[guidovizoso]

What this changes

A computer that serves many Bots (Helm's default computers.mode: shared, and the docker-compose agent-computer when there is no supervisor) kept browser profiles apart per Bot, but files and the shell shared one folder. A note one Bot saved was a file every other Bot could list and read.

With COMPUTER_SEPARATE_WORKSPACES=on, each Bot (the id in x-openbot-bot-id) gets computers/<id> on the workspace volume. Its file tools stay inside that folder, and its shell starts there with HOME pointing at it. The id goes through the same allow-list as profile directories (bot-id.ts).

It is on for the Helm shared StatefulSet and the compose agent-computer. It is off for computers that serve one Bot (supervisor, sandbox) and for the desktop's computer, so their files do not move. The all-in-one image passes the variable through, so turning it on there is opt-in.

This keeps shared as Helm's default (it needs nothing installed in the cluster) and makes it safer to share. It is not isolation: a command can still read another Bot's folder. computers.mode: sandbox is still the answer for keeping people apart. Docs, values.yaml and the changelog say so.

When COMPUTER_SCOPE (per-person / per-bot-per-person) lands, the server will send a computer key in place of the Bot id, and this split follows it.

Where it runs

• New state that outlives a request? Files on the existing workspace volume, in one folder per id. The in-process Map only caches the file and shell helpers for a folder; it holds no state.
• What happens on the second replica? Unchanged. The shared computer is a single-replica StatefulSet with one volume.
• Anything serialised? No.
• Anything fanned out to a browser? No.
• New listener, port, or schedule? No.

Boundary and audit

• Every acting call still goes through the gateway. This only changes which folder a call it already allowed lands in.
• No new refusals. An unusable id was already refused with a 400 before any handler runs.
• Nothing new is trusted from the client. The id is the one the server already sends.

Changelog

• Under Unreleased: a new section, plus a "Before upgrading" item. Files saved before the upgrade stay at the root of the volume, where no Bot sees them. An operator moves them into a Bot's folder to give them back.

Proof

• agent-computer/tests/workspaces.test.ts: two Bots cannot see each other's files; a command's working directory and HOME are the Bot's folder; with separation off, files stay where they were; an id that is not a plain name is refused.
• bun test in agent-computer: 436 pass, 55 skip, 0 fail. tsc --noEmit clean.
• helm template with ci/self-hosted-values.yaml renders COMPUTER_SEPARATE_WORKSPACES: "on" on the computer StatefulSet.

[guidovizoso]

Landed in #847.