, xlsxwriter, reportlab, fpdf2, mat2 (metadata scrubbing).
Media / vision: opencv-python-headless 5.0, onnxruntime, pillow 13 + pillow_heif, pyvips, pytesseract, yt-dlp, mutagen, magika (Google’s ML file-type detector).
Language detection: fast-langdetect, fasttext-predict-v2, hanzidentifier, zhon.
Agent tooling: skills-ref 0.1.1, a reference library for agent "skills" packages.

Notably absent: no PyTorch, TensorFlow, scikit-learn, or Jupyter. The numeric stack is just numpy, pandas 3.0, scipy, and matplotlib.

Package                                                       Version
------------------------------------------------------------- -----------------------------
aiohappyeyeballs                                              2.7.1
aiohttp                                                       3.14.5
aiosignal                                                     1.4.0
annotated-doc                                                 0.0.5
annotated-types                                               0.8.0
anthropic                                                     2.1.0
anyio                                                         4.15.1
attrs                                                         26.1.0
beautifulsoup4                                                4.15.0
blinker                                                       1.9.0
boto3                                                         1.43.117
botocore                                                      1.43.117
bytecode                                                      0.19.1
cbor2                                                         6.1.5
certifi                                                       2026.10.19
cffi                                                          2.1.1
charset-normalizer                                            3.5.2
click                                                         8.5.0
colorlog                                                      6.12.0
contourpy                                                     1.4.0
cryptography                                                  50.0.2
cycler                                                        0.12.1
datadog                                                       0.51.0
ddtrace                                                       4.16.0
ddtrace-internal                                              0.1.0
defusedxml                                                    0.7.1
docstring_parser                                              0.18.0
envier                                                        0.6.1
et_xmlfile                                                    2.0.0
fast-langdetect                                               1.1.0
fastapi                                                       0.159.1
fasttext-predict-v2                                           1.1.0
fire                                                          0.7.1
Flask                                                         3.1.3
flatbuffers                                                   25.12.19
fonttools                                                     4.67.0
fpdf2                                                         2.8.9
frozenlist                                                    1.8.0
git-remote-s3                                                 0.4.2
grpcio                                                        1.80.0
grpclib                                                       0.4.9
h11                                                           0.16.0
h2                                                            4.4.1
hanzidentifier                                                1.3.0
hpack                                                         4.2.0
httpcore2                                                     2.16.0
httptools                                                     0.9.0
httpx2                                                        2.16.0
hyperframe                                                    6.1.0
idl-protobuf-perplexity-llm-api-common-llm-api-common-pyproto 2026.10.22.1792629890+b7907f3
idl-protobuf-perplexity-llm-api-llm-api-pygrpc                0.0.0+local
idl-protobuf-perplexity-llm-api-llm-api-pyproto               0.0.0+local
idna                                                          3.20
itsdangerous                                                  2.2.0
Jinja2                                                        3.1.6
jiter                                                         0.13.0
jmespath                                                      1.1.0
kiwisolver                                                    1.5.1
lxml                                                          6.1.3
lz4                                                           4.4.5
magika                                                        1.0.3
markdown-it-py                                                4.2.0
markdownify                                                   1.2.3
markitdown                                                    0.1.9
MarkupSafe                                                    3.0.4
mat2                                                          0.15.0
matplotlib                                                    3.11.2
mdurl                                                         0.1.2
modal                                                         1.5.2
multidict                                                     7.1.0
mutagen                                                       1.48.1
numpy                                                         2.5.4
onnxruntime                                                   1.31.0
openai                                                        3.36.0
opencv-python-headless                                        5.0.0.93
openpyxl                                                      3.1.5
opentelemetry-api                                             1.45.1
orjson                                                        3.11.8
packaging                                                     26.3
pandas                                                        3.0.6
pdf2docx                                                      0.5.13
pdf2image                                                     1.17.0
pdfminer.six                                                  20260107
pdfplumber                                                    0.11.10
pillow                                                        13.0.0
pillow_heif                                                   1.8.0
pip                                                           26.2.2
pplx-python-sdks-llm-api                                      0.0.0+local
pplx_sdk                                                      0.0.0+local
propcache                                                     0.5.4
protobuf                                                      7.35.1
pycairo                                                       1.29.2
pycparser                                                     3.11
pydantic                                                      2.12.5
pydantic_core                                                 2.41.5
Pygments                                                      2.21.0
PyGObject                                                     3.48.2
pymupdf                                                       1.28.2
pyparsing                                                     3.3.3
pypdf                                                         6.21.2
pypdfium2                                                     5.14.0
pytesseract                                                   0.3.13
python-dateutil                                               2.9.0.post0
python-docx                                                   1.2.0
python-dotenv                                                 1.2.4
python-pptx                                                   1.0.2
pytz                                                          2026.5
pyvips                                                        3.2.0
PyYAML                                                        6.0.3
reportlab                                                     5.0.1
requests                                                      2.34.2
rich                                                          15.0.0
robust-downloader                                             0.0.2
s3transfer                                                    0.19.3
scipy                                                         1.18.1
six                                                           1.17.0
skills-ref                                                    0.1.1
sniffio                                                       1.3.1
soupsieve                                                     3.0.4
sqlglot                                                       30.24.0
starlette                                                     1.9.0
strictyaml                                                    1.7.3
synchronicity                                                 0.12.6
tenacity                                                      9.1.2
termcolor                                                     3.3.0
toml                                                          0.10.2
tqdm                                                          4.70.1
truststore                                                    0.10.5
types-certifi                                                 2021.10.8.3
types-toml                                                    0.10.8.20260518
typing_extensions                                             4.16.0
typing-inspection                                             0.4.4
urllib3                                                       2.8.0
uuid7                                                         0.1.0
uvicorn                                                       0.54.0
uvloop                                                        0.23.0
watchfiles                                                    1.3.0
websockets                                                    17.3
Werkzeug                                                      3.1.9
wrapt                                                         2.5.1
xlrd                                                          2.0.2
xlsxwriter                                                    3.3.0
yarl                                                          1.25.1
yt-dlp                                                        2026.10.21
zhon                                                          2.1.1

Global Node packages

/usr/local/lib
+-- @anthropic-ai/claude-code@2.1.286
+-- @box/cli@4.10.1
+-- @googleworkspace/cli@0.22.5
+-- @openai/codex@0.130.0
+-- convex@1.42.3
+-- corepack@0.34.6
+-- npm@10.8.2
+-- serve@14.2.6
`-- vercel@50.28.0

The global npm prefix has two third-party coding agents preinstalled, @anthropic-ai/claude-code 2.1.286 and @openai/codex 0.130.0, plus CLIs for the services Perplexity Computer connects to: vercel, convex, @box/cli, and @googleworkspace/cli. serve is there for quick static hosting from the VM.

Installed Debian package inventory

All 847 installed packages (dpkg-query name and version). The SWI-Prolog packages (swi-prolog-core, swi-prolog-core-packages, swi-prolog-nox) and their dependencies were installed during this session.

3cpio	0.14.0-1ubuntu1
adduser	3.153ubuntu1
adwaita-icon-theme	50.0-1
alacritty	0.16.1-2ubuntu1
amd64-microcode	3.20251202.1ubuntu2
apache2-utils	2.4.66-2ubuntu2.6
apt	3.2.0
at-spi2-common	2.60.4-0ubuntu0.1
at-spi2-core	2.60.4-0ubuntu0.1
autoconf	2.72-3.1ubuntu2
automake	1:1.18.1-3build1
autopoint	0.23.2-1
autotools-dev	20240727.1build1
base-files	14ubuntu6.2
base-passwd	3.6.8
bash	5.3-2ubuntu1
bc	1.07.1-4build1
bind9-dnsutils	1:9.20.24-1ubuntu0.4
bind9-host	1:9.20.24-1ubuntu0.4
bind9-libs:amd64	1:9.20.24-1ubuntu0.4
binutils	2.46-3ubuntu2
binutils-common:amd64	2.46-3ubuntu2
binutils-x86-64-linux-gnu	2.46-3ubuntu2
bsdextrautils	2.41.3-3ubuntu2.2
bsdutils	1:2.41.3-3ubuntu2.2
bubblewrap	0.11.1-1ubuntu0.3
build-essential	12.12ubuntu2.26.04.2
bzip2	1.0.8-6ubuntu0.1
ca-certificates	20260601~26.04.1
cabextract	1.11-2build1
console-setup	1.237ubuntu3.1
console-setup-linux	1.237ubuntu3.1
coreutils	9.5-1ubuntu2+0.0.0~ubuntu25
coreutils-from-uutils	0.0.0~ubuntu25
cpp	4:15.2.0-5ubuntu1
cpp-15	15.2.0-16ubuntu1
cpp-15-x86-64-linux-gnu	15.2.0-16ubuntu1
cpp-x86-64-linux-gnu	4:15.2.0-5ubuntu1
curl	8.18.0-1ubuntu2.8
dash	0.5.12-12ubuntu3
dbus	1.16.2-2ubuntu4
dbus-bin	1.16.2-2ubuntu4
dbus-daemon	1.16.2-2ubuntu4
dbus-session-bus-common	1.16.2-2ubuntu4
dbus-system-bus-common	1.16.2-2ubuntu4
dbus-user-session	1.16.2-2ubuntu4
dconf-gsettings-backend:amd64	0.49.0-4
dconf-service	0.49.0-4
debconf	1.5.92
debhelper	13.31ubuntu1
debianutils	5.23.2build1
debugedit	1:5.3-4
desktop-file-utils	0.28-1build1
dh-autoreconf	21+nmu1
dh-strip-nondeterminism	1.15.0-1build1
diffutils	1:3.12-1ubuntu0.1
dirmngr	2.4.8-4ubuntu3.1
distro-info	1.15
distro-info-data	0.72-0ubuntu0.26.04.1
dmidecode	3.6-2build1
dmsetup	2:1.02.205-2ubuntu3
dpkg	1.23.7ubuntu1
dpkg-dev	1.23.7ubuntu1
dwz	0.16-4
e2fsprogs	1.47.2-3ubuntu4
exo-utils	4.20.0-1build1
falcon-sensor	7.38.0-19105
fdisk	2.41.3-3ubuntu2.2
ffmpeg	7:8.0.1-3ubuntu2
file	1:5.46-5build2
findutils	4.10.0-3build2
fontconfig	2.17.1-3ubuntu1
fontconfig-config	2.17.1-3ubuntu1
fonts-crosextra-caladea	20200211-2
fonts-crosextra-carlito	20230309-2
fonts-dejavu	2.37-8build1
fonts-dejavu-core	2.37-8build1
fonts-dejavu-extra	2.37-8build1
fonts-dejavu-mono	2.37-8build1
fonts-font-awesome	5.0.10+really4.7.0~dfsg-4.1build1
fonts-freefont-ttf	20211204+svn4273-4build1
fonts-lato	2.015-1build1
fonts-liberation	1:2.1.5-3build1
fonts-liberation-sans-narrow	1:1.07.6-4build1
fonts-linuxlibertine	5.3.0-6build1
fonts-noto-cjk	1:20240730+repack1-1build1
fonts-noto-color-emoji	2.051-1build1
fonts-noto-core	20201225-2build1
fonts-noto-mono	20201225-2build1
fonts-noto-ui-core	20201225-2build1
fonts-opensymbol	4:102.12+LibO26.2.6.3-0ubuntu0.26.04.2
fonts-roboto	2:0~20170802-6
fonts-roboto-unhinted	2:0~20170802-6
fonts-sil-gentium	20081126:1.03-4build1
fonts-sil-gentium-basic	1.102-1.1build1
fonts-tlwg-loma-otf	1:0.7.3-1build1
fonts-unifont	1:16.0.04-1build1
fonts-urw-base35	20200910-8build1
g++	4:15.2.0-5ubuntu1
g++-15	15.2.0-16ubuntu1
g++-15-x86-64-linux-gnu	15.2.0-16ubuntu1
g++-x86-64-linux-gnu	4:15.2.0-5ubuntu1
gcc	4:15.2.0-5ubuntu1
gcc-15	15.2.0-16ubuntu1
gcc-15-base:amd64	15.2.0-16ubuntu1
gcc-15-x86-64-linux-gnu	15.2.0-16ubuntu1
gcc-16-base:amd64	16-20260322-1ubuntu1
gcc-x86-64-linux-gnu	4:15.2.0-5ubuntu1
gettext	0.23.2-1
gettext-base	0.23.2-1
gfortran	4:15.2.0-5ubuntu1
gfortran-15	15.2.0-16ubuntu1
gfortran-15-x86-64-linux-gnu	15.2.0-16ubuntu1
gfortran-x86-64-linux-gnu	4:15.2.0-5ubuntu1
ghostscript	10.06.0~dfsg-3ubuntu1.2
gir1.2-freedesktop:amd64	1.86.0-6build1
gir1.2-gdkpixbuf-2.0:amd64	2.44.5+dfsg-4ubuntu1
gir1.2-girepository-2.0:amd64	1.86.0-6build1
gir1.2-girepository-3.0:amd64	2.88.0-1ubuntu0.1
gir1.2-glib-2.0:amd64	2.88.0-1ubuntu0.1
gir1.2-poppler-0.18:amd64	26.01.0-2ubuntu0.3
gir1.2-rsvg-2.0:amd64	2.61.3+dfsg-3ubuntu0.1
gir1.2-vips-8.0	8.18.0-1build1
git	1:2.53.0-1ubuntu1
git-lfs	3.7.1-1
git-man	1:2.53.0-1ubuntu1
glycin-loaders	2.1.5+ds-0ubuntu0.2
glycin-thumbnailers	2.1.5+ds-0ubuntu0.2
gnu-coreutils	9.7-3ubuntu2.1
gnupg	2.4.8-4ubuntu3.1
gpg	2.4.8-4ubuntu3.1
gpg-agent	2.4.8-4ubuntu3.1
gpgconf	2.4.8-4ubuntu3.1
gpgsm	2.4.8-4ubuntu3.1
gpgv	2.4.8-4ubuntu3.1
grep	3.12-1
groff-base	1.23.0-10
gsettings-desktop-schemas	50.0-1ubuntu2
gtk-update-icon-cache	4.22.4+ds-0ubuntu0.1
gzip	1.14-1~exp2ubuntu1.1
hicolor-icon-theme	0.18-2build1
hostname	3.25build1
imagemagick	8:7.1.2.18+dfsg1-1
imagemagick-7-common	8:7.1.2.18+dfsg1-1
imagemagick-7.q16	8:7.1.2.18+dfsg1-1
init-system-helpers	1.69
inotify-tools	4.25.9.0-1
intel-microcode	3.20260210.1ubuntu2
intltool-debian	0.35.0+20060710.6build1
iproute2	6.19.0-1ubuntu1.1
iputils-ping	3:20250605-1ubuntu1
iso-codes	4.20.1-1
iucode-tool	2.3.1-3build2
javascript-common	12+nmu1build1
jq	1.8.1-4ubuntu2
kbd	2.7.1-2ubuntu2
keyboard-configuration	1.237ubuntu3.1
kmod	34.2-2ubuntu2
libabsl20260107:amd64	20260107.0-4
libabw-0.1-1:amd64	0.1.3-1build6
libacl1:amd64	2.3.2-2
libaom3:amd64	3.13.1-2ubuntu0.1
libapparmor1:amd64	5.0.2-0ubuntu1~26.04.1
libapr1t64:amd64	1.7.6-3
libaprutil1t64:amd64	1.6.3-3ubuntu3.1
libapt-pkg7.0:amd64	3.2.0
libarchive-cpio-perl	0.10-3
libarchive-zip-perl	1.68-1
libarchive13t64:amd64	3.8.5-1ubuntu2.3
libargon2-1:amd64	0~20190702+dfsg-5
libasan8:amd64	16-20260322-1ubuntu1
libasound2-data	1.2.15.3-1ubuntu1.1
libasound2t64:amd64	1.2.15.3-1ubuntu1.1
libass9:amd64	1:0.17.4-2
libassuan9:amd64	3.0.2-2build1
libasyncns0:amd64	0.8-7
libatk-bridge2.0-0t64:amd64	2.60.4-0ubuntu0.1
libatk1.0-0t64:amd64	2.60.4-0ubuntu0.1
libatomic1:amd64	16-20260322-1ubuntu1
libatspi2.0-0t64:amd64	2.60.4-0ubuntu0.1
libattr1:amd64	1:2.5.2-4ubuntu0.1
libaudit-common	1:4.1.2-1ubuntu0.1
libaudit1:amd64	1:4.1.2-1ubuntu0.1
libavahi-client3:amd64	0.8-18ubuntu1.1
libavahi-common-data:amd64	0.8-18ubuntu1.1
libavahi-common3:amd64	0.8-18ubuntu1.1
libavc1394-0:amd64	0.5.4-5build4
libavcodec62:amd64	7:8.0.1-3ubuntu2
libavdevice62:amd64	7:8.0.1-3ubuntu2
libavfilter11:amd64	7:8.0.1-3ubuntu2
libavformat62:amd64	7:8.0.1-3ubuntu2
libavutil60:amd64	7:8.0.1-3ubuntu2
libbinutils:amd64	2.46-3ubuntu2
libblkid1:amd64	2.41.3-3ubuntu2.2
libbluray3:amd64	1:1.4.1-1
libboost-iostreams1.90.0:amd64	1.90.0-6ubuntu1
libboost-locale1.90.0:amd64	1.90.0-6ubuntu1
libboost-thread1.90.0:amd64	1.90.0-6ubuntu1
libbpf1:amd64	1:1.6.3-1ubuntu1
libbrotli1:amd64	1.2.0-3build1
libbs2b0:amd64	3.1.0+dfsg-8build1
libbsd0:amd64	0.12.2-2build2
libbz2-1.0:amd64	1.0.8-6ubuntu0.1
libc-bin	2.43-2ubuntu2.4
libc-dev-bin	2.43-2ubuntu2.4
libc-gconv-modules-extra:amd64	2.43-2ubuntu2.4
libc6:amd64	2.43-2ubuntu2.4
libc6-dev:amd64	2.43-2ubuntu2.4
libcairo-gobject2:amd64	1.18.4-3
libcairo2:amd64	1.18.4-3
libcap-ng0:amd64	0.8.5-4build5
libcap2:amd64	1:2.75-10ubuntu2
libcap2-bin	1:2.75-10ubuntu2
libcbor0.10:amd64	0.10.2-2ubuntu3
libcc1-0:amd64	16-20260322-1ubuntu1
libcdio-cdda2t64:amd64	10.2+2.0.2-2
libcdio-paranoia2t64:amd64	10.2+2.0.2-2
libcdio19t64:amd64	2.2.0-4build1
libcdr-0.1-1:amd64	0.1.7-1build4
libcfitsio10t64:amd64	4.6.3-1
libcgif0:amd64	0.5.1-1
libchromaprint1:amd64	1.6.0-2build1
libcjson1:amd64	1.7.19-2
libclucene-contribs1t64:amd64	2.3.3.4+dfsg-1.3
libclucene-core1t64:amd64	2.3.3.4+dfsg-1.3
libcodec2-1.2:amd64	1.2.0-4
libcolamd3:amd64	1:7.12.2+dfsg-1ubuntu1
libcolord2:amd64	1.4.8-3
libcom-err2:amd64	1.47.2-3ubuntu4
libcrypt-dev:amd64	1:4.5.1-1
libcrypt1:amd64	1:4.5.1-1
libctf-nobfd0:amd64	2.46-3ubuntu2
libctf0:amd64	2.46-3ubuntu2
libcups2t64:amd64	2.4.16-1ubuntu1.3
libcurl3t64-gnutls:amd64	8.18.0-1ubuntu2.8
libcurl4t64:amd64	8.18.0-1ubuntu2.8
libdatrie1:amd64	0.2.14-1
libdav1d7:amd64	1.5.3-1
libdb5.3t64:amd64	5.3.28+dfsg2-10ubuntu1
libdbus-1-3:amd64	1.16.2-2ubuntu4
libdbusmenu-glib4:amd64	18.10.20180917~bzr492+repack1-4build1
libdbusmenu-gtk3-4:amd64	18.10.20180917~bzr492+repack1-4build1
libdc1394-25:amd64	2.2.6-6
libdconf1:amd64	0.49.0-4
libde265-0:amd64	1.0.16-1build1
libdebconfclient0:amd64	0.280ubuntu1
libdebhelper-perl	13.31ubuntu1
libdecor-0-0:amd64	0.2.5-1
libdeflate0:amd64	1.23-2ubuntu1
libdevmapper1.02.1:amd64	2:1.02.205-2ubuntu3
libdisplay-info3:amd64	0.3.0-1
libdjvulibre-text	3.5.29-1
libdjvulibre21:amd64	3.5.29-1
libdpkg-perl	1.23.7ubuntu1
libdrm-amdgpu1:amd64	2.4.131-1
libdrm-common	2.4.131-1
libdrm-intel1:amd64	2.4.131-1
libdrm2:amd64	2.4.131-1
libdvdnav4:amd64	7.0.0-2
libdvdread8t64:amd64	7.0.1-1
libdw1t64:amd64	0.194-4
libe-book-0.1-1:amd64	0.1.3-2build9
libedit2:amd64	3.1-20251016-1
libefivar1t64:amd64	39-2
libelf1t64:amd64	0.194-4
libeot0:amd64	0.01-5build4
libepoxy0:amd64	1.5.10-2build1
libepubgen-0.1-1:amd64	0.1.1-1ubuntu8
liberror-perl	0.17030-1
libetonyek-0.1-1:amd64	0.1.13-2
libexif12:amd64	0.6.25-2ubuntu0.1
libexo-2-0:amd64	4.20.0-1build1
libexo-common	4.20.0-1build1
libexpat1:amd64	2.7.4-1ubuntu0.2
libext2fs2t64:amd64	1.47.2-3ubuntu4
libexttextcat-2.0-0:amd64	3.4.7-2
libexttextcat-data	3.4.7-2
libfdisk1:amd64	2.41.3-3ubuntu2.2
libffi8:amd64	3.5.2-4
libfftw3-double3:amd64	3.3.10-2fakesync1build3
libfido2-1:amd64	1.16.0-2build1
libfile-stripnondeterminism-perl	1.15.0-1build1
libflac14:amd64	1.5.0+ds-5
libflite1:amd64	2.2-7build1
libfontconfig1:amd64	2.17.1-3ubuntu1
libfontenc1:amd64	1:1.1.8-1build2
libfreehand-0.1-1	0.1.2-3build4
libfreetype6:amd64	2.14.2+dfsg-1ubuntu0.2
libfribidi0:amd64	1.0.16-5
libgarcon-1-0:amd64	4.20.0-1build1
libgarcon-common	4.20.0-1build1
libgarcon-gtk3-1-0:amd64	4.20.0-1build1
libgbm1:amd64	26.0.8-1ubuntu0.3
libgcc-15-dev:amd64	15.2.0-16ubuntu1
libgcc-s1:amd64	16-20260322-1ubuntu1
libgcrypt20:amd64	1.12.0-2ubuntu1.1
libgdbm-compat4t64:amd64	1.26-1build1
libgdbm6t64:amd64	1.26-1build1
libgdk-pixbuf-2.0-0:amd64	2.44.5+dfsg-4ubuntu1
libgdk-pixbuf2.0-common	2.44.5+dfsg-4ubuntu1
libgfortran-15-dev:amd64	15.2.0-16ubuntu1
libgfortran5:amd64	16-20260322-1ubuntu1
libgif7:amd64	5.2.2-1ubuntu3.2
libgirepository-1.0-1:amd64	1.86.0-6build1
libgirepository-2.0-0:amd64	2.88.0-1ubuntu0.1
libgl1:amd64	1.7.0-3
libgl1-mesa-dri:amd64	26.0.8-1ubuntu0.3
libglib2.0-0t64:amd64	2.88.0-1ubuntu0.1
libglvnd0:amd64	1.7.0-3
libglx-mesa0:amd64	26.0.8-1ubuntu0.3
libglx0:amd64	1.7.0-3
libglycin-2-0:amd64	2.1.5+ds-0ubuntu0.2
libgme0:amd64	0.6.4-1
libgmp10:amd64	2:6.3.0+dfsg-5ubuntu2
libgnutls30t64:amd64	3.8.12-2ubuntu1.1
libgomp1:amd64	16-20260322-1ubuntu1
libgpg-error0:amd64	1.58-2
libgpgme45:amd64	2.0.1-2build1
libgpgmepp7:amd64	2.0.0-2
libgprofng0:amd64	2.46-3ubuntu2
libgraphite2-3:amd64	1.3.14-11ubuntu1.1
libgs-common	10.06.0~dfsg-3ubuntu1.2
libgs10:amd64	10.06.0~dfsg-3ubuntu1.2
libgs10-common	10.06.0~dfsg-3ubuntu1.2
libgsm1:amd64	1.0.23-2
libgssapi-krb5-2:amd64	1.22.1-2ubuntu4.1
libgstreamer-plugins-base1.0-0:amd64	1.28.2-1ubuntu0.1
libgstreamer1.0-0:amd64	1.28.2-1
libgtk-3-0t64:amd64	3.24.52-0ubuntu1
libgtk-3-common	3.24.52-0ubuntu1
libgtk-layer-shell0:amd64	0.10.0-1
libharfbuzz-icu0:amd64	12.3.2-2
libharfbuzz0b:amd64	12.3.2-2
libhdf5-310:amd64	1.14.6+repack-2
libheif-plugin-aomdec:amd64	1.21.2-3ubuntu0.6
libheif-plugin-aomenc:amd64	1.21.2-3ubuntu0.6
libheif-plugin-libde265:amd64	1.21.2-3ubuntu0.6
libheif-plugin-x265:amd64	1.21.2-3ubuntu0.6
libheif1:amd64	1.21.2-3ubuntu0.6
libhogweed6t64:amd64	3.10.2-1
libhunspell-1.7-0:amd64	1.7.2+really1.7.2-11
libhwasan0:amd64	16-20260322-1ubuntu1
libhwy1t64:amd64	1.3.0-2
libhyphen0:amd64	2.8.8-7build4
libice6:amd64	2:1.1.1-1build1
libicu78:amd64	78.2-2ubuntu1
libid3tag0:amd64	0.16.3-4
libidn12:amd64	1.43-2ubuntu0.26.04.1
libidn2-0:amd64	2.3.8-4build1
libiec61883-0:amd64	1.2.0-8
libijs-0.35:amd64	0.35-16
libimage-exiftool-perl	13.50+dfsg-1
libimagequant0:amd64	4.4.1-1
libimath-3-1-29t64:amd64	3.1.12-1ubuntu5
libimlib2t64:amd64	1.12.6-1
libinotifytools0:amd64	4.25.9.0-1
libisl23:amd64	0.27-1build1
libitm1:amd64	16-20260322-1ubuntu1
libjack-jackd2-0:amd64	1.9.22~dfsg-5build1
libjansson4:amd64	2.14-2build4
libjbig0:amd64	2.1-6.1ubuntu3
libjbig2dec0:amd64	0.20-1ubuntu0.26.04.1
libjemalloc2:amd64	5.3.0-4
libjpeg-turbo8:amd64	2.1.5-4ubuntu4
libjpeg8:amd64	8c-2ubuntu12
libjq1:amd64	1.8.1-4ubuntu2
libjs-jquery	3.7.1+dfsg+~3.5.33-1build1
libjs-sphinxdoc	8.2.3-12
libjson-c5:amd64	0.18+ds-3
libjxl0.11:amd64	0.11.1-6ubuntu4.2
libjxr-tools	1.2~git20170615.f752187-5.3build1
libjxr0t64:amd64	1.2~git20170615.f752187-5.3build1
libk5crypto3:amd64	1.22.1-2ubuntu4.1
libkeyutils1:amd64	1.6.3-6ubuntu3
libkmod2:amd64	34.2-2ubuntu2
libkrb5-3:amd64	1.22.1-2ubuntu4.1
libkrb5support0:amd64	1.22.1-2ubuntu4.1
libksba8:amd64	1.6.7-2build1
liblangtag-common	0.6.8-2
liblangtag1:amd64	0.6.8-2
liblcms2-2:amd64	2.17-1ubuntu0.2
libldap-common	2.6.10+dfsg-1ubuntu5
libldap2:amd64	2.6.10+dfsg-1ubuntu5
libleptonica6:amd64	1.86.0-1
liblerc4:amd64	4.0.0+ds-5ubuntu2
liblilv-0-0:amd64	0.26.2-1
libllvm21:amd64	1:21.1.8-6ubuntu1
liblmdb0:amd64	0.9.31-1build2
liblocale-gettext-perl	1.07-8
liblqr-1-0:amd64	0.4.2-2.2
liblsan0:amd64	16-20260322-1ubuntu1
liblsof0	4.99.4+dfsg-2build2
libltdl-dev:amd64	2.5.4-9
libltdl7:amd64	2.5.4-9
liblua5.4-0:amd64	5.4.8-1build1
liblz4-1:amd64	1.10.0-8
liblzma5:amd64	5.8.3-1
libmagic-mgc	1:5.46-5build2
libmagic1t64:amd64	1:5.46-5build2
libmagickcore-7.q16-10:amd64	8:7.1.2.18+dfsg1-1
libmagickcore-7.q16-10-extra:amd64	8:7.1.2.18+dfsg1-1
libmagickwand-7.q16-10:amd64	8:7.1.2.18+dfsg1-1
libmail-sendmail-perl	0.82-1build1
libmatio14:amd64	1.5.30-2
libmaxminddb0:amd64	1.12.2-1build2
libmbedcrypto16:amd64	3.6.5-0.1ubuntu2
libmd0:amd64	1.1.0-2build4
libmhash2:amd64	0.9.9.9-11
libmnl0:amd64	1.0.5-3build1
libmount1:amd64	2.41.3-3ubuntu2.2
libmp3lame0:amd64	3.101~svn6525+dfsg-2ubuntu0.1
libmpc3:amd64	1.3.1-3
libmpfr6:amd64	4.2.2-3
libmpg123-0t64:amd64	1.33.3-2
libmspack0t64:amd64	0.11-1.1build2
libmspub-0.1-1:amd64	0.1.4-4build1
libmwaw-0.3-3:amd64	0.3.22-2
libmysofa1:amd64	1.3.3+dfsg-1ubuntu2
libmythes-1.2-0:amd64	2:1.2.5-2build1
libncursesw6:amd64	6.6+20251231-1
libnetpbm11t64:amd64	2:11.10.02-1build1
libnettle8t64:amd64	3.10.2-1
libnghttp2-14:amd64	1.68.0-2ubuntu0.2
libnl-3-200:amd64	3.12.0-2
libnl-genl-3-200:amd64	3.12.0-2
libnorm1t64:amd64	1.5.9+dfsg-4
libnpth0t64:amd64	1.8-3build1
libnspr4:amd64	2:4.38.2-1ubuntu1
libnss3:amd64	2:3.120-1ubuntu2.2
libnss3-tools	2:3.120-1ubuntu2.2
libnuma1:amd64	2.0.19-1build1
libobrender32	3.6.1-12ubuntu3
libobt2:amd64	3.6.1-12ubuntu3
libodfgen-0.1-1:amd64	0.1.8-3build1
libogg0:amd64	1.3.6-2
libonig5:amd64	6.9.10-1build1
libopenal-data	1:1.25.1-2
libopenal1:amd64	1:1.25.1-2
libopenexr-3-1-30:amd64	3.1.13-2build1
libopenjp2-7:amd64	2.5.4-1ubuntu0.1
libopenmpt0t64:amd64	0.8.4-1
libopenslide0	3.4.1+dfsg-7build4
libopus0:amd64	1.6.1-1
liborc-0.4-0t64:amd64	1:0.4.42-2
liborcus-0.21-0:amd64	0.21.0-4
liborcus-parser-0.21-0:amd64	0.21.0-4
libossp-uuid16:amd64	1.6.6-1
libp11-kit0:amd64	0.26.2-2
libpagemaker-0.0-0:amd64	0.0.4-1build5
libpam-modules:amd64	1.7.0-5ubuntu3.2
libpam-modules-bin	1.7.0-5ubuntu3.2
libpam-runtime	1.7.0-5ubuntu3.2
libpam-systemd:amd64	259.5-0ubuntu3.4
libpam0g:amd64	1.7.0-5ubuntu3.2
libpango-1.0-0:amd64	1.57.0-1
libpangocairo-1.0-0:amd64	1.57.0-1
libpangoft2-1.0-0:amd64	1.57.0-1
libpangoxft-1.0-0:amd64	1.57.0-1
libpaper2:amd64	2.2.5-0.3maysync1
libparted2t64:amd64	3.6-6
libpci3:amd64	1:3.14.0-1build2
libpciaccess0:amd64	0.18.1-1ubuntu4.1
libpcre2-8-0:amd64	10.46-1build1
libperl5.40:amd64	5.40.1-7ubuntu0.3
libpgm-5.3-0t64:amd64	5.3.128~dfsg-2.1build2
libpipeline1:amd64	1.5.8-2
libpixman-1-0:amd64	0.46.4-1
libpkgconf7:amd64	2.5.1-4
libplacebo360:amd64	7.360.0-3
libpng16-16t64:amd64	1.6.57-1ubuntu0.1
libpoppler-glib8t64:amd64	26.01.0-2ubuntu0.3
libpoppler156:amd64	26.01.0-2ubuntu0.3
libpopt0:amd64	1.19+dfsg-2build1
libproc2-0:amd64	2:4.0.4-9ubuntu1
libpsl5t64:amd64	0.21.2-1.1build2
libpulse0:amd64	1:17.0+dfsg1-2ubuntu4
libpython3-stdlib:amd64	3.14.3-0ubuntu2
libpython3.14:amd64	3.14.4-1ubuntu0.2
libpython3.14-minimal:amd64	3.14.4-1ubuntu0.2
libpython3.14-stdlib:amd64	3.14.4-1ubuntu0.2
libqpdf30:amd64	12.3.2-1
libquadmath0:amd64	16-20260322-1ubuntu1
librabbitmq4:amd64	0.15.0-1ubuntu0.26.04.2
libraptor2-0:amd64	2.0.16-6build1
librasqal3t64:amd64	0.9.33-3
librav1e0.8:amd64	0.8.1-7
libraw1394-11:amd64	2.1.2-2build4
libraw23t64:amd64	0.21.5b-1ubuntu1.1
librdf0t64:amd64	1.0.17-8
libreadline8t64:amd64	8.3-4
libreoffice-base-core	4:26.2.6.3-0ubuntu0.26.04.2
libreoffice-calc	4:26.2.6.3-0ubuntu0.26.04.2
libreoffice-common	4:26.2.6.3-0ubuntu0.26.04.2
libreoffice-core	4:26.2.6.3-0ubuntu0.26.04.2
libreoffice-draw	4:26.2.6.3-0ubuntu0.26.04.2
libreoffice-gtk3	4:26.2.6.3-0ubuntu0.26.04.2
libreoffice-impress	4:26.2.6.3-0ubuntu0.26.04.2
libreoffice-math	4:26.2.6.3-0ubuntu0.26.04.2
libreoffice-style-colibre	4:26.2.6.3-0ubuntu0.26.04.2
libreoffice-uiconfig-calc	4:26.2.6.3-0ubuntu0.26.04.2
libreoffice-uiconfig-common	4:26.2.6.3-0ubuntu0.26.04.2
libreoffice-uiconfig-draw	4:26.2.6.3-0ubuntu0.26.04.2
libreoffice-uiconfig-impress	4:26.2.6.3-0ubuntu0.26.04.2
libreoffice-uiconfig-math	4:26.2.6.3-0ubuntu0.26.04.2
libreoffice-uiconfig-writer	4:26.2.6.3-0ubuntu0.26.04.2
libreoffice-writer	4:26.2.6.3-0ubuntu0.26.04.2
librevenge-0.0-0:amd64	0.0.5-3build2
librist4:amd64	0.2.11+dfsg-1build1
librsvg2-2:amd64	2.61.3+dfsg-3ubuntu0.1
librtmp1:amd64	2.4+20151223.gitfa8646d.1-3
librubberband3:amd64	4.0.0+dfsg-2ubuntu1
libsamplerate0:amd64	0.2.2-4build2
libsasl2-2:amd64	2.1.28+dfsg1-9ubuntu3
libsasl2-modules-db:amd64	2.1.28+dfsg1-9ubuntu3
libsdl2-2.0-0:amd64	2.32.10+dfsg-6
libsdl2-classic:amd64	2.32.10+dfsg-6
libseccomp2:amd64	2.6.0-2ubuntu5
libselinux1:amd64	3.9-4build1
libsemanage-common	3.9-1build1
libsemanage2:amd64	3.9-1build1
libsensors-config	1:3.6.2-2build1
libsensors5:amd64	1:3.6.2-2build1
libsepol2:amd64	3.9-2
libserd-0-0:amd64	0.32.6-1
libsframe3:amd64	2.46-3ubuntu2
libsharpyuv0:amd64	1.5.0-0.1build1
libshine3:amd64	3.1.1-3build1
libsm6:amd64	2:1.2.6-1build1
libsmartcols1:amd64	2.41.3-3ubuntu2.2
libsnappy1v5:amd64	1.2.2-2
libsndfile1:amd64	1.2.2-4
libsodium23:amd64	1.0.18-2
libsord-0-0:amd64	0.16.20-1
libsoxr0:amd64	0.1.3-4.1
libspectre1:amd64	0.2.12-2
libspeex1:amd64	1.2.1-3build1
libsqlite3-0:amd64	3.46.1-9ubuntu0.3
libsratom-0-0:amd64	0.6.20-1
libsrt1.5-gnutls:amd64	1.5.4-3
libss2:amd64	1.47.2-3ubuntu4
libssh-4:amd64	0.11.3-1ubuntu2.1
libssh2-1t64:amd64	1.11.1-1ubuntu0.26.04.4
libssl3t64:amd64	3.5.5-1ubuntu3.7
libstartup-notification0:amd64	0.12-8build1
libstdc++-15-dev:amd64	15.2.0-16ubuntu1
libstdc++6:amd64	16-20260322-1ubuntu1
libsuitesparseconfig7:amd64	1:7.12.2+dfsg-1ubuntu1
libsvtav1enc2:amd64	2.3.0+dfsg-1build1
libswresample6:amd64	7:8.0.1-3ubuntu2
libswscale9:amd64	7:8.0.1-3ubuntu2
libsys-hostname-long-perl	1.5-3
libsystemd-shared:amd64	259.5-0ubuntu3.4
libsystemd0:amd64	259.5-0ubuntu3.4
libsz2:amd64	1.1.5-1
libtasn1-6:amd64	4.21.0-2
libtesseract5:amd64	5.5.0-1build1
libtext-charwidth-perl:amd64	0.04-11build4
libtext-wrapi18n-perl	0.06-10
libthai-data	0.1.30-1
libthai0:amd64	0.1.30-1
libtheoradec2:amd64	1.2.0+dfsg-6
libtheoraenc2:amd64	1.2.0+dfsg-6
libtiff6:amd64	4.7.0-3ubuntu5
libtinfo6:amd64	6.6+20251231-1
libtirpc-common	1.3.7-0.1
libtirpc3t64:amd64	1.3.7-0.1
libtool	2.5.4-9
libtsan2:amd64	16-20260322-1ubuntu1
libtwolame0:amd64	0.4.0-2build4
libubsan1:amd64	16-20260322-1ubuntu1
libuchardet0:amd64	0.0.8-2
libudev1:amd64	259.5-0ubuntu3.4
libudfread3:amd64	1.2.0-2
libunibreak6:amd64	6.1-3build1
libunistring5:amd64	1.3-2build1
libuno-cppu3t64	4:26.2.6.3-0ubuntu0.26.04.2
libuno-cppuhelpergcc3-3t64	4:26.2.6.3-0ubuntu0.26.04.2
libuno-purpenvhelpergcc3-3t64	4:26.2.6.3-0ubuntu0.26.04.2
libuno-sal3t64	4:26.2.6.3-0ubuntu0.26.04.2
libuno-salhelpergcc3-3t64	4:26.2.6.3-0ubuntu0.26.04.2
libunwind8:amd64	1.8.3-0ubuntu1
liburcu8t64:amd64	0.15.6-1
libusb-1.0-0:amd64	2:1.0.29-2build1
libuuid1:amd64	2.41.3-3ubuntu2.2
libuv1t64:amd64	1.51.0-2ubuntu1
libva-drm2:amd64	2.23.0-1ubuntu1
libva-x11-2:amd64	2.23.0-1ubuntu1
libva2:amd64	2.23.0-1ubuntu1
libvdpau1:amd64	1.5-4
libvidstab1.1:amd64	1.1.0-2.1
libvips-tools	8.18.0-1build1
libvips42t64:amd64	8.18.0-1build1
libvisio-0.1-1:amd64	0.1.10-1build1
libvorbis0a:amd64	1.3.7-3build2
libvorbisenc2:amd64	1.3.7-3build2
libvorbisfile3:amd64	1.3.7-3build2
libvpl2	1:2.16.0-1
libvpx12:amd64	1.16.0-3
libvulkan1:amd64	1.4.341.0-1
libwayland-client0:amd64	1.24.0-2
libwayland-cursor0:amd64	1.24.0-2
libwayland-egl1:amd64	1.24.0-2
libwebp7:amd64	1.5.0-0.1build1
libwebpdemux2:amd64	1.5.0-0.1build1
libwebpmux3:amd64	1.5.0-0.1build1
libwmflite-0.2-7:amd64	0.2.14-1
libwnck-3-0:amd64	43.3-1build1
libwnck-3-common	43.3-1build1
libwpd-0.10-10:amd64	0.10.3-2build3
libwpg-0.3-3:amd64	0.3.4-3build2
libwps-0.4-4:amd64	0.4.14-2build2
libwrap0:amd64	7.6.q-36build2
libx11-6:amd64	2:1.8.13-1ubuntu0.1
libx11-data	2:1.8.13-1ubuntu0.1
libx11-xcb1:amd64	2:1.8.13-1ubuntu0.1
libx264-165:amd64	2:0.165.3222+gitb35605ac-3build1
libx265-215:amd64	4.1-4
libxau6:amd64	1:1.0.11-1build2
libxaw7:amd64	2:1.0.16-1build1
libxcb-dri3-0:amd64	1.17.0-2ubuntu1
libxcb-glx0:amd64	1.17.0-2ubuntu1
libxcb-present0:amd64	1.17.0-2ubuntu1
libxcb-randr0:amd64	1.17.0-2ubuntu1
libxcb-render0:amd64	1.17.0-2ubuntu1
libxcb-shape0:amd64	1.17.0-2ubuntu1
libxcb-shm0:amd64	1.17.0-2ubuntu1
libxcb-sync1:amd64	1.17.0-2ubuntu1
libxcb-util1:amd64	0.4.1-1build1
libxcb-xfixes0:amd64	1.17.0-2ubuntu1
libxcb-xkb1:amd64	1.17.0-2ubuntu1
libxcb1:amd64	1.17.0-2ubuntu1
libxcomposite1:amd64	1:0.4.6-1build1
libxcursor1:amd64	1:1.2.3-1build1
libxdamage1:amd64	1:1.1.7-1
libxdmcp6:amd64	1:1.1.5-2
libxext6:amd64	2:1.3.4-1build3
libxfce4panel-2.0-4	4.20.7-1
libxfce4ui-2-0:amd64	4.20.2-1
libxfce4ui-common	4.20.2-1
libxfce4util-common	4.20.1-1build1
libxfce4util7:amd64	4.20.1-1build1
libxfce4windowing-0-0:amd64	4.20.5-1
libxfce4windowing-common	4.20.5-1
libxfconf-0-3:amd64	4.20.0-1build1
libxfixes3:amd64	1:6.0.0-2build2
libxfont2:amd64	1:2.0.6-2ubuntu0.2
libxft2:amd64	2.3.6-1build2
libxi6:amd64	2:1.8.2-2
libxinerama1:amd64	2:1.1.4-3build2
libxkbcommon-x11-0:amd64	1.13.1-1
libxkbcommon0:amd64	1.13.1-1
libxkbfile1:amd64	1:1.1.0-1build5
libxml2-16:amd64	2.15.2+dfsg-0.1ubuntu0.3
libxmlsec1-1:amd64	1.3.9-1
libxmlsec1-nss1:amd64	1.3.9-1
libxmu6:amd64	2:1.1.3-4
libxmuu1:amd64	2:1.1.3-4
libxpm4:amd64	1:3.5.17-1ubuntu0.26.04.2
libxrandr2:amd64	2:1.5.4-1build1
libxrender1:amd64	1:0.9.12-1build1
libxres1:amd64	2:1.2.1-1build2
libxshmfence1:amd64	1.3.3-1build1
libxslt1.1:amd64	1.1.45-0.1
libxss1:amd64	1:1.2.3-1build4
libxt6t64:amd64	1:1.2.1-1.3build1
libxtables12:amd64	1.8.11-2ubuntu3
libxtst6:amd64	2:1.2.5-1ubuntu0.1
libxv1:amd64	2:1.0.13-1
libxvidcore4:amd64	2:1.3.7-3
libxxf86dga1:amd64	2:1.1.5-1build2
libxxf86vm1:amd64	1:1.1.4-2
libxxhash0:amd64	0.8.3-2build1
libyajl2:amd64	2.1.0-5.1
libyaml-0-2:amd64	0.2.5-2build3
libzimg2:amd64	3.0.6+ds1-1
libzix-0-0:amd64	0.8.0-1
libzmq5:amd64	4.3.5-1build3
libzstd1:amd64	1.5.7+dfsg-3
libzvbi-common	0.2.44-1ubuntu2
libzvbi0t64:amd64	0.2.44-1ubuntu2
linux-base	4.15ubuntu5
linux-libc-dev:amd64	7.0.0-38.38
login	1:4.16.0-2+really2.41.3-3ubuntu2.2
login.defs	1:4.17.4-2ubuntu3
logsave	1.47.2-3ubuntu4
lsb-release	12.1-2build1
lsof	4.99.4+dfsg-2build2
lto-disabled-list	79
lxd-agent-loader	0.13ubuntu0
lxd-installer	14ubuntu0
m4	1.4.21-1
make	4.4.1-3
man-db	2.13.1-1build1
mawk	1.3.4.20260129-1
media-types	14.0.0build1
mesa-libgallium:amd64	26.0.8-1ubuntu0.3
microcode-initrd	4ubuntu
mokutil	0.7.2-2
mount	2.41.3-3ubuntu2.2
ncurses-base	6.6+20251231-1
ncurses-bin	6.6+20251231-1
ncurses-term	6.6+20251231-1
netbase	6.5build1
netpbm	2:11.10.02-1build1
ocl-icd-libopencl1:amd64	2.3.4-1
openbox	3.6.1-12ubuntu3
openssh-client	1:10.2p1-2ubuntu3.7
openssh-server	1:10.2p1-2ubuntu3.7
openssh-sftp-server	1:10.2p1-2ubuntu3.7
openssl	3.5.5-1ubuntu3.7
openssl-provider-legacy	3.5.5-1ubuntu3.7
pandoc	3.7.0.2+ds-1
pandoc-data	3.7.0.2-1build1
parted	3.6-6
passwd	1:4.17.4-2ubuntu3
patch	2.8-2build1
pci.ids	0.0~2026.02.12-1
pciutils	1:3.14.0-1build2
perl	5.40.1-7ubuntu0.3
perl-base	5.40.1-7ubuntu0.3
perl-modules-5.40	5.40.1-7ubuntu0.3
pinentry-curses	1.3.2-3ubuntu1
pkg-config:amd64	2.5.1-4
pkgconf:amd64	2.5.1-4
pkgconf-bin	2.5.1-4
po-debconf	1.0.22
poppler-data	0.4.12-1build1
poppler-utils	26.01.0-2ubuntu0.3
procps	2:4.0.4-9ubuntu1
python-apt-common	3.1.0ubuntu1.1
python-is-python3	3.13.3-1+build1
python3	3.14.3-0ubuntu2
python3-apt	3.1.0ubuntu1.1
python3-autocommand	2.2.2-4
python3-bcrypt	5.0.0-3build1
python3-blinker	1.9.0-2build1
python3-cffi-backend:amd64	2.0.0-3build1
python3-click	8.2.0+0.really.8.1.8-1build1
python3-cryptography	46.0.5-1ubuntu2
python3-dbus	1.4.0-1build2
python3-debconf	1.5.92
python3-debian	1.0.1ubuntu2
python3-distro	1.9.0-1build1
python3-distro-info	1.15
python3-distupgrade	1:26.04.27
python3-gi	3.56.2-1
python3-httplib2	0.22.0-1ubuntu0.1
python3-inflect	7.5.0-1build1
python3-jaraco.context	6.0.1-2
python3-jaraco.functools	4.1.0-1build1
python3-jaraco.text	4.0.0-1build1
python3-jwt	2.10.1-4ubuntu1
python3-launchpadlib	2.1.0-1build1
python3-lazr.restfulclient	0.14.6-3build1
python3-lazr.uri	1.0.6-7build1
python3-minimal	3.14.3-0ubuntu2
python3-more-itertools	10.8.0-1build1
python3-mutagen	1.47.0-1build1
python3-oauthlib	3.3.1-1build1
python3-packaging	26.0-1
python3-pip	25.1.1+dfsg-1ubuntu2
python3-pip-whl	25.1.1+dfsg-1ubuntu2
python3-pkg-resources	78.1.1-0.1build1
python3-pyparsing	3.3.2-2
python3-setuptools	78.1.1-0.1build1
python3-setuptools-whl	78.1.1-0.1build1
python3-typeguard	4.4.4-2
python3-typing-extensions	4.15.0-2
python3-uno	4:26.2.6.3-0ubuntu0.26.04.2
python3-update-manager	1:26.04.5
python3-venv	3.14.3-0ubuntu2
python3-wadllib	2.0.0-3
python3-wheel	0.46.3-2
python3-xkit	0.5.0ubuntu8
python3-yaml	6.0.3-1build1
python3-zipp	3.23.0-1build1
python3.14	3.14.4-1ubuntu0.2
python3.14-minimal	3.14.4-1ubuntu0.2
python3.14-venv	3.14.4-1ubuntu0.2
qpdf	12.3.2-1
readline-common	8.3-4
ripgrep	15.1.0-1ubuntu1
rpcsvc-proto	1.4.3-1build1
rsync	3.4.1+ds1-7ubuntu0.3
rust-coreutils	0.8.0-0ubuntu3
sbsigntool	0.9.4-3.1ubuntu9
screen	4.9.1-3ubuntu2
secureboot-db	1.9build2
sed	4.9-2ubuntu1
sensible-utils	0.0.26build1
shared-mime-info	2.4-5build3
socat	1.8.1.1-1ubuntu0.1
sqlite3	3.46.1-9ubuntu0.3
ssh-import-id	5.11-0ubuntu4
sudo	1.9.17p2-1ubuntu3.2
sudo-common	1.2ubuntu
sudo-rs	0.2.13-0ubuntu1.2
supabase	2.78.1
swi-prolog-core	9.2.9+dfsg-1.1build1
swi-prolog-core-packages	9.2.9+dfsg-1.1build1
swi-prolog-nox	9.2.9+dfsg-1.1build1
systemd	259.5-0ubuntu3.4
systemd-resolved	259.5-0ubuntu3.4
systemd-sysv	259.5-0ubuntu3.4
sysvinit-utils	3.15-5ubuntu1
tar	1.35+dfsg-4ubuntu0.4
tesseract-ocr	5.5.0-1build1
tesseract-ocr-eng	1:4.1.0-2build1
tesseract-ocr-osd	1:4.1.0-2build1
ttf-mscorefonts-installer	3.8.1ubuntu2
tzdata	2026c-0ubuntu0.26.04.1
ubuntu-drivers-common	1:0.10.9
ubuntu-keyring	2023.11.28.1build1
ubuntu-pro-client	38ubuntu0~26.04
ubuntu-release-upgrader-core	1:26.04.27
ucf	3.0052ubuntu1
udev	259.5-0ubuntu3.4
unminimize	0.5build1
uno-libs-private	4:26.2.6.3-0ubuntu0.26.04.2
update-manager-core	1:26.04.5
update-notifier-common	3.207.2
ure	4:26.2.6.3-0ubuntu0.26.04.2
usbutils	1:019-1
user-session-migration	0.5.1
util-linux	2.41.3-3ubuntu2.2
wget	1.25.0-2ubuntu4.4
x11-common	1:7.7+26ubuntu1
x11-utils	7.7+7build1
x11-xkb-utils	7.7+9build1
x11-xserver-utils	7.7+11build1
xauth	1:1.1.2-1.1build1
xdg-user-dirs	0.19-1
xdg-utils	1.2.1-2ubuntu2
xfce4-panel	4.20.7-1
xfconf	4.20.0-1build1
xfonts-cyrillic	1:1.0.5+nmu1build1
xfonts-encodings	1:1.0.5-0ubuntu3
xfonts-scalable	1:1.0.3-1.3build1
xfonts-utils	1:7.7+7build1
xkb-data	2.46-2
xserver-common	2:21.1.22-1ubuntu1.3
xsettingsd	1.0.2-1build2
xvfb	2:21.1.22-1ubuntu1.3
xxd	2:9.1.2141-1ubuntu4.9
xz-utils	5.8.3-1
zip	3.0-15ubuntu3
zlib1g:amd64	1:1.3.dfsg+really1.3.1-1ubuntu3.1

GCC C++ include search paths

#include "..." search starts here:
#include <...> search starts here:
 /usr/include/c++/15
 /usr/include/x86_64-linux-gnu/c++/15
 /usr/include/c++/15/backward
 /usr/lib/gcc/x86_64-linux-gnu/15/include
 /usr/local/include
 /usr/include/x86_64-linux-gnu
 /usr/include
End of search list.

Header inventory

There are 5,192 header files under /usr/include, /usr/local/include, and the GCC internal include directory. They are individual files, not packages. Nearly all of them come from a few development packages already listed above, plus the headers bundled with the /usr/local Node and Python builds:

Location	Files	Comes from
`/usr/local/include/node`	2,365	Node.js 20 install (V8, libuv, OpenSSL, N-API headers), not dpkg
`/usr/include/linux`, `asm-generic`	851	`linux-libc-dev` (kernel userspace API, not a build tree for the running 6.1 kernel)
`/usr/include/c++/15`	811	`libstdc++-15-dev`
`/usr/include/x86_64-linux-gnu`	418	`libc6-dev`, `libstdc++-15-dev` (arch-specific bits)
`/usr/include` (other top-level)	308	mostly `libc6-dev` (glibc), plus the smaller `linux-libc-dev` dirs (`drm`, `rdma`, `sound`, `scsi`, …), `libcrypt-dev`, and `libltdl-dev`
`/usr/local/include/python3.14`	284	the `/usr/local` Python 3.14.8 build
`/usr/lib/gcc/x86_64-linux-gnu/15/include`	155	`gcc-15` / `libgcc-15-dev` (intrinsics such as `immintrin.h`)

The practical takeaway is what’s missing: no third-party library development headers are installed. There is no zlib.h, no OpenSSL, curl, libpng/jpeg, SQLite, libffi, ncurses, or readline headers in /usr/include. Plain C/C++ against libc and libstdc++ builds out of the box. Anything that links a system library needs a sudo apt install lib…-dev first. The counts are based on filenames, not on compile or link tests.

Visibility and caveats

Everything above is a point-in-time reading from one session on 2026-10-23. The image is rebuilt often (see the Python protobuf build stamp), so versions will drift.
The inventory is not pristine: SWI-Prolog and its dependencies were added during the session.
Device nodes and installed packages show what is present, not what is attached or running. GPU absence is based on there being no GPU device nodes and no PCI devices at all.
The host machine, the inference stack, and any external tool services (such as web browsing) are not observable from inside the guest.
No environment-variable values, credentials, network addresses, or machine identifiers were collected.

Originally published in TheBigPromptLibrary on GitHub (view source).
⭐ Star the library on GitHub for more system prompts and research.

When “Just Do It” Isn’t Enough: Invoking Claude Code Tools by Name

August 9, 2026November 9, 2026 elias AI / LLM claude-code

The cases where naming the exact tool beats describing the outcome.

Claude Code exposes a few dozen tools, and most of the time you should never name one. You say what you want ("find every place we validate emails", "build it and run it") and the model routes the request to the right tool. That default is good, and you should lean on it.

But routing is the model’s guess at your intent, and sometimes the guess isn’t what you wanted. It answers when you wanted to be asked. It presses on when you wanted a checkpoint. It skips the task list you wanted kept. It improvises three shell commands when you wanted one specific search. In those moments the fix is the same: stop describing the outcome and name the tool. Saying "use the AskUserQuestion tool" or "use TaskCreate" or "use Monitor" turns a guess into a guarantee.

This article is about those moments, the legitimate cases where naming the tool gives you deterministic control, followed by a full, typed reference so you know exactly what to say and with which arguments.

Two ways to invoke, and when to switch

The model is a good dispatcher. Tell it what you want and it walks to the toolbox, picks a tool, and uses it. Ninety percent of the time that is exactly right, and you should let it drive. But a dispatcher is guessing at your intent, and every so often you want to reach past it and grab a specific tool yourself. That reach is the whole skill this article teaches: knowing the names well enough to ask for one on purpose.

Outcome phrasing (the default): "Find where auth is handled." The model picks the tool. Best for almost everything.
By-name invocation (this article): "Use the Grep tool with pattern=’validateAuth’, output_mode=’content’." You pick the tool and, optionally, its exact arguments. Best when the specific behavior matters more than the outcome.

Switch to by-name when any of these is true: you want a specific mechanism (this tool, not a substitute), you want a behavior the model wouldn’t trigger on its own, or the tool is keyword-gated and has no other way in.

When naming the tool wins

Make it stop and ask you: `AskUserQuestion`

Here is a fun one to try right now. Prompt the model with:

"Use the AskUserQuestion tool and present me three color choices."

It pops a little structured menu, red / green / blue, and waits for you to pick. Nothing about choosing a color needs a tool, which is exactly why it makes such a clean demo: you aren’t asking for an outcome, you are commandeering a specific piece of UI on demand. The model is smart enough to reach for this tool on its own, but here you are the one deciding it should.

Now swap the toy for something real:

"Use the AskUserQuestion tool to give me options before you choose the auth library."

Same move, real stakes. You convert "the model decided" into "the model asked." This is the single most useful by-name habit to build.

Force a task to exist: `TaskCreate` / `TaskUpdate`

The todo system auto-engages on big, multi-step work, but for a two- or three-step job it may not bother. When you want a durable, visible checklist regardless of the model’s judgment:

"Use TaskCreate to add a task: subject=’Migrate auth to OAuth’. Then keep it updated as you go." "Use TaskUpdate taskId=2, addBlockedBy=[‘1’] so task 2 waits for task 1."

Naming TaskCreate makes the task exist on purpose; naming TaskUpdate lets you drive status and dependencies by hand instead of hoping they’re tracked.

Start something recurring or watching, on purpose: `CronCreate`, `Monitor`, `/loop`

"Keep an eye on the build" is ambiguous; the mechanism you actually want isn’t. Name it, and you choose polling vs. streaming vs. self-pacing:

"Use CronCreate cron=’*/15 * * * *’ to re-run the tests every 15 minutes." "Use Monitor command=’tail -f dev.log | grep –line-buffered ERROR’ to tell me every time an error appears." "/loop 5m /babysit-prs" to run a prompt on an interval.

Behaviors that only exist by name: the keyword-gated tools

Some tools cannot be summoned any other way. Here the name or keyword is the API:

worktree unlocks EnterWorktree: "do this in a worktree."
ultracode (or "use a workflow") unlocks Workflow: deliberate multi-agent orchestration.
/loop with no interval unlocks ScheduleWakeup: model-paced loops.
an active code review unlocks ReportFindings: typed findings to the UI.

No amount of outcome phrasing unlocks these; the deliberate keyword is the point. They can spawn many agents or relocate your edits, so they wait for explicit consent.

Pin the exact operation: `Grep`, `Glob`, `Edit`, `Agent`

When you want one specific mechanism and no substitution:

"Use Grep with pattern=’TODO’, output_mode=’content’, -n=true" (not a subagent). "Use an Explore agent to search, don’t grep inline." "Use Edit on config.ts with replace_all=true."

Naming removes the routing guess when the how matters as much as the what.

Run a specific, known procedure: `Skill`

Skills are packaged multi-step procedures. Naming one runs that procedure rather than hoping the model reconstructs the same steps:

"Use the deep-research skill on X", or type /deep-research <question>.

Choose the output channel: `Artifact`, `PushNotification`, `WebFetch`

When you want a specific destination for the result:

"Make an Artifact I can share." / "Use PushNotification to ping me when the build finishes." / "Use WebFetch url=… prompt=’what changed in 2.1?’."

How to phrase a by-name call

Two levels of precision:

Name only: "Use TaskCreate to track this." The model fills in the arguments.
Name plus arguments: "Use TaskCreate with subject=’…’, description=’…’, activeForm=’…’." You pin the exact call.

The rest of this article is the reference that makes the second form possible: every tool, its parameters, types, and defaults.

The catalog: always-loaded vs deferred

The reference is the full toolset of a Claude Code 2.1.223 session (Windows, August 2026): 32 tools, 13 always-loaded and 19 deferred. Always-loaded tools are callable immediately; deferred tools are announced by name and their schemas load on demand (the model pulls one in with a ToolSearch call before first use). Parameters are marked * when required, with types and defaults noted.

File, search & shell

Read: read a file (text, image, PDF, notebook).
- file_path* string (absolute) · offset int · limit int · pages string (PDF range)
Write: create or overwrite a file you’ve Read.
- file_path* string · content* string
Edit: exact string replacement.
- file_path* string · old_string* string · new_string* string · replace_all bool=false
Glob: filename pattern match, sorted by mtime.
- pattern* string · path string
Grep: ripgrep content search.
- pattern* string · path · glob · type · output_mode content|files_with_matches|count · -i/-n/-o bool · -A/-B/-C int · multiline bool · head_limit int=250 · offset int
Bash: Git Bash / POSIX shell.
- command* string · description · timeout ms=120000 (max 600000) · run_in_background bool · dangerouslyDisableSandbox bool
PowerShell: pwsh (primary shell on Windows; absent on macOS/Linux).
- command* string · description · timeout ms (max 600000) · run_in_background bool · dangerouslyDisableSandbox bool
NotebookEdit: replace/insert/delete one Jupyter cell.
- notebook_path* string · new_source* string · cell_id string · cell_type code|markdown · edit_mode replace|insert|delete (default replace)

Delegation

Agent: spawn a subagent.
- description* string (3 to 5 words) · prompt* string · subagent_type string · model sonnet|opus|haiku|fable · isolation worktree|remote · run_in_background bool=true
- subagent_type values: claude, general-purpose, Explore, Plan, statusline-setup.
SendMessage: the only way agents talk to each other; resume a spawned agent with its context, or post to main.
- to* string (teammate name, or "main") · message* string · summary string (<=200, required when message is a string)
Workflow (gated: ultracode): deterministic JS orchestration over many subagents.
- script string · scriptPath string · name string · args any · resumeFromRunId (wf_…)

Task list & background jobs

TaskCreate: new task (starts pending).
- subject* string · description* string · activeForm string · metadata object
TaskUpdate: modify a task.
- taskId* string · status pending|in_progress|completed|deleted · addBlockedBy[] · addBlocks[] · owner · subject · description · activeForm · metadata
TaskList: list all tasks. (no params)
TaskGet: one task’s full detail.
- taskId* string
TaskStop: kill a background task or named agent.
- task_id string (also name@team or a bare agent name) · shell_id (deprecated)
TaskOutput (deprecated): read a background job’s output.
- task_id* string · block bool=true · timeout ms=30000 (max 600000)

Scheduling & watching

CronCreate: schedule a prompt on 5-field local-time cron; session-only, recurring auto-expires after 7 days.
- cron* string · prompt* string · recurring bool=true · durable (no effect)
CronList: list this session’s cron jobs. (no params)
CronDelete: cancel one. · id* string
Monitor: stream events from a command’s stdout or a WebSocket; one notification per line.
- description* string · timeout_ms* number=300000 (max 3600000) · persistent* bool=false · command string or ws {url* string, protocols[]} (mutually exclusive)
RemoteTrigger: claude.ai cloud routines (backs /schedule).
- action* list|get|create|update|run · trigger_id string · body object (required for create/update)
ScheduleWakeup (gated: /loop without interval): self-paced loop scheduling.
- delaySeconds number (60 to 3600) · prompt string · reason string · stop bool

Web & output

WebFetch: fetch a URL, convert to markdown, answer a prompt (15-min cache, HTTP upgraded to HTTPS, no auth).
- url* uri · prompt* string
WebSearch: web search (US-only).
- query* string (min 2) · allowed_domains[] · blocked_domains[]
PushNotification: desktop/phone ping.
- message* string (<200 chars) · status* const "proactive"
AskUserQuestion: structured multiple-choice back to you (interactive only).
- questions[]* where each has: question string, header string (<=12), options[] (2 to 4: label, description, preview), multiSelect bool

Planning, isolation & design

EnterPlanMode / ExitPlanMode: read-only planning and approval (interactive; also shift+tab). (no params)
EnterWorktree (gated: worktree): isolated git worktree.
- name string (<=64) or path string, mutually exclusive
ExitWorktree: leave the worktree session.
- action* keep|remove · discard_changes bool (true to remove a dirty worktree)
DesignSync: read/write claude.ai design-system projects; ordering is read, then finalize_plan, then write.
- method* list_projects|get_project|list_files|get_file|finalize_plan|write_files|delete_files|register_assets|unregister_assets|create_project|report_validate · plus projectId, planId, path/paths[], writes[]/deletes[], localDir, files[], assets[], name

Specialized & internal

Skill: run a packaged skill / slash command.
- skill* string (exact name, no leading slash) · args string
ReportFindings (gated: code-review): typed findings to the UI.
- findings[]* where each has: file, summary, failure_scenario*, line, category, short_summary, verdict, outcome · level low|medium|high|xhigh|max
Artifact: publish an HTML/Markdown file as a private claude.ai page (interactive).
- file_path string · favicon emoji (required to publish) · title · description · url (update) · action publish|list
ToolSearch: load deferred tool schemas on demand (internal; never prompt for it).
- query* string (select:A,B, keywords, or +name term) · max_results* number=5

Compact reference

Loaded = always-on; Deferred = schema loads on demand. * = required.

Tool	Loaded	Purpose	Key arguments
Read	always	read file / image / PDF / notebook	`file_path`*, offset, limit, pages
Write	always	create / overwrite a Read file	`file_path`, `content`
Edit	always	exact string replacement	`file_path`, `old_string`, `new_string`*, replace_all
Glob	always	filename pattern match	`pattern`*, path
Grep	always	ripgrep content search	`pattern`*, path, glob, type, output_mode, -i/-n/-o, -A/-B/-C, multiline, head_limit
Bash	always	POSIX shell	`command`*, timeout, run_in_background
PowerShell	always (Windows)	pwsh shell	`command`*, timeout, run_in_background
NotebookEdit	deferred	edit one Jupyter cell	`notebook_path`, `new_source`, cell_id, cell_type, edit_mode
Agent	always	spawn a subagent	`description`, `prompt`, subagent_type, model, isolation, run_in_background
SendMessage	deferred	agent-to-agent message	`to`, `message`, summary
Workflow	always (gated: ultracode)	multi-agent orchestration script	script / scriptPath / name, args
TaskCreate/List/Get/Update	deferred	todo tracking and dependencies	`subject`/`description`; `taskId`; status, addBlockedBy/addBlocks
TaskStop	deferred	kill background task / agent	task_id
TaskOutput	deferred (deprecated)	read a background job’s output	`task_id`*, block, timeout
CronCreate/List/Delete	deferred	in-session scheduled prompts	`cron`, `prompt`, recurring; `id`*
Monitor	deferred	stream events from logs / cmds / WebSockets	`description`, `timeout_ms`, `persistent`*, command \| ws
RemoteTrigger	deferred	cloud routines (`/schedule`)	`action`*, trigger_id, body
ScheduleWakeup	always (gated: `/loop`)	self-paced loops	delaySeconds, prompt, reason, stop
WebFetch / WebSearch	deferred	fetch a URL / web search	`url`+`prompt`; `query`*
PushNotification	deferred	desktop / phone ping	`message`, `status`
AskUserQuestion	interactive	structured question to the user	`questions[]`*
EnterPlanMode / ExitPlanMode	interactive	read-only planning and approval	(none)
EnterWorktree / ExitWorktree	deferred (gated: worktree)	isolated git worktree	name \| path; `action`*, discard_changes
DesignSync	deferred	claude.ai design-system read/write	`method`*, projectId, planId, writes/deletes, files, assets
Skill	always	run a slash command	`skill`*, args
ReportFindings	always (gated: code-review)	typed findings to UI	`findings[]`*, level
Artifact	interactive	publish HTML/MD as a private page	file_path, favicon, url, action
ToolSearch	always	load deferred tool schemas	`query`, `max_results`

How this was measured

Three methods, each more authoritative, and no network capture needed. The parameter schemas come straight from the running session.

Ask, interactively: "list all your tools with their arguments."
Headless, scriptable: claude -p "Introspect and list every tool… output markdown." One thing to know: headless -p exposes a reduced toolset. Artifact, AskUserQuestion, and the plan-mode tools don’t appear (no interactive surface), so add them back by hand.
Read the session logs: ~/.claude/projects/<encoded-cwd>/<session-uuid>.jsonl records the roster (tool_reference, deferred_tools_delta, skill_listing, agent_listing_delta) from the harness, independent of the model, though not the argument schemas (inputSchema isn’t in the transcript).

The typed parameters above come from ToolSearch loading each deferred tool’s full JSONSchema, the same definition the CLI would send on the wire, so a packet capture would only show what the session already hands over.

Originally published in TheBigPromptLibrary on GitHub (view source).
⭐ Star the library on GitHub for more system prompts and research.

Full system inventory of the ChatGPT Work VM

August 6, 2026November 9, 2026 elias AI / LLM chatgpt, chatgpt-work, sandbox

ChatGPT Work mode gives you a VM — a real Linux machine sitting behind the chat box, not a scratch pad that draws a chart and forgets it. You can write code in it, build that code, browse the web, run experiments, serve files, and keep a persistent filesystem for the length of your session.

That combination is what makes it powerful. Point it at a repository and it will clone it, build it, run the output, and iterate on experiments with you. When you are done, ask it to zip the results and it hands you a download link. A full develop-build-run-collect loop, driven in plain English.

So the obvious question is: what is the machine? How many cores, how much RAM, how much disk, which toolchains are already installed, and where are the walls? This is the full inventory — CPU, memory, storage, resource limits, installed software, Python and Node package lists, and the parts of the host the sandbox deliberately refuses to show you.

This article is a companion to the two earlier sandbox inventories in this repo, the Python package list and the Linux package list of the ChatGPT code interpreter — but that was a different, far more constrained box, and this one goes well past packages. Captured 2026-08-06 09:13:48 PDT (2026-08-06T16:13:48.374439+00:00) on a pristine workspace — nothing cloned, installed, or built beforehand. Every figure below is a live reading taken at that moment, not the model’s recollection of its own environment.

Practical capacity, up front

If you are sizing up what to run in this thing, the useful limits are:

9 logical vCPUs
23.55 GB total RAM, with 22.11 GB free at capture
58.28 GB workspace storage available
No swap
Strong Python, Node.js, C/C++, document, spreadsheet, PDF, image, OCR, and media-processing support
No Docker/Podman, Go, Rust, .NET, CMake, Kubernetes, or database client tooling preinstalled

The environment suits moderately large Python/Node projects and Make-based C/C++ projects, subject to the restricted network and sandbox filesystem. Anything that expects CMake, a Go/Rust toolchain, or a container runtime will need to bring it along — or will simply not build.

The rest of this article is the evidence behind those numbers.

Important scope note

This is a restricted, KVM-backed execution environment. The figures below describe resources exposed to this workspace, not the full physical host. /proc, /sys, the mount table, the Debian package database, PCI devices, and GPU devices are hidden or incomplete. Where ordinary tools could not read those interfaces, the inventory falls back to direct operating-system syscalls and runtime APIs — which is why you will see sysinfo-style numbers instead of free/lscpu output.

Operating system

Item	Value
Distribution	Ubuntu 24.04.3 LTS
Codename	Noble Numbat
Kernel	Linux 6.18.35
Kernel build	`#1 SMP Mon Jul 27 18:07:50 UTC 2026`
Architecture	x86_64 / AMD64
Word size	64-bit
Byte order	Little-endian
C library	glibc 2.39
Virtualization	KVM
Hostname	`f20c423af0c2`
Workspace time zone	America/Los_Angeles
Page size	4,096 bytes
Uptime at capture	44,515 seconds (~12 h 21 m 55 s)
Load averages	0.000 / 0.000 / 0.000
Process count reported by `sysinfo`	213

Note the container-style hostname and the ~12 hours of uptime on a completely idle box — this workspace had been sitting warm long before I asked it anything.

CPU

Item	Value
Assigned processors	9 logical vCPUs
CPU affinity	IDs 0 through 8
Exposed architecture generation	AMD Zen 4
Native GCC target	`znver4`
CPUID brand reading	AMD EPYC 9V74 80-Core Processor
Hypervisor	KVM
L1 instruction cache	32 KiB
L1 data cache	32 KiB
Cache-line size	64 bytes
L2 cache	1 MiB
L3 cache	32 MiB

The processor brand describes the virtualized host CPU class, not your allocation. This workspace has 9 vCPUs, not 80 dedicated cores. Physical sockets, physical-core count, topology, and frequency are not exposed. The fresh native compiler probe still reports the znver4 target.

The AMD EPYC 9V74 string is itself a small tell: the V series parts are Azure-specific SKUs, which is consistent with where this workload is hosted.

Exposed native instruction support includes MMX, SSE through SSE4.2, AVX, AVX2, FMA, BMI1/2, AES, PCLMUL, VAES, VPCLMULQDQ, SHA, GFNI, RDRAND, RDSEED, and multiple AVX-512 extensions: F, VL, BW, DQ, CD, VBMI, VBMI2, IFMA, VNNI, VPOPCNTDQ, BITALG, and BF16.

Memory

Values are dynamic and reflect this capture.

Item	Size
Total RAM	23.55 GB
Free RAM	22.11 GB
Shared memory	108 MB
Buffer memory	78 MB
Swap total	0
Swap free	0

No swap. Whatever you run here either fits in RAM or gets killed.

Workspace storage

This is the mounted workspace filesystem capacity, not the host’s complete physical storage inventory.

Item	Size
Filesystem capacity	67.05 GB
Used	5.32 GB
Available to workspace	58.28 GB
Raw free blocks	61.73 GB

Used portion of total capacity: approximately 7.93%.
Filesystem block and fragment size: 4 KiB.
Inodes: 4,194,304 total; 4,081,122 free.
Maximum filename length: 255 bytes.

Resource limits

Limit	Soft	Hard
Open files	16,384	16,384
Processes	7,851	7,851
Stack	8 MiB	Unlimited
Core dump	0 (disabled)	Unlimited ceiling

Main development software

Software	Version	Executable/status
Git	2.51.1	`/usr/local/bin/git`
Git LFS	3.4.1	`/usr/bin/git-lfs`
GCC	13.3.0	`/usr/bin/gcc`
G++	13.3.0	`/usr/bin/g++`
GNU Make	4.3	`/usr/bin/make`
Python	3.12.13	Bundled primary runtime
pip	26.0.1	Bundled primary runtime
uv	0.11.33	Bundled primary runtime
Node.js	24.14.0 LTS ("Krypton")	Bundled primary runtime
npm	11.9.0	Bundled primary runtime
pnpm	11.7.0	Bundled primary runtime
Corepack	0.34.6	Globally installed with Node
Perl	5.38.2	`/usr/bin/perl`
Bash	5.2.21	`/usr/bin/bash`
Zsh	5.9	`/usr/bin/zsh`
curl	8.5.0	`/usr/bin/curl`
wget	1.21.4	`/usr/bin/wget`
OpenSSH	9.6p1	`/usr/bin/ssh`
OpenSSL CLI	3.0.13	`/usr/bin/openssl`
apt	2.8.3	`/usr/bin/apt`
dpkg	1.22.6	`/usr/bin/dpkg`
jq	1.7	`/usr/bin/jq`
ripgrep	15.2.0	Bundled Codex path
nano	Present	`/usr/bin/nano`
rsync	Present	`/usr/bin/rsync`

The bundled Python and Node runtimes use OpenSSL 3.5.5. Python reports SQLite 3.50.4 and zlib 1.3.1. Node reports SQLite 3.51.2, V8 13.6.233.17-node.41, ICU 78.2, Unicode 17.0, libuv 1.51.0, zlib 1.3.1, and zstd 1.5.7.

Document, image, media, and OCR software

Software	Version/status
FFmpeg	6.1.1
ImageMagick	6.9.12-98 Q16
Pandoc	3.1.3
Tesseract OCR	5.3.4
Poppler `pdftotext`	24.02.0
Ghostscript	10.02.1
LibreOfficeDev	26.8.0.0.alpha0 (bundled launcher works for version inspection)
Inkscape	Executable present, but fails — `libinkscape_base.so` unavailable
Java	Launcher present, but fails — `libjli.so` unavailable

Installed Python packages

51 installed Python distributions:

PyMuPDF==1.26.6
PyYAML==6.0.3
annotated-types==0.7.0
artifact_tool_v2==2.8.21
cffi==1.17.1
charset-normalizer==3.4.4
contourpy==1.3.3
cryptography==46.0.0
cycler==0.12.1
et_xmlfile==2.0.0
fonttools==4.61.1
joblib==1.5.3
kiwisolver==1.4.9
lxml==6.0.2
matplotlib==3.10.8
numpy==2.3.5
openpyxl==3.1.5
packaging==26.2
pandas==2.2.3
pdf2image==1.17.0
pdfminer.six==20251107
pdfplumber==0.11.8
pillow==12.2.0
pip==26.0.1
pycparser==2.23
pydantic==2.13.4
pydantic_core==2.46.4
pyhumps==3.8.0
pyparsing==3.3.2
pypdf==6.10.0
pypdfium2==5.3.0
python-dateutil==2.9.0.post0
python-docx==1.2.0
python-pptx==1.0.2
pytz==2026.2
reportlab==4.4.9
scikit-learn==1.8.0
scipy==1.17.0
seaborn==0.13.2
setuptools==82.0.1
six==1.17.0
threadpoolctl==3.6.0
typing-inspection==0.4.2
typing_extensions==4.15.0
tzdata==2026.2
uv==0.11.33
websockets==16.0
wheel==0.47.0
xlrd==2.0.1
xlsxwriter==3.2.9
zstandard==0.25.0

Compare this with the 2024 code interpreter list: that sandbox shipped hundreds of packages including the full scientific/ML stack. This one is a lean 51 — document processing, plotting, and a minimal scikit-learn/scipy core. Note the internal artifact_tool_v2==2.8.21 distribution, which is not a public PyPI package.

Bundled Node.js libraries

Top-level runtime modules:

@napi-rs
@oai
@viz-js
docx
jpeg-js
lucide
marked
pdf-lib
pdfjs-dist
pixelmatch
playwright
pngjs
pnpm
pptxgenjs
sharp
tesseract.js

There are 117 package.json manifests across the bundled Node dependency tree. Global Node packages are corepack@0.34.6 and npm@11.9.0. The @oai scope is, again, internal tooling rather than anything published.

Software availability summary

Present and usable or discoverable on PATH:

apt, dpkg, git, git-lfs, curl, wget, rsync, ssh, scp,
gcc, g++, make, python3, pip, uv, node, npm, npx, pnpm,
perl, jq, rg, nano, ffmpeg, convert, pandoc, soffice,
tesseract, pdftotext, gs

Not found as command-line executables:

rpm, apk, snap, flatpak, gh, svn, hg, gfortran, clang,
clang++, cmake, ninja, meson, autoconf, automake, yarn,
bun, deno, ruby, gem, javac, go, rustc, cargo, dotnet,
php, R, sqlite3, psql, mysql, redis-cli, docker, podman,
buildah, kubectl, helm, terraform, ansible, yq, fd, vim,
nvim, emacs, tmux, screen, magick, chromium,
chromium-browser, google-chrome, playwright CLI, qpdf,
nvidia-smi, rocminfo, lspci, lsusb

Although a playwright Node module is bundled, there is no standalone playwright executable on the inspected PATH.

Inventory counts

Category	Count
Unique executable files found across `PATH` directories	1,023
Resolvable shell command names	1,393
Shared libraries in the linker cache	505
Python distributions	51
Node package manifests in bundled dependency tree	117

Visibility limitations

This is the interesting half of the exercise — what the sandbox won’t tell you:

The Debian package manager executables exist, but the sandbox does not expose a complete package database. An authoritative full apt/dpkg package list cannot be generated here — which is exactly the trick that worked on the 2024 code interpreter sandbox and no longer works on this one.
/proc and /sys are not normally mounted for shell tools, so lscpu, free, df, lsblk, and similar utilities cannot produce their usual reports. Direct syscall/runtime readings were used instead.
GPU presence cannot be confirmed. Neither NVIDIA nor AMD GPU utilities are installed, and PCI/sysfs discovery is unavailable. Read this as GPU unknown, not definitively "no GPU."
Physical disk devices, storage model, RAID layout, CPU sockets, physical-core topology, thermal state, and clock frequency are not exposed.
Installed executables are not guaranteed to be functional. Java and Inkscape are both present launchers with missing runtime libraries.

Originally published in TheBigPromptLibrary on GitHub (view source).
⭐ Star the library on GitHub for more system prompts and research.

What ChatGPT Work Can Really Do: Reverse Engineering a Binary From My Phone, On a Walk

July 29, 2026November 9, 2026 elias AI / LLM, Reverse Engineering chatgpt, chatgpt-work, ghidra

I left the house for a walk. I dictated one paragraph into my phone. Seventy-five minutes later I had a fully analyzed Ghidra project, fifteen recovered function names and prototypes, a patch for a real bug in my own code, and a compiling C reconstruction of a stripped binary — in a zip file, waiting for me.

The part nobody tells you: it’s a VM

ChatGPT Work is the successor to Agent mode — the thing you used to trigger by typing @Agent. The rename made it sound like a productivity feature. It isn’t. When you’re in ChatGPT Work in the mobile app, you have a Linux VM.

That is the whole story. Not a sandbox that draws a chart and forgets it — a real machine with a shell, a persistent filesystem, network access, compilers, and 50+ GB of disk. Once you internalize that, your prompts change shape. You stop asking for explanations and start asking for work:

Clone this repo. Read its install docs. Build it. It’ll break — figure out why and fix it. Then actually run it against something real.

And because it’s a VM with a filesystem, there’s a natural ending to every session: ask for a zip. Everything the machine produced comes back to you as a download, ready to open on your desktop. Clone → build → experiment → zip. That loop fits in a walk.

I documented what’s inside that machine separately — CPU, RAM, disk, toolchains, and everything the sandbox refuses to show you — in Full system inventory of the ChatGPT Work VM. This article is what happens when you use it.

The ask

I wanted to see it do something genuinely hard. Not "write me a script" hard — reverse engineering hard.

I have a project called GhidraSQL: an agentic connector that exposes Ghidra, the NSA’s software reverse engineering suite, as a SQL interface. The binary becomes a database you can SELECT, UPDATE, and JOIN — functions, call graph, strings, and decompiled pseudocode all queryable, findings written straight back into the project. It’s one of the xSQL family of tools I presented at REcon 2026, and it’s built for exactly this kind of agent-driven analysis — but it needs Ghidra, a JDK, Gradle, and CMake to even start.

So I dictated this into my phone (note the typos in the transcription) and kept walking:

Go to GitHub under user name 0xEB, Elias Bachaalany. There’s a project called GhidraSQL, which relies on another project called Ghidra. Anyway, clone GhidraSQL, and it has an install prompt, markdown file, follow the instruction, and sets it up and builds it. Catch all the errors if there are errors with respect to the installation steps. Figure it out, and try to run GhidraSQL executable in headless mode. Pick a binary of your choice, and see if you can query the binary. And start with a terminal shell. That’s it, to start with a terminal shell and then issue the git clone command. You don’t need any GitHub skills or any GitHub connector.

The dictated prompt and the first minutes of work

The prompt as dictated on a walk. "GidraSQL" in the screenshot is a voice-transcription artifact, corrected above.

Note what that prompt does and doesn’t do. It doesn’t specify a binary — I said "pick a binary of your choice." It doesn’t tell it how to fix anything. It explicitly forbids the shortcut ("you don’t need any GitHub skills or any GitHub connector") because I wanted to see plain git in a plain shell. And it pre-authorizes the hard part: catch all the errors, figure it out.

Then I put the phone in my pocket.

52 minutes, unattended

It opened a terminal, cloned at commit 33d5dea, and read the repo’s install-prompt.md end to end before touching the environment. Then preflight:

Preflight caught three real blockers before the build: the java launcher is present but cannot locate libjli.so, while CMake and Gradle are absent. GCC 13, Git, Python 3.12, and disk space are fine.

Every one of those is confirmed in the environment inventory: Java ships as a launcher with a missing runtime library, and CMake and Gradle simply aren’t installed. A less careful agent would have run cmake and face-planted. This one checked first, then went shopping:

I’m repairing preflight with portable, checksum-pinned toolchains inside the workspace: Temurin JDK 21.0.12, CMake 3.31.8, Gradle 8.14.3, and the official Ghidra 12.1.2 distribution. This avoids modifying the base system and matches the runbook’s version gates. Downloads total about 930 MB.

Checksum-pinned. Workspace-local. Version-gated against my own runbook. It searched 8 websites to confirm current release versions first. That is what a competent engineer does on an unfamiliar box, and it did it while I was looking at trees.

The walls — and how it got over them

This is my favorite part of the whole run, and it’s the part that proves nobody scripted this in advance. Eight distinct failures, each diagnosed and fixed. Straight from report.md:

Stage	Observed failure	Cause	Resolution
Toolchain discovery	Required JDK 21, modern CMake, and Gradle were absent or unusable from the system path	Host tools did not satisfy the install prompt	Installed workspace-local OpenJDK 21.0.12, CMake 3.31.8, Gradle 8.14.3
Java loader	`libjli.so: cannot open shared object file`	The relocatable JDK’s private libraries were not on the loader path	Supplied the JDK `lib` and `lib/server` directories through `LD_LIBRARY_PATH`
Temporary files	Java/native steps could not rely on a normal `/tmp`	The runtime had no usable conventional temporary directory	Used workspace `.tmp` through `TMPDIR` and `-Djava.io.tmpdir`
Dependency transport	HTTPS dependency resolution/downloads failed or were interrupted	Restricted/proxied transport; Java trust did not initially match	Used Git transport, resumable downloads, and a workspace-local Java trust setup
Parallel native build	The assembler received truncated input during a concurrent build	Resource pressure interrupted a compiler process, leaving an incomplete assembly stream	Removed only the failed target output and rebuilt serially
Ghidra launch	`support/launch.sh` failed where Bash process substitution required `/dev/fd`	`/dev/fd` was unavailable in the runtime	Rewrote the process-substitution loops as here-strings
First managed GhidraSQL run	glibc aborted in `pthread_mutex_lock`	Two cpp-httplib revisions with different feature macros linked into one executable — incompatible inline class layouts	Forced a single shared cpp-httplib source and linked it publicly
First strict source build	Fallthrough and "control reaches end" diagnostics became errors	The compiler didn’t know `usage()` and the OOM handler never return	Marked both `_Noreturn`; final strict build is clean

Look at row six. Ghidra’s own launcher uses Bash process substitution — done < <(command) — which needs /dev/fd. The VM doesn’t have it. The fix is twelve lines:

 while IFS=$'\r\n' read -r line; do
+	[ -z "$line" ] && continue
 	IFS='=' read -r key value <<< "$line"
 	if [ -z ${!key} ]; then
 		export $key=$value
 	fi
-done < <("${JAVA_CMD}" -cp "${LS_CPATH}" LaunchSupport "${INSTALL_DIR}" -envvars)
+done <<< "$("${JAVA_CMD}" -cp "${LS_CPATH}" LaunchSupport "${INSTALL_DIR}" -envvars)"

Same semantics, no /dev/fd, plus a guard for the empty line that the here-string form introduces. That’s not pattern-matching a Stack Overflow answer; that’s understanding why the construct failed.

And row seven is the one that made me sit up. The managed server crashed inside pthread_mutex_lock — the kind of bug that eats an afternoon. It correctly identified an ODR/ABI mismatch: two different revisions of the header-only cpp-httplib were being pulled into one executable with different OpenSSL/zlib feature macros, so the inline class layouts disagreed and the server object’s synchronization state was corrupted. It wrote the CMake fix, rebuilt, and the server came up.

That’s a real bug in my project, found by an agent on my phone, with a correct diagnosis and a working patch. I’m keeping that fix (and its explanation) for GhidraSQL upstream rather than reprinting it here — but it’s the strongest single result of the run.

The actual reverse engineering

With GhidraSQL alive, it picked its own target: the system /bin/ls. A stripped x86-64 PIE ELF, GNU coreutils 9.4.

The choice of binary barely matters. It could have been a malware sample, a firmware blob, or a vendor library — the workflow is identical. ls is a good demo precisely because you can check the answer: everyone knows what ls is supposed to do, so a reconstruction either behaves like ls or it doesn’t.

The first query sets the scene:

SELECT * FROM binary;
SELECT COUNT(*) AS funcs, SUM(size) AS total_bytes FROM funcs;
SELECT COUNT(*) AS edges FROM callgraph_edges;
SELECT COUNT(*) AS string_hits FROM string_refs;

412 functions. 79,542 bytes of function body. 1,363 call graph edges. 259 string references. Stripped, so every one of those functions is named FUN_00104da0 and typed undefined.

Finding main in a stripped PIE binary is the classic first move, and it did it the classic way — one query:

SELECT text FROM pseudocode WHERE func_addr = 0x106D30;

void processEntry entry(undefined8 param_1, undefined8 param_2)
{
  undefined1 auStack_8 [8];
  __libc_start_main(FUN_00104da0, param_2, &stack0x00000008, 0, 0, param_1, auStack_8);
  do { /* WARNING: Do nothing block with infinite loop */ } while( true );
}

The first argument to __libc_start_main is main. There it is: 0x104DA0. From there it worked outward through the call graph, string evidence, and scoped decompilation — 8,029 bytes of main, 72 distinct callees, GNU help text and embedded src/ls.c assertion strings as corroboration.

Then it started writing findings back. Each annotation is one transaction that reads the function, tags it, renames it, sets a prototype, attaches a plate comment, reads it back to verify, and saves:

SELECT addr,name,prototype FROM funcs WHERE addr=0x107D70;
INSERT OR IGNORE INTO function_tag_mappings(func_addr,tag_name) VALUES(0x107D70,'progress:seed');
UPDATE funcs SET name='ascii_strncasecmp',
  prototype='int ascii_strncasecmp(char *left, char *right, long length)' WHERE addr=0x107D70;
INSERT INTO comments(addr,comment,source)
  VALUES(0x107D70,'Compare at most length ASCII bytes case-insensitively; locale-independent helper.','plate');
INSERT OR IGNORE INTO function_tag_mappings(func_addr,tag_name)
  VALUES(0x107D70,'progress:reviewed'),(0x107D70,'progress:annotated');
SELECT addr,name,prototype FROM funcs WHERE addr=0x107D70;
SELECT save_database();

Read → write → read-back → save. Fifteen times. The discipline was deliberate and recorded: keep decompiler queries scoped to one function, serialize decompiler work, establish names from multiple evidence sources before writing, verify every mutation, save after coherent groups.

Here’s what came out:

Address	Recovered name	Prototype	Role
`0x104DA0`	`main`	`int main(int argc, char **argv)`	Initialize state, parse options, gather/sort/print operands, drain the directory queue
`0x106EA0`	`get_funky_string`	`bool get_funky_string(char dest, char src, int equals_end, long *length)`	Decode `LS_COLORS` escape syntax
`0x107D70`	`ascii_strncasecmp`	`int ascii_strncasecmp(char left, char right, long length)`	Locale-independent bounded ASCII comparison
`0x1090E0`	`usage`	`void usage(int status)`	Print usage/help and exit
`0x109EE0`	`stdout_isatty`	`bool stdout_isatty(void)`	Cache and return stdout terminal state
`0x109F10`	`clear_files`	`void clear_files(void)`	Free accumulated file records, reset per-listing state
`0x10B910`	`required_statx_mask`	`uint required_statx_mask(void)`	Build the metadata mask required by active options
`0x10BBB0`	`color_indicator_is_nonempty`	`bool color_indicator_is_nonempty(uint indicator)`	Test whether a selected color indicator has content
`0x10BD80`	`get_type_indicator`	`char get_type_indicator(char stat_ok, uint mode, int filetype)`	Return the classification suffix for a file type
`0x10E4B0`	`sort_files`	`void sort_files(void)`	Sort the file-pointer array using active options
`0x1105F0`	`print_current_files`	`void print_current_files(void)`	Render the current vector in the selected layout
`0x110B80`	`queue_directory`	`void queue_directory(char name, char realname, bool command_line_arg)`	Prepend a deferred directory traversal record
`0x110C00`	`extract_dirs_from_files`	`void extract_dirs_from_files(char *dirname, bool command_line_arg)`	Move directories from the file vector to the traversal queue
`0x110FD0`	`print_dir`	`void print_dir(char name, char realname, bool command_line_arg)`	Enumerate, gather, sort, print, recurse
`0x1174A0`	`gobble_file`	`ulong gobble_file(char name, uint filetype, bool command_line_arg, char dirname)`	Gather one file record and its requested metadata

Anyone who has read coreutils will recognize those names. They weren’t looked up — they were derived, then independently corroborated by the embedded assertion strings.

Proving it stuck

Naming functions in a decompiler is easy. Making the work persist is where headless automation usually falls apart. So it tested itself: final save_database(), clean shutdown, then reopen the same project read-only and ask whether anything survived.

SELECT program_revision() AS reopened_revision;
SELECT f.name, printf('0x%X',f.addr) AS addr, f.prototype, c.comment
  FROM funcs f JOIN comments c ON c.addr=f.addr
  WHERE f.addr IN (0x104DA0,0x106EA0,0x107D70, /* …all 15… */ 0x1174A0)
  ORDER BY f.addr;
SELECT COUNT(DISTINCT func_addr) AS persisted_annotations
  FROM function_tag_mappings WHERE tag_name='progress:annotated';

All fifteen came back, prototypes and plate comments intact:

main · 0x104DA0 · int main(int argc, char **argv) · "Initialize locale and global listing defaults; parse short/long options and environment; configure quoting, color, time, and layout; gather command-line operands; sort/print files; then drain the directory traversal queue."

readonly server exit=0. The live database had reached program revision 316 before its final save.

The payoff: it compiles, and it’s right

From the recovered architecture it wrote a C reconstruction — recovered_ls.c, ~28 KB — preserving the six-stage structure it had recovered: parse options → gather into a file vector → sort → render → extract directories into a deferred queue → enumerate and recurse.

It builds clean under warnings-as-errors:

cc -O2 -std=c11 -Wall -Wextra -Wpedantic -Werror -o recovered-ls recovered_ls.c

No FUN_, no DAT_, no LAB_, no undefined8, no decompiler warning comments. Then the test that actually matters — run the real ls and the reconstruction over the same directory and diff:

$ /bin/ls -1A --color=never        $ ./recovered-ls -1A --color=never
Makefile                            Makefile
README.md                           README.md
recovered-ls                        recovered-ls
recovered_ls.c                      recovered_ls.c

The diff is empty. Identical names, identical order.

And it checksummed everything it produced — 26 files, sha256sum -c clean, plus a cmp proving the analyzed binary matched the system one byte for byte.

The closing summary and artifact downloads

The end of the session: every artifact offered as a download. This is the "ask for a zip" ending that makes the whole loop portable.

What this is not

The reconstruction is a behavioral one, not GNU’s source, and it doesn’t pretend otherwise. It deliberately leaves out full quoting styles, complete LS_COLORS handling, ACL/SELinux columns, dired offsets, hyperlinks, locale-aware display widths, version sorting, and most long-option aliases. Each of those would need substantially more type, global, and library recovery.

The raw Ghidra pseudocode stayed in the query transcript; the reconstruction itself contains none of it. It’s shipped under GPLv3 to match the analyzed original.

Provenance was recorded rather than asserted: GhidraSQL at 33d5dea, libghidra at 0afcaa3, ghidrasql-skills at 73a3275, all v0.0.3, all cloned with plain git — no GitHub connector, no GitHub-specific skill, exactly as I asked.

Do this yourself

The pattern is simple enough to dictate while walking:

Start with the shell. "Start with a terminal shell, then git clone …" — it grounds everything that follows in a real machine.
Point at docs, not steps. "It has an install markdown, follow it." Let it read the runbook.
Pre-authorize the mess. "Catch all the errors. Figure it out." Without this it asks permission and stalls; with it, it debugs.
Leave room for judgment. "Pick a binary of your choice." Constraints you don’t need are just opportunities for it to guess wrong.
Ask for the zip. Everything it built comes home with you.

Total wall time: 52m 26s to get from git clone to a working headless GhidraSQL, 22m 41s for the recovery itself. I was not at a computer for any of it.

That’s the thing worth sitting with. The bottleneck in this session wasn’t the model’s reasoning — it was 930 MB of downloads and a serial rebuild. The reverse engineering was the easy part. And the whole thing ran on a machine I’ll never see again, kicked off from a phone, on a walk.

In this folder: report.md, the agent’s own write-up — findings, workflow, every failure and fix, and the reconstruction’s limits — plus recovered_ls.c and a Makefile. Build it with make, then try ./recovered-ls -la ..

The analyzed binary is not redistributed; it was the stock /bin/ls from the VM, SHA-256 0148f5ab3062a905281d8deb9645363da5131011c9e7b6dcaa38b504e41b68ea.

See also: Full system inventory of the ChatGPT Work VM — what’s actually inside the machine · GhidraSQL — the SQL interface to Ghidra used here.

Appendix: Headless GhidraSQL recovery report

Target and environment

The target was the local /bin/ls, copied byte-for-byte before analysis.

Property	Value
Format	ELF 64-bit LSB PIE executable
Architecture	x86-64, little-endian
State	Dynamically linked, stripped
GNU version	coreutils 9.4
Entry point	`0x106D30`
Recovered `main`	`0x104DA0`
SHA-256	`0148f5ab3062a905281d8deb9645363da5131011c9e7b6dcaa38b504e41b68ea`

The completed stack used Ghidra 12.1.2, GhidraSQL 0.0.3, libghidra 0.0.3, OpenJDK 21.0.12, Gradle 8.14.3, and CMake 3.31.8. The reconstruction was validated with Ubuntu GCC 13.3.0.

Repository revisions:

GhidraSQL: 33d5dea43accfe67f4e17a6c7e63e44c053ee47e
libghidra: 0afcaa349c7b5d8f60673b64d2093e3f70ef67d7
ghidrasql-skills: 73a32759488e6ff208796bdbe59a0d24d7a6cb99

Live analysis workflow

GhidraSQL was launched in managed headless mode with an ephemeral local libghidra RPC port, SQL HTTP service on 127.0.0.1:8081, a persistent Ghidra project, and shutdown policy save.

The recorded query sequence was:

Inventory the binary, functions, call graph, imports, strings, and hot functions.
Trace _start through __libc_start_main to recover main.
Scope decompiler queries by function address and use call/xref/string evidence to infer responsibilities.
Rename, prototype, plate-comment, and progress-tag 15 high-value functions.
Read each target before mutation, verify it after mutation, and call save_database().
Query the final live revision and annotation count, save, and stop the managed server.
Reopen the same project read-only and query every recovered function, prototype, comment, and tag to prove persistence.

The live database reached program revision 316 before its final save. On read-only reopen, all 15 annotations were present. The different reopened revision representation (3) is the persisted project database’s revision, not a loss of annotations.

Recovered structure

The recovered architecture is:

Parse options, locale, environment, terminal state, quoting, color, time, and output layout.
Gather operands and directory entries into an owned file vector.
Sort the vector using the selected sort mode and direction.
Render the current vector in long, column, row, comma, or single-column form.
Extract directories into a deferred queue.
Enumerate queued directories and optionally enqueue recursive children.

The strongest evidence came from the recovered main, the call graph, embedded GNU help text and src/ls.c assertion strings, and individually scoped decompilation of the gather/sort/render/traversal functions.

Installation and runtime failures

Stage	Observed failure	Cause	Resolution
Toolchain discovery	Required JDK 21, modern CMake, and Gradle were absent or unusable from the system path	Host tools did not satisfy the install prompt	Installed workspace-local OpenJDK 21.0.12, CMake 3.31.8, and Gradle 8.14.3
Java loader	`libjli.so: cannot open shared object file`	The relocatable JDK’s private libraries were not on the loader path	Supplied the JDK `lib` and `lib/server` directories through `LD_LIBRARY_PATH`
Temporary files	Java/native steps could not rely on a normal `/tmp`	The runtime had no usable conventional temporary directory	Used workspace `.tmp` through `TMPDIR` and `-Djava.io.tmpdir`
Dependency transport	HTTPS dependency resolution/downloads failed or were interrupted	The environment used restricted/proxied transport and Java trust did not initially match it	Used the available Git transport, resumable downloads, and a workspace-local Java trust setup
Parallel native build	The assembler received truncated input during a concurrent build	Resource pressure interrupted a compiler process and left an incomplete assembly stream	Removed only the failed target output and rebuilt serially
Ghidra launch	`support/launch.sh` failed where Bash process substitution required `/dev/fd`	`/dev/fd` was unavailable in the runtime	Replaced the two process-substitution loops with command-substitution here-strings and empty-line guards
First managed GhidraSQL run	glibc aborted in `pthread_mutex_lock`	Two cpp-httplib revisions/configurations were linked into one executable: fastmcpp’s `cpp_httplib` and the top-level `httplib`, with different OpenSSL/zlib feature macros and therefore incompatible inline class layouts	Forced fastmcpp’s FetchContent declaration to reuse the top-level cpp-httplib source and linked `fastmcpp_core` publicly to `httplib::httplib`
First strict recovered-source build	Fallthrough and “control reaches end” diagnostics became errors	The compiler did not know that `usage()` and the out-of-memory handler never return	Marked both helpers `_Noreturn`; the final strict build is clean

The CMake fix is the material upstream source change. The Ghidra launch patch is an environment-specific compatibility patch.

A non-fatal Ghidra FileStore warning appeared for /var/tmp/root-ghidra/fscache2. It did not prevent project creation, analysis, saves, clean shutdown, or read-only reopen.

Validation

Exact target copy: source and captured binary SHA-256 hashes match.
Headless live project: 412 functions, 79,542 bytes in functions, 1,363 callgraph edges, 259 string references.
Mutations: 15 functions named, prototyped, commented, and tagged.
Save: final save_database() returned 1.
Shutdown: managed server exited 0.
Persistence: read-only reopen returned all 15 annotations; readonly server exited 0.
Source cleanliness: no FUN_, DAT_, LAB_, decompiler undefinedN types, or decompiler warning comments occur in recovered_ls.c.
Strict source build: C11 with -Wall -Wextra -Wpedantic -Werror succeeded.
Behavioral smoke test: --version, numeric long listing, and single-column directory listing succeeded.
Deterministic comparison: system /bin/ls -1A --color=never and recovered-ls -1A --color=never produced identical names and order for the source directory; the diff was empty.

Reconstruction limits

recovered_ls.c is a clean behavioral reconstruction, not a claim to the original GNU implementation. It intentionally leaves out advanced GNU features whose exact reimplementation would require substantially more type, global, locale, and library recovery: full quoting styles, complete LS_COLORS, ACL/SELinux columns, dired offsets, hyperlinks, locale-aware display widths, version sorting, and every option alias.

Raw Ghidra pseudocode was retained in the query transcript for auditability. The recovered source itself contains none of those decompiler artifacts.

Originally published in TheBigPromptLibrary on GitHub (view source).
⭐ Star the library on GitHub for more system prompts and research.

Your Own Key, Their Telemetry: Reverse-Engineering What Claude Code Phones Home in BYOK Mode

February 4, 2026November 9, 2026 elias AI / LLM, Reverse Engineering claude-code, telemetry

You paid for your own API key. You pointed Claude Code at your own provider. You assumed the conversation was between you and your endpoint. It isn’t — not entirely. Here’s what still flies back to Anthropic, captured off the wire, and the one line of config that shuts it up.

Point-in-time snapshot — capture performed 2026-02-04. Claude Code changes fast; the client version behind this capture is a moment in time, and some internals below have already shifted (e.g. the flag backend moved from Statsig to GrowthBook). Treat this as a dated field report, not a description of current behavior. The [DOC] claims are re-verifiable against live docs; the [WIRE] observations reflect what the client did on 2026-02-04.

Ethics & method. Everything here comes from watching my own machine’s HTTPS traffic with mitmproxy — the same lawful, on-your-own-device inspection any developer can run. Nothing was exfiltrated, decrypted from anyone else, or accessed without authorization. This is transparency research, in the same spirit as my RECon 2024 GPT-reversing work. I flag every claim as [DOC] (Anthropic-documented), [WIRE] (observed in my own 2026-02-04 capture), or [FLAG] (community-observed internal detail, not guaranteed).

The uncomfortable one-liner

When you run Claude Code in Bring-Your-Own-Key mode:

export ANTHROPIC_BASE_URL="https://your-provider.example/v1"
export ANTHROPIC_AUTH_TOKEN="your_api_key"

…your prompts and code go to your provider. Good. But by default, Claude Code still opens side-channels to Anthropic-controlled infrastructure and streams operational telemetry, error traces, and feature-flag lookups — while computing an estimated dollar cost for API calls it isn’t even billing you for. [DOC][WIRE]

None of it contains your source code. All of it is enough to fingerprint you, time you, and profile how you work.

And here’s the part most "privacy" write-ups miss: custom-base-URL BYOK is treated like the direct Anthropic API — telemetry defaults ON. Bedrock, Vertex, and Foundry users get it off by default. Roll your own gateway, and you inherit the chattier posture. [DOC]

What I actually saw on the wire

Capture setup: mitmproxy, HTTPS interception, cert pinning disabled, one trivial task — "create a C hello world, build it with CMake, run it." One boring task. Look how much came back.

Destination	Relative volume	What it’s for
Anthropic telemetry / log intake (Datadog)	many	Usage metrics, timing, cost
Feature-flag service	several	Runtime flag evaluation (`tengu_*`)
Error-reporting endpoint	a few	Crash / error stack traces
Your custom provider	—	The only thing you thought was happening

They know your machine — persistently

Every session carries a stable device fingerprint plus a per-session ID: [WIRE]

// [WIRE] observed shape
{ "device_id": "50xx… (persistent SHA-256)", "session_id": "xxxxxxxx-xxxx-…" }

The session_id rotates. The device_id does not. It’s a durable hash that ties every session you ever run — across projects, across providers, across months — back to the same box. On your own key, with your own provider, you are still a stable, trackable identity to Anthropic. That’s the finding.

They know how you work (not what you write)

The telemetry is metadata-dense and content-free — sizes, types, durations, verdicts. A representative slice of what streams out during a session: [WIRE]

Every tool call: name, duration, success/failure, result size — Bash, file writes, todo updates, the lot.
Bash commands, classified: not the string, but the type — mkdir, cmake, git, cd — plus exit code and output byte-length.
File operations: create/write/delete, hashed path, lines added/removed, char count.
Token + cost: input/output/cache tokens and a computed cost_usd — estimated on their side even though your provider is doing the billing. [DOC][WIRE]
Timing: time-to-first-token and total duration per call — a latency fingerprint of your provider.
BYOK tell: your base_url and model selection can ride along in request telemetry — i.e. Anthropic can see which alternative provider you defected to. [WIRE]

Illustrative shape (structure, not a guaranteed schema):

// ILLUSTRATIVE reconstruction of an observed event
{
  "event": "tengu_tool_use",
  "properties": { "tool_name": "Bash", "duration_ms": 2531, "success": true, "result_length_chars": 45 }
}

Stitch these together and you don’t get my code — you get a behavioral cast of my session: how many tools, how fast, how often I failed, how big my outputs were, which provider I used, and what it cost. Anonymous it is not, given that persistent device_id.

The full event zoo

A single session lit up dozens of distinct tengu_* event types [WIRE][FLAG] — session lifecycle (tengu_session_started / _ended, tengu_request_initialized), API (tengu_api_request, tengu_api_usage, streaming events), tools (tengu_tool_use, tool-result and rate-limit events), bash (tengu_bash_tool_command_executed, tengu_bash_tool_timeout), files (tengu_file_tool_applied, read events), conversation, errors and retries.

"Tengu" — the client’s own nervous system

[FLAG] tengu_ is Claude Code’s internal codename, wired into its runtime feature-flag system (originally Statsig; migrated to GrowthBook after Statsig’s Sept-2025 acquisition). None of it is officially documented; all of it is visible if you watch the client evaluate flags on startup. Community-observed gate names are the spicy part — they read like a changelog of things the client is quietly deciding about you:

tengu_attribution_header — request attribution tagging
tengu_anti_distill_fake_tool_injection — a countermeasure whose very name suggests anti-distillation / anti-scraping defenses baked into the client
tengu_penguins_off — an internal kill-switch of some flavor

You don’t have to speculate about intent to find it notable that your local CLI ships remote-controlled behavior flags with names like "anti-distill fake tool injection." These names are community-observed rather than documented, and they churn between releases — hence the [FLAG] marker on this section.

The redemption arc: it’s all opt-out

Here’s what keeps this fair — and, honestly, more useful than pure outrage. None of this is mandatory. Anthropic documents the switches, and a single one silences telemetry, error reporting, auto-update, feature-flag lookups, and model discovery in one shot: [DOC]

export CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1   # the wire goes quiet

Set it and the Datadog / flag / error chatter drops away, leaving only your provider on the wire. The full, tiered hardening config — plus the two settings people think belong here but don’t — is in Lock it down at the end.

What’s private vs. what leaks (default BYOK)

Stays with you / your provider only [DOC][WIRE]

Prompts and model responses · file contents and diffs · full command strings (only a coarse type leaks) · real file paths (only hashes leak)

Anthropic’s own docs back the content-exclusion, for the record: [DOC]

"Metrics never include your code, prompts, or file paths."

Leaves to Anthropic-side infra by default [WIRE]

Persistent device_id + session IDs · tool-usage metadata · bash command types + exit codes · token counts and estimated cost · TTFT/total timing · your provider base URL + model · redacted error traces

Bottom line

BYOK protects your content, not your metadata. Your code is safe; your behavior and identity are not, by default.
The provider leak is the sharpest finding for BYOK users — Anthropic can see which alternative endpoint you’re routing to.
You are persistently fingerprinted via a non-rotating device_id, even on your own key.
It’s all opt-out — one documented env var silences it. Any critique that omits this is doing outrage, not research.
Trust your capture, not the codenames. The tengu_* internals are undocumented and mutate between releases; publish what your own wire shows.

Lock it down: the hardened BYOK config

Everything above is opt-out. Here’s the config to run. Two equivalent forms — the env block in ~/.claude/settings.json, or plain shell exports (settings.json simply injects these as environment variables). [DOC]

The 80/20, if you read nothing else:

export CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1   # the master kill-switch

That one flag already covers telemetry, error reporting, auto-update, feature flags, and model discovery. Everything below is belt-and-suspenders — explicit, self-documenting, and resilient if the master flag’s coverage ever changes.

Tier 1 — Privacy: stop the phone-home

Variable	Effect
`CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC`	Master switch — telemetry, error reporting, auto-update, feature flags, model discovery.
`DISABLE_TELEMETRY`	Usage / analytics metrics (Datadog).
`DISABLE_ERROR_REPORTING`	Error / stack-trace uploads.
`DISABLE_AUTOUPDATER`	Update-check network calls.
`DISABLE_BUG_COMMAND`	`/bug` uploads — which do include content.
`DISABLE_NON_ESSENTIAL_MODEL_CALLS`	Background model calls (auto-generated titles, etc.).

Tier 2 — Quality of life (noise, not telemetry)

These quiet the UI; they don’t change what leaves your machine. Bundled in for a clean, distraction-free setup — just don’t mistake them for privacy controls.

Variable	Effect
`DISABLE_COST_WARNINGS`	Suppresses cost / usage nag prompts.
`DISABLE_PROMOTIONAL_MESSAGES`	No marketing / upsell messages.
`CLAUDE_CODE_DISABLE_TERMINAL_TITLE`	Stops Claude Code from rewriting your terminal title.

Drop-in `~/.claude/settings.json`

{
  "env": {
    "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC": "1",
    "DISABLE_TELEMETRY": "1",
    "DISABLE_ERROR_REPORTING": "1",
    "DISABLE_AUTOUPDATER": "1",
    "DISABLE_BUG_COMMAND": "1",
    "DISABLE_NON_ESSENTIAL_MODEL_CALLS": "1",

    "DISABLE_COST_WARNINGS": "1",
    "DISABLE_PROMOTIONAL_MESSAGES": "1",
    "CLAUDE_CODE_DISABLE_TERMINAL_TITLE": "1"
  }
}

Same thing as shell exports (no file)

bash / zsh:

# Tier 1 — privacy
export CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1
export DISABLE_TELEMETRY=1
export DISABLE_ERROR_REPORTING=1
export DISABLE_AUTOUPDATER=1
export DISABLE_BUG_COMMAND=1
export DISABLE_NON_ESSENTIAL_MODEL_CALLS=1
# Tier 2 — quality of life
export DISABLE_COST_WARNINGS=1
export DISABLE_PROMOTIONAL_MESSAGES=1
export CLAUDE_CODE_DISABLE_TERMINAL_TITLE=1

PowerShell:

$env:CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC = "1"
$env:DISABLE_TELEMETRY                        = "1"
$env:DISABLE_ERROR_REPORTING                  = "1"
$env:DISABLE_AUTOUPDATER                      = "1"
$env:DISABLE_BUG_COMMAND                      = "1"
$env:DISABLE_NON_ESSENTIAL_MODEL_CALLS        = "1"
$env:DISABLE_COST_WARNINGS                    = "1"
$env:DISABLE_PROMOTIONAL_MESSAGES             = "1"
$env:CLAUDE_CODE_DISABLE_TERMINAL_TITLE       = "1"

Toggle-on-presence gotcha. For these flags, any non-empty value — including "0" — turns the disable ON. To re-enable a feature, remove the variable entirely; setting it to "0" will not do what you’d expect.

Tier 3 — Handle with care (you’ll see these in the wild)

Two settings get copy-pasted into "privacy" configs where they don’t belong. Listed here explicitly so you know why they’re not in the block above — not dropped, just quarantined:

CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1 — this is an enable, and it adds traffic: the client queries your gateway to discover available models. It directly opposes CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC, which switches discovery off. Only set it if your BYOK gateway genuinely needs runtime model discovery to function — otherwise leave it out for a quieter wire.
DISABLE_PROMPT_CACHING=1 — not a telemetry or privacy control. It turns off prompt caching, which just makes sessions slower and pricier; in BYOK the caching happens at your provider anyway, so it buys you zero privacy from Anthropic. Set it only for a specific reason (e.g. a provider that mishandles cache headers).

Sources for the [DOC] claims: Data usage · Environment variables · Settings · Network configuration · Security.

Lawful, on-device transparency research — a dated snapshot from 2026-02-04. Some internals will have changed since; re-verify against live docs before relying on the specifics.

Originally published in TheBigPromptLibrary on GitHub (view source).
⭐ Star the library on GitHub for more system prompts and research.

How the pieces fit

The CLI

omp auth-broker: the vault

omp auth-gateway: the HTTP front end

Setup, in phases

Phase 1: log in to your subscriptions

Phase 2: start the broker

Phase 3: start the gateway

Phase 4: choose how clients authenticate

Phase 5: smoke test

Routing: the path picks the format, model picks the backend

Beyond chat

Worked example: Claude Code on the gateway

1. The essentials

2. Pin every model slot

3. Or: Claude Code’s harness, a GPT brain

4. Wrap it

Other clients, briefly

Two tokens, different power

Limits and gotchas

A note on subscription terms

Practical capacity, up front

Important scope note

Operating system

CPU

Memory and storage

Cgroup resource limits

Mounts

Devices

Privileges and process resource limits

Main development software

The desktop and computer-use stack

Installed Python packages

Global Node packages

Installed Debian package inventory

GCC C++ include search paths

Header inventory

Visibility and caveats

Two ways to invoke, and when to switch

When naming the tool wins

Make it stop and ask you: AskUserQuestion

Force a task to exist: TaskCreate / TaskUpdate

Start something recurring or watching, on purpose: CronCreate, Monitor, /loop

Behaviors that only exist by name: the keyword-gated tools

Pin the exact operation: Grep, Glob, Edit, Agent

Run a specific, known procedure: Skill

Choose the output channel: Artifact, PushNotification, WebFetch

How to phrase a by-name call

The catalog: always-loaded vs deferred

File, search & shell

Delegation

Task list & background jobs

Scheduling & watching

Web & output

Planning, isolation & design

Specialized & internal

Compact reference

How this was measured

Practical capacity, up front

Important scope note

Operating system

CPU

Memory

Workspace storage

Resource limits

Main development software

Document, image, media, and OCR software

Installed Python packages

Bundled Node.js libraries

Software availability summary

Inventory counts

Visibility limitations

The part nobody tells you: it’s a VM

The ask

52 minutes, unattended

The walls — and how it got over them

The actual reverse engineering

Proving it stuck

The payoff: it compiles, and it’s right

What this is not

`omp auth-broker`: the vault

`omp auth-gateway`: the HTTP front end

Routing: the path picks the format, `model` picks the backend

Make it stop and ask you: `AskUserQuestion`

Force a task to exist: `TaskCreate` / `TaskUpdate`

Start something recurring or watching, on purpose: `CronCreate`, `Monitor`, `/loop`

Pin the exact operation: `Grep`, `Glob`, `Edit`, `Agent`

Run a specific, known procedure: `Skill`

Choose the output channel: `Artifact`, `PushNotification`, `WebFetch`

Drop-in `~/.claude/settings.json`