Local VM: show two per-bot desktops in one app window

[lightcloud00]

Problem

Per-bot Local VMs can run two isolated bot desktops, but the Electron app still exposes one modal desktop viewer at a time. Opening another viewer replaces the first and also takes control immediately, preventing a two-up watch workflow.

Requested behavior

• Show exactly two ready per-bot Local VM desktops inside one OpenMausBot app window.
• Default both panes to live watch-only mode so both bots continue working.
• Permit keyboard and mouse input in at most one pane.
• Release the previous control hold before activating the other pane.
• Keep viewer URLs loopback-only and out of renderer events/logs.
• Leave shared/cloud/single-view behavior unchanged.

Acceptance

• Both panes render and update simultaneously.
• Opening the workspace leaves both bots unheld.
• Switching control releases the first bot before taking the second.
• Closing the workspace leaves both held=false.
• Resize, minimize/restore, overlays, and one-VM failure remain isolated.

Related work

• Local VM: only one bot at a time — is the single shared instance intentional, and could it become per-bot? #187 established the per-bot requirement.
• feat(local-vm): support isolated per-bot desktops #332 added isolated per-bot VM infrastructure.
• feat(computer): open live VNC desktop inside the app #322 added the current in-app single desktop viewer.

[lightcloud00]

Status update (2026-08-22, sanitized):

• Source: PR Local VM: add secure two-up workspace and Chief status awareness #365 publishes the two-pane workspace, serialized one-controller handoff, and Chief freshness capsule at exact head 10efdb98818f6977a7383d291b2dadf491d648cd.
• CI: GitHub typecheck/tests pass on macOS, Ubuntu, and Windows; Swift/iOS and Ubuntu package smoke also pass. Vercel alone reports an authorization-required status, which is separate from code/package CI.
• Merge: PR Local VM: add secure two-up workspace and Chief status awareness #365 is open and mergeable but currently UNSTABLE; it has not merged.
• Package/install: a Windows package was built with Node 24 from implementation commit a3d3683695994a402a9c75dabc7dd1f6106bd7cb; the newer PR head differs only by the Windows fail-closed test. The package executables are unsigned, so SmartScreen/signing is a stop gate. No installed app was replaced and no restart occurred.
• Live runtime: the existing loopback service still reports two eligible isolated slots with the eight-hour recycler unchanged, but both recycled containers remain absent. No restore or live two-pane/controller acceptance is claimed.
• Chief/bridge: the Chief-only 300-second validated capsule is implemented in source. Bridge activation/reload remains unperformed because registry projection validation found stale verified timestamps; runtime awareness therefore remains unknown.
• Hermes: the real screenshot compatibility follow-up is tracked in ACP model switches drop session MCPs; bound screenshot pseudo-call remains text NousResearch/hermes-agent#92248. No Hermes package/install/restart is claimed.

Related history remains #332 and #322 merged, with #187 completed.

[lightcloud00]

Source closeout is ready for maintainer acceptance in #365 at exact head a6855b7. All five actionable review threads are resolved; local focused, typecheck, build, Electron, packaged-server, diff, and secret gates pass; and fresh macOS, Ubuntu, Windows, package-smoke, and Swift CI are green. Vercel authorization is an external status. No installation, VM restoration, deployment, or live canary was performed.

[lightcloud00]

Refreshed implementation status

PR #365 has been reconciled locally onto current upstream at head 76e2d3dc783f8f5c1022bd2e1a760cbd49c92688. The implementation retains exactly two watch panes, one active controller, loopback-only navigation, serialized lease handoff, and the two-view ceiling. The docs now include the Windows same-host per-bot / maxInstances: 2 runbook and link multi-host work to #508.

Focused evidence remains green: 11 Electron desktop-workspace tests, 13 workspace reducer tests, 71 focused server tests with one skip, targeted per-bot server integration, TypeScript typecheck, Electron check, and production build. The exact head is clean and queued for serialized publication after PR #326 and the smaller repair branches.