@bevel-software/platform-core-backend 0.15.1 → 0.20.0

package/src/modules/workspace/file-readers/file-reader.ts

@@ -9,6 +9,7 @@
  * branch on extensions themselves.
  */
 import { fileExtension } from './doc-extract.types.js';
+import { sanitizedPath } from '../../../shared/printable.js';
 
 /**
  * What reading a file produces, before the tool layer shapes it for MCP:
@@ -24,13 +25,13 @@ export type ReadResult =
   | { kind: 'refusal'; message: string };
 
 /**
- * `path` as interpolated into a ONE-LINE notice or refusal: CR/LF are shown
- * as escapes rather than obeyed (the same rule as `extractionMarker`), so a
- * filename cannot forge extra output lines.
+ * `path` as interpolated into a ONE-LINE notice or refusal: line breaks are
+ * shown as escapes rather than obeyed (the rule `extractionMarker` uses too),
+ * so a filename cannot forge extra output lines. The rule itself lives in
+ * `shared/printable`, because the missing-path refusals (`not-found.ts`) need
+ * the same one and the shared layer is the only one both can reach.
  */
-export function displayPath(path: string): string {
-  return path.replace(/[\r\n]/g, (c) => (c === '\r' ? '\\r' : '\\n'));
-}
+export const displayPath = sanitizedPath;
 
 /**
  * Any text interpolated into a ONE-LINE notice — a path, or an extractor's
@@ -39,6 +40,13 @@ export function displayPath(path: string): string {
  */
 export const oneLine = displayPath;
 
+/**
+ * What a file IS, as the binary capability contract names it in a refusal:
+ * `text` (the text tools own it), `document` (read_file extracts it; the
+ * legacy .doc/.ppt/.xls count too), `image`, `archive`, or any other `binary`.
+ */
+export type FileKind = 'text' | 'document' | 'image' | 'archive' | 'binary';
+
 /** A per-format file reader. Register implementations in `createFileReaderRegistry`. */
 export interface FileReader {
   /** The extensions this reader owns — lowercase, with the dot. Empty for the default (fallback) reader. */
@@ -54,6 +62,14 @@ export interface FileReader {
   greppableText?(bytes: Buffer, path: string): Promise<string | null>;
   /** May the agent TEXT-editing tools (write_file/write_files/edit_file) touch this file? */
   readonly textEditable: boolean;
+  /** The kind this reader's extensions name — what a `binary_not_writable` refusal reports. */
+  readonly fileKind: FileKind;
+  /**
+   * The MIME type this reader's extensions name for `path` — what `file_stat`
+   * reports as `mime` — or undefined when it names none (the fallback reader
+   * on an unknown extension; stat then sniffs the content).
+   */
+  mimeFor?(path: string): string | undefined;
   /**
    * Format-specific copy for the write-refusal thrown when `textEditable` is
    * false (see `assertNotDocumentEdit` in workspace.tools.ts). Absent = the
@@ -97,6 +113,11 @@ export class FileReaderRegistry {
     }
   }
 
+  /** Every extension some reader claims (lowercase, with the dot); the fallback owns the rest. */
+  ownedExtensions(): string[] {
+    return [...this.byExtension.keys()];
+  }
+
   /** The reader owning `path`'s extension (lowercased by `fileExtension`), or the fallback. */
   readerFor(path: string): FileReader {
     return this.byExtension.get(fileExtension(path)) ?? this.fallback;

package/src/modules/workspace/file-readers/image-reader.ts

@@ -15,14 +15,19 @@ import {
  * note); over it, the honest downscale refusal — see image-read.ts for the
  * cap arithmetic and header-parsing details.
  *
- * No `greppableText`: a picture is never text-searchable. And images stay
- * `textEditable` — the write tools only refuse formats whose reads are lossy
- * EXTRACTIONS (documents); an image read is the real bytes, and image writes
- * were never gated.
+ * No `greppableText`: a picture is never text-searchable. Not `textEditable`
+ * either: a picture is bytes, and text written to `logo.png` could only
+ * produce a broken image — new pictures arrive through upload, existing ones
+ * travel with copy_file/move_file.
  */
 export class ImageReader implements FileReader {
   readonly extensions: readonly string[] = IMAGE_EXTENSIONS;
-  readonly textEditable = true;
+  readonly textEditable = false;
+  readonly fileKind = 'image' as const;
+
+  mimeFor(path: string): string {
+    return imageMimeType(path);
+  }
 
   async read(bytes: Buffer, path: string): Promise<ReadResult> {
     const mime = imageMimeType(path);

package/src/modules/workspace/file-readers/ooxml-text.ts

@@ -406,6 +406,33 @@ export function xmlElementBlocks(
   return out;
 }
 
+/**
+ * Break elements and the character each stands for in extracted text. A soft
+ * line break (`<w:br/>`, `<w:cr/>`, `<a:br/>`) and a tab (`<w:tab/>`) are
+ * EMPTY elements, so collecting run text alone gave them no character at all
+ * and fused the words either side: "however", a soft break, "suits" read as
+ * "howeversuits". A line break becomes a space rather than a newline because
+ * an extraction's lines are its paragraphs (and table rows) — a newline here
+ * would split one paragraph into two.
+ */
+const BREAK_TEXT: ReadonlyMap<string, string> = new Map([
+  ['br', ' '],
+  ['cr', ' '],
+  ['tab', '\t'],
+]);
+
+/**
+ * Elements whose break-named children are NOT text. `tab` also names a tab
+ * STOP (`<w:pPr><w:tabs><w:tab w:pos="720"/>`, `<a:pPr><a:tabLst><a:tab/>`),
+ * which is layout, and every such list sits inside a `…Pr` properties element
+ * (`pPr`, `rPr`, `lvl1pPr`, …). A tracked DELETION (`<w:del>`, `<w:moveFrom>`)
+ * is omitted from the text already — its `<w:delText>` is never a `<w:t>` —
+ * so a break inside one is omitted with it.
+ */
+function suppressesBreaks(local: string): boolean {
+  return local.endsWith('Pr') || local === 'del' || local === 'moveFrom';
+}
+
 /**
  * The text of one OOXML paragraph: every `<w:t>`/`<a:t>` run's character
  * content, concatenated with NO separator — Word/PowerPoint split runs
@@ -413,17 +440,24 @@ export function xmlElementBlocks(
  * `tag` is the run tag ('w:t' for docx, 'a:t' for pptx). A self-closing
  * `<w:t/>` is an empty run and contributes nothing, exactly as it did when
  * the pattern simply failed to match it.
+ *
+ * The exception is a break element between runs: a soft line break adds one
+ * space and a tab element one tab, in document order — see {@link BREAK_TEXT}.
  */
 export function paragraphRunText(paragraphXml: string, localTag: string): string {
   let out = '';
   let inRun = 0;
+  let suppressed = 0;
   let inCdata = false;
   let depth = 0;
   const parser = new Parser(
     {
       onopentag(name) {
         depth++;
-        if (localName(name) === localTag) inRun++;
+        const local = localName(name);
+        if (local === localTag) inRun++;
+        if (suppressesBreaks(local)) suppressed++;
+        else if (suppressed === 0 && BREAK_TEXT.has(local)) out += BREAK_TEXT.get(local);
         if (depth > MAX_ELEMENT_DEPTH) throw TOO_DEEP;
       },
       // TEXT, never the raw body: a run's body is markup as well as characters
@@ -445,7 +479,9 @@ export function paragraphRunText(paragraphXml: string, localTag: string): string
         inCdata = false;
       },
       onclosetag(name) {
-        if (localName(name) === localTag && inRun > 0) inRun--;
+        const local = localName(name);
+        if (local === localTag && inRun > 0) inRun--;
+        if (suppressesBreaks(local) && suppressed > 0) suppressed--;
         depth--;
       },
     },

package/src/modules/workspace/file-readers/text-reader.ts

@@ -1,8 +1,13 @@
 import { isUtf8 } from 'node:buffer';
 import { fileExtension } from './doc-extract.types.js';
-import { displayPath, type FileReader, type ReadResult } from './file-reader.js';
+import { displayPath, type FileKind, type FileReader, type ReadResult } from './file-reader.js';
 
-/** Minimal extension→mime map for the binary-read notice (fallback: octet-stream). */
+/**
+ * Extension→mime for the binary-read notice and for the `mime` `file_stat`
+ * reports (fallback: octet-stream, or text/plain for sniffed text). Every
+ * extension a reader registers must name its mime here or in that reader's
+ * own `mimeFor` — the registry test enforces it.
+ */
 const MIME_BY_EXT: Record<string, string> = {
   '.png': 'image/png',
   '.jpg': 'image/jpeg',
@@ -11,8 +16,13 @@ const MIME_BY_EXT: Record<string, string> = {
   '.webp': 'image/webp',
   '.bmp': 'image/bmp',
   '.ico': 'image/x-icon',
+  '.tif': 'image/tiff',
+  '.tiff': 'image/tiff',
+  '.heic': 'image/heic',
+  '.avif': 'image/avif',
   '.zip': 'application/zip',
   '.gz': 'application/gzip',
+  '.tgz': 'application/gzip',
   '.tar': 'application/x-tar',
   '.7z': 'application/x-7z-compressed',
   '.rar': 'application/vnd.rar',
@@ -21,16 +31,37 @@ const MIME_BY_EXT: Record<string, string> = {
   '.xls': 'application/vnd.ms-excel',
   '.mp3': 'audio/mpeg',
   '.wav': 'audio/wav',
+  '.ogg': 'audio/ogg',
+  '.m4a': 'audio/mp4',
   '.mp4': 'video/mp4',
   '.mov': 'video/quicktime',
+  '.webm': 'video/webm',
   '.woff': 'font/woff',
   '.woff2': 'font/woff2',
   '.ttf': 'font/ttf',
+  '.otf': 'font/otf',
   '.pdf': 'application/pdf',
+  '.docx': 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+  '.pptx': 'application/vnd.openxmlformats-officedocument.presentationml.presentation',
+  '.xlsx': 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+  '.odt': 'application/vnd.oasis.opendocument.text',
+  '.odp': 'application/vnd.oasis.opendocument.presentation',
+  '.ods': 'application/vnd.oasis.opendocument.spreadsheet',
+  '.eml': 'message/rfc822',
+  '.msg': 'application/vnd.ms-outlook',
   '.wasm': 'application/wasm',
   '.exe': 'application/vnd.microsoft.portable-executable',
+  '.dll': 'application/vnd.microsoft.portable-executable',
+  '.so': 'application/x-sharedlib',
+  // `.bin` itself names raw bytes: an extension-given type, not the fallback.
+  '.bin': 'application/octet-stream',
 };
 
+/** The mime `path`'s extension names, or undefined when the table has none. */
+export function extensionMime(path: string): string | undefined {
+  return MIME_BY_EXT[fileExtension(path)];
+}
+
 /**
  * Text is what the fallback reader may hand to the text tools: no NUL byte
  * AND valid UTF-8. A NUL-free file that does not decode as UTF-8 is still
@@ -38,7 +69,7 @@ const MIME_BY_EXT: Record<string, string> = {
  * round-trip the original bytes. Checked on the raw bytes, so a large binary
  * is refused without allocating its full decoded string first.
  */
-function isTextBytes(bytes: Buffer): boolean {
+export function isTextBytes(bytes: Buffer): boolean {
   return !bytes.includes(0) && isUtf8(bytes);
 }
 
@@ -55,6 +86,7 @@ export class TextReader implements FileReader {
   /** Fallback reader: matched by the registry's default, not by extension. */
   readonly extensions: readonly string[] = [];
   readonly textEditable: boolean = true;
+  readonly fileKind: FileKind = 'text';
 
   async read(bytes: Buffer, path: string): Promise<ReadResult> {
     return isTextBytes(bytes)
@@ -80,10 +112,14 @@ export class TextReader implements FileReader {
     return isTextBytes(bytes) ? bytes.toString('utf8') : null; // skip binary (NUL / invalid UTF-8)
   }
 
+  mimeFor(path: string): string | undefined {
+    return extensionMime(path);
+  }
+
   /** The honest one-line notice returned INSTEAD of raw bytes for unreadable binary content. */
   protected binaryNotice(path: string, sizeBytes: number): string {
     const ext = fileExtension(path);
-    const mime = MIME_BY_EXT[ext] ?? 'application/octet-stream';
+    const mime = extensionMime(path) ?? 'application/octet-stream';
     const zipHint = ext === '.zip' ? ' Use the unzip tool to extract its contents.' : '';
     return `[${displayPath(path)} is a binary file (${mime}, ${sizeBytes} bytes) — not readable as text.${zipHint}]`;
   }
@@ -107,6 +143,7 @@ const MODERN_BY_LEGACY: Record<string, string> = { '.doc': '.docx', '.ppt': '.pp
 export class LegacyOfficeReader extends TextReader {
   override readonly extensions: readonly string[] = ['.doc', '.ppt', '.xls'];
   override readonly textEditable: boolean = false;
+  override readonly fileKind: FileKind = 'document';
 
   /** The write-refusal for the agent text-editing tools (see `assertNotDocumentEdit`). */
   editRefusal(path: string): string {
@@ -129,3 +166,23 @@ export class LegacyOfficeReader extends TextReader {
     );
   }
 }
+
+/**
+ * Extensions that name bytes no text tool may produce: archives, media, fonts,
+ * executables, and the image formats read_file does not return as pictures.
+ * Reads and greps stay the text reader's (a mislabeled `.zip` that holds text
+ * still reads as text, and binary content still gets the one-line notice), but
+ * the write tools refuse them by name — text written to `bundle.zip` can only
+ * ever be a broken archive. Bytes of these kinds arrive through upload, or
+ * travel with copy_file/move_file.
+ */
+export class BinaryReader extends TextReader {
+  override readonly textEditable: boolean = false;
+
+  constructor(
+    override readonly extensions: readonly string[],
+    override readonly fileKind: FileKind,
+  ) {
+    super();
+  }
+}

package/src/modules/workspace/git-internals.middleware.ts

@@ -0,0 +1,86 @@
+import express from 'express';
+import { GitInternalsError } from '../../shared/domain-errors.js';
+import { domainErrorBody } from '../../shared/http-errors.js';
+import { assertNotGitInternals, hasGitInternalsSegment } from '../../shared/git-internals.js';
+import '../auth/auth.middleware.js'; // Express Request augmentation
+
+/** The query and body fields through which a workspace route names a path. */
+const GIT_GUARDED_QUERY_KEYS = ['path', 'toDir'] as const;
+// `paths` is the access batch's list; `ancestor` is the folder a
+// remove-from-parent cascades up to. Both name workspace paths, so both are
+// judged — a field that names a path and is not here is a way around this.
+const GIT_GUARDED_BODY_KEYS = ['path', 'oldPath', 'newPath', 'destination', 'paths', 'ancestor'] as const;
+/**
+ * `from` names a PATH on the prospective-access route (`?from=<file>&toDir=…`)
+ * and a BRANCH on the workflow comparison (`?from=<branch>`), so it is judged
+ * only where it is a path — a branch called after the git folder is refused
+ * by the branch-name rule, not by this one.
+ */
+const PATH_FROM_ROUTE = /\/access\/prospective\/?$/;
+
+/** Every workspace path a request names, array-shaped queries included. */
+export function gitGuardedInputs(req: express.Request): string[] {
+  const out: string[] = [];
+  const add = (value: unknown) => {
+    for (const v of Array.isArray(value) ? value : [value]) if (typeof v === 'string' && v.length > 0) out.push(v);
+  };
+  const query = req.query as Record<string, unknown>;
+  for (const key of GIT_GUARDED_QUERY_KEYS) add(query[key]);
+  if (PATH_FROM_ROUTE.test(req.path)) add(query.from);
+  const body = req.body as unknown;
+  if (body && typeof body === 'object' && !Buffer.isBuffer(body)) {
+    for (const key of GIT_GUARDED_BODY_KEYS) add((body as Record<string, unknown>)[key]);
+  }
+  return out;
+}
+
+/**
+ * The git folder is never reachable through the `/workspace/:id` surface (see
+ * `shared/git-internals.ts`). Checked once, ahead of every route, on each
+ * input that names a workspace path: before the read gate, which would
+ * otherwise answer differently for a path that exists, and before any lock is
+ * taken. The resolved form is judged too, so a link in the repository that
+ * points into the folder gets the same refusal.
+ *
+ * Every spelling is refused whether or not the caller is authenticated — the
+ * lexical rule reads the caller's own string and touches no disk, so it
+ * answers nothing about the workspace. Only the RESOLVED check waits for
+ * `req.userId`: it resolves a workspace directory, which an unauthenticated
+ * request must not make the server do.
+ *
+ * Mounted at the app, ahead of every router under that prefix — the file
+ * routes, the review routes, the workflow and access ones, and whatever an
+ * extension mounts — so a router added later is covered by the fact of its
+ * prefix rather than by remembering this. The services underneath refuse
+ * again on their own; this is what keeps the refusal ahead of the gates.
+ */
+export function createGitInternalsRouteGuard(workspaceService: {
+  getWorkspacePath(workspaceId: string): Promise<string>;
+}): express.RequestHandler {
+  return async (req, res, next) => {
+    const inputs = gitGuardedInputs(req);
+    if (inputs.length === 0) return next();
+    // Only the git refusal reaches here, and it carries its own 403 and its
+    // one sanitized message — nothing else about the path is answered.
+    const refuse = (err: GitInternalsError) => void res.status(err.status).json(domainErrorBody(err));
+    if (inputs.some(hasGitInternalsSegment)) return refuse(new GitInternalsError());
+    // The resolved check resolves a workspace on disk, which an
+    // unauthenticated request must not make the server do; its route answers
+    // that request with its own 401.
+    if (!req.userId) return next();
+    let workspaceDir: string;
+    try {
+      workspaceDir = await workspaceService.getWorkspacePath(req.params.id as string);
+    } catch {
+      // The route resolves the workspace again and reports its own failure.
+      return next();
+    }
+    try {
+      for (const input of inputs) await assertNotGitInternals(workspaceDir, input);
+    } catch (err) {
+      if (err instanceof GitInternalsError) return refuse(err);
+      throw err;
+    }
+    next();
+  };
+}

package/src/modules/workspace/not-found.ts

@@ -0,0 +1,119 @@
+import { ToolError } from '../tool-helpers/tool.contract.js';
+import { isAbsence } from '../../shared/fs.contract.js';
+import { NOT_FOUND_NEXT_STEP, PathNotFoundError } from '../../shared/domain-errors.js';
+import { sanitizedPath } from '../../shared/printable.js';
+import { logger } from '../../shared/logging.js';
+
+const log = logger('not-found');
+
+/**
+ * ONE answer for "there is nothing at that path", for every file tool.
+ *
+ * A path that is not there is an ordinary answer, not a failure of the server:
+ * the caller spelled a name nothing holds, and the fix is theirs. Each tool
+ * used to reach that conclusion its own way — some with a 404, most by letting
+ * the filesystem's own `ENOENT` escape as a 500 — so an agent could not tell
+ * "your path is wrong" from "this deployment is broken", and had no stable
+ * field to branch on either way.
+ *
+ * So the mapping lives here and nowhere else. Every tool wraps the call that
+ * can meet absence in {@link orNotFound}, and every one of them then answers:
+ *
+ *   - **404**, because the path is the caller's to correct;
+ *   - `kind: 'not_found'`, the stable discriminator beside the prose (the same
+ *     `kind` convention `write-denied` and `git-internals` already use);
+ *   - the REQUESTED path, sanitized — echoed back so a chained caller can see
+ *     which of its arguments was wrong, never the path on disk;
+ *   - one sentence of next steps, always the same one.
+ *
+ * What is NOT absence stays a 500. ENOENT and ENOTDIR are the disk's own
+ * definition of "nothing is there" ({@link isAbsence}); a permission error, an
+ * I/O error or a symlink loop means the path could not be READ, and answering
+ * those 404 would tell a caller to go and fix a name that is perfectly fine
+ * while an outage went unreported. Their raw code goes to the operator log —
+ * the caller gets the 500 it has always got.
+ *
+ * ORDER MATTERS: a tool that gates reads must let the gate answer FIRST. A 404
+ * on a path the caller may not read would confirm the path is absent, and the
+ * absence of a name is as much a disclosure as its presence. Every read tool
+ * here calls `assertCanRead` before it touches the disk, and this helper is
+ * only ever reached past that point.
+ */
+
+/**
+ * The next step, in one sentence — identical on every tool, so it is written
+ * once. Defined beside {@link PathNotFoundError} in `shared/domain-errors`,
+ * which raises the same 404 from the service and HTTP side and so needs the
+ * same sentence; re-exported here because this is where the file tools read
+ * it from.
+ */
+export { NOT_FOUND_NEXT_STEP };
+
+/** The machine-readable body of a missing-path refusal. */
+export interface NotFoundDetails {
+  kind: 'not_found';
+  /** The path the caller asked for, sanitized for a one-line message. */
+  path: string;
+}
+
+/**
+ * The 404 every file tool answers for a path that is not there.
+ *
+ * `lead` replaces the default opening clause for a tool whose missing path is
+ * not simply "the file you named" — grep's search root, a move's source — so
+ * the caller learns WHICH argument was wrong. The path, the `kind` and the
+ * next step never vary.
+ */
+export function notFound(path: string, lead?: string): ToolError {
+  const safe = sanitizedPath(path);
+  const details: NotFoundDetails = { kind: 'not_found', path: safe };
+  const opening = lead === undefined
+    ? `There is no file or directory at "${safe}" in this workspace.`
+    : `${lead}: there is no file or directory at "${safe}" in this workspace.`;
+  return new ToolError(`${opening} ${NOT_FOUND_NEXT_STEP}`, 404, { ...details });
+}
+
+/**
+ * Run `work`, and answer {@link notFound} if it turns out `path` is not there.
+ *
+ * Absence arrives in two shapes and both are absence: a filesystem error
+ * carrying `ENOENT`/`ENOTDIR` (raw Node errors and Mastra's `FileNotFoundError`
+ * alike), and a {@link PathNotFoundError} a service raised because it probed
+ * the path itself. Anything else is rethrown untouched, with its raw code
+ * logged for the operator and nothing new added to what the caller sees.
+ */
+export async function orNotFound<T>(path: string, work: () => Promise<T>, lead?: string): Promise<T> {
+  try {
+    return await work();
+  } catch (err) {
+    if (err instanceof PathNotFoundError) throw notFound(err.path, lead);
+    if (isAbsence(err)) throw notFound(path, lead);
+    // Not absence: the path could not be READ, which is a 500 and an operator's
+    // problem. The raw errno is logged here — the one place that saw it — and
+    // the error travels on unchanged.
+    const code = (err as { code?: unknown } | null)?.code;
+    if (typeof code === 'string') {
+      log.error('filesystem failure that is not absence:', { code, path: sanitizedPath(path) });
+    }
+    throw err;
+  }
+}
+
+/**
+ * {@link orNotFound} for work that probes the path ITSELF and says so with a
+ * {@link PathNotFoundError} — unzip's service, which must open the archive to
+ * answer at all.
+ *
+ * Only that declared answer maps. A raw `ENOENT` from deep inside such work is
+ * NOT the named path being absent: an extraction that fails part-way through
+ * is a failure of the extraction, and calling it "your .zip is not there"
+ * would send the caller to re-spell a path that was never wrong.
+ */
+export async function orDeclaredNotFound<T>(work: () => Promise<T>, lead?: string): Promise<T> {
+  try {
+    return await work();
+  } catch (err) {
+    if (err instanceof PathNotFoundError) throw notFound(err.path, lead);
+    throw err;
+  }
+}

package/src/modules/workspace/session-ontology.gate.ts

@@ -47,7 +47,7 @@ export const SESSION_ID_INPUT: JsonSchema = {
  * docs/glossary.md.
  */
 export const ONTOLOGY_BOUNDARY_NOTE =
-  ' Stay within one KnowledgeBase ontology per conversation: once this run has read or written files in two different ontologies, every later content write (write_file/edit_file/mkdir/unzip, and both endpoints of move_file/copy_file) is blocked with a 403 and no override. Reads and delete_file never block — but each one records the ontology it touched and can poison a later content write, so do broad cross-ontology exploration only when you do not intend to write. Note move_file/copy_file are blocked outright when source and destination are different ontologies, since they would carry content across.';
+  ' Stay within one KnowledgeBase ontology per conversation: once this run has read or written files in two different ontologies, every later content write (write_file/edit_file/mkdir/unzip, and both endpoints of move_file/copy_file) is blocked with a 403 and no override. Reads, delete_file and delete_folder never block — but each one records the ontology it touched and can poison a later content write, so do broad cross-ontology exploration only when you do not intend to write. Note move_file/copy_file are blocked outright when source and destination are different ontologies, since they would carry content across.';
 
 /** Thrown when a write is refused because the session has crossed ontologies. */
 export class OntologyWriteBlockedError extends ToolError {