One option for this is to make the split clear between the backend and the view.

If your frontend is asking for the current game state (to render it) and sending control messages to modify it, then you don't need much else to allow people to write bots. All you really need to do then is make sure there's a way they can access the exact same API your frontend uses but with (e.g.) an API key rather than cookies.

It's a reasonable thing to do for the code anyway (and might be how it works now, I don't know). Bots then have the ability and knowledge of any human player, you don't need to run any code your side (which brings up issues with sandboxing) and people can write in whatever language they want.