@hachej/boring-workspace 0.1.82 → 0.1.84

package/dist/app-front.js

@@ -1,6 +1,6 @@
-import { B as e, C as t, E as n, F as r, G as i, H as a, I as o, Kt as s, L as c, Lt as l, M as u, N as d, P as f, Q as p, R as m, Rt as h, S as g, Sn as _, T as ee, V as v, an as te, c as ne, cn as re, g as ie, hn as ae, j as oe, kt as se, m as ce, mn as le, n as ue, on as de, r as fe, x as pe, xn as me, z as he } from "./WorkspaceProvider-DH-yiJZ8.js";
+import { B as e, C as t, E as n, F as r, G as i, H as a, I as o, Kt as s, L as c, Lt as l, M as u, N as d, P as f, Q as p, R as m, Rt as h, S as g, Sn as _, T as ee, V as v, an as te, c as ne, cn as re, g as ie, hn as ae, j as oe, kt as se, m as ce, mn as le, n as ue, on as de, r as fe, x as pe, xn as me, z as he } from "./WorkspaceProvider-C8rWNm72.js";
 import { t as y } from "./utils-BRcxFdrz.js";
-import { a as ge, c as _e, f as ve, l as ye, n as be, o as xe, r as Se, s as Ce, t as we, u as Te } from "./WorkspaceLoadingState-D_b8t-6U.js";
+import { a as ge, c as _e, f as ve, l as ye, n as be, o as xe, r as Se, s as Ce, t as we, u as Te } from "./WorkspaceLoadingState-BkAUFt_A.js";
 import { createElement as Ee, useCallback as b, useEffect as x, useLayoutEffect as De, useMemo as S, useRef as C, useState as w, useSyncExternalStore as Oe } from "react";
 import { Fragment as T, jsx as E, jsxs as D } from "react/jsx-runtime";
 import { ChevronRight as ke, Clock3 as Ae, ExternalLink as je, FileText as Me, Maximize2 as Ne, MessageSquare as Pe, MessageSquarePlus as O, Moon as Fe, MoreHorizontal as Ie, PanelLeftClose as Le, PanelLeftOpen as Re, Pin as ze, PinOff as Be, Plug as Ve, Plus as He, RefreshCw as Ue, Search as We, Settings as Ge, Sparkles as Ke, Sun as qe, X as Je } from "lucide-react";

package/dist/app-server.js

@@ -3330,20 +3330,28 @@ function mintWorkspaceBridgeRuntimeRefreshToken(options) {
   });
 }
 function verifyWorkspaceBridgeRuntimeToken(token, options) {
+  return authorizeWorkspaceBridgeRuntimeToken(
+    verifyWorkspaceBridgeRuntimeTokenClaims(token, options),
+    options.requiredCapabilities
+  );
+}
+function verifyWorkspaceBridgeRuntimeTokenClaims(token, options) {
   assertUsableSecret(options.secret);
   const claims = parseAndVerifyToken(token, options.secret);
   const now = Math.floor((options.nowMs ?? Date.now()) / 1e3);
   ensureLiveTokenClaims(claims, now, WORKSPACE_BRIDGE_TOKEN_AUDIENCE, "Runtime bridge token");
-  const missingCapability = (options.requiredCapabilities ?? []).find(
-    (capability) => !claims.capabilities.includes(capability)
+  return { claims };
+}
+function authorizeWorkspaceBridgeRuntimeToken(verified, requiredCapabilities = []) {
+  const missingCapability = requiredCapabilities.find(
+    (capability) => !verified.claims.capabilities.includes(capability)
   );
   if (missingCapability) {
     throw bridgeTokenError("BRIDGE_CAPABILITY_DENIED" /* CapabilityDenied */, "Runtime bridge token is missing a required capability");
   }
-  const runtimeClaims = claims;
   return {
-    claims: runtimeClaims,
-    authContext: runtimeClaimsToBridgeAuthContext(runtimeClaims)
+    claims: verified.claims,
+    authContext: runtimeClaimsToBridgeAuthContext(verified.claims)
   };
 }
 function verifyWorkspaceBridgeRuntimeRefreshToken(token, options) {
@@ -3565,21 +3573,42 @@ function workspaceBridgeHttpRoutes(app, opts, done) {
       return sendBridgeError(reply, 400, void 0, "BRIDGE_SCHEMA_INVALID" /* SchemaInvalid */, "WorkspaceBridge request body is invalid");
     }
     const body = { ...parsed.data, input: parsed.data.input ?? {} };
+    const authHeader = firstHeader(request.headers.authorization);
+    const runtimeToken = authHeader?.startsWith("Bearer ") ? authHeader.slice("Bearer ".length) : void 0;
+    let verifiedRuntimeToken;
+    if (runtimeToken !== void 0 && opts.assertRuntimeWorkspaceScope) {
+      try {
+        verifiedRuntimeToken = resolveRuntimeClaims(runtimeToken, opts);
+      } catch (err) {
+        const bridgeError = isBridgeError(err) ? err : createWorkspaceBridgeError("BRIDGE_HANDLER_FAILED" /* HandlerFailed */, "WorkspaceBridge transport failed");
+        return sendBridgeError(reply, statusForBridgeError(bridgeError.code), body.requestId, bridgeError.code, bridgeError.message);
+      }
+      await opts.assertRuntimeWorkspaceScope(request, verifiedRuntimeToken.claims);
+    }
+    let authorized;
     try {
       const registry = await resolveRegistry(request, body, opts);
       const definition = registry.getDefinition(body.op);
       if (!definition) {
         return sendBridgeError(reply, statusForBridgeError("BRIDGE_OP_NOT_FOUND" /* OpNotFound */), body.requestId, "BRIDGE_OP_NOT_FOUND" /* OpNotFound */, "WorkspaceBridge operation is not registered");
       }
-      const authHeader = firstHeader(request.headers.authorization);
-      const authContext = authHeader?.startsWith("Bearer ") ? resolveRuntimeContext(authHeader.slice("Bearer ".length), opts, definition) : await resolveBrowserContext(request, opts, definition, body);
+      const authContext = runtimeToken !== void 0 ? resolveRuntimeContext(runtimeToken, opts, definition, verifiedRuntimeToken) : await resolveBrowserContext(request, opts, definition, body);
+      authorized = { registry, definition, authContext };
+    } catch (err) {
+      const bridgeError = isBridgeError(err) ? err : createWorkspaceBridgeError("BRIDGE_HANDLER_FAILED" /* HandlerFailed */, "WorkspaceBridge transport failed");
+      return sendBridgeError(reply, statusForBridgeError(bridgeError.code), body.requestId, bridgeError.code, bridgeError.message);
+    }
+    if (runtimeToken !== void 0 && opts.admitRuntimeOperation) {
+      await opts.admitRuntimeOperation(authorized.authContext.workspaceId);
+    }
+    try {
       const idempotencyStore = opts.getIdempotencyStore ? await opts.getIdempotencyStore(request, body) : opts.idempotencyStore;
-      const expectedWorkspaceId = opts.getOwnerWorkspaceId ? await opts.getOwnerWorkspaceId(request, body, authContext) : opts.ownerWorkspaceId;
+      const expectedWorkspaceId = opts.getOwnerWorkspaceId ? await opts.getOwnerWorkspaceId(request, body, authorized.authContext) : opts.ownerWorkspaceId;
       const response = await runWithWorkspaceBridgeIdempotency(idempotencyStore, {
-        definition,
+        definition: authorized.definition,
         request: body,
-        auth: authContext
-      }, async () => await registry.call(body, authContext, { expectedWorkspaceId }));
+        auth: authorized.authContext
+      }, async () => await authorized.registry.call(body, authorized.authContext, { expectedWorkspaceId }));
       return await sendResponse(reply, response);
     } catch (err) {
       const bridgeError = isBridgeError(err) ? err : createWorkspaceBridgeError("BRIDGE_HANDLER_FAILED" /* HandlerFailed */, "WorkspaceBridge transport failed");
@@ -3595,12 +3624,21 @@ function workspaceBridgeHttpRoutes(app, opts, done) {
     if (!opts.runtimeTokenSecret || !opts.runtimeRefreshTokenSecret) {
       return sendBridgeError(reply, 401, void 0, "BRIDGE_AUTH_REQUIRED" /* AuthRequired */, "WorkspaceBridge token refresh is not configured");
     }
+    const nowMs = Date.now();
+    let verified;
     try {
-      const nowMs = Date.now();
-      const verified = verifyWorkspaceBridgeRuntimeRefreshToken(authHeader.slice("Bearer ".length), {
+      verified = verifyWorkspaceBridgeRuntimeRefreshToken(authHeader.slice("Bearer ".length), {
         secret: opts.runtimeRefreshTokenSecret,
         nowMs
       });
+    } catch (err) {
+      const bridgeError = isBridgeError(err) ? err : createWorkspaceBridgeError("BRIDGE_INVALID_TOKEN" /* InvalidToken */, "WorkspaceBridge refresh token is invalid");
+      return sendBridgeError(reply, statusForBridgeError(bridgeError.code), void 0, bridgeError.code, bridgeError.message);
+    }
+    if (opts.assertRuntimeWorkspaceScope) {
+      await opts.assertRuntimeWorkspaceScope(request, verified.claims);
+    }
+    try {
       const store = opts.getRuntimeRefreshTokenStore ? await opts.getRuntimeRefreshTokenStore(request, verified.claims) ?? defaultRefreshTokenStore : defaultRefreshTokenStore;
       const refreshUse = await store.recordUse({
         jti: verified.claims.jti,
@@ -3643,14 +3681,29 @@ async function resolveRegistry(request, body, opts) {
   }
   return registry;
 }
-function resolveRuntimeContext(token, opts, definition) {
+function resolveRuntimeContext(token, opts, definition, verified) {
+  let authorized;
+  if (verified) {
+    authorized = authorizeWorkspaceBridgeRuntimeToken(verified, definition.requiredCapabilities);
+  } else {
+    if (!opts.runtimeTokenSecret) {
+      throw createWorkspaceBridgeError("BRIDGE_AUTH_REQUIRED" /* AuthRequired */, "Runtime bridge token auth is not configured");
+    }
+    authorized = verifyWorkspaceBridgeRuntimeToken(token, {
+      secret: opts.runtimeTokenSecret,
+      requiredCapabilities: definition.requiredCapabilities
+    });
+  }
+  if (opts.admitRuntimeOperation && !definition.callerClassesAllowed.includes("runtime")) {
+    throw createWorkspaceBridgeError("BRIDGE_CALLER_NOT_ALLOWED" /* CallerNotAllowed */, "Caller class is not allowed for operation");
+  }
+  return authorized.authContext;
+}
+function resolveRuntimeClaims(token, opts) {
   if (!opts.runtimeTokenSecret) {
     throw createWorkspaceBridgeError("BRIDGE_AUTH_REQUIRED" /* AuthRequired */, "Runtime bridge token auth is not configured");
   }
-  return verifyWorkspaceBridgeRuntimeToken(token, {
-    secret: opts.runtimeTokenSecret,
-    requiredCapabilities: definition.requiredCapabilities
-  }).authContext;
+  return verifyWorkspaceBridgeRuntimeTokenClaims(token, { secret: opts.runtimeTokenSecret });
 }
 async function resolveBrowserContext(request, opts, definition, body) {
   if (!opts.browserAuthPolicy) {

package/dist/server.d.ts

@@ -232,6 +232,7 @@ interface VerifyWorkspaceBridgeRuntimeTokenOptions {
     nowMs?: number;
     requiredCapabilities?: readonly string[];
 }
+type VerifyWorkspaceBridgeRuntimeTokenClaimsOptions = Omit<VerifyWorkspaceBridgeRuntimeTokenOptions, "requiredCapabilities">;
 interface VerifyWorkspaceBridgeRuntimeRefreshTokenOptions {
     secret: string;
     nowMs?: number;
@@ -240,12 +241,17 @@ interface VerifiedWorkspaceBridgeRuntimeToken {
     claims: WorkspaceBridgeRuntimeTokenClaims;
     authContext: BridgeAuthContext;
 }
+interface VerifiedWorkspaceBridgeRuntimeTokenClaims {
+    claims: WorkspaceBridgeRuntimeTokenClaims;
+}
 interface VerifiedWorkspaceBridgeRuntimeRefreshToken {
     claims: WorkspaceBridgeRuntimeRefreshTokenClaims;
 }
 declare function mintWorkspaceBridgeRuntimeToken(options: MintWorkspaceBridgeRuntimeTokenOptions): string;
 declare function mintWorkspaceBridgeRuntimeRefreshToken(options: MintWorkspaceBridgeRuntimeRefreshTokenOptions): string;
 declare function verifyWorkspaceBridgeRuntimeToken(token: string, options: VerifyWorkspaceBridgeRuntimeTokenOptions): VerifiedWorkspaceBridgeRuntimeToken;
+declare function verifyWorkspaceBridgeRuntimeTokenClaims(token: string, options: VerifyWorkspaceBridgeRuntimeTokenClaimsOptions): VerifiedWorkspaceBridgeRuntimeTokenClaims;
+declare function authorizeWorkspaceBridgeRuntimeToken(verified: VerifiedWorkspaceBridgeRuntimeTokenClaims, requiredCapabilities?: readonly string[]): VerifiedWorkspaceBridgeRuntimeToken;
 declare function verifyWorkspaceBridgeRuntimeRefreshToken(token: string, options: VerifyWorkspaceBridgeRuntimeRefreshTokenOptions): VerifiedWorkspaceBridgeRuntimeRefreshToken;
 declare function clampWorkspaceBridgeRuntimeTokenTtlMs(ttlMs: number | undefined): number | undefined;
 declare function runtimeClaimsToBridgeAuthContext(claims: WorkspaceBridgeRuntimeTokenClaims): BridgeAuthContext;
@@ -289,6 +295,8 @@ interface WorkspaceBridgeHttpRoutesOptions {
     runtimeRefreshTokenSecret?: string;
     runtimeRefreshTokenStore?: WorkspaceBridgeRuntimeRefreshTokenStore;
     getRuntimeRefreshTokenStore?: (request: FastifyRequest, claims: WorkspaceBridgeRuntimeRefreshTokenClaims) => WorkspaceBridgeRuntimeRefreshTokenStore | undefined | Promise<WorkspaceBridgeRuntimeRefreshTokenStore | undefined>;
+    assertRuntimeWorkspaceScope?: (request: FastifyRequest, claims: WorkspaceBridgeRuntimeTokenClaims | WorkspaceBridgeRuntimeRefreshTokenClaims) => void | Promise<void>;
+    admitRuntimeOperation?: (workspaceId: string) => void | Promise<void>;
     refreshTokenRateLimit?: {
         maxUses?: number;
         windowMs?: number;
@@ -622,4 +630,4 @@ interface RuntimeBackendGatewayOptions {
 }
 declare function runtimeBackendGateway(app: FastifyInstance, opts: RuntimeBackendGatewayOptions): Promise<void>;
 
-export { type BeginIdempotencyOptions, BoringPluginAssetManager, BoringPluginEvent, BoringPluginFrontTarget, BoringPluginFrontTargetResolver, BoringPluginListEntry, type BoringPluginScanResult, BoringPluginSource, BoringPluginSourceInput, BoringServerPluginManifest, BridgeAuthContext, BridgeAuthPolicy, BridgeCallerClass, BridgeIdempotencyPolicy, type CompleteIdempotencyOptions, DEFAULT_WORKSPACE_BRIDGE_RUNTIME_REFRESH_TOKEN_TTL_MS, DEFAULT_WORKSPACE_BRIDGE_RUNTIME_TOKEN_TTL_MS, type IdempotencyBeginResult, type IdempotencyRecordStatus, InMemoryWorkspaceBridgeIdempotencyStore, InMemoryWorkspaceBridgeRuntimeRefreshTokenStore, MAX_WORKSPACE_BRIDGE_RUNTIME_TOKEN_TTL_MS, type MintWorkspaceBridgeRuntimeRefreshTokenOptions, type MintWorkspaceBridgeRuntimeTokenOptions, type PluginRestartWarning, type RuntimeBackendDiagnostic, type RuntimeBackendDispatchRequest, type RuntimeBackendDispatchResponse, type RuntimeBackendDispatcher, RuntimeBackendError, type RuntimeBackendGatewayOptions, RuntimeBackendRegistry, type RuntimeBackendReloadResult, type TrustedDomainBridgeHandlerOptions, type TrustedDomainBridgeHandlerPolicy, type TrustedDomainBridgeHandlerRegistration, UiBridge, type UiRoutesOptions, type VerifiedWorkspaceBridgeRuntimeRefreshToken, type VerifiedWorkspaceBridgeRuntimeToken, type VerifyWorkspaceBridgeRuntimeRefreshTokenOptions, type VerifyWorkspaceBridgeRuntimeTokenOptions, WORKSPACE_BRIDGE_REFRESH_TOKEN_AUDIENCE, WORKSPACE_BRIDGE_TOKEN_AUDIENCE, WorkspaceBridge, WorkspaceBridgeCallRequest, WorkspaceBridgeCallResponse, WorkspaceBridgeError, WorkspaceBridgeHandler, type WorkspaceBridgeHttpRoutesOptions, type WorkspaceBridgeIdempotencyRecord, type WorkspaceBridgeIdempotencyStore, WorkspaceBridgeOperationDefinition, WorkspaceBridgeRegistry, type WorkspaceBridgeRuntimeCore, type WorkspaceBridgeRuntimeCoreOptions, type WorkspaceBridgeRuntimeRefreshTokenClaims, type WorkspaceBridgeRuntimeRefreshTokenStore, type WorkspaceBridgeRuntimeRefreshTokenUseOptions, type WorkspaceBridgeRuntimeRefreshTokenUseResult, type WorkspaceBridgeRuntimeTokenClaims, WorkspaceServerPluginAsset, aggregatePluginPrompts, boringPluginRoutes, buildBoringSystemPrompt, clampWorkspaceBridgeRuntimeTokenTtlMs, collectRestartWarnings, createExecUiTool, createGetUiStateTool, createWorkspaceBridgeRuntimeCore, createWorkspaceUiTools, definePluginAsset, defineTrustedDomainBridgeHandler, hashNormalizedInput, mintWorkspaceBridgeRuntimeRefreshToken, mintWorkspaceBridgeRuntimeToken, pluginFileSignature, preflightBoringPlugins, readBoringPlugins, readPluginSignatureCache, resolvePluginAssetPath, runWithWorkspaceBridgeIdempotency, runtimeBackendGateway, runtimeClaimsToBridgeAuthContext, scanBoringPlugins, stableStringify, uiRoutes, verifyWorkspaceBridgeRuntimeRefreshToken, verifyWorkspaceBridgeRuntimeToken, workspaceBridgeHttpRoutes, writePluginSignatureCache };
+export { type BeginIdempotencyOptions, BoringPluginAssetManager, BoringPluginEvent, BoringPluginFrontTarget, BoringPluginFrontTargetResolver, BoringPluginListEntry, type BoringPluginScanResult, BoringPluginSource, BoringPluginSourceInput, BoringServerPluginManifest, BridgeAuthContext, BridgeAuthPolicy, BridgeCallerClass, BridgeIdempotencyPolicy, type CompleteIdempotencyOptions, DEFAULT_WORKSPACE_BRIDGE_RUNTIME_REFRESH_TOKEN_TTL_MS, DEFAULT_WORKSPACE_BRIDGE_RUNTIME_TOKEN_TTL_MS, type IdempotencyBeginResult, type IdempotencyRecordStatus, InMemoryWorkspaceBridgeIdempotencyStore, InMemoryWorkspaceBridgeRuntimeRefreshTokenStore, MAX_WORKSPACE_BRIDGE_RUNTIME_TOKEN_TTL_MS, type MintWorkspaceBridgeRuntimeRefreshTokenOptions, type MintWorkspaceBridgeRuntimeTokenOptions, type PluginRestartWarning, type RuntimeBackendDiagnostic, type RuntimeBackendDispatchRequest, type RuntimeBackendDispatchResponse, type RuntimeBackendDispatcher, RuntimeBackendError, type RuntimeBackendGatewayOptions, RuntimeBackendRegistry, type RuntimeBackendReloadResult, type TrustedDomainBridgeHandlerOptions, type TrustedDomainBridgeHandlerPolicy, type TrustedDomainBridgeHandlerRegistration, UiBridge, type UiRoutesOptions, type VerifiedWorkspaceBridgeRuntimeRefreshToken, type VerifiedWorkspaceBridgeRuntimeToken, type VerifiedWorkspaceBridgeRuntimeTokenClaims, type VerifyWorkspaceBridgeRuntimeRefreshTokenOptions, type VerifyWorkspaceBridgeRuntimeTokenClaimsOptions, type VerifyWorkspaceBridgeRuntimeTokenOptions, WORKSPACE_BRIDGE_REFRESH_TOKEN_AUDIENCE, WORKSPACE_BRIDGE_TOKEN_AUDIENCE, WorkspaceBridge, WorkspaceBridgeCallRequest, WorkspaceBridgeCallResponse, WorkspaceBridgeError, WorkspaceBridgeHandler, type WorkspaceBridgeHttpRoutesOptions, type WorkspaceBridgeIdempotencyRecord, type WorkspaceBridgeIdempotencyStore, WorkspaceBridgeOperationDefinition, WorkspaceBridgeRegistry, type WorkspaceBridgeRuntimeCore, type WorkspaceBridgeRuntimeCoreOptions, type WorkspaceBridgeRuntimeRefreshTokenClaims, type WorkspaceBridgeRuntimeRefreshTokenStore, type WorkspaceBridgeRuntimeRefreshTokenUseOptions, type WorkspaceBridgeRuntimeRefreshTokenUseResult, type WorkspaceBridgeRuntimeTokenClaims, WorkspaceServerPluginAsset, aggregatePluginPrompts, authorizeWorkspaceBridgeRuntimeToken, boringPluginRoutes, buildBoringSystemPrompt, clampWorkspaceBridgeRuntimeTokenTtlMs, collectRestartWarnings, createExecUiTool, createGetUiStateTool, createWorkspaceBridgeRuntimeCore, createWorkspaceUiTools, definePluginAsset, defineTrustedDomainBridgeHandler, hashNormalizedInput, mintWorkspaceBridgeRuntimeRefreshToken, mintWorkspaceBridgeRuntimeToken, pluginFileSignature, preflightBoringPlugins, readBoringPlugins, readPluginSignatureCache, resolvePluginAssetPath, runWithWorkspaceBridgeIdempotency, runtimeBackendGateway, runtimeClaimsToBridgeAuthContext, scanBoringPlugins, stableStringify, uiRoutes, verifyWorkspaceBridgeRuntimeRefreshToken, verifyWorkspaceBridgeRuntimeToken, verifyWorkspaceBridgeRuntimeTokenClaims, workspaceBridgeHttpRoutes, writePluginSignatureCache };

package/dist/server.js

@@ -1409,20 +1409,28 @@ function mintWorkspaceBridgeRuntimeRefreshToken(options) {
   });
 }
 function verifyWorkspaceBridgeRuntimeToken(token, options) {
+  return authorizeWorkspaceBridgeRuntimeToken(
+    verifyWorkspaceBridgeRuntimeTokenClaims(token, options),
+    options.requiredCapabilities
+  );
+}
+function verifyWorkspaceBridgeRuntimeTokenClaims(token, options) {
   assertUsableSecret(options.secret);
   const claims = parseAndVerifyToken(token, options.secret);
   const now = Math.floor((options.nowMs ?? Date.now()) / 1e3);
   ensureLiveTokenClaims(claims, now, WORKSPACE_BRIDGE_TOKEN_AUDIENCE, "Runtime bridge token");
-  const missingCapability = (options.requiredCapabilities ?? []).find(
-    (capability) => !claims.capabilities.includes(capability)
+  return { claims };
+}
+function authorizeWorkspaceBridgeRuntimeToken(verified, requiredCapabilities = []) {
+  const missingCapability = requiredCapabilities.find(
+    (capability) => !verified.claims.capabilities.includes(capability)
   );
   if (missingCapability) {
     throw bridgeTokenError("BRIDGE_CAPABILITY_DENIED" /* CapabilityDenied */, "Runtime bridge token is missing a required capability");
   }
-  const runtimeClaims = claims;
   return {
-    claims: runtimeClaims,
-    authContext: runtimeClaimsToBridgeAuthContext(runtimeClaims)
+    claims: verified.claims,
+    authContext: runtimeClaimsToBridgeAuthContext(verified.claims)
   };
 }
 function verifyWorkspaceBridgeRuntimeRefreshToken(token, options) {
@@ -1644,21 +1652,42 @@ function workspaceBridgeHttpRoutes(app, opts, done) {
       return sendBridgeError(reply, 400, void 0, "BRIDGE_SCHEMA_INVALID" /* SchemaInvalid */, "WorkspaceBridge request body is invalid");
     }
     const body = { ...parsed.data, input: parsed.data.input ?? {} };
+    const authHeader = firstHeader2(request.headers.authorization);
+    const runtimeToken = authHeader?.startsWith("Bearer ") ? authHeader.slice("Bearer ".length) : void 0;
+    let verifiedRuntimeToken;
+    if (runtimeToken !== void 0 && opts.assertRuntimeWorkspaceScope) {
+      try {
+        verifiedRuntimeToken = resolveRuntimeClaims(runtimeToken, opts);
+      } catch (err) {
+        const bridgeError = isBridgeError(err) ? err : createWorkspaceBridgeError("BRIDGE_HANDLER_FAILED" /* HandlerFailed */, "WorkspaceBridge transport failed");
+        return sendBridgeError(reply, statusForBridgeError(bridgeError.code), body.requestId, bridgeError.code, bridgeError.message);
+      }
+      await opts.assertRuntimeWorkspaceScope(request, verifiedRuntimeToken.claims);
+    }
+    let authorized;
     try {
       const registry = await resolveRegistry(request, body, opts);
       const definition = registry.getDefinition(body.op);
       if (!definition) {
         return sendBridgeError(reply, statusForBridgeError("BRIDGE_OP_NOT_FOUND" /* OpNotFound */), body.requestId, "BRIDGE_OP_NOT_FOUND" /* OpNotFound */, "WorkspaceBridge operation is not registered");
       }
-      const authHeader = firstHeader2(request.headers.authorization);
-      const authContext = authHeader?.startsWith("Bearer ") ? resolveRuntimeContext(authHeader.slice("Bearer ".length), opts, definition) : await resolveBrowserContext(request, opts, definition, body);
+      const authContext = runtimeToken !== void 0 ? resolveRuntimeContext(runtimeToken, opts, definition, verifiedRuntimeToken) : await resolveBrowserContext(request, opts, definition, body);
+      authorized = { registry, definition, authContext };
+    } catch (err) {
+      const bridgeError = isBridgeError(err) ? err : createWorkspaceBridgeError("BRIDGE_HANDLER_FAILED" /* HandlerFailed */, "WorkspaceBridge transport failed");
+      return sendBridgeError(reply, statusForBridgeError(bridgeError.code), body.requestId, bridgeError.code, bridgeError.message);
+    }
+    if (runtimeToken !== void 0 && opts.admitRuntimeOperation) {
+      await opts.admitRuntimeOperation(authorized.authContext.workspaceId);
+    }
+    try {
       const idempotencyStore = opts.getIdempotencyStore ? await opts.getIdempotencyStore(request, body) : opts.idempotencyStore;
-      const expectedWorkspaceId = opts.getOwnerWorkspaceId ? await opts.getOwnerWorkspaceId(request, body, authContext) : opts.ownerWorkspaceId;
+      const expectedWorkspaceId = opts.getOwnerWorkspaceId ? await opts.getOwnerWorkspaceId(request, body, authorized.authContext) : opts.ownerWorkspaceId;
       const response = await runWithWorkspaceBridgeIdempotency(idempotencyStore, {
-        definition,
+        definition: authorized.definition,
         request: body,
-        auth: authContext
-      }, async () => await registry.call(body, authContext, { expectedWorkspaceId }));
+        auth: authorized.authContext
+      }, async () => await authorized.registry.call(body, authorized.authContext, { expectedWorkspaceId }));
       return await sendResponse(reply, response);
     } catch (err) {
       const bridgeError = isBridgeError(err) ? err : createWorkspaceBridgeError("BRIDGE_HANDLER_FAILED" /* HandlerFailed */, "WorkspaceBridge transport failed");
@@ -1674,12 +1703,21 @@ function workspaceBridgeHttpRoutes(app, opts, done) {
     if (!opts.runtimeTokenSecret || !opts.runtimeRefreshTokenSecret) {
       return sendBridgeError(reply, 401, void 0, "BRIDGE_AUTH_REQUIRED" /* AuthRequired */, "WorkspaceBridge token refresh is not configured");
     }
+    const nowMs = Date.now();
+    let verified;
     try {
-      const nowMs = Date.now();
-      const verified = verifyWorkspaceBridgeRuntimeRefreshToken(authHeader.slice("Bearer ".length), {
+      verified = verifyWorkspaceBridgeRuntimeRefreshToken(authHeader.slice("Bearer ".length), {
         secret: opts.runtimeRefreshTokenSecret,
         nowMs
       });
+    } catch (err) {
+      const bridgeError = isBridgeError(err) ? err : createWorkspaceBridgeError("BRIDGE_INVALID_TOKEN" /* InvalidToken */, "WorkspaceBridge refresh token is invalid");
+      return sendBridgeError(reply, statusForBridgeError(bridgeError.code), void 0, bridgeError.code, bridgeError.message);
+    }
+    if (opts.assertRuntimeWorkspaceScope) {
+      await opts.assertRuntimeWorkspaceScope(request, verified.claims);
+    }
+    try {
       const store = opts.getRuntimeRefreshTokenStore ? await opts.getRuntimeRefreshTokenStore(request, verified.claims) ?? defaultRefreshTokenStore : defaultRefreshTokenStore;
       const refreshUse = await store.recordUse({
         jti: verified.claims.jti,
@@ -1722,14 +1760,29 @@ async function resolveRegistry(request, body, opts) {
   }
   return registry;
 }
-function resolveRuntimeContext(token, opts, definition) {
+function resolveRuntimeContext(token, opts, definition, verified) {
+  let authorized;
+  if (verified) {
+    authorized = authorizeWorkspaceBridgeRuntimeToken(verified, definition.requiredCapabilities);
+  } else {
+    if (!opts.runtimeTokenSecret) {
+      throw createWorkspaceBridgeError("BRIDGE_AUTH_REQUIRED" /* AuthRequired */, "Runtime bridge token auth is not configured");
+    }
+    authorized = verifyWorkspaceBridgeRuntimeToken(token, {
+      secret: opts.runtimeTokenSecret,
+      requiredCapabilities: definition.requiredCapabilities
+    });
+  }
+  if (opts.admitRuntimeOperation && !definition.callerClassesAllowed.includes("runtime")) {
+    throw createWorkspaceBridgeError("BRIDGE_CALLER_NOT_ALLOWED" /* CallerNotAllowed */, "Caller class is not allowed for operation");
+  }
+  return authorized.authContext;
+}
+function resolveRuntimeClaims(token, opts) {
   if (!opts.runtimeTokenSecret) {
     throw createWorkspaceBridgeError("BRIDGE_AUTH_REQUIRED" /* AuthRequired */, "Runtime bridge token auth is not configured");
   }
-  return verifyWorkspaceBridgeRuntimeToken(token, {
-    secret: opts.runtimeTokenSecret,
-    requiredCapabilities: definition.requiredCapabilities
-  }).authContext;
+  return verifyWorkspaceBridgeRuntimeTokenClaims(token, { secret: opts.runtimeTokenSecret });
 }
 async function resolveBrowserContext(request, opts, definition, body) {
   if (!opts.browserAuthPolicy) {
@@ -3800,6 +3853,7 @@ export {
   WorkspaceBridgeErrorCode,
   WorkspaceBridgeRegistry,
   aggregatePluginPrompts,
+  authorizeWorkspaceBridgeRuntimeToken,
   bootstrapServer,
   boringPluginRoutes,
   buildBoringSystemPrompt,
@@ -3840,6 +3894,7 @@ export {
   validateWorkspaceBridgeOperationDefinition,
   verifyWorkspaceBridgeRuntimeRefreshToken,
   verifyWorkspaceBridgeRuntimeToken,
+  verifyWorkspaceBridgeRuntimeTokenClaims,
   workspaceBridgeHttpRoutes,
   writePluginSignatureCache
 };

package/dist/src/plugins/filesystemPlugin/front/file-tree/FileTreeView.d.ts

@@ -3,6 +3,7 @@ import { FileTreeBridge } from '../../../../front/bridge/types';
 import { FilesystemId } from '../../../../shared/types/filesystem';
 import { PaneProps } from '../../../../shared/types/panel';
 import { LeftTabParams } from '../../../../shared/plugins/types';
+import { ForwardRefExoticComponent, RefAttributes } from 'react';
 export { copyToClipboard } from './clipboard';
 export declare function preloadFileTreeComponent(): void;
 declare function clampContextMenuPosition(x: number, y: number, menuRect: Pick<DOMRect, "width" | "height">, viewportWidth: number, viewportHeight: number): {
@@ -30,6 +31,14 @@ export interface FileTreeViewProps {
     /** Forwarded to the inner <FileTree>. */
     className?: string;
 }
+/** Imperative handle for hosts (e.g. `FileTreePane`'s refresh button) that need
+ * to force a re-sync of this root's listing on demand, outside the normal
+ * mutation/event-driven refresh paths. */
+export interface FileTreeViewHandle {
+    /** Re-fetch this root's top-level listing plus every currently-expanded
+     * subfolder. Resolves once all of it has settled. */
+    refetch: () => Promise<void>;
+}
 /**
  * File tree with the full workbench actions: tracks container height,
  * routes selects through `bridge.openFile`, and provides a right-click
@@ -41,7 +50,7 @@ export interface FileTreeViewProps {
  * want a "Files" panel; `WorkbenchLeftPane` uses this primitive directly to
  * share its search input with the Data tab.
  */
-export declare function FileTreeView({ rootDir, searchQuery, bridge, revealFileTreeRequest, filesystem, access, ignoreNames, className, }: FileTreeViewProps): import("react").JSX.Element;
+export declare const FileTreeView: ForwardRefExoticComponent<FileTreeViewProps & RefAttributes<FileTreeViewHandle>>;
 export { clampContextMenuPosition };
 export interface FileTreeRootConfig {
     filesystem: FilesystemId;

package/dist/src/plugins/filesystemPlugin/front/file-tree/__tests__/treeModel.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/plugins/filesystemPlugin/front/file-tree/treeModel.d.ts

@@ -3,6 +3,18 @@ import { FileTreeNode } from './FileTree';
 export declare function buildTree(entries: FileEntry[], childrenByDir: Map<string, FileEntry[]>): FileTreeNode[];
 export declare function parentDir(path: string): string;
 export declare function dirKey(dir: string): string;
+/**
+ * Join a directory and a leaf name into a path, the same way every path in
+ * this module is shaped: no leading "./", no doubled or trailing slashes.
+ * `dir` is normally "." (root) or a bare relative path like "src/lib" — but
+ * some hosts configure a filesystem root as "/" (see company_context in
+ * `FileTreeRootConfig`), and naively doing `${dir}/${name}` there produced
+ * "//name": a path string that doesn't match what the server round-trips
+ * back, so the optimistic entry and the server-confirmed entry never
+ * deduped by path and the row rendered twice. Stripping trailing slashes
+ * from `dir` first keeps every root shape converging on the same string.
+ */
+export declare function joinPath(dir: string, name: string): string;
 export declare function mergeEntries(base: FileEntry[] | undefined, optimistic: FileEntry[] | undefined): FileEntry[] | undefined;
 export type DraftEditing = {
     kind: 'create-file';

package/dist/testing.js

@@ -1,5 +1,5 @@
 import { r as e, t } from "./rolldown-runtime-Dqa2HsxW.js";
-import { Mt as n, jt as r, n as i, p as a } from "./WorkspaceProvider-DH-yiJZ8.js";
+import { Mt as n, jt as r, n as i, p as a } from "./WorkspaceProvider-C8rWNm72.js";
 import { bootClean as o, openPaneViaBridge as s, openWorkbench as c } from "./testing-e2e.js";
 import * as l from "react";
 import { cloneElement as u, createElement as d, isValidElement as f, useLayoutEffect as p, useMemo as m, useSyncExternalStore as h } from "react";

package/dist/workspace.css

@@ -6028,7 +6028,6 @@
     --tracking-widest: 0.1em;
     --leading-snug: 1.375;
     --radius-xs: 0.125rem;
-    --ease-out: cubic-bezier(0, 0, 0.2, 1);
     --ease-in-out: cubic-bezier(0.4, 0, 0.2, 1);
     --animate-spin: spin 1s linear infinite;
     --animate-pulse: pulse 2s cubic-bezier(0.4, 0, 0.6, 1) infinite;
@@ -6172,6 +6171,9 @@
   .grid {
     display: grid;
   }
+  .inline {
+    display: inline;
+  }
   .inline-block {
     display: inline-block;
   }
@@ -6714,9 +6716,6 @@
   .bg-\[color\:var\(--boring-success-soft\,var\(--secondary\)\)\] {
     background-color: var(--boring-success-soft,var(--secondary));
   }
-  .bg-\[color\:var\(--boring-warning\,var\(--accent-foreground\)\)\] {
-    background-color: var(--boring-warning,var(--accent-foreground));
-  }
   .bg-\[color\:var\(--boring-warning-soft\,var\(--accent\)\)\] {
     background-color: var(--boring-warning-soft,var(--accent));
   }
@@ -7134,11 +7133,6 @@
     transition-timing-function: var(--tw-ease, var(--default-transition-timing-function));
     transition-duration: var(--tw-duration, var(--default-transition-duration));
   }
-  .transition-\[width\] {
-    transition-property: width;
-    transition-timing-function: var(--tw-ease, var(--default-transition-timing-function));
-    transition-duration: var(--tw-duration, var(--default-transition-duration));
-  }
   .transition-all {
     transition-property: all;
     transition-timing-function: var(--tw-ease, var(--default-transition-timing-function));
@@ -7175,18 +7169,10 @@
     --tw-duration: 200ms;
     transition-duration: 200ms;
   }
-  .duration-300 {
-    --tw-duration: 300ms;
-    transition-duration: 300ms;
-  }
   .ease-in-out {
     --tw-ease: var(--ease-in-out);
     transition-timing-function: var(--ease-in-out);
   }
-  .ease-out {
-    --tw-ease: var(--ease-out);
-    transition-timing-function: var(--ease-out);
-  }
   .outline-none {
     --tw-outline-style: none;
     outline-style: none;
@@ -8444,6 +8430,64 @@
       height: calc(var(--spacing) * 4);
     }
   }
+  .\[\&\:\:-moz-progress-bar\]\:rounded-full {
+    &::-moz-progress-bar {
+      border-radius: calc(infinity * 1px);
+    }
+  }
+  .\[\&\:\:-moz-progress-bar\]\:bg-\[color\:var\(--boring-warning\,var\(--accent-foreground\)\)\] {
+    &::-moz-progress-bar {
+      background-color: var(--boring-warning,var(--accent-foreground));
+    }
+  }
+  .\[\&\:\:-moz-progress-bar\]\:bg-destructive {
+    &::-moz-progress-bar {
+      background-color: var(--boring-destructive);
+    }
+  }
+  .\[\&\:\:-moz-progress-bar\]\:bg-primary {
+    &::-moz-progress-bar {
+      background-color: var(--boring-primary);
+    }
+  }
+  .\[\&\:\:-webkit-progress-bar\]\:bg-muted {
+    &::-webkit-progress-bar {
+      background-color: var(--boring-muted);
+    }
+  }
+  .\[\&\:\:-webkit-progress-value\]\:rounded-full {
+    &::-webkit-progress-value {
+      border-radius: calc(infinity * 1px);
+    }
+  }
+  .\[\&\:\:-webkit-progress-value\]\:bg-\[color\:var\(--boring-warning\,var\(--accent-foreground\)\)\] {
+    &::-webkit-progress-value {
+      background-color: var(--boring-warning,var(--accent-foreground));
+    }
+  }
+  .\[\&\:\:-webkit-progress-value\]\:bg-destructive {
+    &::-webkit-progress-value {
+      background-color: var(--boring-destructive);
+    }
+  }
+  .\[\&\:\:-webkit-progress-value\]\:bg-primary {
+    &::-webkit-progress-value {
+      background-color: var(--boring-primary);
+    }
+  }
+  .\[\&\:\:-webkit-progress-value\]\:transition-all {
+    &::-webkit-progress-value {
+      transition-property: all;
+      transition-timing-function: var(--tw-ease, var(--default-transition-timing-function));
+      transition-duration: var(--tw-duration, var(--default-transition-duration));
+    }
+  }
+  .\[\&\:\:-webkit-progress-value\]\:duration-300 {
+    &::-webkit-progress-value {
+      --tw-duration: 300ms;
+      transition-duration: 300ms;
+    }
+  }
   .\[\&\:\:-webkit-scrollbar\]\:hidden {
     &::-webkit-scrollbar {
       display: none;

package/dist/workspace.js

@@ -1,8 +1,8 @@
-import { $ as e, $t as t, A as n, At as r, Bt as i, Ct as a, D as o, Dt as s, E as c, Et as l, Ft as u, Gt as d, Ht as f, It as p, J as m, Jt as h, K as g, Lt as _, Mt as v, Nt as y, O as b, Ot as x, Pt as S, Q as C, Qt as w, Rt as T, S as ee, Sn as te, St as ne, T as re, Tt as E, U as ie, Ut as ae, Vt as oe, W as se, Wt as ce, Xt as le, Y as ue, Yt as de, Z as fe, Zt as pe, _n as me, _t as he, a as ge, an as _e, at as ve, b as ye, bn as be, bt as xe, cn as Se, ct as Ce, d as we, dn as D, dt as O, en as k, et as Te, f as Ee, fn as De, ft as Oe, gn as ke, gt as A, h as Ae, hn as je, ht as Me, i as Ne, in as Pe, it as Fe, jt as Ie, k as Le, l as Re, ln as ze, lt as Be, mn as j, mt as Ve, n as He, nt as Ue, o as We, on as Ge, ot as Ke, p as qe, pn as Je, pt as Ye, q as Xe, qt as Ze, r as Qe, rn as $e, rt as et, s as tt, sn as nt, st as rt, t as it, tn as at, tt as ot, u as st, un as ct, ut as lt, vn as ut, vt as dt, w as ft, wt as pt, x as mt, xt as ht, y as gt, yn as _t, yt as vt, zt as yt } from "./WorkspaceProvider-DH-yiJZ8.js";
-import { t as bt } from "./MarkdownEditor-D8NqIunl.js";
+import { $ as e, $t as t, A as n, At as r, Bt as i, Ct as a, D as o, Dt as s, E as c, Et as l, Ft as u, Gt as d, Ht as f, It as p, J as m, Jt as h, K as g, Lt as _, Mt as v, Nt as y, O as b, Ot as x, Pt as S, Q as C, Qt as w, Rt as T, S as ee, Sn as te, St as ne, T as re, Tt as E, U as ie, Ut as ae, Vt as oe, W as se, Wt as ce, Xt as le, Y as ue, Yt as de, Z as fe, Zt as pe, _n as me, _t as he, a as ge, an as _e, at as ve, b as ye, bn as be, bt as xe, cn as Se, ct as Ce, d as we, dn as D, dt as O, en as k, et as Te, f as Ee, fn as De, ft as Oe, gn as ke, gt as A, h as Ae, hn as je, ht as Me, i as Ne, in as Pe, it as Fe, jt as Ie, k as Le, l as Re, ln as ze, lt as Be, mn as j, mt as Ve, n as He, nt as Ue, o as We, on as Ge, ot as Ke, p as qe, pn as Je, pt as Ye, q as Xe, qt as Ze, r as Qe, rn as $e, rt as et, s as tt, sn as nt, st as rt, t as it, tn as at, tt as ot, u as st, un as ct, ut as lt, vn as ut, vt as dt, w as ft, wt as pt, x as mt, xt as ht, y as gt, yn as _t, yt as vt, zt as yt } from "./WorkspaceProvider-C8rWNm72.js";
+import { t as bt } from "./MarkdownEditor-B4MXLBVy.js";
 import { t as M } from "./utils-BRcxFdrz.js";
-import { d as xt, i as St, n as Ct, p as wt, r as Tt, t as Et } from "./WorkspaceLoadingState-D_b8t-6U.js";
-import { t as Dt } from "./FileTree-DQQ1NXtr.js";
+import { d as xt, i as St, n as Ct, p as wt, r as Tt, t as Et } from "./WorkspaceLoadingState-BkAUFt_A.js";
+import { t as Dt } from "./FileTree-BIRGkW6O.js";
 import { Component as Ot, Suspense as kt, useCallback as N, useEffect as P, useMemo as F, useRef as I, useState as L, useSyncExternalStore as R } from "react";
 import { Fragment as At, jsx as z, jsxs as B } from "react/jsx-runtime";
 import { CheckIcon as jt, CopyIcon as Mt, MenuIcon as Nt, PanelLeftIcon as V, PinIcon as Pt } from "lucide-react";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hachej/boring-workspace",
-  "version": "0.1.82",
+  "version": "0.1.84",
   "type": "module",
   "license": "MIT",
   "description": "Workspace UI, plugin, and bridge package for composing chat, files, catalogs, editors, and app-specific panes.",
@@ -139,9 +139,9 @@
     "tailwind-merge": "^2.0.0",
     "zod": "^3.23.0",
     "zustand": "^5.0.14",
-    "@hachej/boring-agent": "0.1.82",
-    "@hachej/boring-ui-plugin-cli": "0.1.82",
-    "@hachej/boring-ui-kit": "0.1.82"
+    "@hachej/boring-agent": "0.1.84",
+    "@hachej/boring-ui-kit": "0.1.84",
+    "@hachej/boring-ui-plugin-cli": "0.1.84"
   },
   "devDependencies": {
     "@tailwindcss/postcss": "^4.3.1",