computer: Carry backend information through Workspace clients

[mattzcarey]

Stacked on #172, after #181 merged into it.

This fixes the issues review found in #181.

A WorkspaceClient from getWorkspace() wrapped the runtime with exec, getExec, killExec, and disposeExec only. The exec tool also asks the runtime for backendIds, isCallable, and describe, so a client lost all three. With exec left out, an agent got no exec tool, and a callable backend such as celld's lost its input argument and its module list:

A Durable Object that builds its own Workspace passes it straight to createAITools and was never affected. The bug hit the two cases that go through getWorkspace():

// 1. Inside a Durable Object using the withWorkspace mixin, which keeps
//    the Workspace private, as in examples/celld:
const workspace = await getWorkspace(this);
createAITools({ workspace }); // no exec tool, despite backends

// 2. From another Worker or Durable Object, over RPC, as in examples/egress:
const workspace = await getWorkspace(env.MyDO.get(id));
createAITools({ workspace }); // same

// Unaffected: a Durable Object that owns its Workspace, as in examples/think.
createAITools({ workspace: this.workspace });

The tool needs one list of facts per backend, so this PR also collapses those three methods into one:

runtime.backends(): { id: string; callable: boolean; description?: string }[]

The Workspace runtime, its RPC stub, the client, and the tool all speak that one method. backendIds and describe are gone. isCallable stays on the runtime only for its own check before running.

Backends are fixed when the Workspace is constructed, so a client takes one backends() snapshot when getWorkspace() creates it:

sequenceDiagram
  participant Agent
  participant Client as WorkspaceClient
  participant Stub as WorkspaceRuntimeStub (RPC)
  Agent->>Client: getWorkspace(handle)
  Client->>Stub: backends()
  Stub-->>Client: [{ id, callable, description }]
  Agent->>Client: createAITools({ workspace })
  Client-->>Agent: backends(), answered from the snapshot

Loading

The snapshot keeps createAITools synchronous over RPC, where the call would otherwise be a round trip.

Three smaller fixes:

• CloudflareContainerBackend claimed network access even with the default egress: { mode: "none" }. Its description now follows the egress mode: direct, through a gateway, or none.
• exec now takes precedence over the deprecated shell option, so exec: {} always means no exec tool.
• The mcp README described backend as optional, and the think prompt named a default backend. Both now say to name a backend on every call.

client.test.ts builds tools from both a local and a remote client against a real WorkerJavaScriptBackend, checks the backend answers and the module list, and sends structured input through each client's exec tool to a callable backend that echoes it. The snapshot is frozen, so editing the list a client returns cannot change later answers. The other fixes each have a focused test.

[changeset-bot]

🦋 Changeset detected

Latest commit: 6511ce7

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages

Name	Type
@cloudflare/computer	Minor
@cloudflare/dofs	Minor
@cloudflare/computer-rpc	Minor
@cloudflare/computerd	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@cloudflare/computer@182

commit: 3de7511