Share one crew across the install, keep user memory per user

Bots, workspaces and computers now belong to the install. Users reach
workers only through bot_users (assigned by a super admin or admin) and
workspace_users; the coordinator and main computer are one per install,
and only the super admin sees the coordinator. Conversations are per
user (bot_sessions.user_id), jobs run for the session's user, and live
updates go only to who should see them.

A bot's core memory is now general knowledge shared by every user it
works for; what it learns about a user lives in bot_user_memories.

One-off scripts move existing installs over: move-bot-memory-to-owners
(run first), then share-crew.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/pages/admin/workspaces/[workspace_id]/(sections)/workspace-overview.tsx

@@ -1,5 +1,7 @@
 import { useContext, useState } from "react";
+import EmptyContent from "@moduletrace/twui/elements/EmptyContent";
 import { AppContext } from "@/src/pages/__root";
+import canManageCrew from "@/src/utils/rbac/can-manage-crew";
 import SettingsShell from "@/src/pages/admin/settings/(partials)/settings-shell";
 import WorkspaceBotsGroup from "../(partials)/workspace-bots-group";
 import WorkspaceComputersGroup from "../(partials)/workspace-computers-group";
@@ -11,7 +13,8 @@ import WorkspaceSectionHeading from "../(partials)/workspace-section-heading";
 
 /**
  * A workspace's page beside its rail: its context, bots, computers, then
- * its models, and deleting it.
+ * its models, and deleting it. A member only lands here while it has no
+ * bots yet.
  */
 export default function WorkspaceOverview() {
     const { pageProps } = useContext(AppContext);
@@ -19,6 +22,14 @@ export default function WorkspaceOverview() {
 
     if (!workspace?.id) return null;
 
+    if (!canManageCrew({ user_types: pageProps?.user_types })) {
+        return (
+            <SettingsShell title={workspace.name || "Workspace"} description={workspace.description || "A workspace."}>
+                <EmptyContent title="No bots here yet. An admin adds them." />
+            </SettingsShell>
+        );
+    }
+
     const workspace_id = Number(workspace.id);
     const harnesses = pageProps?.workspace_harness_overview?.harnesses;
 

src/pages/admin/workspaces/[workspace_id]/index.server.ts

@@ -6,16 +6,18 @@ import grabUserWorkspaces from "@/src/functions/backend/db/workspaces/grab-user-
 import grabWorkspaceBots from "@/src/functions/backend/db/workspaces/grab-workspace-bots";
 import grabWorkspaceComputers from "@/src/functions/backend/db/workspaces/grab-workspace-computers";
 import { AdminHomePath } from "@/src/dict/admin-sections-dict";
+import canManageCrew from "@/src/utils/rbac/can-manage-crew";
 import type { PagePropsType, PageQueryObject } from "@/src/types";
 import type { BunextPageServerFn } from "@moduletrace/bunext/types";
 
 /**
  * A workspace's page: its details, crew, computers and models, with the
- * rail showing its crew.
+ * rail showing its crew. Only super admins and admins manage it; a member
+ * opens its first bot instead.
  */
 export const server: BunextPageServerFn<PagePropsType> = async (params) => {
     const query: PageQueryObject = params.query;
-    const { user } = await userAuth({ req: params.req });
+    const { user, user_types } = await userAuth({ req: params.req });
 
     if (!user?.id) {
         return { redirect: { destination: "/auth/login" } };
@@ -30,6 +32,19 @@ export const server: BunextPageServerFn<PagePropsType> = async (params) => {
 
     const workspace_id = Number(workspace.id);
 
+    /**
+     * Members don't manage it: they go straight to its first bot.
+     */
+    if (!canManageCrew({ user_types })) {
+        const workspace_bots = await grabWorkspaceBots({ user_id: user.id, workspace_id });
+
+        if (workspace_bots[0]?.id) {
+            return { redirect: { destination: `/admin/workspaces/${workspace_id}/bots/${workspace_bots[0].id}` } };
+        }
+
+        return { props: { workspaces, workspace, bots: workspace_bots, workspace_bots } };
+    }
+
     const [workspace_bots, all_bots, workspace_computers, computers, workspace_harness_overview] =
         await Promise.all([
             grabWorkspaceBots({ user_id: user.id, workspace_id }),