@dench.com/cli 0.3.2 → 0.3.4

package/dench.ts

@@ -179,6 +179,21 @@ const api = {
         "functions/agentToolsNode:agentToolStatus",
       ),
     },
+    files: {
+      listTree: makeFunctionReference<"query">("functions/files:listTree"),
+      deleteFile: makeFunctionReference<"mutation">(
+        "functions/files:deleteFile",
+      ),
+      generateUploadUrl: makeFunctionReference<"mutation">(
+        "functions/files:generateUploadUrl",
+      ),
+      commitFileUpload: makeFunctionReference<"mutation">(
+        "functions/files:commitFileUpload",
+      ),
+      getFileSignedDownloadUrl: makeFunctionReference<"action">(
+        "functions/files:getFileSignedDownloadUrl",
+      ),
+    },
   },
 };
 const CONFIG_DIR = join(homedir(), ".dench");
@@ -233,6 +248,7 @@ const BOOLEAN_FLAGS = new Set([
   "--all",
   "--compact",
   "--dev",
+  "--follow",
   "--help",
   "--mine",
   "--self",
@@ -240,6 +256,7 @@ const BOOLEAN_FLAGS = new Set([
   "--prod",
   "--no-open",
   "--version",
+  "--yolo",
   "--ask-before-publishing",
   "--ask-before-spending",
   "--ask-before-external-messages",
@@ -391,7 +408,7 @@ Usage:
   dench tool connect <toolkit> [--json]
   dench tool search "create github issue" [--toolkit github] [--limit 20] [--compact] [--json]
   dench tool run <composio_tool_slug> --args '{"key":"value"}' [--account <connected_account_id>] [--approval <approvalId>] [--json]
-  dench autonomous run "Inspect this repo and summarize the relevant feature. Do not edit files, publish, deploy, spend money, send external messages, access secrets, or change production data." [--duration 1h] [--model <model>] [--api-base http://localhost:3000] [--json]
+  dench autonomous run "Inspect this repo and summarize the relevant feature. Do not edit files, publish, deploy, spend money, send external messages, access secrets, or change production data." [--duration 1h] [--model <model>] [--api-base http://localhost:3000] [--yolo] [--json]
 
 CRM (Daytona-native rewrite):
   dench crm objects <list|get|create|update|rename|delete> ...
@@ -413,12 +430,32 @@ CRM (Daytona-native rewrite):
   dench crm batch --file ops.jsonl
   Help: dench crm help
 
+Past chat threads (own + shared in this workspace):
+  dench chat list [--query <substr>] [--limit N] [--include-archived] [--json]
+  dench chat search "<query>" [--limit N] [--include-current] [--json]
+  dench chat read <thread-id> [--limit N] [--json]
+
+Spawn a new chat-turn workflow (same as the web UI):
+  dench chat new "<prompt>" [--model <m>] [--file-context <path>] [--visibility private|shared] [--title T] [--yolo] [--follow] [--json]
+  dench chat send <thread-id> "<message>" [--model <m>] [--yolo] [--follow] [--json]
+  dench agent new ...    (alias for dench chat new)
+  dench agent send ...   (alias for dench chat send)
+
+  Help: dench chat help
+
 File sync (Daytona-native rewrite):
+  dench fs status [--json] [--workspace /workspace] [--no-hash] [--drift-limit N]
   dench fs sync --initial --org-id <orgId> [--workspace /workspace]
   dench fs stream-open <path>
   dench fs stream-append <token> <chunk>
   dench fs stream-close <token>
 
+Workspace files (use these instead of mv/rm in /workspace; rename(2)
+returns ENOSYS on the FUSE-backed volume mount):
+  dench files ls <path> [--json]
+  dench files mv <src> <dst> [--json]
+  dench files rm <path> [--recursive] [--json]
+
 Subagents (Daytona-native rewrite):
   dench agent spawn '<goal>' [--parent-run-id <id>] [--sandbox own|share_parent] [--time-budget-ms N]
   dench agent await --hook <token> | --children id1,id2,id3
@@ -491,7 +528,7 @@ function autonomousHelp() {
   console.log(`Dench Long Session commands
 
 Usage:
-  dench autonomous run "Inspect this repo and summarize the relevant feature. Do not edit files, publish, deploy, spend money, send external messages, access secrets, or change production data." [--duration 1h] [--model <model>] [--api-base http://localhost:3000] [--json]
+  dench autonomous run "Inspect this repo and summarize the relevant feature. Do not edit files, publish, deploy, spend money, send external messages, access secrets, or change production data." [--duration 1h] [--model <model>] [--api-base http://localhost:3000] [--yolo] [--json]
 
 Notes:
   Starts a Long Session through /api/runs.
@@ -501,6 +538,8 @@ Notes:
   If needed, run dench login --host <api-base> once so the CLI can authenticate.
   Omit --model to use the server default.
   Approval flags: --ask-before-publishing --ask-before-spending --ask-before-external-messages --ask-before-production-changes --ask-before-secrets.
+  --yolo: skip every approval gate (overrides --ask-before-* / --approval-rules). Equivalent to the workspace's YOLO mode in /<slug>/settings -> Approvals.
+  Without any approval flags, the run inherits the workspace's Approvals policy from /<slug>/settings.
   Safe goals should explicitly say: ${SAFE_LONG_SESSION_CONSTRAINTS.join(", ")}.
 `);
 }
@@ -1417,6 +1456,9 @@ function durationPreset(rawDuration?: string) {
 }
 
 function parseApprovalRules() {
+  // --yolo wins over everything else: every approval gate is off,
+  // mirroring the org-level YOLO mode (settings -> Approvals).
+  if (hasFlag("--yolo")) return [];
   const explicit = option("--approval-rules")
     ?.split(",")
     .map((rule) => rule.trim())
@@ -2663,6 +2705,354 @@ async function runFsCommand() {
   }
 }
 
+// ── dench files <ls|mv|rm> ────────────────────────────────────────────────
+//
+// Escape hatches the model needs every time something on /workspace
+// can't be done with `mv` / `rm` — Mountpoint-S3 doesn't implement
+// rename(2) and the file daemon needs a hint to prune Convex rows.
+// All three commands take + emit POSIX paths under /workspace.
+
+function normalizeFilesPath(input: string): string {
+  if (!input || input === "/") return "/";
+  let cleaned = input.replace(/\\/g, "/").replace(/\/+/g, "/");
+  if (cleaned.startsWith("/workspace/")) cleaned = cleaned.slice("/workspace".length);
+  else if (cleaned === "/workspace") cleaned = "/";
+  if (!cleaned.startsWith("/")) cleaned = `/${cleaned}`;
+  if (cleaned.length > 1 && cleaned.endsWith("/")) cleaned = cleaned.slice(0, -1);
+  return cleaned;
+}
+
+function filesApiKey(runtime: Runtime): string | undefined {
+  if (runtime.mode === "apiKey") return runtime.sessionToken;
+  return process.env.DENCH_API_KEY?.trim() || undefined;
+}
+
+function requireFilesApiKey(runtime: Runtime, command: string): string {
+  const apiKey = filesApiKey(runtime);
+  if (!apiKey) {
+    throw new CliError(
+      `${command} needs DENCH_API_KEY (or a sandbox-baked api-key session). It bypasses the user-session auth path.`,
+      {
+        code: "files_api_key_required",
+        nextActions: [
+          "Run inside a Dench sandbox where DENCH_API_KEY is baked in.",
+          "Or export DENCH_API_KEY=<key> first (see dench login output).",
+        ],
+      },
+    );
+  }
+  return apiKey;
+}
+
+type FileTreeRow = {
+  path: string;
+  contentHash?: string;
+  isDir: boolean;
+  size?: number;
+  mtime?: number;
+};
+
+async function listConvexTreeAt(
+  runtime: Runtime,
+  apiKey: string,
+  prefix: string,
+): Promise<FileTreeRow[]> {
+  return (await runtime.client.query(api.functions.files.listTree, {
+    prefix,
+    apiKey,
+  } as never)) as FileTreeRow[];
+}
+
+async function listConvexTreeRecursive(
+  runtime: Runtime,
+  apiKey: string,
+  prefix: string,
+): Promise<FileTreeRow[]> {
+  const rows = await listConvexTreeAt(runtime, apiKey, prefix);
+  const out: FileTreeRow[] = [...rows];
+  for (const row of rows) {
+    if (row.isDir) {
+      const children = await listConvexTreeRecursive(runtime, apiKey, row.path);
+      out.push(...children);
+    }
+  }
+  return out;
+}
+
+async function downloadConvexFileBytes(
+  runtime: Runtime,
+  apiKey: string,
+  path: string,
+): Promise<Uint8Array | null> {
+  const url = (await runtime.client.action(
+    api.functions.files.getFileSignedDownloadUrl,
+    { path, apiKey } as never,
+  )) as string | null;
+  if (!url) return null;
+  const response = await fetch(url);
+  if (!response.ok) {
+    throw new Error(
+      `signed download failed (${response.status}): ${await response
+        .text()
+        .catch(() => "")}`,
+    );
+  }
+  return new Uint8Array(await response.arrayBuffer());
+}
+
+async function uploadConvexFileBytes(
+  runtime: Runtime,
+  apiKey: string,
+  args: { path: string; bytes: Uint8Array },
+): Promise<{ path: string; storageId: string; contentHash: string }> {
+  const uploadUrl = (await runtime.client.mutation(
+    api.functions.files.generateUploadUrl,
+    { path: args.path, apiKey } as never,
+  )) as string;
+  const response = await fetch(uploadUrl, {
+    method: "POST",
+    headers: { "content-type": "application/octet-stream" },
+    body: new Blob([args.bytes as BlobPart]),
+  });
+  if (!response.ok) {
+    throw new Error(
+      `convex storage upload failed (${response.status}): ${await response
+        .text()
+        .catch(() => "")}`,
+    );
+  }
+  const { storageId } = (await response.json()) as { storageId: string };
+  const hash = sha256HexSync(args.bytes);
+  const inlineEligible = args.bytes.byteLength <= 100_000;
+  const inlineText = inlineEligible
+    ? new TextDecoder("utf-8", { fatal: false }).decode(args.bytes)
+    : undefined;
+  await runtime.client.mutation(api.functions.files.commitFileUpload, {
+    path: args.path,
+    storageId,
+    contentHash: hash,
+    size: args.bytes.byteLength,
+    text: inlineText,
+    lastModifiedBy: "cli",
+    apiKey,
+  } as never);
+  return { path: args.path, storageId, contentHash: hash };
+}
+
+async function runFilesLs() {
+  const runtime = await getRuntime();
+  const apiKey = requireFilesApiKey(runtime, "dench files ls");
+  const target = normalizeFilesPath(positional(2) ?? "/");
+  const recursive = hasFlag("--recursive") || hasFlag("-r");
+  const rows = recursive
+    ? await listConvexTreeRecursive(runtime, apiKey, target)
+    : await listConvexTreeAt(runtime, apiKey, target);
+  if (hasFlag("--json")) {
+    print({
+      ok: true,
+      prefix: target,
+      recursive,
+      count: rows.length,
+      entries: rows.map((row) => ({
+        path: row.path,
+        isDir: row.isDir,
+        size: row.size,
+        mtime: row.mtime,
+        contentHash: row.contentHash,
+      })),
+    });
+    return;
+  }
+  if (rows.length === 0) {
+    process.stdout.write(`(no entries under ${target})\n`);
+    return;
+  }
+  for (const row of rows) {
+    const kind = row.isDir ? "DIR " : "FILE";
+    const size = row.isDir
+      ? "       -"
+      : (row.size ?? 0).toString().padStart(8, " ");
+    process.stdout.write(`${kind} ${size}  ${row.path}\n`);
+  }
+}
+
+async function runFilesMv() {
+  const runtime = await getRuntime();
+  const apiKey = requireFilesApiKey(runtime, "dench files mv");
+  const fromRaw = positional(2);
+  const toRaw = positional(3);
+  if (!fromRaw || !toRaw) {
+    throw new CliError("Usage: dench files mv <src> <dst>", {
+      code: "files_mv_usage",
+      nextActions: ["Pass both source and destination paths."],
+    });
+  }
+  const from = normalizeFilesPath(fromRaw);
+  const to = normalizeFilesPath(toRaw);
+  if (from === to) {
+    throw new CliError("Source and destination are the same path", {
+      code: "files_mv_noop",
+    });
+  }
+
+  const sourceRows = await listConvexTreeRecursive(runtime, apiKey, from);
+  const sourceSelf = (await listConvexTreeAt(runtime, apiKey, parentOfPath(from))).find(
+    (row) => row.path === from,
+  );
+  if (!sourceSelf && sourceRows.length === 0) {
+    throw new CliError(`Source not found in Convex: ${from}`, {
+      code: "files_mv_not_found",
+      nextActions: [
+        "Run `dench files ls` on the parent directory to confirm.",
+        "If the file only exists on the sandbox FS, run the daemon (or `dench fs sync --initial`) first.",
+      ],
+    });
+  }
+
+  const moved: Array<{ from: string; to: string }> = [];
+  if (sourceSelf && !sourceSelf.isDir) {
+    const bytes = await downloadConvexFileBytes(runtime, apiKey, from);
+    if (!bytes) {
+      throw new CliError(`Could not download bytes for ${from}`, {
+        code: "files_mv_download",
+      });
+    }
+    await uploadConvexFileBytes(runtime, apiKey, { path: to, bytes });
+    await runtime.client.mutation(api.functions.files.deleteFile, {
+      path: from,
+      apiKey,
+    } as never);
+    moved.push({ from, to });
+  } else {
+    for (const row of sourceRows) {
+      if (row.isDir) continue;
+      const rel = row.path.slice(from.length).replace(/^\/+/, "");
+      const dest = rel ? `${to}/${rel}` : to;
+      const bytes = await downloadConvexFileBytes(runtime, apiKey, row.path);
+      if (!bytes) continue;
+      await uploadConvexFileBytes(runtime, apiKey, { path: dest, bytes });
+      await runtime.client.mutation(api.functions.files.deleteFile, {
+        path: row.path,
+        apiKey,
+      } as never);
+      moved.push({ from: row.path, to: dest });
+    }
+    if (sourceSelf?.isDir) {
+      await runtime.client.mutation(api.functions.files.deleteFile, {
+        path: from,
+        apiKey,
+      } as never);
+    }
+  }
+
+  print({ ok: true, from, to, moved });
+}
+
+async function runFilesRm() {
+  const runtime = await getRuntime();
+  const apiKey = requireFilesApiKey(runtime, "dench files rm");
+  const targetRaw = positional(2);
+  if (!targetRaw) {
+    throw new CliError("Usage: dench files rm <path> [--recursive]", {
+      code: "files_rm_usage",
+    });
+  }
+  const target = normalizeFilesPath(targetRaw);
+  const recursive = hasFlag("--recursive") || hasFlag("-r");
+
+  const parentRows = await listConvexTreeAt(runtime, apiKey, parentOfPath(target));
+  const self = parentRows.find((row) => row.path === target);
+  if (!self) {
+    if (hasFlag("--json")) {
+      print({ ok: true, path: target, removedFiles: 0, removedDirs: 0 });
+    } else {
+      process.stdout.write(
+        `dench files rm: ${target} not present in Convex (already absent)\n`,
+      );
+    }
+    return;
+  }
+  if (self.isDir && !recursive) {
+    throw new CliError(
+      `${target} is a directory; pass --recursive to delete it.`,
+      { code: "files_rm_recursive" },
+    );
+  }
+
+  const toDelete = self.isDir
+    ? await listConvexTreeRecursive(runtime, apiKey, target)
+    : [];
+  const fileRows = toDelete.filter((row) => !row.isDir);
+  const dirRows = toDelete.filter((row) => row.isDir);
+  // Children first, parents last.
+  dirRows.sort((a, b) => b.path.length - a.path.length);
+
+  for (const row of fileRows) {
+    await runtime.client.mutation(api.functions.files.deleteFile, {
+      path: row.path,
+      apiKey,
+    } as never);
+  }
+  for (const row of dirRows) {
+    await runtime.client.mutation(api.functions.files.deleteFile, {
+      path: row.path,
+      apiKey,
+    } as never);
+  }
+  await runtime.client.mutation(api.functions.files.deleteFile, {
+    path: target,
+    apiKey,
+  } as never);
+
+  print({
+    ok: true,
+    path: target,
+    removedFiles: fileRows.length + (self.isDir ? 0 : 1),
+    removedDirs: dirRows.length + (self.isDir ? 1 : 0),
+  });
+}
+
+async function runFilesCommand() {
+  const sub = positional(1);
+  if (!sub || sub === "help" || hasFlag("--help")) {
+    process.stdout.write(
+      [
+        "dench files <ls|mv|rm> — workspace file ops that update the UI tree",
+        "",
+        "  dench files ls [<path>] [--recursive] [--json]",
+        "  dench files mv <src> <dst> [--json]",
+        "  dench files rm <path> [--recursive] [--json]",
+        "",
+        "Paths are POSIX paths under /workspace; you can pass either form.",
+        "These mutate Convex directly (and the daemon syncs to the volume).",
+      ].join("\n"),
+    );
+    return;
+  }
+  if (sub === "ls") return await runFilesLs();
+  if (sub === "mv") return await runFilesMv();
+  if (sub === "rm") return await runFilesRm();
+  throw new CliError(`Unknown subcommand: dench files ${sub}`, {
+    code: "files_unknown_subcommand",
+    nextActions: ["Run dench files help for usage."],
+  });
+}
+
+function parentOfPath(input: string): string {
+  const normalized = normalizeFilesPath(input);
+  if (normalized === "/") return "/";
+  const idx = normalized.lastIndexOf("/");
+  return idx <= 0 ? "/" : normalized.slice(0, idx);
+}
+
+function sha256HexSync(bytes: Uint8Array): string {
+  // Used by the dench files commands so we can compute the hash
+  // alongside the upload synchronously. Bun + Node both ship
+  // node:crypto, so this is free.
+  const { createHash } = require("node:crypto") as typeof import("node:crypto");
+  return createHash("sha256").update(bytes).digest("hex");
+}
+
 async function spawnInherited(binary: string, commandArgs: string[]) {
   return await new Promise<number>((resolve, reject) => {
     const child = spawn(binary, commandArgs, {
@@ -2815,6 +3205,60 @@ async function main() {
     return;
   }
 
+  if (command === "files") {
+    await runFilesCommand();
+    return;
+  }
+
+  if (command === "chat") {
+    const subArgs = args.slice(args.indexOf("chat") + 1);
+    const sub = subArgs[0];
+    if (!sub || sub === "help" || sub === "--help") {
+      const { runChatCommand } = await import("./chat");
+      // biome-ignore lint/suspicious/noExplicitAny: harmless help-only stub
+      await runChatCommand({ convex: {} as any, args: subArgs });
+      return;
+    }
+    // `chat new` / `chat send` spawn a chat-turn workflow via
+    // /api/chat/cli (the same workflow the web UI uses). They need
+    // an HTTP host + bearer token, not a Convex client. The
+    // remaining subcommands (list / search / read) are Convex
+    // queries and keep going through `runChatCommand`.
+    if (sub === "new" || sub === "send") {
+      const { runChatSpawnCommand } = await import("./chat-spawn");
+      const runtime = await getRuntime();
+      const authedRuntime = requireAuthenticatedRuntime(
+        runtime,
+        `dench chat ${sub}`,
+      );
+      // Drop the leading subcommand from subArgs — runChatSpawnCommand
+      // expects the remaining tokens (prompt + flags).
+      await runChatSpawnCommand({
+        runtime: {
+          host: authedRuntime.host,
+          bearerToken: authedRuntime.sessionToken,
+        },
+        args: subArgs.slice(1),
+        subcommand: sub,
+      });
+      return;
+    }
+    const { runChatCommand } = await import("./chat");
+    const runtime = await getRuntime();
+    // Past-chat queries are org+user-scoped: the server resolves the
+    // user from the session token, OR from `runId` when authenticating
+    // with a Dench API key. Pass DENCH_RUN_ID through automatically so
+    // `dench chat …` works inside a sandbox without extra flags.
+    const authedRuntime = requireAuthenticatedRuntime(runtime, "dench chat");
+    await runChatCommand({
+      convex: authedRuntime.client,
+      args: subArgs,
+      sessionToken: authedRuntime.sessionToken,
+      runId: process.env.DENCH_RUN_ID?.trim() || undefined,
+    });
+    return;
+  }
+
   if (command === "agent") {
     const subArgs = args.slice(args.indexOf("agent") + 1);
     const sub = subArgs[0];
@@ -2824,6 +3268,27 @@ async function main() {
       await runAgentCommand({ convex: {} as any, args: subArgs });
       return;
     }
+    // Aliases: `dench agent new` / `dench agent send` -> the chat-spawn
+    // implementation. Surfaced under `agent` so users who associate
+    // chat threads with the agent surface still find them; the actual
+    // workflow is identical to `dench chat new` / `dench chat send`.
+    if (sub === "new" || sub === "send") {
+      const { runChatSpawnCommand } = await import("./chat-spawn");
+      const runtime = await getRuntime();
+      const authedRuntime = requireAuthenticatedRuntime(
+        runtime,
+        `dench agent ${sub}`,
+      );
+      await runChatSpawnCommand({
+        runtime: {
+          host: authedRuntime.host,
+          bearerToken: authedRuntime.sessionToken,
+        },
+        args: subArgs.slice(1),
+        subcommand: sub,
+      });
+      return;
+    }
     const { runAgentCommand } = await import("./agent");
     const runtime = await getRuntime();
     await runAgentCommand({

package/fs-daemon-mount.ts

@@ -0,0 +1,133 @@
+/**
+ * Mount-point detection helpers for `dench-fs-daemon`.
+ *
+ * `/workspace` in every Dench sandbox is a Daytona persistent volume
+ * mounted via AWS Mountpoint for S3 (a FUSE driver). Two upstream
+ * limitations matter for the file daemon:
+ *
+ *   • inotify events never fire on the mount
+ *     (https://github.com/awslabs/mountpoint-s3/issues/1290), so
+ *     chokidar's default backend is useless. The daemon switches
+ *     to polling mode when these helpers report a FUSE backing.
+ *
+ *   • rename(2) returns ENOSYS on general-purpose buckets, so
+ *     callers that need to detect "is this path on the volume?"
+ *     can use `detectWorkspaceFsType` to choose the safe
+ *     copy+unlink path instead of trusting `mv`.
+ *
+ * This file lives alongside fs-daemon.ts but contains no Convex /
+ * chokidar imports so unit tests can pull it directly.
+ */
+
+import { readFile } from "node:fs/promises";
+
+export type MountInfo = {
+  mountPoint: string;
+  fsType: string;
+  source: string;
+};
+
+/**
+ * Read /proc/self/mountinfo and return the parsed mount table.
+ * Returns an empty array on non-Linux hosts (e.g. local macOS dev,
+ * where /proc doesn't exist) so callers can fall through cleanly.
+ *
+ * The proc(5) line format is:
+ *
+ *   36 35 98:0 /mnt1 /mnt/parent rw,noatime master:1 - ext3 /dev/root rw
+ *   ─┬ ─┬ ──┬─ ──┬── ──┬─────── ──┬───── ──┬────── ─ ──┬─ ────┬──── ──┬
+ *    1  2   3    4    5            6        7           8     9        10
+ *
+ * We only need fields 5 (mount point) and the fs type after the
+ * " - " separator (field 9, with optional source as field 10).
+ */
+export async function readMountInfo(
+  procPath = "/proc/self/mountinfo",
+): Promise<MountInfo[]> {
+  let raw: string;
+  try {
+    raw = await readFile(procPath, "utf-8");
+  } catch {
+    return [];
+  }
+  const out: MountInfo[] = [];
+  for (const rawLine of raw.split("\n")) {
+    const line = rawLine.trim();
+    if (!line) continue;
+    const dashIdx = line.indexOf(" - ");
+    if (dashIdx === -1) continue;
+    const before = line.slice(0, dashIdx).split(/\s+/);
+    const after = line.slice(dashIdx + 3).split(/\s+/);
+    const mountPoint = before[4];
+    const fsType = after[0];
+    const source = after[1] ?? "";
+    if (!mountPoint || !fsType) continue;
+    out.push({ mountPoint, fsType, source });
+  }
+  return out;
+}
+
+/**
+ * Find the longest mount point that is a prefix of `absPath`. Used to
+ * answer "what filesystem is this path on?" from the parsed mount
+ * table. Important to use longest-prefix so a `/workspace` mount
+ * over `/` doesn't get shadowed by the root mount.
+ *
+ * Naïve `startsWith` would also match `/workspace` against
+ * `/worker`; we guard against that by requiring the next char to be
+ * `/` (or the strings to be equal).
+ */
+export function findMountForPath(
+  mounts: MountInfo[],
+  absPath: string,
+): MountInfo | null {
+  let best: MountInfo | null = null;
+  for (const mount of mounts) {
+    if (mount.mountPoint === absPath) return mount;
+    const trimmed = mount.mountPoint.replace(/\/+$/, "");
+    if (
+      absPath === trimmed ||
+      absPath.startsWith(`${trimmed === "" ? "" : trimmed}/`)
+    ) {
+      if (!best || mount.mountPoint.length > best.mountPoint.length) {
+        best = mount;
+      }
+    }
+  }
+  return best;
+}
+
+/**
+ * Returns true for any FUSE-flavored fs type. mount-s3 reports
+ * `fuse` (no subtype on Linux); other FUSE drivers commonly use
+ * `fuse.<name>` (e.g. fuse.sshfs). `fuseblk` is the block-device
+ * flavor used by ntfs-3g and friends.
+ */
+export function isFuseFsType(fsType: string): boolean {
+  if (!fsType) return false;
+  return (
+    fsType === "fuse" || fsType.startsWith("fuse.") || fsType === "fuseblk"
+  );
+}
+
+/**
+ * Convenience: detect the filesystem backing a given workspace path
+ * in one call. The daemon uses this on startup to decide whether to
+ * enable chokidar's polling mode.
+ */
+export async function detectWorkspaceFsType(workspace: string): Promise<{
+  fsType: string;
+  isFuse: boolean;
+  source: string;
+}> {
+  const mounts = await readMountInfo();
+  const match = findMountForPath(mounts, workspace);
+  if (!match) {
+    return { fsType: "unknown", isFuse: false, source: "" };
+  }
+  return {
+    fsType: match.fsType,
+    isFuse: isFuseFsType(match.fsType),
+    source: match.source,
+  };
+}