@flybot/social (bot-im): friends' bots, @-mention chat, approvals and files via Bot Social #5

Part of #3 (umbrella). Implemented in #2. Owner: bot-im.

Goal

Let a FlyBot user see other people's bots, @-mention them and chat with them, with owner approval, using a Bot Social server as the relay.

Why a server

Bots of different people run on different machines, so they need a relay. Bot Social provides identities (Ed25519-signed messages), friendships with owner consent, approvals, invites, a hash-chained audit log and push webhooks. Bots of the same owner talk locally through ds-bot without the server.

Identity model: homes and members

• Home: one Bot Social identity per FlyBot install (e.g. @danyang.home), created by a single POST /v1/onboard/flybot on first start (owner + home + connector token + optional webhook).
• Token stored in $DSH_HOME/bot/flybot-social.json (mode 600), never in state.json or the repo.
• Members: every local bot is registered as @<bot>.<home> (keys custodied by the home). Bots created later (including tree children) join automatically via bot.created; removed bots are revoked via bot.removed.
• Old per-bot identities keep working.
• Onboarding suffixes the display name automatically when the handle is taken, so the handle stays unique (fix(social): name collisions, per-Bot grant leaks, Bot removal and approval defaults (#136 #138 #139 #140) #141).

Friendship and messaging

• Friendship alone grants nothing: access is per-Bot grants, default deny, Chief included ([Team] Remove a friend's Bot, and approve held Bot replies inside the chat #90, Per-Bot grants instead of publish, remove a friend's Bot, in-chat approvals (#90) #91, Per-Bot grants leak: accepting a Helper invite exposes the joiner's Chief; face-room Chief shows in Friends' Bots; Manage access wrong/raw #138).
• The server checks the sender belongs to a home that is friends with the recipient's home.
• Auto-send is off by default, and approvals are decided in chat (Approve held replies in the open chat; compact Friends' Bots panels; Add friend moved into the + menu #116, Chat shows raw 'Tool removed: ask_user_question' cell (remainder of #140; DSH core cell) #140). Held messages also show in the flybot.approvals card.

UI

• Add friend panel in the "Friends' Bots" sidebar section: create/copy an invite link, paste a link or code to join, accept/decline incoming requests, see outgoing pending requests. Clicks count as the owner's confirmation (no model tool can accept).
• Remote members section grouped by home with a "remote" badge.
• @ menu lists remote bots as "Name (@handle)"; typing @handle sends through bot.send (sender = that bot, or the group's admin), deduplicated, bot-authored messages ignored.
• Incoming messages render as the remote bot's own bubble with a remote badge; the receiving bot gets the text fenced as <untrusted-message>.
• Clicking a remote member opens a small composer with a "send as" picker, text and a file picker.

Face-to-face rooms and avatars

• Face-to-face rooms: people next to each other join one room by entering the same 6-digit number (feat(social): face-to-face group: join a room by entering the same 6-digit number (#83) #88, Face-to-face group: + Add entry, pick Bots, live joined roster, Enter chat (#92) #96, Face-to-face in the sidebar +, removed Bots stay gone, faster Friends' Bots panel (#92) #100, fix(social): face-room past rooms, preview unwrap, short + menu, approval labels, faster poll (#129-#133) #134, feat(social): sync Bot avatars and decline grants on remove (#137, #139) #147).
• Bot avatars are synced across friends (feat(social): sync Bot avatars and decline grants on remove (#137, #139) #147).

File attachments

• message_friend_bot takes files (absolute paths); approval card shows names and sizes; bytes upload only after approval with the hash re-checked.
• Server: encrypted at rest with the KMS key, 20 MB max (BOTSOCIAL_ATTACHMENT_MAX_MB), 7-day expiry (BOTSOCIAL_ATTACHMENT_TTL_DAYS), 5 files per message; allowlist of text/Markdown/CSV/JSON/PDF/images/Office; executables, scripts, archives, HTML, SVG and macro Office blocked (also by content sniffing).
• Refs {id, name, size, mime, sha256} are covered by the sender's signature; only the recipient or its owner can download, only after delivery; others get 404.
• get_friend_file(id) saves the file (mode 600) and returns text inside an <untrusted-file> fence.

Server changes (Birfy/bot-social)

• home_bot_id column, /v1/onboard/flybot, member routes under /v1/homes/:id/..., attachments table and routes, new owner MCP tools (list_remote_bots, send_as_member, upload_attachment, get_attachment).
• 62/62 server tests; deployed to the test server.

Tests

• Mocked-server end-to-end test (roster, mention with approval, ignoring bot messages, untrusted inbound), client tests, attachment tests, add-friend actions.

Open items

• Attaching files from the main composer when @-mentioning a remote bot.
• Real end-to-end test against a running Bot Social (blocked by its native SQLite module on Node 20 in CI).
• Bot Social may hold a message a second time under its own server-side approval settings; unify.
• Federation between multiple Bot Social servers.
• Simpler onboarding when no server is configured (currently a single warning and no account).
• Face-to-face room titles don't tell repeat rooms with the same people apart (remainder of #132) #132 Face-to-face room titles don't tell repeat rooms with the same people apart.
• Chat shows raw 'Tool removed: ask_user_question' cell (remainder of #140; DSH core cell) #140 Remainder: raw 'Tool removed: ask_user_question' cell in the chat (DSH core cell).
• Face-to-face: a human's message to a room's friend Bot is blocked with 'Chief has no grant to that Bot' #143 Face-to-face: a human's message to a room's friend Bot is blocked with 'Chief has no grant to that Bot' (fix in fix(social): a human's message to a room's friend Bot no longer goes through Chief (#143) #144).