@praneeth_54/agentdoctor 1.1.1 → 2.0.1

package/dist/security/paths.js

@@ -0,0 +1,105 @@
+import fs from "node:fs";
+import path from "node:path";
+import { resolveRepoRoot, isPathInsideRoot, toPosixRelative } from "../utils/path.js";
+export class PathEscapeError extends Error {
+    code = "PATH_ESCAPE";
+    constructor(message = "path escapes repository root") {
+        super(message);
+        this.name = "PathEscapeError";
+    }
+}
+function tryDecodeUri(value) {
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        return null;
+    }
+}
+function hasTraversalSegment(value) {
+    const normalized = value.replace(/\\/g, "/");
+    if (normalized.includes("\0"))
+        return true;
+    // Reject any `..` occurrence (including encoded forms after decode and `....` tricks).
+    if (normalized.includes(".."))
+        return true;
+    return false;
+}
+function isWindowsDriveAbsolute(value) {
+    return /^[A-Za-z]:[\\/]/.test(value);
+}
+/**
+ * Lexical hostility checks shared by resolve/assert helpers.
+ * Does not leak the candidate path in thrown messages.
+ */
+export function rejectHostilePathInput(candidate) {
+    if (typeof candidate !== "string" || candidate.length === 0) {
+        throw new PathEscapeError("invalid path");
+    }
+    if (candidate.includes("\0")) {
+        throw new PathEscapeError("invalid path");
+    }
+    const decoded = tryDecodeUri(candidate);
+    if (decoded === null) {
+        throw new PathEscapeError("invalid path");
+    }
+    for (const form of decoded === candidate ? [candidate] : [candidate, decoded]) {
+        if (form.includes("\0") || hasTraversalSegment(form) || isWindowsDriveAbsolute(form)) {
+            throw new PathEscapeError("path escapes repository root");
+        }
+    }
+}
+function realpathOrSelf(target) {
+    try {
+        if (fs.existsSync(target)) {
+            return fs.realpathSync(target);
+        }
+    }
+    catch {
+        // fall through
+    }
+    return target;
+}
+function realpathRoot(root) {
+    try {
+        return fs.realpathSync(root);
+    }
+    catch {
+        return path.resolve(root);
+    }
+}
+/**
+ * Resolve a user-supplied path and require it to remain inside the repository root.
+ * Rejects `..`, URI-encoded traversal, null bytes, Windows-drive absolutes, and
+ * symlink realpath escapes. Error messages never echo the hostile candidate.
+ */
+export function resolveSafeRepoPath(rootInput, candidate) {
+    const root = resolveRepoRoot(rootInput);
+    rejectHostilePathInput(candidate);
+    const decoded = tryDecodeUri(candidate) ?? candidate;
+    const primary = decoded;
+    const absolute = path.isAbsolute(primary) ? path.normalize(primary) : path.resolve(root, primary);
+    // Lexical containment against the resolved (non-realpath) root first.
+    // On macOS, /var vs /private/var must not false-reject before realpath.
+    if (!isPathInsideRoot(root, absolute) && path.resolve(absolute) !== path.resolve(root)) {
+        throw new PathEscapeError("path escapes repository root");
+    }
+    const realRoot = realpathRoot(root);
+    const realTarget = realpathOrSelf(absolute);
+    // Symlink / realpath escape check (both sides realpath'd when possible).
+    if (!isPathInsideRoot(realRoot, realTarget) && realTarget !== realRoot) {
+        throw new PathEscapeError("path escapes repository root");
+    }
+    return realTarget;
+}
+/** Assert `candidate` resolves inside `root`; throws PathEscapeError otherwise. */
+export function assertInsideRepo(rootInput, candidate) {
+    resolveSafeRepoPath(rootInput, candidate);
+}
+/** Resolve safely and return a POSIX path relative to the repo root. */
+export function safeRelPath(rootInput, absoluteOrRel) {
+    const abs = resolveSafeRepoPath(rootInput, absoluteOrRel);
+    const root = realpathRoot(resolveRepoRoot(rootInput));
+    return toPosixRelative(root, abs);
+}
+export { tryDecodeUri as tryDecodeUriComponent };

package/dist/storage/postgres.d.ts

@@ -0,0 +1,26 @@
+import type { Pool } from "pg";
+import type { StorageProvider } from "../contracts/index.js";
+/**
+ * Postgres-backed StorageProvider via the `pg` package.
+ * Only usable when a real connection string works — not claimed as always-on enterprise storage.
+ */
+export declare class PostgresStorageProvider implements StorageProvider {
+    readonly kind: "postgres";
+    private readonly pool;
+    private ready;
+    constructor(pool: Pool);
+    private ensureSchema;
+    private withClient;
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string): Promise<void>;
+    delete(key: string): Promise<void>;
+    list(prefix: string): Promise<string[]>;
+    close(): Promise<void>;
+}
+/**
+ * Create Postgres storage when a connection string is provided and the server accepts it.
+ * Returns `{ error }` on failure — do not claim Postgres is supported without a working URL.
+ */
+export declare function tryCreatePostgresStorage(connectionString: string): Promise<PostgresStorageProvider | {
+    error: string;
+}>;

package/dist/storage/postgres.js

@@ -0,0 +1,90 @@
+import pg from "pg";
+const { Pool: PgPool } = pg;
+/**
+ * Postgres-backed StorageProvider via the `pg` package.
+ * Only usable when a real connection string works — not claimed as always-on enterprise storage.
+ */
+export class PostgresStorageProvider {
+    kind = "postgres";
+    pool;
+    ready;
+    constructor(pool) {
+        this.pool = pool;
+        this.ready = this.ensureSchema();
+    }
+    async ensureSchema() {
+        await this.pool.query(`
+      CREATE TABLE IF NOT EXISTS agentdoctor_kv (
+        key TEXT PRIMARY KEY,
+        value TEXT NOT NULL
+      );
+    `);
+    }
+    async withClient(fn) {
+        await this.ready;
+        const client = await this.pool.connect();
+        try {
+            return await fn(client);
+        }
+        finally {
+            client.release();
+        }
+    }
+    async get(key) {
+        return this.withClient(async (client) => {
+            const result = await client.query("SELECT value FROM agentdoctor_kv WHERE key = $1", [key]);
+            return result.rows[0]?.value ?? null;
+        });
+    }
+    async set(key, value) {
+        await this.withClient(async (client) => {
+            await client.query(`INSERT INTO agentdoctor_kv (key, value) VALUES ($1, $2)
+         ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value`, [key, value]);
+        });
+    }
+    async delete(key) {
+        await this.withClient(async (client) => {
+            await client.query("DELETE FROM agentdoctor_kv WHERE key = $1", [key]);
+        });
+    }
+    async list(prefix) {
+        return this.withClient(async (client) => {
+            const result = await client.query("SELECT key FROM agentdoctor_kv WHERE key LIKE $1 ORDER BY key", [`${prefix}%`]);
+            return result.rows.map((r) => r.key);
+        });
+    }
+    async close() {
+        await this.pool.end();
+    }
+}
+/**
+ * Create Postgres storage when a connection string is provided and the server accepts it.
+ * Returns `{ error }` on failure — do not claim Postgres is supported without a working URL.
+ */
+export async function tryCreatePostgresStorage(connectionString) {
+    if (!connectionString || typeof connectionString !== "string" || !connectionString.trim()) {
+        return { error: "Postgres connection string is empty" };
+    }
+    const pool = new PgPool({
+        connectionString: connectionString.trim(),
+        max: 2,
+        idleTimeoutMillis: 5_000,
+        connectionTimeoutMillis: 5_000,
+    });
+    try {
+        const client = await pool.connect();
+        try {
+            await client.query("SELECT 1");
+        }
+        finally {
+            client.release();
+        }
+        return new PostgresStorageProvider(pool);
+    }
+    catch (error) {
+        await pool.end().catch(() => undefined);
+        return {
+            error: `Failed to connect to Postgres: ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+}

package/dist/storage/provider.d.ts

@@ -0,0 +1,30 @@
+import type { StorageProvider } from "../contracts/index.js";
+export declare class FilesystemStorageProvider implements StorageProvider {
+    readonly kind: "filesystem";
+    private readonly root;
+    constructor(rootInput: string, subdir?: string);
+    private resolveKey;
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string): Promise<void>;
+    delete(key: string): Promise<void>;
+    list(prefix: string): Promise<string[]>;
+}
+/** In-memory provider for tests and optional ephemeral mode. */
+export declare class MemoryStorageProvider implements StorageProvider {
+    readonly kind: "memory";
+    private readonly map;
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string): Promise<void>;
+    delete(key: string): Promise<void>;
+    list(prefix: string): Promise<string[]>;
+}
+export { tryCreateSqliteStorage, SqliteStorageProvider } from "./sqlite.js";
+export { tryCreatePostgresStorage, PostgresStorageProvider } from "./postgres.js";
+export interface WorkspaceRecord {
+    id: string;
+    name: string;
+    repositoryRoots: string[];
+    createdAt: string;
+}
+export declare function saveWorkspace(storage: StorageProvider, workspace: WorkspaceRecord): Promise<void>;
+export declare function loadWorkspace(storage: StorageProvider, id: string): Promise<WorkspaceRecord | null>;

package/dist/storage/provider.js

@@ -0,0 +1,109 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { isPathInsideRoot, resolveRepoRoot } from "../utils/path.js";
+import { atomicWriteTextFile } from "../utils/fs.js";
+import { rejectHostilePathInput, PathEscapeError } from "../security/paths.js";
+export class FilesystemStorageProvider {
+    kind = "filesystem";
+    root;
+    constructor(rootInput, subdir = ".agentdoctor/storage") {
+        this.root = path.join(resolveRepoRoot(rootInput), subdir);
+    }
+    resolveKey(key) {
+        if (path.isAbsolute(key)) {
+            throw new Error("unsafe storage key");
+        }
+        try {
+            // Do not use resolveSafeRepoPath here — it calls resolveRepoRoot() which
+            // walks up from the storage subdir and can false-reject valid keys.
+            rejectHostilePathInput(key);
+            const target = path.resolve(this.root, key);
+            if (!isPathInsideRoot(this.root, target)) {
+                throw new PathEscapeError("storage path escape");
+            }
+            return target;
+        }
+        catch (error) {
+            if (error instanceof PathEscapeError) {
+                throw new Error("storage path escape");
+            }
+            throw new Error("unsafe storage key");
+        }
+    }
+    async get(key) {
+        try {
+            return await fs.readFile(this.resolveKey(key), "utf8");
+        }
+        catch {
+            return null;
+        }
+    }
+    async set(key, value) {
+        const target = this.resolveKey(key);
+        await fs.mkdir(path.dirname(target), { recursive: true });
+        await atomicWriteTextFile(target, value);
+    }
+    async delete(key) {
+        try {
+            await fs.unlink(this.resolveKey(key));
+        }
+        catch {
+            // ignore
+        }
+    }
+    async list(prefix) {
+        const base = this.resolveKey(prefix || ".");
+        const out = [];
+        async function walk(dir, rel) {
+            let entries;
+            try {
+                entries = await fs.readdir(dir, { withFileTypes: true });
+            }
+            catch {
+                return;
+            }
+            for (const e of entries) {
+                const nextRel = rel ? `${rel}/${e.name}` : e.name;
+                if (e.isDirectory())
+                    await walk(path.join(dir, e.name), nextRel);
+                else
+                    out.push(nextRel);
+            }
+        }
+        const st = await fs.stat(base).catch(() => null);
+        if (!st)
+            return [];
+        if (st.isFile())
+            return [prefix];
+        await walk(base, prefix === "." ? "" : prefix);
+        return out.sort();
+    }
+}
+/** In-memory provider for tests and optional ephemeral mode. */
+export class MemoryStorageProvider {
+    kind = "memory";
+    map = new Map();
+    async get(key) {
+        return this.map.get(key) ?? null;
+    }
+    async set(key, value) {
+        this.map.set(key, value);
+    }
+    async delete(key) {
+        this.map.delete(key);
+    }
+    async list(prefix) {
+        return [...this.map.keys()].filter((k) => k.startsWith(prefix)).sort();
+    }
+}
+export { tryCreateSqliteStorage, SqliteStorageProvider } from "./sqlite.js";
+export { tryCreatePostgresStorage, PostgresStorageProvider } from "./postgres.js";
+export async function saveWorkspace(storage, workspace) {
+    await storage.set(`workspaces/${workspace.id}.json`, `${JSON.stringify(workspace, null, 2)}\n`);
+}
+export async function loadWorkspace(storage, id) {
+    const raw = await storage.get(`workspaces/${id}.json`);
+    if (!raw)
+        return null;
+    return JSON.parse(raw);
+}

package/dist/storage/sqlite.d.ts

@@ -0,0 +1,33 @@
+import type { StorageProvider } from "../contracts/index.js";
+type DatabaseSyncCtor = new (path: string) => {
+    exec(sql: string): void;
+    prepare(sql: string): {
+        get(...params: unknown[]): unknown;
+        run(...params: unknown[]): unknown;
+        all(...params: unknown[]): unknown[];
+    };
+    close(): void;
+};
+/**
+ * SQLite-backed StorageProvider using Node's built-in `node:sqlite` (DatabaseSync).
+ * Available on Node 22+; feature-detected at runtime.
+ */
+export declare class SqliteStorageProvider implements StorageProvider {
+    readonly kind: "sqlite";
+    private readonly db;
+    private readonly dbPath;
+    constructor(db: InstanceType<DatabaseSyncCtor>, dbPath: string);
+    get path(): string;
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string): Promise<void>;
+    delete(key: string): Promise<void>;
+    list(prefix: string): Promise<string[]>;
+    close(): void;
+}
+/**
+ * Create SQLite storage at `.agentdoctor/storage.sqlite` when `node:sqlite` is available.
+ */
+export declare function tryCreateSqliteStorage(rootInput: string): Promise<SqliteStorageProvider | {
+    error: string;
+}>;
+export {};

package/dist/storage/sqlite.js

@@ -0,0 +1,77 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { resolveRepoRoot } from "../utils/path.js";
+/**
+ * SQLite-backed StorageProvider using Node's built-in `node:sqlite` (DatabaseSync).
+ * Available on Node 22+; feature-detected at runtime.
+ */
+export class SqliteStorageProvider {
+    kind = "sqlite";
+    db;
+    dbPath;
+    constructor(db, dbPath) {
+        this.db = db;
+        this.dbPath = dbPath;
+        this.db.exec(`
+      CREATE TABLE IF NOT EXISTS kv (
+        key TEXT PRIMARY KEY,
+        value TEXT NOT NULL
+      );
+    `);
+    }
+    get path() {
+        return this.dbPath;
+    }
+    async get(key) {
+        const row = this.db.prepare("SELECT value FROM kv WHERE key = ?").get(key);
+        return row?.value ?? null;
+    }
+    async set(key, value) {
+        this.db
+            .prepare("INSERT INTO kv (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value")
+            .run(key, value);
+    }
+    async delete(key) {
+        this.db.prepare("DELETE FROM kv WHERE key = ?").run(key);
+    }
+    async list(prefix) {
+        const rows = this.db
+            .prepare("SELECT key FROM kv WHERE key LIKE ? ORDER BY key")
+            .all(`${prefix}%`);
+        return rows.map((r) => r.key);
+    }
+    close() {
+        this.db.close();
+    }
+}
+/**
+ * Create SQLite storage at `.agentdoctor/storage.sqlite` when `node:sqlite` is available.
+ */
+export async function tryCreateSqliteStorage(rootInput) {
+    let DatabaseSync;
+    try {
+        const mod = await import("node:sqlite");
+        if (!mod || typeof mod.DatabaseSync !== "function") {
+            return { error: "node:sqlite DatabaseSync is not available in this Node runtime" };
+        }
+        DatabaseSync = mod.DatabaseSync;
+    }
+    catch (error) {
+        return {
+            error: `SQLite storage requires Node.js with node:sqlite (typically Node 22+): ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+    try {
+        const root = resolveRepoRoot(rootInput);
+        const dir = path.join(root, ".agentdoctor");
+        await fs.mkdir(dir, { recursive: true });
+        const dbPath = path.join(dir, "storage.sqlite");
+        const db = new DatabaseSync(dbPath);
+        return new SqliteStorageProvider(db, dbPath);
+    }
+    catch (error) {
+        return {
+            error: `Failed to open SQLite storage: ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+}

package/dist/team/auth.d.ts

@@ -0,0 +1,35 @@
+import type { StorageProvider } from "../contracts/index.js";
+export type TeamRole = "owner" | "admin" | "member" | "viewer";
+export interface TeamUser {
+    id: string;
+    username: string;
+    passwordHash: string;
+    salt: string;
+    role: TeamRole;
+    createdAt: string;
+    /** Development-only local auth — not enterprise SSO. */
+    authMode: "local-dev";
+}
+export interface SessionToken {
+    token: string;
+    userId: string;
+    expiresAt: string;
+}
+export declare function registerLocalDevUser(options: {
+    root: string;
+    username: string;
+    password: string;
+    role?: TeamRole;
+    storage?: StorageProvider;
+}): Promise<TeamUser>;
+export declare function authenticateLocalDev(options: {
+    root: string;
+    username: string;
+    password: string;
+    storage?: StorageProvider;
+}): Promise<SessionToken>;
+export declare function authorize(root: string, token: string, minRole: TeamRole, storage?: StorageProvider): Promise<{
+    ok: boolean;
+    user?: TeamUser;
+    reason: string;
+}>;

package/dist/team/auth.js

@@ -0,0 +1,70 @@
+import { createHash, randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
+import { FilesystemStorageProvider } from "../storage/provider.js";
+function hashPassword(password, salt) {
+    return scryptSync(password, salt, 32).toString("hex");
+}
+export async function registerLocalDevUser(options) {
+    if (options.password.length < 8)
+        throw new Error("password must be at least 8 characters");
+    const storage = options.storage ?? new FilesystemStorageProvider(options.root, ".agentdoctor/team");
+    const salt = randomBytes(16).toString("hex");
+    const user = {
+        id: `user_${createHash("sha256").update(options.username).digest("hex").slice(0, 10)}`,
+        username: options.username,
+        passwordHash: hashPassword(options.password, salt),
+        salt,
+        role: options.role ?? "member",
+        createdAt: new Date().toISOString(),
+        authMode: "local-dev",
+    };
+    await storage.set(`users/${user.id}.json`, `${JSON.stringify(user, null, 2)}\n`);
+    return {
+        ...user,
+        passwordHash: "[REDACTED]",
+        salt: "[REDACTED]",
+    };
+}
+export async function authenticateLocalDev(options) {
+    const storage = options.storage ?? new FilesystemStorageProvider(options.root, ".agentdoctor/team");
+    const keys = await storage.list("users");
+    for (const key of keys) {
+        const raw = await storage.get(key.startsWith("users/") ? key : `users/${key}`);
+        if (!raw)
+            continue;
+        const user = JSON.parse(raw);
+        if (user.username !== options.username)
+            continue;
+        const next = hashPassword(options.password, user.salt);
+        const a = Buffer.from(next, "hex");
+        const b = Buffer.from(user.passwordHash, "hex");
+        if (a.length !== b.length || !timingSafeEqual(a, b))
+            break;
+        const token = randomBytes(24).toString("hex");
+        const session = {
+            token,
+            userId: user.id,
+            expiresAt: new Date(Date.now() + 8 * 3600_000).toISOString(),
+        };
+        await storage.set(`sessions/${token}.json`, `${JSON.stringify(session, null, 2)}\n`);
+        return session;
+    }
+    throw new Error("invalid credentials");
+}
+export async function authorize(root, token, minRole, storage) {
+    const store = storage ?? new FilesystemStorageProvider(root, ".agentdoctor/team");
+    const raw = await store.get(`sessions/${token}.json`);
+    if (!raw)
+        return { ok: false, reason: "missing session" };
+    const session = JSON.parse(raw);
+    if (Date.parse(session.expiresAt) < Date.now())
+        return { ok: false, reason: "expired session" };
+    const userRaw = await store.get(`users/${session.userId}.json`);
+    if (!userRaw)
+        return { ok: false, reason: "missing user" };
+    const user = JSON.parse(userRaw);
+    const rank = { viewer: 1, member: 2, admin: 3, owner: 4 };
+    if ((rank[user.role] ?? 0) < (rank[minRole] ?? 99)) {
+        return { ok: false, reason: "insufficient role", user };
+    }
+    return { ok: true, user, reason: "authorized" };
+}

package/dist/types/index.d.ts

@@ -9,7 +9,7 @@ export type LanguageId = "typescript" | "javascript" | "python" | "dart" | "php"
 export type FrameworkId = "nextjs" | "react" | "vue" | "nuxt" | "svelte" | "nodejs" | "express" | "nestjs" | "flutter" | "laravel" | "django" | "fastapi" | "unknown";
 export type PackageManagerId = "npm" | "pnpm" | "yarn" | "bun" | "composer" | "pub" | "pip" | "poetry" | "cargo" | "gradle" | "unknown";
 export type MonorepoToolId = "npm-workspaces" | "pnpm-workspaces" | "turborepo" | "nx" | "multi-project" | "none";
-export type AgentId = "cursor" | "claude-code" | "codex";
+export type AgentId = "cursor" | "claude-code" | "codex" | "copilot" | "windsurf" | "gemini-cli" | "aider";
 export interface DiscoveredFile {
     /** Absolute path */
     absolutePath: string;
@@ -76,6 +76,10 @@ export interface AgentScores {
     cursor: number;
     "claude-code": number;
     codex: number;
+    copilot: number;
+    windsurf: number;
+    "gemini-cli": number;
+    aider: number;
 }
 export interface Scores {
     overall: number;

package/dist/workspace/index.d.ts

@@ -0,0 +1,69 @@
+export declare const WORKSPACE_SCHEMA_VERSION: "1.0.0";
+export interface WorkspaceModel {
+    schemaVersion: typeof WORKSPACE_SCHEMA_VERSION;
+    id: string;
+    name: string;
+    /** Absolute, resolved repository roots that belong to this workspace. */
+    repositoryRoots: string[];
+    /**
+     * When false (default), operations scoped to repo A must not read paths under repo B
+     * even if both are members of the same workspace.
+     */
+    allowCrossRead: boolean;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface WorkspacePathAccess {
+    allowed: boolean;
+    reason: string;
+    workspaceId?: string;
+    requestedRoot?: string;
+    targetRoot?: string;
+}
+export declare function initWorkspace(options: {
+    controlRoot: string;
+    name: string;
+    repositoryRoot?: string;
+    id?: string;
+    allowCrossRead?: boolean;
+}): Promise<WorkspaceModel>;
+export declare function loadWorkspace(controlRoot: string, id: string): Promise<WorkspaceModel | null>;
+export declare function listWorkspaces(controlRoot: string): Promise<WorkspaceModel[]>;
+export declare function addRepositoryToWorkspace(options: {
+    controlRoot: string;
+    workspaceId: string;
+    repositoryRoot: string;
+}): Promise<WorkspaceModel>;
+export declare function removeWorkspace(controlRoot: string, id: string): Promise<boolean>;
+export declare function workspaceStatus(controlRoot: string, id: string): Promise<{
+    ok: boolean;
+    workspace?: WorkspaceModel;
+    missingRoots: string[];
+    error?: string;
+}>;
+/**
+ * Isolation gate: a path may be read only when it is inside the operation's own
+ * repositoryRoot, OR (allowCrossRead && both roots are members of the same workspace).
+ */
+export declare function assertWorkspacePathAccess(options: {
+    workspace: WorkspaceModel | null;
+    operationRoot: string;
+    targetPath: string;
+}): WorkspacePathAccess;
+/**
+ * Read a file only when workspace isolation allows it.
+ */
+export declare function readFileWithinWorkspace(options: {
+    workspace: WorkspaceModel | null;
+    operationRoot: string;
+    targetPath: string;
+    maxBytes?: number;
+}): Promise<{
+    ok: true;
+    content: string;
+    access: WorkspacePathAccess;
+} | {
+    ok: false;
+    access: WorkspacePathAccess;
+    error: string;
+}>;