Share one crew across the install, keep user memory per user

Bots, workspaces and computers now belong to the install. Users reach
workers only through bot_users (assigned by a super admin or admin) and
workspace_users; the coordinator and main computer are one per install,
and only the super admin sees the coordinator. Conversations are per
user (bot_sessions.user_id), jobs run for the session's user, and live
updates go only to who should see them.

A bot's core memory is now general knowledge shared by every user it
works for; what it learns about a user lives in bot_user_memories.

One-off scripts move existing installs over: move-bot-memory-to-owners
(run first), then share-crew.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/dict/bot-queue-dict.ts

@@ -38,6 +38,13 @@ export type BotJobUpdateKind = (typeof BotJobUpdateKinds)[number]["value"];
  */
 export const BotReplyJobTitle = "Thinking";
 
+/**
+ * The bot's status line while a task runs. Everyone who sees the bot sees
+ * it, so it never names the task: each user sees their own task's title
+ * and steps in their conversation.
+ */
+export const BotTaskStatusLine = "Working on a task";
+
 /**
  * The bot's status line while its job waits for a rate-limited model.
  */

src/dict/settings-pages-dict.ts

@@ -12,6 +12,7 @@ import {
 } from "lucide-react";
 import type { BUN_SQLITE_COBBLE_USER_TYPES } from "@/db/types/db";
 import canListUsers from "@/src/utils/rbac/can-list-users";
+import canManageCrew from "@/src/utils/rbac/can-manage-crew";
 
 export type SettingsPage = {
     title: string;
@@ -45,9 +46,9 @@ export const SettingsPages: SettingsPage[] = [
         url: "/admin/settings/change-password",
         Icon: KeyRound,
     },
-    { title: "Bots", url: "/admin/settings/bots", Icon: Bot },
-    { title: "Workspaces", url: "/admin/settings/workspaces", Icon: Layers },
-    { title: "Computers", url: SettingsComputersPath, Icon: Monitor },
+    { title: "Bots", url: "/admin/settings/bots", Icon: Bot, can_view: canManageCrew },
+    { title: "Workspaces", url: "/admin/settings/workspaces", Icon: Layers, can_view: canManageCrew },
+    { title: "Computers", url: SettingsComputersPath, Icon: Monitor, can_view: canManageCrew },
     {
         title: "Users",
         url: "/admin/settings/users",

src/dict/user-types-dict.ts

@@ -7,17 +7,17 @@ export const UserTypes = [
     {
         value: "super_admin",
         title: "Super admin",
-        description: "Runs the install: models, environment, computers and users. The first account.",
+        description: "Runs the install: the coordinator, models, environment, computers and users. The first account.",
     },
     {
         value: "admin",
         title: "Admin",
-        description: "Adds and manages members.",
+        description: "Manages members, bots and workspaces, and picks which bots and workspaces each member reaches.",
     },
     {
         value: "member",
         title: "Member",
-        description: "Has their own crew, workspaces and main computer.",
+        description: "Chats with the bots assigned to them and in the workspaces they were added to.",
     },
     {
         value: "read_only",
@@ -27,7 +27,7 @@ export const UserTypes = [
     {
         value: "revoked",
         title: "Revoked",
-        description: "Can't sign in. Their crew and files are kept.",
+        description: "Can't sign in. Their conversations and files are kept.",
     },
 ] as const;