@resolveio/server-lib 22.1.15 → 22.1.17

package/methods/ai-terminal.js

@@ -551,6 +551,7 @@ var AI_ASSISTANT_SYSTEM_PROMPT = [
     '- Do not modify files, run destructive commands, or access databases directly.',
     '- Read-only data access is allowed only via the REPORT_BUILDER_READ/REPORT_BUILDER_AGG directives (see below).',
     '- Do not access secrets, credentials, or user data.',
+    '- If asked about the underlying AI/model/provider/runtime (including Codex/OpenAI/local-vs-hosted/version details), refuse. This information is not available to users, including admins and super admins.',
     '- If the user has a customer portal scope (other.id_customer), only discuss that customer\'s data and what is visible in their customer portal. Never reference other customers or internal/admin-only data. If asked for anything outside the portal, say it isn\'t available.',
     '- Do not assist with hacking, bypassing security, or abuse.',
     'Accuracy & tools:',
@@ -1254,7 +1255,7 @@ function loadAiTerminalMethods(methodManager) {
 }
 function executeAiTerminalRun(payload, context) {
     return __awaiter(this, void 0, void 0, function () {
-        var input, message, requestId, isSuperAdmin, guardrailsEnabled, guardrail, conversation_1, now_1, userMsg, assistantMsg, conversation, now, attachments, attachmentData, config, systemPrompt, userPromptTemplate, userPrompt, historyLimit, history, _a, messages, openaiSettings, client, response, usage, idClient, userDoc, assistantDoc, insertResult;
+        var input, message, requestId, identityGuardrail, conversation_1, now_1, userMsg, assistantMsg, isSuperAdmin, guardrailsEnabled, guardrail, conversation_2, now_2, userMsg, assistantMsg, conversation, now, attachments, attachmentData, config, systemPrompt, userPromptTemplate, userPrompt, historyLimit, history, _a, messages, openaiSettings, client, response, usage, idClient, userDoc, assistantDoc, insertResult;
         return __generator(this, function (_b) {
             switch (_b.label) {
                 case 0:
@@ -1264,15 +1265,10 @@ function executeAiTerminalRun(payload, context) {
                         throw new Error('Message is required.');
                     }
                     requestId = normalizeOptionalString(input.request_id);
-                    return [4 /*yield*/, resolveIsSuperAdmin(context === null || context === void 0 ? void 0 : context.id_user)];
-                case 1:
-                    isSuperAdmin = _b.sent();
-                    guardrailsEnabled = input.guardrails !== false && !isSuperAdmin;
-                    if (!guardrailsEnabled) return [3 /*break*/, 6];
-                    guardrail = evaluateGuardrails(message);
-                    if (!(guardrail === null || guardrail === void 0 ? void 0 : guardrail.blocked)) return [3 /*break*/, 6];
+                    identityGuardrail = evaluateAssistantIdentityDisclosureGuardrail(message);
+                    if (!(identityGuardrail === null || identityGuardrail === void 0 ? void 0 : identityGuardrail.blocked)) return [3 /*break*/, 5];
                     return [4 /*yield*/, ensureConversation(input, 'openai', context === null || context === void 0 ? void 0 : context.id_user)];
-                case 2:
+                case 1:
                     conversation_1 = _b.sent();
                     now_1 = new Date();
                     userMsg = {
@@ -1286,47 +1282,88 @@ function executeAiTerminalRun(payload, context) {
                     assistantMsg = {
                         id_conversation: conversation_1._id,
                         role: 'assistant',
-                        content: guardrail.response,
-                        metadata: __assign({ blocked: true, reason: guardrail.reason }, (requestId ? { request_id: requestId } : {})),
+                        content: identityGuardrail.response,
+                        metadata: __assign({ blocked: true, reason: identityGuardrail.reason }, (requestId ? { request_id: requestId } : {})),
                         createdAt: now_1,
                         updatedAt: now_1
                     };
                     return [4 /*yield*/, ai_terminal_message_collection_1.AiTerminalMessages.insertOne(userMsg)];
-                case 3:
+                case 2:
                     _b.sent();
                     return [4 /*yield*/, ai_terminal_message_collection_1.AiTerminalMessages.insertOne(assistantMsg)];
-                case 4:
+                case 3:
                     _b.sent();
                     return [4 /*yield*/, touchConversation(conversation_1._id, now_1)];
-                case 5:
+                case 4:
                     _b.sent();
                     return [2 /*return*/, {
                             conversation: conversation_1,
                             message: assistantMsg,
-                            guardrails: { blocked: true, reason: guardrail.reason }
+                            guardrails: { blocked: true, reason: identityGuardrail.reason }
                         }];
-                case 6: return [4 /*yield*/, ensureConversation(input, 'openai', context === null || context === void 0 ? void 0 : context.id_user)];
+                case 5: return [4 /*yield*/, resolveIsSuperAdmin(context === null || context === void 0 ? void 0 : context.id_user)];
+                case 6:
+                    isSuperAdmin = _b.sent();
+                    guardrailsEnabled = input.guardrails !== false && !isSuperAdmin;
+                    if (!guardrailsEnabled) return [3 /*break*/, 11];
+                    guardrail = evaluateGuardrails(message);
+                    if (!(guardrail === null || guardrail === void 0 ? void 0 : guardrail.blocked)) return [3 /*break*/, 11];
+                    return [4 /*yield*/, ensureConversation(input, 'openai', context === null || context === void 0 ? void 0 : context.id_user)];
                 case 7:
+                    conversation_2 = _b.sent();
+                    now_2 = new Date();
+                    userMsg = {
+                        id_conversation: conversation_2._id,
+                        role: 'user',
+                        content: message,
+                        metadata: requestId ? { request_id: requestId } : undefined,
+                        createdAt: now_2,
+                        updatedAt: now_2
+                    };
+                    assistantMsg = {
+                        id_conversation: conversation_2._id,
+                        role: 'assistant',
+                        content: guardrail.response,
+                        metadata: __assign({ blocked: true, reason: guardrail.reason }, (requestId ? { request_id: requestId } : {})),
+                        createdAt: now_2,
+                        updatedAt: now_2
+                    };
+                    return [4 /*yield*/, ai_terminal_message_collection_1.AiTerminalMessages.insertOne(userMsg)];
+                case 8:
+                    _b.sent();
+                    return [4 /*yield*/, ai_terminal_message_collection_1.AiTerminalMessages.insertOne(assistantMsg)];
+                case 9:
+                    _b.sent();
+                    return [4 /*yield*/, touchConversation(conversation_2._id, now_2)];
+                case 10:
+                    _b.sent();
+                    return [2 /*return*/, {
+                            conversation: conversation_2,
+                            message: assistantMsg,
+                            guardrails: { blocked: true, reason: guardrail.reason }
+                        }];
+                case 11: return [4 /*yield*/, ensureConversation(input, 'openai', context === null || context === void 0 ? void 0 : context.id_user)];
+                case 12:
                     conversation = _b.sent();
                     now = new Date();
                     attachments = Array.isArray(input.attachments) ? input.attachments : [];
                     return [4 /*yield*/, readAttachmentContents(attachments)];
-                case 8:
+                case 13:
                     attachmentData = _b.sent();
                     config = sanitizeConfig(input.config || {});
                     systemPrompt = normalizeOptionalString(config.system_prompt) || '';
                     userPromptTemplate = normalizeOptionalString(config.user_prompt_template);
                     userPrompt = buildUserPrompt(userPromptTemplate, message, attachmentData.promptText);
                     historyLimit = normalizeHistoryLimit(input.max_history);
-                    if (!(historyLimit > 0)) return [3 /*break*/, 10];
+                    if (!(historyLimit > 0)) return [3 /*break*/, 15];
                     return [4 /*yield*/, ai_terminal_message_collection_1.AiTerminalMessages.find({ id_conversation: conversation._id, role: { $in: ['user', 'assistant'] } }, { sort: { createdAt: 1 }, limit: historyLimit * 2 })];
-                case 9:
+                case 14:
                     _a = _b.sent();
-                    return [3 /*break*/, 11];
-                case 10:
+                    return [3 /*break*/, 16];
+                case 15:
                     _a = [];
-                    _b.label = 11;
-                case 11:
+                    _b.label = 16;
+                case 16:
                     history = _a;
                     messages = [];
                     if (systemPrompt) {
@@ -1345,13 +1382,13 @@ function executeAiTerminalRun(payload, context) {
                     openaiSettings = resolveOpenAISettings(config);
                     client = new openai_client_1.OpenAIClient(openaiSettings);
                     return [4 /*yield*/, client.chat(messages, { timeoutMs: 60000, responseFormat: config.response_format })];
-                case 12:
+                case 17:
                     response = _b.sent();
                     usage = response.usage || estimateUsage(messages, response.content, openaiSettings.model);
                     return [4 /*yield*/, resolveClientId(conversation, input.id_client, context === null || context === void 0 ? void 0 : context.id_user)];
-                case 13:
+                case 18:
                     idClient = _b.sent();
-                    if (!idClient) return [3 /*break*/, 15];
+                    if (!idClient) return [3 /*break*/, 20];
                     return [4 /*yield*/, (0, openai_usage_ledger_manager_1.recordOpenAIUsage)({
                             id_client: idClient,
                             model: response.model || openaiSettings.model || 'unknown',
@@ -1361,10 +1398,10 @@ function executeAiTerminalRun(payload, context) {
                             category: 'ai-terminal',
                             id_conversation: conversation._id
                         })];
-                case 14:
+                case 19:
                     _b.sent();
-                    _b.label = 15;
-                case 15:
+                    _b.label = 20;
+                case 20:
                     userDoc = {
                         id_conversation: conversation._id,
                         role: 'user',
@@ -1389,20 +1426,20 @@ function executeAiTerminalRun(payload, context) {
                         updatedAt: now
                     };
                     return [4 /*yield*/, ai_terminal_message_collection_1.AiTerminalMessages.insertOne(userDoc)];
-                case 16:
+                case 21:
                     _b.sent();
                     return [4 /*yield*/, ai_terminal_message_collection_1.AiTerminalMessages.insertOne(assistantDoc)];
-                case 17:
+                case 22:
                     insertResult = _b.sent();
                     return [4 /*yield*/, touchConversation(conversation._id, now, insertResult._id)];
-                case 18:
+                case 23:
                     _b.sent();
-                    if (!(input.delete_files_after_run !== false)) return [3 /*break*/, 20];
+                    if (!(input.delete_files_after_run !== false)) return [3 /*break*/, 25];
                     return [4 /*yield*/, cleanupAttachments(attachmentData.attachments)];
-                case 19:
+                case 24:
                     _b.sent();
-                    _b.label = 20;
-                case 20: return [2 /*return*/, {
+                    _b.label = 25;
+                case 25: return [2 /*return*/, {
                         conversation: conversation,
                         message: assistantDoc,
                         usage: assistantDoc.usage
@@ -1482,7 +1519,7 @@ function executeAiFormPatch(payload, context) {
 }
 function executeAiAssistantCodexRun(payload, context) {
     return __awaiter(this, void 0, void 0, function () {
-        var input, message, aiWorkerDebug, requestId, codexModel, codexFallbackModels, guardrail, conversation_2, now_2, userMsg, assistantMsg, user, isSuperAdmin, hasInvoiceAccess, customerId, conversation, now, attachments, navigationFastPath, userMsg, assistantMsg, assistantInsert, assistantMessageId_1, changeHistoryFastPath, userMsg, assistantMsg, assistantInsert, assistantMessageId_2, attachmentData, historyLimit, history, _a, historyLines, recentToolError, userDoc, initialProgress, assistantDoc, insertResult, assistantMessageId;
+        var input, message, aiWorkerDebug, requestId, codexModel, codexFallbackModels, guardrail, conversation_3, now_3, userMsg, assistantMsg, user, isSuperAdmin, canViewDebug, hasInvoiceAccess, customerId, conversation, now, attachments, navigationFastPath, userMsg, assistantMsg, assistantInsert, assistantMessageId_1, changeHistoryFastPath, changeHistoryFastPathBypassedReason, userMsg, assistantMsg, assistantInsert, assistantMessageId_2, attachmentData, historyLimit, history, _a, historyLines, recentToolError, userDoc, initialProgress, assistantDoc, insertResult, assistantMessageId;
         var _this = this;
         var _b, _c, _d;
         return __generator(this, function (_e) {
@@ -1504,23 +1541,23 @@ function executeAiAssistantCodexRun(payload, context) {
                     if (!(guardrail === null || guardrail === void 0 ? void 0 : guardrail.blocked)) return [3 /*break*/, 5];
                     return [4 /*yield*/, ensureConversation(input, 'codex', context === null || context === void 0 ? void 0 : context.id_user)];
                 case 1:
-                    conversation_2 = _e.sent();
-                    now_2 = new Date();
+                    conversation_3 = _e.sent();
+                    now_3 = new Date();
                     userMsg = {
-                        id_conversation: conversation_2._id,
+                        id_conversation: conversation_3._id,
                         role: 'user',
                         content: message,
                         metadata: requestId ? { request_id: requestId } : undefined,
-                        createdAt: now_2,
-                        updatedAt: now_2
+                        createdAt: now_3,
+                        updatedAt: now_3
                     };
                     assistantMsg = {
-                        id_conversation: conversation_2._id,
+                        id_conversation: conversation_3._id,
                         role: 'assistant',
                         content: guardrail.response,
                         metadata: __assign({ blocked: true, reason: guardrail.reason }, (requestId ? { request_id: requestId } : {})),
-                        createdAt: now_2,
-                        updatedAt: now_2
+                        createdAt: now_3,
+                        updatedAt: now_3
                     };
                     return [4 /*yield*/, ai_terminal_message_collection_1.AiTerminalMessages.insertOne(userMsg)];
                 case 2:
@@ -1528,11 +1565,11 @@ function executeAiAssistantCodexRun(payload, context) {
                     return [4 /*yield*/, ai_terminal_message_collection_1.AiTerminalMessages.insertOne(assistantMsg)];
                 case 3:
                     _e.sent();
-                    return [4 /*yield*/, touchConversation(conversation_2._id, now_2)];
+                    return [4 /*yield*/, touchConversation(conversation_3._id, now_3)];
                 case 4:
                     _e.sent();
                     return [2 /*return*/, {
-                            conversation: conversation_2,
+                            conversation: conversation_3,
                             message: assistantMsg,
                             guardrails: { blocked: true, reason: guardrail.reason }
                         }];
@@ -1540,6 +1577,7 @@ function executeAiAssistantCodexRun(payload, context) {
                 case 6:
                     user = _e.sent();
                     isSuperAdmin = !!((_b = user === null || user === void 0 ? void 0 : user.roles) === null || _b === void 0 ? void 0 : _b.super_admin);
+                    canViewDebug = isAssistantDebugUser(user);
                     hasInvoiceAccess = userHasInvoiceAccess(user);
                     customerId = normalizeOptionalString((_c = user === null || user === void 0 ? void 0 : user.other) === null || _c === void 0 ? void 0 : _c.id_customer);
                     return [4 /*yield*/, ensureConversation(input, 'codex', context === null || context === void 0 ? void 0 : context.id_user)];
@@ -1608,7 +1646,12 @@ function executeAiAssistantCodexRun(payload, context) {
                     })];
                 case 12:
                     changeHistoryFastPath = _e.sent();
-                    if (!changeHistoryFastPath) return [3 /*break*/, 16];
+                    changeHistoryFastPathBypassedReason = (changeHistoryFastPath
+                        && (changeHistoryFastPath.reason === 'no_repo' || changeHistoryFastPath.reason === 'error')
+                        && !shouldReturnAssistantChangeHistoryUnavailableFastPath())
+                        ? changeHistoryFastPath.reason
+                        : '';
+                    if (!(changeHistoryFastPath && !changeHistoryFastPathBypassedReason)) return [3 /*break*/, 16];
                     userMsg = {
                         id_conversation: conversation._id,
                         role: 'user',
@@ -1781,6 +1824,11 @@ function executeAiAssistantCodexRun(payload, context) {
                                     contextRoute = normalizeOptionalString((_k = input === null || input === void 0 ? void 0 : input.context) === null || _k === void 0 ? void 0 : _k.route);
                                     contextMode = normalizeOptionalString((_l = input === null || input === void 0 ? void 0 : input.context) === null || _l === void 0 ? void 0 : _l.mode);
                                     recordStep('Queued', { requestId: requestId || undefined });
+                                    if (changeHistoryFastPathBypassedReason) {
+                                        recordStep('Planning: change-history fast path unavailable', {
+                                            reason: changeHistoryFastPathBypassedReason
+                                        });
+                                    }
                                     recordStep('Planning: request classification', {
                                         type: requestClassification.type,
                                         source: requestClassification.source,
@@ -1880,7 +1928,8 @@ function executeAiAssistantCodexRun(payload, context) {
                                         fieldHints: fieldHints,
                                         methodHints: methodHints,
                                         publicationHints: publicationHints,
-                                        recentToolError: recentToolError
+                                        recentToolError: recentToolError,
+                                        changeHistoryFastPathBypassedReason: changeHistoryFastPathBypassedReason
                                     });
                                     heuristicDirectivePrecomputed = dataQuestion
                                         ? buildAssistantHeuristicDirective(message, collectionHints, collectionNames)
@@ -2408,7 +2457,7 @@ function executeAiAssistantCodexRun(payload, context) {
                                         });
                                     }
                                     finalNow = new Date();
-                                    if (isSuperAdmin) {
+                                    if (canViewDebug) {
                                         finishedAt = Date.now();
                                         codexMs = timingBreakdown.directiveMs
                                             + timingBreakdown.plannerMs
@@ -2475,7 +2524,9 @@ function executeAiAssistantCodexRun(payload, context) {
                                             }
                                         });
                                     }
-                                    finalMetadata = __assign(__assign(__assign(__assign({ model: codexModel }, (codexFallbackModels.length ? { model_fallbacks: codexFallbackModels } : {})), (requestId ? { request_id: requestId } : {})), (toolResult ? { tool_result: toolResult } : {})), (assistantDebug ? { debug: assistantDebug } : {}));
+                                    finalMetadata = __assign(__assign(__assign(__assign(__assign({ model: codexModel }, (codexFallbackModels.length ? { model_fallbacks: codexFallbackModels } : {})), (requestId ? { request_id: requestId } : {})), (changeHistoryFastPathBypassedReason ? {
+                                        fast_path_change_history_bypassed_reason: changeHistoryFastPathBypassedReason
+                                    } : {})), (toolResult ? { tool_result: toolResult } : {})), (assistantDebug ? { debug: assistantDebug } : {}));
                                     finalUsage = codexUsage.total_tokens > 0 ? {
                                         model: codexModel || 'unknown',
                                         input_tokens: codexUsage.input_tokens,
@@ -2671,7 +2722,7 @@ function executeAiAssistantReportIssue(payload, context) {
 }
 function executeAiAssistantMongoRead(payload, context) {
     return __awaiter(this, void 0, void 0, function () {
-        var input, rawCollection, retryState, triedCollections, crossCollectionRetryEnabled, dbName, db, collectionResolution, collection, bridgeCollection, retryRootCollection, schemaFields, effectivePermissionView, _a, user, isSuperAdmin, customerId, fallbackMeta, baseQuery, stripped, userId, normalizedClient, shouldScopeByClient, _b, strippedClient, clientScopedQuery, scopedQuery, normalized, findOptions, runFindWithRepair, initialRead, documents, executedQuery, probeDocs, dateFallback, fallbackQuery, fallbackRead, fallbackDocs, expanded, fallbackRead, fallbackDocs, nameFallback, fallbackRead, fallbackDocs, _c, chemicalLookup, fallbackRead, fallbackDocs, queryFields, _d, aliases, rewrittenQuery, fallbackRead, fallbackDocs, _e, activeFallback, fallbackRead, fallbackDocs, _f, idLookup, fallbackRead, fallbackDocs, baseCollection, fallbackPayload, fallbackResult, existingFallbacks, hasActiveStatusFilters, crossCollectionCandidates, crossCollectionCandidates_1, crossCollectionCandidates_1_1, candidateCollection, fallbackPayload, fallbackResult, fallbackDocs, existingFallbacks, rejectedQuality, error_5, existingErrors, e_1_1, nameFields, dateFields, diagnostics, queryNoName, _g, queryNoDate, _h, _j, _k, _l, allCollections, base, alt, altCount, _m, total, sanitizedDocuments, requestedFields, missingFields, _o, projectionAliases, expandedProjection, refreshedDocs, includeIds, fieldAliases, displayDocs, idLookupDisplay, priorityFields, displayMaxRows, display;
+        var input, rawCollection, retryState, triedCollections, crossCollectionRetryEnabled, dbName, db, collectionResolution, collection, bridgeCollection, retryRootCollection, schemaFields, effectivePermissionView, _a, user, isSuperAdmin, canViewDebug, customerId, fallbackMeta, baseQuery, stripped, userId, normalizedClient, shouldScopeByClient, _b, strippedClient, clientScopedQuery, scopedQuery, normalized, findOptions, runFindWithRepair, initialRead, documents, executedQuery, probeDocs, dateFallback, fallbackQuery, fallbackRead, fallbackDocs, expanded, fallbackRead, fallbackDocs, nameFallback, fallbackRead, fallbackDocs, _c, chemicalLookup, fallbackRead, fallbackDocs, queryFields, _d, aliases, rewrittenQuery, fallbackRead, fallbackDocs, _e, activeFallback, fallbackRead, fallbackDocs, _f, idLookup, fallbackRead, fallbackDocs, baseCollection, fallbackPayload, fallbackResult, existingFallbacks, hasActiveStatusFilters, crossCollectionCandidates, crossCollectionCandidates_1, crossCollectionCandidates_1_1, candidateCollection, fallbackPayload, fallbackResult, fallbackDocs, existingFallbacks, rejectedQuality, error_5, existingErrors, e_1_1, nameFields, dateFields, diagnostics, queryNoName, _g, queryNoDate, _h, _j, _k, _l, allCollections, base, alt, altCount, _m, total, sanitizedDocuments, requestedFields, missingFields, _o, projectionAliases, expandedProjection, refreshedDocs, includeIds, fieldAliases, displayDocs, idLookupDisplay, priorityFields, displayMaxRows, display;
         var e_1, _p;
         var _this = this;
         var _q, _r;
@@ -2709,7 +2760,7 @@ function executeAiAssistantMongoRead(payload, context) {
                         : input.permissionView;
                     return [4 /*yield*/, ensureAssistantReadAccess(context, effectivePermissionView, collection)];
                 case 3:
-                    _a = _s.sent(), user = _a.user, isSuperAdmin = _a.isSuperAdmin;
+                    _a = _s.sent(), user = _a.user, isSuperAdmin = _a.isSuperAdmin, canViewDebug = _a.canViewDebug;
                     if (!isSuperAdmin && AI_ASSISTANT_BLOCKED_COLLECTIONS.has(collection)) {
                         throw new Error('AI assistant report builder bridge: Access denied.');
                     }
@@ -3039,7 +3090,7 @@ function executeAiAssistantMongoRead(payload, context) {
                 case 33:
                     fallbackResult = _s.sent();
                     if (Array.isArray(fallbackResult === null || fallbackResult === void 0 ? void 0 : fallbackResult.documents) && fallbackResult.documents.length) {
-                        if (isSuperAdmin && (fallbackResult === null || fallbackResult === void 0 ? void 0 : fallbackResult.debug) && typeof fallbackResult.debug === 'object') {
+                        if (canViewDebug && (fallbackResult === null || fallbackResult === void 0 ? void 0 : fallbackResult.debug) && typeof fallbackResult.debug === 'object') {
                             existingFallbacks = fallbackResult.debug.fallbacks && typeof fallbackResult.debug.fallbacks === 'object'
                                 ? fallbackResult.debug.fallbacks
                                 : {};
@@ -3051,7 +3102,7 @@ function executeAiAssistantMongoRead(payload, context) {
                         }
                         return [2 /*return*/, fallbackResult];
                     }
-                    if (isSuperAdmin) {
+                    if (canViewDebug) {
                         fallbackMeta.reportFallback = { from: collection, to: baseCollection, attempted: true, used: false };
                     }
                     _s.label = 34;
@@ -3092,7 +3143,7 @@ function executeAiAssistantMongoRead(payload, context) {
                     fallbackResult = _s.sent();
                     fallbackDocs = Array.isArray(fallbackResult === null || fallbackResult === void 0 ? void 0 : fallbackResult.documents) ? fallbackResult.documents : [];
                     if (fallbackDocs.length && shouldAcceptAssistantFallbackDocuments(fallbackDocs)) {
-                        if (isSuperAdmin && (fallbackResult === null || fallbackResult === void 0 ? void 0 : fallbackResult.debug) && typeof fallbackResult.debug === 'object') {
+                        if (canViewDebug && (fallbackResult === null || fallbackResult === void 0 ? void 0 : fallbackResult.debug) && typeof fallbackResult.debug === 'object') {
                             existingFallbacks = fallbackResult.debug.fallbacks && typeof fallbackResult.debug.fallbacks === 'object'
                                 ? fallbackResult.debug.fallbacks
                                 : {};
@@ -3106,7 +3157,7 @@ function executeAiAssistantMongoRead(payload, context) {
                         }
                         return [2 /*return*/, fallbackResult];
                     }
-                    if (fallbackDocs.length && isSuperAdmin && fallbackMeta.collectionRetry && typeof fallbackMeta.collectionRetry === 'object') {
+                    if (fallbackDocs.length && canViewDebug && fallbackMeta.collectionRetry && typeof fallbackMeta.collectionRetry === 'object') {
                         rejectedQuality = Array.isArray(fallbackMeta.collectionRetry.rejectedQuality)
                             ? fallbackMeta.collectionRetry.rejectedQuality
                             : [];
@@ -3146,7 +3197,7 @@ function executeAiAssistantMongoRead(payload, context) {
                     return [7 /*endfinally*/];
                 case 45: return [3 /*break*/, 47];
                 case 46:
-                    if (!documents.length && crossCollectionRetryEnabled && hasActiveStatusFilters && isSuperAdmin) {
+                    if (!documents.length && crossCollectionRetryEnabled && hasActiveStatusFilters && canViewDebug) {
                         fallbackMeta.collectionRetry = {
                             from: collection,
                             root: retryRootCollection,
@@ -3157,7 +3208,7 @@ function executeAiAssistantMongoRead(payload, context) {
                     }
                     _s.label = 47;
                 case 47:
-                    if (!(!documents.length && isSuperAdmin)) return [3 /*break*/, 64];
+                    if (!(!documents.length && canViewDebug)) return [3 /*break*/, 64];
                     nameFields = collectMatchFieldsByCondition(executedQuery, function (field, condition) { return isRegexMatchCondition(condition)
                         || (typeof condition === 'string' && shouldApplyAssistantNameRegex(field)); });
                     dateFields = collectMatchFieldsByCondition(executedQuery, function (_field, condition) { return isDateCondition(condition); });
@@ -3328,7 +3379,7 @@ function executeAiAssistantMongoRead(payload, context) {
                     if (Object.keys(fieldAliases).length) {
                         fallbackMeta.fieldAliases = fieldAliases;
                     }
-                    return [2 /*return*/, __assign({ documents: sanitizedDocuments, total: total, display: display }, (isSuperAdmin ? {
+                    return [2 /*return*/, __assign({ documents: sanitizedDocuments, total: total, display: display }, (canViewDebug ? {
                             debug: {
                                 collection: collection,
                                 collectionRequested: rawCollection,
@@ -3350,7 +3401,7 @@ function executeAiAssistantMongoRead(payload, context) {
 }
 function executeAiAssistantMongoAggregate(payload, context) {
     return __awaiter(this, void 0, void 0, function () {
-        var input, rawCollection, retryState, triedCollections, crossCollectionRetryEnabled, dbName, db, collectionResolution, collection, bridgeCollection, retryRootCollection, schemaFields, effectivePermissionView, _a, user, isSuperAdmin, customerId, fallbackMeta, baseQuery, stripped, userId, normalizedClient, shouldScopeByClient, _b, clientScopedQuery, scopedQuery, normalizedPipeline, sanitizedPipeline, strippedPipeline, pipelineWithScope, normalizedOptions, limitedPipeline, executedPipeline, dateField, aggregateOptions, runAggregateWithRepair, initialAggregate, documents, probeDocs, fallback, fallbackPipeline, fallbackAggregate, fallbackDocs, createdFallback, createdPipeline, createdAggregate, createdDocs, expanded, expandedAggregate, expandedDocs, completionFallback, fallbackPipeline, fallbackAggregate, fallbackDocs, completionExprFallback, fallbackPipeline, fallbackAggregate, fallbackDocs, unwindFallback, shouldUnwind, _c, _d, fallbackPipeline, fallbackAggregate, fallbackDocs, nameFallback, fallbackPipeline, fallbackAggregate, fallbackDocs, _e, _loop_1, i, state_1, matchFields_1, _f, aliases, rewrittenPipeline, fallbackAggregate, fallbackDocs, _loop_2, i, state_2, nestedFallbacks, nestedFallbacks_1, nestedFallbacks_1_1, nestedFallback, fallbackPayload, fallbackResult, existingFallbacks, error_7, errorMessage, existingErrors, e_2_1, baseCollection, fallbackPayload, fallbackResult, existingFallbacks, fallbackAcceptanceOptions, crossCollectionCandidates, crossCollectionCandidates_2, crossCollectionCandidates_2_1, candidateCollection, fallbackPayload, fallbackResult, fallbackDocs, fallbackQuality, existingFallbacks, rejectedQuality, error_8, existingErrors, e_3_1, matchStages, diagnostics, combinedMatch, nameFields, dateFields, queryNoName, _g, queryNoDate, _h, _j, _k, _l, allCollections, base, alt, altCount, _m, verification, sanitizedDocuments, includeIds, displayDocs, idLookupDisplay, display;
+        var input, rawCollection, retryState, triedCollections, crossCollectionRetryEnabled, dbName, db, collectionResolution, collection, bridgeCollection, retryRootCollection, schemaFields, effectivePermissionView, _a, user, isSuperAdmin, canViewDebug, customerId, fallbackMeta, baseQuery, stripped, userId, normalizedClient, shouldScopeByClient, _b, clientScopedQuery, scopedQuery, normalizedPipeline, sanitizedPipeline, strippedPipeline, pipelineWithScope, normalizedOptions, limitedPipeline, executedPipeline, dateField, aggregateOptions, runAggregateWithRepair, initialAggregate, documents, probeDocs, fallback, fallbackPipeline, fallbackAggregate, fallbackDocs, createdFallback, createdPipeline, createdAggregate, createdDocs, expanded, expandedAggregate, expandedDocs, completionFallback, fallbackPipeline, fallbackAggregate, fallbackDocs, completionExprFallback, fallbackPipeline, fallbackAggregate, fallbackDocs, unwindFallback, shouldUnwind, _c, _d, fallbackPipeline, fallbackAggregate, fallbackDocs, nameFallback, fallbackPipeline, fallbackAggregate, fallbackDocs, _e, _loop_1, i, state_1, matchFields_1, _f, aliases, rewrittenPipeline, fallbackAggregate, fallbackDocs, _loop_2, i, state_2, nestedFallbacks, nestedFallbacks_1, nestedFallbacks_1_1, nestedFallback, fallbackPayload, fallbackResult, existingFallbacks, error_7, errorMessage, existingErrors, e_2_1, baseCollection, fallbackPayload, fallbackResult, existingFallbacks, fallbackAcceptanceOptions, crossCollectionCandidates, crossCollectionCandidates_2, crossCollectionCandidates_2_1, candidateCollection, fallbackPayload, fallbackResult, fallbackDocs, fallbackQuality, existingFallbacks, rejectedQuality, error_8, existingErrors, e_3_1, matchStages, diagnostics, combinedMatch, nameFields, dateFields, queryNoName, _g, queryNoDate, _h, _j, _k, _l, allCollections, base, alt, altCount, _m, verification, sanitizedDocuments, includeIds, displayDocs, idLookupDisplay, display;
         var e_2, _o, e_3, _p;
         var _this = this;
         var _q, _r;
@@ -3388,7 +3439,7 @@ function executeAiAssistantMongoAggregate(payload, context) {
                         : input.permissionView;
                     return [4 /*yield*/, ensureAssistantReadAccess(context, effectivePermissionView, collection)];
                 case 3:
-                    _a = _s.sent(), user = _a.user, isSuperAdmin = _a.isSuperAdmin;
+                    _a = _s.sent(), user = _a.user, isSuperAdmin = _a.isSuperAdmin, canViewDebug = _a.canViewDebug;
                     if (!isSuperAdmin && AI_ASSISTANT_BLOCKED_COLLECTIONS.has(collection)) {
                         throw new Error('AI assistant report builder bridge: Access denied.');
                     }
@@ -3952,7 +4003,7 @@ function executeAiAssistantMongoAggregate(payload, context) {
                 case 47:
                     fallbackResult = _s.sent();
                     if (Array.isArray(fallbackResult === null || fallbackResult === void 0 ? void 0 : fallbackResult.documents) && fallbackResult.documents.length) {
-                        if (isSuperAdmin && (fallbackResult === null || fallbackResult === void 0 ? void 0 : fallbackResult.debug) && typeof fallbackResult.debug === 'object') {
+                        if (canViewDebug && (fallbackResult === null || fallbackResult === void 0 ? void 0 : fallbackResult.debug) && typeof fallbackResult.debug === 'object') {
                             existingFallbacks = fallbackResult.debug.fallbacks && typeof fallbackResult.debug.fallbacks === 'object'
                                 ? fallbackResult.debug.fallbacks
                                 : {};
@@ -4008,7 +4059,7 @@ function executeAiAssistantMongoAggregate(payload, context) {
                 case 55:
                     fallbackResult = _s.sent();
                     if (Array.isArray(fallbackResult === null || fallbackResult === void 0 ? void 0 : fallbackResult.documents) && fallbackResult.documents.length) {
-                        if (isSuperAdmin && (fallbackResult === null || fallbackResult === void 0 ? void 0 : fallbackResult.debug) && typeof fallbackResult.debug === 'object') {
+                        if (canViewDebug && (fallbackResult === null || fallbackResult === void 0 ? void 0 : fallbackResult.debug) && typeof fallbackResult.debug === 'object') {
                             existingFallbacks = fallbackResult.debug.fallbacks && typeof fallbackResult.debug.fallbacks === 'object'
                                 ? fallbackResult.debug.fallbacks
                                 : {};
@@ -4020,7 +4071,7 @@ function executeAiAssistantMongoAggregate(payload, context) {
                         }
                         return [2 /*return*/, fallbackResult];
                     }
-                    if (isSuperAdmin) {
+                    if (canViewDebug) {
                         fallbackMeta.reportFallback = { from: collection, to: baseCollection, attempted: true, used: false };
                     }
                     _s.label = 56;
@@ -4062,7 +4113,7 @@ function executeAiAssistantMongoAggregate(payload, context) {
                     fallbackDocs = Array.isArray(fallbackResult === null || fallbackResult === void 0 ? void 0 : fallbackResult.documents) ? fallbackResult.documents : [];
                     fallbackQuality = evaluateAssistantFallbackDocumentsQuality(fallbackDocs, fallbackAcceptanceOptions);
                     if (fallbackDocs.length && fallbackQuality.accepted) {
-                        if (isSuperAdmin && (fallbackResult === null || fallbackResult === void 0 ? void 0 : fallbackResult.debug) && typeof fallbackResult.debug === 'object') {
+                        if (canViewDebug && (fallbackResult === null || fallbackResult === void 0 ? void 0 : fallbackResult.debug) && typeof fallbackResult.debug === 'object') {
                             existingFallbacks = fallbackResult.debug.fallbacks && typeof fallbackResult.debug.fallbacks === 'object'
                                 ? fallbackResult.debug.fallbacks
                                 : {};
@@ -4076,7 +4127,7 @@ function executeAiAssistantMongoAggregate(payload, context) {
                         }
                         return [2 /*return*/, fallbackResult];
                     }
-                    if (fallbackDocs.length && isSuperAdmin && fallbackMeta.collectionRetry && typeof fallbackMeta.collectionRetry === 'object') {
+                    if (fallbackDocs.length && canViewDebug && fallbackMeta.collectionRetry && typeof fallbackMeta.collectionRetry === 'object') {
                         rejectedQuality = Array.isArray(fallbackMeta.collectionRetry.rejectedQuality)
                             ? fallbackMeta.collectionRetry.rejectedQuality
                             : [];
@@ -4120,7 +4171,7 @@ function executeAiAssistantMongoAggregate(payload, context) {
                     finally { if (e_3) throw e_3.error; }
                     return [7 /*endfinally*/];
                 case 67:
-                    if (!(!documents.length && isSuperAdmin)) return [3 /*break*/, 84];
+                    if (!(!documents.length && canViewDebug)) return [3 /*break*/, 84];
                     matchStages = (executedPipeline || []).filter(function (stage) { return stage && typeof stage === 'object' && stage.$match && typeof stage.$match === 'object'; });
                     diagnostics = {};
                     if (!matchStages.length) return [3 /*break*/, 84];
@@ -4241,7 +4292,7 @@ function executeAiAssistantMongoAggregate(payload, context) {
                         maxRows: normalizedOptions.limit || sanitizedDocuments.length,
                         includeGroupFromId: false
                     });
-                    return [2 /*return*/, __assign(__assign({ documents: sanitizedDocuments, display: display }, (verification ? { verification: verification } : {})), (isSuperAdmin ? {
+                    return [2 /*return*/, __assign(__assign({ documents: sanitizedDocuments, display: display }, (verification ? { verification: verification } : {})), (canViewDebug ? {
                             debug: __assign(__assign({ collection: collection, collectionRequested: rawCollection, collectionResolved: collection, collectionMatched: collectionResolution.matched, collectionCandidates: collectionResolution.candidates, collectionScore: collectionResolution.score, bridge: 'report-builder', database: dbName, query: scopedQuery, options: normalizedOptions.aggregateOptions, originalPipeline: limitedPipeline, executedPipeline: executedPipeline }, (verification ? { verification: verification } : {})), { fallbacks: fallbackMeta })
                         } : {}))];
             }
@@ -9636,7 +9687,7 @@ function isDisplayObjectLike(value) {
 }
 function ensureAssistantReadAccess(context, permissionView, collection) {
     return __awaiter(this, void 0, void 0, function () {
-        var idUser, user, isSuperAdmin, normalizedCollection, normalizedPermission, requiresInvoiceAccess, hasInvoiceAccess, hasViewAccess;
+        var idUser, user, isSuperAdmin, canViewDebug, normalizedCollection, normalizedPermission, requiresInvoiceAccess, hasInvoiceAccess, hasViewAccess;
         var _a;
         return __generator(this, function (_b) {
             switch (_b.label) {
@@ -9652,8 +9703,9 @@ function ensureAssistantReadAccess(context, permissionView, collection) {
                         throw new Error('AI assistant report builder bridge: Unauthorized.');
                     }
                     isSuperAdmin = !!((_a = user === null || user === void 0 ? void 0 : user.roles) === null || _a === void 0 ? void 0 : _a.super_admin);
+                    canViewDebug = isAssistantDebugUser(user);
                     if (isSuperAdmin) {
-                        return [2 /*return*/, { user: user, isSuperAdmin: isSuperAdmin }];
+                        return [2 /*return*/, { user: user, isSuperAdmin: isSuperAdmin, canViewDebug: canViewDebug }];
                     }
                     normalizedCollection = normalizeOptionalString(collection);
                     normalizedPermission = normalizeAssistantPermissionView(permissionView, normalizedCollection);
@@ -9669,7 +9721,7 @@ function ensureAssistantReadAccess(context, permissionView, collection) {
                     if (requiresInvoiceAccess && !hasInvoiceAccess) {
                         throw new Error('AI assistant report builder bridge: Access denied.');
                     }
-                    return [2 /*return*/, { user: user, isSuperAdmin: isSuperAdmin }];
+                    return [2 /*return*/, { user: user, isSuperAdmin: isSuperAdmin, canViewDebug: canViewDebug }];
             }
         });
     });
@@ -16845,6 +16897,11 @@ function parseAssistantPathList(value) {
         .map(function (entry) { return normalizeOptionalString(entry); })
         .filter(Boolean);
 }
+function resolveAssistantConfiguredWorkspaceRoots(serverConfigParam, envParam) {
+    var serverConfig = serverConfigParam || resolveio_server_app_1.ResolveIOServer.getServerConfig() || {};
+    var env = envParam || process.env || {};
+    return mergeAssistantHintValues(parseAssistantPathList(serverConfig['AI_ASSISTANT_WORKSPACE_ROOTS']), parseAssistantPathList(env['AI_ASSISTANT_WORKSPACE_ROOTS']), parseAssistantPathList(serverConfig['AI_ASSISTANT_GIT_ROOTS']), parseAssistantPathList(env['AI_ASSISTANT_GIT_ROOTS']), parseAssistantPathList(serverConfig['AI_ASSISTANT_WORKSPACE_ROOT']), parseAssistantPathList(env['AI_ASSISTANT_WORKSPACE_ROOT']), parseAssistantPathList(serverConfig['AI_ASSISTANT_ROOT_WORKSPACE']), parseAssistantPathList(env['AI_ASSISTANT_ROOT_WORKSPACE']), parseAssistantPathList(serverConfig['AI_TERMINAL_WORKSPACE_ROOT']), parseAssistantPathList(env['AI_TERMINAL_WORKSPACE_ROOT']), parseAssistantPathList(serverConfig['AI_DASHBOARD_WORKSPACE_ROOT']), parseAssistantPathList(env['AI_DASHBOARD_WORKSPACE_ROOT']));
+}
 function buildAssistantParentDirectoryCandidates(basePath, maxDepth) {
     if (maxDepth === void 0) { maxDepth = 4; }
     var normalized = normalizeOptionalString(basePath);
@@ -16869,7 +16926,7 @@ function buildAssistantWorkspaceRootCandidates(params) {
     var cwdValue = normalizeOptionalString((params === null || params === void 0 ? void 0 : params.cwd) || process.cwd());
     var dirnameValue = normalizeOptionalString((params === null || params === void 0 ? void 0 : params.dirname) || __dirname);
     var homeDir = normalizeOptionalString(os.homedir());
-    var configuredRoots = mergeAssistantHintValues(parseAssistantPathList(serverConfig['AI_ASSISTANT_WORKSPACE_ROOTS']), parseAssistantPathList(env['AI_ASSISTANT_WORKSPACE_ROOTS']), parseAssistantPathList(serverConfig['AI_ASSISTANT_GIT_ROOTS']), parseAssistantPathList(env['AI_ASSISTANT_GIT_ROOTS']));
+    var configuredRoots = resolveAssistantConfiguredWorkspaceRoots(serverConfig, env);
     var pathCandidates = __spreadArray(__spreadArray(__spreadArray([
         serverConfig['AI_ASSISTANT_WORKSPACE_ROOT'],
         env['AI_ASSISTANT_WORKSPACE_ROOT'],
@@ -16904,20 +16961,21 @@ function buildAssistantWorkspaceRootCandidates(params) {
 }
 function resolveAssistantWorkspaceRoot() {
     return __awaiter(this, void 0, void 0, function () {
-        var candidates, firstExisting, candidates_8, candidates_8_1, candidate, _a, gitRoot, e_44_1;
+        var candidates, firstExisting, firstNestedGitRoot, candidates_8, candidates_8_1, candidate, _a, gitRoot, nestedGitRoots, e_44_1;
         var e_44, _b;
         return __generator(this, function (_c) {
             switch (_c.label) {
                 case 0:
                     candidates = buildAssistantWorkspaceRootCandidates();
                     firstExisting = '';
+                    firstNestedGitRoot = '';
                     _c.label = 1;
                 case 1:
-                    _c.trys.push([1, 8, 9, 10]);
+                    _c.trys.push([1, 9, 10, 11]);
                     candidates_8 = __values(candidates), candidates_8_1 = candidates_8.next();
                     _c.label = 2;
                 case 2:
-                    if (!!candidates_8_1.done) return [3 /*break*/, 7];
+                    if (!!candidates_8_1.done) return [3 /*break*/, 8];
                     candidate = candidates_8_1.value;
                     _a = !candidate;
                     if (_a) return [3 /*break*/, 4];
@@ -16927,7 +16985,7 @@ function resolveAssistantWorkspaceRoot() {
                     _c.label = 4;
                 case 4:
                     if (_a) {
-                        return [3 /*break*/, 6];
+                        return [3 /*break*/, 7];
                     }
                     if (!firstExisting) {
                         firstExisting = candidate;
@@ -16936,24 +16994,34 @@ function resolveAssistantWorkspaceRoot() {
                 case 5:
                     gitRoot = _c.sent();
                     if (gitRoot) {
-                        return [2 /*return*/, candidate];
+                        return [2 /*return*/, gitRoot];
                     }
-                    _c.label = 6;
+                    if (!!firstNestedGitRoot) return [3 /*break*/, 7];
+                    return [4 /*yield*/, resolveAssistantWorkspaceGitRoots(candidate)];
                 case 6:
+                    nestedGitRoots = _c.sent();
+                    if (nestedGitRoots.length) {
+                        firstNestedGitRoot = nestedGitRoots[0];
+                    }
+                    _c.label = 7;
+                case 7:
                     candidates_8_1 = candidates_8.next();
                     return [3 /*break*/, 2];
-                case 7: return [3 /*break*/, 10];
-                case 8:
+                case 8: return [3 /*break*/, 11];
+                case 9:
                     e_44_1 = _c.sent();
                     e_44 = { error: e_44_1 };
-                    return [3 /*break*/, 10];
-                case 9:
+                    return [3 /*break*/, 11];
+                case 10:
                     try {
                         if (candidates_8_1 && !candidates_8_1.done && (_b = candidates_8.return)) _b.call(candidates_8);
                     }
                     finally { if (e_44) throw e_44.error; }
                     return [7 /*endfinally*/];
-                case 10:
+                case 11:
+                    if (firstNestedGitRoot) {
+                        return [2 /*return*/, firstNestedGitRoot];
+                    }
                     if (firstExisting) {
                         return [2 /*return*/, firstExisting];
                     }
@@ -17730,6 +17798,11 @@ function buildAssistantContext(input, userContext) {
     if (recentToolError) {
         lines.push("Most recent data-query error: ".concat(recentToolError));
     }
+    var changeHistoryBypassReason = normalizeOptionalString(userContext === null || userContext === void 0 ? void 0 : userContext.changeHistoryFastPathBypassedReason);
+    if (changeHistoryBypassReason) {
+        lines.push("Change history fast path unavailable: ".concat(changeHistoryBypassReason));
+        lines.push('For change-history requests, run git history lookups through available repository tooling before concluding history is unavailable.');
+    }
     var mongoDb = normalizeOptionalString((_c = input === null || input === void 0 ? void 0 : input.mongo) === null || _c === void 0 ? void 0 : _c.database);
     var mongoDbs = Array.isArray((_d = input === null || input === void 0 ? void 0 : input.mongo) === null || _d === void 0 ? void 0 : _d.databases)
         ? input.mongo.databases.map(function (value) { return normalizeOptionalString(value); }).filter(Boolean)
@@ -18695,7 +18768,7 @@ function resolveAssistantWorkspaceGitRoots(workspaceRoot) {
                     return [4 /*yield*/, resolveAssistantGitRoot(workspaceRoot)];
                 case 1:
                     _a.apply(void 0, [_h.sent()]);
-                    configuredRoots = mergeAssistantHintValues(parseAssistantPathList(process.env.AI_ASSISTANT_GIT_ROOTS), parseAssistantPathList(process.env.AI_ASSISTANT_WORKSPACE_ROOTS));
+                    configuredRoots = resolveAssistantConfiguredWorkspaceRoots();
                     _h.label = 2;
                 case 2:
                     _h.trys.push([2, 7, 8, 9]);
@@ -18977,6 +19050,12 @@ function buildAssistantChangeHistoryUnavailableResponse(message, reason) {
         generic: true
     };
 }
+function shouldReturnAssistantChangeHistoryUnavailableFastPath() {
+    var config = resolveio_server_app_1.ResolveIOServer.getServerConfig() || {};
+    var configured = normalizeOptionalBoolean(config['AI_ASSISTANT_CHANGE_HISTORY_UNAVAILABLE_FAST_PATH']
+        || process.env.AI_ASSISTANT_CHANGE_HISTORY_UNAVAILABLE_FAST_PATH);
+    return configured === true;
+}
 function resolveAssistantChangeHistoryGitRepoUrls() {
     var serverConfig = resolveio_server_app_1.ResolveIOServer.getServerConfig() || {};
     var rawValues = [
@@ -19471,6 +19550,10 @@ function sanitizeAssistantResponse(value) {
 function evaluateAssistantGuardrails(message) {
     var e_52, _a;
     var normalized = String(message || '').toLowerCase();
+    var identityGuardrail = evaluateAssistantIdentityDisclosureGuardrail(normalized);
+    if (identityGuardrail === null || identityGuardrail === void 0 ? void 0 : identityGuardrail.blocked) {
+        return identityGuardrail;
+    }
     var patterns = [
         {
             pattern: /\b(show|share|paste|provide|dump|output)\b.*\b(code|snippet|file|function|class|script|sql)\b/i,
@@ -20339,6 +20422,10 @@ function estimateUsage(messages, responseText, model) {
 function evaluateGuardrails(message) {
     var e_56, _a;
     var normalized = String(message || '').toLowerCase();
+    var identityGuardrail = evaluateAssistantIdentityDisclosureGuardrail(normalized);
+    if (identityGuardrail === null || identityGuardrail === void 0 ? void 0 : identityGuardrail.blocked) {
+        return identityGuardrail;
+    }
     var patterns = [
         { pattern: /\b(source\s*code|full\s*code|entire\s*code|repo\s*dump|repository|git\s*clone)\b/i, reason: 'Code access is restricted.' },
         { pattern: /\b(show|share|paste|provide|dump|output)\b.*\b(code|file|contents|snippet)\b/i, reason: 'Code access is restricted.' },
@@ -20368,6 +20455,34 @@ function evaluateGuardrails(message) {
     }
     return null;
 }
+function evaluateAssistantIdentityDisclosureGuardrail(message) {
+    var normalized = String(message || '').toLowerCase();
+    if (!normalized) {
+        return null;
+    }
+    var patterns = [
+        /\b(?:what|which)\s+(?:ai|model|llm)\b/i,
+        /\b(?:what|which)\s+(?:model|engine|provider)\s+(?:are|is)\s+(?:you|this|it)\s+using\b/i,
+        /\b(?:are\s+you|is\s+(?:this|it))\s+(?:codex|gpt|openai)\b/i,
+        /\b(?:run(?:ning)?\s+locally|local(?:ly)?\s+(?:model|runtime|instance))\b/i,
+        /\b(?:model|ai|assistant)\s+version\b/i,
+        /\bwhat\s+version\s+are\s+you\b/i,
+        /\bwhat\s+version\s+is\s+(?:this|it)\b/i,
+        /\bsystem\s+prompt\b/i
+    ];
+    if (!patterns.some(function (pattern) { return pattern.test(normalized); })) {
+        return null;
+    }
+    return {
+        blocked: true,
+        reason: 'Assistant identity/runtime details are restricted.',
+        response: 'I can’t share details about the underlying AI model, provider, runtime environment, or version.'
+    };
+}
+function isAssistantDebugUser(user) {
+    var username = normalizeOptionalString(user === null || user === void 0 ? void 0 : user.username).toLowerCase();
+    return username === 'admin';
+}
 function resolveIsSuperAdmin(id_user) {
     return __awaiter(this, void 0, void 0, function () {
         var user, _a;