Add workspaces, conversation sessions, app-managed computers and pictures

- Rail: Add icon with stacked form modals (bot, workspace, computer), coordinator, recent bots with "See all bots", Workspaces section, and a workspace mode listing only its crew - Workspaces: page for context, bots (per-workspace instructions and memory), computers (default, link, unlink), models and delete; conversations scoped per bot per workspace - Sessions: conversations split into searchable, reopenable sessions with carry-over summaries; sessions and new-session header icons - Computers: created and provisioned over the docker socket, home dir kept at DATA_DIR/computers/<id> after delete; super admins only - Models: workspace settings win over a bot's own, then the defaults - Pictures for bots and workspaces; bots editable from the header - Coordinator tools: update_workspace, set_bot_workspace_instructions Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-19 08:39:33 +01:00
parent 56daf0c462
commit 0ce61cdb49
223 changed files with 8166 additions and 585 deletions
@@ -0,0 +1,46 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import addBotToWorkspace from "@/src/functions/backend/db/workspaces/add-bot-to-workspace";
+import grabWorkspaceBots from "@/src/functions/backend/db/workspaces/grab-workspace-bots";
+import type { WorkspaceBot } from "@/src/types";
+import { WorkspaceBotRequestSchema } from "@/src/schemas/workspace-schema";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Puts one of the session user's bots in one of their workspaces. Returns
+ * the workspace's crew.
+ */
+export const handler: BunextAPIRouteHandler<APIResponseObject<WorkspaceBot>> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        const { workspace_id, bot_id } = parseWithSchema({ schema: WorkspaceBotRequestSchema, data: body });
+
+        await addBotToWorkspace({ user_id: user.id, workspace_id, bot_id });
+
+        return {
+            success: true,
+            payload: await grabWorkspaceBots({ user_id: user.id, workspace_id }),
+        };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};
@@ -0,0 +1,43 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import addComputerToWorkspace from "@/src/functions/backend/db/workspaces/add-computer-to-workspace";
+import grabWorkspaceComputers from "@/src/functions/backend/db/workspaces/grab-workspace-computers";
+import type { ComputerWithStatus } from "@/src/types";
+import { WorkspaceComputerRequestSchema } from "@/src/schemas/workspace-schema";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Links one of the session user's computers to one of their workspaces
+ * (the first becomes its default). Returns the workspace's computers.
+ */
+export const handler: BunextAPIRouteHandler<APIResponseObject<ComputerWithStatus>> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        const { workspace_id, computer_id } = parseWithSchema({ schema: WorkspaceComputerRequestSchema, data: body });
+
+        await addComputerToWorkspace({ user_id: user.id, workspace_id, computer_id });
+
+        return { success: true, payload: await grabWorkspaceComputers({ workspace_id }) };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};
@@ -0,0 +1,52 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import createWorkspace from "@/src/functions/backend/db/workspaces/create-workspace";
+import logEvent, { grabRequestIP } from "@/src/functions/backend/logger";
+import { CreateWorkspaceRequestSchema } from "@/src/schemas/workspace-schema";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Creates a workspace for the session user. Returns its id.
+ */
+export const handler: BunextAPIRouteHandler<APIResponseObject<{ workspace_id: number }>> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        const { name, description, system_prompt } = parseWithSchema({ schema: CreateWorkspaceRequestSchema, data: body });
+
+        const workspace_id = Number(
+            await createWorkspace({ user_id: user.id, name, description, system_prompt }),
+        );
+
+        await logEvent({
+            title: "Workspace created",
+            category: "system",
+            user_id: user.id,
+            plain_text: `User #${user.id} created the workspace ${name}.`,
+            metadata: { workspace_id },
+            ip_address: grabRequestIP(req),
+        });
+
+        return { success: true, msg: `${name} is ready.`, singleRes: { workspace_id } };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};
@@ -0,0 +1,51 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import deleteWorkspace from "@/src/functions/backend/db/workspaces/delete-workspace";
+import logEvent, { grabRequestIP } from "@/src/functions/backend/logger";
+import { WorkspaceIdRequestSchema } from "@/src/schemas/workspace-schema";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Deletes one of the session user's workspaces with its conversations.
+ * Its bots and computers stay.
+ */
+export const handler: BunextAPIRouteHandler<APIResponseObject> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        const { workspace_id } = parseWithSchema({ schema: WorkspaceIdRequestSchema, data: body });
+
+        const workspace = await deleteWorkspace({ user_id: user.id, workspace_id });
+
+        await logEvent({
+            title: "Workspace deleted",
+            category: "system",
+            user_id: user.id,
+            plain_text: `User #${user.id} deleted the workspace ${workspace.name}.`,
+            metadata: { workspace_id },
+            ip_address: grabRequestIP(req),
+        });
+
+        return { success: true, msg: `${workspace.name || "The workspace"} is deleted.` };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};
@@ -0,0 +1,47 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import removeBotFromWorkspace from "@/src/functions/backend/db/workspaces/remove-bot-from-workspace";
+import grabWorkspaceBots from "@/src/functions/backend/db/workspaces/grab-workspace-bots";
+import type { WorkspaceBot } from "@/src/types";
+import { WorkspaceBotRequestSchema } from "@/src/schemas/workspace-schema";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Takes a bot out of one of the session user's workspaces. Its
+ * conversation there is kept, for if it's put back. Returns the
+ * workspace's crew.
+ */
+export const handler: BunextAPIRouteHandler<APIResponseObject<WorkspaceBot>> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        const { workspace_id, bot_id } = parseWithSchema({ schema: WorkspaceBotRequestSchema, data: body });
+
+        await removeBotFromWorkspace({ user_id: user.id, workspace_id, bot_id });
+
+        return {
+            success: true,
+            payload: await grabWorkspaceBots({ user_id: user.id, workspace_id }),
+        };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};
@@ -0,0 +1,43 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import removeComputerFromWorkspace from "@/src/functions/backend/db/workspaces/remove-computer-from-workspace";
+import grabWorkspaceComputers from "@/src/functions/backend/db/workspaces/grab-workspace-computers";
+import type { ComputerWithStatus } from "@/src/types";
+import { WorkspaceComputerRequestSchema } from "@/src/schemas/workspace-schema";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Unlinks a computer from one of the session user's workspaces; the
+ * computer stays. Returns the workspace's computers.
+ */
+export const handler: BunextAPIRouteHandler<APIResponseObject<ComputerWithStatus>> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        const { workspace_id, computer_id } = parseWithSchema({ schema: WorkspaceComputerRequestSchema, data: body });
+
+        await removeComputerFromWorkspace({ user_id: user.id, workspace_id, computer_id });
+
+        return { success: true, payload: await grabWorkspaceComputers({ workspace_id }) };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};
@@ -0,0 +1,91 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import grabBotHarnessOverview from "@/src/functions/backend/db/harness/grab-bot-harness-overview";
+import grabHarnessSetting from "@/src/functions/backend/db/harness/grab-harness-setting";
+import saveWorkspaceHarnessSetting from "@/src/functions/backend/db/harness/save-workspace-harness-setting";
+import grabUserWorkspace from "@/src/functions/backend/db/workspaces/grab-user-workspace";
+import logEvent, { grabRequestIP } from "@/src/functions/backend/logger";
+import { SaveWorkspaceHarnessSettingsRequestSchema } from "@/src/schemas/harness-schema";
+import type { BotHarnessOverviewPayload } from "@/src/types";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Saves which model each harness uses in one of the session user's
+ * workspaces. A workspace's models win over its bots' own, for the
+ * coordinator too.
+ */
+export const handler: BunextAPIRouteHandler<
+    APIResponseObject<BotHarnessOverviewPayload>
+> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        const { workspace_id, settings } = parseWithSchema({
+            schema: SaveWorkspaceHarnessSettingsRequestSchema,
+            data: body,
+        });
+
+        const workspace = await grabUserWorkspace({ workspace_id, user_id: user.id });
+
+        if (!workspace?.id) {
+            throw new AppError(`Workspace not found.`);
+        }
+
+        for (const setting of settings) {
+            const existing = await grabHarnessSetting({
+                harness: setting.harness,
+                workspace_id: workspace.id,
+            });
+            const { voice, ...options } = existing.source == "workspace" ? existing.options : {};
+
+            await saveWorkspaceHarnessSetting({
+                workspace_id: Number(workspace.id),
+                harness: setting.harness,
+                inherit: setting.inherit,
+                model_id: setting.model_id,
+                provider_id: setting.provider_id,
+                fallback: setting.fallback,
+                enabled: setting.enabled,
+                options: setting.voice ? { ...options, voice: setting.voice } : options,
+            });
+        }
+
+        await logEvent({
+            title: "Workspace model settings changed",
+            category: "system",
+            user_id: user.id,
+            plain_text: `User #${user.id} changed ${workspace.name}'s model settings for ${settings.map((s) => s.harness).join(", ")}.`,
+            metadata: { workspace_id: workspace.id, settings },
+            ip_address: grabRequestIP(req),
+        });
+
+        return {
+            success: true,
+            msg: `Saved.`,
+            singleRes: await grabBotHarnessOverview({ workspace_id: Number(workspace.id) }),
+        };
+    } catch (error: unknown) {
+        return {
+            success: false,
+            msg: safeErrorMessage({ error }),
+        };
+    }
+};
@@ -0,0 +1,50 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import setWorkspaceComputer from "@/src/functions/backend/db/workspaces/set-workspace-computer";
+import type { ComputerWithStatus } from "@/src/types";
+import { WorkspaceComputerRequestSchema } from "@/src/schemas/workspace-schema";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Makes one of a workspace's computers its default. Returns the
+ * workspace's computers, the default first.
+ */
+export const handler: BunextAPIRouteHandler<APIResponseObject<ComputerWithStatus>> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        const { workspace_id, computer_id } = parseWithSchema({ schema: WorkspaceComputerRequestSchema, data: body });
+
+        const { computer, computers } = await setWorkspaceComputer({
+            user_id: user.id,
+            workspace_id,
+            computer_id,
+        });
+
+        return {
+            success: true,
+            msg: `${computer.name || "That computer"} is the default now.`,
+            payload: computers,
+        };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};
@@ -0,0 +1,47 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import updateWorkspaceBot from "@/src/functions/backend/db/workspaces/update-workspace-bot";
+import grabWorkspaceBots from "@/src/functions/backend/db/workspaces/grab-workspace-bots";
+import type { WorkspaceBot } from "@/src/types";
+import { UpdateWorkspaceBotRequestSchema } from "@/src/schemas/workspace-schema";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Saves a bot's instructions and memory for one of the session user's
+ * workspaces. Returns the workspace's crew.
+ */
+export const handler: BunextAPIRouteHandler<APIResponseObject<WorkspaceBot>> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        const { workspace_id, bot_id, system_prompt, memory } = parseWithSchema({ schema: UpdateWorkspaceBotRequestSchema, data: body });
+
+        await updateWorkspaceBot({ user_id: user.id, workspace_id, bot_id, system_prompt, memory });
+
+        return {
+            success: true,
+            msg: `Saved.`,
+            payload: await grabWorkspaceBots({ user_id: user.id, workspace_id }),
+        };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};
@@ -0,0 +1,56 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import updateWorkspace from "@/src/functions/backend/db/workspaces/update-workspace";
+import grabUserWorkspace from "@/src/functions/backend/db/workspaces/grab-user-workspace";
+import type { BUN_SQLITE_COBBLE_WORKSPACES } from "@/db/types/db";
+import { UpdateWorkspaceRequestSchema } from "@/src/schemas/workspace-schema";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Saves one of the session user's workspaces: its name, description and
+ * the context every bot working there gets. Returns the workspace.
+ */
+export const handler: BunextAPIRouteHandler<APIResponseObject<BUN_SQLITE_COBBLE_WORKSPACES>> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        const { workspace_id, name, description, system_prompt, archived } = parseWithSchema({ schema: UpdateWorkspaceRequestSchema, data: body });
+
+        await updateWorkspace({
+            user_id: user.id,
+            workspace_id,
+            data: {
+                name,
+                description,
+                system_prompt,
+                archived: archived === undefined ? undefined : archived ? 1 : 0,
+            },
+        });
+
+        return {
+            success: true,
+            msg: `Saved.`,
+            singleRes: (await grabUserWorkspace({ workspace_id, user_id: user.id })) || undefined,
+        };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};