rubik 0.3.4 → 0.3.5

data/lib/rubik/repl/commands/mcp.rb

@@ -27,104 +27,19 @@ module Rubik
             when "list"
               list_tools(ctx, manager, clean_args[1])
             when "add"
-              name = clean_args[1]
-              cmd = clean_args[2]
-              server_args = clean_args[3..] || []
-              if name.nil? || cmd.nil?
-                ctx.out.puts "Usage: !mcp add <name> <command> [args...] [-p|-g]"
-                next
-              end
-              defn = { "command" => cmd, "args" => server_args }
-              begin
-                res = manager.add_server(name, defn, auto_start: true, persist: scope)
-                if res[:ok]
-                  ctx.out.puts "MCP server '#{name}' added and started (#{res[:tools]} tool(s) registered) [#{Base.scope_label(scope)}]."
-                else
-                  Base.report_persist_failure(ctx, res, scope)
-                end
-              rescue StandardError => e
-                ctx.out.puts "Failed to add/start MCP server '#{name}': #{e.message}"
-              end
+              handle_add(ctx, manager, clean_args, scope)
             when "remove", "rm", "delete"
-              name = clean_args[1]
-              if name.nil?
-                ctx.out.puts "Usage: !mcp remove <name> [-p|-g]"
-                next
-              end
-              begin
-                res = manager.remove_server(name, persist: scope)
-                if res[:ok]
-                  ctx.out.puts "MCP server '#{name}' removed [#{Base.scope_label(scope)}]."
-                else
-                  Base.report_persist_failure(ctx, res, scope)
-                end
-              rescue StandardError => e
-                ctx.out.puts "Failed to remove MCP server '#{name}': #{e.message}"
-              end
+              handle_remove(ctx, manager, clean_args, scope)
             when "enable", "on", "start"
-              name = clean_args[1]
-              if name.nil?
-                ctx.out.puts "Usage: !mcp enable <name>"
-                next
-              end
-              begin
-                manager.enable_server(name)
-                tool_count = (manager.tools[name] || []).size
-                ctx.out.puts "MCP server '#{name}' enabled (#{tool_count} tool(s) registered)."
-              rescue StandardError => e
-                ctx.out.puts "Failed to enable MCP server '#{name}': #{e.message}"
-              end
+              handle_enable(ctx, manager, clean_args)
             when "disable", "off", "stop"
-              name = clean_args[1]
-              if name.nil?
-                ctx.out.puts "Usage: !mcp disable <name>"
-                next
-              end
-              begin
-                manager.disable_server(name)
-                ctx.out.puts "MCP server '#{name}' disabled and tools unregistered."
-              rescue StandardError => e
-                ctx.out.puts "Failed to disable MCP server '#{name}': #{e.message}"
-              end
+              handle_disable(ctx, manager, clean_args)
             when "connect"
-              name = clean_args[1]
-              cmd = clean_args[2]
-              server_args = clean_args[3..] || []
-              if name.nil? || cmd.nil?
-                ctx.out.puts "Usage: !mcp connect <name> <command> [args...]"
-                next
-              end
-              begin
-                manager.connect(name, cmd, server_args)
-                tool_count = (manager.tools[name] || []).size
-                ctx.out.puts "MCP server '#{name}' connected [Session only] (#{tool_count} tool(s) registered)."
-              rescue StandardError => e
-                ctx.out.puts "Failed to connect MCP server '#{name}': #{e.message}"
-              end
+              handle_connect(ctx, manager, clean_args)
             when "disconnect"
-              name = clean_args[1]
-              if name.nil?
-                ctx.out.puts "Usage: !mcp disconnect <name>"
-                next
-              end
-              begin
-                manager.disconnect(name)
-                ctx.out.puts "MCP server '#{name}' disconnected."
-              rescue StandardError => e
-                ctx.out.puts "Failed to disconnect MCP server '#{name}': #{e.message}"
-              end
+              handle_disconnect(ctx, manager, clean_args)
             when "ping"
-              name = clean_args[1]
-              if name.nil?
-                ctx.out.puts "Usage: !mcp ping <name>"
-                next
-              end
-              begin
-                latency = manager.ping(name)
-                ctx.out.puts "MCP server '#{name}' is alive (ping: #{latency} ms)."
-              rescue StandardError => e
-                ctx.out.puts "Ping failed for MCP server '#{name}': #{e.message}"
-              end
+              handle_ping(ctx, manager, clean_args)
             else
               ctx.out.puts "Unknown !mcp action '#{sub}'. Valid actions: status, list, add, remove, enable, disable, connect, disconnect, ping."
             end
@@ -188,6 +103,119 @@ module Rubik
             ctx.out.puts "No active MCP tools across servers."
           end
         end
+
+        private_class_method def self.handle_add(ctx, manager, clean_args, scope)
+          name = clean_args[1]
+          cmd = clean_args[2]
+          server_args = clean_args[3..] || []
+          if name.nil? || cmd.nil?
+            ctx.out.puts "Usage: !mcp add <name> <command> [args...] [-p|-g]"
+            return
+          end
+          defn = { "command" => cmd, "args" => server_args }
+          begin
+            res = manager.add_server(name, defn, auto_start: true, persist: scope)
+            if res[:ok]
+              ctx.out.puts "MCP server '#{name}' added and started (#{res[:tools]} tool(s) registered) [#{Base.scope_label(scope)}]."
+            else
+              Base.report_persist_failure(ctx, res, scope)
+            end
+          rescue StandardError => e
+            ctx.out.puts "Failed to add/start MCP server '#{name}': #{e.message}"
+          end
+        end
+
+        private_class_method def self.handle_remove(ctx, manager, clean_args, scope)
+          name = clean_args[1]
+          if name.nil?
+            ctx.out.puts "Usage: !mcp remove <name> [-p|-g]"
+            return
+          end
+          begin
+            res = manager.remove_server(name, persist: scope)
+            if res[:ok]
+              ctx.out.puts "MCP server '#{name}' removed [#{Base.scope_label(scope)}]."
+            else
+              Base.report_persist_failure(ctx, res, scope)
+            end
+          rescue StandardError => e
+            ctx.out.puts "Failed to remove MCP server '#{name}': #{e.message}"
+          end
+        end
+
+        private_class_method def self.handle_enable(ctx, manager, clean_args)
+          name = clean_args[1]
+          if name.nil?
+            ctx.out.puts "Usage: !mcp enable <name>"
+            return
+          end
+          begin
+            manager.enable_server(name)
+            tool_count = (manager.tools[name] || []).size
+            ctx.out.puts "MCP server '#{name}' enabled (#{tool_count} tool(s) registered)."
+          rescue StandardError => e
+            ctx.out.puts "Failed to enable MCP server '#{name}': #{e.message}"
+          end
+        end
+
+        private_class_method def self.handle_disable(ctx, manager, clean_args)
+          name = clean_args[1]
+          if name.nil?
+            ctx.out.puts "Usage: !mcp disable <name>"
+            return
+          end
+          begin
+            manager.disable_server(name)
+            ctx.out.puts "MCP server '#{name}' disabled and tools unregistered."
+          rescue StandardError => e
+            ctx.out.puts "Failed to disable MCP server '#{name}': #{e.message}"
+          end
+        end
+
+        private_class_method def self.handle_connect(ctx, manager, clean_args)
+          name = clean_args[1]
+          cmd = clean_args[2]
+          server_args = clean_args[3..] || []
+          if name.nil? || cmd.nil?
+            ctx.out.puts "Usage: !mcp connect <name> <command> [args...]"
+            return
+          end
+          begin
+            manager.connect(name, cmd, server_args)
+            tool_count = (manager.tools[name] || []).size
+            ctx.out.puts "MCP server '#{name}' connected [Session only] (#{tool_count} tool(s) registered)."
+          rescue StandardError => e
+            ctx.out.puts "Failed to connect MCP server '#{name}': #{e.message}"
+          end
+        end
+
+        private_class_method def self.handle_disconnect(ctx, manager, clean_args)
+          name = clean_args[1]
+          if name.nil?
+            ctx.out.puts "Usage: !mcp disconnect <name>"
+            return
+          end
+          begin
+            manager.disconnect(name)
+            ctx.out.puts "MCP server '#{name}' disconnected."
+          rescue StandardError => e
+            ctx.out.puts "Failed to disconnect MCP server '#{name}': #{e.message}"
+          end
+        end
+
+        private_class_method def self.handle_ping(ctx, manager, clean_args)
+          name = clean_args[1]
+          if name.nil?
+            ctx.out.puts "Usage: !mcp ping <name>"
+            return
+          end
+          begin
+            latency = manager.ping(name)
+            ctx.out.puts "MCP server '#{name}' is alive (ping: #{latency} ms)."
+          rescue StandardError => e
+            ctx.out.puts "Ping failed for MCP server '#{name}': #{e.message}"
+          end
+        end
       end
     end
   end

data/lib/rubik/repl/commands/session.rb

@@ -16,6 +16,27 @@ module Rubik
 
         def self.register(shell)
           shell.register_command("history", description: "List recent session history", audience: :both) do |args, ctx|
+            run_history(args, ctx)
+          end
+
+          # Plan 91 — explicit multi-line paste mode: collects lines until a
+          # lone "." line, then dispatches the joined text as one prompt turn.
+          shell.register_command("paste", description: "Multi-line paste mode (finish with lone '.')") do |_args, ctx|
+            run_paste(ctx)
+          end
+
+          shell.register_command("replay", description: "Replay session file") do |args, ctx|
+            run_replay(args, ctx)
+          end
+
+          shell.register_command("session", description: "Manage recorded sessions (list|resume|info|prune)",
+                                            usage: USAGE_SESSION) do |args, ctx|
+            dispatch_session(args, ctx)
+          end
+        end
+
+        class << self
+          def run_history(args, ctx)
             limit = (args.first || 20).to_i
             hist = ctx.recorder.read_history(limit)
             hist.each_with_index do |item, idx|
@@ -23,14 +44,12 @@ module Rubik
             end
           end
 
-          # Plan 91 — explicit multi-line paste mode: collects lines until a
-          # lone "." line, then dispatches the joined text as one prompt turn.
-          shell.register_command("paste", description: "Multi-line paste mode (finish with lone '.')") do |_args, ctx|
+          def run_paste(ctx)
             ctx.request_paste!
             ctx.out.puts "[Rubik] Paste modu bir sonraki prompt'ta başlayacak."
           end
 
-          shell.register_command("replay", description: "Replay session file") do |args, ctx|
+          def run_replay(args, ctx)
             path = args.first
             replayer = ctx.session_replayer
             if replayer.replay_file(path)
@@ -40,77 +59,85 @@ module Rubik
             end
           end
 
-          shell.register_command("session", description: "Manage recorded sessions (list|resume|info|prune)",
-                                            usage: USAGE_SESSION) do |args, ctx|
+          def dispatch_session(args, ctx)
             sub = args.first&.downcase || "list"
             root_d = ctx.buffer_manager&.root_dir || Dir.pwd
             home_d = ctx.config&.home_dir || ENV.fetch("HOME", nil)
 
             case sub
             when "list"
-              sessions = Rubik::Session::Manager.list_sessions(root_d, home_d, config: ctx.config)
-              if sessions.empty?
-                ctx.out.puts "No recorded sessions found for this workspace."
-              else
-                ctx.out.puts "=== Recorded Sessions (#{sessions.size}) ==="
-                sessions.each_with_index do |s, idx|
-                  mark = s[:path] == ctx.recorder.session_file ? " [CURRENT]" : ""
-                  ctx.out.puts "  #{idx + 1}. #{s[:id]} (#{s[:scope]}) - #{s[:event_count]} events - Last: \"#{s[:last_prompt]}\"#{mark}"
-                end
-              end
+              run_list(ctx, root_d, home_d)
             when "resume", "continue", "load"
-              target_id = args[1]
-              if target_id.nil?
-                picked = interactive_session_pick(ctx)
-                if picked == :picker_cancelled
-                  ctx.out.puts "[Rubik::Session] Resume iptal edildi."
-                  next
-                end
-                target_id = picked || :latest
-              end
-              res = ctx.resume_session(target_id)
-              ctx.out.puts "Resume failed: #{res[:error]}" unless res[:ok]
+              run_resume(args[1], ctx)
             when "info"
-              ctx.out.puts "Active Session File: #{ctx.recorder.session_file}"
-              ctx.out.puts "Total Events in Session: #{ctx.recorder.events.size}"
+              run_info(ctx)
             when "prune", "clean", "cleanup"
               run_prune(args.drop(1), ctx)
             when "save"
-              target_name = args[1]
-              if target_name.nil? || target_name.strip.empty?
-                ctx.out.puts "Usage: !session save <name>"
-              else
-                safe_name = File.basename(target_name.strip.sub(/\.jsonl$/, ""))
-                if safe_name.empty? || safe_name.start_with?(".")
-                  ctx.out.puts "Error: Invalid session name '#{target_name}'."
-                  next
-                end
-
-                target_dir = File.join(root_d, ".rubik", "sessions")
-                FileUtils.mkdir_p(target_dir)
-                target_file = File.join(target_dir, "#{safe_name}.jsonl")
-
-                if ctx.recorder.session_file && File.exist?(ctx.recorder.session_file)
-                  FileUtils.cp(ctx.recorder.session_file, target_file)
-                else
-                  File.open(target_file, "w") do |f|
-                    ctx.recorder.events.each { |ev| f.puts(JSON.dump(ev)) }
-                  end
-                end
-                ctx.recorder.switch_session_file(target_file, cleanup_empty_current: false)
-                ctx.out.puts "[Rubik::Session] Session saved to #{target_file}"
-              end
+              run_save(args[1], ctx, root_d)
             else
               ctx.out.puts USAGE_SESSION
             end
           end
-        end
 
-        # Interactive session picker (Antigravity /resume style): arrow-key
-        # selection over recorded sessions on capable TTYs. Returns the
-        # session id, :picker_cancelled on Ctrl+C (caller aborts the
-        # resume), or nil in pipes/tests so `resume` falls back to :latest.
-        class << self
+          def run_list(ctx, root_d, home_d)
+            sessions = Rubik::Session::Manager.list_sessions(root_d, home_d, config: ctx.config)
+            if sessions.empty?
+              ctx.out.puts "No recorded sessions found for this workspace."
+            else
+              ctx.out.puts "=== Recorded Sessions (#{sessions.size}) ==="
+              sessions.each_with_index do |s, idx|
+                mark = s[:path] == ctx.recorder.session_file ? " [CURRENT]" : ""
+                ctx.out.puts "  #{idx + 1}. #{s[:id]} (#{s[:scope]}) - #{s[:event_count]} events - Last: \"#{s[:last_prompt]}\"#{mark}"
+              end
+            end
+          end
+
+          def run_resume(target_id, ctx)
+            if target_id.nil?
+              picked = interactive_session_pick(ctx)
+              if picked == :picker_cancelled
+                ctx.out.puts "[Rubik::Session] Resume iptal edildi."
+                return
+              end
+              target_id = picked || :latest
+            end
+            res = ctx.resume_session(target_id)
+            ctx.out.puts "Resume failed: #{res[:error]}" unless res[:ok]
+          end
+
+          def run_info(ctx)
+            ctx.out.puts "Active Session File: #{ctx.recorder.session_file}"
+            ctx.out.puts "Total Events in Session: #{ctx.recorder.events.size}"
+          end
+
+          def run_save(target_name, ctx, root_d)
+            if target_name.nil? || target_name.strip.empty?
+              ctx.out.puts "Usage: !session save <name>"
+              return
+            end
+
+            safe_name = File.basename(target_name.strip.sub(/\.jsonl$/, ""))
+            if safe_name.empty? || safe_name.start_with?(".")
+              ctx.out.puts "Error: Invalid session name '#{target_name}'."
+              return
+            end
+
+            target_dir = File.join(root_d, ".rubik", "sessions")
+            FileUtils.mkdir_p(target_dir)
+            target_file = File.join(target_dir, "#{safe_name}.jsonl")
+
+            if ctx.recorder.session_file && File.exist?(ctx.recorder.session_file)
+              FileUtils.cp(ctx.recorder.session_file, target_file)
+            else
+              File.open(target_file, "w") do |f|
+                ctx.recorder.events.each { |ev| f.puts(JSON.dump(ev)) }
+              end
+            end
+            ctx.recorder.switch_session_file(target_file, cleanup_empty_current: false)
+            ctx.out.puts "[Rubik::Session] Session saved to #{target_file}"
+          end
+
           # `!session prune [days] [--apply] [--all]` — dry-run by default:
           # prints the blast radius of files that WOULD be deleted and only
           # unlinks once the operator passes --apply. The active session file
@@ -154,6 +181,10 @@ module Rubik
             days == days.to_i ? "#{days.to_i}d" : "#{days.round(1)}d"
           end
 
+          # Interactive session picker (Antigravity /resume style): arrow-key
+          # selection over recorded sessions on capable TTYs. Returns the
+          # session id, :picker_cancelled on Ctrl+C (caller aborts the
+          # resume), or nil in pipes/tests so `resume` falls back to :latest.
           def interactive_session_pick(ctx)
             return nil unless Rubik::UI::Capability.interactive?(input: ctx.input, output: ctx.output)
 

data/lib/rubik/repl/commands/workspace.rb

@@ -149,114 +149,130 @@ module Rubik
 
             case sub
             when "list", "status"
-              extra = ctx.buffer_manager&.additional_roots || []
-              rw_set = ctx.buffer_manager&.rw_roots || Set.new
-              allowed_ext = ctx.buffer_manager&.allowed_external_dirs || []
-              rw_allowed_set = ctx.buffer_manager&.rw_allowed_dirs || Set.new
-              glob_rw = ctx.buffer_manager&.allow_external_writes || false
-              auto_idx = ctx.config.fetch("workspace.auto_index_additional", true)
-
-              ctx.out.puts "=== Configured Workspace Roots ==="
-              ctx.out.puts "  • [PRIMARY] #{effective_root} (Read-Write)"
-              if extra.empty?
-                ctx.out.puts "  (No additional workspace roots configured)"
-              else
-                extra.each_with_index do |r, idx|
-                  mode_str = glob_rw || rw_set.include?(r) ? "Read-Write" : "Read-Only"
-                  ctx.out.puts "  • [EXTRA #{idx + 1}] #{r} (#{mode_str})"
-                end
-              end
+              handle_workspace_list(ctx, effective_root)
+            when "allow"
+              handle_workspace_allow(clean_args[1], ctx, is_ro, scope)
+            when "add"
+              handle_workspace_add(clean_args[1], ctx, is_rw, scope)
+            when "remove", "rm", "delete"
+              handle_workspace_remove(clean_args[1], ctx, scope, effective_root)
+            else
+              ctx.out.puts USAGE_WORKSPACE
+            end
+          end
 
-              ctx.out.puts "=== Allowed External Dirs (Zero-AST) ==="
-              if allowed_ext.empty?
-                ctx.out.puts "  (No allowed external directories configured)"
-              else
-                allowed_ext.each_with_index do |d, idx|
-                  mode_str = glob_rw || rw_allowed_set.include?(d) ? "Read-Write" : "Read-Only"
-                  ctx.out.puts "  • [ALLOWED #{idx + 1}] #{d} (#{mode_str})"
-                end
-              end
+          shell.register_command("workspace", description: "Manage multiple workspace roots (list|add <path> [--rw]|allow <path>|remove <path>)",
+                                              usage: USAGE_WORKSPACE, &workspace_handler)
+          shell.register_command("roots", description: "Alias for !workspace", usage: USAGE_WORKSPACE, &workspace_handler)
+        end
 
-              ctx.out.puts "External Writes Allowed Globally : #{glob_rw}"
-              ctx.out.puts "Auto-Index Additional Roots      : #{auto_idx}"
-            when "allow"
-              target_path = clean_args[1]
-              if target_path.nil? || target_path.empty?
-                ctx.out.puts "Usage: !workspace allow <path> [--rw|--ro] [--project|--global]"
-              else
-                begin
-                  ctx.guard.verify_root_safety!(target_path)
-                rescue Rubik::Security::BlockedWriteError => e
-                  ctx.out.puts "Security Error: #{e.message}"
-                  next
-                end
+        private_class_method def self.handle_workspace_list(ctx, effective_root)
+          extra = ctx.buffer_manager&.additional_roots || []
+          rw_set = ctx.buffer_manager&.rw_roots || Set.new
+          allowed_ext = ctx.buffer_manager&.allowed_external_dirs || []
+          rw_allowed_set = ctx.buffer_manager&.rw_allowed_dirs || Set.new
+          glob_rw = ctx.buffer_manager&.allow_external_writes || false
+          auto_idx = ctx.config.fetch("workspace.auto_index_additional", true)
 
-                mode_rw = !is_ro
-                expanded = ctx.buffer_manager.add_allowed_dir(target_path, rw: mode_rw)
-                ctx.sandbox_runner&.add_allowed_dir(target_path)
+          ctx.out.puts "=== Configured Workspace Roots ==="
+          ctx.out.puts "  • [PRIMARY] #{effective_root} (Read-Write)"
+          if extra.empty?
+            ctx.out.puts "  (No additional workspace roots configured)"
+          else
+            extra.each_with_index do |r, idx|
+              mode_str = glob_rw || rw_set.include?(r) ? "Read-Write" : "Read-Only"
+              ctx.out.puts "  • [EXTRA #{idx + 1}] #{r} (#{mode_str})"
+            end
+          end
 
-                current_dirs = Array(ctx.config.fetch("workspace.allowed_external_dirs", [])).dup
-                current_dirs << target_path unless current_dirs.include?(target_path)
-                res = ctx.config.set("workspace.allowed_external_dirs", current_dirs, persist: scope)
-                next if Base.report_persist_failure(ctx, res, scope)
+          ctx.out.puts "=== Allowed External Dirs (Zero-AST) ==="
+          if allowed_ext.empty?
+            ctx.out.puts "  (No allowed external directories configured)"
+          else
+            allowed_ext.each_with_index do |d, idx|
+              mode_str = glob_rw || rw_allowed_set.include?(d) ? "Read-Write" : "Read-Only"
+              ctx.out.puts "  • [ALLOWED #{idx + 1}] #{d} (#{mode_str})"
+            end
+          end
 
-                mode_str = mode_rw ? "Read-Write" : "Read-Only"
-                ctx.out.puts "[Rubik::Allow] Added allowed external directory: #{expanded} (Mode: #{mode_str}) [#{Base.scope_label(scope)}]."
-              end
-            when "add"
-              target_path = clean_args[1]
-              if target_path.nil? || target_path.empty?
-                ctx.out.puts "Usage: !workspace add <path> [--rw] [--project|--global]"
-              else
-                begin
-                  ctx.guard.verify_root_safety!(target_path)
-                rescue Rubik::Security::BlockedWriteError => e
-                  ctx.out.puts "Security Error: #{e.message}"
-                  next
-                end
+          ctx.out.puts "External Writes Allowed Globally : #{glob_rw}"
+          ctx.out.puts "Auto-Index Additional Roots      : #{auto_idx}"
+        end
 
-                expanded = ctx.buffer_manager.add_root(target_path, rw: is_rw)
+        private_class_method def self.handle_workspace_allow(target_path, ctx, is_ro, scope)
+          if target_path.nil? || target_path.empty?
+            ctx.out.puts "Usage: !workspace allow <path> [--rw|--ro] [--project|--global]"
+            return
+          end
 
-                # Sync context index & AST coeffects
-                auto_idx = ctx.config.fetch("workspace.auto_index_additional", true)
-                ctx.sync_workspace_index! if auto_idx
+          begin
+            ctx.guard.verify_root_safety!(target_path)
+          rescue Rubik::Security::BlockedWriteError => e
+            ctx.out.puts "Security Error: #{e.message}"
+            return
+          end
 
-                # Persist to config
-                current_roots = Array(ctx.config.fetch("workspace.additional_roots", [])).dup
-                current_roots << target_path unless current_roots.include?(target_path)
-                res = ctx.config.set("workspace.additional_roots", current_roots, persist: scope)
-                next if Base.report_persist_failure(ctx, res, scope)
+          mode_rw = !is_ro
+          expanded = ctx.buffer_manager.add_allowed_dir(target_path, rw: mode_rw)
+          ctx.sandbox_runner&.add_allowed_dir(target_path)
 
-                mode_str = is_rw ? "Read-Write" : "Read-Only"
-                ctx.out.puts "[Rubik::Workspace] Added additional root: #{expanded} (Mode: #{mode_str}) [#{Base.scope_label(scope)}]."
-              end
-            when "remove", "rm", "delete"
-              target_path = clean_args[1]
-              if target_path.nil? || target_path.empty?
-                ctx.out.puts "Usage: !workspace remove <path> [--project|--global]"
-              else
-                expanded = ctx.buffer_manager.remove_root(target_path)
+          current_dirs = Array(ctx.config.fetch("workspace.allowed_external_dirs", [])).dup
+          current_dirs << target_path unless current_dirs.include?(target_path)
+          res = ctx.config.set("workspace.allowed_external_dirs", current_dirs, persist: scope)
+          return if Base.report_persist_failure(ctx, res, scope)
 
-                # Sync context index & AST coeffects
-                auto_idx = ctx.config.fetch("workspace.auto_index_additional", true)
-                ctx.sync_workspace_index! if auto_idx
+          mode_str = mode_rw ? "Read-Write" : "Read-Only"
+          ctx.out.puts "[Rubik::Allow] Added allowed external directory: #{expanded} (Mode: #{mode_str}) [#{Base.scope_label(scope)}]."
+        end
 
-                # Persist to config
-                current_roots = Array(ctx.config.fetch("workspace.additional_roots", [])).dup
-                current_roots.reject! { |r| File.expand_path(r, effective_root) == expanded || r == target_path }
-                res = ctx.config.set("workspace.additional_roots", current_roots, persist: scope)
-                next if Base.report_persist_failure(ctx, res, scope)
+        private_class_method def self.handle_workspace_add(target_path, ctx, is_rw, scope)
+          if target_path.nil? || target_path.empty?
+            ctx.out.puts "Usage: !workspace add <path> [--rw] [--project|--global]"
+            return
+          end
 
-                ctx.out.puts "[Rubik::Workspace] Removed additional root: #{expanded} [#{Base.scope_label(scope)}]."
-              end
-            else
-              ctx.out.puts USAGE_WORKSPACE
-            end
+          begin
+            ctx.guard.verify_root_safety!(target_path)
+          rescue Rubik::Security::BlockedWriteError => e
+            ctx.out.puts "Security Error: #{e.message}"
+            return
           end
 
-          shell.register_command("workspace", description: "Manage multiple workspace roots (list|add <path> [--rw]|allow <path>|remove <path>)",
-                                              usage: USAGE_WORKSPACE, &workspace_handler)
-          shell.register_command("roots", description: "Alias for !workspace", usage: USAGE_WORKSPACE, &workspace_handler)
+          expanded = ctx.buffer_manager.add_root(target_path, rw: is_rw)
+
+          # Sync context index & AST coeffects
+          auto_idx = ctx.config.fetch("workspace.auto_index_additional", true)
+          ctx.sync_workspace_index! if auto_idx
+
+          # Persist to config
+          current_roots = Array(ctx.config.fetch("workspace.additional_roots", [])).dup
+          current_roots << target_path unless current_roots.include?(target_path)
+          res = ctx.config.set("workspace.additional_roots", current_roots, persist: scope)
+          return if Base.report_persist_failure(ctx, res, scope)
+
+          mode_str = is_rw ? "Read-Write" : "Read-Only"
+          ctx.out.puts "[Rubik::Workspace] Added additional root: #{expanded} (Mode: #{mode_str}) [#{Base.scope_label(scope)}]."
+        end
+
+        private_class_method def self.handle_workspace_remove(target_path, ctx, scope, effective_root)
+          if target_path.nil? || target_path.empty?
+            ctx.out.puts "Usage: !workspace remove <path> [--project|--global]"
+            return
+          end
+
+          expanded = ctx.buffer_manager.remove_root(target_path)
+
+          # Sync context index & AST coeffects
+          auto_idx = ctx.config.fetch("workspace.auto_index_additional", true)
+          ctx.sync_workspace_index! if auto_idx
+
+          # Persist to config
+          current_roots = Array(ctx.config.fetch("workspace.additional_roots", [])).dup
+          current_roots.reject! { |r| File.expand_path(r, effective_root) == expanded || r == target_path }
+          res = ctx.config.set("workspace.additional_roots", current_roots, persist: scope)
+          return if Base.report_persist_failure(ctx, res, scope)
+
+          ctx.out.puts "[Rubik::Workspace] Removed additional root: #{expanded} [#{Base.scope_label(scope)}]."
         end
 
         private_class_method def self.register_allow_command(shell)