@bevel-software/platform-core-backend 0.1.0

package/dist/modules/workspace/routine-write-policy.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Per-run write restriction for background/routine agents.
+ *
+ * The ontology-session gate ({@link ../workflow/session-ontology.service}) bounds
+ * WHICH ontology a run may write; this narrower gate bounds WHAT KIND of file a
+ * run may write, by extension. It exists for the `watchlist_check` routine, which is
+ * allowed to refresh dashboard views (`.html`) but must never touch the
+ * knowledge-graph nodes (`.md`) or any other file — a hard, code-level guarantee
+ * rather than a prompt request (a prompt-only rule has already proven insufficient).
+ *
+ * Keyed by the agent run's `sessionId` (the background agent passes its run id as
+ * the session id, which the internal token then carries onto every loopback tool
+ * call as `ctx.sessionId`). A restriction lives only for the duration of one
+ * in-process run, so the store is a plain in-memory map — no durability needed,
+ * unlike the ontology touched-set which must survive restarts and span the MCP
+ * proxy. The executor sets the restriction before streaming and clears it after.
+ */
+export interface IRoutineWritePolicy {
+    /**
+     * Confine a session's writes to the given file extensions (each including the
+     * leading dot, e.g. `['.html', '.htm']`). Overwrites any prior restriction for
+     * the session. A session with no restriction is unrestricted (the default for
+     * chat + `ontology_ingest` runs).
+     */
+    restrictToExtensions(sessionId: string, extensions: readonly string[]): void;
+    /** Drop a session's restriction (called at run end). */
+    clear(sessionId: string): void;
+    /**
+     * Throw a 403 `ToolError` when the session is restricted and `wsPath`'s
+     * extension is not on its allow-list. No session id, or no active restriction,
+     * always passes — so this is a no-op for every non-restricted caller.
+     */
+    assertPathWritable(sessionId: string | undefined, wsPath: string): void;
+    /**
+     * Throw a 403 `ToolError` when the session is restricted at all — for write
+     * tools with no single target path to check (arbitrary shell), which a
+     * restricted run must not be able to use as a write bypass.
+     */
+    assertUnrestricted(sessionId: string | undefined): void;
+}
+export declare class RoutineWritePolicyService implements IRoutineWritePolicy {
+    /** sessionId → allowed lowercased extensions. Absent = unrestricted. */
+    private readonly restrictions;
+    restrictToExtensions(sessionId: string, extensions: readonly string[]): void;
+    clear(sessionId: string): void;
+    assertPathWritable(sessionId: string | undefined, wsPath: string): void;
+    assertUnrestricted(sessionId: string | undefined): void;
+}
+//# sourceMappingURL=routine-write-policy.d.ts.map

package/dist/modules/workspace/routine-write-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routine-write-policy.d.ts","sourceRoot":"","sources":["../../../src/modules/workspace/routine-write-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IAC7E,wDAAwD;IACxD,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B;;;;OAIG;IACH,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACxE;;;;OAIG;IACH,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC;CACzD;AAED,qBAAa,yBAA0B,YAAW,mBAAmB;IACnE,wEAAwE;IACxE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAkC;IAE/D,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IAI5E,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAI9B,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAcvE,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;CAQxD"}

package/dist/modules/workspace/routine-write-policy.js

@@ -0,0 +1,46 @@
+/**
+ * Per-run write restriction for background/routine agents.
+ *
+ * The ontology-session gate ({@link ../workflow/session-ontology.service}) bounds
+ * WHICH ontology a run may write; this narrower gate bounds WHAT KIND of file a
+ * run may write, by extension. It exists for the `watchlist_check` routine, which is
+ * allowed to refresh dashboard views (`.html`) but must never touch the
+ * knowledge-graph nodes (`.md`) or any other file — a hard, code-level guarantee
+ * rather than a prompt request (a prompt-only rule has already proven insufficient).
+ *
+ * Keyed by the agent run's `sessionId` (the background agent passes its run id as
+ * the session id, which the internal token then carries onto every loopback tool
+ * call as `ctx.sessionId`). A restriction lives only for the duration of one
+ * in-process run, so the store is a plain in-memory map — no durability needed,
+ * unlike the ontology touched-set which must survive restarts and span the MCP
+ * proxy. The executor sets the restriction before streaming and clears it after.
+ */
+import { ToolError } from '../tool-helpers/tool.contract.js';
+export class RoutineWritePolicyService {
+    /** sessionId → allowed lowercased extensions. Absent = unrestricted. */
+    restrictions = new Map();
+    restrictToExtensions(sessionId, extensions) {
+        this.restrictions.set(sessionId, new Set(extensions.map((e) => e.toLowerCase())));
+    }
+    clear(sessionId) {
+        this.restrictions.delete(sessionId);
+    }
+    assertPathWritable(sessionId, wsPath) {
+        const allowed = sessionId ? this.restrictions.get(sessionId) : undefined;
+        if (!allowed)
+            return;
+        const lower = wsPath.toLowerCase();
+        for (const ext of allowed) {
+            if (lower.endsWith(ext))
+                return;
+        }
+        throw new ToolError(`This run may only write ${[...allowed].join(', ')} files (dashboard views); "${wsPath}" is blocked. ` +
+            'Knowledge-graph nodes and other files are read-only for this routine.', 403);
+    }
+    assertUnrestricted(sessionId) {
+        if (sessionId && this.restrictions.has(sessionId)) {
+            throw new ToolError('This run is restricted to writing dashboard views only, so shell commands (which could write any file) are disabled.', 403);
+        }
+    }
+}
+//# sourceMappingURL=routine-write-policy.js.map

package/dist/modules/workspace/routine-write-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routine-write-policy.js","sourceRoot":"","sources":["../../../src/modules/workspace/routine-write-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AA0B7D,MAAM,OAAO,yBAAyB;IACpC,wEAAwE;IACvD,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;IAE/D,oBAAoB,CAAC,SAAiB,EAAE,UAA6B;QACnE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC;IAED,KAAK,CAAC,SAAiB;QACrB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAED,kBAAkB,CAAC,SAA6B,EAAE,MAAc;QAC9D,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzE,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QACnC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO;QAClC,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,2BAA2B,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,8BAA8B,MAAM,gBAAgB;YACpG,uEAAuE,EACzE,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,kBAAkB,CAAC,SAA6B;QAC9C,IAAI,SAAS,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,SAAS,CACjB,sHAAsH,EACtH,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/modules/workspace/session-ontology.gate.d.ts

@@ -0,0 +1,112 @@
+/**
+ * Ontology-session boundary — the per-call gate used by the agent tool handlers.
+ *
+ * One decision fn, called by every gated file/graph handler:
+ *   READS  (isWrite=false) record the touched ontology and always allow.
+ *   WRITES (isWrite=true)  run the registered BLOCKING `preWrite` hooks
+ *                          (`WorkflowHooks`), then record. The core registers
+ *                          no hook, so core alone only TRACKS; the enterprise
+ *                          overlay registers the ontology block (see
+ *                          `modules/kb/ontology-block.hook.ts`), restoring
+ *                          "allowed only while the session is confined to a
+ *                          single ontology; once it has touched ≥2, all
+ *                          writes are blocked".
+ *
+ * Skips entirely when: the flag is off, the path is neutral (`ontologyOf` →
+ * null), the caller is not an agent, or the caller is the recovery bot. Fails
+ * CLOSED for an agent named-path operation that carries no `sessionId`.
+ *
+ * Lives beside `assertCanRead` in the workspace tools — it does NOT touch
+ * `acquireLock` (that gate is protected-branch-only; this boundary applies on
+ * all branches and to reads). See `docs/rp4-ontology-boundary-plan-v2.md`.
+ */
+import type { JsonSchema } from '../tool-registry/tool.contract.js';
+import { ToolError, type ToolContext } from '../tool-helpers/tool.contract.js';
+import type { ISessionOntologyService } from '../workflow/session-ontology.service.js';
+import type { WorkflowHooks } from '../workflow/workflow-hooks.js';
+/**
+ * The `sessionId` input the ontology-session boundary reads: the agent run /
+ * conversation id. The in-process agent supplies its thread id automatically
+ * (via its per-run internal token); an external agent has no ambient run id,
+ * so it must first mint one with the `start_session` tool and then pass it
+ * EXPLICITLY on every gated call — the MCP proxy is a pure passthrough and
+ * never injects args.
+ */
+export declare const SESSION_ID_INPUT: JsonSchema;
+/**
+ * Boundary warning appended to ontology-gated tool descriptions so the agent
+ * knows the restriction before it calls one. Action-then-why phrasing per
+ * docs/glossary.md.
+ */
+export declare const ONTOLOGY_BOUNDARY_NOTE = " Stay within one KnowledgeBase ontology per conversation: once this run has read or written files in two different ontologies, every later content write (write_file/edit_file/mkdir/unzip, and both endpoints of move_file/copy_file) is blocked with a 403 and no override. Reads and delete_file never block \u2014 but each one records the ontology it touched and can poison a later content write, so do broad cross-ontology exploration only when you do not intend to write. Note move_file/copy_file are blocked outright when source and destination are different ontologies, since they would carry content across.";
+/** Thrown when a write is refused because the session has crossed ontologies. */
+export declare class OntologyWriteBlockedError extends ToolError {
+    constructor(touched: string[], attempted: string, reason: 'multi-ontology' | 'different-ontology');
+}
+/** Thrown when an agent op on a named ontology carries no session id (fail closed). */
+export declare class MissingSessionError extends ToolError {
+    constructor();
+}
+export interface SessionOntologyGate {
+    service: ISessionOntologyService;
+    enabled: boolean;
+    kbDirName: string;
+    /** Lowercased email of the recovery/merge bot, which is exempt. */
+    recoveryBotEmail: string;
+    /**
+     * The workflow lifecycle-hook registry whose BLOCKING `preWrite` hooks
+     * decide whether a gated write/shell op proceeds. Core registers none (the
+     * gate then only tracks); the enterprise composition root registers the
+     * ontology block against `workflowService.hooks` — pass that same instance
+     * here.
+     */
+    hooks: WorkflowHooks;
+}
+/**
+ * Record a read of `wsPath`'s ontology into the session's touched set. Reads are
+ * always allowed — recording is the only effect — but each one widens the
+ * touched set and so can poison a later write (see {@link assertOntologyWriteAllowed}).
+ * Fails closed (`MissingSessionError`) for an agent read of a named ontology
+ * with no session id.
+ */
+export declare function recordOntologyRead(gate: SessionOntologyGate, ctx: ToolContext, wsPath: string): Promise<void>;
+/**
+ * Assert a write to `wsPath` is allowed, then record it. A write that would
+ * carry information into a second ontology is the thing the boundary blocks:
+ * permitted only while the session stays confined to the target ontology, and
+ * refused with `OntologyWriteBlockedError` once it has touched ≥2. Note `delete`
+ * is NOT a write here — removing a node propagates no cross-ontology
+ * information, so it goes through {@link recordOntologyRead}.
+ *
+ * The BLOCKING decision itself lives behind the `preWrite` hooks: the
+ * enterprise-registered ontology block evaluates-and-records atomically via
+ * `checkOperation(isWrite=true)` and throws to refuse (identical behavior to
+ * the previous in-gate decision). Core registers no hook, so with none the
+ * write is allowed and only the touch is recorded (tracking stays core). The
+ * follow-up read-record after the hooks is idempotent — a no-op when a hook
+ * already recorded the allowed write.
+ */
+export declare function assertOntologyWriteAllowed(gate: SessionOntologyGate, ctx: ToolContext, wsPath: string): Promise<void>;
+/**
+ * Session-level write-eligibility gate for write-capable tools that have no
+ * single resolvable target path to check per-call — currently `execute_command`
+ * (arbitrary shell). Such a tool cannot be path-confined, so we enforce the
+ * boundary at the coarser session level: once the run has crossed into ≥2
+ * ontologies (the point at which EVERY path-checked write is already refused),
+ * we refuse the tool outright, so shell can't become a write path around the
+ * boundary. A fresh or single-ontology session is still allowed; a residual gap
+ * remains (a single-ontology session could shell-write a *different* ontology),
+ * accepted because arbitrary shell cannot be path-confined and blocking all
+ * shell after one KB read would gut its read-style diagnostic use (git/grep/ls).
+ *
+ * Skips when: the flag is off, the caller is not an agent, the caller is the
+ * recovery bot, or there is no session id — there is no named path here to fail
+ * closed on, and with no session there is no touched set to evaluate.
+ *
+ * Like {@link assertOntologyWriteAllowed}, the refusal itself is the
+ * enterprise-registered `preWrite` hook's (it evaluates the touched set and
+ * throws); core registers none, so shell is never refused in a core-only
+ * deployment.
+ */
+export declare function assertShellAllowedWithinOntology(gate: SessionOntologyGate, ctx: ToolContext): Promise<void>;
+//# sourceMappingURL=session-ontology.gate.d.ts.map

package/dist/modules/workspace/session-ontology.gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-ontology.gate.d.ts","sourceRoot":"","sources":["../../../src/modules/workspace/session-ontology.gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AACpE,OAAO,EAAE,SAAS,EAAE,KAAK,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AACvF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAEnE;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,EAAE,UAI9B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,smBAC6jB,CAAC;AAEjmB,iFAAiF;AACjF,qBAAa,yBAA0B,SAAQ,SAAS;gBAC1C,OAAO,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,GAAG,oBAAoB;CAQlG;AAED,uFAAuF;AACvF,qBAAa,mBAAoB,SAAQ,SAAS;;CAQjD;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,uBAAuB,CAAC;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,KAAK,EAAE,aAAa,CAAC;CACtB;AA4BD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKnH;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,mBAAmB,EACzB,GAAG,EAAE,WAAW,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAQf;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,gCAAgC,CAAC,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAOjH"}

package/dist/modules/workspace/session-ontology.gate.js

@@ -0,0 +1,161 @@
+/**
+ * Ontology-session boundary — the per-call gate used by the agent tool handlers.
+ *
+ * One decision fn, called by every gated file/graph handler:
+ *   READS  (isWrite=false) record the touched ontology and always allow.
+ *   WRITES (isWrite=true)  run the registered BLOCKING `preWrite` hooks
+ *                          (`WorkflowHooks`), then record. The core registers
+ *                          no hook, so core alone only TRACKS; the enterprise
+ *                          overlay registers the ontology block (see
+ *                          `modules/kb/ontology-block.hook.ts`), restoring
+ *                          "allowed only while the session is confined to a
+ *                          single ontology; once it has touched ≥2, all
+ *                          writes are blocked".
+ *
+ * Skips entirely when: the flag is off, the path is neutral (`ontologyOf` →
+ * null), the caller is not an agent, or the caller is the recovery bot. Fails
+ * CLOSED for an agent named-path operation that carries no `sessionId`.
+ *
+ * Lives beside `assertCanRead` in the workspace tools — it does NOT touch
+ * `acquireLock` (that gate is protected-branch-only; this boundary applies on
+ * all branches and to reads). See `docs/rp4-ontology-boundary-plan-v2.md`.
+ */
+import { ontologyOf } from '../../shared/kb-layout.js';
+import { ToolError } from '../tool-helpers/tool.contract.js';
+/**
+ * The `sessionId` input the ontology-session boundary reads: the agent run /
+ * conversation id. The in-process agent supplies its thread id automatically
+ * (via its per-run internal token); an external agent has no ambient run id,
+ * so it must first mint one with the `start_session` tool and then pass it
+ * EXPLICITLY on every gated call — the MCP proxy is a pure passthrough and
+ * never injects args.
+ */
+export const SESSION_ID_INPUT = {
+    type: 'string',
+    description: 'The KnowledgeBase session id that scopes this run to one ontology. External agents (direct MCP calls and `call_tool_chain` alike): call the `start_session` tool ONCE at the very start of your work to obtain it, then pass that id here on EVERY gated call. The in-process agent runtime supplies this automatically (do not set it yourself).',
+};
+/**
+ * Boundary warning appended to ontology-gated tool descriptions so the agent
+ * knows the restriction before it calls one. Action-then-why phrasing per
+ * docs/glossary.md.
+ */
+export const ONTOLOGY_BOUNDARY_NOTE = ' Stay within one KnowledgeBase ontology per conversation: once this run has read or written files in two different ontologies, every later content write (write_file/edit_file/mkdir/unzip, and both endpoints of move_file/copy_file) is blocked with a 403 and no override. Reads and delete_file never block — but each one records the ontology it touched and can poison a later content write, so do broad cross-ontology exploration only when you do not intend to write. Note move_file/copy_file are blocked outright when source and destination are different ontologies, since they would carry content across.';
+/** Thrown when a write is refused because the session has crossed ontologies. */
+export class OntologyWriteBlockedError extends ToolError {
+    constructor(touched, attempted, reason) {
+        const msg = reason === 'multi-ontology'
+            ? `This conversation has already read across multiple ontologies (${touched.join(', ')}), so writing is no longer allowed. Start a new conversation to write to "${attempted}".`
+            : `This conversation is working in ${touched.join(', ')}, so it can't write to a different ontology ("${attempted}"). Start a new conversation to work in "${attempted}".`;
+        super(msg, 403);
+        this.name = 'OntologyWriteBlockedError';
+    }
+}
+/** Thrown when an agent op on a named ontology carries no session id (fail closed). */
+export class MissingSessionError extends ToolError {
+    constructor() {
+        super('This operation needs a KnowledgeBase session id and none was provided. Call the `start_session` tool once at the start of your work to obtain a sessionId, then pass it explicitly as `sessionId` on every gated call (direct MCP calls and `call_tool_chain` alike).', 403);
+        this.name = 'MissingSessionError';
+    }
+}
+/** Only internal/external agent callers are gated; `session` (browser JWT) and humans are not. */
+function isAgentSource(ctx) {
+    return ctx.source === 'internal' || ctx.source === 'external';
+}
+/**
+ * Shared gate preamble for the two per-path operations below. Returns `'skip'`
+ * when the boundary doesn't apply to this call (flag off, neutral path,
+ * non-agent caller, or recovery bot), otherwise the session id to evaluate
+ * against — throwing `MissingSessionError` (fail closed) when an agent op on a
+ * named ontology carries none.
+ */
+function resolveGatedSession(gate, ctx, wsPath) {
+    if (!gate.enabled)
+        return 'skip';
+    // Neutral paths never pin/record/block — skip before any identity work.
+    if (ontologyOf(wsPath, gate.kbDirName) === null)
+        return 'skip';
+    // Humans (UI routes) and browser-JWT callers never hit these tools; only
+    // agent tool calls are gated.
+    if (!isAgentSource(ctx))
+        return 'skip';
+    // The recovery/merge bot legitimately spans ontologies — exempt by identity.
+    if (ctx.user.email.toLowerCase() === gate.recoveryBotEmail)
+        return 'skip';
+    // Fail closed: an agent operation on a named ontology must carry a session id.
+    if (!ctx.sessionId)
+        throw new MissingSessionError();
+    return ctx.sessionId;
+}
+/**
+ * Record a read of `wsPath`'s ontology into the session's touched set. Reads are
+ * always allowed — recording is the only effect — but each one widens the
+ * touched set and so can poison a later write (see {@link assertOntologyWriteAllowed}).
+ * Fails closed (`MissingSessionError`) for an agent read of a named ontology
+ * with no session id.
+ */
+export async function recordOntologyRead(gate, ctx, wsPath) {
+    const sessionId = resolveGatedSession(gate, ctx, wsPath);
+    if (sessionId === 'skip')
+        return;
+    // checkOperation(isWrite=false) records the touch and always allows.
+    await gate.service.checkOperation(sessionId, wsPath, false, gate.kbDirName);
+}
+/**
+ * Assert a write to `wsPath` is allowed, then record it. A write that would
+ * carry information into a second ontology is the thing the boundary blocks:
+ * permitted only while the session stays confined to the target ontology, and
+ * refused with `OntologyWriteBlockedError` once it has touched ≥2. Note `delete`
+ * is NOT a write here — removing a node propagates no cross-ontology
+ * information, so it goes through {@link recordOntologyRead}.
+ *
+ * The BLOCKING decision itself lives behind the `preWrite` hooks: the
+ * enterprise-registered ontology block evaluates-and-records atomically via
+ * `checkOperation(isWrite=true)` and throws to refuse (identical behavior to
+ * the previous in-gate decision). Core registers no hook, so with none the
+ * write is allowed and only the touch is recorded (tracking stays core). The
+ * follow-up read-record after the hooks is idempotent — a no-op when a hook
+ * already recorded the allowed write.
+ */
+export async function assertOntologyWriteAllowed(gate, ctx, wsPath) {
+    const sessionId = resolveGatedSession(gate, ctx, wsPath);
+    if (sessionId === 'skip')
+        return;
+    await gate.hooks.runPreWrite({ kind: 'file-write', sessionId, wsPath });
+    // Tracking stays core: record the (now-allowed) write's ontology touch.
+    // A blocked write never reaches this line, so it records nothing — same as
+    // before the hook split.
+    await gate.service.checkOperation(sessionId, wsPath, false, gate.kbDirName);
+}
+/**
+ * Session-level write-eligibility gate for write-capable tools that have no
+ * single resolvable target path to check per-call — currently `execute_command`
+ * (arbitrary shell). Such a tool cannot be path-confined, so we enforce the
+ * boundary at the coarser session level: once the run has crossed into ≥2
+ * ontologies (the point at which EVERY path-checked write is already refused),
+ * we refuse the tool outright, so shell can't become a write path around the
+ * boundary. A fresh or single-ontology session is still allowed; a residual gap
+ * remains (a single-ontology session could shell-write a *different* ontology),
+ * accepted because arbitrary shell cannot be path-confined and blocking all
+ * shell after one KB read would gut its read-style diagnostic use (git/grep/ls).
+ *
+ * Skips when: the flag is off, the caller is not an agent, the caller is the
+ * recovery bot, or there is no session id — there is no named path here to fail
+ * closed on, and with no session there is no touched set to evaluate.
+ *
+ * Like {@link assertOntologyWriteAllowed}, the refusal itself is the
+ * enterprise-registered `preWrite` hook's (it evaluates the touched set and
+ * throws); core registers none, so shell is never refused in a core-only
+ * deployment.
+ */
+export async function assertShellAllowedWithinOntology(gate, ctx) {
+    if (!gate.enabled)
+        return;
+    if (!isAgentSource(ctx))
+        return;
+    if (ctx.user.email.toLowerCase() === gate.recoveryBotEmail)
+        return;
+    if (!ctx.sessionId)
+        return;
+    await gate.hooks.runPreWrite({ kind: 'shell', sessionId: ctx.sessionId });
+}
+//# sourceMappingURL=session-ontology.gate.js.map

package/dist/modules/workspace/session-ontology.gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-ontology.gate.js","sourceRoot":"","sources":["../../../src/modules/workspace/session-ontology.gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAEvD,OAAO,EAAE,SAAS,EAAoB,MAAM,kCAAkC,CAAC;AAI/E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAe;IAC1C,IAAI,EAAE,QAAQ;IACd,WAAW,EACT,mVAAmV;CACtV,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GACjC,8lBAA8lB,CAAC;AAEjmB,iFAAiF;AACjF,MAAM,OAAO,yBAA0B,SAAQ,SAAS;IACtD,YAAY,OAAiB,EAAE,SAAiB,EAAE,MAA+C;QAC/F,MAAM,GAAG,GACP,MAAM,KAAK,gBAAgB;YACzB,CAAC,CAAC,kEAAkE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,6EAA6E,SAAS,IAAI;YAChL,CAAC,CAAC,mCAAmC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,iDAAiD,SAAS,4CAA4C,SAAS,IAAI,CAAC;QAC/K,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChB,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED,uFAAuF;AACvF,MAAM,OAAO,mBAAoB,SAAQ,SAAS;IAChD;QACE,KAAK,CACH,uQAAuQ,EACvQ,GAAG,CACJ,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAkBD,kGAAkG;AAClG,SAAS,aAAa,CAAC,GAAgB;IACrC,OAAO,GAAG,CAAC,MAAM,KAAK,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,CAAC;AAChE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,IAAyB,EAAE,GAAgB,EAAE,MAAc;IACtF,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC;IACjC,wEAAwE;IACxE,IAAI,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAC/D,yEAAyE;IACzE,8BAA8B;IAC9B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IACvC,6EAA6E;IAC7E,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,gBAAgB;QAAE,OAAO,MAAM,CAAC;IAC1E,+EAA+E;IAC/E,IAAI,CAAC,GAAG,CAAC,SAAS;QAAE,MAAM,IAAI,mBAAmB,EAAE,CAAC;IACpD,OAAO,GAAG,CAAC,SAAS,CAAC;AACvB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAyB,EAAE,GAAgB,EAAE,MAAc;IAClG,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACzD,IAAI,SAAS,KAAK,MAAM;QAAE,OAAO;IACjC,qEAAqE;IACrE,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,IAAyB,EACzB,GAAgB,EAChB,MAAc;IAEd,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACzD,IAAI,SAAS,KAAK,MAAM;QAAE,OAAO;IACjC,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IACxE,wEAAwE;IACxE,2EAA2E;IAC3E,yBAAyB;IACzB,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,IAAyB,EAAE,GAAgB;IAChG,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO;IAC1B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;QAAE,OAAO;IAChC,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,gBAAgB;QAAE,OAAO;IACnE,IAAI,CAAC,GAAG,CAAC,SAAS;QAAE,OAAO;IAE3B,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;AAC5E,CAAC"}

package/dist/modules/workspace/session-sink.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Port behind `start_session` (workspace.tools.ts): mints the session id an
+ * external agent scopes its ontology boundary under. The workspace module owns
+ * the port; WHAT backs the id is the composition root's choice:
+ *
+ * - Core default ({@link UuidSessionSink}): a bare random id — sufficient for
+ *   the session-ontology gate, with no app-side session record.
+ * - The enterprise app substitutes a sink that mints a REAL chat thread, so the
+ *   same id also works end to end with `ask` (its sessionId IS a chat thread).
+ *   See the `start_session` comment in workspace.tools.ts for why that
+ *   unification matters.
+ */
+export interface ISessionSink {
+    /** Mint a session id for an external agent run started at `startedAt`. */
+    createSession(userId: string, startedAt: Date): Promise<{
+        sessionId: string;
+    }>;
+}
+/** Core default: a bare random id — no app-side session record. */
+export declare class UuidSessionSink implements ISessionSink {
+    createSession(): Promise<{
+        sessionId: string;
+    }>;
+}
+//# sourceMappingURL=session-sink.d.ts.map

package/dist/modules/workspace/session-sink.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-sink.d.ts","sourceRoot":"","sources":["../../../src/modules/workspace/session-sink.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,YAAY;IAC3B,0EAA0E;IAC1E,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChF;AAED,mEAAmE;AACnE,qBAAa,eAAgB,YAAW,YAAY;IAC5C,aAAa,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAGtD"}

package/dist/modules/workspace/session-sink.js

@@ -0,0 +1,8 @@
+import { randomUUID } from 'node:crypto';
+/** Core default: a bare random id — no app-side session record. */
+export class UuidSessionSink {
+    async createSession() {
+        return { sessionId: randomUUID() };
+    }
+}
+//# sourceMappingURL=session-sink.js.map

package/dist/modules/workspace/session-sink.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-sink.js","sourceRoot":"","sources":["../../../src/modules/workspace/session-sink.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAmBzC,mEAAmE;AACnE,MAAM,OAAO,eAAe;IAC1B,KAAK,CAAC,aAAa;QACjB,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC;IACrC,CAAC;CACF"}

package/dist/modules/workspace/spill-store.d.ts

@@ -0,0 +1,24 @@
+export declare class SpillStore {
+    private readonly root;
+    constructor(root: string);
+    /** Is this `read_file` path a spill ref rather than a workspace-relative path? */
+    isSpillRef(p: string): boolean;
+    /**
+     * Park `content` and return the ref to read it back with. The ref is what an
+     * agent passes to `read_file` (its `branch` is ignored for spill reads).
+     */
+    write(content: string): Promise<{
+        ref: string;
+        bytes: number;
+    }>;
+    /**
+     * Read a spill back by ref, optionally a byte window `[offset, offset+limit)`.
+     * The window is range-read straight off disk (`createReadStream` with
+     * `start`/`end`), so a multi-MB spill never lands in memory just to return a
+     * slice. Throws if the ref is malformed or the spill has been GC'd.
+     */
+    read(ref: string, offset?: number, limit?: number): Promise<string>;
+    /** Best-effort prune of spills older than the TTL. Never throws. */
+    private gc;
+}
+//# sourceMappingURL=spill-store.d.ts.map

package/dist/modules/workspace/spill-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spill-store.d.ts","sourceRoot":"","sources":["../../../src/modules/workspace/spill-store.ts"],"names":[],"mappings":"AAoBA,qBAAa,UAAU;IACT,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,MAAM;IAEzC,kFAAkF;IAClF,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO;IAI9B;;;OAGG;IACG,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAQrE;;;;;OAKG;IACG,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAiBzE,oEAAoE;YACtD,EAAE;CAkBjB"}

package/dist/modules/workspace/spill-store.js

@@ -0,0 +1,87 @@
+import { createReadStream, promises as fs } from 'node:fs';
+import path from 'node:path';
+/**
+ * Global store for `call_tool_chain` spill files. When a tool-chain result is too
+ * large to return inline, the full JSON is parked here — OUTSIDE any workspace,
+ * in a single shared directory (`config.spillRoot`, sibling of `workspacesRoot`) —
+ * so any agent, in-process or external over MCP, can read it back regardless of
+ * which branch's workspace (if any) it is operating on.
+ *
+ * Read-back is via the regular `read_file` tool: a spill is addressed by a
+ * reserved, workspace-independent ref (`__tool_chain_spill__/<id>.json`) that
+ * `read_file` recognises and resolves here instead of against a workspace
+ * filesystem. Files are ephemeral and never committed; each write best-effort
+ * prunes entries older than the TTL so the directory can't grow without bound.
+ */
+const SPILL_PREFIX = '__tool_chain_spill__/';
+const TTL_MS = 24 * 60 * 60 * 1000; // 24h
+const ID_RE = /^[A-Za-z0-9._-]+$/; // no path separators — keeps reads inside the root
+export class SpillStore {
+    root;
+    constructor(root) {
+        this.root = root;
+    }
+    /** Is this `read_file` path a spill ref rather than a workspace-relative path? */
+    isSpillRef(p) {
+        return p.startsWith(SPILL_PREFIX);
+    }
+    /**
+     * Park `content` and return the ref to read it back with. The ref is what an
+     * agent passes to `read_file` (its `branch` is ignored for spill reads).
+     */
+    async write(content) {
+        await fs.mkdir(this.root, { recursive: true });
+        void this.gc();
+        const id = `tool-chain-${new Date().toISOString().replace(/[:.]/g, '-')}-${randomSuffix()}.json`;
+        await fs.writeFile(path.join(this.root, id), content, 'utf8');
+        return { ref: SPILL_PREFIX + id, bytes: Buffer.byteLength(content, 'utf8') };
+    }
+    /**
+     * Read a spill back by ref, optionally a byte window `[offset, offset+limit)`.
+     * The window is range-read straight off disk (`createReadStream` with
+     * `start`/`end`), so a multi-MB spill never lands in memory just to return a
+     * slice. Throws if the ref is malformed or the spill has been GC'd.
+     */
+    async read(ref, offset, limit) {
+        const id = ref.slice(SPILL_PREFIX.length);
+        if (!ID_RE.test(id))
+            throw new Error(`Invalid spill ref "${ref}".`);
+        if (typeof limit === 'number' && limit <= 0)
+            return '';
+        const start = typeof offset === 'number' && offset > 0 ? offset : 0;
+        // `end` is INCLUSIVE in createReadStream, so [start, start+limit).
+        const end = typeof limit === 'number' ? start + limit - 1 : undefined;
+        const filePath = path.join(this.root, id);
+        return new Promise((resolve, reject) => {
+            const chunks = [];
+            const stream = createReadStream(filePath, end !== undefined ? { start, end } : { start });
+            stream.on('data', (c) => chunks.push(c));
+            stream.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
+            stream.on('error', reject);
+        });
+    }
+    /** Best-effort prune of spills older than the TTL. Never throws. */
+    async gc() {
+        try {
+            const now = Date.now();
+            const names = await fs.readdir(this.root);
+            await Promise.all(names.map(async (name) => {
+                try {
+                    const stat = await fs.stat(path.join(this.root, name));
+                    if (now - stat.mtimeMs > TTL_MS)
+                        await fs.rm(path.join(this.root, name), { force: true });
+                }
+                catch {
+                    // file vanished mid-sweep / unreadable — ignore
+                }
+            }));
+        }
+        catch {
+            // root not yet created or unreadable — nothing to prune
+        }
+    }
+}
+function randomSuffix() {
+    return Math.random().toString(36).slice(2, 8);
+}
+//# sourceMappingURL=spill-store.js.map

package/dist/modules/workspace/spill-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spill-store.js","sourceRoot":"","sources":["../../../src/modules/workspace/spill-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AAC3D,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B;;;;;;;;;;;;GAYG;AACH,MAAM,YAAY,GAAG,uBAAuB,CAAC;AAC7C,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,MAAM;AAC1C,MAAM,KAAK,GAAG,mBAAmB,CAAC,CAAC,mDAAmD;AAEtF,MAAM,OAAO,UAAU;IACQ;IAA7B,YAA6B,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;IAE7C,kFAAkF;IAClF,UAAU,CAAC,CAAS;QAClB,OAAO,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK,CAAC,OAAe;QACzB,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,EAAE,GAAG,cAAc,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,YAAY,EAAE,OAAO,CAAC;QACjG,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9D,OAAO,EAAE,GAAG,EAAE,YAAY,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;IAC/E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,MAAe,EAAE,KAAc;QACrD,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;QACpE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,IAAI,CAAC;YAAE,OAAO,EAAE,CAAC;QACvD,MAAM,KAAK,GAAG,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,mEAAmE;QACnE,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1C,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC7C,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1F,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAW,CAAC,CAAC,CAAC;YACnD,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACxE,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,oEAAoE;IAC5D,KAAK,CAAC,EAAE;QACd,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1C,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;gBACvB,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;oBACvD,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,MAAM;wBAAE,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC5F,CAAC;gBAAC,MAAM,CAAC;oBACP,gDAAgD;gBAClD,CAAC;YACH,CAAC,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;IACH,CAAC;CACF;AAED,SAAS,YAAY;IACnB,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAChD,CAAC"}

package/dist/modules/workspace/workspace.routes.d.ts

@@ -0,0 +1,25 @@
+import express from 'express';
+import type { IWorkflowService } from '@bevel-software/platform-shared';
+import type { WorkspaceService } from './workspace.service.js';
+import type { AuthService } from '../auth/auth.service.js';
+import type { IAccessControl } from '../access/access-control.interface.js';
+import type { ICreatorAccess } from '../access/creator-access.js';
+import type { WorkflowEventBus } from '../workflow/event-bus.js';
+import '../auth/auth.middleware.js';
+/**
+ * Workspaces are per-branch (PLAN §3). Any authenticated user can access
+ * any branch's workspace; coordination of concurrent edits lives in the
+ * file-lock service, not in giving each user their own clone. We therefore
+ * gate every handler on authentication only — there is no "this is my
+ * workspace" ownership check.
+ *
+ * Every file-mutating route on this surface — `PUT /file`, `DELETE /file`,
+ * `PATCH /file` (move), `POST /directory`, `POST /upload`, `POST /unzip` —
+ * routes its write through `withLock(path, op)`: acquire the per-file
+ * workflow lock, perform the op, then release. The release commits the
+ * file as a one-file change attributed to the user and pushes it to origin,
+ * exactly like the lock-aware filesystem the agent writes through. There
+ * is no separate "share" step; save and share are fused.
+ */
+export declare function createWorkspaceRoutes(workspaceService: WorkspaceService, authService: AuthService, workflowService: IWorkflowService, eventBus: WorkflowEventBus, accessControl: IAccessControl, kbDirName: string, creatorAccess: ICreatorAccess): express.Router;
+//# sourceMappingURL=workspace.routes.d.ts.map

package/dist/modules/workspace/workspace.routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/workspace/workspace.routes.ts"],"names":[],"mappings":"AAEA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAY,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAYlF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAE5E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAElE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,4BAA4B,CAAC;AAIpC;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,gBAAgB,EAAE,gBAAgB,EAClC,WAAW,EAAE,WAAW,EACxB,eAAe,EAAE,gBAAgB,EACjC,QAAQ,EAAE,gBAAgB,EAC1B,aAAa,EAAE,cAAc,EAC7B,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,cAAc,GAC5B,OAAO,CAAC,MAAM,CAq+BhB"}