Tell replies their envs and call queued work runs

Chat replies now list the envs that reach them (keys and descriptions,
never values), so a bot no longer asks for keys that are set or "checks"
them with show_secret or printenv. request_secret refuses a key that's
already set unless the user asked to replace it, and search_computers
says envs aren't loaded in its shell.

start_task and delegate_task results say "Run #N" and that list_tasks
doesn't show it, since bots sent users to the to-do list for queue jobs.
start_task refuses a second open run in the session on the same
computer unless it's separate work, and says how many runs are ahead on
that computer.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/functions/backend/db/bots-queue/count-computer-task-jobs.ts

@@ -0,0 +1,24 @@
+import BunSQLite from "@moduletrace/bun-sqlite";
+
+type Params = {
+    computer_id: number | string;
+    /**
+     * Left out of the count, e.g. the job just queued.
+     */
+    except_job_id?: number | string | null;
+};
+
+/**
+ * How many tasks are queued or working on a computer (any bot's, any
+ * user's). Tasks run one at a time per computer, so a new one waits for
+ * all of them.
+ */
+export default async function countComputerTaskJobs({ computer_id, except_job_id }: Params) {
+    const res = await BunSQLite.sql<{ n: number }>({
+        sql: `SELECT COUNT(*) AS n FROM bots_queue
+            WHERE computer_id = ? AND kind = 'task' AND status IN ('pending', 'processing') AND id != ?`,
+        values: [Number(computer_id), Number(except_job_id) || 0],
+    });
+
+    return Number(res.payload?.[0]?.n) || 0;
+}

src/functions/backend/db/bots-queue/grab-open-bot-task.ts

@@ -3,21 +3,35 @@ import BunSQLite from "@moduletrace/bun-sqlite";
 type Params = {
     bot_id: number | string;
     session_id: number | string;
-    title: string;
+    /**
+     * Only a task with this title. Without it, any open task.
+     */
+    title?: string;
+    /**
+     * Only a task on this computer.
+     */
+    computer_id?: number | string | null;
 };
 
 /**
- * The bot's task in this session with this title that's still queued or
- * working, if any, so the same work isn't started twice.
+ * The bot's latest task in this session that's still queued or working
+ * (with this title, on this computer, when given), if any, so the same
+ * work isn't started twice.
  */
-export default async function grabOpenBotTask({ bot_id, session_id, title }: Params) {
-    const res = await BunSQLite.sql<{ id: number; status: string }>({
-        sql: `SELECT id, status FROM bots_queue
+export default async function grabOpenBotTask({ bot_id, session_id, title, computer_id }: Params) {
+    const res = await BunSQLite.sql<{ id: number; status: string; title: string | null }>({
+        sql: `SELECT id, status, title FROM bots_queue
             WHERE bot_id = ? AND session_id = ? AND kind = 'task'
                 AND status IN ('pending', 'processing')
-                AND lower(trim(title)) = lower(trim(?))
+                ${title != undefined ? `AND lower(trim(title)) = lower(trim(?))` : ""}
+                ${computer_id ? `AND computer_id = ?` : ""}
             ORDER BY id DESC LIMIT 1`,
-        values: [bot_id, session_id, title],
+        values: [
+            bot_id,
+            session_id,
+            ...(title != undefined ? [title] : []),
+            ...(computer_id ? [Number(computer_id)] : []),
+        ],
     });
 
     return res.payload?.[0] || null;

src/functions/backend/db/envs/grab-reachable-envs.ts

@@ -0,0 +1,46 @@
+import grabRunEnvs from "../extensions/grab-run-envs";
+import type { DecryptedEnv } from "./grab-all-envs";
+import grabComputerEnvs from "./grab-computer-envs";
+
+type Params = {
+    bot_id: number | string;
+    user_id: number | string;
+    workspace_id?: number | string | null;
+    /**
+     * The computer the run is on (the bot's current one), whose envs count.
+     */
+    computer_id?: number | string | null;
+};
+
+export type ReachableEnvs = {
+    /**
+     * Set on the computer for its tasks ($KEY in their shells and code).
+     */
+    on_computer: DecryptedEnv[];
+    /**
+     * Only filled into tools' templates ({{env.KEY}}): not exposed to
+     * computers, or there's no computer.
+     */
+    tools_only: DecryptedEnv[];
+};
+
+/**
+ * Every env that reaches one run, one per key: the computer's
+ * (`grabComputerEnvs`) first, then the ones only tools read
+ * (`grabRunEnvs`). What `show_secret` can show, what `request_secret`
+ * mustn't ask for again, and what a reply is told it has.
+ */
+export default async function grabReachableEnvs({
+    bot_id,
+    user_id,
+    workspace_id,
+    computer_id,
+}: Params): Promise<ReachableEnvs> {
+    const [on_computer, run] = await Promise.all([
+        computer_id ? grabComputerEnvs({ computer_id, bot_id, user_id, workspace_id }) : [],
+        grabRunEnvs({ bot_id, user_id, workspace_id }),
+    ]);
+    const keys = new Set(on_computer.map((env) => env.key));
+
+    return { on_computer, tools_only: run.filter((env) => !keys.has(env.key)) };
+}