Add bot types with a permission matrix, and workspace admin bots

A bot's powers came from bots.kind alone, so only the coordinator could
hand work to other bots. bot_types now works like user_types: a row with
no workspace holds everywhere (the coordinator), one with a workspace
only there (a workspace admin), and no row is a worker. bots.kind stays
the legacy marker of the one coordinator for who sees it.

The matrices in src/dict/bot-types-dict.ts say what each type may do,
whom it may direct and who grants it, read by one generic interpreter
(rbac/type-assignment.ts) that userTypeAssignment now wraps too. Every
run reads its powers once (grabBotRunPowers) and the chat tools, task
runs and task tools gate on them instead of kind; a run's powers are its
type's and its user's together.

In the workspace it leads, an admin hands tasks to the workers there
(results relayed back to it), sets their instructions, adds tasks to
their lists and keeps the workspace's context when its user may. Super
admins and admins grant it from the workspace's settings or the chat
header's menu, and the coordinator with set_bot_type. Admins are marked
with a filled green shield beside their name across the workspace, kept
live by pushBotUpdated's admin_workspace_ids.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/functions/backend/db/workspaces/delete-workspace.ts

@@ -36,6 +36,11 @@ export default async function deleteWorkspace({ user_id, workspace_id }: Params)
      */
     const task_media_ids = await grabTaskMediaIds({ workspace_id: workspace.id! }).catch(() => []);
 
+    /**
+     * Explicitly, since foreign keys are off outside the server process.
+     */
+    await BunSQLite.sql({ sql: `DELETE FROM bot_types WHERE workspace_id = ?`, values: [workspace.id] });
+
     const res = await BunSQLite.sql({
         sql: `DELETE FROM workspaces WHERE id = ?`,
         values: [workspace.id],

src/functions/backend/db/workspaces/grab-bot-workspaces.ts

@@ -11,7 +11,8 @@ type Params = {
 /**
  * The workspaces a bot works in, for its settings page. The coordinator
  * works in every workspace; a worker only in the ones it was added to.
- * Each row carries what the bot has for that workspace alone.
+ * Each row carries what the bot has for that workspace alone, and whether
+ * it's that workspace's admin.
  */
 export default async function grabBotWorkspaces({
     user_id,
@@ -36,6 +37,16 @@ export default async function grabBotWorkspaces({
         ).payload || [];
 
     const by_workspace = new Map(rows.map((row) => [Number(row.workspace_id), row]));
+    const admin_of = new Set(
+        (
+            (
+                await BunSQLite.sql<{ workspace_id: number }>({
+                    sql: `SELECT workspace_id FROM bot_types WHERE bot_id = ? AND bot_type = 'admin'`,
+                    values: [Number(bot.id)],
+                })
+            ).payload || []
+        ).map((row) => Number(row.workspace_id)),
+    );
 
     return workspaces
         .filter((workspace) => by_workspace.has(Number(workspace.id)))
@@ -46,6 +57,7 @@ export default async function grabBotWorkspaces({
                 ...workspace,
                 workspace_system_prompt: row?.system_prompt || null,
                 workspace_memory: row?.memory || null,
+                is_admin: admin_of.has(Number(workspace.id)),
             };
         });
 }

src/functions/backend/db/workspaces/grab-workspace-bots.ts

@@ -11,7 +11,7 @@ type Params = {
 /**
  * A workspace's crew (the coordinator first, then its bots by latest
  * activity there), each with its instructions and memory for the
- * workspace.
+ * workspace (whether it's the workspace's admin comes with `grabBots`).
  */
 export default async function grabWorkspaceBots({
     user_id,

src/functions/backend/db/workspaces/remove-bot-from-workspace.ts

@@ -29,4 +29,12 @@ export default async function removeBotFromWorkspace({
         sql: `DELETE FROM workspace_bots WHERE workspace_id = ? AND bot_id = ?`,
         values: [workspace.id, bot_id],
     });
+
+    /**
+     * Its types there (workspace admin) go with its place.
+     */
+    await BunSQLite.sql({
+        sql: `DELETE FROM bot_types WHERE workspace_id = ? AND bot_id = ?`,
+        values: [workspace.id, bot_id],
+    });
 }