Moduletrace/cobble
2
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases 14 Wiki Activity

Add bot types with a permission matrix, and workspace admin bots

Browse Source 
A bot's powers came from bots.kind alone, so only the coordinator could
hand work to other bots. bot_types now works like user_types: a row with
no workspace holds everywhere (the coordinator), one with a workspace
only there (a workspace admin), and no row is a worker. bots.kind stays
the legacy marker of the one coordinator for who sees it.

The matrices in src/dict/bot-types-dict.ts say what each type may do,
whom it may direct and who grants it, read by one generic interpreter
(rbac/type-assignment.ts) that userTypeAssignment now wraps too. Every
run reads its powers once (grabBotRunPowers) and the chat tools, task
runs and task tools gate on them instead of kind; a run's powers are its
type's and its user's together.

In the workspace it leads, an admin hands tasks to the workers there
(results relayed back to it), sets their instructions, adds tasks to
their lists and keeps the workspace's context when its user may. Super
admins and admins grant it from the workspace's settings or the chat
header's menu, and the coordinator with set_bot_type. Admins are marked
with a filled green shield beside their name across the workspace, kept
live by pushBotUpdated's admin_workspace_ids.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
tben
2026-10-25 09:04:14 +01:00
co-authored by Claude Opus 5.5
parent 4161863587
commit ea62dd11f0
65 changed files with 1970 additions and 239 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/bots-queue/push-bot-updated.ts
+13
View File
@@ -74,6 +74,18 @@ async function push({
})
).payload?.[0];
/**
* The workspaces it leads, so each crew shows its shield.
*/
const admin_workspace_ids = (
(
await BunSQLite.sql<{ workspace_id: number }>({
sql: `SELECT workspace_id FROM bot_types WHERE bot_id = ? AND bot_type = 'admin' AND workspace_id IS NOT NULL`,
values: [bot_id],
})
).payload || []
).map((row) => Number(row.workspace_id));
for (const viewer_id of audience) {
if (users && !users.has(String(viewer_id))) continue;
@@ -87,6 +99,7 @@ async function push({
color: identity?.color || null,
stone: identity?.stone || null,
image_media_id: identity?.image_media_id ? Number(identity.image_media_id) : null,
admin_workspace_ids,
...(computer_id !== undefined ? { computer_id: computer_id || null } : {}),
...(workspace_ids !== undefined ? { workspace_ids } : {}),
task: await grabActiveBotTask({ bot_id, user_id: viewer_id }),
src/bots-queue/run-bot-reply.ts
+28 -8
View File
@@ -9,8 +9,12 @@ import {
CoordinatorSoloNote,
TasksNote,
TaskReminderNote,
workspaceAdminNote,
WorkspaceLearningNote,
} from "@/src/data/harness-prompts";
import grabBotRunPowers from "@/src/functions/backend/db/bot-types/grab-bot-run-powers";
import workspaceAdminsNote from "./workspace-admins-note";
import type { WorkspaceAdminTools } from "@/src/harness/tools/bot/grab-workspace-admin-tools";
import { grabReplyMaxToolSteps } from "@/src/functions/backend/db/app-settings/grab-run-limits";
import grabBotMessages from "@/src/functions/backend/db/bots/grab-bot-messages";
import grabBotPrompt from "@/src/functions/backend/db/bots/grab-bot-prompt";
@@ -158,8 +162,16 @@ export default async function runBotReply({
onAttach: ({ media_id }) => attachments.push(media_id),
});
/**
* What the bot's types let it do here, and what it leads when it's this
* workspace's admin.
*/
const powers = await grabBotRunPowers({ bot_id: bot.id, workspace_id });
let led: WorkspaceAdminTools | null = null;
const tools = await grabBotChatTools({
bot,
powers,
user_id,
computers,
session_id,
@@ -168,6 +180,9 @@ export default async function runBotReply({
message_id: job.message_id || undefined,
onTakeOver: ({ ref }) => take_overs.push(ref),
onPropose: ({ ref }) => proposals.push(ref),
onWorkspaceAdmin: (admin) => {
led = admin;
},
});
/**
@@ -193,14 +208,19 @@ export default async function runBotReply({
});
/**
* delegate_task is only there while the coordinator has workers.
* delegate_task is only there while the coordinator, or a workspace's
* admin, has bots to hand work to. Anyone else in a workspace with an
* admin is told who leads it.
*/
const crew_note =
bot.kind != "coordinator"
? ""
: tools.some((tool) => tool.name == "delegate_task")
? coordinatorReplyNote({ bot_id: bot.id })
: CoordinatorSoloNote;
const can_delegate = tools.some((tool) => tool.name == "delegate_task");
const lead = led as WorkspaceAdminTools | null;
const crew_note = powers.is_coordinator
? can_delegate
? coordinatorReplyNote({ bot_id: bot.id })
: CoordinatorSoloNote
: lead?.workspace && can_delegate
? workspaceAdminNote({ workspace_name: lead.workspace.name || "this workspace", members: lead.members })
: await workspaceAdminsNote({ bot_id: bot.id, workspace_id });
try {
const result = await runTextLoop({
@@ -216,7 +236,7 @@ export default async function runBotReply({
workspace_id ? WorkspaceLearningNote : "",
composeComputersNote({
computers,
is_coordinator: bot.kind == "coordinator",
is_coordinator: powers.is_coordinator,
in_workspace: Boolean(workspace_id),
}),
crew_note,
src/bots-queue/run-bot-task.ts
+32 -10
View File
@@ -1,3 +1,6 @@
import grabBotRunPowers from "@/src/functions/backend/db/bot-types/grab-bot-run-powers";
import grabWorkspaceAdminTools from "@/src/harness/tools/bot/grab-workspace-admin-tools";
import workspaceAdminsNote from "./workspace-admins-note";
import type { BUN_SQLITE_COBBLE_BOTS } from "@/db/types/db";
import {
ActionCheckNote,
@@ -87,13 +90,15 @@ export default async function runBotTask({
const computers = await grabBotComputers({ bot_id: bot.id, workspace_id });
/**
* A coordinator's task can also change workspaces: the findings
* it was asked to record go there, not only in the report.
* What the bot's types let it do here. A coordinator's task can
* also change workspaces, and a workspace admin's its workspace:
* the findings it was asked to record go there, not only in the
* report.
*/
const coordinator_workspaces =
bot.kind == "coordinator"
? (await grabUserWorkspaces({ user_id })).filter((w) => !w.archived)
: [];
const powers = await grabBotRunPowers({ bot_id: bot.id, workspace_id });
const coordinator_workspaces = powers.is_coordinator
? (await grabUserWorkspaces({ user_id })).filter((w) => !w.archived)
: [];
const carry_over = await grabSessionCarryOver({
session_id,
bot_id: bot.id,
@@ -121,6 +126,16 @@ export default async function runBotTask({
*/
const scopes = await grabRunScopes({ bot, user_id, workspace_id });
/**
* A workspace admin's task keeps the workspace's context and its
* members' instructions; it hands nothing over (no session to report
* back to mid-task).
*/
const admin_tools =
!powers.is_coordinator && workspace_id && powers.is_workspace_admin
? (await grabWorkspaceAdminTools({ bot, user_id, workspace_id, powers, scopes })).tools
: [];
const tools = [
...(await grabBotTools({
user_id,
@@ -128,10 +143,12 @@ export default async function runBotTask({
workspace_id,
computers,
session_id,
is_coordinator: bot.kind == "coordinator",
is_coordinator: powers.is_coordinator,
admin_workspace_ids: powers.admin_workspace_ids,
scopes,
})),
...(bot.kind == "coordinator"
...admin_tools,
...(powers.is_coordinator
? [
createWorkspaceTool({ user_id, workspaces: coordinator_workspaces }),
...(coordinator_workspaces.length
@@ -204,9 +221,14 @@ export default async function runBotTask({
TasksNote,
ActionCheckNote,
workspace_id ? WorkspaceLearningNote : "",
bot.kind == "coordinator"
powers.is_coordinator
? `If this brief asked you to record something in a workspace (its context, or a new one), do it yourself with update_workspace or create_workspace before you report: the report alone changes nothing.`
: "",
: admin_tools.some((tool) => tool.name == "update_workspace")
? `If this brief asked you to record something in this workspace's context, do it yourself with update_workspace before you report: the report alone changes nothing.`
: "",
powers.is_coordinator || powers.is_workspace_admin
? ""
: await workspaceAdminsNote({ bot_id: bot.id, workspace_id }),
computer
? `You're working on the computer "${computer.name}" (a Linux sandbox with a shell, files, code runners and a browser). Use its tools; don't ask the user to run anything. When only the user can go on (a login, a captcha, a code sent to them), ask them to take over with ask_user_to_take_over.`
: workspace_id
src/bots-queue/workspace-admins-note.ts
+20
View File
@@ -0,0 +1,20 @@
import { workspaceAdminsLine } from "@/src/data/harness-prompts";
import grabWorkspaceAdmins from "@/src/functions/backend/db/bot-types/grab-workspace-admins";
/**
* For a bot in a workspace that has admins other than itself: the line
* naming them (`workspaceAdminsLine`).
*/
export default async function workspaceAdminsNote({
bot_id,
workspace_id,
}: {
bot_id: number | string | "" | undefined;
workspace_id?: number | string | null;
}) {
if (!workspace_id) return "";
const admins = (await grabWorkspaceAdmins({ workspace_id })).filter((admin) => admin.id != Number(bot_id));
return admins.length ? workspaceAdminsLine({ admins }) : "";
}