Add workspaces, conversation sessions, app-managed computers and pictures

- Rail: Add icon with stacked form modals (bot, workspace, computer),
  coordinator, recent bots with "See all bots", Workspaces section, and
  a workspace mode listing only its crew
- Workspaces: page for context, bots (per-workspace instructions and
  memory), computers (default, link, unlink), models and delete;
  conversations scoped per bot per workspace
- Sessions: conversations split into searchable, reopenable sessions
  with carry-over summaries; sessions and new-session header icons
- Computers: created and provisioned over the docker socket, home dir
  kept at DATA_DIR/computers/<id> after delete; super admins only
- Models: workspace settings win over a bot's own, then the defaults
- Pictures for bots and workspaces; bots editable from the header
- Coordinator tools: update_workspace, set_bot_workspace_instructions

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/pages/api/admin/bots/create-bot.ts

@@ -0,0 +1,61 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import createBot from "@/src/functions/backend/db/bots/create-bot";
+import addBotToWorkspace from "@/src/functions/backend/db/workspaces/add-bot-to-workspace";
+import grabUserWorkspace from "@/src/functions/backend/db/workspaces/grab-user-workspace";
+import logEvent, { grabRequestIP } from "@/src/functions/backend/logger";
+import { CreateBotRequestSchema } from "@/src/schemas/bot-schema";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Adds a worker bot to the session user's crew, and to one of their
+ * workspaces when one is given. Returns the bot's id.
+ */
+export const handler: BunextAPIRouteHandler<APIResponseObject<{ bot_id: number }>> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        const { name, role, hue, system_prompt, workspace_id } = parseWithSchema({ schema: CreateBotRequestSchema, data: body });
+
+        if (workspace_id && !(await grabUserWorkspace({ workspace_id, user_id: user.id }))?.id) {
+            throw new AppError(`Workspace not found.`);
+        }
+
+        const bot_id = await createBot({ user_id: user.id, name, role, hue, system_prompt });
+
+        if (workspace_id) {
+            await addBotToWorkspace({ user_id: user.id, workspace_id, bot_id });
+        }
+
+        await logEvent({
+            title: "Bot added",
+            category: "system",
+            user_id: user.id,
+            plain_text: `User #${user.id} added the bot ${name}.`,
+            metadata: { bot_id, workspace_id },
+            ip_address: grabRequestIP(req),
+        });
+
+        return { success: true, msg: `${name} is on the crew.`, singleRes: { bot_id } };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};

src/pages/api/admin/bots/list-sessions.ts

@@ -0,0 +1,51 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import grabBotSessions from "@/src/functions/backend/db/bot-sessions/grab-bot-sessions";
+import grabUserConversation from "@/src/functions/backend/db/bot-sessions/grab-user-conversation";
+import { ListBotSessionsRequestSchema } from "@/src/schemas/bot-schema";
+import type { BotSessionListItem } from "@/src/types";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * The sessions of one of the session user's conversations, latest first,
+ * searched by title, summary or message text.
+ */
+export const handler: BunextAPIRouteHandler<
+    APIResponseObject<BotSessionListItem>
+> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        const { bot_id, workspace_id, query, page } = parseWithSchema({
+            schema: ListBotSessionsRequestSchema,
+            data: body,
+        });
+
+        const conversation = await grabUserConversation({ user_id: user.id, bot_id, workspace_id });
+
+        return {
+            success: true,
+            payload: await grabBotSessions({
+                bot_id: conversation.bot.id,
+                workspace_id: conversation.workspace_id,
+                query,
+                page,
+            }),
+        };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};

src/pages/api/admin/bots/mark-read.ts

@@ -1,6 +1,6 @@
 import userAuth from "@/src/functions/backend/auth/user-auth";
-import markBotRead from "@/src/functions/backend/db/bots/mark-bot-read";
-import { BotIdRequestSchema } from "@/src/schemas/bot-schema";
+import markBotSessionRead from "@/src/functions/backend/db/bot-sessions/mark-bot-session-read";
+import { BotSessionIdRequestSchema } from "@/src/schemas/bot-schema";
 import AppError from "@/src/utils/app-error";
 import parseWithSchema from "@/src/utils/parse-with-schema";
 import safeErrorMessage from "@/src/utils/safe-error-message";
@@ -10,8 +10,8 @@ import type {
 } from "@moduletrace/bunext/types";
 
 /**
- * Clears a bot's unread flag when a message arrives in the conversation
- * the user has open. Only the session user's own bots.
+ * Clears a session's unread flag when a message arrives in the
+ * conversation the user has open. Only the session user's own bots.
  */
 export const handler: BunextAPIRouteHandler<APIResponseObject> = async ({
     req,
@@ -28,9 +28,9 @@ export const handler: BunextAPIRouteHandler<APIResponseObject> = async ({
             return { success: false, msg: `Unauthorized`, logoutUser: true };
         }
 
-        const { bot_id } = parseWithSchema({ schema: BotIdRequestSchema, data: body });
+        const { session_id } = parseWithSchema({ schema: BotSessionIdRequestSchema, data: body });
 
-        await markBotRead({ bot_id, user_id: user.id });
+        await markBotSessionRead({ session_id, user_id: user.id });
 
         return { success: true };
     } catch (error: unknown) {

src/pages/api/admin/bots/new-session.ts

@@ -0,0 +1,54 @@
+import type { BUN_SQLITE_COBBLE_BOT_SESSIONS } from "@/db/types/db";
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import grabUserConversation from "@/src/functions/backend/db/bot-sessions/grab-user-conversation";
+import startBotSession from "@/src/functions/backend/db/bot-sessions/start-bot-session";
+import { BotConversationRequestSchema } from "@/src/schemas/bot-schema";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Closes the active session of one of the session user's conversations and
+ * starts the next one, which carries on from it.
+ */
+export const handler: BunextAPIRouteHandler<
+    APIResponseObject<BUN_SQLITE_COBBLE_BOT_SESSIONS>
+> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        const { bot_id, workspace_id } = parseWithSchema({
+            schema: BotConversationRequestSchema,
+            data: body,
+        });
+
+        const conversation = await grabUserConversation({ user_id: user.id, bot_id, workspace_id });
+
+        return {
+            success: true,
+            singleRes: await startBotSession({
+                bot_id: conversation.bot.id,
+                workspace_id: conversation.workspace_id,
+            }),
+        };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};

src/pages/api/admin/bots/reopen-session.ts

@@ -0,0 +1,48 @@
+import type { BUN_SQLITE_COBBLE_BOT_SESSIONS } from "@/db/types/db";
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import reopenBotSession from "@/src/functions/backend/db/bot-sessions/reopen-bot-session";
+import { BotSessionIdRequestSchema } from "@/src/schemas/bot-schema";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Makes a closed session of one of the session user's conversations the
+ * active one again, so the bot carries on from where it left off.
+ */
+export const handler: BunextAPIRouteHandler<
+    APIResponseObject<BUN_SQLITE_COBBLE_BOT_SESSIONS>
+> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        const { session_id } = parseWithSchema({
+            schema: BotSessionIdRequestSchema,
+            data: body,
+        });
+
+        return {
+            success: true,
+            singleRes: await reopenBotSession({ session_id, user_id: user.id }),
+        };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};

src/pages/api/admin/bots/send-message.ts

@@ -1,5 +1,6 @@
 import userAuth from "@/src/functions/backend/auth/user-auth";
-import grabUserBot from "@/src/functions/backend/db/bots/grab-user-bot";
+import grabUserConversation from "@/src/functions/backend/db/bot-sessions/grab-user-conversation";
+import ensureBotSession from "@/src/functions/backend/db/bot-sessions/ensure-bot-session";
 import insertUserMessage from "@/src/functions/backend/db/bots/insert-user-message";
 import grabAttachableMedia from "@/src/functions/backend/db/bots/grab-attachable-media";
 import enqueueBotReply from "@/src/functions/backend/db/bots-queue/enqueue-bot-reply";
@@ -16,10 +17,12 @@ import type {
 } from "@moduletrace/bunext/types";
 
 /**
- * Posts a message from the session user to one of their own bots and
- * queues the bot's reply, which arrives over the WebSocket. The message
- * also goes to the user's other open tabs. Files are uploaded first
- * (`upload-attachment`) and sent as `media_ids`.
+ * Posts a message from the session user to one of their own bots, in its
+ * own chat or in a workspace it's in, and queues the bot's reply, which
+ * arrives over the WebSocket. The message goes in the conversation's
+ * active session (the next one when it's full) and also to the user's
+ * other open tabs. Files are uploaded first (`upload-attachment`) and
+ * sent as `media_ids`.
  */
 export const handler: BunextAPIRouteHandler<APIResponseObject> = async ({
     req,
@@ -44,23 +47,33 @@ export const handler: BunextAPIRouteHandler<APIResponseObject> = async ({
             throw new AppError(`This user can only read records.`);
         }
 
-        const { bot_id, text, media_ids } = parseWithSchema({
+        const { bot_id, workspace_id, text, media_ids } = parseWithSchema({
             schema: SendBotMessageRequestSchema,
             data: body,
         });
 
-        const bot = await grabUserBot({ bot_id, user_id: user.id });
-
-        if (!bot?.id) {
-            throw new AppError(`Bot not found`);
-        }
+        const conversation = await grabUserConversation({ user_id: user.id, bot_id, workspace_id });
+        const bot = conversation.bot;
 
         const media = await grabAttachableMedia({ user_id: Number(user.id), media_ids });
-        const message = await insertUserMessage({ bot_id: bot.id, text, media });
+        const session = await ensureBotSession({
+            bot_id: bot.id,
+            workspace_id: conversation.workspace_id,
+            rollover: true,
+        });
+
+        const message = await insertUserMessage({
+            bot_id: bot.id,
+            session_id: Number(session.id),
+            workspace_id: conversation.workspace_id,
+            text,
+            media,
+        });
 
         await enqueueBotReply({
             user_id: user.id,
             bot_id: bot.id,
+            session_id: Number(session.id),
             message_id: message.id || 0,
         });
 

src/pages/api/admin/bots/set-computer.ts

@@ -2,6 +2,8 @@ import type { BUN_SQLITE_COBBLE_COMPUTERS } from "@/db/types/db";
 import userAuth from "@/src/functions/backend/auth/user-auth";
 import pushBotNotice from "@/src/bots-queue/push-bot-notice";
 import setBotComputer from "@/src/functions/backend/db/computers/set-bot-computer";
+import grabUserConversation from "@/src/functions/backend/db/bot-sessions/grab-user-conversation";
+import setWorkspaceComputer from "@/src/functions/backend/db/workspaces/set-workspace-computer";
 import logEvent, { grabRequestIP } from "@/src/functions/backend/logger";
 import { SetBotComputerRequestSchema } from "@/src/schemas/bot-schema";
 import AppError from "@/src/utils/app-error";
@@ -14,9 +16,9 @@ import type {
 } from "@moduletrace/bunext/types";
 
 /**
- * Switches the computer one of the session user's bots works on, and
- * tells the user's other tabs. Returns the bot's computers, the new one
- * first.
+ * Switches the computer one of the session user's bots works on (in a
+ * workspace, the workspace's default computer), and tells the user's
+ * other tabs. Returns the bot's computers there, the new one first.
  */
 export const handler: BunextAPIRouteHandler<
     APIResponseObject<BUN_SQLITE_COBBLE_COMPUTERS>
@@ -36,16 +38,21 @@ export const handler: BunextAPIRouteHandler<
             throw new AppError(`This user can only read records.`);
         }
 
-        const { bot_id, computer_id } = parseWithSchema({
+        const { bot_id, computer_id, workspace_id } = parseWithSchema({
             schema: SetBotComputerRequestSchema,
             data: body,
         });
 
-        const { bot, computer, computers } = await setBotComputer({
-            bot_id,
-            computer_id,
-            user_id: user.id,
-        });
+        const { bot, computer, computers } = workspace_id
+            ? {
+                  bot: (await grabUserConversation({ user_id: user.id, bot_id, workspace_id })).bot,
+                  ...(await setWorkspaceComputer({ user_id: user.id, workspace_id, computer_id })),
+              }
+            : await setBotComputer({
+                  bot_id,
+                  computer_id,
+                  user_id: user.id,
+              });
 
         await pushBotNotice({
             bot_id: bot.id || 0,
@@ -61,14 +68,18 @@ export const handler: BunextAPIRouteHandler<
             title: "Bot computer switched",
             category: "system",
             user_id: user.id,
-            plain_text: `User #${user.id} switched ${bot.name} to ${computer.name || `computer #${computer.id}`}.`,
-            metadata: { bot_id: bot.id, computer_id: computer.id },
+            plain_text: workspace_id
+                ? `User #${user.id} made ${computer.name || `computer #${computer.id}`} the default of workspace #${workspace_id}.`
+                : `User #${user.id} switched ${bot.name} to ${computer.name || `computer #${computer.id}`}.`,
+            metadata: { bot_id: bot.id, computer_id: computer.id, workspace_id },
             ip_address: grabRequestIP(req),
         });
 
         return {
             success: true,
-            msg: `${bot.name} is on ${computer.name || "that computer"} now.`,
+            msg: workspace_id
+                ? `${computer.name || "That computer"} is the workspace's default computer now.`
+                : `${bot.name} is on ${computer.name || "that computer"} now.`,
             payload: computers,
         };
     } catch (error: unknown) {

src/pages/api/admin/bots/update-bot.ts

@@ -0,0 +1,55 @@
+import type { BUN_SQLITE_COBBLE_BOTS } from "@/db/types/db";
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import updateBot from "@/src/functions/backend/db/bots/update-bot";
+import logEvent, { grabRequestIP } from "@/src/functions/backend/logger";
+import { UpdateBotRequestSchema } from "@/src/schemas/bot-schema";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Saves one of the session user's bots (name, job, hue, instructions).
+ * Returns the bot.
+ */
+export const handler: BunextAPIRouteHandler<APIResponseObject<BUN_SQLITE_COBBLE_BOTS>> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        const { bot_id, name, role, hue, system_prompt } = parseWithSchema({
+            schema: UpdateBotRequestSchema,
+            data: body,
+        });
+
+        const bot = await updateBot({ user_id: user.id, bot_id, name, role, hue, system_prompt });
+
+        await logEvent({
+            title: "Bot changed",
+            category: "system",
+            user_id: user.id,
+            plain_text: `User #${user.id} changed the bot ${bot.name}.`,
+            metadata: { bot_id },
+            ip_address: grabRequestIP(req),
+        });
+
+        return { success: true, msg: `Saved.`, singleRes: bot };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};