@cat-factory/server 0.226.0 → 0.228.0

package/dist/github/GitHubPrReportPublisher.js

@@ -1,8 +1,26 @@
-import { spliceManagedSection } from '@cat-factory/kernel';
+import { noopLogger, runBestEffort, spliceManagedSection } from '@cat-factory/kernel';
+import { allPullRequests } from '@cat-factory/contracts';
 import { githubRepoOrigin } from '../agents/containerAgentBody.js';
+import { splitRepo } from './repoFullName.js';
 /**
- * Upserts the engine's verification report onto a block's pull request as a marker-delimited
- * section of the PR description (see `docs/initiatives/pr-verification-report.md`, decision
+ * The numeric connection handle the engine VCS client takes, recovered from a target's neutral
+ * {@link VcsConnectionRef}.
+ *
+ * Not kernel's `githubInstallationId`, which refuses a non-GitHub connection: this adapter serves
+ * a GitLab deployment too (through `vcsBackedGitHubClient`), and there the same numeric id is the
+ * workspace's `github_installations` row that holds its PAT. A non-numeric id is a wiring bug and
+ * throws, which the engine records as a failed publish rather than a run failure.
+ */
+function connectionId(connection) {
+    const id = Number(connection.connectionId);
+    if (!Number.isInteger(id)) {
+        throw new Error(`PR report target carries an unusable connection id "${connection.connectionId}".`);
+    }
+    return id;
+}
+/**
+ * Upserts the engine's verification report onto a block's pull requests as a marker-delimited
+ * section of each PR description (see `docs/initiatives/pr-verification-report.md`, decision
  * D1: the markers ARE the section's identity, so the write is idempotent across re-runs,
  * retries and replayed durable steps with no persisted state at all).
  *
@@ -10,51 +28,135 @@ import { githubRepoOrigin } from '../agents/containerAgentBody.js';
  * as it is right now, so a human who edited the description while the run was in flight keeps
  * their edit. An unchanged body short-circuits before the remote write.
  *
- * Scoped to the block's OWN-service pull request. A multi-repo task's peer PRs are a phase-2
- * item on the initiative tracker — reporting the own-service run's evidence onto a peer repo's
- * PR without per-repo composition would be misleading, so it is deliberately not done here.
+ * On a MULTI-REPO run (service-connections phase 3) the task opens one PR per repo it changed,
+ * and every one of them is a target: a reviewer on a connected service's PR is looking at part
+ * of this change and is as entitled to the run's evidence as one on the own-service PR. The
+ * engine composes a distinct report per target — the own-service-only sections are withheld
+ * from a peer's copy rather than copied onto it.
+ *
+ * **All addressing happens in {@link resolveTargets}, once.** Each target it returns carries the
+ * connection and repo its write needs, so `publish` reads no repository and a run with N pull
+ * requests costs one resolution per settlement rather than N. That also removes the question
+ * `publish` would otherwise have to answer on every call ("is this still the block's PR?") on a
+ * hook that fires on every settled step.
  */
 export class GitHubPrReportPublisher {
     deps;
     constructor(deps) {
         this.deps = deps;
     }
-    async resolveTarget(workspaceId, blockId) {
-        const resolved = await this.resolve(workspaceId, blockId);
-        if (!resolved)
-            return null;
-        const { number, repo } = resolved;
-        const origin = (this.deps.resolveRepoOrigin ?? githubRepoOrigin)(repo);
-        return { prNumber: number, repo: `${repo.owner}/${repo.name}`, provider: origin.provider };
-    }
-    /** The PR number + repo a block's report targets, or null when either is unresolved. */
-    async resolve(workspaceId, blockId) {
+    /**
+     * Every pull request of the block's run, own-service first, each addressed for writing.
+     *
+     * ONE block read and ONE repo resolution for the whole set: the own-service target is
+     * resolved first (it is needed regardless, and lets the multi-repo resolver skip re-walking
+     * the block's ancestry), then a single `resolveRepoTargets` call covers every peer. Resolving
+     * per recorded peer PR would be the N+1 this codebase bans.
+     */
+    async resolveTargets(workspaceId, blockId) {
         const block = await this.deps.blockRepository.get(workspaceId, blockId);
-        const number = block?.pullRequest?.number;
-        if (number == null)
-            return null;
-        const repo = await this.deps.resolveRepoTarget(workspaceId, blockId);
-        return repo ? { number, repo } : null;
+        if (!block)
+            return [];
+        // `allPullRequests` is the single source of truth for "every PR this task opened", own
+        // first then peers — the same enumeration the CI gate aggregates over. The own-service
+        // entry is the one carrying no `repo` (its repo is the task's own service).
+        const prs = allPullRequests(block);
+        if (prs.length === 0)
+            return [];
+        const targets = [];
+        // The own-service PR FIRST when it exists: the engine reads the peer reports' back-pointer
+        // off the head of this list rather than re-resolving it. Matched on an ABSENT `repo` rather
+        // than a falsy one, and only when the block records an own PR at all: a peer whose recorded
+        // repo is the empty string is unaddressable, not the own-service one.
+        const own = block.pullRequest ? prs.find((pr) => pr.repo === undefined) : undefined;
+        const ownRepo = own ? await this.deps.resolveRepoTarget(workspaceId, blockId) : null;
+        if (own?.ref.number != null && ownRepo) {
+            targets.push(this.describe(ownRepo, own.ref.number, { role: 'own', url: own.ref.url }));
+        }
+        // BEST-EFFORT, and deliberately so: the multi-repo resolver THROWS on a workspace with no
+        // installation or an involved frame that lost its repo linkage, and letting that propagate
+        // would mean one broken peer linkage costs the OWN-SERVICE report too — the one a reviewer is
+        // most likely reading. The same "a failure on one target does not cost the others" rule the
+        // engine applies when publishing, applied one step earlier where the targets are found.
+        const peers = await runBestEffort(this.deps.logger ?? noopLogger, 'pr-report peer target resolution', () => this.peerTargets(workspaceId, blockId, block, prs, ownRepo), { workspaceId, blockId });
+        targets.push(...(peers ?? []));
+        return targets;
     }
-    async publish(workspaceId, blockId, section) {
-        // Resolved through the SAME helper as `resolveTarget`, so the two can never disagree about
-        // which PR is "the block's". `publish` re-resolves rather than trusting a target handed in:
-        // it is a port method other callers may reach directly, and the write must be self-contained.
-        const block = await this.deps.blockRepository.get(workspaceId, blockId);
-        const number = block?.pullRequest?.number;
-        if (number == null)
-            return { published: false, skipped: 'no_pull_request' };
-        const repo = await this.deps.resolveRepoTarget(workspaceId, blockId);
-        if (!repo)
-            return { published: false, skipped: 'no_repo', prNumber: number };
-        const ref = { owner: repo.owner, repo: repo.name };
+    /**
+     * The run's PEER pull requests, addressed through the multi-repo repo resolution.
+     *
+     * A recorded peer PR is only targetable when two things line up: it carries a `number` (the
+     * unit the description write addresses, absent on a ref that was only ever a URL) and its
+     * repo is in the resolved checkout set (which is what supplies the connection to write
+     * through, and is the platform's own answer about which repos this run touched). A peer that
+     * satisfies neither is skipped rather than guessed at — the repo name on a recorded peer PR
+     * is harness-reported, and writing a report onto a pull request we cannot confirm the identity
+     * of is the one failure mode worse than not writing it.
+     */
+    async peerTargets(workspaceId, blockId, block, prs, ownRepo) {
+        // Every entry that names a repo: the complement of the own-service one above.
+        const peers = prs.filter((pr) => pr.repo !== undefined);
+        const resolveAll = this.deps.resolveRepoTargets;
+        if (!peers.length || !resolveAll)
+            return [];
+        // The frames to resolve: the task's declared involved services, plus any frame a recorded
+        // peer PR attributes itself to. The union rather than either alone, because the declared
+        // list is what the run fanned out over while the recorded PRs are what it actually opened,
+        // and a peer whose frame left the task's involved list still has an open PR owed a report.
+        const frameIds = [
+            ...new Set([
+                ...(block.involvedServiceIds ?? []),
+                ...peers.map((p) => p.frameId).filter((id) => !!id),
+            ]),
+        ];
+        const resolved = await resolveAll(workspaceId, blockId, frameIds, ownRepo ?? undefined);
+        const byRepo = new Map(resolved.checkouts.map((c) => [`${c.target.owner}/${c.target.name}`, c.target]));
+        const out = [];
+        for (const peer of peers) {
+            const number = peer.ref.number;
+            const repo = peer.repo ? byRepo.get(peer.repo) : undefined;
+            if (number == null || !repo)
+                continue;
+            out.push(this.describe(repo, number, { role: 'peer', frameId: peer.frameId, url: peer.ref.url }));
+        }
+        return out;
+    }
+    /**
+     * A resolved repo + PR number as a self-describing target: which PR, in which repo, on which
+     * provider, through which connection.
+     *
+     * The connection names the DEPLOYMENT'S provider, not this class's name: a GitLab deployment
+     * reaches this adapter through `vcsBackedGitHubClient`, and a target that claimed `github`
+     * would mis-route the day a native GitLab publisher selects its adapter from it. Both providers
+     * ride the same numeric connection id, because a GitLab workspace's PAT connect reuses the
+     * `github_installations` row this id comes from.
+     */
+    describe(repo, prNumber, scope) {
+        const origin = (this.deps.resolveRepoOrigin ?? githubRepoOrigin)(repo);
+        return {
+            prNumber,
+            repo: `${repo.owner}/${repo.name}`,
+            provider: origin.provider,
+            connection: { provider: origin.provider, connectionId: String(repo.installationId) },
+            role: scope.role,
+            frameId: scope.frameId ?? null,
+            url: scope.url ?? null,
+        };
+    }
+    async publish(_workspaceId, target, section) {
+        // No resolution here at all: the target names its own pull request, repo and connection,
+        // and the caller composed `section` for exactly that. See the class doc.
+        const installationId = connectionId(target.connection);
+        const [owner, name] = splitRepo(target.repo);
+        const ref = { owner, repo: name };
+        const number = target.prNumber;
         const gh = this.deps.githubClient;
-        const current = await gh.getPullRequestBody(repo.installationId, ref, number);
+        const current = await gh.getPullRequestBody(installationId, ref, number);
         const next = spliceManagedSection(current, section);
         if (next === (current ?? '')) {
             return { published: false, skipped: 'unchanged', prNumber: number };
         }
-        await gh.updatePullRequest(repo.installationId, ref, number, { body: next });
+        await gh.updatePullRequest(installationId, ref, number, { body: next });
         return { published: true, prNumber: number };
     }
 }

package/dist/github/GitHubPrReportPublisher.js.map

@@ -1 +1 @@
-{"version":3,"file":"GitHubPrReportPublisher.js","sourceRoot":"","sources":["../../src/github/GitHubPrReportPublisher.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAM1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AAsBlE;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,uBAAuB;IACL,IAAI;IAAjC,YAA6B,IAAyC;oBAAzC,IAAI;IAAwC,CAAC;IAE1E,KAAK,CAAC,aAAa,CAAC,WAAmB,EAAE,OAAe;QACtD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QACzD,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAA;QAC1B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAA;QACjC,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAA;QACtE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAA;IAC5F,CAAC;IAED,wFAAwF;IAChF,KAAK,CAAC,OAAO,CACnB,WAAmB,EACnB,OAAe;QAEf,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QACvE,MAAM,MAAM,GAAG,KAAK,EAAE,WAAW,EAAE,MAAM,CAAA;QACzC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,IAAI,CAAA;QAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QACpE,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IACvC,CAAC;IAED,KAAK,CAAC,OAAO,CACX,WAAmB,EACnB,OAAe,EACf,OAAe;QAEf,2FAA2F;QAC3F,4FAA4F;QAC5F,8FAA8F;QAC9F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QACvE,MAAM,MAAM,GAAG,KAAK,EAAE,WAAW,EAAE,MAAM,CAAA;QACzC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAA;QAE3E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QACpE,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;QAE5E,MAAM,GAAG,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAA;QAClD,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAA;QACjC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;QAC7E,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACnD,IAAI,IAAI,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;QACrE,CAAC;QACD,MAAM,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5E,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;IAC9C,CAAC;CACF"}
+{"version":3,"file":"GitHubPrReportPublisher.js","sourceRoot":"","sources":["../../src/github/GitHubPrReportPublisher.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AACrF,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAOxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAuC7C;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,UAA4B;IAChD,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;IAC1C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,uDAAuD,UAAU,CAAC,YAAY,IAAI,CACnF,CAAA;IACH,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,OAAO,uBAAuB;IACL,IAAI;IAAjC,YAA6B,IAAyC;oBAAzC,IAAI;IAAwC,CAAC;IAE1E;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAC,WAAmB,EAAE,OAAe;QACvD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QACvE,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,CAAA;QAErB,uFAAuF;QACvF,uFAAuF;QACvF,4EAA4E;QAC5E,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;QAClC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAA;QAE/B,MAAM,OAAO,GAAqB,EAAE,CAAA;QACpC,2FAA2F;QAC3F,4FAA4F;QAC5F,4FAA4F;QAC5F,sEAAsE;QACtE,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACnF,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACpF,IAAI,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI,IAAI,OAAO,EAAE,CAAC;YACvC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QACzF,CAAC;QACD,0FAA0F;QAC1F,2FAA2F;QAC3F,8FAA8F;QAC9F,4FAA4F;QAC5F,wFAAwF;QACxF,MAAM,KAAK,GAAG,MAAM,aAAa,CAC/B,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,UAAU,EAC9B,kCAAkC,EAClC,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,EACjE,EAAE,WAAW,EAAE,OAAO,EAAE,CACzB,CAAA;QACD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAA;QAC9B,OAAO,OAAO,CAAA;IAChB,CAAC;IAED;;;;;;;;;;OAUG;IACK,KAAK,CAAC,WAAW,CACvB,WAAmB,EACnB,OAAe,EACf,KAAY,EACZ,GAAmC,EACnC,OAA0B;QAE1B,8EAA8E;QAC9E,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAA;QACvD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAA;QAC/C,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,CAAA;QAE3C,0FAA0F;QAC1F,yFAAyF;QACzF,2FAA2F;QAC3F,2FAA2F;QAC3F,MAAM,QAAQ,GAAG;YACf,GAAG,IAAI,GAAG,CAAC;gBACT,GAAG,CAAC,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC;gBACnC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClE,CAAC;SACH,CAAA;QACD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,SAAS,CAAC,CAAA;QACvF,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAChF,CAAA;QAED,MAAM,GAAG,GAAqB,EAAE,CAAA;QAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAA;YAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YAC1D,IAAI,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI;gBAAE,SAAQ;YACrC,GAAG,CAAC,IAAI,CACN,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CACxF,CAAA;QACH,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED;;;;;;;;;OASG;IACK,QAAQ,CACd,IAAgB,EAChB,QAAgB,EAChB,KAAsE;QAEtE,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAA;QACtE,OAAO;YACL,QAAQ;YACR,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE;YAClC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE;YACpF,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;YAC9B,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI;SACvB,CAAA;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CACX,YAAoB,EACpB,MAAsB,EACtB,OAAe;QAEf,yFAAyF;QACzF,yEAAyE;QACzE,MAAM,cAAc,GAAG,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QACtD,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC5C,MAAM,GAAG,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;QACjC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAA;QAC9B,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAA;QACjC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,kBAAkB,CAAC,cAAc,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;QACxE,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACnD,IAAI,IAAI,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;QACrE,CAAC;QACD,MAAM,EAAE,CAAC,iBAAiB,CAAC,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACvE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;IAC9C,CAAC;CACF"}

package/dist/http/workspaceAccess.d.ts

@@ -1,6 +1,6 @@
 import { type BlockEditActor } from '@cat-factory/contracts';
 import { type WorkspaceAccess, type WorkspacePermission } from '@cat-factory/kernel';
-import type { Context, MiddlewareHandler } from 'hono';
+import type { Context, Hono } from 'hono';
 import type { AppEnv, ServerContainer } from './env.js';
 /**
  * Resolve a signed-in user's effective access to one board, THROUGH the `workspaceAccess` cache.
@@ -40,66 +40,91 @@ export declare function requirePermission<E extends AppEnv>(c: Context<E>, permi
  */
 export declare function blockEditActor<E extends AppEnv>(c: Context<E>): BlockEditActor;
 /**
- * Controller-level admin-tier gate (workspace-rbac, slice 6). Mount ONCE at the top of an
- * admin route group — `app.use('*', requireWorkspacePermission('integrations.manage'))` —
- * and every WRITE the controller serves (now and in the future) requires that permission,
- * with ZERO per-handler code. Reads (GET/HEAD) pass straight through, so the whole controller
- * stays viewer-readable (`workspace.read`, satisfied by the gate resolution) while its mutations
- * are admin-only.
+ * The controller-level admin-tier gate (workspace-rbac, slice 6): every WRITE served under one of
+ * `prefixes` requires `permission`, with ZERO per-handler code. Reads (GET/HEAD) pass straight
+ * through, so the controller stays viewer-readable (`workspace.read`, satisfied by the gate
+ * resolution) while its mutations are admin-only. Use
+ * {@link mountWorkspacePermissionIncludingReads} for the rare controller whose READ is the
+ * sensitive half.
  *
- * This is the method-shaped counterpart to the gate's viewer floor: the floor rejects viewer
- * writes wholesale (non-GET ⇒ ≥ member) in ONE place; this rejects member writes on the admin
- * groups in ONE place per group. Because it is co-located with the controller's mount (not a
- * central path→permission table), a new route inherits the correct gate automatically — the
- * drift a shadow route-map would suffer can't happen. It runs BEFORE the handler, so an
+ * This is the method-shaped counterpart to the gate's viewer floor: the floor rejects viewer writes
+ * wholesale (non-GET ⇒ ≥ member) in ONE place; this rejects member writes on the admin groups in
+ * ONE place per group. Because it is co-located with the controller's own mount (not a central
+ * path→permission table), a new route under a gated prefix inherits the correct gate automatically:
+ * the drift a shadow route-map would suffer can't happen. It runs BEFORE the handler, so an
  * unauthorized caller is refused even when the underlying integration is unwired (a member never
- * learns whether Slack/GitHub/etc. is configured).
+ * learns whether Slack/GitHub/etc. is configured), and before body validation, so a malformed
+ * payload cannot turn a refusal into a 422 that answers the same question.
  *
  * `OPTIONS` (CORS preflight) is never gated. Where a controller mixes gated and ungated writes
- * under one mount (e.g. workspace create vs rename), call {@link requirePermission} per-handler
+ * under one prefix (e.g. workspace create vs rename), call {@link requirePermission} per-handler
  * instead of mounting this.
  *
- * ⚠️ **A `'*'` mount is NOT scoped to the controller.** `app.route('/workspaces/:workspaceId', sub)`
- * re-registers each of `sub`'s entries under that prefix, and a `sub.use('*', …)` becomes
- * `ALL /workspaces/:workspaceId/*` on the shared app — so it also matches routes OTHER controllers
- * mounted on the same prefix. Hono then runs whichever matching entry was registered first, which
- * makes the blast radius depend on the order in `app.ts`: today the run controllers are registered
- * before the config ones, so their routes win and the existing `'*'` mounts reach only the config
- * controllers listed after them (all admin-tier, which is why nothing has surfaced). Prefer mounting
- * on the controller's OWN path patterns (`/thing` and `/thing/*`), which cannot reach a sibling
- * whatever the order — as {@link requireWorkspacePermissionIncludingReads}'s two call sites do,
- * because for them the ordering accident stopped being harmless.
+ * **`prefixes` are the controller's OWN top-level paths, and taking them is the whole point of this
+ * helper.** `app.route('/workspaces/:workspaceId', sub)` re-registers each of `sub`'s entries under
+ * that prefix, so a `sub.use('*', …)` becomes `ALL /workspaces/:workspaceId/*` on the shared app and
+ * matches routes OTHER controllers mounted on the same prefix. Hono runs a matching middleware for
+ * every route registered after it, which made the blast radius depend on the order in `app.ts`: the
+ * admin document and task-source controllers are registered ahead of the human-gate controllers, so
+ * their `'*'` mounts refused a plain member's review decisions, requirement answers and initiative
+ * writes with `integrations.manage`. Nobody noticed because an account admin resolves as a workspace
+ * admin, and dogfooding happens as one. Passing prefixes cannot reach a sibling whatever the order,
+ * and it is why no middleware factory is exported from this module: a `'*'` mount is now
+ * unrepresentable rather than merely discouraged. `permissionMounts.test.ts` pins the invariant
+ * (a member is refused exactly the writes their own controller gates).
+ *
+ * Each prefix is mounted twice, bare and `/*`, because Hono's `*` does not match the bare prefix.
+ * A prefix may carry params (`/services/:blockId/test-secrets`), which is how a controller whose
+ * routes hang off a shared first segment gates its own without claiming the segment.
  */
-export declare function requireWorkspacePermission<E extends AppEnv>(permission: WorkspacePermission): MiddlewareHandler<E>;
+export declare function mountWorkspacePermission<E extends AppEnv>(app: Hono<E>, permission: WorkspacePermission, prefixes: readonly string[]): void;
 /**
  * The same controller-level gate, applied to READS as well.
  *
- * {@link requireWorkspacePermission} lets GET/HEAD through by design: on almost every admin
+ * {@link mountWorkspacePermission} lets GET/HEAD through by design: on almost every admin
  * controller the permission guards MUTATION and the configuration itself is viewer-readable. A few
- * controllers invert that, because their READ is the sensitive half — the capability-credential
+ * controllers invert that, because their READ is the sensitive half. The capability-credential
  * checklist and the tool-server inventory both project the credential KEY NAMES this deployment's
  * capabilities want, which is exactly what the workspace snapshot withholds from a viewer ("no
  * business learning which environment variables the deployment sets"). Moving the value into a
  * sealed row did not change that judgement, and neither did adding a second surface over the same
- * registry.
+ * registry. `vcsConnectController` is the third and the plainest: it serves ONE read and no write,
+ * so the writes-only mount left it enforcing nothing at all.
  *
  * A separate function rather than an option, so the choice is legible at the mount and a controller
  * cannot acquire it by a default changing underneath it. `OPTIONS` still passes: a CORS preflight
  * carries no credentials to judge, and refusing it breaks the browser before the real request that
  * this gate is here to refuse.
  *
- * The failure this exists to prevent is not hypothetical. Both call sites documented the read as
- * gated (in the controller, in the SPA's tab gate, in the store's 403 handling) while the mount let
- * every member's GET through, because "gated on `secrets.manage`" reads as covering the controller
- * and covered only its writes.
+ * The failure this exists to prevent is not hypothetical, and all three call sites hit it: each
+ * documented the read as gated (in the controller, in the SPA's tab gate, in the store's 403
+ * handling) while the mount let every member's GET through, because "gated on `secrets.manage`"
+ * reads as covering the controller and covered only its writes. `permissionMounts.test.ts` now
+ * asserts the READS of an `IncludingReads` controller are covered too, so the gap cannot reopen
+ * by a prefix going missing.
+ */
+export declare function mountWorkspacePermissionIncludingReads<E extends AppEnv>(app: Hono<E>, permission: WorkspacePermission, prefixes: readonly string[]): void;
+/** What one mounted gate enforces: the permission, and whether it covers READS as well. */
+export interface MountedGate {
+    permission: WorkspacePermission;
+    /** True for {@link mountWorkspacePermissionIncludingReads}, false for the writes-only mount. */
+    gatesReads: boolean;
+}
+/**
+ * What a mounted gate enforces, or `undefined` for any other middleware.
+ *
+ * Read off a controller's route table by `permissionMounts.test.ts`, which asserts that a member is
+ * refused exactly the writes their own controller gates AND that a gated controller leaves none of
+ * its own routes uncovered. It exists because a controller's middleware is not necessarily a
+ * permission gate: `executionController` and `notificationController` both mount their own `ALL`
+ * middleware, and treating every middleware entry as a gate made the derived expectation wrong for
+ * them. Tagging the handler is what lets the invariant be READ from what the mount actually did
+ * instead of from a second list somebody has to keep in step.
  *
- * ⚠️ **Mount this on the controller's OWN path patterns, never `'*'`.** See the warning on
- * {@link requireWorkspacePermission}: a `'*'` mount lands on `/workspaces/:workspaceId/*` and can
- * refuse a SIBLING controller's routes. That is survivable while only writes are gated (the
- * siblings it can reach are admin-tier anyway); gating READS makes it fatal, because the same
- * pattern then refuses every member-readable GET registered after it — `GET /github/repos` was the
- * one that caught it. Two patterns are needed, `/thing` and `/thing/*`: Hono's `*` does not match
- * the bare prefix.
+ * Read it off a STANDALONE-built controller, not the composed app: `app.route()` passes a sub-app's
+ * handlers through untouched only while the sub-app has no error handler of its own, and wraps them
+ * (losing this tag) the moment one calls `app.onError`. No controller does today, and the invariant
+ * does not depend on none ever doing.
  */
-export declare function requireWorkspacePermissionIncludingReads<E extends AppEnv>(permission: WorkspacePermission): MiddlewareHandler<E>;
+export declare function permissionGateOf(handler: unknown): MountedGate | undefined;
 //# sourceMappingURL=workspaceAccess.d.ts.map

package/dist/http/workspaceAccess.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspaceAccess.d.ts","sourceRoot":"","sources":["../../src/http/workspaceAccess.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAA;AACvF,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACzB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAA;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAiBvD;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,eAAe,EAC1B,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAKjC;AA6BD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,MAAM,EAChD,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EACb,UAAU,EAAE,mBAAmB,GAC9B,IAAI,CASN;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,cAAc,CAI9E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,0BAA0B,CAAC,CAAC,SAAS,MAAM,EACzD,UAAU,EAAE,mBAAmB,GAC9B,iBAAiB,CAAC,CAAC,CAAC,CAQtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,wCAAwC,CAAC,CAAC,SAAS,MAAM,EACvE,UAAU,EAAE,mBAAmB,GAC9B,iBAAiB,CAAC,CAAC,CAAC,CAKtB"}
+{"version":3,"file":"workspaceAccess.d.ts","sourceRoot":"","sources":["../../src/http/workspaceAccess.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAA;AACvF,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACzB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAqB,MAAM,MAAM,CAAA;AAC5D,OAAO,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAiBvD;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,eAAe,EAC1B,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAKjC;AA6BD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,MAAM,EAChD,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EACb,UAAU,EAAE,mBAAmB,GAC9B,IAAI,CASN;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,cAAc,CAI9E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,wBAAwB,CAAC,CAAC,SAAS,MAAM,EACvD,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,EACZ,UAAU,EAAE,mBAAmB,EAC/B,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,IAAI,CAQN;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,sCAAsC,CAAC,CAAC,SAAS,MAAM,EACrE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,EACZ,UAAU,EAAE,mBAAmB,EAC/B,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,IAAI,CAKN;AAID,2FAA2F;AAC3F,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,mBAAmB,CAAA;IAC/B,gGAAgG;IAChG,UAAU,EAAE,OAAO,CAAA;CACpB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,WAAW,GAAG,SAAS,CAI1E"}

package/dist/http/workspaceAccess.js

@@ -93,80 +93,120 @@ export function blockEditActor(c) {
     return { role: access.role, managesPolicy: access.permissions.has('settings.manage') };
 }
 /**
- * Controller-level admin-tier gate (workspace-rbac, slice 6). Mount ONCE at the top of an
- * admin route group — `app.use('*', requireWorkspacePermission('integrations.manage'))` —
- * and every WRITE the controller serves (now and in the future) requires that permission,
- * with ZERO per-handler code. Reads (GET/HEAD) pass straight through, so the whole controller
- * stays viewer-readable (`workspace.read`, satisfied by the gate resolution) while its mutations
- * are admin-only.
+ * The controller-level admin-tier gate (workspace-rbac, slice 6): every WRITE served under one of
+ * `prefixes` requires `permission`, with ZERO per-handler code. Reads (GET/HEAD) pass straight
+ * through, so the controller stays viewer-readable (`workspace.read`, satisfied by the gate
+ * resolution) while its mutations are admin-only. Use
+ * {@link mountWorkspacePermissionIncludingReads} for the rare controller whose READ is the
+ * sensitive half.
  *
- * This is the method-shaped counterpart to the gate's viewer floor: the floor rejects viewer
- * writes wholesale (non-GET ⇒ ≥ member) in ONE place; this rejects member writes on the admin
- * groups in ONE place per group. Because it is co-located with the controller's mount (not a
- * central path→permission table), a new route inherits the correct gate automatically — the
- * drift a shadow route-map would suffer can't happen. It runs BEFORE the handler, so an
+ * This is the method-shaped counterpart to the gate's viewer floor: the floor rejects viewer writes
+ * wholesale (non-GET ⇒ ≥ member) in ONE place; this rejects member writes on the admin groups in
+ * ONE place per group. Because it is co-located with the controller's own mount (not a central
+ * path→permission table), a new route under a gated prefix inherits the correct gate automatically:
+ * the drift a shadow route-map would suffer can't happen. It runs BEFORE the handler, so an
  * unauthorized caller is refused even when the underlying integration is unwired (a member never
- * learns whether Slack/GitHub/etc. is configured).
+ * learns whether Slack/GitHub/etc. is configured), and before body validation, so a malformed
+ * payload cannot turn a refusal into a 422 that answers the same question.
  *
  * `OPTIONS` (CORS preflight) is never gated. Where a controller mixes gated and ungated writes
- * under one mount (e.g. workspace create vs rename), call {@link requirePermission} per-handler
+ * under one prefix (e.g. workspace create vs rename), call {@link requirePermission} per-handler
  * instead of mounting this.
  *
- * ⚠️ **A `'*'` mount is NOT scoped to the controller.** `app.route('/workspaces/:workspaceId', sub)`
- * re-registers each of `sub`'s entries under that prefix, and a `sub.use('*', …)` becomes
- * `ALL /workspaces/:workspaceId/*` on the shared app — so it also matches routes OTHER controllers
- * mounted on the same prefix. Hono then runs whichever matching entry was registered first, which
- * makes the blast radius depend on the order in `app.ts`: today the run controllers are registered
- * before the config ones, so their routes win and the existing `'*'` mounts reach only the config
- * controllers listed after them (all admin-tier, which is why nothing has surfaced). Prefer mounting
- * on the controller's OWN path patterns (`/thing` and `/thing/*`), which cannot reach a sibling
- * whatever the order — as {@link requireWorkspacePermissionIncludingReads}'s two call sites do,
- * because for them the ordering accident stopped being harmless.
+ * **`prefixes` are the controller's OWN top-level paths, and taking them is the whole point of this
+ * helper.** `app.route('/workspaces/:workspaceId', sub)` re-registers each of `sub`'s entries under
+ * that prefix, so a `sub.use('*', …)` becomes `ALL /workspaces/:workspaceId/*` on the shared app and
+ * matches routes OTHER controllers mounted on the same prefix. Hono runs a matching middleware for
+ * every route registered after it, which made the blast radius depend on the order in `app.ts`: the
+ * admin document and task-source controllers are registered ahead of the human-gate controllers, so
+ * their `'*'` mounts refused a plain member's review decisions, requirement answers and initiative
+ * writes with `integrations.manage`. Nobody noticed because an account admin resolves as a workspace
+ * admin, and dogfooding happens as one. Passing prefixes cannot reach a sibling whatever the order,
+ * and it is why no middleware factory is exported from this module: a `'*'` mount is now
+ * unrepresentable rather than merely discouraged. `permissionMounts.test.ts` pins the invariant
+ * (a member is refused exactly the writes their own controller gates).
+ *
+ * Each prefix is mounted twice, bare and `/*`, because Hono's `*` does not match the bare prefix.
+ * A prefix may carry params (`/services/:blockId/test-secrets`), which is how a controller whose
+ * routes hang off a shared first segment gates its own without claiming the segment.
  */
-export function requireWorkspacePermission(permission) {
-    return (c, next) => {
+export function mountWorkspacePermission(app, permission, prefixes) {
+    mountGate(app, prefixes, { permission, gatesReads: false }, (c, next) => {
         const method = c.req.method;
         if (method !== 'GET' && method !== 'HEAD' && method !== 'OPTIONS') {
             requirePermission(c, permission);
         }
         return next();
-    };
+    });
 }
 /**
  * The same controller-level gate, applied to READS as well.
  *
- * {@link requireWorkspacePermission} lets GET/HEAD through by design: on almost every admin
+ * {@link mountWorkspacePermission} lets GET/HEAD through by design: on almost every admin
  * controller the permission guards MUTATION and the configuration itself is viewer-readable. A few
- * controllers invert that, because their READ is the sensitive half — the capability-credential
+ * controllers invert that, because their READ is the sensitive half. The capability-credential
  * checklist and the tool-server inventory both project the credential KEY NAMES this deployment's
  * capabilities want, which is exactly what the workspace snapshot withholds from a viewer ("no
  * business learning which environment variables the deployment sets"). Moving the value into a
  * sealed row did not change that judgement, and neither did adding a second surface over the same
- * registry.
+ * registry. `vcsConnectController` is the third and the plainest: it serves ONE read and no write,
+ * so the writes-only mount left it enforcing nothing at all.
  *
  * A separate function rather than an option, so the choice is legible at the mount and a controller
  * cannot acquire it by a default changing underneath it. `OPTIONS` still passes: a CORS preflight
  * carries no credentials to judge, and refusing it breaks the browser before the real request that
  * this gate is here to refuse.
  *
- * The failure this exists to prevent is not hypothetical. Both call sites documented the read as
- * gated (in the controller, in the SPA's tab gate, in the store's 403 handling) while the mount let
- * every member's GET through, because "gated on `secrets.manage`" reads as covering the controller
- * and covered only its writes.
- *
- * ⚠️ **Mount this on the controller's OWN path patterns, never `'*'`.** See the warning on
- * {@link requireWorkspacePermission}: a `'*'` mount lands on `/workspaces/:workspaceId/*` and can
- * refuse a SIBLING controller's routes. That is survivable while only writes are gated (the
- * siblings it can reach are admin-tier anyway); gating READS makes it fatal, because the same
- * pattern then refuses every member-readable GET registered after it — `GET /github/repos` was the
- * one that caught it. Two patterns are needed, `/thing` and `/thing/*`: Hono's `*` does not match
- * the bare prefix.
+ * The failure this exists to prevent is not hypothetical, and all three call sites hit it: each
+ * documented the read as gated (in the controller, in the SPA's tab gate, in the store's 403
+ * handling) while the mount let every member's GET through, because "gated on `secrets.manage`"
+ * reads as covering the controller and covered only its writes. `permissionMounts.test.ts` now
+ * asserts the READS of an `IncludingReads` controller are covered too, so the gap cannot reopen
+ * by a prefix going missing.
  */
-export function requireWorkspacePermissionIncludingReads(permission) {
-    return (c, next) => {
+export function mountWorkspacePermissionIncludingReads(app, permission, prefixes) {
+    mountGate(app, prefixes, { permission, gatesReads: true }, (c, next) => {
         if (c.req.method !== 'OPTIONS')
             requirePermission(c, permission);
         return next();
-    };
+    });
+}
+const MOUNTED_GATE = Symbol('workspacePermissionGate');
+/**
+ * What a mounted gate enforces, or `undefined` for any other middleware.
+ *
+ * Read off a controller's route table by `permissionMounts.test.ts`, which asserts that a member is
+ * refused exactly the writes their own controller gates AND that a gated controller leaves none of
+ * its own routes uncovered. It exists because a controller's middleware is not necessarily a
+ * permission gate: `executionController` and `notificationController` both mount their own `ALL`
+ * middleware, and treating every middleware entry as a gate made the derived expectation wrong for
+ * them. Tagging the handler is what lets the invariant be READ from what the mount actually did
+ * instead of from a second list somebody has to keep in step.
+ *
+ * Read it off a STANDALONE-built controller, not the composed app: `app.route()` passes a sub-app's
+ * handlers through untouched only while the sub-app has no error handler of its own, and wraps them
+ * (losing this tag) the moment one calls `app.onError`. No controller does today, and the invariant
+ * does not depend on none ever doing.
+ */
+export function permissionGateOf(handler) {
+    if (typeof handler !== 'function')
+        return undefined;
+    const tagged = handler[MOUNTED_GATE];
+    return typeof tagged === 'object' && tagged !== null ? tagged : undefined;
+}
+/** Mount one gate on each prefix, bare and `/*` (Hono's `*` does not match the bare prefix). */
+function mountGate(app, prefixes, mounted, gate) {
+    if (prefixes.length === 0) {
+        // A gated controller with no prefix would gate nothing while reading as gated, which is the
+        // silent hole this whole helper exists to close. A prefix that matches none of the controller's
+        // routes is the same hole one step later, so `permissionMounts.test.ts` refuses that too: this
+        // throw can only catch the spelling of it that names no path at all.
+        throw new Error('mountWorkspacePermission: at least one path prefix is required');
+    }
+    Object.defineProperty(gate, MOUNTED_GATE, { value: mounted });
+    for (const prefix of prefixes) {
+        app.use(prefix, gate);
+        app.use(`${prefix}/*`, gate);
+    }
 }
 //# sourceMappingURL=workspaceAccess.js.map

package/dist/http/workspaceAccess.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspaceAccess.js","sourceRoot":"","sources":["../../src/http/workspaceAccess.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAuB,MAAM,wBAAwB,CAAA;AACvF,OAAO,EACL,cAAc,EACd,sBAAsB,GAGvB,MAAM,qBAAqB,CAAA;AAI5B,8EAA8E;AAC9E,wFAAwF;AACxF,yFAAyF;AACzF,mFAAmF;AACnF,EAAE;AACF,yFAAyF;AACzF,sFAAsF;AACtF,wFAAwF;AACxF,2FAA2F;AAC3F,8FAA8F;AAC9F,4FAA4F;AAC5F,8FAA8F;AAC9F,uFAAuF;AACvF,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAA0B,EAC1B,WAAmB,EACnB,MAAc;IAEd,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC9F,MAAM,EAAE,MAAM,8BAA8B,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC;KAC7E,CAAC,CAAC,CAAA;IACH,OAAO,MAAM,CAAA;AACf,CAAC;AAED,qGAAqG;AACrG,KAAK,UAAU,8BAA8B,CAC3C,SAA0B,EAC1B,WAAmB,EACnB,MAAc;IAEd,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAA;IAC3E,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA,CAAC,4DAA4D;IAExF,uFAAuF;IACvF,uDAAuD;IACvD,IAAI,SAAS,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QACjC,OAAO,sBAAsB,CAAC;YAC5B,MAAM;YACN,SAAS,EAAE,SAAS;YACpB,YAAY,EAAE,EAAE;YAChB,UAAU,EAAE,IAAI;SACjB,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACnD,SAAS,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC;QAC9D,SAAS,CAAC,gBAAgB,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC;KAC7D,CAAC,CAAA;IACF,OAAO,sBAAsB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAA;AAC3F,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAC/B,CAAa,EACb,UAA+B;IAE/B,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;IACvC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAM,CAAC,kDAAkD;QAC7E,MAAM,IAAI,cAAc,CAAC,4BAA4B,UAAU,aAAa,EAAE,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/F,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,cAAc,CAAC,4BAA4B,UAAU,aAAa,EAAE,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/F,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAAmB,CAAa;IAC5D,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;IACvC,IAAI,CAAC,MAAM;QAAE,OAAO,yBAAyB,CAAA;IAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAA;AACxF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,0BAA0B,CACxC,UAA+B;IAE/B,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE;QACjB,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAA;QAC3B,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAClE,iBAAiB,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;QAClC,CAAC;QACD,OAAO,IAAI,EAAE,CAAA;IACf,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,wCAAwC,CACtD,UAA+B;IAE/B,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE;QACjB,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS;YAAE,iBAAiB,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;QAChE,OAAO,IAAI,EAAE,CAAA;IACf,CAAC,CAAA;AACH,CAAC"}
+{"version":3,"file":"workspaceAccess.js","sourceRoot":"","sources":["../../src/http/workspaceAccess.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAuB,MAAM,wBAAwB,CAAA;AACvF,OAAO,EACL,cAAc,EACd,sBAAsB,GAGvB,MAAM,qBAAqB,CAAA;AAI5B,8EAA8E;AAC9E,wFAAwF;AACxF,yFAAyF;AACzF,mFAAmF;AACnF,EAAE;AACF,yFAAyF;AACzF,sFAAsF;AACtF,wFAAwF;AACxF,2FAA2F;AAC3F,8FAA8F;AAC9F,4FAA4F;AAC5F,8FAA8F;AAC9F,uFAAuF;AACvF,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAA0B,EAC1B,WAAmB,EACnB,MAAc;IAEd,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC9F,MAAM,EAAE,MAAM,8BAA8B,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC;KAC7E,CAAC,CAAC,CAAA;IACH,OAAO,MAAM,CAAA;AACf,CAAC;AAED,qGAAqG;AACrG,KAAK,UAAU,8BAA8B,CAC3C,SAA0B,EAC1B,WAAmB,EACnB,MAAc;IAEd,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAA;IAC3E,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA,CAAC,4DAA4D;IAExF,uFAAuF;IACvF,uDAAuD;IACvD,IAAI,SAAS,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QACjC,OAAO,sBAAsB,CAAC;YAC5B,MAAM;YACN,SAAS,EAAE,SAAS;YACpB,YAAY,EAAE,EAAE;YAChB,UAAU,EAAE,IAAI;SACjB,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACnD,SAAS,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC;QAC9D,SAAS,CAAC,gBAAgB,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC;KAC7D,CAAC,CAAA;IACF,OAAO,sBAAsB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAA;AAC3F,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAC/B,CAAa,EACb,UAA+B;IAE/B,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;IACvC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAM,CAAC,kDAAkD;QAC7E,MAAM,IAAI,cAAc,CAAC,4BAA4B,UAAU,aAAa,EAAE,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/F,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,cAAc,CAAC,4BAA4B,UAAU,aAAa,EAAE,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/F,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAAmB,CAAa;IAC5D,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;IACvC,IAAI,CAAC,MAAM;QAAE,OAAO,yBAAyB,CAAA;IAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAA;AACxF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAAY,EACZ,UAA+B,EAC/B,QAA2B;IAE3B,SAAS,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE;QACtE,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAA;QAC3B,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAClE,iBAAiB,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;QAClC,CAAC;QACD,OAAO,IAAI,EAAE,CAAA;IACf,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,sCAAsC,CACpD,GAAY,EACZ,UAA+B,EAC/B,QAA2B;IAE3B,SAAS,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE;QACrE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS;YAAE,iBAAiB,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;QAChE,OAAO,IAAI,EAAE,CAAA;IACf,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,YAAY,GAAG,MAAM,CAAC,yBAAyB,CAAC,CAAA;AAStD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAgB;IAC/C,IAAI,OAAO,OAAO,KAAK,UAAU;QAAE,OAAO,SAAS,CAAA;IACnD,MAAM,MAAM,GAAI,OAA8C,CAAC,YAAY,CAAC,CAAA;IAC5E,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAE,MAAsB,CAAC,CAAC,CAAC,SAAS,CAAA;AAC5F,CAAC;AAED,gGAAgG;AAChG,SAAS,SAAS,CAChB,GAAY,EACZ,QAA2B,EAC3B,OAAoB,EACpB,IAA0B;IAE1B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,4FAA4F;QAC5F,gGAAgG;QAChG,+FAA+F;QAC/F,qEAAqE;QACrE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAA;IACnF,CAAC;IACD,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;IAC7D,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QACrB,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,EAAE,IAAI,CAAC,CAAA;IAC9B,CAAC;AACH,CAAC"}

package/dist/modules/agentPrompts/AgentPromptController.js

@@ -2,7 +2,7 @@ import { getAgentPromptContract, listAgentPromptsContract, promoteAgentPromptCon
 import { promptIdForKind, promptVersionLabel } from '@cat-factory/agents';
 import { buildHonoRoute } from '@toad-contracts/hono';
 import { Hono } from 'hono';
-import { requireWorkspacePermission } from '../../http/workspaceAccess.js';
+import { mountWorkspacePermission } from '../../http/workspaceAccess.js';
 import { param } from '../../http/params.js';
 import { requireCapability } from '../../http/guards.js';
 import { NotFoundError, ValidationError } from '@cat-factory/kernel';
@@ -56,7 +56,7 @@ function detailFor(c, agentKind, revisions) {
  */
 export function agentPromptController() {
     const app = new Hono();
-    app.use('*', requireWorkspacePermission('settings.manage'));
+    mountWorkspacePermission(app, 'settings.manage', ['/agent-prompts']);
     buildHonoRoute(app, listAgentPromptsContract, async (c) => {
         const prompts = requireAgentPrompts(c);
         return c.json(await prompts.service.listSummaries(param(c, 'workspaceId')), 200);