@sigrun/sigrun 0.1.5 → 0.2.0

package/dist/server/routes/settings-sections.js

@@ -0,0 +1,190 @@
+/**
+ * The settings sections route (UI-blocks U4 Task 4, spec §13.4):
+ * `GET /v1/settings/sections` serves the settings panel's nav list and
+ * the search index in one payload —
+ *
+ * ```
+ * {
+ *   sections: { slug, id, title, icon }[],        // core first, then extensions alphabetically
+ *   index: { sectionId, slug, label, help, kind }[]  // every searchable row
+ * }
+ * ```
+ *
+ * The search index carries one row per core SETTINGS key (registry-driven —
+ * `src/settings/registry.ts`, with the section + labels resolved from
+ * `src/settings/core-sections.ts`), one row per extension-declared
+ * section field (labels + help walked out of the form trees), and one
+ * row per core section title (so "interface" lands somewhere). Section
+ * trees are static per extension version, so the index builds ONCE per
+ * request from the loaded bindings (cheap: the forms are small), never
+ * persisted.
+ */
+import { isSuperuser } from "../auth/principal.js";
+import { CORE_SECTION_IDS, CORE_SETTINGS_SECTIONS, } from "../../settings/core-sections.js";
+import { CORE_SETTING_KEYS } from "../../settings/registry.js";
+function isRec(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+ * Yield every field-ish node of one settings form: a record carrying a
+ * string `name` and a `type` that is a FIELD type (not a container).
+ * Walks `root`/`children`/`fields`/`item` — the loader-validated tree's
+ * only nesting paths.
+ */
+function* walkFields(tree) {
+    const stack = [tree];
+    while (stack.length > 0) {
+        const node = stack.pop();
+        if (Array.isArray(node)) {
+            stack.push(...node);
+            continue;
+        }
+        if (!isRec(node))
+            continue;
+        for (const key of ["children", "fields", "root", "item"]) {
+            if (node[key] !== undefined)
+                stack.push(node[key]);
+        }
+        if (typeof node.name === "string" && typeof node.type === "string") {
+            const type = node.type;
+            if (type !== "section" && type !== "form" && type !== "page" && type !== "stack") {
+                yield {
+                    name: node.name,
+                    label: typeof node.label === "string" ? node.label : node.name,
+                    ...(typeof node.help === "string" ? { help: node.help } : {}),
+                };
+            }
+        }
+    }
+}
+/** The core field a key renders as, plus the section it renders IN
+ *  (the section id comes from the WALK — the section the field
+ *  actually renders under — never from the registry's `section`
+ *  metadata, which drifts from where fields land: the retry and
+ *  stream keys say `general` but render under Advanced). A key no core section
+ *  renders has no row (the index covers only what the panel shows). */
+function coreFieldEntry(key) {
+    for (const section of CORE_SETTINGS_SECTIONS) {
+        for (const field of walkFields(section.form)) {
+            if (field.name === key) {
+                return {
+                    sectionId: section.id,
+                    label: field.label,
+                    ...(field.help === undefined ? {} : { help: field.help }),
+                };
+            }
+        }
+    }
+    return undefined;
+}
+/** The index entry for one core registry key. */
+function coreKeyEntry(key) {
+    const registryEntry = CORE_SETTING_KEYS.find((entry) => entry.key === key);
+    if (registryEntry === undefined)
+        return undefined;
+    const field = coreFieldEntry(key);
+    if (field === undefined)
+        return undefined;
+    return {
+        slug: "core",
+        sectionId: field.sectionId,
+        kind: "core-key",
+        label: field.label,
+        ...(field.help === undefined ? {} : { help: field.help }),
+        key,
+    };
+}
+/** Build the section list + search index from the boot's bindings. */
+export function buildSettingsSections(extensionSections) {
+    const sections = CORE_SETTINGS_SECTIONS.map((section) => ({
+        slug: "core",
+        id: section.id,
+        title: section.title,
+        icon: section.icon ?? "key",
+    }));
+    const sorted = [...extensionSections].sort((a, b) => a.extension.localeCompare(b.extension));
+    for (const binding of sorted) {
+        for (const def of binding.defs) {
+            sections.push({
+                slug: binding.extension,
+                id: def.id,
+                title: def.title,
+                icon: def.icon ?? "key",
+                ...(def.scope === "user" ? { scope: "user" } : {}),
+                ...(def.scope === "user" ? { admin: def.admin === true } : {}),
+            });
+        }
+    }
+    const index = [];
+    // Core section titles (a hit on the title lands on the section).
+    for (const [position, id] of CORE_SECTION_IDS.entries()) {
+        const section = CORE_SETTINGS_SECTIONS[position];
+        if (section === undefined)
+            continue;
+        index.push({
+            slug: "core",
+            sectionId: id,
+            kind: "section",
+            label: section.title,
+        });
+    }
+    // Core keys (registry-driven — every registry key whose section
+    // renders gets a row). Cove-rendered sections (Interface / Providers
+    // / Extensions — the channels draw them natively) drop their keys:
+    // a hit must land on a form field, and a cove has none (the search
+    // would strand the user on a section whose row it named but whose
+    // field does not exist).
+    const COVE_SECTIONS = new Set([
+        "interface",
+        "providers",
+        "extensions",
+    ]);
+    for (const entry of CORE_SETTING_KEYS) {
+        const row = coreKeyEntry(entry.key);
+        if (row === undefined)
+            continue;
+        if (COVE_SECTIONS.has(row.sectionId))
+            continue;
+        index.push(row);
+    }
+    // Extension sections: titles + every field's label/help.
+    for (const binding of sorted) {
+        for (const def of binding.defs) {
+            index.push({
+                slug: binding.extension,
+                sectionId: def.id,
+                kind: "section",
+                label: def.title,
+            });
+            for (const field of walkFields(def.form)) {
+                index.push({
+                    slug: binding.extension,
+                    sectionId: def.id,
+                    kind: "field",
+                    label: field.label,
+                    ...(field.help === undefined ? {} : { help: field.help }),
+                    key: field.name,
+                });
+            }
+        }
+    }
+    return { sections, index };
+}
+/** Register `GET /v1/settings/sections` (any authenticated principal —
+ *  U4 Task 4 fix wave: the client-only Interface prefs die with the
+ *  panel when a non-admin can't load the list; the per-section SURFACES
+ *  keep their own access gates, so a non-admin's admin-section save
+ *  still rejects 404/forbidden server-side). */
+export function registerSettingsSectionsRoutes(app, ctx) {
+    app.get("/v1/settings/sections", async (request) => {
+        const response = buildSettingsSections(ctx.opened.extensionSettingsSections);
+        const admin = isSuperuser(request.principal) || request.principal.admin;
+        const allowed = new Set(response.sections
+            .filter((section) => section.scope !== "user" || section.admin !== true || admin)
+            .map((section) => `${section.slug}\u0000${section.id}`));
+        return {
+            sections: response.sections.filter((section) => allowed.has(`${section.slug}\u0000${section.id}`)),
+            index: response.index.filter((entry) => allowed.has(`${entry.slug}\u0000${entry.sectionId}`)),
+        };
+    });
+}

package/dist/server/routes/settings.js

@@ -1,8 +1,11 @@
 /**
  * Settings routes over the file-backed store on the harness's live
  * settings (pi parity): GET serves the current effective settings
- * (absent file = `{}` — every default); PATCH validates + merges +
- * persists through the store.
+ * (absent file = `{}` — every default) plus the pending-restart diff
+ * (U4 §13.2); PATCH validates + merges + persists through the store's
+ * `apply()` — the write classifies live vs. restart against the §13.1
+ * registry, reports both, and publishes `settings.changed` after the
+ * write commits.
  */
 import { SettingsValidationError } from "../../harness/settings.js";
 import { settingsResponse } from "../helpers.js";
@@ -33,8 +36,17 @@ export function registerSettingsRoutes(app, ctx) {
             return await reply.code(400).send({ error: "invalid_body" });
         }
         try {
-            opened.settings.update(body);
-            return settingsResponse(opened, config, env);
+            const outcome = opened.settings.apply(body);
+            // §13.2: the store's onWrite observer (boot's settings-changed
+            // sink) published `settings.changed` when the write committed —
+            // hub publication, extension onSettingsChanged fan-out, and the
+            // scheduler re-arm all ride that ONE seam, so the route only
+            // reports the write's own classification here. Observer errors
+            // never fail the write (§13.2's caught-and-logged rule).
+            return settingsResponse(opened, config, env, {
+                applied: outcome.applied,
+                pending: outcome.pending,
+            });
         }
         catch (error) {
             if (error instanceof SettingsValidationError) {

package/dist/server/routes/submissions.js

@@ -96,7 +96,7 @@ export function registerSubmissionRoutes(app, ctx) {
     // The shared configure op (gateway C4a) is the SAME code path the
     // extension host bridge drives — the validation order and error bodies
     // moved verbatim into the op; this route owns the HTTP mapping only.
-    // v1 accepts EXACTLY `model` + `thinking` — any other key is a fail-loud
+    // Configure accepts `model` + `thinking` + `extensions` — any other key is a fail-loud
     // 400 (the agent's other knobs are not wire surface yet).
     app.post("/v1/conversations/:id/configure", { schema: { params: ID_PARAMS_SCHEMA }, preHandler: loadConversation(ctx, "write") }, async (request, reply) => {
         try {

package/dist/server/routes/surfaces.js

@@ -32,8 +32,15 @@
  * extension stays loaded.
  */
 import { PassThrough } from "node:stream";
-import { instanceKey } from "../surfaces/instance.js";
+import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
 import { ActionRateLimitedError, SurfaceFailedError, UnknownActionError, } from "../surfaces/service.js";
+import { NamedUserRequiredError } from "../surfaces/settings-surfaces.js";
+import { applyChatAction, chatActionStartsTurn, readChatBlock, resolveChatHandlers } from "../blocks/chat-surfaces.js";
+import { answerBlock } from "../blocks/answers.js";
+import { accessOf } from "@sigrun/shared/access";
+import { accessPrincipalOf } from "../auth/access-principal.js";
+import { SessionMetaDoc } from "../session-meta.js";
+import { conversationId as brandConversationId } from "../helpers.js";
 /**
  * The one upload-name rule, shared with core's conversation upload
  * route (files.ts §6.2 — kept in sync by hand): no `/` or `\\`, not
@@ -89,6 +96,9 @@ export function registerSurfaceRoutes(app, ctx) {
     const uploadCaps = new WeakMap();
     /** The shared failure mapping (logged; errors only under server.dev). */
     const failureReply = async (reply, slug, id, cause) => {
+        if (cause instanceof NamedUserRequiredError) {
+            return reply.code(400).send({ error: "named_user_required" });
+        }
         const failed = cause instanceof SurfaceFailedError
             ? cause
             : new SurfaceFailedError(cause instanceof Error ? cause.message : String(cause));
@@ -169,21 +179,16 @@ export function registerSurfaceRoutes(app, ctx) {
         }
         // The §6.5 access gate: cache or re-render decides BEFORE the
         // handler runs. A located-check first keeps unknown slugs/ids on
-        // the same 404 body without a render.
-        const binding = ctx.opened.extensionSurfaces.find((entry) => entry.extension === slug);
-        const def = binding?.defs.find((entry) => entry.id === id);
-        if (def === undefined) {
-            return await reply.code(404).send(NOT_FOUND);
-        }
-        // A throwing `instanceKey` is an extension fault: 500
-        // surface_failed, the extension stays loaded (deferred minor from
-        // Task 2 — this ran outside the try before).
+        // the same 404 body without a render; a throwing extension
+        // `instanceKey` is a 500 (the extension-fault path). The service's
+        // locate covers the settings surfaces too (spec §13.4).
         let key;
         try {
-            key =
-                def.instanceKey !== undefined
-                    ? def.instanceKey(params)
-                    : instanceKey(params);
+            const probe = surfaces.instanceKeyFor(slug, id, params, request.principal);
+            if (probe === undefined) {
+                return await reply.code(404).send(NOT_FOUND);
+            }
+            key = probe;
         }
         catch (cause) {
             return await failureReply(reply, slug, id, cause);
@@ -245,17 +250,13 @@ export function registerSurfaceRoutes(app, ctx) {
                     .code(400)
                     .send({ error: "invalid_field", field: "params" });
             }
-            const binding = ctx.opened.extensionSurfaces.find((entry) => entry.extension === slug);
-            const def = binding?.defs.find((entry) => entry.id === id);
-            if (def === undefined) {
-                return await reply.code(404).send(NOT_FOUND);
-            }
             let key;
             try {
-                key =
-                    def.instanceKey !== undefined
-                        ? def.instanceKey(parsed.params)
-                        : instanceKey(parsed.params);
+                const probe = surfaces.instanceKeyFor(slug, id, parsed.params, request.principal);
+                if (probe === undefined) {
+                    return await reply.code(404).send(NOT_FOUND);
+                }
+                key = probe;
             }
             catch (cause) {
                 return await failureReply(reply, slug, id, cause);
@@ -384,4 +385,155 @@ export function registerSurfaceRoutes(app, ctx) {
             return await failureReply(reply, slug, id, cause);
         }
     });
+    // ── Chat block surfaces (UI-blocks U5 Task 2, spec §8.2) ──────────────
+    // A chat block reuses this machinery with CORE as the handler: the
+    // address is (conversationId, entryId), access is the CONVERSATION's
+    // (write edits; read sees; hidden is 404 — indistinguishable from an
+    // unknown conversation), and ops are kept/returned like sharedData
+    // (chat data is the same for everyone who can see the conversation).
+    /** One conversation's access for the caller (§5.9; the pre-handler's
+     *  same resolution, inlined because the routes below own the body). */
+    const conversationAccess = async (id, principal) => {
+        const conversation = await ctx.opened.harness.conversation(brandConversationId(id), BACKGROUND_CONTEXT);
+        if (conversation === undefined)
+            return undefined;
+        const meta = await ctx.opened.harness.snapshot(SessionMetaDoc, conversation.id, BACKGROUND_CONTEXT);
+        return accessOf(accessPrincipalOf(principal, ctx.opened.identity.users), meta ?? {});
+    };
+    /** The chat-block route params: one integer id + one entryId. */
+    const BLOCK_PARAMS_SCHEMA = {
+        type: "object",
+        properties: { id: { type: "integer" }, entryId: { type: "string", pattern: "^[0-9]+$" } },
+        required: ["id", "entryId"],
+        additionalProperties: false,
+    };
+    app.get("/v1/conversations/:id/blocks/:entryId", { schema: { params: BLOCK_PARAMS_SCHEMA } }, async (request, reply) => {
+        const { id, entryId } = request.params;
+        const access = await conversationAccess(id, request.principal);
+        if (access === undefined || access === "none") {
+            return await reply.code(404).send({ error: "conversation_not_found" });
+        }
+        const block = await readChatBlock(ctx.opened.harness, id, entryId);
+        if (block === undefined) {
+            return await reply.code(404).send({ error: "block_not_found" });
+        }
+        return await reply.send({
+            tree: block.tree,
+            data: block.state.data,
+            rev: block.state.rev,
+            treeRev: 0,
+            access,
+        });
+    });
+    app.get("/v1/conversations/:id/blocks/:entryId/data", { schema: { params: BLOCK_PARAMS_SCHEMA } }, async (request, reply) => {
+        const { id, entryId } = request.params;
+        const access = await conversationAccess(id, request.principal);
+        if (access === undefined || access === "none") {
+            return await reply.code(404).send({ error: "conversation_not_found" });
+        }
+        const block = await readChatBlock(ctx.opened.harness, id, entryId);
+        if (block === undefined) {
+            return await reply.code(404).send({ error: "block_not_found" });
+        }
+        const since = parseSince(request.query.since);
+        if (since === null) {
+            return await reply
+                .code(400)
+                .send({ error: "invalid_field", field: "since" });
+        }
+        // The sharedData answer (§7.3): ops since `since` while the kept
+        // window still covers it AND the in-memory rev matches the durable
+        // one just read; anything else is the full data.
+        const delta = since === undefined
+            ? undefined
+            : ctx.surfaces.chatOpsSince({ conversationId: id, entryId }, since, block.state.rev);
+        if (delta !== undefined) {
+            return await reply.send({ rev: delta.rev, treeRev: 0, ops: delta.ops });
+        }
+        return await reply.send({
+            rev: block.state.rev,
+            treeRev: 0,
+            data: block.state.data,
+        });
+    });
+    app.post("/v1/conversations/:id/blocks/:entryId/actions", { schema: { params: BLOCK_PARAMS_SCHEMA } }, async (request, reply) => {
+        const { id, entryId } = request.params;
+        const body = request.body ?? {};
+        if (typeof body.action !== "string") {
+            return await reply
+                .code(400)
+                .send({ error: "invalid_field", field: "action" });
+        }
+        const actionId = typeof body.actionId === "string" ? body.actionId : undefined;
+        // The conversation's access gates BEFORE anything runs (§6.5/
+        // §8.2): hidden is the conversation 404, read is 403.
+        const access = await conversationAccess(id, request.principal);
+        if (access === undefined || access === "none") {
+            return await reply.code(404).send({ error: "conversation_not_found" });
+        }
+        if (access === "read") {
+            return await reply.code(403).send({ error: "forbidden" });
+        }
+        // An unknown entry id: the same 404 as the GETs (§8.2 mirrors
+        // §7.2's not-found posture).
+        const block = await readChatBlock(ctx.opened.harness, id, entryId);
+        if (block === undefined) {
+            return await reply.code(404).send({ error: "block_not_found" });
+        }
+        // U3's action gates, over the chat address: rate limit then dedup
+        // (the ordering the ext route chose — a replayed actionId still
+        // costs a token).
+        const address = { conversationId: id, entryId };
+        if (!ctx.surfaces.chatTakeToken(address, request.principal.user ?? "")) {
+            return await reply.code(429).send({ error: "rate_limited" });
+        }
+        const fingerprint = JSON.stringify({ action: body.action, payload: body.payload });
+        if (actionId !== undefined) {
+            const hit = ctx.surfaces.chatDedupCheck(actionId, address, fingerprint);
+            if (hit !== undefined && hit !== null)
+                return await reply.send(hit);
+        }
+        // A handler name no node in the tree declares is unknown
+        // (validateTree's handlers-set check, applied at route time:
+        // chat names are free labels).
+        if (!resolveChatHandlers(block.tree).has(body.action)) {
+            return await reply.code(400).send({ error: "unknown_action" });
+        }
+        // The answer path (§8.4): a turn action submits a user message
+        // through `submitOp` for the acting user — the fold and the
+        // `notedThrough` advance happen inside `answerBlock`. The §6.3
+        // response wraps no ops (the surface's data is unchanged by the
+        // answer itself; the channel already applied the optimistic edits
+        // that produced the payload).
+        if (chatActionStartsTurn(block.tree, body.action)) {
+            const answerPayload = (body.payload ?? null);
+            const wrapped = { ok: true, rev: block.state.rev };
+            await answerBlock(ctx, id, entryId, body.action, answerPayload, actionId);
+            if (actionId !== undefined) {
+                ctx.surfaces.chatDedupRecord(actionId, address, fingerprint, wrapped);
+            }
+            return await reply.send(wrapped);
+        }
+        const outcome = await applyChatAction(ctx.opened.harness, id, entryId, request.principal.user ?? "", body.action, (body.payload ?? null));
+        if (outcome === undefined) {
+            return await reply.code(404).send({ error: "block_not_found" });
+        }
+        if (!outcome.ok) {
+            return await reply.send(outcome);
+        }
+        // Record the ops (sharedData semantics: the kept window) and the
+        // dedup entry, then answer the §6.3 accept-with-ops shape.
+        const wrapped = {
+            ok: true,
+            rev: outcome.rev,
+            ops: outcome.ops,
+        };
+        ctx.surfaces.announceChatRev(address, outcome.rev, {
+            ops: outcome.ops,
+        });
+        if (actionId !== undefined) {
+            ctx.surfaces.chatDedupRecord(actionId, address, fingerprint, wrapped);
+        }
+        return await reply.send(wrapped);
+    });
 }

package/dist/server/routes/users.js

@@ -3,29 +3,34 @@
  * admin-gated directory surface — list, patch (with the last-record-admin
  * guard: group-derived admins never count, Authelia can revoke them at
  * any moment), delete-with-transfer (ownership rewrite → token revocation
- * → record removal → the `userDeleted` lifecycle event), and invite
- * issuance.
+ * → account-link removal → stop services → the `userDeleted` lifecycle
+ * event → record removal, per spec §10.6), and invite issuance.
  *
  * The admin gate reads `request.principal.admin` — record admin, service
  * token, the naive loopback superuser, or a proxy-group grant. The
  * last-admin GUARDS read the directory records only (`recordAdminCount`).
  */
 import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
+import { join } from "node:path";
 import { withClaimLock } from "../auth/claim-lock.js";
+import { effectiveAdmin, storedGroups } from "../../harness/identity/groups.js";
 import { transferOwnership } from "../ownership.js";
-/** The wire form of one directory user (the record minus nothing — the
- * routes serving it are admin-gated, and emails are admin material).
- * `admin` stays the STORED flag; `groupAdmin` (gateway C8) is the
- * persisted proxy-group grant alongside it. */
-function userWire(record) {
+import { validateGrantPath } from "../../sandbox/grants.js";
+/** The wire form of one directory user. `admin` stays the STORED flag;
+ * `groupAdmin` is DERIVED from stored groups and retained for one release
+ * so the users UI keeps rendering. */
+export function userWire(record, adminGroups) {
+    const effective = effectiveAdmin(record, adminGroups);
     return {
         user: record.user,
         ...(record.name === undefined ? {} : { name: record.name }),
         ...(record.email === undefined ? {} : { email: record.email }),
         admin: record.admin,
-        ...(record.groupAdmin === undefined
-            ? {}
-            : { groupAdmin: record.groupAdmin }),
+        groupAdmin: effective && !record.admin,
+        groups: storedGroups(record),
+        ...(record.workspace === undefined ? {} : { workspace: record.workspace }),
+        ...(record.grants === undefined ? {} : { grants: record.grants }),
+        ...(record.osUser === undefined ? {} : { osUser: record.osUser }),
         createdAt: record.createdAt,
         source: record.source,
     };
@@ -37,7 +42,7 @@ export function registerUserRoutes(app, ctx) {
         if (!request.principal.admin) {
             return await reply.code(403).send({ error: "forbidden" });
         }
-        return { users: identity.users.list().map(userWire) };
+        return { users: identity.users.list().map((record) => userWire(record, ctx.config.auth.adminGroups)) };
     });
     app.patch("/v1/users/:user", async (request, reply) => {
         if (!request.principal.admin) {
@@ -73,6 +78,61 @@ export function registerUserRoutes(app, ctx) {
                     }
                     patch.admin = value;
                     break;
+                case "workspace": {
+                    if (typeof value !== "string") {
+                        return await reply.code(400).send({ error: "invalid_body" });
+                    }
+                    const result = validateGrantPath(value, {
+                        managed: ctx.managedPaths,
+                        user,
+                    });
+                    if (!result.ok) {
+                        return await reply.code(400).send({
+                            error: "invalid_grant",
+                            path: value,
+                            reason: result.reason,
+                        });
+                    }
+                    patch.workspace = result.realpath;
+                    break;
+                }
+                case "grants": {
+                    if (!Array.isArray(value)) {
+                        return await reply.code(400).send({ error: "invalid_body" });
+                    }
+                    const grants = [];
+                    for (const entry of value) {
+                        if (typeof entry !== "object" || entry === null || Array.isArray(entry)) {
+                            return await reply.code(400).send({ error: "invalid_body" });
+                        }
+                        const candidate = entry;
+                        if (typeof candidate.path !== "string" ||
+                            (candidate.access !== "ro" && candidate.access !== "rw") ||
+                            Object.keys(candidate).some((key) => key !== "path" && key !== "access")) {
+                            return await reply.code(400).send({ error: "invalid_body" });
+                        }
+                        const result = validateGrantPath(candidate.path, {
+                            managed: ctx.managedPaths,
+                            user,
+                        });
+                        if (!result.ok) {
+                            return await reply.code(400).send({
+                                error: "invalid_grant",
+                                path: candidate.path,
+                                reason: result.reason,
+                            });
+                        }
+                        grants.push({ path: result.realpath, access: candidate.access });
+                    }
+                    patch.grants = grants;
+                    break;
+                }
+                case "osUser":
+                    if (typeof value !== "string" || value === "") {
+                        return await reply.code(400).send({ error: "invalid_body" });
+                    }
+                    patch.osUser = value;
+                    break;
                 default:
                     return await reply
                         .code(400)
@@ -89,12 +149,8 @@ export function registerUserRoutes(app, ctx) {
             identity.users.recordAdminCount() === 1) {
             return await reply.code(409).send({ error: "last_admin" });
         }
-        const updated = await identity.users.update(user, {
-            ...(patch.name === undefined ? {} : { name: patch.name }),
-            ...(patch.email === undefined ? {} : { email: patch.email }),
-            ...(patch.admin === undefined ? {} : { admin: patch.admin }),
-        });
-        return userWire(updated);
+        const updated = await identity.users.update(user, patch);
+        return userWire(updated, ctx.config.auth.adminGroups);
     });
     app.post("/v1/users/invites", async (request, reply) => {
         if (!request.principal.admin) {
@@ -157,18 +213,58 @@ export function registerUserRoutes(app, ctx) {
             identity.users.get(query.transferTo) === undefined) {
             return await reply.code(400).send({ error: "invalid_transfer" });
         }
+        if (target.osUser !== undefined) {
+            return await reply.code(409).send({
+                error: "invalid_transfer",
+                reason: "osUser workspace",
+            });
+        }
         // The last record-admin may not be deleted — admin is not a
         // transferable property (transferTo moves resources, not rights).
         if (target.admin && identity.users.recordAdminCount() === 1) {
             return await reply.code(409).send({ error: "last_admin" });
         }
         const to = query.transferTo;
+        const workspace = target.workspace ??
+            join(ctx.managedPaths.roots.dataDir, "users", user, "workspace");
+        // Complete the only grant-dependent failure decision BEFORE the
+        // irreversible transfer/revocation. Invalid grants remain non-fatal.
+        const validatedGrant = validateGrantPath(workspace, {
+            managed: ctx.managedPaths,
+            user: to,
+            inheritedFrom: user,
+        });
+        const grant = validatedGrant.ok
+            ? {
+                path: validatedGrant.realpath,
+                access: "rw",
+                inheritedFrom: user,
+            }
+            : undefined;
+        if (!validatedGrant.ok) {
+            console.warn(`user delete: skipping departing workspace grant for ${to}: ${workspace}: ${validatedGrant.reason}`);
+        }
         await transferOwnership(ctx, user, to);
         await identity.tokens.revokeAllFor(user);
-        await identity.users.remove(user);
-        // The lifecycle event: extensions transfer their own records
-        // (deadlocked-ordering free — the core transfer already landed).
+        // External identities never transfer (multi-user §10.6 step 1):
+        // credentials belong to a person, and a transferred link would hand
+        // the receiving user's account to whoever holds that chat identity.
+        await identity.accounts.removeUser(user);
+        // §10.6 step 2: stop the user's worker and credential-bearing
+        // services, then uninstall every *@user entry.
+        await ctx.opened.sandboxPool.stopUser(user);
+        await ctx.opened.userServices.stopUser(user);
+        ctx.opened.userTools.removeUser(user);
+        // §10.6 step 3: provider credentials remain readable throughout the
+        // fan-out. Always release the deletion marker before record removal.
         await eventBus.emitUserDeleted({ user, transferTo: to }, BACKGROUND_CONTEXT);
+        if (grant === undefined)
+            await identity.users.remove(user);
+        else
+            await identity.users.removeWithGrant(user, to, grant);
+        // §10.6 step 5: data/state stay for the recipient; core owns only
+        // the departing user's credentials, settings, and every cache slug.
+        await ctx.opened.extensionStores.removeUserData(user);
         return await reply.code(204).send();
     });
 }