Share one crew across the install, keep user memory per user

Bots, workspaces and computers now belong to the install. Users reach
workers only through bot_users (assigned by a super admin or admin) and
workspace_users; the coordinator and main computer are one per install,
and only the super admin sees the coordinator. Conversations are per
user (bot_sessions.user_id), jobs run for the session's user, and live
updates go only to who should see them.

A bot's core memory is now general knowledge shared by every user it
works for; what it learns about a user lives in bot_user_memories.

One-off scripts move existing installs over: move-bot-memory-to-owners
(run first), then share-crew.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/functions/backend/db/workspaces/grab-workspace-bot.ts

@@ -4,6 +4,9 @@ import type {
     BUN_SQLITE_COBBLE_WORKSPACES,
 } from "@/db/types/db";
 import BunSQLite from "@moduletrace/bun-sqlite";
+import workspaceBotsSql from "@/src/utils/crew-access/workspace-bots-sql";
+import workspacesSql from "@/src/utils/crew-access/workspaces-sql";
+import grabCrewRole from "../access/grab-crew-role";
 
 type Params = {
     workspace_id: number | string;
@@ -22,29 +25,37 @@ export type WorkspaceBotMembership = {
 };
 
 /**
- * One of the user's bots in one of their (non-archived) workspaces: a
- * member, or the coordinator, which is in all of them. Null otherwise.
+ * A bot the user chats with in a workspace they're in (not archived): one
+ * of its workers, or for the super admin the coordinator, which is in all
+ * of them (`workspaceBotsSql`). Null otherwise.
  */
 export default async function grabWorkspaceBot({
     workspace_id,
     bot_id,
     user_id,
 }: Params): Promise<WorkspaceBotMembership | null> {
+    const role = await grabCrewRole({ user_id });
+    const workspace_access = workspacesSql({ role, user_id });
+
     const workspace = (
         await BunSQLite.sql<BUN_SQLITE_COBBLE_WORKSPACES>({
-            sql: `SELECT * FROM workspaces WHERE id = ? AND user_id = ? AND archived = 0 LIMIT 1`,
-            values: [workspace_id, user_id],
+            sql: `SELECT w.* FROM workspaces w WHERE w.id = ? AND w.archived = 0 AND ${workspace_access.sql} LIMIT 1`,
+            values: [workspace_id, ...workspace_access.values],
         })
     ).payload?.[0];
 
+    if (!workspace?.id) return null;
+
+    const bot_access = workspaceBotsSql({ role, workspace_id: workspace.id });
+
     const bot = (
         await BunSQLite.sql<BUN_SQLITE_COBBLE_BOTS>({
-            sql: `SELECT * FROM bots WHERE id = ? AND user_id = ? LIMIT 1`,
-            values: [bot_id, user_id],
+            sql: `SELECT b.* FROM bots b WHERE b.id = ? AND ${bot_access.sql} LIMIT 1`,
+            values: [bot_id, ...bot_access.values],
         })
     ).payload?.[0];
 
-    if (!workspace?.id || !bot?.id) return null;
+    if (!bot?.id) return null;
 
     const membership =
         (
@@ -54,7 +65,5 @@ export default async function grabWorkspaceBot({
             })
         ).payload?.[0] || null;
 
-    if (!membership && bot.kind != "coordinator") return null;
-
     return { workspace, bot, membership };
 }