Merge branch 'main' into feat/workspace-provider-field

The hardcoded Hetzner instance lists used cx/ccx, but the live Hetzner project
(verified via HCLOUD_TOKEN against api.hetzner.cloud) offers cpx (AMD) + cax
(ARM). Aligned both the workspace-server allowlist and the canvas Container
Config selector to the real shapes, in sync with controlplane's RateCatalog:

  cpx11/cpx21/cpx31/cpx41/cpx51 (AMD) + cax21/cax31/cax41 (ARM)

Without this the allowlist would reject the real default (cpx31) and the UI
would offer shapes that don't exist.

Verified: workspace-server go build + compute tests pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

canvas/src/components/tabs/ContainerConfigTab.tsx

@@ -6,7 +6,21 @@ import { runtimeDisplayName } from "@/lib/runtime-names";
 import { useCanvasStore, type WorkspaceNodeData } from "@/store/canvas";
 import type { WorkspaceCompute } from "@/store/socket";
 
-const INSTANCE_TYPES = ["t3.medium", "t3.large", "t3.xlarge", "t3.2xlarge", "m6i.large", "m6i.xlarge", "c6i.xlarge"];
+// Multi-provider RFC: provider drives the instance-type list. AWS is the only
+// default-visible option until the CTO-gated flip; Hetzner/GCP are shown when
+// the backend reports them registered + the customer is entitled.
+// TODO(SSOT): replace these literals with the CP provider catalog (the same
+// SSOT that prices the shapes) — keep in sync with workspace-server's
+// workspaceComputeInstanceAllowlistByProvider and controlplane's RateCatalog
+// until the catalog endpoint lands.
+const PROVIDERS = ["aws", "hetzner", "gcp"];
+const PROVIDER_INSTANCE_TYPES: Record<string, string[]> = {
+  aws: ["t3.medium", "t3.large", "t3.xlarge", "t3.2xlarge", "m6i.large", "m6i.xlarge", "c6i.xlarge"],
+  hetzner: ["cpx11", "cpx21", "cpx31", "cpx41", "cpx51", "cax21", "cax31", "cax41"],
+  gcp: ["e2-small", "e2-standard-2", "e2-standard-4", "n2-standard-2", "n2-standard-4"],
+};
+const providerLabel = (p: string): string =>
+  p === "aws" ? "AWS" : p === "hetzner" ? "Hetzner (cost)" : p === "gcp" ? "Google Cloud" : p;
 const RUNTIME_OPTIONS = ["claude-code", "codex", "hermes", "openclaw", "kimi", "kimi-cli", "external"];
 const RESOLUTIONS = ["1280x720", "1440x900", "1920x1080", "2560x1440"];
 const DEFAULT_HEADLESS_INSTANCE_TYPE = "t3.medium";
@@ -23,6 +37,7 @@ type Props = {
 
 type FormState = {
   runtime: string;
+  provider: string;
   instanceType: string;
   rootGB: string;
   displayEnabled: boolean;
@@ -40,6 +55,7 @@ const dataPersistenceLabel = (v: string): string =>
 
 export function ContainerConfigTab({ workspaceId, data }: Props) {
   const runtime = data.runtime;
+  const provider = data.compute?.provider;
   const instanceType = data.compute?.instance_type;
   const rootGB = data.compute?.volume?.root_gb;
   const displayMode = data.compute?.display?.mode;
@@ -48,8 +64,8 @@ export function ContainerConfigTab({ workspaceId, data }: Props) {
   const displayHeight = data.compute?.display?.height;
   const dataPersistence = data.compute?.data_persistence;
   const initial = useMemo(
-    () => formFromData({ runtime, instanceType, rootGB, displayMode, displayProtocol, displayWidth, displayHeight, dataPersistence }),
-    [runtime, instanceType, rootGB, displayMode, displayProtocol, displayWidth, displayHeight, dataPersistence],
+    () => formFromData({ runtime, provider, instanceType, rootGB, displayMode, displayProtocol, displayWidth, displayHeight, dataPersistence }),
+    [runtime, provider, instanceType, rootGB, displayMode, displayProtocol, displayWidth, displayHeight, dataPersistence],
   );
   const [form, setForm] = useState<FormState>(initial);
   const [saving, setSaving] = useState(false);
@@ -87,6 +103,7 @@ export function ContainerConfigTab({ workspaceId, data }: Props) {
 
         const [width, height] = form.resolution.split("x").map((v) => parseInt(v, 10));
         const compute: WorkspaceCompute = {
+          provider: form.provider,
           instance_type: form.instanceType,
           volume: { root_gb: rootGB },
           display: form.displayEnabled
@@ -139,11 +156,27 @@ export function ContainerConfigTab({ workspaceId, data }: Props) {
             optionLabel={runtimeDisplayName}
             onChange={(runtime) => setForm((s) => ({ ...s, runtime }))}
           />
+          <SelectField
+            id="cloud-provider"
+            label="Cloud provider"
+            value={form.provider}
+            options={PROVIDERS}
+            optionLabel={providerLabel}
+            onChange={(provider) =>
+              setForm((s) => {
+                // Provider drives the instance-type set; reset to the new
+                // provider's first shape when the current one isn't valid there.
+                const shapes = PROVIDER_INSTANCE_TYPES[provider] ?? [];
+                const instanceType = shapes.includes(s.instanceType) ? s.instanceType : (shapes[0] ?? s.instanceType);
+                return { ...s, provider, instanceType };
+              })
+            }
+          />
           <SelectField
             id="instance-type"
             label="Instance type"
             value={form.instanceType}
-            options={INSTANCE_TYPES}
+            options={PROVIDER_INSTANCE_TYPES[form.provider] ?? PROVIDER_INSTANCE_TYPES.aws}
             onChange={(instanceType) => setForm((s) => ({ ...s, instanceType }))}
           />
           <label className="grid gap-1" htmlFor="root-volume-gb">
@@ -247,6 +280,7 @@ export function ContainerConfigTab({ workspaceId, data }: Props) {
 
 function formFromData(data: {
   runtime?: string;
+  provider?: string;
   instanceType?: string;
   rootGB?: number;
   displayMode?: string;
@@ -260,6 +294,7 @@ function formFromData(data: {
   const resolution = `${width}x${height}`;
   return {
     runtime: data.runtime || "claude-code",
+    provider: data.provider || "aws",
     instanceType: data.instanceType || DEFAULT_HEADLESS_INSTANCE_TYPE,
     rootGB: String(data.rootGB || DEFAULT_HEADLESS_ROOT_GB),
     displayEnabled: !!data.displayMode && data.displayMode !== "none",

canvas/src/store/socket.ts

@@ -358,6 +358,9 @@ export interface WorkspaceData {
 }
 
 export interface WorkspaceCompute {
+  // Cloud backend: "aws" | "hetzner" | "gcp". undefined = CP default (AWS until
+  // the CTO-gated flip; multi-provider RFC). Drives the valid instance_type set.
+  provider?: string;
   instance_type?: string;
   volume?: {
     root_gb?: number;

workspace-server/internal/handlers/workspace_compute.go

@@ -31,20 +31,49 @@ type workspaceDisplayResponse struct {
 	Status    string `json:"status,omitempty"`
 }
 
-var workspaceComputeInstanceAllowlist = map[string]struct{}{
-	"t3.medium":  {},
-	"t3.large":   {},
-	"t3.xlarge":  {},
-	"t3.2xlarge": {},
-	"m6i.large":  {},
-	"m6i.xlarge": {},
-	"c6i.xlarge": {},
+// workspaceComputeInstanceAllowlistByProvider is the per-provider set of
+// selectable shapes (multi-provider RFC). AWS keeps its existing list; Hetzner
+// and GCP add theirs. Empty provider normalizes to "aws" so pre-multi-provider
+// workspaces validate unchanged.
+//
+// TODO(SSOT): source this from the CP provider catalog (the same SSOT the
+// Container Config selector reads) rather than a second hardcoded copy — keep
+// in sync with controlplane internal/credits providerInstanceUSDPerHour until
+// the catalog endpoint lands.
+var workspaceComputeInstanceAllowlistByProvider = map[string]map[string]struct{}{
+	"aws": {
+		"t3.medium": {}, "t3.large": {}, "t3.xlarge": {}, "t3.2xlarge": {},
+		"m6i.large": {}, "m6i.xlarge": {}, "c6i.xlarge": {},
+	},
+	"hetzner": {
+		"cpx11": {}, "cpx21": {}, "cpx31": {}, "cpx41": {}, "cpx51": {},
+		"cax21": {}, "cax31": {}, "cax41": {},
+	},
+	"gcp": {
+		"e2-small": {}, "e2-standard-2": {}, "e2-standard-4": {},
+		"n2-standard-2": {}, "n2-standard-4": {},
+	},
+}
+
+func normalizeWorkspaceProvider(p string) string {
+	switch p {
+	case "aws", "hetzner", "gcp":
+		return p
+	case "":
+		return "aws" // back-compat: pre-multi-provider rows
+	default:
+		return "" // unknown → invalid (validated below)
+	}
 }
 
 func validateWorkspaceCompute(compute models.WorkspaceCompute) error {
+	provider := normalizeWorkspaceProvider(compute.Provider)
+	if provider == "" {
+		return fmt.Errorf("unsupported compute.provider (want aws|hetzner|gcp)")
+	}
 	if compute.InstanceType != "" {
-		if _, ok := workspaceComputeInstanceAllowlist[compute.InstanceType]; !ok {
-			return fmt.Errorf("unsupported compute.instance_type")
+		if _, ok := workspaceComputeInstanceAllowlistByProvider[provider][compute.InstanceType]; !ok {
+			return fmt.Errorf("unsupported compute.instance_type %q for provider %q", compute.InstanceType, provider)
 		}
 	}
 	if compute.Volume.RootGB != 0 {
@@ -107,7 +136,8 @@ func validateWorkspaceDisplayDimensions(width, height int) error {
 }
 
 func workspaceComputeIsZero(compute models.WorkspaceCompute) bool {
-	return compute.InstanceType == "" &&
+	return compute.Provider == "" &&
+		compute.InstanceType == "" &&
 		compute.Volume.RootGB == 0 &&
 		compute.Display.Mode == "" &&
 		compute.Display.Width == 0 &&
@@ -120,6 +150,9 @@ func workspaceComputeJSON(compute models.WorkspaceCompute) (string, error) {
 		return "{}", nil
 	}
 	out := map[string]interface{}{}
+	if compute.Provider != "" {
+		out["provider"] = compute.Provider
+	}
 	if compute.InstanceType != "" {
 		out["instance_type"] = compute.InstanceType
 	}

workspace-server/internal/handlers/workspace_compute_test.go

@@ -607,3 +607,44 @@ func TestWorkspaceDisplaySession_NonDisplayWorkspaceDoesNotProxy(t *testing.T) {
 		t.Errorf("unmet sqlmock expectations: %v", err)
 	}
 }
+
+// TestValidateWorkspaceCompute_Provider pins the multi-provider validation:
+// per-provider instance allowlists, empty-provider back-compat (→ aws), and
+// unknown providers rejected.
+func TestValidateWorkspaceCompute_Provider(t *testing.T) {
+	ok := []models.WorkspaceCompute{
+		{InstanceType: "t3.large"},                       // empty provider → aws
+		{Provider: "aws", InstanceType: "m6i.xlarge"},    // aws shape
+		{Provider: "hetzner", InstanceType: "cpx31"},     // hetzner shape
+		{Provider: "gcp", InstanceType: "e2-standard-2"}, // gcp shape
+		{Provider: "hetzner"},                            // provider only, no shape
+	}
+	for _, c := range ok {
+		if err := validateWorkspaceCompute(c); err != nil {
+			t.Errorf("validateWorkspaceCompute(%+v) = %v, want nil", c, err)
+		}
+	}
+
+	bad := []models.WorkspaceCompute{
+		{Provider: "azure"},                             // unknown provider
+		{Provider: "hetzner", InstanceType: "t3.large"}, // aws shape on hetzner
+		{Provider: "aws", InstanceType: "cpx31"},        // hetzner shape on aws
+	}
+	for _, c := range bad {
+		if err := validateWorkspaceCompute(c); err == nil {
+			t.Errorf("validateWorkspaceCompute(%+v) = nil, want error", c)
+		}
+	}
+}
+
+// TestWorkspaceComputeJSON_IncludesProvider ensures provider round-trips into
+// the persisted compute JSON.
+func TestWorkspaceComputeJSON_IncludesProvider(t *testing.T) {
+	js, err := workspaceComputeJSON(models.WorkspaceCompute{Provider: "hetzner", InstanceType: "cpx31"})
+	if err != nil {
+		t.Fatalf("workspaceComputeJSON: %v", err)
+	}
+	if !strings.Contains(js, `"provider":"hetzner"`) {
+		t.Fatalf("compute JSON missing provider: %s", js)
+	}
+}

workspace-server/internal/models/workspace.go

@@ -165,6 +165,11 @@ type WorkspaceComputeDisplay struct {
 }
 
 type WorkspaceCompute struct {
+	// Provider is the cloud backend this workspace runs on: "aws" | "hetzner" |
+	// "gcp". Empty = the CP's default provider (AWS until the CTO-gated flip;
+	// multi-provider RFC). Determines which instance_type values are valid and
+	// is forwarded to CP, which routes provisioning via its ProviderRegistry.
+	Provider     string                  `json:"provider,omitempty"`
 	InstanceType string                  `json:"instance_type,omitempty"`
 	Volume       WorkspaceComputeVolume  `json:"volume,omitempty"`
 	Display      WorkspaceComputeDisplay `json:"display,omitempty"`