Add workspaces, conversation sessions, app-managed computers and pictures

- Rail: Add icon with stacked form modals (bot, workspace, computer),
  coordinator, recent bots with "See all bots", Workspaces section, and
  a workspace mode listing only its crew
- Workspaces: page for context, bots (per-workspace instructions and
  memory), computers (default, link, unlink), models and delete;
  conversations scoped per bot per workspace
- Sessions: conversations split into searchable, reopenable sessions
  with carry-over summaries; sessions and new-session header icons
- Computers: created and provisioned over the docker socket, home dir
  kept at DATA_DIR/computers/<id> after delete; super admins only
- Models: workspace settings win over a bot's own, then the defaults
- Pictures for bots and workspaces; bots editable from the header
- Coordinator tools: update_workspace, set_bot_workspace_instructions

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/functions/backend/db/computers/create-computer.ts

@@ -0,0 +1,96 @@
+import BunSQLite from "@moduletrace/bun-sqlite";
+import type {
+    BUN_SQLITE_COBBLE_COMPUTERS,
+    BUN_SQLITE_COBBLE_CONTAINERS,
+    BunSQLiteTables,
+} from "@/db/types/db";
+import { AppData } from "@/src/data/app-data";
+import type { ComputerKind } from "@/src/dict/computer-dict";
+import grabEnv from "../envs/grab-env";
+import provisionComputer from "./provision-computer";
+
+type Params = {
+    user_id: number | string;
+    name: string;
+    description?: string;
+    /**
+     * `main` only for the owner's one main computer (`ensureMainComputer`).
+     */
+    kind?: ComputerKind;
+};
+
+/**
+ * Records a new computer for the user and its container
+ * (`<AppData.ComputerContainerPrefix>-<id>`), then sets the container up
+ * in the background (`provisionComputer`). Returns the computer at once,
+ * still `creating`, and the setup to await when the caller must (a CLI
+ * script). The main computer of a server that reaches it at
+ * `MAIN_COMPUTER_URL` (a dev server) gets no container of its own.
+ */
+export default async function createComputer({
+    user_id,
+    name,
+    description,
+    kind = "sandbox",
+}: Params) {
+    const external = kind == "main" && Boolean((await grabEnv({ key: "MAIN_COMPUTER_URL" }))?.trim());
+
+    const container_res = await BunSQLite.insert<
+        BUN_SQLITE_COBBLE_CONTAINERS,
+        (typeof BunSQLiteTables)[number]
+    >({
+        table: "containers",
+        data: [
+            {
+                name: `${AppData.ComputerContainerPrefix}-pending-${Date.now()}`,
+                purpose: "computer",
+                network: AppData.DockerNetworkName,
+                port: AppData.ComputerPort,
+                image: AppData.ComputerImage,
+                status: external ? "unknown" : "creating",
+            },
+        ],
+    });
+
+    const container_id = container_res.singleRes?.id || container_res.postInsertReturn?.insertId;
+
+    if (!container_res.success || !container_id) {
+        throw new Error(`Couldn't record the computer's container: ${container_res.msg}`);
+    }
+
+    const computer_res = await BunSQLite.insert<
+        BUN_SQLITE_COBBLE_COMPUTERS,
+        (typeof BunSQLiteTables)[number]
+    >({
+        table: "computers",
+        data: [
+            {
+                user_id: Number(user_id),
+                container_id: Number(container_id),
+                name,
+                description: description || undefined,
+                kind,
+            },
+        ],
+    });
+
+    const computer_id = computer_res.singleRes?.id || computer_res.postInsertReturn?.insertId;
+
+    if (!computer_res.success || !computer_id) {
+        await BunSQLite.sql({ sql: `DELETE FROM containers WHERE id = ?`, values: [container_id] });
+        throw new Error(`Couldn't create the computer: ${computer_res.msg}`);
+    }
+
+    const container_name = `${AppData.ComputerContainerPrefix}-${computer_id}`;
+
+    await BunSQLite.sql({
+        sql: `UPDATE containers SET name = ?, hostname = ? WHERE id = ?`,
+        values: [container_name, container_name, container_id],
+    });
+
+    const provisioning = external
+        ? Promise.resolve()
+        : provisionComputer({ computer_id: Number(computer_id), fresh: true });
+
+    return { computer_id: Number(computer_id), provisioning };
+}

src/functions/backend/db/computers/delete-computer.ts

@@ -0,0 +1,57 @@
+import BunSQLite from "@moduletrace/bun-sqlite";
+import type { BUN_SQLITE_COBBLE_CONTAINERS } from "@/db/types/db";
+import removeDockerContainer from "@/src/functions/backend/docker/remove-docker-container";
+import AppError from "@/src/utils/app-error";
+import grabUserComputer from "./grab-user-computer";
+
+type Params = {
+    user_id: number | string;
+    computer_id: number | string;
+};
+
+/**
+ * Deletes one of the user's computers: removes its container and its
+ * records (its access grants and workspace links go with them). Its home
+ * directory is kept, so what it left stays on disk. Workspaces it was the
+ * default of fall back to their oldest computer still linked. The main
+ * computer can't be deleted.
+ */
+export default async function deleteComputer({ user_id, computer_id }: Params) {
+    const computer = await grabUserComputer({ computer_id, user_id });
+
+    if (!computer?.id) {
+        throw new AppError(`Computer not found.`);
+    }
+
+    if (computer.kind == "main") {
+        throw new AppError(`The main computer can't be deleted.`);
+    }
+
+    const container = computer.container_id
+        ? (
+              await BunSQLite.sql<BUN_SQLITE_COBBLE_CONTAINERS>({
+                  sql: `SELECT * FROM containers WHERE id = ? LIMIT 1`,
+                  values: [computer.container_id],
+              })
+          ).payload?.[0]
+        : null;
+
+    if (container?.docker_id || container?.name) {
+        await removeDockerContainer({ container: container.docker_id || container.name! });
+    }
+
+    await BunSQLite.sql({ sql: `DELETE FROM computers WHERE id = ?`, values: [computer.id] });
+
+    if (container?.id) {
+        await BunSQLite.sql({ sql: `DELETE FROM containers WHERE id = ?`, values: [container.id] });
+    }
+
+    await BunSQLite.sql({
+        sql: `UPDATE workspaces SET updated_at = ?, computer_id = (
+            SELECT wc.computer_id FROM workspace_computers wc WHERE wc.workspace_id = workspaces.id ORDER BY wc.id ASC LIMIT 1
+        ) WHERE computer_id = ?`,
+        values: [Date.now(), computer.id],
+    });
+
+    return computer;
+}

src/functions/backend/db/computers/ensure-main-computer-container.ts

@@ -1,60 +0,0 @@
-import BunSQLite from "@moduletrace/bun-sqlite";
-import type {
-    BUN_SQLITE_COBBLE_CONTAINERS,
-    BunSQLiteTables,
-} from "@/db/types/db";
-import { AppData } from "@/src/data/app-data";
-
-/**
- * Returns the id of the main computer's container record, creating it if
- * missing. The container itself is created at install, named
- * `AppData.MainComputerContainerName` on the `AppData.DockerNetworkName`
- * network; this only records it. Safe to call on every visit.
- */
-export default async function ensureMainComputerContainer() {
-    const name = AppData.MainComputerContainerName;
-
-    const existing = (
-        await BunSQLite.select<
-            BUN_SQLITE_COBBLE_CONTAINERS,
-            (typeof BunSQLiteTables)[number]
-        >({
-            table: "containers",
-            query: {
-                query: {
-                    name: { value: name },
-                },
-                limit: 1,
-            },
-        })
-    ).payload?.[0];
-
-    if (existing?.id) {
-        return existing.id;
-    }
-
-    const res = await BunSQLite.insert<
-        BUN_SQLITE_COBBLE_CONTAINERS,
-        (typeof BunSQLiteTables)[number]
-    >({
-        table: "containers",
-        data: [
-            {
-                name,
-                purpose: "computer",
-                network: AppData.DockerNetworkName,
-                hostname: name,
-                port: AppData.ComputerPort,
-                status: "unknown",
-            },
-        ],
-    });
-
-    const container_id = res.singleRes?.id || res.postInsertReturn?.insertId;
-
-    if (!res.success || !container_id) {
-        throw new Error(`Couldn't record the main computer's container: ${res.msg}`);
-    }
-
-    return container_id;
-}

src/functions/backend/db/computers/ensure-main-computer.ts

@@ -1,10 +1,13 @@
 import BunSQLite from "@moduletrace/bun-sqlite";
 import type {
     BUN_SQLITE_COBBLE_COMPUTERS,
+    BUN_SQLITE_COBBLE_CONTAINERS,
     BunSQLiteTables,
 } from "@/db/types/db";
 import { MainComputerName } from "@/src/dict/computer-dict";
-import ensureMainComputerContainer from "./ensure-main-computer-container";
+import grabEnv from "../envs/grab-env";
+import createComputer from "./create-computer";
+import provisionComputer from "./provision-computer";
 
 type Params = {
     user_id: number | string;
@@ -13,30 +16,26 @@ type Params = {
      * access to the main computer.
      */
     coordinator_id: number | string;
+    /**
+     * Wait for a container being set up (a CLI script, which would
+     * otherwise exit first).
+     */
+    wait?: boolean;
 };
 
 /**
- * Returns the id of the user's main computer, recording it (and its
- * container) first if missing, and makes sure the coordinator has access
- * to it. Safe to call on every visit.
+ * Returns the id of the user's main computer, creating it first if
+ * missing (`createComputer`, which sets its container up in the
+ * background), and makes sure the coordinator has access to it. A main
+ * computer recorded before the app managed containers (no docker id, no
+ * `MAIN_COMPUTER_URL`) gets its container set up now. Safe to call on
+ * every visit.
  */
 export default async function ensureMainComputer({
     user_id,
     coordinator_id,
+    wait,
 }: Params) {
-    const computer_id = await grabOrCreateMainComputer({ user_id });
-
-    await BunSQLite.sql({
-        sql: `INSERT OR IGNORE INTO bot_computers (bot_id, computer_id, created_at, updated_at) VALUES (?, ?, ?, ?)`,
-        values: [coordinator_id, computer_id, Date.now(), Date.now()],
-    });
-
-    return computer_id;
-}
-
-async function grabOrCreateMainComputer({
-    user_id,
-}: Pick<Params, "user_id">) {
     const existing = (
         await BunSQLite.select<
             BUN_SQLITE_COBBLE_COMPUTERS,
@@ -54,32 +53,39 @@ async function grabOrCreateMainComputer({
         })
     ).payload?.[0];
 
-    if (existing?.id) {
-        return existing.id;
+    let computer_id = existing?.id ? Number(existing.id) : 0;
+    let provisioning: Promise<void> = Promise.resolve();
+
+    if (!computer_id) {
+        const created = await createComputer({ user_id, name: MainComputerName, kind: "main" });
+
+        computer_id = created.computer_id;
+        provisioning = created.provisioning;
+    } else if (await needsContainer({ container_id: existing?.container_id })) {
+        provisioning = provisionComputer({ computer_id });
     }
 
-    const container_id = await ensureMainComputerContainer();
-
-    const res = await BunSQLite.insert<
-        BUN_SQLITE_COBBLE_COMPUTERS,
-        (typeof BunSQLiteTables)[number]
-    >({
-        table: "computers",
-        data: [
-            {
-                user_id: Number(user_id),
-                container_id: Number(container_id),
-                name: MainComputerName,
-                kind: "main",
-            },
-        ],
+    await BunSQLite.sql({
+        sql: `INSERT OR IGNORE INTO bot_computers (bot_id, computer_id, created_at, updated_at) VALUES (?, ?, ?, ?)`,
+        values: [coordinator_id, computer_id, Date.now(), Date.now()],
     });
 
-    const computer_id = res.singleRes?.id || res.postInsertReturn?.insertId;
-
-    if (!res.success || !computer_id) {
-        throw new Error(`Couldn't create the main computer: ${res.msg}`);
-    }
+    if (wait) await provisioning;
 
     return computer_id;
 }
+
+async function needsContainer({ container_id }: { container_id?: number | "" }) {
+    if ((await grabEnv({ key: "MAIN_COMPUTER_URL" }))?.trim()) return false;
+
+    const container = container_id
+        ? (
+              await BunSQLite.sql<BUN_SQLITE_COBBLE_CONTAINERS>({
+                  sql: `SELECT docker_id, status FROM containers WHERE id = ? LIMIT 1`,
+                  values: [container_id],
+              })
+          ).payload?.[0]
+        : null;
+
+    return Boolean(container && !container.docker_id && container.status == "unknown");
+}

src/functions/backend/db/computers/grab-bot-computers.ts

@@ -4,36 +4,53 @@ import BunSQLite from "@moduletrace/bun-sqlite";
 type Params = {
     bot_id: number | string;
     user_id: number | string;
+    /**
+     * The workspace the bot is working in: then its computers are the
+     * workspace's, the default first, and nothing else.
+     */
+    workspace_id?: number | string | null;
 };
 
 /**
- * Every computer a bot can use: the ones it was given directly
- * (`bot_computers`) plus the ones assigned to any workspace it's in
- * (`workspace_computers`); the coordinator can use all of them. Only the
- * owner's computers, each once. The
- * one it works on now (`bots.computer_id`) comes first, else its main one,
- * so `computers[0]` is where its tasks run by default.
+ * Every computer a bot can use where it's working. In a workspace, the
+ * workspace's computers (none linked: none at all), its default first. In
+ * its own chat, the ones it was given directly (`bot_computers`); the
+ * coordinator can use all of the owner's. There the one it works on now
+ * (`bots.computer_id`) comes first, else its main one, so `computers[0]`
+ * is where its tasks run by default.
  */
 export default async function grabBotComputers({
     bot_id,
     user_id,
+    workspace_id,
 }: Params): Promise<BUN_SQLITE_COBBLE_COMPUTERS[]> {
+    if (workspace_id) {
+        const res = await BunSQLite.sql<BUN_SQLITE_COBBLE_COMPUTERS>({
+            sql: `SELECT c.* FROM computers c
+                JOIN workspace_computers wc ON wc.computer_id = c.id AND wc.workspace_id = ?
+                JOIN workspaces w ON w.id = wc.workspace_id AND w.user_id = c.user_id AND w.archived = 0
+                WHERE c.user_id = ?
+                AND (
+                    (SELECT kind FROM bots WHERE id = ? AND user_id = c.user_id) = 'coordinator'
+                    OR ? IN (SELECT bot_id FROM workspace_bots WHERE workspace_id = w.id)
+                )
+                ORDER BY c.id = w.computer_id DESC, wc.id ASC`,
+            values: [workspace_id, user_id, bot_id, Number(bot_id)],
+        });
+
+        return res.payload || [];
+    }
+
     const res = await BunSQLite.sql<BUN_SQLITE_COBBLE_COMPUTERS>({
         sql: `SELECT c.* FROM computers c
             WHERE c.user_id = ?
             AND (
                 (SELECT kind FROM bots WHERE id = ? AND user_id = c.user_id) = 'coordinator'
                 OR c.id IN (SELECT computer_id FROM bot_computers WHERE bot_id = ?)
-                OR c.id IN (
-                    SELECT wc.computer_id FROM workspace_computers wc
-                    JOIN workspace_bots wb ON wb.workspace_id = wc.workspace_id
-                    JOIN workspaces w ON w.id = wc.workspace_id
-                    WHERE wb.bot_id = ? AND w.archived = 0
-                )
             )
             ORDER BY c.id = (SELECT computer_id FROM bots WHERE id = ?) DESC,
                 c.kind = 'main' DESC, c.id ASC`,
-        values: [user_id, bot_id, bot_id, bot_id, bot_id],
+        values: [user_id, bot_id, bot_id, bot_id],
     });
 
     return res.payload || [];

src/functions/backend/db/computers/grab-computer-data-dir.ts

@@ -0,0 +1,17 @@
+import path from "path";
+import { AppData } from "@/src/data/app-data";
+import grabDirNames from "@/src/utils/grab-dir-names";
+
+type Params = {
+    computer_id: number | string;
+};
+
+/**
+ * Where a computer's home directory is kept, as this app sees it:
+ * `DATA_DIR/<AppData.ComputerDataDir>/<id>`.
+ */
+export default function grabComputerDataDir({ computer_id }: Params) {
+    const { DATA_DIR } = grabDirNames();
+
+    return path.join(DATA_DIR, AppData.ComputerDataDir, String(computer_id));
+}

src/functions/backend/db/computers/grab-user-computers.ts

@@ -0,0 +1,44 @@
+import BunSQLite from "@moduletrace/bun-sqlite";
+import parseJobJson from "@/src/bots-queue/parse-job-json";
+import type { ComputerWithStatus } from "@/src/types";
+
+type Params = {
+    /**
+     * Every computer of this owner, main first.
+     */
+    user_id?: number | string;
+    /**
+     * Or just this one.
+     */
+    computer_id?: number | string;
+};
+
+/**
+ * Computers with their container's state, and why setting one up failed.
+ */
+export default async function grabUserComputers({
+    user_id,
+    computer_id,
+}: Params): Promise<ComputerWithStatus[]> {
+    if (!user_id && !computer_id) return [];
+
+    const rows =
+        (
+            await BunSQLite.sql<ComputerWithStatus & { metadata?: string | null }>({
+                sql: `SELECT c.*, co.status AS status, co.metadata AS metadata FROM computers c
+                    LEFT JOIN containers co ON co.id = c.container_id
+                    WHERE ${computer_id ? `c.id = ?` : `c.user_id = ?`}
+                    ORDER BY c.kind = 'main' DESC, c.id ASC`,
+                values: [computer_id || user_id!],
+            })
+        ).payload || [];
+
+    return rows.map(({ metadata, ...computer }) => {
+        const error = parseJobJson({ text: metadata })?.error;
+
+        return {
+            ...computer,
+            error: computer.status == "failed" && typeof error == "string" ? error : null,
+        };
+    });
+}

src/functions/backend/db/computers/prepare-computer-data-dir.ts

@@ -0,0 +1,40 @@
+import fs from "fs/promises";
+import { AppData } from "@/src/data/app-data";
+import grabComputerDataDir from "./grab-computer-data-dir";
+
+type Params = {
+    computer_id: number | string;
+    /**
+     * A new computer: files already at its path (left by a deleted
+     * computer with the same id, e.g. after a restore) are moved aside to
+     * `<id>-<timestamp>` and kept, so it starts empty.
+     */
+    fresh?: boolean;
+};
+
+/**
+ * Creates a computer's home directory, owned by the sandbox's user so it
+ * can write there, and returns its path. Docker would otherwise create a
+ * missing mount source owned by root.
+ */
+export default async function prepareComputerDataDir({ computer_id, fresh }: Params) {
+    const dir = grabComputerDataDir({ computer_id });
+
+    if (fresh) {
+        const existing = await fs.readdir(dir).catch(() => null);
+
+        if (existing?.length) {
+            await fs.rename(dir, `${dir}-${Date.now()}`);
+        }
+    }
+
+    await fs.mkdir(dir, { recursive: true });
+
+    /**
+     * Only root can hand a directory to another user; a dev server
+     * running as that user already owns it.
+     */
+    await fs.chown(dir, AppData.ComputerUserUid, AppData.ComputerUserGid).catch(() => {});
+
+    return dir;
+}

src/functions/backend/db/computers/provision-computer.ts

@@ -0,0 +1,81 @@
+import BunSQLite from "@moduletrace/bun-sqlite";
+import type { BUN_SQLITE_COBBLE_CONTAINERS } from "@/db/types/db";
+import parseJobJson from "@/src/bots-queue/parse-job-json";
+import { AppData } from "@/src/data/app-data";
+import createComputerContainer from "@/src/functions/backend/docker/create-computer-container";
+import { logError } from "@/src/functions/backend/logger";
+import prepareComputerDataDir from "./prepare-computer-data-dir";
+import pushComputerUpdate from "./push-computer-update";
+
+type Params = {
+    computer_id: number;
+    /**
+     * A brand new computer: start from an empty home directory.
+     */
+    fresh?: boolean;
+};
+
+/**
+ * Sets up a computer's container: prepares its home directory, pulls the
+ * sandbox image and starts the container, then records it (`containers`:
+ * docker id, state, and where to reach it outside docker). A failure is
+ * recorded as `failed` with its reason, which the computer lists show. The
+ * owner's tabs hear about it either way. Never throws.
+ */
+export default async function provisionComputer({ computer_id, fresh }: Params) {
+    const row = (
+        await BunSQLite.sql<BUN_SQLITE_COBBLE_CONTAINERS>({
+            sql: `SELECT co.* FROM containers co JOIN computers c ON c.container_id = co.id WHERE c.id = ? LIMIT 1`,
+            values: [computer_id],
+        })
+    ).payload?.[0];
+
+    if (!row?.id || !row.name) return;
+
+    const metadata = parseJobJson({ text: row.metadata }) || {};
+
+    try {
+        await BunSQLite.sql({
+            sql: `UPDATE containers SET status = 'creating', updated_at = ? WHERE id = ?`,
+            values: [Date.now(), row.id],
+        });
+
+        const data_dir = await prepareComputerDataDir({ computer_id, fresh });
+        const created = await createComputerContainer({ computer_id, name: row.name, data_dir });
+
+        const { error: _error, mcp_url: _mcp_url, ...kept } = metadata;
+
+        await BunSQLite.sql({
+            sql: `UPDATE containers SET docker_id = ?, image = ?, network = ?, hostname = ?, port = ?,
+                status = ?, metadata = ?, last_seen_at = ?, updated_at = ? WHERE id = ?`,
+            values: [
+                created.docker_id,
+                AppData.ComputerImage,
+                created.network,
+                row.name,
+                AppData.ComputerPort,
+                created.status,
+                JSON.stringify({
+                    ...kept,
+                    data_dir,
+                    host_dir: created.host_dir,
+                    ...(created.mcp_url ? { mcp_url: created.mcp_url } : {}),
+                }),
+                Date.now(),
+                Date.now(),
+                row.id,
+            ],
+        });
+    } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+
+        await BunSQLite.sql({
+            sql: `UPDATE containers SET status = 'failed', metadata = ?, updated_at = ? WHERE id = ?`,
+            values: [JSON.stringify({ ...metadata, error: message }), Date.now(), row.id],
+        }).catch(() => {});
+
+        await logError({ title: `Computer #${computer_id} couldn't be set up`, error }).catch(() => {});
+    }
+
+    await pushComputerUpdate({ computer_id }).catch(() => {});
+}

src/functions/backend/db/computers/push-computer-update.ts

@@ -0,0 +1,21 @@
+import { sendToUser } from "@/src/websocket/(functions)/send-to-user";
+import grabUserComputers from "./grab-user-computers";
+
+type Params = {
+    computer_id: number | string;
+};
+
+/**
+ * Pushes a computer's current state (`server:computer-updated`) to its
+ * owner's open tabs. Best effort.
+ */
+export default async function pushComputerUpdate({ computer_id }: Params) {
+    const computer = (await grabUserComputers({ computer_id }))[0];
+
+    if (!computer?.user_id) return;
+
+    sendToUser({
+        user_id: computer.user_id,
+        data: { event: "server:computer-updated", data: computer },
+    });
+}

src/functions/backend/db/computers/set-bot-computer.ts

@@ -10,8 +10,10 @@ type Params = {
 };
 
 /**
- * Switches the computer a bot works on (`bots.computer_id`) to one of its
- * own (`grabBotComputers`). Returns its computers, the new one first.
+ * Switches the computer a bot works on in its own chat
+ * (`bots.computer_id`) to one of its own (`grabBotComputers`). In a
+ * workspace the default computer is switched instead
+ * (`setWorkspaceComputer`). Returns its computers, the new one first.
  */
 export default async function setBotComputer({ bot_id, user_id, computer_id }: Params) {
     const bot = await grabUserBot({ bot_id, user_id });