Add workspaces, conversation sessions, app-managed computers and pictures

- Rail: Add icon with stacked form modals (bot, workspace, computer),
  coordinator, recent bots with "See all bots", Workspaces section, and
  a workspace mode listing only its crew
- Workspaces: page for context, bots (per-workspace instructions and
  memory), computers (default, link, unlink), models and delete;
  conversations scoped per bot per workspace
- Sessions: conversations split into searchable, reopenable sessions
  with carry-over summaries; sessions and new-session header icons
- Computers: created and provisioned over the docker socket, home dir
  kept at DATA_DIR/computers/<id> after delete; super admins only
- Models: workspace settings win over a bot's own, then the defaults
- Pictures for bots and workspaces; bots editable from the header
- Coordinator tools: update_workspace, set_bot_workspace_instructions

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/harness/tools/bot/assign-computer-tool.ts

@@ -1,7 +1,6 @@
 import { z } from "zod";
 import type { BUN_SQLITE_COBBLE_BOTS, BUN_SQLITE_COBBLE_COMPUTERS } from "@/db/types/db";
 import addBotToComputer from "@/src/functions/backend/db/computers/add-bot-to-computer";
-import grabBotComputers from "@/src/functions/backend/db/computers/grab-bot-computers";
 import removeBotFromComputer from "@/src/functions/backend/db/computers/remove-bot-from-computer";
 import computerRef from "@/src/utils/computer-ref";
 import type { HarnessTool } from "../../types";
@@ -30,8 +29,8 @@ type Args = {
 
 /**
  * Lets the coordinator give a crew member access to one of the user's
- * computers (`bot_computers`), or take a direct grant away. Access that
- * comes through a workspace stays, and the result says so.
+ * computers in its own chat (`bot_computers`), or take it away. In a
+ * workspace, bots use the workspace's computers instead.
  */
 export default function assignComputerTool({
     user_id,
@@ -77,13 +76,7 @@ export default function assignComputerTool({
 
             await removeBotFromComputer({ user_id, bot_id: worker.id, computer_id: computer.id });
 
-            const still = (await grabBotComputers({ bot_id: worker.id, user_id })).some(
-                (c) => c.id == computer.id,
-            );
-
-            return still
-                ? `Removed ${worker.name}'s own access to ${ref}, but it still has it through a workspace.`
-                : `${worker.name} can't use ${ref} any more.`;
+            return `${worker.name} can't use ${ref} in its own chat any more. In a workspace it still uses the workspace's computers.`;
         },
     };
 }