Move a Bot's own browser onto per-person seats, and let Record run on a person's own computer

A Bot's browser (#868) is now a seat's, like everything else on a computer: each
route resolves the asker's seat for the Bot and reaches that browser, on their
own computer or on an isolated Bot's computer of its own, with the person named
to the computer where people share one. Recorder connections are still filed
under the Bot, but a seat on a person's computer reads, hands back and clears
only that person's: before, Ben opening his own Bot screen ended Ada's live
recording on her computer as left behind. The Bot's network policy is pushed to
the seat's computer.

Record is refused only on the computer every person shares. A person's computer
is now told whose it is (COMPUTER_PERSON_ID, from the supervisor and the Sandbox
template), so it records in its Bots' browsers there and still refuses a
person's own browser.

Author: davidmckayv

CHANGELOG.md

@@ -639,11 +639,14 @@ someone records, so recording a task needs no extension and no Connect step.
   disconnects; the Bot acts again only once the recording has ended. Taking control now records who
   took it, so on a shared Bot only that person can use the bar or record, someone else's recording
   shows only that one is running, and nobody else sees its name, its step count or its microphone.
-- **Record needs a computer the Bot does not share.** Where every Bot runs on one computer (Helm's
-  shared mode, or `AGENT_COMPUTER_URL` with no supervisor), Record is refused in every Bot's browser
-  and the panel says why: your Recorder connection would sit in the Bot's profile, where any other
-  Bot's shell could read it. The bar still works. The computer refuses it too. With a supervisor
-  (laptop, Desktop) or a Sandbox, each Bot has its own computer and Record works.
+- **Record runs on your own computer, never the one everyone shares.** Where every person's Bots run
+  on one computer (Helm's shared mode, or `AGENT_COMPUTER_URL` with no supervisor), Record is refused
+  in every Bot's browser and the panel says why: your Recorder connection would sit in the Bot's
+  profile, where another person's Bot could read it. The bar still works. The computer refuses it too.
+  With a supervisor (laptop, Desktop) or a Sandbox, a Bot's browser is on your own computer, beside
+  only your own Bots, or on an isolated Bot's computer of its own, and Record works there. Your
+  hand-back ends only your own recording: another person recording in the same Bot's browser on their
+  own computer is never touched.
 - **One connection per recording.** Record mints a Recorder connection for the person who pressed it
   and Stop revokes it; Settings, Browsers lists it as "<Bot>'s browser" while it lives, and says
   "recording now" for any browser that is recording.

agent-computer/src/index.ts

@@ -20,8 +20,8 @@ import {
   mutatesBrowser,
   offeredToken,
 } from "./authorisation";
-import { isPlainBotId, seatIdFor } from "./bot-id";
 import { createBotBrowserHost, isBotBrowserPath } from "./bot-browser-host";
+import { isPlainBotId, seatIdFor } from "./bot-id";
 import { createBrowserHost, isBrowserPath } from "./browser-host";
 import { browserRuntimeFromEnv } from "./browser-runtime";
 import { detectChallenge } from "./challenge";

agent-computer/src/person-access.ts

@@ -86,13 +86,18 @@ export function personHoldsTheWheel(since: string): ComputerControlState {
  *
  *   - `people`: OpenBot Desktop's host-side computer (`COMPUTER_PEOPLE_ONLY=on`), which runs people's own browsers and
  *     no Bot.
- *   - `one`: a computer started for one id (`COMPUTER_BOT_ID`), which is how a supervisor starts each container and a
- *     Sandbox each pod. Started for a person's browser, it runs that browser and nothing else.
- *   - `shared`: neither, the one computer every Bot without its own reaches. No person's browser runs there.
+ *   - `one`: a computer started for one id (`COMPUTER_BOT_ID`): an isolated Bot's, or a person's own browser's, as the
+ *     supervisor and a Sandbox start them. Started for a person's browser, it runs that browser and nothing else.
+ *   - `person`: one person's computer (`COMPUTER_PERSON_ID`), carrying every Bot that person uses. Their Bots share it,
+ *     so their own browser does not run there, but Record in one of those Bots' browsers does: the connection it holds
+ *     is the person's own, beside only their own Bots' work.
+ *   - `shared`: none of these, the one computer every person's Bots reach. No person's browser runs there, and nobody
+ *     records in a Bot's browser there.
  */
 export type ComputerOwner =
   | { kind: "people" }
   | { kind: "one"; id: string }
+  | { kind: "person"; id: string }
   | { kind: "shared" };
 
 export function computerOwner(
@@ -101,7 +106,9 @@ export function computerOwner(
   if (env[PEOPLE_ONLY_ENV]?.trim().toLowerCase() === "on")
     return { kind: "people" };
   const id = env.COMPUTER_BOT_ID?.trim();
-  return id ? { kind: "one", id } : { kind: "shared" };
+  if (id) return { kind: "one", id };
+  const person = env.COMPUTER_PERSON_ID?.trim();
+  return person ? { kind: "person", id: person } : { kind: "shared" };
 }
 
 /** Why a person's browser is refused on a computer Bots run on. Said to whoever runs OpenBot: the server tells the
@@ -110,7 +117,7 @@ export const NOT_ITS_OWN_COMPUTER =
   "A person's own browser runs only on a computer of its own, and Bots run on this one. Give people's browsers their own computers (COMPUTER_SUPERVISOR_URL or a Sandbox), or OpenBot Desktop's.";
 
 /**
- * Why Record is refused in a Bot's browser on the shared computer. Record hands the Recorder there a person's own
+ * Why Record is refused in a Bot's browser on the computer every person shares (`shared`, not a person's own). Record hands the Recorder there a person's own
  * connection, kept in the Bot's profile until Stop, and every other Bot here can run a shell as the same user and read
  * it. Said to whoever runs OpenBot, as `NOT_ITS_OWN_COMPUTER` is; the server tells the person in its own words.
  */

agent-computer/tests/bot-browser-computer.test.ts

@@ -343,6 +343,36 @@ describe.skipIf(!asked)(
       ).toBe(200);
     }, 60_000);
 
+    test("records on a person's own computer, where only their own Bots run", async () => {
+      // How the supervisor and a Sandbox start a person's computer: named for the person, no Bot.
+      const own = await startComputer("persons-computer", {
+        OPENBOT_RECORDER_DIR: FIXTURE,
+        COMPUTER_PERSON_ID: "user-1",
+      });
+      await takeWheel("user-1", own);
+      const before = calls.length;
+      const started = await start("user-1", "File an expense report", own);
+      expect(started.status).toBe(200);
+      expect(started.json.recordingBy).toBe("user-1");
+      // The Recorder there was handed the person's connection and asked to record.
+      expect(
+        calls
+          .slice(before)
+          .map((each) => each.method)
+          .filter((method) => method === "connect" || method === "record"),
+      ).toEqual(["connect", "record"]);
+      expect(
+        (
+          await call("/bot-browser/recording", {
+            body: { action: "stop" },
+            on: own,
+          })
+        ).status,
+      ).toBe(200);
+      // The fixture Recorder's calls are one list for the file; the tests after this one start from none.
+      calls.length = 0;
+    }, 60_000);
+
     test("refuses the bar, Record and narration while the Bot holds the wheel", async () => {
       for (const [path, body] of [
         ["/bot-browser/tabs", { action: "new", url: page("sneaky") }],
@@ -982,9 +1012,9 @@ describe.skipIf(!asked)(
 function serverOn(on: Computer) {
   const provider: ComputerProvider = {
     name: "this-test",
-    isolation: "per-bot",
+    isolation: "per-person",
     locate: async () => on.base,
-    status: async (botId) => ({ botId, state: "ready" }),
+    status: async (seat) => ({ botId: seat.botId, state: "ready" }),
     stop: async () => ({ wasRunning: true }),
     reset: async () => ({ cleared: true }),
     list: async () => [],
@@ -1069,8 +1099,9 @@ describe.skipIf(!asked)("who asked for the wheel", () => {
     ).toBe(200);
 
     // The Bot asking, as the headless tools and the password service do: no source, so the Bot's.
+    // On the seat the routes reach for this person, as the headless tools resolve it.
     const bots = await server.gateway.requestHelp(
-      botId,
+      await server.gateway.seatFor(botId, server.actor.id),
       server.actor,
       "Sign in to the bank, then hand back.",
       "call-sign-in",

agent-computer/tests/person-browser-rules.test.ts

@@ -30,8 +30,8 @@ import {
   forgetRecorderPins,
   PLAYWRIGHT_DEFAULTS_A_PERSON_DOES_NOT_GET,
   personBrowserEnv,
-  recorderLaunchOptions,
   personNativeLaunch,
+  recorderLaunchOptions,
   runnable,
 } from "../src/person-launch";
 import {
@@ -480,6 +480,11 @@ describe("which computer a person's browser may run on", () => {
       kind: "one",
       id: PERSON,
     });
+    // A person's computer, carrying every Bot they use.
+    expect(computerOwner({ COMPUTER_PERSON_ID: "u-ada" })).toEqual({
+      kind: "person",
+      id: "u-ada",
+    });
     // OpenBot Desktop's host-side computer.
     expect(computerOwner({ COMPUTER_PEOPLE_ONLY: "on" })).toEqual({
       kind: "people",
@@ -493,6 +498,8 @@ describe("which computer a person's browser may run on", () => {
     for (const owner of [
       computerOwner({}),
       computerOwner({ COMPUTER_BOT_ID: "invoice-collector" }),
+      // Nor on a person's own computer, where their Bots run: their browser gets a computer of its own.
+      computerOwner({ COMPUTER_PERSON_ID: "u-ada" }),
     ]) {
       expect(refusedHere(owner, PERSON)).toEqual({
         status: 503,

app/src/components/channels/chat-transcript.tsx

@@ -53,6 +53,7 @@ import { attachmentUrl } from "@/lib/channels/attachments";
 import { readResponsibilityTurn } from "@/lib/channels/responsibility-turn";
 import { readFiring } from "@/lib/channels/routine-firing";
 import type { CardPlace } from "@/lib/copilot/carry-on";
+import { ToolPlaceContext } from "@/lib/copilot/tool-place";
 import { markdownComponents } from "@/lib/markdown";
 import { EASE_OUT, ENTRANCE_SECONDS } from "@/lib/motion";
 import { readToolName } from "@/lib/plugins/tool-name";
@@ -63,12 +64,6 @@ import {
   toolResultFailed,
 } from "@/lib/plugins/tool-result";
 import { readTeamBotConsent } from "@/lib/team-bots";
-import type { CardPlace } from "@/lib/copilot/carry-on";
-import { ToolPlaceContext } from "@/lib/copilot/tool-place";
-import {
-  readConnectPrompt,
-  SHOW_APP_ACCESS_TOOL,
-} from "@openbot/shared/connect-prompt";
 import { cn } from "@/lib/utils";
 import { VOICE_CHAT_ACTIVITY, type VoiceChatEntry } from "@/lib/voice/archive";
 import { AppAccessCard } from "./app-access-card";

app/src/components/computer/handoff-resume-notice.tsx

@@ -6,7 +6,6 @@ import {
   type PendingHandoff,
   pendingHandoff,
   rememberHandoff,
-  type PendingHandoff,
   wasHandoffAnswered,
 } from "@/lib/computers/handoff";
 import {

app/src/lib/computers/control.ts

@@ -12,6 +12,7 @@ import { tryClient } from "@/lib/client";
  */
 
 export type { ComputerControlState as ControlState } from "@openbot/shared/computer-control";
+
 import type {
   ComputerControlState as ControlState,
   RequestHelpInput,