Add isolated spaces for bot teams

.gitignore

@@ -1,5 +1,7 @@
 .deepsec/
 node_modules
+__pycache__/
+*.py[cod]
 .turbo
 dist
 build

apps/api/src/agent-skills.ts

@@ -116,7 +116,7 @@ export function createAgentSkillsService(prisma: PrismaClient) {
     const row = await prisma.agentSkill.findFirst({
       where: {
         id: skillId,
-        workspaceId: actor.workspaceId,
+        spaceId: actor.spaceId,
         userId: actor.userId,
       },
     });
@@ -127,7 +127,7 @@ export function createAgentSkillsService(prisma: PrismaClient) {
   return {
     async list(actor: Actor): Promise<Omit<AgentSkill, "content">[]> {
       const rows = await prisma.agentSkill.findMany({
-        where: { workspaceId: actor.workspaceId, userId: actor.userId },
+        where: { spaceId: actor.spaceId, userId: actor.userId },
         orderBy: [{ name: "asc" }, { id: "asc" }],
       });
       const catalog = [...builtinCatalog(), ...rows.map(mapAgentSkill)].map(
@@ -138,7 +138,7 @@ export function createAgentSkillsService(prisma: PrismaClient) {
 
     async listWithContent(actor: Actor): Promise<AgentSkill[]> {
       const rows = await prisma.agentSkill.findMany({
-        where: { workspaceId: actor.workspaceId, userId: actor.userId },
+        where: { spaceId: actor.spaceId, userId: actor.userId },
         orderBy: [{ name: "asc" }, { id: "asc" }],
       });
       return [...builtinCatalog(), ...rows.map(mapAgentSkill)];
@@ -160,7 +160,7 @@ export function createAgentSkillsService(prisma: PrismaClient) {
       if (builtin) return builtin;
       const row = await prisma.agentSkill.findFirst({
         where: {
-          workspaceId: actor.workspaceId,
+          spaceId: actor.spaceId,
           userId: actor.userId,
           name: { equals: name, mode: "insensitive" },
         },
@@ -176,7 +176,7 @@ export function createAgentSkillsService(prisma: PrismaClient) {
       const resolved = resolveSkillContent(input);
       const clash = await prisma.agentSkill.findFirst({
         where: {
-          workspaceId: actor.workspaceId,
+          spaceId: actor.spaceId,
           userId: actor.userId,
           name: { equals: resolved.name, mode: "insensitive" },
         },
@@ -190,7 +190,7 @@ export function createAgentSkillsService(prisma: PrismaClient) {
       try {
         const row = await prisma.agentSkill.create({
           data: {
-            workspaceId: actor.workspaceId,
+            spaceId: actor.spaceId,
             userId: actor.userId,
             name: resolved.name,
             description: resolved.description,
@@ -229,7 +229,7 @@ export function createAgentSkillsService(prisma: PrismaClient) {
       if (resolved.name.toLowerCase() !== existing.name.toLowerCase()) {
         const clash = await prisma.agentSkill.findFirst({
           where: {
-            workspaceId: actor.workspaceId,
+            spaceId: actor.spaceId,
             userId: actor.userId,
             name: { equals: resolved.name, mode: "insensitive" },
             NOT: { id: existing.id },
@@ -247,7 +247,7 @@ export function createAgentSkillsService(prisma: PrismaClient) {
         const updated = await prisma.agentSkill.updateMany({
           where: {
             id: existing.id,
-            workspaceId: actor.workspaceId,
+            spaceId: actor.spaceId,
             userId: actor.userId,
             source: "user",
           },
@@ -272,7 +272,7 @@ export function createAgentSkillsService(prisma: PrismaClient) {
       const row = await prisma.agentSkill.findFirst({
         where: {
           id: existing.id,
-          workspaceId: actor.workspaceId,
+          spaceId: actor.spaceId,
           userId: actor.userId,
         },
       });
@@ -288,7 +288,7 @@ export function createAgentSkillsService(prisma: PrismaClient) {
       const deleted = await prisma.agentSkill.deleteMany({
         where: {
           id: existing.id,
-          workspaceId: actor.workspaceId,
+          spaceId: actor.spaceId,
           userId: actor.userId,
           source: "user",
         },

apps/api/src/app.ts

@@ -46,8 +46,8 @@ import {
   type RemoteConnectorDependencies,
   ScriptedAgentRuntime,
   SendBlueMessagingProvider,
+  SpaceMemoryProviderResolver,
   sendBlueConfigFromEnv,
-  WorkspaceMemoryProviderResolver,
 } from "@rakazo/adapters";
 import { blockedAuthPaths, createAuth } from "@rakazo/auth";
 import { signupPolicyFromEnv } from "@rakazo/core";
@@ -159,7 +159,7 @@ export async function createApp(
     prisma,
   });
   const mcpOAuth = new McpOAuthBroker(prisma, secrets, remoteConnectors);
-  const memoryProviders = new WorkspaceMemoryProviderResolver(prisma, secrets);
+  const memoryProviders = new SpaceMemoryProviderResolver(prisma, secrets);
   const oauthLogins = new PiOAuthLogins();
   const home = new LocalAgentHomeStore(env.dataDir);
   const artifacts = new LocalArtifactStore(env.dataDir);
@@ -215,7 +215,7 @@ export async function createApp(
     beforeDeleteUser: async (userId) => {
       const bots = await prisma.bot.findMany({
         where: { userId },
-        select: { id: true, workspaceId: true, name: true, archivedAt: true },
+        select: { id: true, spaceId: true, name: true, archivedAt: true },
       });
       await Promise.all(
         bots.map((bot) =>
@@ -225,7 +225,7 @@ export async function createApp(
             {
               operationId: `account-delete:${userId}`,
               traceId: `account-delete:${userId}`,
-              workspaceId: bot.workspaceId,
+              spaceId: bot.spaceId,
               userId,
               botId: bot.id,
               signal: new AbortController().signal,
@@ -333,8 +333,9 @@ export async function createApp(
   });
   app.use("/rpc/*", async (c, next) => {
     const session = await auth.api.getSession({ headers: sessionHeaders(c.req.raw) });
+    const requestedSpaceId = c.req.header("x-rakazo-space-id");
     const actor = session?.user
-      ? await requireMembership(prisma, session.user.id).catch(() => null)
+      ? await requireMembership(prisma, session.user.id, requestedSpaceId).catch(() => null)
       : null;
     const { matched, response } = await rpc.handle(c.req.raw, {
       prefix: "/rpc",
@@ -346,7 +347,9 @@ export async function createApp(
   mountVoiceHttpRoutes(app, { prisma, secrets }, async (c) => {
     const session = await auth.api.getSession({ headers: sessionHeaders(c.req.raw) });
     if (!session?.user) return null;
-    return requireMembership(prisma, session.user.id).catch(() => null);
+    return requireMembership(prisma, session.user.id, c.req.header("x-rakazo-space-id")).catch(
+      () => null,
+    );
   });
   mountWebhookHttpRoutes(app, { prisma, secrets, events, jobs });
   // The phone webhook only exists when the messaging surface is enabled.
@@ -376,7 +379,7 @@ export async function createApp(
               {
                 operationId,
                 traceId: operationId,
-                workspaceId: "",
+                spaceId: "",
                 userId: "",
                 // Cosmetic side call: bound it so a stalled vendor response
                 // can never pin the webhook handler's event loop slot.

apps/api/src/artifacts.ts

@@ -15,7 +15,7 @@ function adapterContext(actor: Actor, botId: string, operationId: string) {
   return {
     operationId,
     traceId: operationId,
-    workspaceId: actor.workspaceId,
+    spaceId: actor.spaceId,
     userId: actor.userId,
     botId,
     signal: new AbortController().signal,
@@ -47,7 +47,7 @@ export async function createOwnedArtifact(
   const row = await deps.prisma.artifact
     .create({
       data: {
-        workspaceId: actor.workspaceId,
+        spaceId: actor.spaceId,
         userId: actor.userId,
         botId: input.botId,
         groupId: input.groupId,
@@ -87,15 +87,15 @@ export async function getOwnedArtifact(
       id: input.artifactId,
       botId: input.botId,
       groupId: null,
-      workspaceId: actor.workspaceId,
+      spaceId: actor.spaceId,
       userId: actor.userId,
     },
   });
   if (!row) throw new IsolationError();
   return readArtifact(deps.artifacts, actor, row, input.botId);
 }
 
-export async function getWorkspaceArtifact(
+export async function getSpaceArtifact(
   deps: {
     prisma: PrismaClient;
     artifacts: ArtifactStore;
@@ -107,7 +107,7 @@ export async function getWorkspaceArtifact(
     where: {
       id: input.artifactId,
       groupId: input.groupId,
-      workspaceId: actor.workspaceId,
+      spaceId: actor.spaceId,
       userId: actor.userId,
     },
   });
@@ -193,7 +193,7 @@ export async function resolveSendAttachments(
       id: { in: ids },
       botId,
       groupId: null,
-      workspaceId: actor.workspaceId,
+      spaceId: actor.spaceId,
       userId: actor.userId,
     },
   });
@@ -213,7 +213,7 @@ export async function resolveGroupSendAttachments(
   const rows = await deps.prisma.artifact.findMany({
     where: {
       id: { in: ids },
-      workspaceId: actor.workspaceId,
+      spaceId: actor.spaceId,
       userId: actor.userId,
       OR: [
         { groupId },

apps/api/src/onboarding.ts

@@ -79,7 +79,7 @@ const APP_NAMES: Record<string, string> = {
 
 async function requireBotThread(deps: OnboardingDeps, actor: Actor, botId: string) {
   const bot = await deps.prisma.bot.findFirst({
-    where: { id: botId, workspaceId: actor.workspaceId, userId: actor.userId },
+    where: { id: botId, spaceId: actor.spaceId, userId: actor.userId },
     include: { thread: true },
   });
   if (!bot?.thread) throw new IsolationError();
@@ -88,7 +88,7 @@ async function requireBotThread(deps: OnboardingDeps, actor: Actor, botId: strin
 
 async function post(
   deps: OnboardingDeps,
-  target: { workspaceId: string; botId: string; threadId: string },
+  target: { spaceId: string; botId: string; threadId: string },
   blocks: MessageBlock[],
 ): Promise<string> {
   const message = await createThreadMessage(deps.prisma, {
@@ -97,7 +97,7 @@ async function post(
     blocks,
   });
   await deps.events.append({
-    workspaceId: target.workspaceId,
+    spaceId: target.spaceId,
     threadId: target.threadId,
     botId: target.botId,
     type: "thread.message.created",
@@ -108,13 +108,13 @@ async function post(
 
 async function updateBlocks(
   deps: OnboardingDeps,
-  target: { workspaceId: string; botId: string; threadId: string },
+  target: { spaceId: string; botId: string; threadId: string },
   messageId: string,
   blocks: MessageBlock[],
 ): Promise<void> {
   await deps.prisma.message.update({ where: { id: messageId }, data: { blocks } });
   await deps.events.append({
-    workspaceId: target.workspaceId,
+    spaceId: target.spaceId,
     threadId: target.threadId,
     botId: target.botId,
     type: "thread.message.updated",
@@ -135,7 +135,7 @@ export async function startOnboarding(
     select: { name: true },
   });
   const firstName = (user?.name ?? "there").split(/\s+/)[0];
-  const target = { workspaceId: actor.workspaceId, botId: bot.id, threadId: thread.id };
+  const target = { spaceId: actor.spaceId, botId: bot.id, threadId: thread.id };
   await post(deps, target, [
     { kind: "text", text: `Hey ${firstName}. Fresh start on my side, so I’ll keep this short.` },
   ]);
@@ -157,7 +157,7 @@ export async function chooseFocus(
   const option = FOCUS_OPTIONS.find((entry) => entry.id === optionId);
   if (!option) throw new IsolationError();
   const { bot, thread } = await requireBotThread(deps, actor, botId);
-  const target = { workspaceId: actor.workspaceId, botId: bot.id, threadId: thread.id };
+  const target = { spaceId: actor.spaceId, botId: bot.id, threadId: thread.id };
 
   const recent = await deps.prisma.message.findMany({
     where: { threadId: thread.id },
@@ -186,7 +186,7 @@ export async function chooseFocus(
         .catalog({
           operationId: "onboarding.choose",
           traceId: "onboarding.choose",
-          workspaceId: actor.workspaceId,
+          spaceId: actor.spaceId,
           userId: actor.userId,
           botId: bot.id,
           signal: new AbortController().signal,
@@ -231,7 +231,7 @@ export async function markAppConnected(
   provider: string,
 ): Promise<void> {
   const { bot, thread } = await requireBotThread(deps, actor, botId);
-  const target = { workspaceId: actor.workspaceId, botId: bot.id, threadId: thread.id };
+  const target = { spaceId: actor.spaceId, botId: bot.id, threadId: thread.id };
   const messages = await deps.prisma.message.findMany({
     where: { threadId: thread.id },
     select: { id: true, blocks: true },

apps/api/src/persist-memory-provider-config.test.ts

@@ -3,7 +3,7 @@ import { persistMemoryProviderConfig, updateMemoryProviderDefaultScope } from ".
 
 const actor = {
   userId: "user-1",
-  workspaceId: "ws-1",
+  spaceId: "ws-1",
   email: "a@b.com",
   isDeploymentOwner: false,
 };
@@ -23,7 +23,7 @@ function makeDeps(
       defaultMemoryScope: string;
       updatedAt: Date;
     };
-    workspaceOwner?: boolean;
+    spaceOwner?: boolean;
     memberRole?: string;
   } = {},
 ) {
@@ -47,14 +47,14 @@ function makeDeps(
     },
   );
   const prisma = {
-    member: {
-      findFirst: vi
+    spaceMember: {
+      findUnique: vi
         .fn()
         .mockResolvedValue(
-          overrides.workspaceOwner === false ? null : { role: overrides.memberRole ?? "owner" },
+          overrides.spaceOwner === false ? null : { role: overrides.memberRole ?? "owner" },
         ),
     },
-    workspaceMemoryConfig: { findUnique, update, upsert },
+    spaceMemoryConfig: { findUnique, update, upsert },
     secret: { create: secretCreate, deleteMany: secretDeleteMany },
     $transaction: vi.fn(),
   };
@@ -86,10 +86,10 @@ function connectionInput(mode: "cloud" | "local", baseUrl?: string) {
 }
 
 describe("persistMemoryProviderConfig", () => {
-  it("rejects non-owners before probing or writing workspace configuration", async () => {
+  it("rejects non-owners before probing or writing Space configuration", async () => {
     const fetchMock = vi.fn();
     vi.stubGlobal("fetch", fetchMock);
-    const { deps, upsert } = makeDeps({ workspaceOwner: false });
+    const { deps, upsert } = makeDeps({ spaceOwner: false });
 
     await expect(
       persistMemoryProviderConfig(deps as never, actor, connectionInput("cloud")),
@@ -163,7 +163,7 @@ describe("persistMemoryProviderConfig", () => {
     );
     expect(upsert).toHaveBeenCalledWith(
       expect.objectContaining({
-        where: { workspaceId: "ws-1" },
+        where: { spaceId: "ws-1" },
         create: expect.objectContaining({
           provider: "supermemory",
           settings: { mode: "cloud", baseUrl: "https://api.supermemory.ai" },
@@ -225,7 +225,7 @@ describe("updateMemoryProviderDefaultScope", () => {
   it("rejects non-owners without updating provider configuration", async () => {
     const { deps, update } = makeDeps({
       existing: { id: "cfg-1", secretId: "secret-existing" },
-      workspaceOwner: false,
+      spaceOwner: false,
     });
 
     await expect(