bloby-bot 0.48.0 → 0.48.2

package/supervisor/index.ts

@@ -288,6 +288,17 @@ export async function startSupervisor() {
   let currentStreamConvId: string | null = null;
   let currentStreamBuffer = '';
 
+  // Workspace channel: SSE subscribers receive every chat event the dashboard widget WS
+  // clients receive. A subscriber is just a held-open HTTP response we write `data: ...\n\n`
+  // chunks to. Registered by `GET /api/agent/chat/stream`, used by `broadcastBloby` below.
+  interface ChatSubscriber {
+    id: string;
+    clientId?: string;
+    send: (type: string, data: any) => void;
+    close: () => void;
+  }
+  const chatSubscribers = new Set<ChatSubscriber>();
+
   /** Call worker API endpoints (in-process via supervisor's own HTTP server) */
   async function workerApi(apiPath: string, method = 'GET', body?: any) {
     const opts: RequestInit = { method, headers: { 'Content-Type': 'application/json', 'x-internal': internalSecret } };
@@ -296,12 +307,16 @@ export async function startSupervisor() {
     return res.json();
   }
 
-  /** Broadcast to all bloby WS clients EXCEPT sender */
+  /** Broadcast to all bloby chat surfaces EXCEPT the sender WS. Workspace SSE subscribers
+   *  always receive (sender is a WS, so no SSE collision). */
   function broadcastBlobyExcept(sender: WebSocket, type: string, data: any) {
     const msg = JSON.stringify({ type, data });
     for (const client of blobyWss.clients) {
       if (client !== sender && client.readyState === WebSocket.OPEN) client.send(msg);
     }
+    for (const sub of chatSubscribers) {
+      try { sub.send(type, data); } catch {}
+    }
   }
 
   // ── Auth middleware ──
@@ -376,6 +391,7 @@ export async function startSupervisor() {
     'POST /api/channels/whatsapp/pairing-code',
     'POST /api/channels/whatsapp/react',
     'POST /api/channels/send',
+    'POST /api/channels/alexa/handle',
   ];
 
   function isExemptRoute(method: string, url: string): boolean {
@@ -813,6 +829,296 @@ ${!connected ? `<script>
         return;
       }
 
+      // POST /api/channels/alexa/handle — relay-forwarded Alexa utterance.
+      // Authed via x-bloby-alexa-secret (per-user shared secret minted at pair time).
+      // Returns plain text the relay then formats as Alexa SSML.
+      if (req.method === 'POST' && channelPath === '/api/channels/alexa/handle') {
+        let body = '';
+        req.on('data', (chunk: Buffer) => { body += chunk.toString(); });
+        req.on('end', async () => {
+          try {
+            const cfg = loadConfig();
+            const expected = cfg.channels?.alexa?.sharedSecret;
+            const provided = req.headers['x-bloby-alexa-secret'];
+            if (!expected || !provided || provided !== expected) {
+              res.writeHead(401);
+              res.end(JSON.stringify({ ok: false, error: 'alexa-auth-failed' }));
+              return;
+            }
+            if (!cfg.channels?.alexa?.enabled) {
+              res.writeHead(503);
+              res.end(JSON.stringify({ ok: false, error: 'alexa-disabled' }));
+              return;
+            }
+
+            const { text, alexaUserId, sessionId, deviceId, locale, kind, apiEndpoint, apiAccessToken, requestId } = JSON.parse(body || '{}') as {
+              text?: string; alexaUserId?: string; sessionId?: string; deviceId?: string; locale?: string; kind?: string;
+              apiEndpoint?: string; apiAccessToken?: string; requestId?: string;
+            };
+
+            // Launch / Stop / Help intents don't need to hit the agent — the relay
+            // can short-circuit, but we accept them here too for symmetry.
+            if (kind === 'launch') {
+              res.writeHead(200);
+              res.end(JSON.stringify({ ok: true, reply: 'Morphy here, what can I help with?', endSession: false }));
+              return;
+            }
+            if (kind === 'stop' || kind === 'cancel') {
+              res.writeHead(200);
+              res.end(JSON.stringify({ ok: true, reply: 'Goodbye.', endSession: true }));
+              return;
+            }
+
+            if (!text || !alexaUserId) {
+              res.writeHead(400);
+              res.end(JSON.stringify({ ok: false, error: 'text and alexaUserId required' }));
+              return;
+            }
+
+            try {
+              const reply = await channelManager.handleAlexaInbound({
+                text, alexaUserId, alexaSessionId: sessionId, deviceId, locale,
+                apiEndpoint, apiAccessToken, requestId,
+              });
+              res.writeHead(200);
+              res.end(JSON.stringify({ ok: true, reply, endSession: false }));
+            } catch (err: any) {
+              // Timeout or aborted turn — agent will still finish and the result lands
+              // in the shared conversation. The agent is responsible for any
+              // out-of-band notification (HA announce, chat, WhatsApp) — that's
+              // a skill concern, not a supervisor concern.
+              res.writeHead(200);
+              res.end(JSON.stringify({
+                ok: true,
+                reply: "I'll reply in your chat when ready.",
+                endSession: false,
+                overflow: true,
+              }));
+            }
+          } catch (err: any) {
+            res.writeHead(500);
+            res.end(JSON.stringify({ ok: false, error: err.message }));
+          }
+        });
+        return;
+      }
+
+      // POST /api/channels/alexa/pair — dashboard mints a pairing code via the relay.
+      // Body: optional { ttlSeconds }. Returns: { code, expiresAt, sharedSecret }.
+      // We persist sharedSecret locally so future /handle calls can authenticate.
+      if (req.method === 'POST' && channelPath === '/api/channels/alexa/pair') {
+        (async () => {
+          try {
+            const cfg = loadConfig();
+            if (!cfg.relay?.token) {
+              res.writeHead(400);
+              res.end(JSON.stringify({ ok: false, error: 'no-relay-token' }));
+              return;
+            }
+            // The relay API always lives at api.bloby.bot — `cfg.relay.url` is the
+            // bot's public profile URL (e.g. https://bloby.bot/<handle>), not the API.
+            const resp = await fetch('https://api.bloby.bot/api/alexa/pair', {
+              method: 'POST',
+              headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${cfg.relay.token}`,
+              },
+              body: '{}',
+            });
+            const data = await resp.json() as { code?: string; expiresAt?: string; sharedSecret?: string; error?: string };
+            if (!resp.ok || !data.code || !data.sharedSecret) {
+              res.writeHead(resp.status || 500);
+              res.end(JSON.stringify({ ok: false, error: data.error || 'pair-failed' }));
+              return;
+            }
+
+            // Persist the shared secret + mark channel enabled so handleInbound is gated.
+            if (!cfg.channels) cfg.channels = {};
+            cfg.channels.alexa = {
+              ...(cfg.channels.alexa || {}),
+              enabled: true,
+              sharedSecret: data.sharedSecret,
+            };
+            saveConfig(cfg);
+            // Initialize the channel if it wasn't already running.
+            await channelManager.init().catch(() => {});
+
+            res.writeHead(200);
+            res.end(JSON.stringify({ ok: true, code: data.code, expiresAt: data.expiresAt }));
+          } catch (err: any) {
+            log.warn(`[alexa/pair] ${err.message}`);
+            res.writeHead(500);
+            res.end(JSON.stringify({ ok: false, error: err.message }));
+          }
+        })();
+        return;
+      }
+
+      // GET /api/channels/alexa/pair-page — inline HTML page showing the code with countdown.
+      // The chat surface auto-converts URLs ending in /pair-page into a button (see MessageBubble).
+      if (req.method === 'GET' && channelPath === '/api/channels/alexa/pair-page') {
+        res.setHeader('Content-Type', 'text/html');
+        const alexaStatus = channelManager.getStatus('alexa');
+        const alreadyLinked = !!(alexaStatus?.info as any)?.linked;
+        const confettiHTML = Array.from({ length: 30 }, (_, i) => {
+          const colors = ['#04D1FE', '#AF27E3', '#FB4072', '#4ade80', '#facc15', '#818cf8'];
+          const color = colors[Math.floor(Math.random() * colors.length)];
+          const left = Math.random() * 100;
+          const delay = i * 0.04;
+          const drift = (Math.random() - 0.5) * 120;
+          const duration = 1.8 + Math.random() * 0.8;
+          return `<div class="confetti-dot" style="left:${left}%;background:${color};animation-delay:${delay}s;animation-duration:${duration}s;--drift:${drift}px"></div>`;
+        }).join('');
+        res.writeHead(200);
+        res.end(`<!DOCTYPE html><html><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Connect Alexa</title>
+<link rel="preconnect" href="https://fonts.googleapis.com">
+<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600&family=Space+Grotesk:wght@600;700&display=swap" rel="stylesheet">
+<style>
+  *{margin:0;padding:0;box-sizing:border-box}
+  body{background:#212121;color:#f5f5f5;font-family:'Inter',system-ui,-apple-system,sans-serif;display:flex;flex-direction:column;align-items:center;justify-content:center;min-height:100dvh;margin:0;overflow-x:hidden}
+  .container{display:flex;flex-direction:column;align-items:center;max-width:380px;width:100%;padding:20px}
+
+  .card{background:#2a2a2a;border:1px solid rgba(255,255,255,0.08);border-radius:20px;padding:28px 24px;width:100%;box-shadow:0 0 0 1px rgba(175,39,227,0.1),0 0 20px -5px rgba(175,39,227,0.15);animation:fade-up .5s ease-out both;text-align:center}
+
+  .header{display:flex;flex-direction:column;align-items:center;gap:6px;margin-bottom:18px}
+  .badge-alexa{display:inline-flex;align-items:center;gap:6px;background:#1a1a1a;border:1px solid rgba(255,255,255,0.08);border-radius:9999px;padding:4px 10px;font-size:11px;color:#888;text-transform:uppercase;letter-spacing:0.6px}
+  .badge-alexa::before{content:'';width:8px;height:8px;border-radius:50%;background:linear-gradient(135deg,#04D1FE,#AF27E3);box-shadow:0 0 8px rgba(4,209,254,0.5)}
+  .title{font-family:'Space Grotesk',sans-serif;font-size:22px;font-weight:700;background:linear-gradient(135deg,#04D1FE,#AF27E3,#FB4072);-webkit-background-clip:text;-webkit-text-fill-color:transparent;background-clip:text;margin-top:6px}
+  .sub{font-size:13px;color:#999;line-height:1.6;margin-top:6px}
+
+  .code-block{margin:18px 0 6px;animation:fade-up .5s ease-out .15s both}
+  .code-label{font-size:11px;color:#666;text-transform:uppercase;letter-spacing:0.8px;margin-bottom:8px}
+  .code-value{font-family:'Space Grotesk',monospace;font-size:36px;font-weight:700;letter-spacing:8px;background:linear-gradient(135deg,#04D1FE,#AF27E3);-webkit-background-clip:text;-webkit-text-fill-color:transparent;background-clip:text;line-height:1.1}
+  .countdown{font-size:12px;color:#666;margin-top:10px;display:inline-flex;align-items:center;gap:6px}
+  .countdown.warn{color:#FB4072}
+  .countdown .dot{width:6px;height:6px;border-radius:50%;background:currentColor;animation:pulse 1.6s ease-in-out infinite;opacity:.6}
+
+  .quote-card{background:#1a1a1a;border:1px solid rgba(255,255,255,0.06);border-radius:12px;padding:14px 16px;margin:18px 0 6px;animation:fade-up .5s ease-out .25s both}
+  .quote-label{font-size:11px;color:#666;text-transform:uppercase;letter-spacing:0.6px;margin-bottom:6px}
+  .quote{font-size:15px;color:#f5f5f5;line-height:1.5;font-style:italic}
+  .quote .invocation{color:#04D1FE;font-style:normal;font-weight:600}
+  .quote .num{background:linear-gradient(135deg,#04D1FE,#AF27E3);-webkit-background-clip:text;-webkit-text-fill-color:transparent;background-clip:text;font-style:normal;font-weight:700;letter-spacing:2px}
+
+  .steps{text-align:left;margin-top:20px;animation:fade-up .5s ease-out .35s both}
+  .steps-title{font-size:11px;color:#666;text-transform:uppercase;letter-spacing:0.6px;margin-bottom:10px;text-align:center}
+  .step{display:flex;gap:12px;font-size:13px;color:#bbb;line-height:1.5;padding:6px 0}
+  .step-num{flex-shrink:0;width:22px;height:22px;border-radius:50%;background:#1a1a1a;border:1px solid rgba(255,255,255,0.08);display:flex;align-items:center;justify-content:center;font-size:11px;font-weight:600;color:#888}
+  .step b{color:#f5f5f5;font-weight:600}
+
+  .btn-row{display:flex;gap:10px;margin-top:20px;width:100%;animation:fade-up .5s ease-out .45s both}
+  .btn{flex:1;display:inline-flex;align-items:center;justify-content:center;border:none;border-radius:10px;padding:11px 16px;font-size:13px;font-weight:600;cursor:pointer;font-family:inherit;transition:all .2s}
+  .btn-primary{background:linear-gradient(135deg,#AF27E3,#FB4072);color:#fff}
+  .btn-primary:hover{opacity:.9}
+  .btn-primary:disabled{opacity:.5;cursor:not-allowed}
+  .btn-ghost{background:#1a1a1a;border:1px solid rgba(255,255,255,0.1);color:#999}
+  .btn-ghost:hover{border-color:rgba(175,39,227,0.4);color:#f5f5f5}
+
+  .err{color:#FB4072;font-size:13px;margin-top:14px;min-height:1.2em}
+
+  .confetti-wrap{position:fixed;top:0;left:0;width:100%;height:100%;pointer-events:none;overflow:hidden;z-index:0}
+  .confetti-dot{position:absolute;width:8px;height:8px;border-radius:50%;top:-10px;animation:confetti-fall 2s ease-out forwards}
+  @keyframes confetti-fall{0%{opacity:1;transform:translateY(0) translateX(0) rotate(0) scale(1)}100%{opacity:0;transform:translateY(100vh) translateX(var(--drift)) rotate(360deg) scale(.5)}}
+
+  .video-wrap{margin-bottom:8px;animation:pop-in .5s cubic-bezier(.34,1.56,.64,1) forwards}
+  .video-wrap video{width:200px;object-fit:contain;pointer-events:none}
+  @keyframes pop-in{0%{transform:scale(0);opacity:0}100%{transform:scale(1);opacity:1}}
+
+  .text-wrap{text-align:center;animation:fade-up .5s ease-out .3s both}
+  .success-sub{font-size:14px;color:#999;line-height:1.5;margin-top:6px}
+
+  @keyframes pulse{0%,100%{opacity:1;transform:scale(1)}50%{opacity:.4;transform:scale(.8)}}
+  @keyframes fade-up{0%{opacity:0;transform:translateY(10px)}100%{opacity:1;transform:translateY(0)}}
+</style></head><body>
+<div class="container" id="root">
+${alreadyLinked
+  ? `<div class="confetti-wrap">${confettiHTML}</div>
+<div class="video-wrap"><video autoplay muted playsinline><source src="/bloby_happy_reappearing.mov" type='video/mp4; codecs="hvc1"'><source src="/bloby_happy_reappearing.webm" type="video/webm"></video></div>
+<div class="text-wrap">
+  <div class="title">Connected!</div>
+  <p class="success-sub">Alexa is linked. Say <b style="color:#f5f5f5">"Alexa, open Morphy Agent"</b> to start a conversation, or <b style="color:#f5f5f5">"Alexa, tell Morphy Agent &lt;command&gt;"</b> for one-shots.</p>
+  <p class="success-sub" style="margin-top:14px;font-size:12px;color:#666">You can close this page.</p>
+</div>`
+  : `<div class="card" id="pendingCard">
+  <div class="header">
+    <span class="badge-alexa">Amazon Alexa</span>
+    <div class="title">Link your Alexa</div>
+    <p class="sub">Open the Alexa app and enable the <b style="color:#f5f5f5">Morphy Agent</b> skill, then say the phrase below.</p>
+  </div>
+
+  <div class="code-block">
+    <div class="code-label">Pairing code</div>
+    <div class="code-value" id="code">— — — — — —</div>
+    <div class="countdown" id="cd"><span class="dot"></span><span id="cdText">Generating code…</span></div>
+  </div>
+
+  <div class="quote-card">
+    <div class="quote-label">Say to Alexa</div>
+    <div class="quote">"<span class="invocation">Alexa, ask Morphy Agent to link with code</span> <span class="num" id="codeSpoken">———</span>"</div>
+  </div>
+
+  <div class="steps">
+    <div class="steps-title">How to link</div>
+    <div class="step"><div class="step-num">1</div><div>Open the <b>Alexa</b> app on your phone</div></div>
+    <div class="step"><div class="step-num">2</div><div>Find and enable the <b>Morphy Agent</b> skill</div></div>
+    <div class="step"><div class="step-num">3</div><div>Say the phrase above to your Alexa device</div></div>
+  </div>
+
+  <div class="btn-row">
+    <button class="btn btn-ghost" onclick="mint()">New code</button>
+  </div>
+  <p class="err" id="err"></p>
+</div>`}
+</div>
+<script>
+${alreadyLinked ? `` : `
+let expiresAt=0,timer=null;
+function fmt(n){return String(n).padStart(2,'0')}
+function tick(){
+  const s=Math.max(0,Math.round((expiresAt-Date.now())/1000));
+  const cd=document.getElementById('cd');
+  const txt=document.getElementById('cdText');
+  if(s>0){
+    txt.textContent='Expires in '+Math.floor(s/60)+':'+fmt(s%60);
+    cd.classList.toggle('warn',s<60);
+  }else{
+    txt.textContent='Expired — generate a new code';
+    cd.classList.add('warn');
+    if(timer){clearInterval(timer);timer=null}
+  }
+}
+async function mint(){
+  document.getElementById('err').textContent='';
+  document.getElementById('code').textContent='— — — — — —';
+  document.getElementById('codeSpoken').textContent='———';
+  document.getElementById('cdText').textContent='Generating code…';
+  document.getElementById('cd').classList.remove('warn');
+  try{
+    const r=await fetch('/api/channels/alexa/pair',{method:'POST',headers:{'Content-Type':'application/json'},body:'{}'});
+    const d=await r.json();
+    if(!d.ok){document.getElementById('err').textContent=d.error||'Failed to mint code';return}
+    document.getElementById('code').textContent=d.code.split('').join(' ');
+    document.getElementById('codeSpoken').textContent=d.code;
+    expiresAt=new Date(d.expiresAt).getTime();
+    if(timer)clearInterval(timer);
+    timer=setInterval(tick,1000);tick();
+  }catch(e){document.getElementById('err').textContent=e.message}
+}
+mint();
+`}
+</script>
+</body></html>`);
+        return;
+      }
+
+      // GET /api/channels/alexa/status — current alexa channel status
+      if (req.method === 'GET' && channelPath === '/api/channels/alexa/status') {
+        const status = channelManager.getStatus('alexa');
+        res.writeHead(200);
+        res.end(JSON.stringify(status || { channel: 'alexa', connected: false }));
+        return;
+      }
+
       // Fallback for unknown channel routes
       res.writeHead(404);
       res.end(JSON.stringify({ error: 'Not found' }));
@@ -869,27 +1175,43 @@ ${!connected ? `<script>
     }
 
     // ── Agent API — SDK gateway for workspace code ──
-    if (req.method === 'POST' && req.url?.startsWith('/api/agent/')) {
+    if (req.url?.startsWith('/api/agent/')) {
       const agentPath = req.url.split('?')[0];
-      res.setHeader('Content-Type', 'application/json');
-      res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate');
 
       // Localhost-only guard
       const remoteIp = req.socket.remoteAddress || '';
       if (remoteIp !== '127.0.0.1' && remoteIp !== '::1' && remoteIp !== '::ffff:127.0.0.1') {
+        res.setHeader('Content-Type', 'application/json');
         res.writeHead(403);
         res.end(JSON.stringify({ ok: false, error: 'Agent API is localhost-only.' }));
         return;
       }
 
-      // Auth: x-agent-secret header
-      if (req.headers['x-agent-secret'] !== agentSecret) {
+      // Auth: x-agent-secret header (query param fallback for EventSource which cannot set headers)
+      const urlObj = new URL(req.url, `http://${req.headers.host}`);
+      const headerSecret = req.headers['x-agent-secret'];
+      const querySecret = urlObj.searchParams.get('secret');
+      if (headerSecret !== agentSecret && querySecret !== agentSecret) {
+        res.setHeader('Content-Type', 'application/json');
         res.writeHead(401);
-        res.end(JSON.stringify({ ok: false, error: 'Invalid or missing x-agent-secret header.' }));
+        res.end(JSON.stringify({ ok: false, error: 'Invalid or missing x-agent-secret.' }));
         return;
       }
 
-      if (agentPath === '/api/agent/query') {
+      const readJsonBody = () => new Promise<any>((resolve, reject) => {
+        let body = '';
+        req.on('data', (chunk: Buffer) => { body += chunk.toString(); });
+        req.on('end', () => {
+          try { resolve(body ? JSON.parse(body) : {}); }
+          catch (err: any) { reject(err); }
+        });
+        req.on('error', reject);
+      });
+
+      // POST /api/agent/query — one-shot agent query (legacy AGENT-API.md endpoint)
+      if (req.method === 'POST' && agentPath === '/api/agent/query') {
+        res.setHeader('Content-Type', 'application/json');
+        res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate');
         let body = '';
         req.on('data', (chunk: Buffer) => { body += chunk.toString(); });
         req.on('end', async () => {
@@ -897,7 +1219,6 @@ ${!connected ? `<script>
             const parsed = JSON.parse(body) as AgentQueryRequest;
             const result = await handleAgentQuery(parsed);
 
-            // If the agent wrote files, restart backend + broadcast HMR
             if (result.usedFileTools) {
               resetBackendRestarts();
               stopBackend().then(() => spawnBackend(backendPort));
@@ -914,6 +1235,275 @@ ${!connected ? `<script>
         return;
       }
 
+      // ── Workspace channel: live-conversation mirror of the Bloby chat ──
+      // The workspace is a chat surface like the dashboard widget. Everything users
+      // see in the widget + WhatsApp is mirrored here; messages sent from workspace
+      // run through the SAME orchestrator with the SAME memory/agents/recent history.
+
+      // GET /api/agent/chat/stream — Server-Sent Events, every chat event (bot:*, chat:*)
+      if (req.method === 'GET' && agentPath === '/api/agent/chat/stream') {
+        const clientId = urlObj.searchParams.get('clientId') || undefined;
+        res.setHeader('Content-Type', 'text/event-stream');
+        res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate');
+        res.setHeader('Connection', 'keep-alive');
+        res.setHeader('X-Accel-Buffering', 'no');
+        res.writeHead(200);
+        res.write(': connected\n\n');
+
+        const sub: ChatSubscriber = {
+          id: crypto.randomBytes(8).toString('hex'),
+          clientId,
+          send: (type, data) => {
+            if (res.writableEnded) return;
+            res.write(`event: ${type}\ndata: ${JSON.stringify(data)}\n\n`);
+          },
+          close: () => { try { res.end(); } catch {} },
+        };
+        chatSubscribers.add(sub);
+
+        // Replay current streaming state so a late-joining workspace catches up mid-turn
+        if (agentQueryActive && currentStreamConvId) {
+          sub.send('chat:state', {
+            streaming: true,
+            conversationId: currentStreamConvId,
+            buffer: currentStreamBuffer,
+          });
+        }
+
+        const keepAlive = setInterval(() => {
+          if (res.writableEnded) return;
+          res.write(': ping\n\n');
+        }, 25_000);
+
+        req.on('close', () => {
+          clearInterval(keepAlive);
+          chatSubscribers.delete(sub);
+        });
+        return;
+      }
+
+      // GET /api/agent/chat/state — snapshot: convId + bot/user names + recent messages
+      if (req.method === 'GET' && agentPath === '/api/agent/chat/state') {
+        res.setHeader('Content-Type', 'application/json');
+        (async () => {
+          try {
+            const ctx = await workerApi('/api/context/current');
+            const convId: string | undefined = ctx.conversationId;
+            const [status, recentRaw] = await Promise.all([
+              workerApi('/api/onboard/status'),
+              convId ? workerApi(`/api/conversations/${convId}/messages/recent?limit=50`) : Promise.resolve([]),
+            ]);
+            const messages = Array.isArray(recentRaw)
+              ? recentRaw
+                  .filter((m: any) => m.role === 'user' || m.role === 'assistant')
+                  .map((m: any) => ({ role: m.role, content: m.content, timestamp: m.created_at }))
+              : [];
+            res.writeHead(200);
+            res.end(JSON.stringify({
+              ok: true,
+              conversationId: convId || null,
+              agentName: status?.agentName || 'Bloby',
+              userName: status?.userName || 'Human',
+              streaming: agentQueryActive,
+              streamConversationId: currentStreamConvId,
+              streamBuffer: currentStreamBuffer,
+              messages,
+            }));
+          } catch (err: any) {
+            res.writeHead(500);
+            res.end(JSON.stringify({ ok: false, error: err.message }));
+          }
+        })();
+        return;
+      }
+
+      // POST /api/agent/chat/message — push a user message into the shared conversation.
+      // Mirrors the chat-WS `user:message` flow: ensures live conversation, persists, pushes.
+      if (req.method === 'POST' && agentPath === '/api/agent/chat/message') {
+        res.setHeader('Content-Type', 'application/json');
+        (async () => {
+          try {
+            const body = await readJsonBody();
+            const content: string = body.content;
+            const clientId: string | undefined = body.clientId;
+            if (!content || typeof content !== 'string') {
+              res.writeHead(400);
+              res.end(JSON.stringify({ ok: false, error: 'Missing "content".' }));
+              return;
+            }
+
+            const freshConfig = loadConfig();
+            const provider = freshConfig.ai.provider;
+            if (provider !== 'anthropic' && provider !== 'openai' && provider !== 'pi') {
+              res.writeHead(400);
+              res.end(JSON.stringify({ ok: false, error: `Workspace chat requires a harnessed provider (got "${provider}").` }));
+              return;
+            }
+
+            let savedFiles: SavedFile[] = [];
+            if (Array.isArray(body.attachments) && body.attachments.length) {
+              for (const att of body.attachments) {
+                try { savedFiles.push(saveAttachment(att)); }
+                catch (err: any) { log.warn(`[workspace-chat] attachment save: ${err.message}`); }
+              }
+            }
+
+            let convId: string;
+            const ctx = await workerApi('/api/context/current');
+            if (ctx.conversationId) {
+              convId = ctx.conversationId;
+            } else {
+              const conv = await workerApi('/api/conversations', 'POST', { title: content.slice(0, 80), model: freshConfig.ai.model });
+              convId = conv.id;
+              await workerApi('/api/context/set', 'POST', { conversationId: convId });
+            }
+
+            const meta: any = { model: freshConfig.ai.model, channel: 'workspace' };
+            if (savedFiles.length) {
+              meta.attachments = JSON.stringify(savedFiles.map((f) => ({
+                type: f.type, name: f.name, mediaType: f.mediaType, filePath: f.relPath,
+              })));
+            }
+            try {
+              await workerApi(`/api/conversations/${convId}/messages`, 'POST', {
+                role: 'user', content, meta,
+              });
+            } catch (err: any) {
+              log.warn(`[workspace-chat] DB persist error: ${err.message}`);
+              broadcastBloby('chat:persist-error', { conversationId: convId, role: 'user', error: err.message });
+            }
+
+            // Echo user message to every OTHER surface (dashboard WS + other SSE subscribers).
+            // The originating workspace subscriber renders its own message optimistically.
+            broadcastBlobyExceptSubscriber(clientId, 'chat:sync', {
+              conversationId: convId,
+              message: { role: 'user', content, timestamp: new Date().toISOString() },
+            });
+
+            let botName = 'Bloby', humanName = 'Human';
+            let recentMessages: RecentMessage[] = [];
+            try {
+              const [status, recentRaw] = await Promise.all([
+                workerApi('/api/onboard/status'),
+                workerApi(`/api/conversations/${convId}/messages/recent?limit=20`),
+              ]);
+              botName = status.agentName || 'Bloby';
+              humanName = status.userName || 'Human';
+              if (Array.isArray(recentRaw)) {
+                const filtered = recentRaw.filter((m: any) => m.role === 'user' || m.role === 'assistant');
+                if (filtered.length > 0) {
+                  recentMessages = filtered.slice(0, -1).map((m: any) => ({
+                    role: m.role as 'user' | 'assistant',
+                    content: m.content,
+                  }));
+                }
+              }
+            } catch {}
+
+            if (!hasConversation(convId)) {
+              log.info(`[workspace-chat] Starting new live conversation: ${convId}`);
+              const waState = channelManager.createWaStreamState();
+              await startConversation(
+                convId,
+                freshConfig.ai.model,
+                createSharedChatOnMessage(convId, freshConfig.ai.model, botName, waState),
+                { botName, humanName },
+                recentMessages,
+              );
+            }
+
+            const agentAttachments = Array.isArray(body.attachments) && body.attachments.length
+              ? body.attachments
+              : undefined;
+
+            // Mirror to WhatsApp self-chat if connected (same behaviour as the widget).
+            const waStatus = channelManager.getStatus('whatsapp');
+            const ownPhone = waStatus?.connected ? (waStatus.info?.phoneNumber as string | undefined) : undefined;
+            const waMirrorTo = ownPhone ? `${ownPhone}@s.whatsapp.net` : undefined;
+
+            channelManager.pushWithRouting(
+              convId,
+              { surface: 'workspace', waSendTo: waMirrorTo, isSelfChat: true },
+              content,
+              agentAttachments,
+              savedFiles,
+            );
+
+            res.writeHead(200);
+            res.end(JSON.stringify({ ok: true, conversationId: convId }));
+          } catch (err: any) {
+            log.warn(`[workspace-chat] message error: ${err.message}`);
+            res.writeHead(500);
+            res.end(JSON.stringify({ ok: false, error: err.message }));
+          }
+        })();
+        return;
+      }
+
+      // POST /api/agent/chat/stop — interrupt the current turn (mirrors user:stop)
+      if (req.method === 'POST' && agentPath === '/api/agent/chat/stop') {
+        res.setHeader('Content-Type', 'application/json');
+        (async () => {
+          try {
+            const ctx = await workerApi('/api/context/current');
+            const convId: string | undefined = ctx.conversationId;
+            if (convId && hasConversation(convId)) {
+              log.info(`[workspace-chat] stop — ending live conversation ${convId}`);
+              endConversation(convId);
+            }
+            res.writeHead(200);
+            res.end(JSON.stringify({ ok: true }));
+          } catch (err: any) {
+            res.writeHead(500);
+            res.end(JSON.stringify({ ok: false, error: err.message }));
+          }
+        })();
+        return;
+      }
+
+      // POST /api/agent/chat/clear — clear context (mirrors user:clear-context)
+      if (req.method === 'POST' && agentPath === '/api/agent/chat/clear') {
+        res.setHeader('Content-Type', 'application/json');
+        (async () => {
+          try {
+            const ctx = await workerApi('/api/context/current');
+            const convId: string | undefined = ctx.conversationId;
+            if (convId && hasConversation(convId)) endConversation(convId);
+            await workerApi('/api/context/clear', 'POST');
+            broadcastBloby('chat:cleared', {});
+            res.writeHead(200);
+            res.end(JSON.stringify({ ok: true }));
+          } catch (err: any) {
+            res.writeHead(500);
+            res.end(JSON.stringify({ ok: false, error: err.message }));
+          }
+        })();
+        return;
+      }
+
+      // POST /api/agent/chat/whisper — transcribe audio via the same Whisper the widget uses
+      if (req.method === 'POST' && agentPath === '/api/agent/chat/whisper') {
+        res.setHeader('Content-Type', 'application/json');
+        (async () => {
+          try {
+            const body = await readJsonBody();
+            if (!body.audio || typeof body.audio !== 'string') {
+              res.writeHead(400);
+              res.end(JSON.stringify({ ok: false, error: 'Missing "audio" (base64).' }));
+              return;
+            }
+            const result = await workerApi('/api/whisper/transcribe', 'POST', { audio: body.audio });
+            res.writeHead(200);
+            res.end(JSON.stringify({ ok: !result.error, ...result }));
+          } catch (err: any) {
+            res.writeHead(500);
+            res.end(JSON.stringify({ ok: false, error: err.message }));
+          }
+        })();
+        return;
+      }
+
+      res.setHeader('Content-Type', 'application/json');
       res.writeHead(404);
       res.end(JSON.stringify({ ok: false, error: 'Unknown agent endpoint.' }));
       return;
@@ -1122,12 +1712,105 @@ ${!connected ? `<script>
     });
   });
 
-  /** Send a message to all connected bloby WS clients */
+  /** Send a message to every chat surface — dashboard widget WS clients AND workspace SSE
+   *  subscribers. The workspace mirror sees the exact same event stream the widget does. */
   function broadcastBloby(type: string, data: any = {}) {
     const msg = JSON.stringify({ type, data });
     for (const client of blobyWss.clients) {
       if (client.readyState === WebSocket.OPEN) client.send(msg);
     }
+    for (const sub of chatSubscribers) {
+      try { sub.send(type, data); } catch {}
+    }
+  }
+
+  /** Like broadcastBloby but skips the workspace SSE subscriber identified by clientId.
+   *  Used when the workspace itself originated the event — that subscriber renders the
+   *  event optimistically and shouldn't receive its own echo. */
+  function broadcastBlobyExceptSubscriber(excludeClientId: string | undefined, type: string, data: any) {
+    const msg = JSON.stringify({ type, data });
+    for (const client of blobyWss.clients) {
+      if (client.readyState === WebSocket.OPEN) client.send(msg);
+    }
+    for (const sub of chatSubscribers) {
+      if (excludeClientId && sub.clientId === excludeClientId) continue;
+      try { sub.send(type, data); } catch {}
+    }
+  }
+
+  /** Build the onMessage handler used by EVERY surface that pushes into the shared live
+   *  conversation. Chat-WS, the workspace SSE channel, and (in spirit) the channel manager
+   *  all want the same wiring: track stream buffer for late joiners, route streaming text
+   *  via the manager's per-conversation routing FIFO, persist responses, defer backend
+   *  restarts, and broadcast every event to all chat surfaces.
+   *
+   *  Factored so adding a new surface (here: workspace) cannot drift from the chat WS
+   *  behaviour — same buffer, same persistence, same restart timing. */
+  function createSharedChatOnMessage(
+    convId: string,
+    model: string,
+    botName: string,
+    waState: ReturnType<typeof channelManager.createWaStreamState>,
+  ) {
+    return async (type: string, eventData: any) => {
+      if (type === 'bot:typing') {
+        currentStreamConvId = convId;
+        currentStreamBuffer = '';
+        agentQueryActive = true;
+      }
+      if (type === 'bot:token' && eventData.token) {
+        currentStreamBuffer += eventData.token;
+      }
+
+      channelManager.routeWaStreamEvent(waState, type, eventData, botName);
+
+      if (type === 'bot:turn-complete') {
+        log.info(`[orchestrator] ──── TURN COMPLETE ────`);
+        log.info(`[orchestrator] File tools used: ${eventData.usedFileTools}`);
+        agentQueryActive = false;
+        currentStreamConvId = null;
+        currentStreamBuffer = '';
+
+        if (eventData.usedFileTools || pendingBackendRestart) {
+          log.info('[orchestrator] Restarting backend (file tools used)');
+          pendingBackendRestart = false;
+          if (backendRestartTimer) { clearTimeout(backendRestartTimer); backendRestartTimer = null; }
+          resetBackendRestarts();
+          stopBackend().then(() => spawnBackend(backendPort));
+        }
+        if (pendingUpdate) {
+          pendingUpdate = false;
+          log.info('[orchestrator] Ending conversation before update...');
+          endConversation(convId);
+          runDeferredUpdate();
+        }
+        broadcastBloby('bot:idle', { conversationId: convId });
+        return;
+      }
+
+      if (type === 'bot:conversation-ended') {
+        log.info(`[orchestrator] Conversation ended: ${convId}`);
+        agentQueryActive = false;
+        currentStreamConvId = null;
+        currentStreamBuffer = '';
+        channelManager.clearRoutes(convId);
+        return;
+      }
+
+      if (type === 'bot:response') {
+        currentStreamBuffer = '';
+        try {
+          await workerApi(`/api/conversations/${convId}/messages`, 'POST', {
+            role: 'assistant', content: eventData.content, meta: { model },
+          });
+        } catch (err: any) {
+          log.warn(`[bloby] DB persist bot response error: ${err.message}`);
+          broadcastBloby('chat:persist-error', { conversationId: convId, role: 'assistant', error: err.message });
+        }
+      }
+
+      broadcastBloby(type, eventData);
+    };
   }
 
   blobyWss.on('connection', (ws) => {
@@ -1446,93 +2129,19 @@ ${!connected ? `<script>
             log.info(`[orchestrator] Conv: ${convId}`);
             log.info(`[orchestrator] Live conversation exists: ${hasConversation(convId)}`);
 
-            // Start a live conversation if one doesn't exist
+            // Start a live conversation if one doesn't exist. The onMessage handler is
+            // shared with the workspace channel — both surfaces push into the same conv
+            // and observe the same events.
             if (!hasConversation(convId)) {
               log.info(`[orchestrator] Starting new live conversation...`);
-
-              // Per-conversation WhatsApp streaming state. The manager owns the
-              // routing decision: if a WhatsApp inbound message is the trigger
-              // for this turn, it sends to that chat; otherwise it falls back to
-              // the self-chat mirror (the user's own number).
               const waState = channelManager.createWaStreamState();
-
-              await startConversation(convId, freshConfig.ai.model, async (type, eventData) => {
-                // Track stream buffer for reconnecting clients
-                if (type === 'bot:typing') {
-                  currentStreamConvId = convId;
-                  currentStreamBuffer = '';
-                  agentQueryActive = true;
-                }
-
-                if (type === 'bot:token' && eventData.token) {
-                  currentStreamBuffer += eventData.token;
-                }
-
-                // Route streaming text via the manager's per-conversation routing FIFO.
-                // The destination was decided at pushWithRouting time — this is purely a
-                // dispatcher and cannot bleed events to the wrong surface.
-                channelManager.routeWaStreamEvent(waState, type, eventData, botName);
-
-                // Agent finished a turn — handle backend restart + notify client
-                if (type === 'bot:turn-complete') {
-                  log.info(`[orchestrator] ──── TURN COMPLETE ────`);
-                  log.info(`[orchestrator] File tools used: ${eventData.usedFileTools}`);
-                  agentQueryActive = false;
-                  currentStreamConvId = null;
-                  currentStreamBuffer = '';
-
-                  if (eventData.usedFileTools || pendingBackendRestart) {
-                    log.info('[orchestrator] Restarting backend (file tools used)');
-                    pendingBackendRestart = false;
-                    if (backendRestartTimer) { clearTimeout(backendRestartTimer); backendRestartTimer = null; }
-                    resetBackendRestarts();
-                    stopBackend().then(() => spawnBackend(backendPort));
-                  }
-                  if (pendingUpdate) {
-                    pendingUpdate = false;
-                    // End the live conversation before updating — SDK child processes
-                    // must be cleaned up or process.exit() may not terminate cleanly
-                    log.info('[orchestrator] Ending conversation before update...');
-                    endConversation(convId);
-                    runDeferredUpdate();
-                  }
-                  // Tell the client the agent is idle — streaming can stop
-                  broadcastBloby('bot:idle', { conversationId: convId });
-                  return;
-                }
-
-                // Conversation ended (query loop exited)
-                if (type === 'bot:conversation-ended') {
-                  log.info(`[orchestrator] Conversation ended: ${convId}`);
-                  agentQueryActive = false;
-                  currentStreamConvId = null;
-                  currentStreamBuffer = '';
-                  channelManager.clearRoutes(convId);
-                  return;
-                }
-
-                // Save assistant response to DB BEFORE broadcasting so a refresh
-                // immediately after the bubble appears can't race the INSERT and lose
-                // the message. addMessage() in worker/db.ts is self-healing —
-                // it INSERT OR IGNOREs the parent conversation row first, so even an
-                // orphan convId persists cleanly.
-                if (type === 'bot:response') {
-                  currentStreamBuffer = '';
-                  try {
-                    await workerApi(`/api/conversations/${convId}/messages`, 'POST', {
-                      role: 'assistant', content: eventData.content, meta: { model: freshConfig.ai.model },
-                    });
-                  } catch (err: any) {
-                    log.warn(`[bloby] DB persist bot response error: ${err.message}`);
-                    // Tell clients the bubble they're about to see is not durable —
-                    // they can flag/retry rather than silently losing it on refresh.
-                    broadcastBloby('chat:persist-error', { conversationId: convId, role: 'assistant', error: err.message });
-                  }
-                }
-
-                // Stream all events to every connected client
-                broadcastBloby(type, eventData);
-              }, { botName, humanName }, recentMessages);
+              await startConversation(
+                convId,
+                freshConfig.ai.model,
+                createSharedChatOnMessage(convId, freshConfig.ai.model, botName, waState),
+                { botName, humanName },
+                recentMessages,
+              );
             }
 
             // Push the user message into the live conversation with a pinned routing