# Gemmbot

Multi-user AI assistant for Gemma Analytics, powered by Claude Code.

## Architecture

Monorepo with three main components:

- `bot/` — Node.js Slack bot (Bolt framework, Socket Mode). Manages sessions, Docker containers, Claude CLI invocation.
- `ui/` — Next.js management UI. User settings, secrets, Claude OAuth, admin dashboard.
- `docker/` — Dockerfile and entrypoint for session containers.
- `bin/` — Helper scripts (request-secret, vpn-exec, vpn-ns).

## Key decisions

- **SQLite + Prisma** — shared between bot and UI. Schema in `ui/prisma/schema.prisma`. WAL mode for concurrent access.
- **AES-256-GCM encryption** — for secrets stored in DB. Key via `ENCRYPTION_KEY` env var. Shared algorithm in `bot/src/crypto.js` and `ui/src/lib/crypto.ts`.
- **Two auth modes**: `SINGLE_USER` (personal bot, one user) and `MULTI_USER` (shared team bot, management UI for onboarding).
- **Docker isolation** — each session runs in its own container (`gemmbot-session:latest`). Claude invoked via `docker exec`.
- **Claude Code OAuth** — PKCE flow with `client_id=9d1c250a-e61b-44d9-88ed-5944d1962f5e`. Users authorize via management UI, tokens stored encrypted.

## Development

```bash
# Bot
cd bot && npm install && node src/app.js

# UI
cd ui && npm install && npx prisma generate && npm run dev

# Build Docker image
docker build -t gemmbot-session:latest docker/
```

## Environment variables

See `bot/.env.example` and `ui/.env.example` for required configuration.

## CI/CD

GitHub Actions in `.github/workflows/`:
- `deploy-bot.yml` / `deploy-ui.yml` — production deploy on push to `main`
- `preview-deploy.yml` / `preview-cleanup.yml` / `preview-stale.yml` — PR preview environments

Only one preview environment can exist at a time (single `/opt/gemmbot/preview/` directory, port 4001).

## Plan

See `PLAN.md` for the full implementation plan and architecture details.