feat(mothership): operate across organization workspaces

Author: Sg312

apps/sim/app/api/copilot/chat/resources/route.ts

@@ -28,7 +28,12 @@ export const POST = defineInternalJsonRoute({
   contract: addCopilotChatResourceContract,
   mapInput: ({ body }) => ({
     chatId: body.chatId,
-    change: { kind: 'upsert' as const, resources: [{ ...body.resource, ...(body.clearViewId ? { clearViewId: true as const } : {}) }] },
+    change: {
+      kind: 'upsert' as const,
+      resources: [
+        { ...body.resource, ...(body.clearViewId ? { clearViewId: true as const } : {}) },
+      ],
+    },
   }),
 })
 
@@ -48,7 +53,7 @@ export const DELETE = defineInternalJsonRoute({
     chatId: body.chatId,
     change: {
       kind: 'remove' as const,
-      resources: [{ type: body.resourceType, id: body.resourceId }],
+      resources: [{ type: body.resourceType, id: body.resourceId, workspaceId: body.workspaceId }],
     },
   }),
 })

apps/sim/app/api/copilot/tools/execute/route.ts

@@ -118,6 +118,7 @@ export const POST = withRouteHandler((request: NextRequest) =>
         userPermission,
         requestMode,
         assistantSearch,
+        targetWorkspaceId,
       } = validation.data
       rootSpan.setAttributes({
         [TraceAttr.ToolName]: toolName,
@@ -190,6 +191,7 @@ export const POST = withRouteHandler((request: NextRequest) =>
           copilotInteractionMode: 'interactive',
           requestMode,
           assistantSearch,
+          targetWorkspaceId,
           resolvedSecretTraceRegistry: toolRegistry,
         })
         const projection = inspectToolResultForCopilot(result, toolRegistry, toolName)

apps/sim/app/api/files/serve/[...path]/route.test.ts

@@ -70,7 +70,7 @@ const {
 })
 
 vi.mock('@/lib/uploads/contexts/organization-assistant/application', () => ({
-  readOrganizationAssistantImage: mockReadOrganizationAssistantImage,
+  readOrganizationChatAttachment: mockReadOrganizationAssistantImage,
 }))
 
 vi.mock('fs/promises', () => ({

apps/sim/app/api/files/serve/[...path]/route.ts

@@ -17,7 +17,7 @@ import { resolveServableDocBytes } from '@/lib/mothership/tools/server/files/doc
 import { DocCompileUserError } from '@/lib/mothership/tools/server/files/doc-compile-error'
 import { CopilotFiles, isUsingCloudStorage } from '@/lib/uploads'
 import type { StorageContext } from '@/lib/uploads/config'
-import { readOrganizationAssistantImage } from '@/lib/uploads/contexts/organization-assistant/application'
+import { readOrganizationChatAttachment } from '@/lib/uploads/contexts/organization-assistant/application'
 import { parseWorkspaceFileKey } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
 import { downloadFile } from '@/lib/uploads/core/storage-service'
 import { resolveServableImageBytes } from '@/lib/uploads/server/image-derivative'
@@ -225,7 +225,7 @@ export const GET = withRouteHandler(
 
       if (cloudKey.startsWith('assistant/')) {
         const principal = await internalSessionAuth.authenticate()
-        const image = await readOrganizationAssistantImage({
+        const image = await readOrganizationChatAttachment({
           principal,
           key: cloudKey,
           signal: request.signal,

apps/sim/app/api/files/uploads/purposes.ts

@@ -14,7 +14,10 @@ import {
 } from '@/lib/uploads/upload-session/service'
 import { isImageFileType } from '@/lib/uploads/utils/file-utils'
 import { validateAttachmentFileType } from '@/lib/uploads/utils/validation'
-import { authorizeWorkspaceFileAccess } from '@/lib/workspace-files/application/authorization'
+import {
+  authorizeWorkspaceFileAccess,
+  WORKSPACE_FILES_DELEGATION_AUDIENCE,
+} from '@/lib/workspace-files/application/authorization'
 import { fileOperations } from '@/lib/workspace-files/application/operations'
 import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
 
@@ -266,6 +269,15 @@ async function principalUserId(principal: Principal, workspaceId?: string): Prom
         return context.billedAccountUserId
       }
     case 'delegated':
+      if (
+        principal.serviceId === 'copilot' &&
+        principal.workspaceId === workspaceId &&
+        principal.audience === WORKSPACE_FILES_DELEGATION_AUDIENCE &&
+        principal.subjectUserId &&
+        principal.resourceScope?.chatId &&
+        principal.expiresAt > new Date()
+      )
+        return principal.subjectUserId
       throw new UploadSessionError('forbidden', 'Delegated principals cannot create uploads')
     case 'system':
       throw new UploadSessionError('forbidden', 'System principals cannot create uploads')

apps/sim/app/api/mothership/chats/[chatId]/route.ts

@@ -124,6 +124,7 @@ export const GET = withRouteHandler(
         chat: {
           id: chat.id,
           title: chat.title,
+          mode: chat.mode,
           messages: effectiveMessages,
           activeStreamId: liveStreamId,
           resources: Array.isArray(chat.resources) ? chat.resources : [],

apps/sim/app/api/mothership/chats/route.ts

@@ -7,6 +7,7 @@ import {
   listMothershipChatsContract,
 } from '@/lib/api/contracts/mothership-chats'
 import { parseRequest } from '@/lib/api/server'
+import { asOrchestrationError } from '@/lib/core/orchestration/types'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { listMothershipChats } from '@/lib/mothership/chat/list-mothership-chats'
 import {
@@ -21,7 +22,6 @@ import {
   createInternalServerErrorResponse,
   createUnauthorizedResponse,
 } from '@/lib/mothership/request/http'
-import { asOrchestrationError } from '@/lib/core/orchestration/types'
 import { captureServerEvent } from '@/lib/posthog/server'
 import {
   assertActiveWorkspaceAccess,
@@ -85,11 +85,14 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
 
     const validation = await parseRequest(createMothershipChatContract, request, {})
     if (!validation.success) return validation.response
-    const { workspaceId, organizationId } = validation.data.body
+    const { workspaceId, organizationId, mode } = validation.data.body
 
     if (organizationId) {
       if (!principal) return createUnauthorizedResponse()
-      const chat = await createOrganizationChat.execute({ principal, input: { organizationId } })
+      const chat = await createOrganizationChat.execute({
+        principal,
+        input: { organizationId, mode },
+      })
       return NextResponse.json({ success: true, id: chat.id })
     }
 

apps/sim/app/api/mothership/tasks/workflow-status/route.ts

@@ -11,7 +11,7 @@ import { readWatchedWorkflowStatus } from '@/lib/mothership/tasks/application/re
 
 export const POST = defineInternalJsonRoute({
   contract: workflowWatchStatusContract,
-  auth: internalCopilotAuth(TASK_DELEGATION_AUDIENCE),
+  auth: internalCopilotAuth(TASK_DELEGATION_AUDIENCE, { organization: true }),
   operation: taskOperations.readWorkflowStatus,
   rateLimit: internalRateLimits.none({
     reason: 'Authenticated worker reconciles its bounded task inbox.',

apps/sim/app/api/mothership/wake/route.ts

@@ -13,7 +13,7 @@ import { runWakeTurn } from '@/lib/mothership/tasks/wake'
 
 export const POST = defineInternalJsonRoute({
   contract: wakeMothershipTaskContract,
-  auth: internalCopilotAuth(TASK_DELEGATION_AUDIENCE),
+  auth: internalCopilotAuth(TASK_DELEGATION_AUDIENCE, { organization: true }),
   operation: taskOperations.wake,
   rateLimit: internalRateLimits.none({
     reason:

apps/sim/app/api/mothership/workspaces/context/route.ts

@@ -0,0 +1,25 @@
+import { readWorkspaceContextContract } from '@/lib/api/contracts/mothership-workspaces'
+import {
+  defineInternalJsonRoute,
+  internalOrchestrationErrorPolicy,
+  internalRateLimits,
+} from '@/lib/api/server/routes'
+import { internalCopilotAuth } from '@/lib/mothership/auth/internal'
+import {
+  readWorkspaceContext,
+  readWorkspaceContextOperation,
+} from '@/lib/mothership/chat/application/workspace-context'
+import { WORKSPACE_TARGET_AUDIENCE } from '@/lib/mothership/chat/application/workspace-target'
+
+export const POST = defineInternalJsonRoute({
+  contract: readWorkspaceContextContract,
+  auth: internalCopilotAuth(WORKSPACE_TARGET_AUDIENCE, { organization: true }),
+  operation: readWorkspaceContextOperation,
+  rateLimit: internalRateLimits.none({
+    reason:
+      'Private worker preflight rechecks the current workspace grant before local memory access.',
+  }),
+  errorPolicy: internalOrchestrationErrorPolicy,
+  mapInput: ({ body }) => body,
+  useCase: readWorkspaceContext,
+})