fixing/merge-conflict

.devcontainer/Dockerfile

@@ -0,0 +1,40 @@
+# Full Electron + Den dev environment for Daytona sandboxes.
+#
+# Clones the repo from GitHub, installs deps, and provides
+# Xvfb + noVNC so you can see/steer the real Electron app
+# from your browser.
+
+FROM node:20-bookworm
+
+# System deps for Electron / Chromium + virtual display + utils
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git unzip dbus dbus-x11 \
+    libgtk-3-0 libnotify-dev libnss3 libxss1 libasound2 \
+    libxtst6 libatk-bridge2.0-0 libdrm2 libgbm1 libxrandr2 \
+    libxcomposite1 libxdamage1 libxfixes3 libcups2 \
+    libpango-1.0-0 libcairo2 \
+    xvfb x11vnc novnc websockify fluxbox xterm \
+    default-mysql-client \
+    && rm -rf /var/lib/apt/lists/*
+
+# pnpm + bun
+RUN corepack enable && corepack prepare pnpm@latest --activate
+# Pin bun to the CI-proven 1.3 line; unpinned installs picked up bun 1.4.0,
+# which breaks the Den/desktop sandbox stack (sign-in grant exchange fails).
+RUN npm install -g bun@1.3.14
+
+# noVNC index
+RUN ln -sf /usr/share/novnc/vnc.html /usr/share/novnc/index.html
+
+ENV DISPLAY=:99
+ENV ELECTRON_DISABLE_SANDBOX=1
+ENV PNPM_HOME=/root/.local/share/pnpm
+ENV PATH=$PNPM_HOME:$PATH
+
+# Clone and install
+ARG REPO_URL=https://github.com/different-ai/openwork.git
+ARG BRANCH=dev
+WORKDIR /workspace
+RUN git clone --depth 1 --branch $BRANCH $REPO_URL . && pnpm install --frozen-lockfile || pnpm install
+
+EXPOSE 3005 5173 6080 8788 9825

.devcontainer/Dockerfile.daytona-server

@@ -0,0 +1,73 @@
+# Daytona image for the OpenWork Den server stack.
+#
+# This intentionally does not run Docker inside Daytona. The sandbox runs the
+# same services as packaging/docker/docker-compose.den-dev.yml directly:
+# MySQL, Den API, and Den Web.
+FROM daytonaio/sandbox:0.6.0
+
+USER root
+
+RUN apt-get update \
+  && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+    ca-certificates \
+    curl \
+    default-mysql-client \
+    default-mysql-server \
+    git \
+    procps \
+    sudo \
+  && /usr/local/share/nvm/current/bin/npm install -g pnpm@10.27.0 bun@1.3.14 \
+  && apt-get clean \
+  && rm -rf /var/lib/apt/lists/* /root/.cache /root/.npm /tmp/* \
+  && printf 'daytona ALL=(ALL) NOPASSWD:ALL\n' >/etc/sudoers.d/daytona-openwork \
+  && chmod 0440 /etc/sudoers.d/daytona-openwork \
+  && install -d -o daytona -g daytona /workspace
+
+WORKDIR /workspace
+
+ENV PATH="/usr/local/share/nvm/current/bin:$PATH"
+
+# Everything under /workspace is created as the daytona user so no later
+# chown layer is needed: a recursive chown in its own layer copy-on-write
+# duplicates the entire baked workspace and pushed the image past the 20 GB
+# snapshot limit.
+USER daytona
+
+RUN git clone --depth 1 --branch dev https://github.com/different-ai/openwork.git . \
+  && mkdir -p /workspace/.openwork-daytona \
+  && sha256sum /workspace/pnpm-lock.yaml | cut -d ' ' -f 1 > /workspace/.openwork-daytona/pnpm-lock.sha256 \
+  && git rev-parse HEAD > /workspace/.openwork-daytona/base-commit \
+  && git gc --prune=now
+
+# Bake dependencies and the sandbox-invariant Den builds so a boot from this
+# snapshot only pays checkout + delta install + service start. The Den Web
+# production build bakes no per-sandbox values: NEXT_PUBLIC_* inputs are fixed
+# and every DEN_* value is runtime env consumed by `next start`.
+# .devcontainer/start-daytona-server.sh skips these rebuilds when the git tree
+# hashes recorded here still match the checked-out ref.
+# Only the server packages' dependency graph is installed, and Electron and
+# browser binaries are skipped: the server stack never runs them, and the
+# smaller node_modules keeps the image inside the snapshot size limits. The
+# full-lockfile sha marker stays valid because a filtered install uses the
+# same lockfile; a ref that changes the lockfile reinstalls at boot.
+RUN CI=1 ELECTRON_SKIP_BINARY_DOWNLOAD=1 PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 \
+    PUPPETEER_SKIP_DOWNLOAD=1 CYPRESS_INSTALL_BINARY=0 \
+    pnpm install --store-dir /workspace/.openwork-daytona/pnpm-store --frozen-lockfile \
+      --filter @openwork-ee/den-api... \
+      --filter @openwork-ee/den-web... \
+      --filter @openwork-ee/den-db... \
+      --filter @openwork/ui... \
+      --filter @openwork-ee/utils... \
+      --filter @openwork/mcp-apps... \
+  && NEXT_PUBLIC_POSTHOG_KEY= NEXT_PUBLIC_POSTHOG_API_KEY= \
+    pnpm --filter @openwork/ui build \
+  && NEXT_PUBLIC_POSTHOG_KEY= NEXT_PUBLIC_POSTHOG_API_KEY= \
+    pnpm --filter @openwork-ee/utils build \
+  && NEXT_PUBLIC_POSTHOG_KEY= NEXT_PUBLIC_POSTHOG_API_KEY= \
+    pnpm --filter @openwork-ee/den-web build \
+  && pnpm --filter @openwork-ee/den-api run build:mcp-apps \
+  && { git rev-parse HEAD:packages/ui HEAD:ee/packages/utils HEAD:ee/apps/den-web; cat /workspace/.openwork-daytona/pnpm-lock.sha256; } \
+    | sha256sum | cut -d ' ' -f 1 > /workspace/.openwork-daytona/den-web-build.tree \
+  && { git rev-parse HEAD:packages/mcp-apps; cat /workspace/.openwork-daytona/pnpm-lock.sha256; } \
+    | sha256sum | cut -d ' ' -f 1 > /workspace/.openwork-daytona/den-api-assets.tree \
+  && rm -rf /home/daytona/.cache /home/daytona/.npm /home/daytona/.local/share/pnpm/store

.devcontainer/Dockerfile.daytona-vnc

@@ -0,0 +1,29 @@
+# Daytona VNC/Computer Use image with OpenWork preinstalled.
+#
+# Use this for Electron/noVNC tests instead of the generic devcontainer image.
+# The base image already contains the desktop stack Daytona expects:
+# Xvfb, XFCE, x11vnc, noVNC, websockify, and dbus-x11.
+FROM daytonaio/sandbox:0.6.0
+
+USER root
+
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends ffmpeg \
+  && rm -rf /var/lib/apt/lists/*
+
+RUN /usr/local/share/nvm/current/bin/npm install -g pnpm@10.27.0 bun
+
+WORKDIR /workspace
+
+RUN git clone --depth 1 --branch dev https://github.com/different-ai/openwork.git . \
+  && mkdir -p /workspace/.openwork-daytona \
+  && sha256sum /workspace/pnpm-lock.yaml | cut -d ' ' -f 1 > /workspace/.openwork-daytona/pnpm-lock.sha256 \
+  && /usr/local/share/nvm/current/bin/npm cache clean --force \
+  && git gc --prune=now \
+  && rm -rf /root/.cache /root/.npm \
+    /home/daytona/.cache /home/daytona/.npm /home/daytona/.local/share/pnpm/store \
+    /workspace/node_modules /tmp/*
+
+RUN chown -R daytona:daytona /workspace
+
+USER daytona

.devcontainer/README.md

@@ -0,0 +1,159 @@
+# Daytona / Dev Container Setup
+
+Full-stack dev environment that runs the **real Electron app** + Den stack in a cloud sandbox. You see and steer the desktop app through your browser via noVNC.
+
+## What's included
+
+| Service | Port | Description |
+|---------|------|-------------|
+| **Desktop App (noVNC)** | 6080 | The real Electron app rendered in a virtual display, accessible in your browser |
+| **Den Web** | 3005 | Admin dashboard for managing orgs, restrictions, providers |
+| **Den API** | 8788 | Control plane API |
+| **CDP Debug** | 9825 | Chrome DevTools Protocol — for app and browser automation |
+| **Vite HMR** | 5173 | Hot module replacement for the React UI |
+| **MySQL** | 3306 | Database (internal) |
+
+## Quick start with Daytona Electron/noVNC
+
+```bash
+bash .devcontainer/create-daytona-openwork-snapshot.sh   # one-time / refresh when deps change
+bash .devcontainer/test-on-daytona.sh [branch-or-commit]
+```
+
+The test script creates a sandbox from the reusable `openwork-eval-vnc` snapshot
+when present, checks out the target ref, skips `pnpm install` if the lockfile is
+unchanged, starts XFCE/noVNC, Vite, and Electron, then prints the noVNC and CDP
+URLs. If the snapshot is missing, it fails fast and tells you to create it. The
+snapshot intentionally does not bake `node_modules`; installs use the reusable
+`openwork-eval-pnpm-store` volume so the image stays under Daytona's 20 GB limit.
+
+For provider evals, create/populate the reusable Daytona secrets volume once:
+
+```bash
+bash .devcontainer/setup-daytona-secrets-volume.sh .newtoken
+bash .devcontainer/setup-daytona-secrets-volume.sh .anthropic anthropic.env
+```
+
+Future Daytona test sandboxes mount `openwork-eval-secrets:/daytona-secrets`
+and source every `/daytona-secrets/*.env` file automatically before Electron
+starts. Use this volume for provider keys and other eval-only secrets; never
+commit those files into the repo.
+
+For downloadable eval artifacts or optional video recording, use:
+
+```bash
+bash .devcontainer/test-on-daytona.sh [branch-or-commit] --artifacts-volume
+bash .devcontainer/test-on-daytona.sh [branch-or-commit] --record-video
+```
+
+The artifacts flow mounts `openwork-eval-artifacts:/daytona-artifacts`, starts a
+static download server on port 8090, and prints a Daytona preview URL. Recording
+writes mp4 files to `/daytona-artifacts/recordings` and prints the direct video
+URL. Screenshots write png files to `/daytona-artifacts/screenshots` for quick
+AI/human validation checkpoints. Stop recording with
+`.devcontainer/stop-daytona-recording.sh` so ffmpeg finalizes the file cleanly.
+
+Do not use the generic `daytona create https://github.com/different-ai/openwork`
+flow for Electron/noVNC tests. The default resource size is too small and the
+generic image path does not guarantee the desktop stack we need.
+
+## Quick start with Daytona server
+
+```bash
+bash .devcontainer/create-daytona-openwork-server-snapshot.sh  # one-time / refresh when deps change
+bash .devcontainer/test-server-on-daytona.sh [branch-or-commit]
+```
+
+The server helper creates a separate public Daytona sandbox for the Den stack:
+MySQL, Den API, and Den Web. It prints public preview URLs and
+the exact Electron command to point a desktop sandbox at that server:
+
+```bash
+bash .devcontainer/test-on-daytona.sh [branch-or-commit] \
+  --den-base-url https://3005-...daytonaproxy... \
+  --den-api-base-url https://8788-...daytonaproxy...
+```
+
+This keeps the architecture simple: the server sandbox owns cloud auth, orgs,
+policies, workers, and persistence; the Electron sandbox stays a real desktop
+client and talks to the server through public Daytona preview URLs.
+
+## How it works
+
+1. `.devcontainer/Dockerfile.daytona-vnc` starts from `daytonaio/sandbox:0.6.0`,
+   which includes Daytona's expected desktop packages: Xvfb, XFCE, x11vnc,
+   noVNC, websockify, and dbus-x11.
+2. `.devcontainer/create-daytona-openwork-snapshot.sh` bakes that image into
+   `openwork-eval-vnc` without `node_modules`.
+3. `/opt/openwork-daytona/start-daytona-vnc.sh` starts Xvfb, XFCE, x11vnc, and
+   noVNC on display `:99`.
+4. `test-on-daytona.sh` installs dependencies through the reusable
+   `openwork-eval-pnpm-store` volume when `node_modules` is missing or the
+   lockfile changed.
+5. Vite serves the React UI on port 5173.
+6. `/opt/openwork-daytona/start-daytona-electron.sh` sources optional secrets,
+   applies Daytona-safe Chromium flags, and starts Electron on display `:99`.
+7. **CDP on port 9825** enables Chrome MCP and browser-tool automation.
+8. Optional artifact capture mounts `/daytona-artifacts`, serves it on port 8090,
+   records display `:99` with ffmpeg when `--record-video` is passed, and can
+   capture screenshot checkpoints with `.devcontainer/capture-daytona-screenshot.sh`.
+
+## Validation Evidence
+
+Use three layers of evidence for Daytona UI work:
+
+- **CDP assertions:** use browser tools against port 9825 to inspect text, URL,
+  state, and accessibility snapshots. This is the primary AI validation path.
+- **Screenshots:** run `daytona exec "$SANDBOX" -- 'bash .devcontainer/capture-daytona-screenshot.sh'` after important states. These png files live in `/daytona-artifacts/screenshots`.
+- **Recordings:** start with `--record-video --recording-name <name>` for flows
+  that need PR evidence. These mp4 files live in `/daytona-artifacts/recordings`.
+
+Recordings prove the flow to humans. CDP assertions and screenshots give the AI
+fast checkpoints to decide whether behavior is correct before reporting success.
+
+## AI Skills
+
+The Daytona toolbox is exposed to opencode through focused skills:
+
+- `daytona-dev`: overview of the Daytona setup and when to use each piece.
+- `daytona-cloud-server`: Den Web/API, marketplace, cloud auth, and org policy flows.
+- `daytona-secrets-volume`: add and verify provider keys or eval-only secrets in `/daytona-secrets`.
+- `daytona-electron-test`: run and drive the real Electron app through CDP/noVNC.
+- `daytona-recording-artifacts`: screenshots, recordings, before/after videos, and PR evidence.
+- `run-tests`: runs `evals/specs` coverage locally or with the relevant Daytona environment.
+
+## Testing the customization system
+
+1. Open **Den Web** (port 3005) in a separate tab
+2. Sign up → create org → Org Settings → UI Customization
+3. Set overrides → Save
+4. In the **Electron app** (noVNC on port 6080):
+   - Cloud → developer mode → base URL `http://localhost:3005`
+   - Sign in → Settings → see the desktop policy banner
+
+## Architecture
+
+```
+Your Browser
+    │
+    ├── :6080 noVNC ──▶ x11vnc ──▶ XFCE/Xvfb ──▶ Electron App
+    │                              │
+    │                              ├── CDP :9825 (automatable)
+    │                              └── Vite HMR :5173
+    │
+    ├── :3005 Den Web (Next.js)
+    │
+    └── :8788 Den API (Hono) ──▶ MySQL :3306
+```
+
+With a separate server sandbox, the Electron box uses Daytona preview URLs for
+Den Web/API instead of `localhost`, while the server sandbox still keeps its
+internal service graph local.
+
+## Automation
+
+The Electron app exposes CDP on port 9825. You can:
+
+- Connect Playwright: `const browser = await chromium.connectOverCDP('ws://localhost:9825')`
+- Connect Chrome MCP for AI agent testing
+- Take screenshots, run UI tests, etc.

.devcontainer/capture-daytona-screenshot.sh

@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Capture a single Daytona Electron display frame as a PNG artifact. Screenshots
+# are for quick AI/human validation; videos are still the durable PR evidence.
+
+OUTPUT="/daytona-artifacts/screenshots/daytona-screenshot-$(date +%Y%m%d-%H%M%S).png"
+SIZE="1920x1080"
+
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --output)
+      shift
+      OUTPUT="${1:?missing output path}"
+      ;;
+    --size)
+      shift
+      SIZE="${1:?missing screenshot size}"
+      ;;
+    --help|-h)
+      printf '%s\n' \
+        "Usage: capture-daytona-screenshot.sh [--output PATH] [--size WxH]" \
+        "" \
+        "Captures DISPLAY, defaulting to :99, and writes a PNG file."
+      exit 0
+      ;;
+    --*)
+      echo "Unknown option: $1" >&2
+      exit 1
+      ;;
+    *)
+      echo "Unexpected argument: $1" >&2
+      exit 1
+      ;;
+  esac
+  shift
+done
+
+if ! command -v ffmpeg >/dev/null 2>&1; then
+  echo "ERROR: ffmpeg is required for Daytona screenshots." >&2
+  exit 1
+fi
+
+if [[ ! "$SIZE" =~ ^[0-9]+x[0-9]+$ ]]; then
+  echo "ERROR: screenshot size must use WxH format, for example 1920x1080" >&2
+  exit 1
+fi
+
+FINAL_OUTPUT="$OUTPUT"
+CAPTURE_OUTPUT="$OUTPUT"
+if [[ "$OUTPUT" = /daytona-artifacts/* ]]; then
+  CAPTURE_OUTPUT="/tmp/daytona-screenshot-$(basename "$OUTPUT")"
+fi
+
+mkdir -p "$(dirname "$CAPTURE_OUTPUT")"
+ffmpeg -y -f x11grab -video_size "$SIZE" -i "${DISPLAY:-:99}" -frames:v 1 "$CAPTURE_OUTPUT" >/tmp/daytona-screenshot.log 2>&1
+
+if [ "$CAPTURE_OUTPUT" != "$FINAL_OUTPUT" ]; then
+  mkdir -p "$(dirname "$FINAL_OUTPUT")"
+  cp "$CAPTURE_OUTPUT" "$FINAL_OUTPUT"
+fi
+
+echo "Screenshot saved: $FINAL_OUTPUT"