Share one crew across the install, keep user memory per user

Bots, workspaces and computers now belong to the install. Users reach
workers only through bot_users (assigned by a super admin or admin) and
workspace_users; the coordinator and main computer are one per install,
and only the super admin sees the coordinator. Conversations are per
user (bot_sessions.user_id), jobs run for the session's user, and live
updates go only to who should see them.

A bot's core memory is now general knowledge shared by every user it
works for; what it learns about a user lives in bot_user_memories.

One-off scripts move existing installs over: move-bot-memory-to-owners
(run first), then share-crew.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/layouts/bots/(partials)/rail-add-button.tsx

@@ -1,14 +1,19 @@
 import { useContext } from "react";
 import Button from "@moduletrace/twui/layout/Button";
+import { AppContext } from "@/src/pages/__root";
+import canManageCrew from "@/src/utils/rbac/can-manage-crew";
 import { Plus } from "lucide-react";
 import { AddFlowContext } from "../(data)/add-flow-context";
 
 /**
  * The rail header's Add icon: opens the Add modal (a bot, a workspace or a
- * computer).
+ * computer), for super admins and admins.
  */
 export default function RailAddButton() {
     const { openAdd } = useContext(AddFlowContext);
+    const { pageProps } = useContext(AppContext);
+
+    if (!canManageCrew({ user_types: pageProps?.user_types })) return null;
 
     return (
         <Button

src/layouts/bots/(partials)/rail-crew-list.tsx

@@ -1,5 +1,7 @@
 import { useContext } from "react";
 import { AddFlowContext } from "../(data)/add-flow-context";
+import { AppContext } from "@/src/pages/__root";
+import canManageCrew from "@/src/utils/rbac/can-manage-crew";
 import type { BotWithLastMessage, WorkspaceWithActivity } from "@/src/types";
 import CoordinatorRow from "./coordinator-row";
 import RailBotsSection from "./rail-bots-section";
@@ -18,6 +20,7 @@ type Props = {
  */
 export default function RailCrewList({ bots, workspaces, selected_id }: Props) {
     const { openForm } = useContext(AddFlowContext);
+    const { pageProps } = useContext(AppContext);
     const coordinator = bots.find((bot) => bot.kind === "coordinator");
     const workers = bots.filter((bot) => bot.kind !== "coordinator");
 
@@ -36,7 +39,11 @@ export default function RailCrewList({ bots, workspaces, selected_id }: Props) {
                 workers={workers}
                 selected_id={selected_id}
                 hrefFor={(bot) => `/admin/bots/${bot.id}`}
-                empty="No bots yet. Add one for a job you hand out often."
+                empty={
+                    canManageCrew({ user_types: pageProps?.user_types })
+                        ? "No bots yet. Add one for a job you hand out often."
+                        : "No bots for you yet. An admin assigns them."
+                }
             />
             <RailWorkspacesSection workspaces={workspaces} />
         </>

src/layouts/bots/(partials)/rail-section-add-button.tsx

@@ -1,4 +1,7 @@
+import { useContext } from "react";
 import Button from "@moduletrace/twui/layout/Button";
+import { AppContext } from "@/src/pages/__root";
+import canManageCrew from "@/src/utils/rbac/can-manage-crew";
 import { Plus } from "lucide-react";
 
 type Props = {
@@ -7,9 +10,14 @@ type Props = {
 };
 
 /**
- * The "+" beside a rail section's label.
+ * The "+" beside a rail section's label, for super admins and admins (who
+ * add bots and workspaces).
  */
 export default function RailSectionAddButton({ title, onClick }: Props) {
+    const { pageProps } = useContext(AppContext);
+
+    if (!canManageCrew({ user_types: pageProps?.user_types })) return null;
+
     return (
         <Button
             title={title}

src/layouts/bots/(partials)/rail-workspace-list.tsx

@@ -51,7 +51,7 @@ export default function RailWorkspaceList({ workspace, bots, selected_id, on_wor
                 workers={workers}
                 selected_id={on_workspace_page ? undefined : selected_id}
                 hrefFor={(bot) => `${base}/bots/${bot.id}`}
-                empty="No bots here yet. Add one, or put an existing bot in from the workspace's page."
+                empty="No bots here yet."
             />
         </>
     );