Share one crew across the install, keep user memory per user

Bots, workspaces and computers now belong to the install. Users reach workers only through bot_users (assigned by a super admin or admin) and workspace_users; the coordinator and main computer are one per install, and only the super admin sees the coordinator. Conversations are per user (bot_sessions.user_id), jobs run for the session's user, and live updates go only to who should see them. A bot's core memory is now general knowledge shared by every user it works for; what it learns about a user lives in bot_user_memories. One-off scripts move existing installs over: move-bot-memory-to-owners (run first), then share-crew. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-19 11:37:14 +01:00
parent 4dd34ed251
commit e45d54d30b
133 changed files with 1854 additions and 436 deletions
@@ -1,5 +1,7 @@
 import type { BUN_SQLITE_COBBLE_BOTS } from "@/db/types/db";
 import BunSQLite from "@moduletrace/bun-sqlite";
+import chatBotsSql from "@/src/utils/crew-access/chat-bots-sql";
+import grabCrewRole from "../access/grab-crew-role";

 type Params = {
    bot_id: number | string;
@@ -7,15 +9,23 @@ type Params = {
 };

 /**
- * A bot only if it belongs to the given owner.
+ * A bot only if the user reaches it somewhere: in its own chat
+ * (`chatBotsSql`) or in a workspace they're in. Super admins and admins
+ * reach every worker; only the super admin reaches the coordinator.
 */
 export default async function grabUserBot({
    bot_id,
    user_id,
 }: Params): Promise<BUN_SQLITE_COBBLE_BOTS | null> {
+    const access = chatBotsSql({ role: await grabCrewRole({ user_id }), user_id });
+
    const res = await BunSQLite.sql<BUN_SQLITE_COBBLE_BOTS>({
-        sql: `SELECT * FROM bots WHERE id = ? AND user_id = ? LIMIT 1`,
-        values: [bot_id, user_id],
+        sql: `SELECT b.* FROM bots b WHERE b.id = ? AND (${access.sql} OR (b.kind != 'coordinator' AND b.id IN (
+                SELECT wb.bot_id FROM workspace_bots wb
+                JOIN workspace_users wu ON wu.workspace_id = wb.workspace_id AND wu.user_id = ?
+                JOIN workspaces w ON w.id = wb.workspace_id AND w.archived = 0
+            ))) LIMIT 1`,
+        values: [bot_id, ...access.values, user_id],
    });

    return res.payload?.[0] || null;