Sessions 286-287: Computer Use Infrastructure Fixes & Vitto Vault

Date: March 30, 2026 Branch: session-280-290 Status: Complete — Ready for Production

What This Session Accomplished (Plain Language)

This session fixed critical server problems that were preventing Computer Use from working, then built an entirely new system called Vitto Vault that lets users save their login credentials securely so they never have to re-enter passwords when running Computer Use tasks.

Timeline of Changes

Phase 1: Emergency Infrastructure Fixes (Session 286)

1.1 Server Crash Fix (Hetzner AX102)

Problem: When a user tried to run a Computer Use task (e.g., "Send an email via Gmail"), the server crashed with a "502 Bad Gateway" error. The task failed immediately with zero steps completed.

Root Cause: The Firecracker software (which creates virtual computers for browser automation) was never installed on our AX102 server. When the system tried to start a virtual machine, it couldn't find the program and crashed the entire server process. The server auto-restarted, but crashed again on the next attempt.

Fix:

• Added safety checks so the server returns a clear error message instead of crashing
• Installed the Firecracker software on AX102 (it was already on AX42)
• Deployed the fix to both servers

Impact: Computer Use tasks can now run successfully on both Hetzner servers.

1.2 Dashboard Display Bug

Problem: The server dashboard showed disk usage as "7.4 TB" and "1754 TB" for our Hetzner servers — impossibly large numbers.

Root Cause: A formatting function had the wrong unit labels. It was showing gigabytes but labeling them as terabytes (off by 1000x).

Fix: Corrected the unit labels in the display code. Now shows accurate values: 7.4 GB used out of 1754 GB total.

Impact: Operations team can now trust the dashboard numbers.

1.3 Deploy Script Fix

Problem: Running yarn sandbox:deploy:all to deploy updates to both servers failed with an error about "unbound variable."

Root Cause: A bash script variable wasn't initialized when no arguments were passed.

Fix: Added a safety check for the empty variable.

Impact: Fleet deployment works reliably with zero arguments.

Phase 2: Vitto Vault System (Session 287)

2.1 The Problem It Solves

Every time a user wanted to run a Computer Use task (like sending an email), they had to manually type their email address and password. This happened every single session because credentials were stored in memory and lost when the server restarted.

2.2 What Was Built

Vault Crypto Library (@libs-api/vault-crypto)

• Shared encryption utilities using AES-256-GCM (industry-standard encryption)
• Used by multiple services to encrypt/decrypt credentials
• Supports key rotation for security compliance

Vault Database

• New vault-accounts collection in MongoDB
• Each credential is encrypted before storage — even database administrators cannot read passwords
• Supports two scopes: personal accounts ("My Vault") and team accounts ("Space Vault")
• Tracks usage: how many times each account was used, when it was last used

Vault Backend Service

• REST API for creating, listing, updating, and deleting vault accounts
• Credential resolution chain: when a task starts, the system automatically finds the right credentials
• Priority: preferred personal account > preferred team account > any available account > ask user
• Protected by JWT authentication — only the account owner can access their vault

Vault Page (/space/{spaceSlug}/vault)

• Two-tab interface: "My Vault" for personal accounts, "Space Vault" for team/shared accounts
• Shows all 8 supported services: Gmail, Google Calendar, GitHub, Reddit, LinkedIn, X (Twitter), Notion, Google Search
• "Add Account" modal with encryption disclosure
• Preferred account management — set which account auto-selects for each service

Account Picker Component (ggs-account-picker)

• Reusable dropdown that appears in Computer Use instead of credential input fields
• Shows the auto-selected preferred account as a chip
• Dropdown reveals all available accounts (personal + team) for the selected service
• "Connect new account" links to the vault page
• "Enter credentials manually" fallback for one-time use

Computer Use Integration

• The AccountPicker replaces the old username/password form
• When a user selects Gmail and clicks "Run," credentials are automatically resolved from the vault
• No more typing passwords every time

2.3 Settings Integration

• Space Settings: New "Vault" item in the sidebar (between Members and Advanced)
• User Preferences: New "My Vault" card at the bottom linking to the vault page

2.4 Cross-App Navigation

• Computer Use runs on the AI app (ai.gograb.space), but the vault lives on the main app (app.gograb.space)
• Built getFrontendAppUrl() utility that automatically resolves the correct URL for both local development and production
• "Manage accounts" link in Computer Use opens the vault in a new tab on the correct app

Phase 3: Computer Use Improvements

3.1 Gmail Profile Update

• Changed "Google Email" label to "Email" — users with Google Workspace (e.g., [email protected]) were confused by the Gmail-specific label
• Updated placeholder from "[email protected]" to "[email protected]"

3.2 Two-Factor Authentication (2FA) Handling

• Before: When Google asked for a 2FA code, the agent stopped and marked the task as complete without doing anything
• After: The agent now clicks "Text" to trigger the verification code, then asks the user to provide the code via the reply input, enters it, and continues the task

3.3 Validation Fix

• Fixed a bug where "Google Email is required" error appeared even when a vault account was already selected
• Now skips credential field validation when a vault account is selected

Architecture Summary

User → Vault Page (save credentials once)
         ↓
User → Computer Use → AccountPicker (auto-selects saved account)
         ↓
ComputerUseSupervisor → VaultAccountService (resolves credentials from vault)
         ↓
Backend-AI-API → Firecracker VM → Chrome → Task Execution

What's Next (Session 288+)

OAuth-First Intelligent Task Execution

Instead of always launching a browser VM ($2-5, 30-120 seconds), the system will automatically pick the cheapest/fastest path:

1. API Execution ($0, 0.1 seconds) — Use OAuth tokens to call Gmail/Calendar/GitHub APIs directly
2. Persistent VM Session ($0.50, 15 seconds) — Restore a saved browser session (already logged in)
3. Fresh Browser ($2-5, 120 seconds) — Current behavior, only when needed

Vault-Driven Profiles

• Show task templates based on which accounts the user has saved
• Auto-detect email providers (Google Workspace, Outlook) from domain
• Reorder service profiles to show connected services first

Persistent VM Onboarding

• When adding a password account, offer "Verify & Save Session"
• Logs in once, handles 2FA, saves the authenticated browser state
• All future tasks restore this state — never log in again

Files Created/Modified

New Files

Modified Files

Security Notes

• All credentials encrypted with AES-256-GCM before storage
• Unique initialization vector (IV) per credential — prevents pattern analysis
• Credentials never sent to frontend — only masked identifiers shown (e.g., pa***@gograb.space)
• Credentials never included in AI/LLM context
• Credentials never logged — CredentialRedactorService scrubs all log output
• JWT authentication required for all vault endpoints
• Space vault access is role-gated (only admins can add/remove team accounts)