feat(mothership): create organization workspaces through CLI

Author: Sg312

apps/sim/lib/api/contracts/mothership-management-tools.ts

@@ -1,9 +1,22 @@
 import { z } from 'zod'
+import { createWorkspaceInputSchema } from '@/lib/workspaces/create-input'
 import { organizationSearchSourcesInputSchema } from './mothership-search-sources'
 import { mothershipSettingsInputSchema } from './mothership-settings'
 
+export const mothershipWorkspacesInputSchema = z.discriminatedUnion('action', [
+  createWorkspaceInputSchema.extend({ action: z.literal('create') }).strict(),
+])
+
 /** Shared input contracts and availability; permission decisions remain in the domain use cases. */
 export const managementToolContracts = [
+  {
+    id: 'workspaces',
+    route: 'sim',
+    scope: 'organization',
+    description:
+      'Create a workspace in the conversation’s organization under the current user’s workspace-creation policy. Returns its ID for subsequent explicitly workspace-scoped commands. Includes a starter workflow unless skipDefaultWorkflow is true.',
+    inputSchema: mothershipWorkspacesInputSchema,
+  },
   {
     id: 'settings',
     route: 'sim',

apps/sim/lib/api/contracts/workspaces.ts

@@ -1,6 +1,7 @@
 import { z } from 'zod'
 import { nonEmptyIdSchema, organizationRoleSchema } from '@/lib/api/contracts/primitives'
 import { type ContractJsonResponse, defineRouteContract } from '@/lib/api/contracts/types'
+import { createWorkspaceInputSchema } from '@/lib/workspaces/create-input'
 import { workspacePermissionUpdatesSchema } from '@/lib/workspaces/permissions/input'
 
 export const workspaceScopeSchema = z.enum(['active', 'archived', 'all'])
@@ -61,10 +62,7 @@ export const listWorkspacesQuerySchema = z.object({
 
 export type WorkspaceQueryScope = NonNullable<z.input<typeof listWorkspacesQuerySchema>['scope']>
 
-export const createWorkspaceBodySchema = z.object({
-  name: z.string().trim().min(1, 'Name is required'),
-  skipDefaultWorkflow: z.boolean().optional().default(false),
-})
+export const createWorkspaceBodySchema = createWorkspaceInputSchema
 
 export const workspaceParamsSchema = z.object({
   id: z.string().min(1),

apps/sim/lib/mothership/agent-cli/services.test.ts

@@ -96,30 +96,33 @@ describe('scoped CLI service adapter', () => {
     })
   })
 
-  it.each(['list_workspaces', 'search_workspace', 'read_document', 'search_sources'] as const)(
-    '%s keeps org chat authority without workspace resolution',
-    async (name) => {
-      const result = await executeAgentCliService(service(name), organization)
-      expect(result.exitCode).toBe(0)
-      expect(JSON.parse(result.stdout).documents[0].citation).toBe('<doc id="1" />')
-      expect(boundary.workspace).not.toHaveBeenCalled()
-      expect(boundary.organization).toHaveBeenCalledWith({
-        principal: expect.objectContaining({
-          subjectUserId: 'actor',
-          organizationId: 'org',
-          resourceScope: { chatId: 'chat' },
-        }),
-      })
-      expect(boundary.route).toHaveBeenCalledWith(
-        name,
-        {},
-        expect.objectContaining({ organizationId: 'org', workspaceId: undefined })
-      )
-      await expect(executeAgentCliService(service(name), workspace)).rejects.toThrow(
-        'organization conversation'
-      )
-    }
-  )
+  it.each([
+    'list_workspaces',
+    'search_workspace',
+    'read_document',
+    'search_sources',
+    'workspaces',
+  ] as const)('%s keeps org chat authority without workspace resolution', async (name) => {
+    const result = await executeAgentCliService(service(name), organization)
+    expect(result.exitCode).toBe(0)
+    expect(JSON.parse(result.stdout).documents[0].citation).toBe('<doc id="1" />')
+    expect(boundary.workspace).not.toHaveBeenCalled()
+    expect(boundary.organization).toHaveBeenCalledWith({
+      principal: expect.objectContaining({
+        subjectUserId: 'actor',
+        organizationId: 'org',
+        resourceScope: { chatId: 'chat' },
+      }),
+    })
+    expect(boundary.route).toHaveBeenCalledWith(
+      name,
+      {},
+      expect.objectContaining({ organizationId: 'org', workspaceId: undefined })
+    )
+    await expect(executeAgentCliService(service(name), workspace)).rejects.toThrow(
+      'organization conversation'
+    )
+  })
   it('passes trusted execution metadata through the real sim_cli handler and index branch', async () => {
     const signal = new AbortController().signal
     const result = await executeSimCli(

apps/sim/lib/mothership/application/execute-organization-workspace-use-case.ts

@@ -0,0 +1,43 @@
+import type { OperationUseCase } from '@/lib/core/application/operation'
+import { OrchestrationError } from '@/lib/core/orchestration/types'
+import {
+  COPILOT_APPLICATION_DELEGATION_TTL_MS,
+  type CopilotExecutionContext,
+  createTrustedOrganizationCopilotPrincipal,
+  requireTrustedOrganizationCopilotContext,
+} from '@/lib/mothership/auth/application-delegation'
+import { authorizeOrganizationChatDelegation } from '@/lib/mothership/chat/organization-chats'
+import {
+  type OrganizationWorkspaceOperation,
+  organizationWorkspaceOperations,
+} from '@/lib/workspaces/application/organization-operations'
+
+/** Organization operations bind to the private chat, without inventing a workspace authority. */
+export async function executeOrganizationWorkspaceUseCase<
+  O extends OrganizationWorkspaceOperation,
+  I,
+  R,
+>(
+  context: CopilotExecutionContext | undefined,
+  useCase: OperationUseCase<O, I & { organizationId: string }, R>,
+  input: I
+): Promise<R> {
+  if (
+    !Object.values(organizationWorkspaceOperations).some(
+      (operation) => operation === useCase.operation
+    )
+  )
+    throw new Error('Unregistered organization workspace operation')
+  const trusted = requireTrustedOrganizationCopilotContext(context)
+  if (context?.requestMode !== 'agent')
+    throw new OrchestrationError(
+      'forbidden',
+      'Workspace management requires organization agent mode'
+    )
+  const principal = createTrustedOrganizationCopilotPrincipal(
+    { ...trusted, delegationId: trusted.toolCallId },
+    { audience: useCase.operation.delegationAudience, ttlMs: COPILOT_APPLICATION_DELEGATION_TTL_MS }
+  )
+  await authorizeOrganizationChatDelegation.execute({ principal })
+  return useCase.execute({ principal, input: { ...input, organizationId: trusted.organizationId } })
+}

apps/sim/lib/mothership/generated/agent-cli.ts

@@ -46,7 +46,14 @@ export type AgentCliStdoutInvocation = z.infer<typeof AgentCliStdoutInvocation>;
 /** Internal product operations reuse Sim's authorized handlers; public CLI operations stay native. */
 export const AgentCliServiceInvocation = z.object({
   kind: z.literal("service"),
-  name: z.enum(["list_workspaces", "search_workspace", "read_document", "settings", "search_sources"]),
+  name: z.enum([
+    "list_workspaces",
+    "search_workspace",
+    "read_document",
+    "settings",
+    "search_sources",
+    "workspaces",
+  ]),
   input: z.record(z.string(), z.json()),
   inputFiles: z.partialRecord(z.enum(["input", "changes"]), z.string().min(1).max(1000)).optional(),
 });

apps/sim/lib/mothership/tools/server/router.ts

@@ -32,6 +32,7 @@ import { organizationSearchSourcesServerTool } from '@/lib/mothership/tools/serv
 import { settingsServerTool } from '@/lib/mothership/tools/server/settings'
 import { getCredentialsServerTool } from '@/lib/mothership/tools/server/user/get-credentials'
 import { listWorkspacesServerTool } from '@/lib/mothership/tools/server/workspace-list'
+import { workspacesServerTool } from '@/lib/mothership/tools/server/workspaces'
 
 export type ExecuteResponseSuccess = z.output<typeof ExecuteResponseSuccessSchema>
 
@@ -62,6 +63,7 @@ const baseServerToolRegistry: Record<string, BaseServerTool> = {
   [searchDocsServerTool.name]: searchDocsServerTool,
   [searchWorkspaceServerTool.name]: searchWorkspaceServerTool,
   [listWorkspacesServerTool.name]: listWorkspacesServerTool,
+  [workspacesServerTool.name]: workspacesServerTool,
   [organizationSearchSourcesServerTool.name]: organizationSearchSourcesServerTool,
   [settingsServerTool.name]: settingsServerTool,
   [openResourceServerTool.name]: openResourceServerTool,

apps/sim/lib/mothership/tools/server/workspace-list.ts

@@ -1,11 +1,6 @@
 import { listWorkspacesInputSchema } from '@/lib/api/contracts/mothership-assistant-tools'
 import { messageForCopilotApplicationError } from '@/lib/mothership/application/error'
-import {
-  COPILOT_APPLICATION_DELEGATION_TTL_MS,
-  createTrustedOrganizationCopilotPrincipal,
-  requireTrustedOrganizationCopilotContext,
-} from '@/lib/mothership/auth/application-delegation'
-import { authorizeOrganizationChatDelegation } from '@/lib/mothership/chat/organization-chats'
+import { executeOrganizationWorkspaceUseCase } from '@/lib/mothership/application/execute-organization-workspace-use-case'
 import type { BaseServerTool } from '@/lib/mothership/tools/server/base-tool'
 import { listOrganizationWorkspaces } from '@/lib/workspaces/application/list-organization-workspaces'
 
@@ -14,18 +9,11 @@ export const listWorkspacesServerTool: BaseServerTool = {
   inputSchema: listWorkspacesInputSchema,
   async execute(raw, context) {
     try {
-      const trusted = requireTrustedOrganizationCopilotContext(context)
-      if (context?.requestMode !== 'agent')
-        throw new Error('Workspace discovery requires organization agent mode')
-      const principal = createTrustedOrganizationCopilotPrincipal(
-        { ...trusted, delegationId: trusted.toolCallId },
-        { audience: 'sim:workspaces', ttlMs: COPILOT_APPLICATION_DELEGATION_TTL_MS }
+      const result = await executeOrganizationWorkspaceUseCase(
+        context,
+        listOrganizationWorkspaces,
+        listWorkspacesInputSchema.parse(raw)
       )
-      await authorizeOrganizationChatDelegation.execute({ principal })
-      const result = await listOrganizationWorkspaces.execute({
-        principal,
-        input: { ...listWorkspacesInputSchema.parse(raw), organizationId: trusted.organizationId },
-      })
       return { success: true, ...result }
     } catch (error) {
       return {