@aiworker/web 1.22.0 → 1.22.2

package/server/lib/changelog/update-notes.test.js

@@ -0,0 +1,59 @@
+import { describe, expect, it } from 'vitest';
+import { fetchUpdateNotes, renderUpdateNotes } from './update-notes.js';
+
+const compare = (a, b) => {
+  const pa = a.split('.').map(Number);
+  const pb = b.split('.').map(Number);
+  for (let i = 0; i < 3; i += 1) if (pa[i] !== pb[i]) return pa[i] - pb[i];
+  return 0;
+};
+
+const index = [
+  { version: '1.2.3', date: '2026-03-03', title: 'Comments everywhere', intro: 'A short intro.', app: { new: ['**Comments:** on code.'], improvements: [], fixes: ['Chat: no freeze.'], misc: [] }, vscode: null },
+  { version: '1.2.2', date: '2026-03-02', title: null, intro: null, app: { new: [], improvements: ['Faster.'], fixes: [], misc: [] }, vscode: null },
+  { version: '1.2.1', date: '2026-03-01', title: 'Old', intro: null, app: { new: ['Older.'], improvements: [], fixes: [], misc: [] }, vscode: null },
+];
+
+describe('renderUpdateNotes', () => {
+  it('renders the releases after the installed version up to the offered one, newest first', () => {
+    expect(renderUpdateNotes(index, '1.2.1', '1.2.3', compare)).toBe(`## [1.2.3] - 2026-03-03
+
+**Comments everywhere**
+
+A short intro.
+
+### New
+
+- **Comments:** on code.
+
+### Fixes
+
+- Chat: no freeze.
+
+## [1.2.2] - 2026-03-02
+
+### Improvements
+
+- Faster.`);
+  });
+
+  it('returns null when nothing lies in the range or the payload is not an index', () => {
+    expect(renderUpdateNotes(index, '1.2.3', '1.2.3', compare)).toBe(null);
+    expect(renderUpdateNotes({ entries: [] }, '1.0.0', '9.9.9', compare)).toBe(null);
+    expect(renderUpdateNotes([{ version: 'nope' }, { version: '1.2.2', date: '2026' }], '1.0.0', '9.9.9', compare)).toBe(null);
+  });
+});
+
+describe('fetchUpdateNotes', () => {
+  it('turns a failed request or a thrown fetch into null', async () => {
+    const notFound = async () => ({ ok: false });
+    expect(await fetchUpdateNotes('1.0.0', '2.0.0', compare, { fetch: notFound })).toBe(null);
+    const throwing = async () => { throw new Error('offline'); };
+    expect(await fetchUpdateNotes('1.0.0', '2.0.0', compare, { fetch: throwing })).toBe(null);
+  });
+
+  it('renders a successful response', async () => {
+    const ok = async () => ({ ok: true, json: async () => index });
+    expect(await fetchUpdateNotes('1.2.2', '1.2.3', compare, { fetch: ok })).toMatch(/^## \[1\.2\.3\] - 2026-03-03\n\n\*\*Comments everywhere\*\*/);
+  });
+});

package/server/lib/client-auth/remote-clients.test.js

@@ -86,15 +86,15 @@ describe('remote client auth runtime', () => {
   it('keeps the replaced record label on a dedupe re-mint without an explicit label', async () => {
     const { dir, runtime } = await createRuntime();
     try {
-      await runtime.createClient({ label: 'Iryna iPhone', dedupeKey: 'mobile:device-1', fallbackLabel: 'OpenChamber Mobile' });
-      const remint = await runtime.createClient({ dedupeKey: 'mobile:device-1', fallbackLabel: 'OpenChamber Mobile' });
+      await runtime.createClient({ label: 'Iryna iPhone', dedupeKey: 'mobile:device-1', fallbackLabel: 'AiWorker Mobile' });
+      const remint = await runtime.createClient({ dedupeKey: 'mobile:device-1', fallbackLabel: 'AiWorker Mobile' });
       expect(remint.client.label).toBe('Iryna iPhone');
 
-      const renamed = await runtime.createClient({ label: 'Work phone', dedupeKey: 'mobile:device-1', fallbackLabel: 'OpenChamber Mobile' });
+      const renamed = await runtime.createClient({ label: 'Work phone', dedupeKey: 'mobile:device-1', fallbackLabel: 'AiWorker Mobile' });
       expect(renamed.client.label).toBe('Work phone');
 
-      const fresh = await runtime.createClient({ dedupeKey: 'mobile:device-2', fallbackLabel: 'OpenChamber Mobile' });
-      expect(fresh.client.label).toBe('OpenChamber Mobile');
+      const fresh = await runtime.createClient({ dedupeKey: 'mobile:device-2', fallbackLabel: 'AiWorker Mobile' });
+      expect(fresh.client.label).toBe('AiWorker Mobile');
     } finally {
       await fs.rm(dir, { recursive: true, force: true });
     }

package/server/lib/context-obligatory/runtime.js

@@ -5,15 +5,15 @@ const isRecord = (value) => Boolean(value && typeof value === 'object' && !Array
 
 const readContextState = (session) => {
   const metadata = isRecord(session?.metadata) ? session.metadata : {};
-  const openchamber = isRecord(metadata.openchamber) ? metadata.openchamber : {};
-  const messages = Array.isArray(openchamber.context_obligatory_messages)
-    ? openchamber.context_obligatory_messages.filter((item) =>
+  const aiworker = isRecord(metadata.aiworker) ? metadata.aiworker : {};
+  const messages = Array.isArray(aiworker.context_obligatory_messages)
+    ? aiworker.context_obligatory_messages.filter((item) =>
       isRecord(item)
       && typeof item.id === 'string'
       && typeof item.createdAt === 'number'
       && (item.role === 'user' || item.role === 'assistant'))
     : [];
-  return { metadata, openchamber, messages };
+  return { metadata, aiworker, messages };
 };
 
 const buildContextPrompt = (entries) => {
@@ -89,7 +89,7 @@ export const createContextObligatoryRuntime = ({
     const summary = recent.toReversed().find((message) =>
       message?.info?.role === 'assistant' && message.info.summary === true)?.info;
     if (!summary?.id || !summary?.time?.completed) return;
-    if (state.openchamber.context_obligatory_last_compaction_message_id === summary.id) return;
+    if (state.aiworker.context_obligatory_last_compaction_message_id === summary.id) return;
 
     const fetched = await Promise.allSettled(state.messages.map(async (pinned) => {
       const message = await openCodeFetch(
@@ -138,8 +138,8 @@ export const createContextObligatoryRuntime = ({
       body: {
         metadata: {
           ...freshState.metadata,
-          openchamber: {
-            ...freshState.openchamber,
+          aiworker: {
+            ...freshState.aiworker,
             context_obligatory_last_compaction_message_id: summary.id,
             // Recorded together with the cursor: the session now carries this
             // knowledge again, so the next send must not repeat it.

package/server/lib/context-obligatory/runtime.test.js

@@ -23,7 +23,7 @@ describe('context obligatory runtime', () => {
         sessionReads += 1;
         return json({
           id: 'ses_1',
-          metadata: { openchamber: { context_obligatory_messages: [
+          metadata: { aiworker: { context_obligatory_messages: [
             { id: 'msg_2', createdAt: 20, role: 'assistant' },
             { id: 'msg_1', createdAt: 10, role: 'user' },
           ] } },
@@ -58,7 +58,7 @@ describe('context obligatory runtime', () => {
     expect(payload.parts[0].text).toContain('Only if no tasks or next steps remain');
     expect(payload.parts[0].text).toContain('no more than one short paragraph');
     const patch = requests.find((request) => request.method === 'PATCH');
-    expect(JSON.parse(patch.body).metadata.openchamber.context_obligatory_last_compaction_message_id).toBe('msg_summary');
+    expect(JSON.parse(patch.body).metadata.aiworker.context_obligatory_last_compaction_message_id).toBe('msg_summary');
     expect(sessionReads).toBe(2);
     runtime.stop();
   });
@@ -75,7 +75,7 @@ describe('context obligatory runtime', () => {
       if (url.pathname === '/session/ses_1' && init.method === 'PATCH') return json({});
       if (url.pathname === '/session/ses_1') return json({
         id: 'ses_1',
-        metadata: { openchamber: { knowledge_context_delivered: 'sig-before-compaction' } },
+        metadata: { aiworker: { knowledge_context_delivered: 'sig-before-compaction' } },
       });
       if (url.pathname === '/session/ses_1/message') return json([
         { info: { id: 'msg_agent', role: 'assistant', providerID: 'provider', modelID: 'model', agent: 'build' } },
@@ -112,7 +112,7 @@ describe('context obligatory runtime', () => {
     expect(JSON.parse(prompt.body).parts[0].text).toContain('Remember this.');
     const patch = requests.find((request) => request.method === 'PATCH');
     // Recorded with the cursor, so the next ordinary send does not repeat it.
-    expect(JSON.parse(patch.body).metadata.openchamber.knowledge_context_delivered).toBe('sig-1');
+    expect(JSON.parse(patch.body).metadata.aiworker.knowledge_context_delivered).toBe('sig-1');
   });
 
   it('sends pinned messages and project knowledge as one message', async () => {
@@ -123,7 +123,7 @@ describe('context obligatory runtime', () => {
       if (url.pathname === '/session/ses_1' && init.method === 'PATCH') return json({});
       if (url.pathname === '/session/ses_1') return json({
         id: 'ses_1',
-        metadata: { openchamber: { context_obligatory_messages: [{ id: 'msg_1', createdAt: 10, role: 'user' }] } },
+        metadata: { aiworker: { context_obligatory_messages: [{ id: 'msg_1', createdAt: 10, role: 'user' }] } },
       });
       if (url.pathname === '/session/ses_1/message') return json([
         { info: { id: 'msg_agent', role: 'assistant', providerID: 'provider', modelID: 'model', agent: 'build' } },

package/server/lib/dev-servers/parse.js

@@ -143,7 +143,7 @@ export const parseNetstatListeners = (output) => {
 /**
  * Narrows raw listeners to the ones worth offering as a preview target.
  *
- * `ownPorts` removes OpenChamber's own listeners — offering the user a preview
+ * `ownPorts` removes AiWorker's own listeners — offering the user a preview
  * of the app they are already looking at is pure noise.
  */
 export const selectDevServerCandidates = (listeners, { ownPorts = [], ownPids = [] } = {}) => {
@@ -169,7 +169,7 @@ const PROC_LOOPBACK_ADDRESSES = new Set(['0100007F', '00000000000000000000000001
  * Parses `/proc/net/tcp` and `/proc/net/tcp6`.
  *
  * The fallback for hosts without `lsof`, which is most containers — and a
- * deployed OpenChamber is exactly where a dev server needs discovering. Reads a
+ * deployed AiWorker is exactly where a dev server needs discovering. Reads a
  * kernel file rather than shelling out, so it cannot be defeated by a missing
  * binary or a stripped PATH.
  *

package/server/lib/dev-servers/parse.test.js

@@ -100,11 +100,11 @@ describe('candidate selection', () => {
   const listeners = [
     { port: 5173, pid: 10, command: 'node' },
     { port: 5432, pid: 11, command: 'postgres' },
-    { port: 4096, pid: 12, command: 'openchamber' },
+    { port: 4096, pid: 12, command: 'aiworker' },
     { port: 3000, pid: 13, command: 'node' },
   ];
 
-  test('drops OpenChamber own ports so the app never offers itself', () => {
+  test('drops AiWorker own ports so the app never offers itself', () => {
     const ports = selectDevServerCandidates(listeners, { ownPorts: [4096] }).map((entry) => entry.port);
     expect(ports).toEqual([5173, 3000]);
   });

package/server/lib/dev-servers/routes.js

@@ -50,7 +50,7 @@ const runCommand = (spawn, command, args, timeoutMs) => new Promise((resolve) =>
 
 /**
  * Reads the kernel's socket tables. Containers routinely ship without `lsof`,
- * and a deployed OpenChamber is precisely where discovery has to work, so this
+ * and a deployed AiWorker is precisely where discovery has to work, so this
  * is tried whenever the command is unavailable.
  */
 const readProcListeners = async (readFile) => {

package/server/lib/dev-tunnel/DOCUMENTATION.md

@@ -20,7 +20,13 @@ and what made it fragile per framework.
 - `client.js` is the local end: it binds a loopback listener on the user's
   machine and pipes each accepted connection through one WebSocket. It lives in
   this package because it needs a WebSocket client the package already depends
-  on; the desktop shell drives it over IPC.
+  on; the desktop shell drives it over IPC for directly reachable HTTP(S)
+  runtimes.
+- Relay-only runtimes use `packages/electron/relay-dev-tunnel.mjs` for the local
+  listener. Each accepted connection gets an Electron `MessagePort`; the trusted
+  renderer carries its bytes through the active E2EE relay. This keeps relay
+  credentials and encryption in their existing renderer owner instead of
+  duplicating them in Electron main.
 - Port discovery is not owned here. `runtime.js` is given the reachable set by
   the same dev-server discovery the user's own list is built from.
 - The browser panel decides when to tunnel; this module never chooses a target.
@@ -40,9 +46,12 @@ and what made it fragile per framework.
     usual origin allowlist applies unchanged. That check is a CSRF defence: a
     hostile page can make a browser open a WebSocket carrying ambient cookies,
     and the origin is what exposes it.
-  - With no `Origin` the request must carry client-token auth. A browser cannot
-    reach this path — the WebSocket API always sends an origin and never lets a
-    page set an `Authorization` header — so this case is the desktop shell.
+  - With no `Origin` the request must carry client-token auth or a short-lived
+    URL token. The bearer case is the desktop main process. The URL-token case
+    is the trusted renderer carrying the socket through the E2EE relay.
+  - Through the E2EE relay, the trusted renderer mints a short-lived URL token
+    and includes it in the virtual WebSocket URL. The relay host and URL-token
+    allowlists accept exactly `/api/dev-tunnel`, not subpaths.
 - Concurrency is capped per host, not per page, because one page load opens
   many sockets.
 - A connection that cannot be established fails the socket rather than holding

package/server/lib/dev-tunnel/client.js

@@ -2,7 +2,7 @@
  * Local end of the dev-server tunnel.
  *
  * Binds a loopback listener on this machine and pipes every connection to a
- * dev server on the OpenChamber host. The point of binding a real local port —
+ * dev server on the AiWorker host. The point of binding a real local port —
  * rather than serving the remote page under a path on some other origin — is
  * that the page then has its own origin at the root of its own host. Absolute
  * URLs resolve, cookies scope correctly, HMR sockets connect, and nothing has

package/server/lib/dev-tunnel/runtime.js

@@ -1,5 +1,5 @@
 /**
- * Raw byte tunnel to a dev server running on the OpenChamber host.
+ * Raw byte tunnel to a dev server running on the AiWorker host.
  *
  * This is what lets a desktop client preview a dev server that lives on another
  * machine without rewriting anything. The client binds its own local port and
@@ -20,9 +20,9 @@
  *
  * - With an `Origin` header, the request came from a browser context and the
  *   usual origin check applies unchanged.
- * - With no `Origin`, the request must carry client-token auth. A browser
- *   cannot reach this path: the WebSocket API always sends an origin and never
- *   lets a page set an `Authorization` header.
+ * - With no `Origin`, the request must carry client-token auth or a short-lived
+ *   URL token. The URL-token case is used only by the trusted renderer through
+ *   the E2EE relay; the UI-auth allowlist limits it to this exact path.
  */
 import net from 'node:net';
 import { WebSocketServer } from 'ws';
@@ -133,7 +133,7 @@ export function createDevTunnelRuntime({
     void (async () => {
       try {
         if (uiAuthController?.enabled) {
-          const auth = await uiAuthController.resolveAuthContext(req, null, { allowUrlToken: false });
+          const auth = await uiAuthController.resolveAuthContext(req, null, { allowUrlToken: true });
           if (!auth) {
             rejectWebSocketUpgrade(socket, 401, 'UI authentication required');
             return;

package/server/lib/dev-tunnel/tunnel.test.js

@@ -1,12 +1,13 @@
 import { afterEach, describe, expect, test } from 'bun:test';
 import http from 'node:http';
 import net from 'node:net';
+import WebSocket from 'ws';
 
 import { createDevTunnelClient } from './client.js';
 import { createDevTunnelRuntime, isDevTunnelPath } from './runtime.js';
 
 /**
- * These exercise the real socket path end to end: a dev server, an OpenChamber
+ * These exercise the real socket path end to end: a dev server, an AiWorker
  * host tunnelling to it, and a client binding a local port. Anything less would
  * not prove the thing that matters — that a page loads over the tunnel exactly
  * as it does locally.
@@ -228,6 +229,12 @@ describe('dev tunnel authentication', () => {
     enabled: true,
     resolveAuthContext: async () => ({ type: 'session' }),
   };
+  const urlTokenAuth = {
+    enabled: true,
+    resolveAuthContext: async (req, _res, options) => (
+      options?.allowUrlToken === true && req.url.includes('oc_url_token=good') ? { type: 'client', token: 'url:authenticated' } : null
+    ),
+  };
 
   test('accepts a bearer-authenticated client that sends no origin', async () => {
     const devPort = await startDevServer((_req, res) => res.end('ok'));
@@ -243,6 +250,19 @@ describe('dev tunnel authentication', () => {
     expect((await httpGet(localPort, '/')).body).toBe('ok');
   });
 
+  test('accepts a URL-token client carried by the E2EE relay', async () => {
+    const devPort = await startDevServer((_req, res) => res.end('relay-ok'));
+    const host = await startHost({ allowedPorts: [devPort], auth: urlTokenAuth });
+
+    const body = await new Promise((resolve, reject) => {
+      const socket = new WebSocket(`ws://127.0.0.1:${host.port}/api/dev-tunnel?port=${devPort}&oc_url_token=good`);
+      socket.on('open', () => socket.send('GET / HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n'));
+      socket.on('message', (data) => resolve(Buffer.from(data).toString()));
+      socket.on('error', reject);
+    });
+    expect(body).toContain('relay-ok');
+  });
+
   test('rejects a client with no credentials', async () => {
     const devPort = await startDevServer((_req, res) => res.end('ok'));
     const host = await startHost({ allowedPorts: [devPort], auth: clientAuth });

package/server/lib/dictation/local/model-catalog.js

@@ -1,7 +1,7 @@
 /**
  * Catalog of local sherpa-onnx STT models available for dictation.
  * Models are downloaded on demand from the k2-fsa GitHub releases and
- * extracted under the OpenChamber speech-models directory.
+ * extracted under the AiWorker speech-models directory.
  *
  * `type` selects the recognizer construction path in the worker:
  * - 'nemo_transducer': encoder/decoder/joiner transducer (Parakeet)

package/server/lib/dictation/local/worker-process.js

@@ -2,7 +2,7 @@
  * Dictation local-speech worker process.
  *
  * Hosts the sherpa-onnx native inference (Parakeet STT) in a separate process
- * so ONNX decoding never blocks the main OpenChamber server. Communicates
+ * so ONNX decoding never blocks the main AiWorker server. Communicates
  * with the parent over child_process IPC (advanced serialization, so Buffers
  * survive the trip as Uint8Array).
  *
@@ -24,7 +24,7 @@ import { getLocalSttModelDir, getLocalSttModelSpec } from './model-catalog.js';
 import { pcm16ToWav } from '../audio.js';
 import path from 'path';
 
-process.title = 'OpenChamber Dictation';
+process.title = 'AiWorker Dictation';
 
 const engines = new Map();
 const ttsEngines = new Map();

package/server/lib/event-stream/directory-ws-bridge.js

@@ -56,7 +56,7 @@ export function acceptDirectoryMessageStreamWsConnection({
       return;
     }
 
-    sendMessageStreamWsEvent(socket, { type: 'openchamber:heartbeat', timestamp: Date.now() }, { directory: 'global' });
+    sendMessageStreamWsEvent(socket, { type: 'aiworker:heartbeat', timestamp: Date.now() }, { directory: 'global' });
   }, heartbeatIntervalMs);
 
   socket.on('close', () => {

package/server/lib/event-stream/global-ws-bridge.js

@@ -177,7 +177,7 @@ export function createGlobalMessageStreamWsBridge({
         return;
       }
 
-      sendMessageStreamWsEvent(socket, { type: 'openchamber:heartbeat', timestamp: Date.now() }, { directory: 'global' });
+      sendMessageStreamWsEvent(socket, { type: 'aiworker:heartbeat', timestamp: Date.now() }, { directory: 'global' });
     }, heartbeatIntervalMs);
 
     socket.on('close', () => {

package/server/lib/event-stream/protocol.test.js

@@ -32,14 +32,14 @@ describe('event stream protocol helpers', () => {
 
   it('derives directory from payload properties when not wrapped', () => {
     const envelope = parseSseEventEnvelope(
-      'data: {"type":"openchamber:notification","properties":{"directory":"/tmp/project"}}\n'
+      'data: {"type":"aiworker:notification","properties":{"directory":"/tmp/project"}}\n'
     );
 
     expect(envelope).toEqual({
       eventId: null,
       directory: '/tmp/project',
       payload: {
-        type: 'openchamber:notification',
+        type: 'aiworker:notification',
         properties: { directory: '/tmp/project' },
       },
     });
@@ -167,14 +167,14 @@ describe('event stream protocol helpers', () => {
 
     const sent = sendMessageStreamWsEvent(
       socket,
-      { type: 'openchamber:heartbeat', timestamp: 1 },
+      { type: 'aiworker:heartbeat', timestamp: 1 },
       { eventId: 'evt-2', directory: '/tmp/project' }
     );
 
     expect(sent).toBe(true);
     expect(JSON.parse(rawPayload)).toEqual({
       type: 'event',
-      payload: { type: 'openchamber:heartbeat', timestamp: 1 },
+      payload: { type: 'aiworker:heartbeat', timestamp: 1 },
       eventId: 'evt-2',
       directory: '/tmp/project',
     });

package/server/lib/event-stream/runtime.test.js

@@ -84,18 +84,18 @@ describe('event stream broadcaster', () => {
       },
     });
 
-    broadcast({ type: 'openchamber:session-status' }, { eventId: 'evt-1', directory: '/tmp/project' });
+    broadcast({ type: 'aiworker:session-status' }, { eventId: 'evt-1', directory: '/tmp/project' });
 
     expect(sseEvents).toEqual([
       {
         res: sseClient,
-        payload: { type: 'openchamber:session-status' },
+        payload: { type: 'aiworker:session-status' },
       },
     ]);
     expect(wsPayloads).toEqual([
       {
         type: 'event',
-        payload: { type: 'openchamber:session-status' },
+        payload: { type: 'aiworker:session-status' },
         eventId: 'evt-1',
         directory: '/tmp/project',
       },
@@ -120,7 +120,7 @@ describe('event stream broadcaster', () => {
       },
     });
 
-    broadcast({ type: 'openchamber:notification' });
+    broadcast({ type: 'aiworker:notification' });
 
     expect(wsClients.size).toBe(0);
   });
@@ -475,7 +475,7 @@ describe('message stream websocket runtime', () => {
       getOpenCodeAuthHeaders: () => ({}),
       processForwardedEventPayload(payload, emitSynthetic) {
         if (payload.type === 'session.updated') {
-          emitSynthetic({ type: 'openchamber:session-status', sessionID: 'ses_1' });
+          emitSynthetic({ type: 'aiworker:session-status', sessionID: 'ses_1' });
         }
       },
       wsClients,
@@ -502,7 +502,7 @@ describe('message stream websocket runtime', () => {
     });
     expect(socket.sent).toContainEqual({
       type: 'event',
-      payload: { type: 'openchamber:session-status', sessionID: 'ses_1' },
+      payload: { type: 'aiworker:session-status', sessionID: 'ses_1' },
       directory: 'global',
     });
 

package/server/lib/fs/DOCUMENTATION.md

@@ -40,6 +40,8 @@ Own filesystem API behavior for the web server runtime, including workspace-boun
 
 ## Notes for contributors
 - Keep filesystem policy (workspace root checks, error mapping, exec timeout behavior) inside this module, not in the composition root.
+- Workspace checks accept, besides the active workspace and its worktrees, the **managed roots**: the AiWorker config root and the managed chats root (`managedChatsRoot` dependency; `AIWORKER_CHATS_DIR` upstream, default `<config root>/chats`). Chat worktrees may legitimately live outside every project workspace.
+- `GET /api/fs/home` answers `{ home, chatsRoot }`. `chatsRoot` is the server-resolved managed chats root; clients must use it instead of joining `home` + the well-known segment (a relocated root does not contain that segment).
 - Filesystem `EPERM`/`EACCES` failures use the stable `reason: "os-permission"` response marker. Policy denials such as workspace-boundary or missing-grant failures must not use that marker because a native folder picker cannot remediate them.
 - Read-only routes authorize the requested path against the workspace before resolving symlinks. A symlink reached through the workspace may therefore target a file outside it, while a directly requested outside path still requires an exact-path grant. Write routes keep canonical-target boundary checks.
 - If adding new `/api/fs/*` endpoints, add them in `routes.js` and extend this document.