@mseep/open-computer-use 1.0.0

package/contracts/storage/mount-config.schema.json

@@ -0,0 +1,197 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schemas.open-computer-use.dev/storage/mount-config.schema.json",
+  "$comment": "SPDX-License-Identifier: FSL-1.1-Apache-2.0 | Copyright (c) 2025 Open Computer Use Contributors | File-operation mount surface (Storage broker -> host -> Session sandbox): broker-side provisioning config (carries lease), guest-facing config (no lease). The per-operation file-op RPC bodies live in file-ops.schema.json. NFR-SEC-25. JSON Schema 2020-12 (json-schema.org).",
+  "title": "File-operation mount config",
+  "description": "Two mount-config variants: a broker-side provisioning config (carries the lease) and a guest-facing config (no lease). Each mount's RW/RO posture is the `writes` flag plus the structural `mounts` (RW) / `readonly_mounts` (RO) split; its freshness window is the per-mount `cache_duration_s` (short for RO inputs, long for the RW sink). The transport substrate (FUSE/virtio-fs/9p) is a component-spec choice and is deliberately absent from this schema (NFR-SEC-25). No object-store/S3 fields. No backend-encryption fields: isolation is by filesystem_id scope, not per-session crypt keys; crypt is not modelled on. The file-op RPC message set is split out to file-ops.schema.json (status TBD).",
+
+  "$defs": {
+    "SchemaVersion": {
+      "description": "Interface version. Breaking change increments major (NFR-IC-04).",
+      "type": "string",
+      "pattern": "^v[0-9]+(alpha|beta)?[0-9]*$",
+      "examples": ["v1alpha"]
+    },
+
+    "FilesystemId": {
+      "description": "Per-session logical scope (the isolation unit, not a crypto boundary). Egress binds connection to this id (NFR-SEC-25).",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256,
+      "examples": ["session_01HXYZ_chat"]
+    },
+
+    "Octal": {
+      "description": "Host-set POSIX permission bits as an octal string. Agent (non-root) cannot change.",
+      "type": "string",
+      "pattern": "^0[0-7]{3}$",
+      "examples": ["0755", "0644"]
+    },
+
+    "CacheDurationSeconds": {
+      "description": "Per-mount cache_duration_s: backend cache freshness window in whole seconds. RO inputs use a short window so externally-written user data appears promptly; the RW output mount uses a long window since the agent is the writer and invalidates locally. Directional defaults by mount: uploads 1, tool_results 3, transcripts 10, outputs 3600.",
+      "type": "integer",
+      "minimum": 0,
+      "examples": [1, 3, 10, 3600]
+    },
+
+    "BackendCacheTtlSeconds": {
+      "description": "Config-level backend (broker-side) cache freshness window in whole seconds, distinct from the per-mount local-VFS window cache_duration_s. Broker-side, so it sits on the provisioning variant only.",
+      "type": "integer",
+      "minimum": 0,
+      "x-ocu-tbd": "Config-level backend cache TTL. Units (seconds) and config-level-vs-per-mount scope are design-derived from the field name; confirm against a source before freezing."
+    },
+
+    "ByteSize": {
+      "description": "Local VFS cache cap as a size string. Files over the cap stream rather than cache.",
+      "type": "string",
+      "pattern": "^[0-9]+(B|K|M|G|T)?$",
+      "examples": ["1G", "512M"]
+    },
+
+    "VfsCacheMode": {
+      "description": "Page-cache policy for the mount.",
+      "type": "string",
+      "enum": ["off", "minimal", "writes", "full"]
+    },
+
+    "MountBase": {
+      "description": "Fields common to every mount. `writes` is the single RW/RO control (no inverse `readonly` field). RW vs RO is host-enforced; the agent cannot flip it.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "destination",
+        "writes",
+        "vfs_cache_mode",
+        "cache_duration_s",
+        "vfs_cache_max_size",
+        "dir_perms",
+        "file_perms"
+      ],
+      "oneOf": [
+        { "required": ["filesystem_id"], "not": { "required": ["memory_store_id"] } },
+        { "required": ["memory_store_id"], "not": { "required": ["filesystem_id"] } }
+      ],
+      "properties": {
+        "destination": {
+          "description": "Absolute guest mountpoint.",
+          "type": "string",
+          "pattern": "^/.+",
+          "examples": ["/workspace/out"]
+        },
+        "filesystem_id": { "$ref": "#/$defs/FilesystemId" },
+        "memory_store_id": {
+          "description": "Parallel scope id for memory-backed mounts; present only when the backing scope is a memory store rather than a filesystem.",
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 256
+        },
+        "writes": {
+          "description": "true => read-write mount, false => read-only. Host-enforced; the agent cannot flip it. RW vs RO is the split between the `mounts` (RW) and `readonly_mounts` (RO) arrays; this boolean is the per-mount projection of that split.",
+          "type": "boolean"
+        },
+        "vfs_cache_mode": { "$ref": "#/$defs/VfsCacheMode" },
+        "cache_duration_s": { "$ref": "#/$defs/CacheDurationSeconds" },
+        "vfs_cache_max_size": {
+          "description": "Local VFS cache cap per mount. Files over the cap stream rather than cache.",
+          "$ref": "#/$defs/ByteSize"
+        },
+        "dir_perms": { "$ref": "#/$defs/Octal" },
+        "file_perms": { "$ref": "#/$defs/Octal" }
+      },
+      "$comment": "RW/RO is carried by `writes` and the structural `mounts` (RW) / `readonly_mounts` (RO) split, host-enforced. cache_duration_s sets the per-mount directional window (short for RO inputs, long for the RW sink; defaults pinned in CacheDurationSeconds, tunable per deployment). The backend source path is broker-derived from filesystem_id + the mount's RW/RO intent and is deliberately off the wire (least-data, NFR-SEC-25) — not a guest- or host-facing mount field. NFR-SEC-25.",
+      "$comment-no-role": "No `role` field. RW/RO is structural (the mounts / readonly_mounts split) and the directional cache window is cache_duration_s itself; a role enum (uploads/tool_results/transcripts/outputs) bound to writes/cache would only duplicate values already carried by `writes` and cache_duration_s, with no source. The role names survive solely as the directional-window vocabulary in CacheDurationSeconds."
+    },
+
+    "GuestMountConfig": {
+      "description": "Host -> in-guest mount agent. Token-absent by construction: no field can carry an upstream credential (NFR-SEC-25, no-creds-in-guest invariant). The bearer credential is injected at the egress edge, never seen in the guest.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["schema_version", "service_url", "mounts"],
+      "properties": {
+        "schema_version": { "$ref": "#/$defs/SchemaVersion" },
+        "service_url": {
+          "description": "Single allow-listed broker egress endpoint the mount agent dials.",
+          "type": "string",
+          "format": "uri",
+          "pattern": "^https://",
+          "examples": ["https://broker.internal"]
+        },
+        "mounts": {
+          "description": "Read-write mounts provisioned in the guest. `writes` MUST be true; a read-only mount belongs in `readonly_mounts`.",
+          "type": "array",
+          "items": {
+            "allOf": [
+              { "$ref": "#/$defs/MountBase" },
+              { "properties": { "writes": { "const": true } } }
+            ]
+          }
+        },
+        "readonly_mounts": {
+          "description": "Read-only mounts. Same shape; `writes` MUST be false. RO is host-set; the agent cannot make a read-only mount writable.",
+          "type": "array",
+          "items": {
+            "allOf": [
+              { "$ref": "#/$defs/MountBase" },
+              { "properties": { "writes": { "const": false } } }
+            ]
+          },
+          "default": []
+        }
+      }
+    },
+
+    "ProvisionMountConfig": {
+      "description": "Storage broker -> host provisioning variant. Carries the broker-signed lease and the inspection-CA trust anchor. Never delivered into the guest as-is; the host strips the lease before handing the GuestMountConfig to the in-guest agent.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["schema_version", "service_url", "filesystem_id", "auth_token", "ca_cert_pem", "mounts"],
+      "properties": {
+        "schema_version": { "$ref": "#/$defs/SchemaVersion" },
+        "service_url": {
+          "type": "string",
+          "format": "uri",
+          "pattern": "^https://",
+          "examples": ["https://broker.internal"]
+        },
+        "filesystem_id": { "$ref": "#/$defs/FilesystemId" },
+        "auth_token": {
+          "description": "Broker-signed lease, opaque to the holder. Bound to filesystem_id and a TTL by the broker (lease semantics live in the Lease-pull surface). Present only in this broker-side variant; absent from GuestMountConfig.",
+          "type": "string",
+          "minLength": 1
+        },
+        "ca_cert_pem": {
+          "description": "Inspection-CA trust anchor (PEM) injected into the guest trust store so the guest trusts the egress edge that injects the bearer credential.",
+          "type": "string",
+          "contentMediaType": "application/x-pem-file",
+          "pattern": "-----BEGIN CERTIFICATE-----"
+        },
+        "mounts": {
+          "type": "array",
+          "items": {
+            "allOf": [
+              { "$ref": "#/$defs/MountBase" },
+              { "properties": { "writes": { "const": true } } }
+            ]
+          }
+        },
+        "readonly_mounts": {
+          "type": "array",
+          "items": {
+            "allOf": [
+              { "$ref": "#/$defs/MountBase" },
+              { "properties": { "writes": { "const": false } } }
+            ]
+          },
+          "default": []
+        },
+        "backend_cache_ttl": { "$ref": "#/$defs/BackendCacheTtlSeconds" }
+      }
+    }
+  },
+
+  "oneOf": [
+    { "$ref": "#/$defs/GuestMountConfig" },
+    { "$ref": "#/$defs/ProvisionMountConfig" }
+  ]
+}

package/cron/Dockerfile

@@ -0,0 +1,15 @@
+FROM docker:27-cli
+
+RUN apk add --no-cache bash coreutils findutils
+
+COPY cleanup.sh /usr/local/bin/cleanup.sh
+COPY cleanup-quick.sh /usr/local/bin/cleanup-quick.sh
+RUN chmod +x /usr/local/bin/cleanup.sh /usr/local/bin/cleanup-quick.sh
+
+# Two cron schedules:
+# - Quick: every 2 hours — remove stopped containers + dangling images
+# - Full:  daily at 3 AM — stop old containers, clean volumes, prune data
+RUN echo "0 */2 * * * /usr/local/bin/cleanup-quick.sh >> /var/log/cleanup.log 2>&1" > /etc/crontabs/root && \
+    echo "0 3 * * * /usr/local/bin/cleanup.sh >> /var/log/cleanup.log 2>&1" >> /etc/crontabs/root
+
+CMD ["crond", "-f", "-l", "2"]

package/cron/cleanup-quick.sh

@@ -0,0 +1,21 @@
+#!/bin/sh
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+# Quick cleanup — runs every 2 hours
+# Removes stopped sandbox containers and dangling images.
+# Fast and safe — doesn't touch running containers or volumes.
+
+set -eu
+
+log() { echo "[cleanup-quick] $(date -u +%Y-%m-%dT%H:%M:%SZ) $*"; }
+
+log "Removing stopped chat containers..."
+REMOVED=$(docker ps -a --filter "label=managed-by=mcp-computer-use-orchestrator" \
+    --filter "status=exited" --filter "status=dead" \
+    --format '{{.ID}}' | xargs -r docker rm 2>/dev/null | wc -l)
+log "Removed $REMOVED stopped containers"
+
+log "Pruning dangling images..."
+docker image prune -f > /dev/null 2>&1
+
+log "Quick cleanup done."

package/cron/cleanup.sh

@@ -0,0 +1,127 @@
+#!/bin/sh
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+# Full cleanup — runs daily at 3:00 AM
+# Stops old containers, removes stopped ones, cleans volumes and stale data.
+#
+# IMPORTANT: Only touches owui-chat-* containers, never infrastructure services.
+# Volumes are kept for N days after LAST USE (checked via .last_active marker).
+#
+# Environment variables:
+#   CONTAINER_MAX_AGE_HOURS  - Stop running containers older than this (default: 24)
+#   VOLUME_MAX_AGE_DAYS      - Remove unused volumes older than this (default: 7)
+#   DATA_MAX_AGE_DAYS        - Remove stale data dirs older than this (default: 7)
+#   DATA_DIR                 - Host path for chat data (default: /tmp/computer-use-data)
+#   DRY_RUN                  - If "true", only log what would be done (default: false)
+
+set -eu
+
+CONTAINER_MAX_AGE_HOURS="${CONTAINER_MAX_AGE_HOURS:-24}"
+VOLUME_MAX_AGE_DAYS="${VOLUME_MAX_AGE_DAYS:-7}"
+DATA_MAX_AGE_DAYS="${DATA_MAX_AGE_DAYS:-7}"
+DATA_DIR="${DATA_DIR:-/tmp/computer-use-data}"
+DRY_RUN="${DRY_RUN:-false}"
+
+log() { echo "[cleanup] $(date -u +%Y-%m-%dT%H:%M:%SZ) $*"; }
+
+run_or_dry() {
+    if [ "$DRY_RUN" = "true" ]; then
+        log "DRY RUN: $*"
+    else
+        "$@"
+    fi
+}
+
+echo "=== Full cleanup started at $(date -u) ==="
+
+# -------------------------------------------------------------------
+# 1. Stop old running chat containers (>N hours)
+# -------------------------------------------------------------------
+log "Stopping chat containers older than ${CONTAINER_MAX_AGE_HOURS}h..."
+docker ps --filter "label=managed-by=mcp-computer-use-orchestrator" \
+    --format '{{.ID}} {{.Names}} {{.Status}}' | while read -r id name status; do
+    # Match "Up X days" or "Up N hours" where N > threshold
+    if echo "$status" | grep -qE "Up [0-9]+ (day|week|month)"; then
+        log "  Stopping $name ($status)"
+        run_or_dry docker stop "$id"
+    elif echo "$status" | grep -qE "Up ([2-9][0-9]|[0-9]{3,}) hours"; then
+        HOURS=$(echo "$status" | grep -oE '[0-9]+ hours' | grep -oE '[0-9]+')
+        if [ "${HOURS:-0}" -ge "$CONTAINER_MAX_AGE_HOURS" ]; then
+            log "  Stopping $name (up ${HOURS}h)"
+            run_or_dry docker stop "$id"
+        fi
+    fi
+done
+
+# -------------------------------------------------------------------
+# 2. Remove all stopped chat containers
+# -------------------------------------------------------------------
+log "Removing stopped chat containers..."
+docker ps -a --filter "label=managed-by=mcp-computer-use-orchestrator" \
+    --filter "status=exited" --filter "status=dead" \
+    --format '{{.ID}} {{.Names}}' | while read -r id name; do
+    log "  Removing $name"
+    run_or_dry docker rm -v "$id"
+done
+
+# -------------------------------------------------------------------
+# 3. Remove chat volumes unused for N days
+# Uses .last_active marker inside volume (touched by entrypoint on start).
+# Falls back to volume CreatedAt if no marker exists.
+# -------------------------------------------------------------------
+log "Checking chat volumes (max age: ${VOLUME_MAX_AGE_DAYS}d)..."
+CUTOFF=$(date -u -d "-${VOLUME_MAX_AGE_DAYS} days" +%s 2>/dev/null || \
+         date -u -v-${VOLUME_MAX_AGE_DAYS}d +%s 2>/dev/null || echo 0)
+REMOVED=0
+
+for vol in $(docker volume ls -q 2>/dev/null | grep "chat-.*-workspace" || true); do
+    # Skip if volume is used by a running container
+    USED=$(docker ps -q --filter "volume=$vol" 2>/dev/null)
+    if [ -n "$USED" ]; then
+        continue
+    fi
+
+    # Check .last_active marker inside volume
+    LAST_ACTIVE=$(docker run --rm -v "$vol:/vol:ro" alpine stat -c %Y /vol/.last_active 2>/dev/null || echo "")
+
+    if [ -z "$LAST_ACTIVE" ]; then
+        # No marker — fallback to volume CreatedAt
+        CREATED=$(docker volume inspect --format "{{.CreatedAt}}" "$vol" 2>/dev/null | cut -d"." -f1 | cut -d"+" -f1)
+        if [ -n "$CREATED" ]; then
+            LAST_ACTIVE=$(date -u -d "$CREATED" +%s 2>/dev/null || echo "")
+        fi
+    fi
+
+    if [ -n "$LAST_ACTIVE" ] && [ "$LAST_ACTIVE" -lt "$CUTOFF" ]; then
+        log "  Removing $vol (last active: $(date -u -d @$LAST_ACTIVE +%Y-%m-%d 2>/dev/null || echo 'unknown'))"
+        run_or_dry docker volume rm "$vol" && REMOVED=$((REMOVED + 1))
+    fi
+done
+log "Removed $REMOVED old volumes"
+
+# -------------------------------------------------------------------
+# 4. Remove stale data directories
+# -------------------------------------------------------------------
+if [ -d "$DATA_DIR" ]; then
+    log "Checking stale data dirs in $DATA_DIR (max age: ${DATA_MAX_AGE_DAYS}d)..."
+    find "$DATA_DIR" -maxdepth 1 -mindepth 1 -type d -mtime "+${DATA_MAX_AGE_DAYS}" | while read -r dir; do
+        CHAT_ID=$(basename "$dir")
+        CONTAINER_NAME="owui-chat-${CHAT_ID}"
+        if ! docker ps -a --filter "name=^/${CONTAINER_NAME}$" --format '{{.ID}}' | grep -q .; then
+            log "  Removing stale data: $dir"
+            run_or_dry rm -rf "$dir"
+        fi
+    done
+fi
+
+# -------------------------------------------------------------------
+# 5. Docker system cleanup
+# -------------------------------------------------------------------
+log "Pruning unused images and build cache..."
+run_or_dry docker image prune -f
+run_or_dry docker builder prune -f --keep-storage=2GB
+
+echo "=== Disk usage after cleanup ==="
+df -h / 2>/dev/null || true
+
+echo "=== Full cleanup finished at $(date -u) ==="

package/docker-compose.test.yml

@@ -0,0 +1,54 @@
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+#
+# Integration test stack. Mirrors docker-compose.yml exactly — same socket
+# bind, same workspace image, same env shape — but on a non-default port and
+# with a fixed MCP_API_KEY so the pytest suite can assert auth behavior.
+#
+# Run:
+#   docker compose -f docker-compose.test.yml up -d --build
+#   pytest tests/integration/
+#   docker compose -f docker-compose.test.yml down -v --remove-orphans
+#
+# Cleanup of orphan workspace containers spawned by the orchestrator during
+# tests is handled by the pytest session finalizer in conftest.py (matches
+# the `owui-chat-itest-*` container-name prefix that the test fixtures use).
+
+services:
+  computer-use-server-test:
+    build: ./computer-use-server
+    image: open-computer-use-server:test
+    container_name: ocu-test-server
+    ports:
+      - "18081:8081"  # non-default to avoid clashing with a running prod stack
+    volumes:
+      # Production parity: bind the host Docker socket so the orchestrator
+      # spawns sibling containers on the host daemon. This is exactly the
+      # configuration the chart targets via Sysbox DinD in k8s and what the
+      # default Compose layout uses on a developer workstation.
+      - /var/run/docker.sock:/var/run/docker.sock
+      - ./tests/integration/_tmp/user-data:/tmp/computer-use-data:rw
+    environment:
+      - MCP_API_KEY=test-token-do-not-use-in-prod
+      - DOCKER_IMAGE=open-computer-use:test
+      # Same path the workspace container will see — bind mount paths must
+      # resolve identically inside and outside the orchestrator pod/container.
+      - USER_DATA_BASE_PATH=/tmp/computer-use-data
+      - BASE_DATA_DIR=/tmp/computer-use-data
+      - PUBLIC_BASE_URL=http://ocu-test-server:8081
+      - COMMAND_TIMEOUT=60
+      - CONTAINER_IDLE_TIMEOUT=120
+    healthcheck:
+      test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8081/health')"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
+      start_period: 5s
+    restart: "no"
+    networks:
+      - ocu-test
+
+networks:
+  ocu-test:
+    name: ocu-test-net
+    driver: bridge

package/docker-compose.webui.yml

@@ -0,0 +1,77 @@
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+# Open WebUI + PostgreSQL — example client for Computer Use
+#
+# Reaches Computer Use Server via Docker service DNS (computer-use-server:8081).
+# Both stacks share the default network because they share the Compose project
+# name (the parent directory "open-computer-use") — no extra_hosts required.
+#
+# Start: docker compose -f docker-compose.webui.yml up --build
+# Requires: Computer Use Server running (docker compose -f docker-compose.yml up -d)
+
+services:
+  open-webui:
+    build:
+      context: ./openwebui
+      dockerfile: Dockerfile
+      args:
+        OPENWEBUI_VERSION: ${OPENWEBUI_VERSION:-0.9.2}
+    ports:
+      - "${OPENWEBUI_PORT:-3000}:8080"
+    depends_on:
+      postgres:
+        condition: service_healthy
+    environment:
+      - DATABASE_URL=postgresql://openwebui:${POSTGRES_PASSWORD:-openwebui}@postgres:5432/openwebui
+      - OPENAI_API_KEY=${OPENAI_API_KEY:-}
+      - OPENAI_API_BASE_URL=${OPENAI_API_BASE_URL:-}
+      - WEBUI_SECRET_KEY=${WEBUI_SECRET_KEY:-}
+      # Disable HuggingFace model downloads — not needed for Computer Use
+      - BYPASS_EMBEDDING_AND_RETRIEVAL=true
+      - RAG_EMBEDDING_MODEL_AUTO_UPDATE=false
+      # Skip SSL verification for self-signed certs (set to false if needed)
+      - ENABLE_OPENAI_API_SSL_VERIFY=${ENABLE_OPENAI_API_SSL_VERIFY:-true}
+      # Auto-init: install Computer Use tool + filter on first startup
+      - ADMIN_EMAIL=${ADMIN_EMAIL:-admin@open-computer-use.dev}
+      - ADMIN_PASSWORD=${ADMIN_PASSWORD:-admin}
+      # Internal URL of computer-use-server, seeded by init.sh into the Tool
+      # and Filter Valves. Uses Docker service DNS — both compose stacks share
+      # the default network because they share the project name (the parent
+      # directory "open-computer-use"), so `computer-use-server` resolves to
+      # the container's IP directly. Browsers never see this URL.
+      # Internal port is always 8081 — MCP_PORT is a host-side mapping and
+      # irrelevant for container-to-container traffic on the Docker network.
+      - ORCHESTRATOR_URL=http://computer-use-server:8081
+      - MCP_API_KEY=${MCP_API_KEY:-}
+      # Allow complex multi-step tasks (browser + doc creation) to complete
+      - CHAT_RESPONSE_MAX_TOOL_CALL_RETRIES=200
+      # Large tool result truncation (fix_large_tool_results patch)
+      # Prevents context window exhaustion from large MCP tool outputs
+      - TOOL_RESULT_MAX_CHARS=${TOOL_RESULT_MAX_CHARS:-50000}
+      - TOOL_RESULT_PREVIEW_CHARS=${TOOL_RESULT_PREVIEW_CHARS:-2000}
+      # fix_large_tool_results patch reads ORCHESTRATOR_URL (same name as the
+      # Tool/Filter Valves) to upload truncated tool results back to the server.
+      # Already set in the Valves-seed block above — re-exporting here so the
+      # patch's `os.environ.get('ORCHESTRATOR_URL')` at Python import time sees it.
+    volumes:
+      - open-webui-data:/app/backend/data
+    restart: unless-stopped
+
+  postgres:
+    image: postgres:17-alpine
+    environment:
+      POSTGRES_USER: openwebui
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-openwebui}
+      POSTGRES_DB: openwebui
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U openwebui"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+    restart: unless-stopped
+
+volumes:
+  open-webui-data:
+  postgres-data:

package/docker-compose.yml

@@ -0,0 +1,96 @@
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+# Computer Use Server — core MCP server + workspace image
+# Start: docker compose up
+# Build workspace first: docker compose up --build
+
+services:
+  # Workspace image — builds the AI sandbox container
+  # One-shot verification, then exits. Image stays cached.
+  workspace:
+    build:
+      context: .
+      dockerfile: Dockerfile
+      platforms:
+        - linux/amd64
+    image: ${DOCKER_IMAGE:-open-computer-use:latest}
+    command: >
+      bash -c "echo 'Workspace image OK:' && python3 --version && node --version && echo 'Ready.' && exit 0"
+    restart: "no"
+
+  # Computer Use MCP Server (orchestrator)
+  # Manages workspace containers, provides MCP tools endpoint at :8081
+  computer-use-server:
+    build: ./computer-use-server
+    container_name: computer-use-server
+    ports:
+      - "${MCP_PORT:-8081}:8081"
+    depends_on:
+      workspace:
+        condition: service_completed_successfully
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /tmp/computer-use-data:/tmp/computer-use-data:rw
+      - computer-use-data:/data:rw
+      - skills-cache:/data/skills-cache:rw
+    environment:
+      - MCP_API_KEY=${MCP_API_KEY:-}
+      - DOCKER_IMAGE=${DOCKER_IMAGE:-open-computer-use:latest}
+      - USER_DATA_BASE_PATH=/tmp/computer-use-data
+      - BASE_DATA_DIR=/tmp/computer-use-data
+      # Public URL of this orchestrator, as reachable from the end-user's
+      # browser. The server bakes it into every /system-prompt response (so the
+      # model writes correct links) and returns it to the Open WebUI filter via
+      # the X-Public-Base-URL response header (so outlet() decorates with the
+      # same URL). This is THE single source of truth for the browser-facing
+      # URL — the filter no longer has its own Valve for it.
+      - PUBLIC_BASE_URL=${PUBLIC_BASE_URL:-http://computer-use-server:8081}
+      - COMMAND_TIMEOUT=${COMMAND_TIMEOUT:-120}
+      - SUB_AGENT_TIMEOUT=${SUB_AGENT_TIMEOUT:-3600}
+      - SINGLE_USER_MODE=${SINGLE_USER_MODE:-}
+      - VISION_API_KEY=${VISION_API_KEY:-}
+      - VISION_API_URL=${VISION_API_URL:-}
+      - VISION_MODEL=${VISION_MODEL:-}
+      - ANTHROPIC_AUTH_TOKEN=${ANTHROPIC_AUTH_TOKEN:-}
+      - ANTHROPIC_BASE_URL=${ANTHROPIC_BASE_URL:-}
+      - ANTHROPIC_MODEL=${ANTHROPIC_MODEL:-}
+      - ANTHROPIC_DEFAULT_SONNET_MODEL=${ANTHROPIC_DEFAULT_SONNET_MODEL:-}
+      - ANTHROPIC_DEFAULT_OPUS_MODEL=${ANTHROPIC_DEFAULT_OPUS_MODEL:-}
+      - ANTHROPIC_DEFAULT_HAIKU_MODEL=${ANTHROPIC_DEFAULT_HAIKU_MODEL:-}
+      - CLAUDE_CODE_SUBAGENT_MODEL=${CLAUDE_CODE_SUBAGENT_MODEL:-}
+      - CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS=${CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS:-}
+      - DISABLE_PROMPT_CACHING=${DISABLE_PROMPT_CACHING:-}
+      - DISABLE_PROMPT_CACHING_SONNET=${DISABLE_PROMPT_CACHING_SONNET:-}
+      - DISABLE_PROMPT_CACHING_OPUS=${DISABLE_PROMPT_CACHING_OPUS:-}
+      - DISABLE_PROMPT_CACHING_HAIKU=${DISABLE_PROMPT_CACHING_HAIKU:-}
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8081/health')"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+
+  # Cleanup cron — removes stopped containers, orphaned volumes, stale data
+  cleanup:
+    build: ./cron
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /tmp/computer-use-data:/tmp/computer-use-data:rw
+    environment:
+      - CONTAINER_MAX_AGE_HOURS=${CONTAINER_MAX_AGE_HOURS:-24}
+      - DATA_MAX_AGE_DAYS=${DATA_MAX_AGE_DAYS:-7}
+    restart: unless-stopped
+
+  # Optional: Skill registry — controls per-user skill access
+  # Uncomment to enable. See settings-wrapper/README.md for details.
+  # settings-wrapper:
+  #   build: ./settings-wrapper
+  #   ports:
+  #     - "8082:8082"
+  #   environment:
+  #     - API_KEY=${MCP_TOKENS_API_KEY:-}
+  #   restart: unless-stopped
+
+volumes:
+  computer-use-data:
+  skills-cache:

package/docs/CLOUD.md

@@ -0,0 +1,29 @@
+# Cloud (managed Yambr)
+
+This page exists so GitHub visitors know a managed version exists. It is intentionally thin — the canonical cloud reference is **[docs.yambr.com](https://docs.yambr.com)** and the source of truth for keys, budgets and limits is **[app.yambr.com](https://app.yambr.com)**. If you self-host, see [INSTALL.md](INSTALL.md) instead.
+
+## The four Yambr services
+
+| Service | URL | Role |
+|---------|-----|------|
+| Dashboard | [app.yambr.com](https://app.yambr.com) | Sign in (GitHub / Google), manage keys, spend |
+| MCP endpoint | `https://api.yambr.com/mcp/computer_use` | Public Streamable-HTTP MCP — tools only |
+| Hosted chat | [chat.yambr.com](https://chat.yambr.com) | Open WebUI with Computer Use pre-wired, models included |
+| Artifact host | `https://cu.yambr.com` | Sandbox file/preview URLs |
+
+Yambr publishes the MCP tool endpoint; it is **not** an LLM gateway. On `api.yambr.com` you bring your own model provider. On `chat.yambr.com` models are bundled as a free convenience.
+
+## Which path?
+
+- **Just want to try it?** Open [chat.yambr.com](https://chat.yambr.com), sign in with GitHub or Google.
+- **Want to plug Computer Use into your own agent?** Get a key from [app.yambr.com](https://app.yambr.com), point your MCP client at `https://api.yambr.com/mcp/computer_use` with a `Bearer` header. Per-client configs (Claude Desktop, OpenAI Agents SDK, n8n, LiteLLM, curl) live on [docs.yambr.com](https://docs.yambr.com) under the Integrations section.
+- **Want full control / air-gap / heavy use?** See [INSTALL.md](INSTALL.md).
+
+A bare `GET https://api.yambr.com/mcp/computer_use` returns `500` — that's expected, the endpoint requires `POST` with MCP headers. Not a service outage.
+
+## See also
+
+- [docs.yambr.com/quickstart](https://docs.yambr.com/quickstart) — the three starting paths, with copy-paste snippets
+- [docs.yambr.com/platform/overview](https://docs.yambr.com/platform/overview) — how the four services fit together
+- [docs.yambr.com/platform/api-keys](https://docs.yambr.com/platform/api-keys) — keys, budgets, rotation
+- [MCP.md](MCP.md) — MCP protocol reference (applies to both hosted and self-hosted)