Add the harness, envs, per-bot models and chat attachments

- Harness: providers, model catalog synced hourly, automatic free picks,
  cooldowns, tool loop with context trimming, MCP computer tools
- Bots queue runs replies and tasks through the harness; jobs wait
  (attempt refunded) while every model is resting
- Envs: Settings > Environment, scoped general/workspace/computer,
  written to computers and redacted from tool output
- Models: Settings > Models, per-harness provider select defaulting to
  OpenRouter, and a models modal on each bot's chat (the coordinator's
  edits the defaults)
- Chat: thinking row while a reply runs, file attachments (upload,
  paste, drop) that replies read as images, audio and document text
- Fix media uploads failing after a user's first file, and private
  files being served from the public media path

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/layouts/bots/(partials)/rail-settings-list.tsx

@@ -1,5 +1,8 @@
+import { useContext } from "react";
 import Divider from "@moduletrace/twui/layout/Divider";
 import { SettingsPages } from "@/src/dict/settings-pages-dict";
+import { AppContext } from "@/src/pages/__root";
+import isPassThroughUser from "@/src/utils/rbac/is-pass-through-user";
 import RailBackLink from "./rail-back-link";
 import RailSettingsLink from "./rail-settings-link";
 
@@ -8,16 +11,23 @@ type Props = {
 };
 
 /**
- * Settings mode of the rail: back to the bots, then the settings sub pages.
+ * Settings mode of the rail: back to the bots, then the settings sub pages
+ * (super admin pages only for super admins).
  */
 export default function RailSettingsList({ pathname }: Props) {
+    const { pageProps } = useContext(AppContext);
     const current = pathname?.replace(/\/$/, "");
+    const is_super_admin = isPassThroughUser({
+        user_types: pageProps?.user_types,
+    });
 
     return (
         <>
             <RailBackLink />
             <Divider className="shrink-0 mx-1 lg:mx-3 my-2 w-auto border-hairline dark:border-hairline" />
-            {SettingsPages.map((page) => (
+            {SettingsPages.filter(
+                (page) => is_super_admin || !page.super_admin_only,
+            ).map((page) => (
                 <RailSettingsLink
                     key={page.url}
                     {...page}

src/layouts/bots/(partials)/rail-user-row.tsx

@@ -6,14 +6,14 @@ import Span from "@moduletrace/twui/layout/Span";
 import { ChevronRight } from "lucide-react";
 import { AppContext } from "@/src/pages/__root";
 import RailUserMenu from "./rail-user-menu";
+import Tag from "@moduletrace/twui/elements/Tag";
 
 /**
  * The signed-in user, opening the popover above. Its top rule sits at the
  * same height as the composer rule, so the two read as one line.
  */
 export default function RailUserRow() {
-    const { pageProps } = useContext(AppContext);
-    const user = pageProps?.user;
+    const { user, user_types } = useContext(AppContext);
 
     const name = user?.first_name || user?.email || "";
     const initials = [user?.first_name, user?.last_name]
@@ -38,13 +38,23 @@ export default function RailUserRow() {
                         <Span className="size-6 shrink-0 rounded-full bg-sunken flex items-center justify-center text-[11px] font-bold leading-none text-ink">
                             {initials}
                         </Span>
-                        <Stack className="hidden lg:flex grow min-w-0 gap-0!">
+                        <Stack className="hidden lg:flex grow min-w-0 gap-1">
                             <Span className="text-sm font-bold leading-5 text-ink truncate w-full">
                                 {name}
                             </Span>
-                            <Span className="text-[11px] leading-4 text-ink-secondary">
-                                Free
-                            </Span>
+                            <Row>
+                                {user_types?.map((ut, indx) => {
+                                    return (
+                                        <Tag
+                                            key={indx}
+                                            variant="outlined"
+                                            color="gray"
+                                        >
+                                            {ut.user_type}
+                                        </Tag>
+                                    );
+                                })}
+                            </Row>
                         </Stack>
                         <ChevronRight
                             size={16}

src/layouts/bots/(sections)/bots-rail.tsx

@@ -1,6 +1,7 @@
 import { useContext } from "react";
 import Stack from "@moduletrace/twui/layout/Stack";
 import { AppContext } from "@/src/pages/__root";
+import useLiveBots from "@/src/hooks/use-live-bots";
 import RailHeader from "../(partials)/rail-header";
 import RailCrewList from "../(partials)/rail-crew-list";
 import RailSettingsList from "../(partials)/rail-settings-list";
@@ -16,6 +17,10 @@ export default function BotsRail() {
 
     const pathname = pageProps?.url?.pathname;
     const is_settings_page = Boolean(pathname?.startsWith("/admin/settings"));
+    const bots = useLiveBots({
+        bots: pageProps?.bots || [],
+        open_bot_id: pageProps?.bot?.id || undefined,
+    });
 
     return (
         <Stack
@@ -28,7 +33,7 @@ export default function BotsRail() {
                     <RailSettingsList pathname={pathname} />
                 ) : (
                     <RailCrewList
-                        bots={pageProps?.bots || []}
+                        bots={bots}
                         selected_id={pageProps?.bot?.id || undefined}
                     />
                 )}

src/layouts/bots/index.tsx

@@ -1,5 +1,6 @@
 import React from "react";
 import Row from "@moduletrace/twui/layout/Row";
+import useWebSocket from "@moduletrace/twui/hooks/useWebSocket";
 import BotsRail from "./(sections)/bots-rail";
 
 /**
@@ -12,6 +13,11 @@ export default function BotsLayout({
 }: {
     children: React.ReactNode;
 }) {
+    /**
+     * One socket for live bot updates (see `useServerEvent`).
+     */
+    useWebSocket({ url: "/ws" });
+
     return (
         <Row className="w-full h-screen gap-0! flex-nowrap items-stretch overflow-hidden bg-paper text-ink">
             <BotsRail />