feat: add shared ai workspace assistant service

infra/.env.example

@@ -52,3 +52,10 @@ NOTIFICATION_PG_DB=nodedc_notifications
 NOTIFICATION_PG_USER=nodedc_notifications
 NOTIFICATION_PG_PASS=change-me-generate-with-infra-scripts-init-dev-env
 NODEDC_NOTIFICATION_CORE_URL=http://notification-core:5185
+
+# AI Workspace Assistant shared registry/conversations
+AI_WORKSPACE_PG_DB=nodedc_ai_workspace
+AI_WORKSPACE_PG_USER=nodedc_ai_workspace
+AI_WORKSPACE_PG_PASS=change-me-generate-with-infra-scripts-init-dev-env
+AI_WORKSPACE_ASSISTANT_TOKEN=change-me-generate-with-infra-scripts-init-dev-env
+NODEDC_AI_WORKSPACE_ASSISTANT_URL=http://ai-workspace-assistant:18082

infra/docker-compose.dev.yml

@@ -20,6 +20,8 @@ services:
         condition: service_started
       ai-workspace-hub:
         condition: service_started
+      ai-workspace-assistant:
+        condition: service_started
     extra_hosts:
       - "host.docker.internal:host-gateway"
 
@@ -128,6 +130,46 @@ services:
       notification-postgres:
         condition: service_healthy
 
+  ai-workspace-postgres:
+    image: docker.io/library/postgres:16-alpine
+    restart: unless-stopped
+    env_file:
+      - path: .env
+        required: false
+    environment:
+      POSTGRES_DB: ${AI_WORKSPACE_PG_DB:-nodedc_ai_workspace}
+      POSTGRES_PASSWORD: ${AI_WORKSPACE_PG_PASS:-nodedc_ai_workspace}
+      POSTGRES_USER: ${AI_WORKSPACE_PG_USER:-nodedc_ai_workspace}
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
+      interval: 30s
+      timeout: 5s
+      retries: 5
+      start_period: 20s
+    volumes:
+      - ai-workspace-database:/var/lib/postgresql/data
+
+  ai-workspace-assistant:
+    image: nodedc/ai-workspace-assistant:local
+    build:
+      context: ../services/ai-workspace-assistant
+    restart: unless-stopped
+    env_file:
+      - path: .env
+        required: false
+    environment:
+      NODE_ENV: production
+      PORT: 18082
+      DATABASE_URL: postgres://${AI_WORKSPACE_PG_USER:-nodedc_ai_workspace}:${AI_WORKSPACE_PG_PASS:-nodedc_ai_workspace}@ai-workspace-postgres:5432/${AI_WORKSPACE_PG_DB:-nodedc_ai_workspace}
+      AI_WORKSPACE_ASSISTANT_TOKEN: ${AI_WORKSPACE_ASSISTANT_TOKEN:-dev-ai-workspace-assistant-token}
+    expose:
+      - "18082"
+    ports:
+      - "${AI_WORKSPACE_ASSISTANT_HOST_BIND:-127.0.0.1:18082}:18082"
+    depends_on:
+      ai-workspace-postgres:
+        condition: service_healthy
+
   ai-workspace-hub:
     image: nodedc/ai-workspace-hub:local
     build:
@@ -151,5 +193,6 @@ volumes:
   authentik-data:
   authentik-certs:
   notification-database:
+  ai-workspace-database:
   caddy-data:
   caddy-config:

infra/synology/.env.synology.example

@@ -57,5 +57,11 @@ NOTIFICATION_PG_USER=nodedc_notifications
 NOTIFICATION_PG_PASS=replace-with-random-synology-secret
 NODEDC_NOTIFICATION_CORE_URL=http://notification-core:5185
 
+AI_WORKSPACE_PG_DB=nodedc_ai_workspace
+AI_WORKSPACE_PG_USER=nodedc_ai_workspace
+AI_WORKSPACE_PG_PASS=replace-with-random-synology-secret
+AI_WORKSPACE_ASSISTANT_TOKEN=replace-with-random-synology-secret
+NODEDC_AI_WORKSPACE_ASSISTANT_URL=http://ai-workspace-assistant:18082
+
 AI_WORKSPACE_HUB_TOKEN=replace-with-random-synology-secret
 AI_WORKSPACE_HUB_HOST_BIND=0.0.0.0:18081

infra/synology/apply-current-runtime.sh

@@ -30,12 +30,16 @@ echo "== ai workspace hub image build =="
 cd "${PLATFORM_DIR}/ai-workspace-hub"
 "${DOCKER_BIN}" build --no-cache -t nodedc/ai-workspace-hub:local .
 
+echo "== ai workspace assistant image build =="
+cd "${PLATFORM_DIR}/ai-workspace-assistant"
+"${DOCKER_BIN}" build --no-cache -t nodedc/ai-workspace-assistant:local .
+
 echo "== platform services recreate =="
 cd "${PLATFORM_DIR}"
 "${DOCKER_BIN}" compose \
   --env-file "${ENV_FILE}" \
   -f "${COMPOSE_FILE}" \
-  up -d --force-recreate reverse-proxy authentik-server authentik-worker notification-postgres notification-core ai-workspace-hub launcher
+  up -d --force-recreate reverse-proxy authentik-server authentik-worker notification-postgres notification-core ai-workspace-postgres ai-workspace-assistant ai-workspace-hub launcher
 
 echo "== notification core health check =="
 "${DOCKER_BIN}" exec nodedc-platform-notification-core-1 sh -lc \
@@ -45,6 +49,10 @@ echo "== ai workspace hub health check =="
 "${DOCKER_BIN}" exec nodedc-platform-ai-workspace-hub-1 sh -lc \
   'node -e '"'"'fetch("http://127.0.0.1:18081/healthz").then(async (response) => { console.log(await response.text()); process.exit(response.ok ? 0 : 1); }).catch((error) => { console.error(error); process.exit(1); })'"'"''
 
+echo "== ai workspace assistant health check =="
+"${DOCKER_BIN}" exec nodedc-platform-ai-workspace-assistant-1 sh -lc \
+  'node -e '"'"'fetch("http://127.0.0.1:18082/healthz").then(async (response) => { console.log(await response.text()); process.exit(response.ok ? 0 : 1); }).catch((error) => { console.error(error); process.exit(1); })'"'"''
+
 echo "== clear authentik global brand css =="
 DOCKER_BIN="${DOCKER_BIN}" bash "${PLATFORM_DIR}/clear-authentik-brand-css.sh"
 

infra/synology/deploy-current.sh

@@ -51,6 +51,14 @@ rsync -av --delete \
   "${PLATFORM_REPO}/services/ai-workspace-hub/" \
   "${NAS_ROOT}/platform/ai-workspace-hub/"
 
+mkdir -p "${NAS_ROOT}/platform/ai-workspace-assistant"
+rsync -av --delete \
+  --exclude='node_modules/' \
+  --exclude='.env' \
+  --exclude='.env.*' \
+  "${PLATFORM_REPO}/services/ai-workspace-assistant/" \
+  "${NAS_ROOT}/platform/ai-workspace-assistant/"
+
 if [[ "${SYNC_AUTHENTIK_TEMPLATES}" == "1" ]]; then
   mkdir -p "${NAS_ROOT}/authentik/custom-templates"
   rsync -av --delete \
@@ -201,14 +209,14 @@ cd /volume1/docker/nodedc-platform/platform
 sudo /usr/local/bin/docker compose \
   --env-file /volume1/docker/nodedc-platform/platform/.env.synology \
   -f /volume1/docker/nodedc-platform/platform/docker-compose.platform-http.yml \
-  up -d --build --force-recreate --no-deps ai-workspace-hub notification-core launcher
+  up -d --build --force-recreate --no-deps ai-workspace-hub ai-workspace-assistant notification-core launcher
 
 Optional Platform/Auth infra apply, only after deliberate compose/proxy/Auth templates changes:
 
 sudo /usr/local/bin/docker compose \
   --env-file /volume1/docker/nodedc-platform/platform/.env.synology \
   -f /volume1/docker/nodedc-platform/platform/docker-compose.platform-http.yml \
-  up -d --build --force-recreate --no-deps reverse-proxy authentik-server authentik-worker ai-workspace-hub notification-core launcher
+  up -d --build --force-recreate --no-deps reverse-proxy authentik-server authentik-worker ai-workspace-hub ai-workspace-assistant notification-core launcher
 
 After Authentik template rollout, clear global Brand custom CSS from the live DB.
 NODE.DC login CSS must be template-scoped, not stored in Brand.branding_custom_css:

infra/synology/docker-compose.platform-http.yml

@@ -21,6 +21,8 @@ services:
         condition: service_started
       ai-workspace-hub:
         condition: service_started
+      ai-workspace-assistant:
+        condition: service_started
     extra_hosts:
       - "id.nodedc.ru:host-gateway"
       - "hub.nodedc.ru:host-gateway"
@@ -43,6 +45,7 @@ services:
       NODEDC_AUTHENTIK_BASE_URL: http://nodedc-platform-authentik-server:9000
       AUTHENTIK_BASE_URL: http://nodedc-platform-authentik-server:9000
       NODEDC_NOTIFICATION_CORE_URL: http://notification-core:5185
+      NODEDC_AI_WORKSPACE_ASSISTANT_URL: http://ai-workspace-assistant:18082
     expose:
       - "5173"
     volumes:
@@ -102,6 +105,50 @@ services:
       - identity
       - engine
 
+  ai-workspace-postgres:
+    image: postgres:16-alpine
+    restart: unless-stopped
+    env_file:
+      - ${NODEDC_SYNOLOGY_ENV_FILE:-.env.synology}
+    environment:
+      POSTGRES_DB: ${AI_WORKSPACE_PG_DB:-nodedc_ai_workspace}
+      POSTGRES_PASSWORD: ${AI_WORKSPACE_PG_PASS:?ai workspace database password required}
+      POSTGRES_USER: ${AI_WORKSPACE_PG_USER:-nodedc_ai_workspace}
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
+      interval: 30s
+      timeout: 5s
+      retries: 5
+      start_period: 20s
+    volumes:
+      - ai-workspace-database:/var/lib/postgresql/data
+    networks:
+      - identity
+
+  ai-workspace-assistant:
+    image: nodedc/ai-workspace-assistant:local
+    build:
+      context: ./ai-workspace-assistant
+    restart: unless-stopped
+    env_file:
+      - ${NODEDC_SYNOLOGY_ENV_FILE:-.env.synology}
+    environment:
+      NODE_ENV: production
+      PORT: 18082
+      DATABASE_URL: postgres://${AI_WORKSPACE_PG_USER:-nodedc_ai_workspace}:${AI_WORKSPACE_PG_PASS:?ai workspace database password required}@ai-workspace-postgres:5432/${AI_WORKSPACE_PG_DB:-nodedc_ai_workspace}
+      AI_WORKSPACE_ASSISTANT_TOKEN: ${AI_WORKSPACE_ASSISTANT_TOKEN:?ai workspace assistant token required}
+      NODEDC_INTERNAL_ACCESS_TOKEN: ${NODEDC_INTERNAL_ACCESS_TOKEN:-}
+    expose:
+      - "18082"
+    ports:
+      - "${AI_WORKSPACE_ASSISTANT_HOST_BIND:-127.0.0.1:18082}:18082"
+    depends_on:
+      ai-workspace-postgres:
+        condition: service_healthy
+    networks:
+      - identity
+      - engine
+
   ai-workspace-hub:
     image: nodedc/ai-workspace-hub:local
     build:
@@ -209,5 +256,6 @@ volumes:
   authentik-data:
   authentik-certs:
   notification-database:
+  ai-workspace-database:
   caddy-data:
   caddy-config:

infra/synology/verify-current-runtime.sh

@@ -59,6 +59,10 @@ echo "== ai workspace hub health check =="
 "${DOCKER_BIN}" exec nodedc-platform-ai-workspace-hub-1 sh -lc \
   'node -e '"'"'fetch("http://127.0.0.1:18081/healthz").then(async (response) => { console.log(await response.text()); process.exit(response.ok ? 0 : 1); }).catch((error) => { console.error(error); process.exit(1); })'"'"''
 
+echo "== ai workspace assistant health check =="
+"${DOCKER_BIN}" exec nodedc-platform-ai-workspace-assistant-1 sh -lc \
+  'node -e '"'"'fetch("http://127.0.0.1:18082/healthz").then(async (response) => { console.log(await response.text()); process.exit(response.ok ? 0 : 1); }).catch((error) => { console.error(error); process.exit(1); })'"'"''
+
 echo "== auth flow check =="
 auth_flow="$(fetch_with_retry https://id.nodedc.ru/if/flow/default-authentication-flow/)"
 printf '%s' "$auth_flow" \