@hachej/boring-governance 0.1.71 → 0.1.72

package/dist/server/index.js

@@ -1,3 +1,6 @@
+// src/server/index.ts
+import path3 from "path";
+
 // src/server/loadPolicy.ts
 import { readFile, stat } from "fs/promises";
 import { parse } from "yaml";
@@ -16,25 +19,25 @@ function normalizePolicyEmail(value) {
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function nonEmptyString(value, path2) {
+function nonEmptyString(value, path4) {
   if (typeof value !== "string" || value.trim().length === 0) {
-    fail(`${path2} must be a non-empty string`);
+    fail(`${path4} must be a non-empty string`);
   }
   return value.trim();
 }
-function uuidString(value, path2) {
-  const id = nonEmptyString(value, path2);
+function uuidString(value, path4) {
+  const id = nonEmptyString(value, path4);
   if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id)) {
-    fail(`${path2} must be a UUID workspace id`);
+    fail(`${path4} must be a UUID workspace id`);
   }
   return id;
 }
-function finiteNumber(value, path2, opts) {
+function finiteNumber(value, path4, opts) {
   if (typeof value !== "number" || !Number.isFinite(value)) {
-    fail(`${path2} must be a finite number`);
+    fail(`${path4} must be a finite number`);
   }
   if (opts.allowZero ? value < opts.min : value <= opts.min) {
-    fail(`${path2} must be ${opts.allowZero ? ">=" : ">"} ${opts.min}`);
+    fail(`${path4} must be ${opts.allowZero ? ">=" : ">"} ${opts.min}`);
   }
   return value;
 }
@@ -96,42 +99,42 @@ function hasTopLevelAlternation(pattern) {
   }
   return false;
 }
-function validateSegmentSafePattern(pattern, path2) {
+function validateSegmentSafePattern(pattern, path4) {
   const { prefix, consumed, unsafeEscape } = literalPathPrefix(pattern);
-  if (unsafeEscape) fail(`${path2} must use only literal regex escapes before the path-segment boundary`);
+  if (unsafeEscape) fail(`${path4} must use only literal regex escapes before the path-segment boundary`);
   if (!prefix) {
     const remainder2 = pattern.slice("^/".length);
     if (remainder2.startsWith(".*") || remainder2.startsWith("$")) return;
-    fail(`${path2} must start with a literal path segment or ^/.*`);
+    fail(`${path4} must start with a literal path segment or ^/.*`);
   }
   const remainder = pattern.slice("^/".length + consumed);
   if (prefix.endsWith("/")) {
-    if (/^[?*+{]/.test(remainder)) fail(`${path2} must not make the path-segment boundary slash optional`);
+    if (/^[?*+{]/.test(remainder)) fail(`${path4} must not make the path-segment boundary slash optional`);
     return;
   }
   if (remainder.startsWith("$")) return;
   for (const guard of ["(?:/|$)", "(?:$|/)", "(/|$)", "($|/)"]) {
     if (!remainder.startsWith(guard)) continue;
     if (/^[?*+{]/.test(remainder.slice(guard.length))) {
-      fail(`${path2} must not make the path-segment boundary guard optional`);
+      fail(`${path4} must not make the path-segment boundary guard optional`);
     }
     return;
   }
-  fail(`${path2} must make literal path-prefix grants segment-safe with /, $, or (?:/|$)`);
+  fail(`${path4} must make literal path-prefix grants segment-safe with /, $, or (?:/|$)`);
 }
-function validateRegexPattern(value, path2) {
-  const pattern = nonEmptyString(value, path2);
-  if (pattern.length > MAX_REGEX_LENGTH) fail(`${path2} must be at most ${MAX_REGEX_LENGTH} characters`);
-  if (!pattern.startsWith("^/")) fail(`${path2} must start with ^/`);
-  if (hasTopLevelAlternation(pattern)) fail(`${path2} must not use top-level regex alternation; add separate allow rules instead`);
-  validateSegmentSafePattern(pattern, path2);
+function validateRegexPattern(value, path4) {
+  const pattern = nonEmptyString(value, path4);
+  if (pattern.length > MAX_REGEX_LENGTH) fail(`${path4} must be at most ${MAX_REGEX_LENGTH} characters`);
+  if (!pattern.startsWith("^/")) fail(`${path4} must start with ^/`);
+  if (hasTopLevelAlternation(pattern)) fail(`${path4} must not use top-level regex alternation; add separate allow rules instead`);
+  validateSegmentSafePattern(pattern, path4);
   if (/\([^)]*[+*][^)]*\)[+*{]/.test(pattern)) {
-    fail(`${path2} contains an unsafe nested quantifier`);
+    fail(`${path4} contains an unsafe nested quantifier`);
   }
   try {
     new RegExp(pattern);
   } catch (error) {
-    fail(`${path2} must compile as a JavaScript RegExp: ${error instanceof Error ? error.message : String(error)}`);
+    fail(`${path4} must compile as a JavaScript RegExp: ${error instanceof Error ? error.message : String(error)}`);
   }
   return pattern;
 }
@@ -139,11 +142,11 @@ function validateModels(value, userPath, defaultMonthlyModelBudgetEur) {
   if (value === void 0) return [];
   if (!Array.isArray(value)) fail(`${userPath}.models must be an array`);
   return value.map((entry, index) => {
-    const path2 = `${userPath}.models[${index}]`;
-    if (!isRecord(entry)) fail(`${path2} must be an object`);
-    const provider = nonEmptyString(entry.provider, `${path2}.provider`);
-    const id = nonEmptyString(entry.id, `${path2}.id`);
-    const monthlyBudgetEur = entry.monthlyBudgetEur === void 0 ? defaultMonthlyModelBudgetEur : finiteNumber(entry.monthlyBudgetEur, `${path2}.monthlyBudgetEur`, {
+    const path4 = `${userPath}.models[${index}]`;
+    if (!isRecord(entry)) fail(`${path4} must be an object`);
+    const provider = nonEmptyString(entry.provider, `${path4}.provider`);
+    const id = nonEmptyString(entry.id, `${path4}.id`);
+    const monthlyBudgetEur = entry.monthlyBudgetEur === void 0 ? defaultMonthlyModelBudgetEur : finiteNumber(entry.monthlyBudgetEur, `${path4}.monthlyBudgetEur`, {
       min: 0,
       allowZero: true
     });
@@ -155,6 +158,15 @@ function validateModels(value, userPath, defaultMonthlyModelBudgetEur) {
     };
   });
 }
+function validateUserBudgets(value, userPath) {
+  if (value === void 0) return { monthlyEur: null, monthlyMicros: null };
+  if (!isRecord(value)) fail(`${userPath}.budgets must be an object`);
+  const monthlyEur = value.monthlyEur === void 0 ? null : finiteNumber(value.monthlyEur, `${userPath}.budgets.monthlyEur`, { min: 0, allowZero: true });
+  return {
+    monthlyEur,
+    monthlyMicros: monthlyEur === null ? null : Math.round(monthlyEur * MICROS_PER_EUR)
+  };
+}
 function validateCompanyContext(value, userPath) {
   if (value === void 0) return { allow: [] };
   if (!isRecord(value)) fail(`${userPath}.companyContext must be an object`);
@@ -168,8 +180,8 @@ function validateCompanyContext(value, userPath) {
     allow: allow.map((pattern, index) => validateRegexPattern(pattern, `${userPath}.companyContext.allow[${index}]`))
   };
 }
-function validateRole(value, path2) {
-  if (value !== "admin" && value !== "user") fail(`${path2} must be admin or user`);
+function validateRole(value, path4) {
+  if (value !== "admin" && value !== "user") fail(`${path4} must be admin or user`);
   return value;
 }
 function validateGovernancePolicy(input) {
@@ -184,16 +196,17 @@ function validateGovernancePolicy(input) {
   if (!Array.isArray(candidate.users)) fail("users must be an array");
   const usersByEmail = /* @__PURE__ */ new Map();
   const users = candidate.users.map((entry, index) => {
-    const path2 = `users[${index}]`;
-    if (!isRecord(entry)) fail(`${path2} must be an object`);
-    const email = normalizePolicyEmail(nonEmptyString(entry.email, `${path2}.email`));
-    if (!email.includes("@")) fail(`${path2}.email must be an email address`);
+    const path4 = `users[${index}]`;
+    if (!isRecord(entry)) fail(`${path4} must be an object`);
+    const email = normalizePolicyEmail(nonEmptyString(entry.email, `${path4}.email`));
+    if (!email.includes("@")) fail(`${path4}.email must be an email address`);
     if (usersByEmail.has(email)) fail(`duplicate user email: ${email}`);
     const user = {
       email,
-      role: validateRole(entry.role, `${path2}.role`),
-      models: validateModels(entry.models, path2, defaultMonthlyModelBudgetEur),
-      companyContext: validateCompanyContext(entry.companyContext, path2)
+      role: validateRole(entry.role, `${path4}.role`),
+      budgets: validateUserBudgets(entry.budgets, path4),
+      models: validateModels(entry.models, path4, defaultMonthlyModelBudgetEur),
+      companyContext: validateCompanyContext(entry.companyContext, path4)
     };
     usersByEmail.set(email, user);
     return user;
@@ -219,13 +232,13 @@ function validateGovernancePolicy(input) {
 var MAX_POLICY_BYTES = 256 * 1024;
 var GOVERNANCE_POLICY_PATH_ENV = "BORING_GOVERNANCE_POLICY_PATH";
 var GOVERNANCE_DEV_EMAIL_VERIFICATION_OVERRIDE_ENV = "BORING_GOVERNANCE_ALLOW_UNVERIFIED_EMAIL_DEV";
-function invalidResult(path2, error) {
+function invalidResult(path4, error) {
   return {
     enabled: true,
     policy: null,
     status: {
       state: "invalid",
-      path: path2,
+      path: path4,
       message: error instanceof Error ? error.message : String(error)
     }
   };
@@ -348,10 +361,21 @@ var GovernanceService = class {
     const grant = userPolicy?.models.find((entry) => entry.provider === model.provider && entry.id === model.id);
     return grant?.monthlyBudgetMicros ?? null;
   }
+  userMonthlyBudgetMicros(user) {
+    if (!this.loaded.enabled) return null;
+    return this.userPolicy(user)?.budgets.monthlyMicros ?? null;
+  }
   companyContextRules(user) {
     if (!this.loaded.enabled) return [];
     return this.userPolicy(user)?.companyContext.allow ?? [];
   }
+  companyContextAccessForUser(user) {
+    if (!this.loaded.enabled) return "none";
+    const policy = this.userPolicy(user);
+    if (!policy) return "none";
+    if (policy.role === "admin") return "readwrite";
+    return policy.companyContext.allow.length > 0 ? "readonly" : "none";
+  }
   companyContextWorkspaceId() {
     return this.enabledPolicy()?.tenant.companyContextWorkspaceId ?? null;
   }
@@ -382,6 +406,7 @@ var GovernanceService = class {
         email: entry.email,
         role: entry.role,
         modelCount: entry.models.length,
+        monthlyBudgetEur: entry.budgets.monthlyEur,
         contextRuleCount: entry.companyContext.allow.length
       })),
       models: policy.users.flatMap((entry) => entry.models.map((model) => ({ ...model, email: entry.email }))),
@@ -516,9 +541,7 @@ async function reconcileCompanyContextWorkspace(app, service) {
 
 // src/server/metering.ts
 import { ErrorCode } from "@hachej/boring-agent/shared";
-import * as coreServer from "@hachej/boring-core/server";
-var PostgresModelBudgetStore2 = coreServer.PostgresModelBudgetStore;
-var ModelBudgetExceededError2 = coreServer.ModelBudgetExceededError;
+import { ModelBudgetExceededError, PostgresBudgetReservationStore, UserBudgetExceededError } from "@hachej/boring-core/server";
 var DEFAULT_HOLD_TTL_SECONDS = 60 * 60;
 function authRequiredError() {
   return Object.assign(new Error("authentication required"), { statusCode: 401, code: ErrorCode.enum.UNAUTHORIZED });
@@ -530,7 +553,7 @@ function policyDeniedError() {
   return Object.assign(new Error("model is not allowed by governance policy"), { statusCode: 403, code: ErrorCode.enum.TOOL_INVALID_INPUT });
 }
 function budgetError(error) {
-  if (typeof ModelBudgetExceededError2 === "function" && error instanceof ModelBudgetExceededError2) return error;
+  if (typeof ModelBudgetExceededError === "function" && error instanceof ModelBudgetExceededError) return error;
   return error instanceof Error ? error : new Error(String(error));
 }
 function runKey(input) {
@@ -538,8 +561,8 @@ function runKey(input) {
 }
 function createGovernanceMeteringSink(options) {
   let store;
-  const getStore = () => store ??= new PostgresModelBudgetStore2(options.getDb());
-  const reservationsByRun = /* @__PURE__ */ new Map();
+  const getStore = () => store ??= new PostgresBudgetReservationStore(options.getDb(), { eligibleLegacySources: ["pi-chat", "pi-chat-fallback", "pi-chat-expired"] });
+  const admissionsByRun = /* @__PURE__ */ new Map();
   const holdTtlSeconds = options.holdTtlSeconds ?? DEFAULT_HOLD_TTL_SECONDS;
   async function reserveGovernance(input) {
     if (!options.service.isEnabled()) return void 0;
@@ -552,35 +575,59 @@ function createGovernanceMeteringSink(options) {
     } catch {
       throw policyDeniedError();
     }
-    const budgetMicros = options.service.monthlyBudgetMicros(user, { provider: input.model.provider, id: input.model.id });
-    if (budgetMicros === null || budgetMicros <= 0) throw new ModelBudgetExceededError2(0, 0, budgetMicros ?? 0, 0);
+    const modelBudgetMicros = options.service.monthlyBudgetMicros(user, { provider: input.model.provider, id: input.model.id });
+    if (modelBudgetMicros === null || modelBudgetMicros <= 0) throw new ModelBudgetExceededError(0, 0, modelBudgetMicros ?? 0, 0);
     const policy = options.service.policy();
     const holdMicros = policy?.tenant.perRunHoldMicros ?? 1e6;
-    const result = await getStore().reserve({
+    const now = /* @__PURE__ */ new Date();
+    let userReservationInput;
+    const userBudgetMicros = options.service.userMonthlyBudgetMicros(user);
+    if (userBudgetMicros !== null) {
+      if (userBudgetMicros <= 0) throw new (UserBudgetExceededError ?? ModelBudgetExceededError)(0, 0, userBudgetMicros, 0);
+      userReservationInput = {
+        scope: "user",
+        userId: input.userId,
+        workspaceId: input.workspaceId,
+        sessionId: input.sessionId,
+        runId: input.runId,
+        budgetMicros: userBudgetMicros,
+        holdMicros,
+        ttlSeconds: holdTtlSeconds,
+        now
+      };
+    }
+    const modelReservationInput = {
+      scope: "model",
       userId: input.userId,
       workspaceId: input.workspaceId,
       sessionId: input.sessionId,
       runId: input.runId,
       provider: input.model.provider,
       model: input.model.id,
-      budgetMicros,
+      budgetMicros: modelBudgetMicros,
       holdMicros,
-      ttlSeconds: holdTtlSeconds
-    }).catch((error) => {
+      ttlSeconds: holdTtlSeconds,
+      now
+    };
+    const admission = await getStore().reserveAdmission({ user: userReservationInput, model: modelReservationInput }).catch((error) => {
       throw budgetError(error);
     });
     const key = runKey(input);
-    if (key) reservationsByRun.set(key, result.reservationId);
-    return result.reservationId;
+    if (key) admissionsByRun.set(key, admission);
+    return admission;
   }
   async function finishGovernance(input, action) {
     if (!options.service.isEnabled()) return;
     const key = runKey(input);
-    const reservationId = key ? reservationsByRun.get(key) : void 0;
-    if (!reservationId && (!input.userId || !input.runId)) return;
-    if (action === "settle") await getStore().settle({ reservationId, runId: input.runId, userId: input.userId });
-    else await getStore().release({ reservationId, runId: input.runId, userId: input.userId });
-    if (key) reservationsByRun.delete(key);
+    const admission = key ? admissionsByRun.get(key) : void 0;
+    const status = action === "settle" ? "settled" : "released";
+    if (admission) {
+      await getStore().finishAdmission(admission, status);
+      if (key) admissionsByRun.delete(key);
+      return;
+    }
+    if (!input.userId || !input.runId) return;
+    await getStore().finishRun({ runId: input.runId, userId: input.userId }, status);
   }
   function releaseConsumesBudget(input) {
     return input.reason === "usage-write-failed" || input.reason === "fallback-hold-charge";
@@ -588,21 +635,24 @@ function createGovernanceMeteringSink(options) {
   return {
     isEnabled: () => options.service.isEnabled() || options.delegate.isEnabled?.() !== false,
     async reserveRun(input) {
-      const governanceReservationId = await reserveGovernance(input);
+      const admission = await reserveGovernance(input);
       try {
         return await options.delegate.reserveRun(input);
       } catch (error) {
-        if (governanceReservationId) await getStore().release({ reservationId: governanceReservationId }).catch(() => {
-        });
-        const key = runKey(input);
-        if (key) reservationsByRun.delete(key);
+        try {
+          if (admission) await getStore().releaseCreated(admission);
+        } catch {
+        } finally {
+          const key = runKey(input);
+          if (key) admissionsByRun.delete(key);
+        }
         throw error;
       }
     },
     recordUsage(input) {
       const key = runKey(input);
-      const reservationId = key ? reservationsByRun.get(key) : void 0;
-      return options.delegate.recordUsage(reservationId ? { ...input, metadata: { ...input.metadata ?? {}, modelBudgetReservationId: reservationId } } : input);
+      const admission = key ? admissionsByRun.get(key) : void 0;
+      return options.delegate.recordUsage(admission ? { ...input, metadata: { ...input.metadata ?? {}, ...getStore().metadataForAdmission(admission) } } : input);
     },
     async settleRun(input) {
       try {
@@ -627,10 +677,10 @@ function createGovernanceMeteringSink(options) {
 }
 
 // src/server/filesystemBindings.ts
-import { constants } from "fs";
-import { access, chmod, copyFile, lstat, mkdir, mkdtemp, readdir, realpath, rm, stat as stat2 } from "fs/promises";
+import { constants as constants2 } from "fs";
+import { access, chmod, copyFile, lstat as lstat2, mkdir as mkdir2, mkdtemp, readdir as readdir2, realpath as realpath2, rm as rm2, stat as stat3 } from "fs/promises";
 import os from "os";
-import path from "path";
+import path2 from "path";
 import { createLogger } from "@hachej/boring-agent/server";
 import { ErrorCode as ErrorCode2 } from "@hachej/boring-agent/shared";
 import {
@@ -638,6 +688,260 @@ import {
   ScopedFilesystemRuntimeBindingManager,
   createReadonlyProjectionOperations
 } from "@hachej/boring-bash/server";
+
+// src/server/companyContextStore.ts
+import { constants } from "fs";
+import { lstat, mkdir, open, readdir, readFile as readFile2, realpath, rename, rm, stat as stat2 } from "fs/promises";
+import path from "path";
+import { randomUUID } from "crypto";
+import lockfile from "proper-lockfile";
+var COMPANY_CONTEXT_CONFLICT_CODE = "conflict";
+var CompanyContextConflictError = class extends Error {
+  constructor(details) {
+    super(details.currentMtimeMs === void 0 ? "file no longer exists" : "file has been modified since last read");
+    this.details = details;
+    this.name = "CompanyContextConflictError";
+  }
+  details;
+  statusCode = 409;
+  code = COMPANY_CONTEXT_CONFLICT_CODE;
+};
+var COMPANY_CONTEXT_STATE_DIR = ".boring-governance";
+var mutationQueues = /* @__PURE__ */ new Map();
+function normalizeCompanyPath(value) {
+  const normalized = value.replace(/\\/g, "/");
+  if (normalized.includes("\0")) throw Object.assign(new Error("invalid company path"), { code: "EPERM" });
+  const withRoot = normalized.startsWith("/") ? normalized : `/${normalized}`;
+  const parts = withRoot.split("/").filter(Boolean);
+  if (parts.some((part) => part === "." || part === ".." || part === COMPANY_CONTEXT_STATE_DIR)) {
+    throw Object.assign(new Error("company path traversal is not allowed"), { code: "EPERM" });
+  }
+  return `/${parts.join("/")}`;
+}
+function assertContained(root, candidate) {
+  const relative = path.relative(root, candidate);
+  if (relative.startsWith("..") || path.isAbsolute(relative)) {
+    throw Object.assign(new Error("path escapes company context root"), { code: "EPERM" });
+  }
+}
+async function inspectExistingPath(root, target, allowMissingLeaf) {
+  assertContained(root, target);
+  const relative = path.relative(root, target);
+  let current = root;
+  const parts = relative.split(path.sep).filter(Boolean);
+  for (let index = 0; index < parts.length; index += 1) {
+    current = path.join(current, parts[index]);
+    try {
+      const entry = await lstat(current);
+      if (entry.isSymbolicLink()) throw Object.assign(new Error("company context symlinks are not allowed"), { code: "EPERM" });
+      if (index < parts.length - 1 && !entry.isDirectory()) {
+        throw Object.assign(new Error("company context parent is not a directory"), { code: "ENOTDIR" });
+      }
+    } catch (error) {
+      if (error.code === "ENOENT" && allowMissingLeaf && index === parts.length - 1) return;
+      throw error;
+    }
+  }
+}
+async function acquireFilesystemLock(root) {
+  const stateRoot = path.join(root, COMPANY_CONTEXT_STATE_DIR);
+  const lockPath = path.join(stateRoot, "mutation.lock");
+  await mkdir(stateRoot, { recursive: true, mode: 448 });
+  const stateStat = await lstat(stateRoot);
+  if (stateStat.isSymbolicLink() || !stateStat.isDirectory()) {
+    throw Object.assign(new Error("unsafe company context state directory"), { code: "EPERM" });
+  }
+  return await lockfile.lock(root, {
+    lockfilePath: lockPath,
+    realpath: false,
+    stale: 3e4,
+    update: 5e3,
+    retries: { retries: 100, minTimeout: 25, maxTimeout: 100 }
+  });
+}
+async function withMutationLock(key, operation) {
+  const previous = mutationQueues.get(key) ?? Promise.resolve();
+  let releaseProcessLock;
+  const current = new Promise((resolve) => {
+    releaseProcessLock = resolve;
+  });
+  const queued = previous.then(() => current);
+  mutationQueues.set(key, queued);
+  await previous;
+  let releaseFilesystemLock = null;
+  try {
+    releaseFilesystemLock = await acquireFilesystemLock(key);
+    return await operation();
+  } finally {
+    await releaseFilesystemLock?.().catch(() => {
+    });
+    releaseProcessLock();
+    if (mutationQueues.get(key) === queued) mutationQueues.delete(key);
+  }
+}
+var CompanyContextStore = class _CompanyContextStore {
+  constructor(root) {
+    this.root = root;
+  }
+  root;
+  static async open(root) {
+    const canonicalRoot = await realpath(path.resolve(root));
+    const rootStat = await stat2(canonicalRoot);
+    if (!rootStat.isDirectory()) throw new Error("company context root is not a directory");
+    return new _CompanyContextStore(canonicalRoot);
+  }
+  resolve(companyPath) {
+    const normalized = normalizeCompanyPath(companyPath);
+    const target = path.resolve(this.root, `.${normalized}`);
+    assertContained(this.root, target);
+    return { root: this.root, target };
+  }
+  async read(companyPath) {
+    const { target } = this.resolve(companyPath);
+    await inspectExistingPath(this.root, target, false);
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+      const before = await stat2(target);
+      if (!before.isFile()) throw Object.assign(new Error("company context path is not a file"), { code: "EISDIR" });
+      const content = await readFile2(target, "utf8");
+      const after = await stat2(target);
+      if (before.mtimeMs === after.mtimeMs && before.size === after.size) return { content, mtimeMs: after.mtimeMs };
+    }
+    throw Object.assign(new Error("company context changed while reading"), { statusCode: 409, code: COMPANY_CONTEXT_CONFLICT_CODE });
+  }
+  async list(companyPath) {
+    const { target } = this.resolve(companyPath);
+    await inspectExistingPath(this.root, target, false);
+    const entries = await readdir(target, { withFileTypes: true });
+    return {
+      entries: entries.filter((entry) => !entry.isSymbolicLink() && entry.name !== COMPANY_CONTEXT_STATE_DIR).map((entry) => entry.name)
+    };
+  }
+  async walk(companyPath) {
+    const normalized = normalizeCompanyPath(companyPath);
+    const pending = [normalized];
+    const files = [];
+    while (pending.length > 0) {
+      const current = pending.shift();
+      const listed = await this.list(current);
+      for (const name of listed.entries) {
+        const child = current === "/" ? `/${name}` : `${current}/${name}`;
+        const childStat = await this.stat(child);
+        if (childStat.isDirectory) pending.push(child);
+        else files.push(child);
+      }
+    }
+    return files;
+  }
+  async find(companyPath, pattern, options = {}) {
+    const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*/g, "\0").replace(/\*/g, "[^/]*").replace(/\?/g, "[^/]").replace(/\u0000/g, ".*");
+    const matcher = new RegExp(`^${escaped}$`);
+    const paths = (await this.walk(companyPath)).filter((entry) => matcher.test(path.posix.basename(entry)) || matcher.test(entry));
+    const offset = Math.max(0, options.offset ?? 0);
+    return { paths: paths.slice(offset, options.limit === void 0 ? void 0 : offset + Math.max(0, options.limit)) };
+  }
+  async grep(companyPath, pattern, options = {}) {
+    const matcher = new RegExp(pattern);
+    const matches = [];
+    for (const file of await this.walk(companyPath)) {
+      const { content } = await this.read(file);
+      for (const [index, line] of content.split(/\r?\n/).entries()) {
+        matcher.lastIndex = 0;
+        if (matcher.test(line)) matches.push({ path: file, line: index + 1, text: line });
+      }
+    }
+    const offset = Math.max(0, options.offset ?? 0);
+    return { matches: matches.slice(offset, options.limit === void 0 ? void 0 : offset + Math.max(0, options.limit)) };
+  }
+  async stat(companyPath) {
+    const { target } = this.resolve(companyPath);
+    await inspectExistingPath(this.root, target, false);
+    const entry = await stat2(target);
+    return { isDirectory: entry.isDirectory(), mtimeMs: entry.mtimeMs };
+  }
+  async write(companyPath, content, expectedMtimeMs) {
+    const { target } = this.resolve(companyPath);
+    return withMutationLock(this.root, async () => {
+      await inspectExistingPath(this.root, path.dirname(target), false);
+      let currentMtimeMs;
+      try {
+        await inspectExistingPath(this.root, target, false);
+        currentMtimeMs = (await stat2(target)).mtimeMs;
+      } catch (error) {
+        if (error.code !== "ENOENT") throw error;
+      }
+      if (expectedMtimeMs !== void 0 && currentMtimeMs !== expectedMtimeMs) {
+        throw new CompanyContextConflictError({ currentMtimeMs, expectedMtimeMs });
+      }
+      const temporary = path.join(path.dirname(target), `.${path.basename(target)}.${randomUUID()}.tmp`);
+      let promoted = false;
+      try {
+        const handle = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 384);
+        try {
+          await handle.writeFile(content, "utf8");
+          await handle.sync();
+        } finally {
+          await handle.close();
+        }
+        await rename(temporary, target);
+        promoted = true;
+        return { mtimeMs: (await stat2(target)).mtimeMs };
+      } finally {
+        if (!promoted) await rm(temporary, { force: true }).catch(() => {
+        });
+      }
+    });
+  }
+  async delete(companyPath) {
+    const { target } = this.resolve(companyPath);
+    await withMutationLock(this.root, async () => {
+      await inspectExistingPath(this.root, target, false);
+      const entry = await lstat(target);
+      if (!entry.isFile()) throw Object.assign(new Error("company context path is not a file"), { code: "EPERM" });
+      await rm(target);
+    });
+  }
+  async mkdir(companyPath, recursive = false) {
+    const { target } = this.resolve(companyPath);
+    await withMutationLock(this.root, async () => {
+      if (!recursive) {
+        await inspectExistingPath(this.root, path.dirname(target), false);
+        await mkdir(target);
+        return;
+      }
+      const relative = path.relative(this.root, target);
+      let current = this.root;
+      for (const segment of relative.split(path.sep).filter(Boolean)) {
+        current = path.join(current, segment);
+        try {
+          const entry = await lstat(current);
+          if (entry.isSymbolicLink() || !entry.isDirectory()) {
+            throw Object.assign(new Error("unsafe company context directory"), { code: "EPERM" });
+          }
+        } catch (error) {
+          if (error.code !== "ENOENT") throw error;
+          await mkdir(current);
+        }
+      }
+    });
+  }
+  async move(fromPath, toPath) {
+    const from = this.resolve(fromPath).target;
+    const to = this.resolve(toPath).target;
+    await withMutationLock(this.root, async () => {
+      await inspectExistingPath(this.root, from, false);
+      await inspectExistingPath(this.root, path.dirname(to), false);
+      try {
+        await inspectExistingPath(this.root, to, false);
+        throw Object.assign(new Error("destination already exists"), { code: "EEXIST" });
+      } catch (error) {
+        if (error.code !== "ENOENT") throw error;
+      }
+      await rename(from, to);
+    });
+  }
+};
+
+// src/server/filesystemBindings.ts
 var COMPANY_CONTEXT_MOUNT_PATH = "/company_context";
 var AGENT_MODE_ENV = "BORING_AGENT_MODE";
 var AGENT_WORKSPACE_ROOT_ENV = "BORING_AGENT_WORKSPACE_ROOT";
@@ -648,7 +952,7 @@ var companyContextBindingFallbackLogger = {
     companyContextBindingCanonicalLogger.error(message, fields);
   }
 };
-function normalizeCompanyPath(value) {
+function normalizeCompanyPath2(value) {
   const normalized = value.replace(/\\/g, "/");
   if (normalized.includes("\0")) throw new Error("invalid company path");
   const withRoot = normalized.startsWith("/") ? normalized : `/${normalized}`;
@@ -657,17 +961,18 @@ function normalizeCompanyPath(value) {
   return `/${parts.join("/")}`;
 }
 async function assertInsideRoot(root, candidate) {
-  const realRoot = await realpath(root);
-  const existing = await realpath(candidate);
-  const rel = path.relative(realRoot, existing);
-  if (rel.startsWith("..") || path.isAbsolute(rel)) throw new Error("path escapes company context root");
+  const realRoot = await realpath2(root);
+  const existing = await realpath2(candidate);
+  const rel = path2.relative(realRoot, existing);
+  if (rel.startsWith("..") || path2.isAbsolute(rel)) throw new Error("path escapes company context root");
 }
 async function walkFiles(root, current = root) {
-  const entries = await readdir(current, { withFileTypes: true });
+  const entries = await readdir2(current, { withFileTypes: true });
   const out = [];
   for (const entry of entries) {
-    const absolutePath = path.join(current, entry.name);
-    const entryStat = await lstat(absolutePath);
+    if (current === root && entry.name === COMPANY_CONTEXT_STATE_DIR) continue;
+    const absolutePath = path2.join(current, entry.name);
+    const entryStat = await lstat2(absolutePath);
     if (entryStat.isSymbolicLink()) continue;
     if (entry.isDirectory()) out.push(...await walkFiles(root, absolutePath));
     else if (entry.isFile()) out.push(absolutePath);
@@ -675,9 +980,9 @@ async function walkFiles(root, current = root) {
   return out;
 }
 async function makeProjectionReadonly(root, current = root) {
-  const entries = await readdir(current, { withFileTypes: true });
+  const entries = await readdir2(current, { withFileTypes: true });
   for (const entry of entries) {
-    const absolutePath = path.join(current, entry.name);
+    const absolutePath = path2.join(current, entry.name);
     if (entry.isDirectory()) await makeProjectionReadonly(root, absolutePath);
     else if (entry.isFile()) await chmod(absolutePath, 256);
   }
@@ -686,9 +991,9 @@ async function makeProjectionReadonly(root, current = root) {
 async function makeProjectionRemovable(current) {
   await chmod(current, 448).catch(() => {
   });
-  const entries = await readdir(current, { withFileTypes: true }).catch(() => []);
+  const entries = await readdir2(current, { withFileTypes: true }).catch(() => []);
   for (const entry of entries) {
-    const absolutePath = path.join(current, entry.name);
+    const absolutePath = path2.join(current, entry.name);
     if (entry.isDirectory()) await makeProjectionRemovable(absolutePath);
     else await chmod(absolutePath, 384).catch(() => {
     });
@@ -730,7 +1035,7 @@ var RegexFilteredCompanyContextProvider = class {
     if (handle.lifecycle) handle.lifecycle.active = false;
     if (handle.projectionRoot) {
       await makeProjectionRemovable(handle.projectionRoot);
-      await rm(handle.projectionRoot, { recursive: true, force: true });
+      await rm2(handle.projectionRoot, { recursive: true, force: true });
     }
   }
   async prepareBinding(_ctx, binding) {
@@ -738,17 +1043,17 @@ var RegexFilteredCompanyContextProvider = class {
     if (binding.access !== "readonly" || binding.projection !== "policy-filtered") {
       throw new Error("company_context policy mount only supports readonly policy-filtered bindings");
     }
-    await access(this.sourceRoot, constants.R_OK);
-    const projectionRoot = await mkdtemp(path.join(this.projectionRootParent, "boring-company-context-"));
+    await access(this.sourceRoot, constants2.R_OK);
+    const projectionRoot = await mkdtemp(path2.join(this.projectionRootParent, "boring-company-context-"));
     try {
       const files = await walkFiles(this.sourceRoot);
       for (const sourceFile of files) {
         await assertInsideRoot(this.sourceRoot, sourceFile);
-        const rel = path.relative(this.sourceRoot, sourceFile).split(path.sep).join("/");
-        const companyPath = normalizeCompanyPath(rel);
+        const rel = path2.relative(this.sourceRoot, sourceFile).split(path2.sep).join("/");
+        const companyPath = normalizeCompanyPath2(rel);
         if (!this.allowedRules.some((rule) => rule.test(companyPath))) continue;
-        const destination = path.join(projectionRoot, ...companyPath.slice(1).split("/"));
-        await mkdir(path.dirname(destination), { recursive: true });
+        const destination = path2.join(projectionRoot, ...companyPath.slice(1).split("/"));
+        await mkdir2(path2.dirname(destination), { recursive: true });
         await copyFile(sourceFile, destination);
       }
       await makeProjectionReadonly(projectionRoot);
@@ -762,7 +1067,7 @@ var RegexFilteredCompanyContextProvider = class {
       };
     } catch (error) {
       await makeProjectionRemovable(projectionRoot);
-      await rm(projectionRoot, { recursive: true, force: true });
+      await rm2(projectionRoot, { recursive: true, force: true });
       throw error;
     }
   }
@@ -779,10 +1084,10 @@ function asRuntimeOperations(ops) {
 }
 function createDefaultCompanyContextRootResolver(env = process.env) {
   const explicitSourceRoot = env[GOVERNANCE_COMPANY_CONTEXT_ROOT_ENV]?.trim();
-  if (explicitSourceRoot) return () => path.resolve(explicitSourceRoot);
+  if (explicitSourceRoot) return () => path2.resolve(explicitSourceRoot);
   if (env[AGENT_MODE_ENV]?.trim() === "vercel-sandbox") return void 0;
   const workspaceStorageRoot = env[AGENT_WORKSPACE_ROOT_ENV]?.trim() || process.cwd();
-  return (_ctx, companyContextWorkspaceId) => path.resolve(workspaceStorageRoot, companyContextWorkspaceId);
+  return (_ctx, companyContextWorkspaceId) => path2.resolve(workspaceStorageRoot, companyContextWorkspaceId);
 }
 function logCompanyContextBindingError(ctx, reason, details = {}) {
   const fields = {
@@ -814,16 +1119,16 @@ async function resolveCompanyContextSourceRoot(ctx, companyContextWorkspaceId, r
     return null;
   }
   try {
-    const sourceRoot = await realpath(path.resolve(candidate));
-    const sourceStat = await stat2(sourceRoot);
+    const sourceRoot = await realpath2(path2.resolve(candidate));
+    const sourceStat = await stat3(sourceRoot);
     if (!sourceStat.isDirectory()) {
       logCompanyContextBindingError(ctx, "source_root_not_directory", { companyContextWorkspaceId, sourceRoot });
       return null;
     }
-    await access(sourceRoot, constants.R_OK);
+    await access(sourceRoot, constants2.R_OK);
     return sourceRoot;
   } catch (error) {
-    logCompanyContextBindingError(ctx, "source_root_unavailable", { companyContextWorkspaceId, sourceRoot: path.resolve(candidate), err: error });
+    logCompanyContextBindingError(ctx, "source_root_unavailable", { companyContextWorkspaceId, sourceRoot: path2.resolve(candidate), err: error });
     return null;
   }
 }
@@ -832,12 +1137,44 @@ function createGovernanceFilesystemBindings(service, options = {}) {
     if (!service.isEnabled()) return void 0;
     const user = userFromContext(ctx);
     if (!user?.id) return [];
-    const rules = service.companyContextRules(user);
+    const policyAccess = service.companyContextAccessForUser(user);
+    const accessMode = policyAccess === "readwrite" && options.allowAdminMutations !== true ? "readonly" : policyAccess;
     const companyContextWorkspaceId = service.companyContextWorkspaceId();
-    if (!companyContextWorkspaceId || rules.length === 0) return [];
+    if (!companyContextWorkspaceId || accessMode === "none") return [];
     if (ctx.workspaceId === companyContextWorkspaceId) return [];
     const sourceRoot = await resolveCompanyContextSourceRoot(ctx, companyContextWorkspaceId, options.resolveCompanyContextRoot);
     if (!sourceRoot) return [];
+    if (accessMode === "readwrite") {
+      const store = await CompanyContextStore.open(sourceRoot);
+      const operations2 = {
+        read: (descriptor) => store.read(descriptor.path),
+        list: (descriptor) => store.list(descriptor.path),
+        find: (descriptor, pattern, opOptions) => store.find(descriptor.path, pattern, opOptions),
+        grep: (descriptor, pattern, opOptions) => store.grep(descriptor.path, pattern, opOptions),
+        stat: async (descriptor) => {
+          const result = await store.stat(descriptor.path);
+          return { isDirectory: result.isDirectory, metadata: { mtimeMs: result.mtimeMs } };
+        },
+        write: (descriptor) => store.write(descriptor.path, descriptor.content, descriptor.expectedMtimeMs),
+        delete: async (descriptor) => {
+          await store.delete(descriptor.path);
+          return {};
+        },
+        move: async (descriptor) => {
+          await store.move(descriptor.from, descriptor.to);
+          return {};
+        },
+        mkdir: async (descriptor) => {
+          await store.mkdir(descriptor.path, descriptor.recursive);
+          return {};
+        },
+        rejectMutation(operation) {
+          throw new Error(`company_context ${operation} operation is unavailable`);
+        }
+      };
+      return [{ filesystem: COMPANY_CONTEXT_FILESYSTEM_ID, access: "readwrite", operations: operations2 }];
+    }
+    const rules = service.companyContextRules(user);
     const projectionRootParent = options.projectionRootParent ?? os.tmpdir();
     const binding = {
       filesystem: COMPANY_CONTEXT_FILESYSTEM_ID,
@@ -885,6 +1222,15 @@ function createGovernanceFilesystemBindings(service, options = {}) {
 async function buildGovernanceService(options = {}) {
   return createGovernanceService(await loadGovernancePolicy(options));
 }
+function defaultAdminMutationsAllowed(options) {
+  if (options.resolveCompanyContextRoot) return false;
+  const companyRoot = process.env.BORING_GOVERNANCE_COMPANY_CONTEXT_ROOT?.trim();
+  if (!companyRoot) return false;
+  const workspaceRoot = path3.resolve(process.env.BORING_AGENT_WORKSPACE_ROOT?.trim() || process.cwd());
+  const resolvedCompanyRoot = path3.resolve(companyRoot);
+  const relative = path3.relative(workspaceRoot, resolvedCompanyRoot);
+  return relative.startsWith("..") || path3.isAbsolute(relative);
+}
 async function createGovernance(config) {
   const service = await buildGovernanceService({ config });
   return {
@@ -894,8 +1240,9 @@ async function createGovernance(config) {
     filterModels: createGovernanceModelFilter(service),
     createMeteringSink: (delegate, getDb) => createGovernanceMeteringSink({ service, delegate, getDb }),
     getFilesystemBindings: (options = {}) => createGovernanceFilesystemBindings(service, {
-      resolveCompanyContextRoot: createDefaultCompanyContextRootResolver(),
-      ...options
+      ...options,
+      resolveCompanyContextRoot: options.resolveCompanyContextRoot ?? createDefaultCompanyContextRootResolver(),
+      allowAdminMutations: options.allowAdminMutations ?? defaultAdminMutationsAllowed(options)
     }),
     pi: { strictModelResolution: service.isEnabled() }
   };
@@ -909,6 +1256,8 @@ function createGovernanceModelFilter(service) {
     const user = governanceUserFromRequest(request);
     if (!service.isEnabled()) return { models, defaultModel };
     if (!user) return { models: [] };
+    const aggregateBudgetMicros = service.userMonthlyBudgetMicros(user);
+    if (aggregateBudgetMicros !== null && aggregateBudgetMicros <= 0) return { models: [], defaultModel: void 0 };
     const allowedModels = service.allowedModelsForUser(user, models).filter((model) => (service.monthlyBudgetMicros(user, model) ?? 0) > 0);
     const allowedDefault = defaultModel && allowedModels.some((model) => model.available && model.provider === defaultModel.provider && model.id === defaultModel.id) ? defaultModel : void 0;
     return { models: allowedModels, defaultModel: allowedDefault };