Add the harness, envs, per-bot models and chat attachments

- Harness: providers, model catalog synced hourly, automatic free picks,
  cooldowns, tool loop with context trimming, MCP computer tools
- Bots queue runs replies and tasks through the harness; jobs wait
  (attempt refunded) while every model is resting
- Envs: Settings > Environment, scoped general/workspace/computer,
  written to computers and redacted from tool output
- Models: Settings > Models, per-harness provider select defaulting to
  OpenRouter, and a models modal on each bot's chat (the coordinator's
  edits the defaults)
- Chat: thinking row while a reply runs, file attachments (upload,
  paste, drop) that replies read as images, audio and document text
- Fix media uploads failing after a user's first file, and private
  files being served from the public media path

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/functions/backend/db/bots/grab-attachable-media.ts

@@ -0,0 +1,33 @@
+import BunSQLite from "@moduletrace/bun-sqlite";
+import type { BUN_SQLITE_COBBLE_MEDIA } from "@/db/types/db";
+import AppError from "@/src/utils/app-error";
+
+type Params = {
+    user_id: number;
+    media_ids: number[];
+};
+
+/**
+ * The session user's own uploaded files, in the given order. Throws when
+ * any isn't theirs (or no longer exists), so a message can't carry
+ * someone else's file.
+ */
+export default async function grabAttachableMedia({ user_id, media_ids }: Params) {
+    const ids = [...new Set(media_ids)];
+
+    if (!ids.length) return [];
+
+    const rows =
+        (
+            await BunSQLite.sql<BUN_SQLITE_COBBLE_MEDIA>({
+                sql: `SELECT * FROM media WHERE user_id = ? AND id IN (${ids.map(() => "?").join(", ")})`,
+                values: [user_id, ...ids],
+            })
+        ).payload || [];
+
+    if (rows.length != ids.length) {
+        throw new AppError(`One of the files is gone. Attach it again.`);
+    }
+
+    return ids.map((id) => rows.find((row) => row.id == id)!);
+}

src/functions/backend/db/bots/grab-bot-by-id.ts

@@ -0,0 +1,21 @@
+import type { BUN_SQLITE_COBBLE_BOTS } from "@/db/types/db";
+import BunSQLite from "@moduletrace/bun-sqlite";
+
+type Params = {
+    bot_id: number | string;
+};
+
+/**
+ * A bot by id, whoever owns it. Server-side work only (the queue); request
+ * handlers use `grabUserBot` to check ownership.
+ */
+export default async function grabBotById({
+    bot_id,
+}: Params): Promise<BUN_SQLITE_COBBLE_BOTS | null> {
+    const res = await BunSQLite.sql<BUN_SQLITE_COBBLE_BOTS>({
+        sql: `SELECT * FROM bots WHERE id = ? LIMIT 1`,
+        values: [bot_id],
+    });
+
+    return res.payload?.[0] || null;
+}

src/functions/backend/db/bots/grab-bot-messages.ts

@@ -1,5 +1,8 @@
 import type { BUN_SQLITE_COBBLE_BOT_MESSAGES } from "@/db/types/db";
+import type { BotMessageWithAttachments } from "@/src/types";
 import BunSQLite from "@moduletrace/bun-sqlite";
+import grabMessagesMedia from "./grab-messages-media";
+import mediaToAttachment from "./media-to-attachment";
 
 type Params = {
     bot_id: number | string;
@@ -7,12 +10,13 @@ type Params = {
 };
 
 /**
- * The latest messages of a bot's conversation, oldest first.
+ * The latest messages of a bot's conversation, oldest first, with their
+ * attachments.
  */
 export default async function grabBotMessages({
     bot_id,
     limit = 100,
-}: Params): Promise<BUN_SQLITE_COBBLE_BOT_MESSAGES[]> {
+}: Params): Promise<BotMessageWithAttachments[]> {
     let sql = ``;
 
     sql += `SELECT * FROM (\n`;
@@ -27,5 +31,16 @@ export default async function grabBotMessages({
         values: [bot_id, limit],
     });
 
-    return res.payload || [];
+    const messages = res.payload || [];
+    const media = await grabMessagesMedia({
+        message_ids: messages.map((message) => Number(message.id)),
+    });
+
+    return messages.map((message) => {
+        const files = media.get(Number(message.id));
+
+        return files
+            ? { ...message, attachments: files.map((file) => mediaToAttachment({ media: file })) }
+            : message;
+    });
 }

src/functions/backend/db/bots/grab-messages-media.ts

@@ -0,0 +1,38 @@
+import BunSQLite from "@moduletrace/bun-sqlite";
+import type { BUN_SQLITE_COBBLE_MEDIA } from "@/db/types/db";
+
+type Params = {
+    message_ids: number[];
+};
+
+export type MessageMediaRow = BUN_SQLITE_COBBLE_MEDIA & { message_id: number };
+
+/**
+ * The files attached to these messages, by message id, in the order they
+ * were attached.
+ */
+export default async function grabMessagesMedia({ message_ids }: Params) {
+    const by_message = new Map<number, MessageMediaRow[]>();
+    const ids = [...new Set(message_ids.filter(Boolean))];
+
+    if (!ids.length) return by_message;
+
+    const rows =
+        (
+            await BunSQLite.sql<MessageMediaRow>({
+                sql: `SELECT m.*, l.message_id FROM bot_message_media l
+                    JOIN media m ON m.id = l.media_id
+                    WHERE l.message_id IN (${ids.map(() => "?").join(", ")})
+                    ORDER BY l.id ASC`,
+                values: ids,
+            })
+        ).payload || [];
+
+    for (const row of rows) {
+        const list = by_message.get(row.message_id) || [];
+        list.push(row);
+        by_message.set(row.message_id, list);
+    }
+
+    return by_message;
+}

src/functions/backend/db/bots/insert-user-message.ts

@@ -1,22 +1,32 @@
 import type {
     BUN_SQLITE_COBBLE_BOT_MESSAGES,
+    BUN_SQLITE_COBBLE_MEDIA,
     BunSQLiteTables,
 } from "@/db/types/db";
+import type { BotMessageWithAttachments } from "@/src/types";
 import BunSQLite from "@moduletrace/bun-sqlite";
+import mediaToAttachment from "./media-to-attachment";
 
 type Params = {
     bot_id: number;
     text: string;
+    /**
+     * Files to attach, already checked to be the user's own
+     * (`grabAttachableMedia`).
+     */
+    media?: BUN_SQLITE_COBBLE_MEDIA[];
 };
 
 /**
- * Appends a user message to a bot's conversation and bumps its activity.
- * Callers must check the bot belongs to the session user first.
+ * Appends a user message (and its files) to a bot's conversation and
+ * bumps its activity. Callers must check the bot belongs to the session
+ * user first.
  */
 export default async function insertUserMessage({
     bot_id,
     text,
-}: Params): Promise<BUN_SQLITE_COBBLE_BOT_MESSAGES> {
+    media = [],
+}: Params): Promise<BotMessageWithAttachments> {
     const now = Date.now();
 
     const res = await BunSQLite.insert<
@@ -33,6 +43,13 @@ export default async function insertUserMessage({
         throw new Error(`Failed to save message: ${res.msg}`);
     }
 
+    for (const file of media) {
+        await BunSQLite.sql({
+            sql: `INSERT INTO bot_message_media (created_at, updated_at, message_id, media_id) VALUES (?, ?, ?, ?)`,
+            values: [now, now, id, file.id!],
+        });
+    }
+
     await BunSQLite.sql({
         sql: `UPDATE bots SET last_activity_at = ? WHERE id = ?`,
         values: [now, bot_id],
@@ -46,5 +63,6 @@ export default async function insertUserMessage({
         needs_you: 0,
         created_at: now,
         updated_at: now,
+        attachments: media.map((file) => mediaToAttachment({ media: file })),
     };
 }

src/functions/backend/db/bots/media-to-attachment.ts

@@ -0,0 +1,23 @@
+import type { BUN_SQLITE_COBBLE_MEDIA } from "@/db/types/db";
+import grabMediaURL from "@/src/functions/backend/media/grab-media-url";
+import type { BotMessageAttachment, MediaType } from "@/src/types";
+
+type Params = {
+    media: BUN_SQLITE_COBBLE_MEDIA;
+};
+
+/**
+ * A `media` row as a chat attachment: its original name (`title`), type
+ * and the private URLs it's served at.
+ */
+export default function mediaToAttachment({ media }: Params): BotMessageAttachment {
+    const { media_url, media_thumbnail_url } = grabMediaURL({ media: { ...media } });
+
+    return {
+        id: Number(media.id),
+        name: media.title || `File ${media.id}`,
+        media_type: (media.media_type || "document") as MediaType,
+        url: media_url || "",
+        thumbnail_url: media_thumbnail_url,
+    };
+}