canopycms 0.0.68-int.109 → 0.0.68-int.110

package/README.md

@@ -47,7 +47,7 @@ you misunderstood, which is why it is worth resolving the ref rather than guessi
 
 - Workspaces resolve per mode: `prod` uses `$CANOPYCMS_WORKSPACE_ROOT/content-branches` (default: `/mnt/efs/content-branches`), `dev` uses `.canopy-dev/content-branches/<branch>`.
 - For `prod` mode, you must set `defaultRemoteUrl`. For `dev`, `defaultRemoteUrl` is **optional** - if omitted, a local remote is auto-created at `.canopy-dev/remote.git`.
-- Optionally configure `defaultRemoteName` (default: `origin`) and `defaultBaseBranch` (default: `main`).
+- Optionally configure `defaultRemoteName` (default: `origin`) and `defaultBaseBranch` (unset: the checked-out git branch in dev, the repository's default branch in prod).
 - Git author identity is required for `prod` mode: set `gitBotAuthorName` and `gitBotAuthorEmail` so bot commits can be created reliably.
 - Branch names are sanitized and traversal is blocked before creating directories.
 - Metadata lives at `<workspace>/.canopy-meta/branch.json`; the registry lives at `<branchesRoot>/branches.json` and records the workspaceRoot for each branch.
@@ -515,7 +515,7 @@ export default defineCanopyConfig({
 **How it works:**
 
 1. When you create your first branch, CanopyCMS automatically creates a bare git repository at `.canopy-dev/remote.git`
-2. Your current `baseBranch` (default: `main`) is pushed to this local remote
+2. Your current `baseBranch` (unset: the checked-out branch) is pushed to this local remote
 3. Branch workspaces are cloned from this local remote into `.canopy-dev/content-branches/<branch-name>/`
 4. All git operations (push, fetch, etc.) work against the local remote
 

package/dist/ai/resolve-branch.js

@@ -4,6 +4,8 @@
  */
 import { loadOrCreateBranchContext } from '../branch-workspace.js';
 import { readsFromCheckout } from '../build-mode.js';
+import { GitManager } from '../git-manager.js';
+import { baseBranchOf } from '../utils/base-branch.js';
 import { detectHeadBranch } from '../utils/git.js';
 /**
  * Resolve the branch root directory for reading content.
@@ -15,6 +17,11 @@ export async function resolveBranchRoot(config) {
     if (readsFromCheckout(config)) {
         return process.cwd();
     }
+    // Prod reads an unset base branch from the remote's HEAD, as services does; provisioning
+    // needs it even when the active branch is configured.
+    const resolved = config.mode === 'prod' && !config.defaultBaseBranch
+        ? { ...config, defaultBaseBranch: await GitManager.detectBaseBranch(config, 'throw') }
+        : config;
     let activeBranch;
     if (config.defaultActiveBranch) {
         activeBranch = config.defaultActiveBranch;
@@ -23,10 +30,10 @@ export async function resolveBranchRoot(config) {
         activeBranch = await detectHeadBranch(process.cwd(), config.defaultBaseBranch ?? 'main');
     }
     else {
-        activeBranch = config.defaultBaseBranch ?? 'main';
+        activeBranch = baseBranchOf(resolved);
     }
     const context = await loadOrCreateBranchContext({
-        config,
+        config: resolved,
         branchName: activeBranch,
         mode: config.mode,
         createdBy: 'canopycms-ai',

package/dist/api/admin-branch-health.js

@@ -27,6 +27,7 @@ import { branchProvisioningLockName, tryAcquireProvisioningLock } from '../utils
 import { withContentWriteLock, ContentWriteLockBusyError, DEFAULT_CONTENT_WRITE_LOCK_WAIT_MS, } from '../utils/content-write-lock.js';
 import { getErrorMessage, isNodeError, isNotFoundError } from '../utils/error.js';
 import { defineEndpoint } from './route-builder.js';
+import { baseBranchOf } from '../utils/base-branch.js';
 /** [H1] A fresh (< 5 min old) init lock blocks purge -- provisioning may be running. */
 const PROVISIONING_LOCK_FRESH_MS = 5 * 60_000;
 // Mirrors deleteTaskHandler's fileName pattern in admin.ts: conservative
@@ -65,7 +66,7 @@ const getBranchHealthHandler = async (_gc, ctx, _req) => {
     // admin handlers must agree with it or the scan silently looks at the
     // wrong directory.
     const baseRoot = getDefaultBranchBase(ctx.services.config.mode);
-    const baseBranchName = ctx.services.config.defaultBaseBranch ?? 'main';
+    const baseBranchName = baseBranchOf(ctx.services.config);
     const contentRootName = ctx.services.config.contentRoot || 'content';
     try {
         const entries = await scanBranchHealth(baseRoot, { baseBranchName, contentRootName });
@@ -102,7 +103,7 @@ const getBranchHealthHandler = async (_gc, ctx, _req) => {
  */
 const purgeBranchDirHandler = async (_gc, ctx, _req, params) => {
     const baseRoot = getDefaultBranchBase(ctx.services.config.mode);
-    const baseBranchName = ctx.services.config.defaultBaseBranch ?? 'main';
+    const baseBranchName = baseBranchOf(ctx.services.config);
     const sanitizedBaseBranchName = sanitizeBranchName(baseBranchName);
     if (params.dirName === sanitizedBaseBranchName) {
         return { ok: false, status: 400, error: 'The base branch directory can never be purged' };
@@ -412,7 +413,7 @@ async function checkStillCorrupt(dirPath) {
  * rebuild) and invalidates any ContentStore already registered in THIS
  * process for the same root.
  */
-const repairContentDuplicatesHandler = async (_gc, ctx, _req, params) => {
+const repairContentDuplicatesHandler = async (_gc, ctx, req, params) => {
     const baseRoot = getDefaultBranchBase(ctx.services.config.mode);
     const dirPath = resolveDirWithinBase(baseRoot, params.dirName);
     if (!dirPath) {
@@ -485,6 +486,14 @@ const repairContentDuplicatesHandler = async (_gc, ctx, _req, params) => {
                 : getErrorMessage(err),
         };
     }
+    finally {
+        // Archived files leave the branch at its next submit, a partial repair's included, so the
+        // admin is one of its editors. No `writableBranch` guard can say so: this route names a
+        // directory, not a branch.
+        if (resolved.length > 0) {
+            await ctx.services.recordBranchEditor({ branchRoot: dirPath, baseRoot }, req.user);
+        }
+    }
 };
 /**
  * Branch directory health scan (healthy/corrupt-metadata/orphan)

package/dist/api/admin.d.ts

@@ -78,10 +78,10 @@ declare const listAdminTasksParamsSchema: z.ZodObject<{
     status: z.ZodEnum<["pending", "processing", "completed", "failed", "corrupt"]>;
     limit: z.ZodOptional<z.ZodNumber>;
 }, "strip", z.ZodTypeAny, {
-    status: "failed" | "corrupt" | "pending" | "processing" | "completed";
+    status: "failed" | "pending" | "corrupt" | "processing" | "completed";
     limit?: number | undefined;
 }, {
-    status: "failed" | "corrupt" | "pending" | "processing" | "completed";
+    status: "failed" | "pending" | "corrupt" | "processing" | "completed";
     limit?: number | undefined;
 }>;
 export type ListAdminTasksParams = z.infer<typeof listAdminTasksParamsSchema>;
@@ -89,10 +89,10 @@ declare const deleteTaskParamsSchema: z.ZodObject<{
     status: z.ZodEnum<["pending", "failed", "corrupt"]>;
     fileName: z.ZodEffects<z.ZodString, string, string>;
 }, "strip", z.ZodTypeAny, {
-    status: "failed" | "corrupt" | "pending";
+    status: "failed" | "pending" | "corrupt";
     fileName: string;
 }, {
-    status: "failed" | "corrupt" | "pending";
+    status: "failed" | "pending" | "corrupt";
     fileName: string;
 }>;
 export type DeleteTaskParams = z.infer<typeof deleteTaskParamsSchema>;
@@ -132,10 +132,10 @@ export declare const ADMIN_ROUTES: {
         status: z.ZodEnum<["pending", "processing", "completed", "failed", "corrupt"]>;
         limit: z.ZodOptional<z.ZodNumber>;
     }, "strip", z.ZodTypeAny, {
-        status: "failed" | "corrupt" | "pending" | "processing" | "completed";
+        status: "failed" | "pending" | "corrupt" | "processing" | "completed";
         limit?: number | undefined;
     }, {
-        status: "failed" | "corrupt" | "pending" | "processing" | "completed";
+        status: "failed" | "pending" | "corrupt" | "processing" | "completed";
         limit?: number | undefined;
     }>, undefined, AdminTasksResponse>;
     readonly retryTask: import("./route-builder.js").RouteDefinition<z.ZodObject<{
@@ -149,10 +149,10 @@ export declare const ADMIN_ROUTES: {
         status: z.ZodEnum<["pending", "failed", "corrupt"]>;
         fileName: z.ZodEffects<z.ZodString, string, string>;
     }, "strip", z.ZodTypeAny, {
-        status: "failed" | "corrupt" | "pending";
+        status: "failed" | "pending" | "corrupt";
         fileName: string;
     }, {
-        status: "failed" | "corrupt" | "pending";
+        status: "failed" | "pending" | "corrupt";
         fileName: string;
     }>, undefined, AdminDeleteTaskResponse>;
 };

package/dist/api/admin.js

@@ -16,6 +16,7 @@ import { getErrorMessage, isNotFoundError, redactCredentials } from '../utils/er
 import { getBuildIdentity } from '../build-identity.js';
 import { loadSharp } from '../assets/sharp-loader.js';
 import { ADMIN_BRANCH_HEALTH_ROUTES } from './admin-branch-health.js';
+import { baseBranchOf } from '../utils/base-branch.js';
 /**
  * 60_000 = DEFAULT_LOCK_STALE_MS in worker/cms-worker.ts, hardcoded rather
  * than threaded through config: an adopter who overrides `lockStaleMs` skews
@@ -91,7 +92,7 @@ async function readSettingsWorkspaceError(ctx) {
 async function readBaseSchemaIssues(ctx) {
     try {
         const { config, branchSchemaCache, entrySchemaRegistry } = ctx.services;
-        const base = await ctx.getBranchContext(config.defaultBaseBranch ?? 'main');
+        const base = await ctx.getBranchContext(baseBranchOf(config));
         if (!base)
             return [];
         const { issues } = await branchSchemaCache.getSchema(base.branchRoot, entrySchemaRegistry, config.contentRoot || 'content');

package/dist/api/branch-merge.js

@@ -54,7 +54,7 @@ const markAsMergedHandler = async (gc, ctx, _req, params) => {
     //     console.error(`CanopyCMS: Failed to delete remote branch ${branchName}:`, err)
     //   }
     // }
-    // Comments.json is already in the branch workspace at .canopycms/comments.json
+    // Comments.json is already in the branch workspace at .canopy-meta/comments.json
     // It will be preserved with the archived branch - no action needed
     return {
         ok: true,

package/dist/api/branch-review.js

@@ -17,7 +17,7 @@ const requestChangesHandler = async (gc, ctx, _req, _params) => {
     const updated = await meta.save({
         branch: { name: branchContext.branch.name, status: 'editing' },
     });
-    // TODO: Optionally record comment in .canopycms/comments.json when comment system is implemented
+    // TODO: Optionally record comment in .canopy-meta/comments.json when comment system is implemented
     return {
         ok: true,
         status: 200,

package/dist/api/branch-status.js

@@ -12,6 +12,7 @@ import { isNonFastForwardRejection } from '../utils/git.js';
 import { ContentWriteLockBusyError } from '../utils/content-write-lock.js';
 import { submissionEditorFromUser } from '../submission-attribution.js';
 import { NothingToSubmitError } from '../services.js';
+import { baseBranchOf } from '../utils/base-branch.js';
 const getBranchStatusHandler = async (gc, _ctx, _req, _params) => {
     const { branchContext } = gc;
     return { ok: true, status: 200, data: { branch: branchContext.branch } };
@@ -53,10 +54,16 @@ const submitBranchForMergeHandler = async (gc, ctx, req, _params) => {
     }
     // Commit and push changes
     const submitter = submissionEditorFromUser(req.user);
+    const { authPlugin } = ctx;
     let changedPaths;
+    let editors;
     try {
         ;
-        ({ changedPaths } = await ctx.services.submitBranch({ context: branchContext, submitter }));
+        ({ changedPaths, editors } = await ctx.services.submitBranch({
+            context: branchContext,
+            submitter,
+            lookupEditor: authPlugin ? (id) => authPlugin.getUserMetadata(id) : undefined,
+        }));
     }
     catch (err) {
         if (err instanceof NothingToSubmitError) {
@@ -113,6 +120,7 @@ const submitBranchForMergeHandler = async (gc, ctx, req, _params) => {
     const submittedAt = new Date().toISOString();
     const prResult = await syncSubmitPr(ctx, branchContext, {
         submitter,
+        editors,
         changedPaths,
         submittedAt,
     });
@@ -123,7 +131,7 @@ const submitBranchForMergeHandler = async (gc, ctx, req, _params) => {
     // stays editable; the stamp records that it is now on GitHub, for delete.
     if (prResult.nothingToSubmit) {
         await meta.save({ branch: { name: branchContext.branch.name, ...pushed } });
-        const base = branchContext.branch.baseBranch ?? ctx.services.config.defaultBaseBranch ?? 'main';
+        const base = branchContext.branch.baseBranch ?? baseBranchOf(ctx.services.config);
         return {
             ok: false,
             status: 400,

package/dist/api/branch.js

@@ -16,6 +16,7 @@ import { sanitizeBranchName, RESERVED_SETTINGS_BRANCH_PREFIX, RESERVED_ROUTE_BRA
 import { GitManager } from '../git-manager.js';
 import { syncDeleteRemoteBranch } from './github-sync.js';
 import { branchNameSchema, branchParamSchema } from './validators.js';
+import { baseBranchOf } from '../utils/base-branch.js';
 const log = createDebugLogger({ prefix: 'BranchAPI' });
 const createBranchBodySchema = z.object({
     branch: branchNameSchema,
@@ -300,7 +301,7 @@ export const createBranchHandler = async (ctx, req, body) => {
         // Load path permissions from the base branch's JSON file (the resolved
         // fork point — baked into config at service creation; dev-mode git HEAD
         // when not explicitly configured)
-        const baseBranch = ctx.services.config.defaultBaseBranch ?? 'main';
+        const baseBranch = baseBranchOf(ctx.services.config);
         const baseBranchContext = await ctx.getBranchContext(baseBranch);
         let pathPermissions = [];
         if (baseBranchContext) {
@@ -377,7 +378,7 @@ export const listBranchesHandler = async (ctx, req) => {
     // but registry branch names are filesystem-sanitized ('claude-foo') — the
     // editor matches defaultBranch against registry names, so return the form
     // that can actually be found there.
-    const defaultBranch = sanitizeBranchName(ctx.services.config.defaultActiveBranch ?? ctx.services.config.defaultBaseBranch ?? 'main');
+    const defaultBranch = sanitizeBranchName(ctx.services.config.defaultActiveBranch ?? baseBranchOf(ctx.services.config));
     // Admins and Reviewers see all branches
     if (isPrivileged(req.user.groups)) {
         return {
@@ -551,7 +552,7 @@ export const deleteBranchHandler = async (ctx, req, params) => {
     const sanitizedDeleted = sanitizeBranchName(branchContext.branch.name);
     // Defense-in-depth only -- isProtected above already rejects the base
     // branch, and settings branches never resolve through getBranchContext.
-    const sanitizedBase = sanitizeBranchName(branchContext.branch.baseBranch ?? ctx.services.config.defaultBaseBranch ?? 'main');
+    const sanitizedBase = sanitizeBranchName(branchContext.branch.baseBranch ?? baseBranchOf(ctx.services.config));
     const deletableHead = sanitizedDeleted !== sanitizedBase &&
         !sanitizedDeleted.startsWith(RESERVED_SETTINGS_BRANCH_PREFIX);
     if (deletableHead &&

package/dist/api/comments.d.ts

@@ -1,6 +1,7 @@
 import { z } from 'zod';
 import type { ApiResponse } from './types.js';
 import type { CommentThread, CommentType } from '../comment-store.js';
+import type { LogicalPath } from '../paths/types.js';
 export interface AddCommentBody {
     text: string;
     threadId?: string;
@@ -48,18 +49,18 @@ export declare const COMMENT_ROUTES: {
         text: z.ZodString;
         threadId: z.ZodOptional<z.ZodString>;
         type: z.ZodEnum<["field", "entry", "branch"]>;
-        entryPath: z.ZodOptional<z.ZodType<import("../paths/index.js").LogicalPath, z.ZodTypeDef, import("../paths/index.js").LogicalPath>>;
+        entryPath: z.ZodOptional<z.ZodType<LogicalPath, z.ZodTypeDef, LogicalPath>>;
         canopyPath: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         type: "branch" | "entry" | "field";
         text: string;
-        entryPath?: import("../paths/index.js").LogicalPath | undefined;
+        entryPath?: LogicalPath | undefined;
         threadId?: string | undefined;
         canopyPath?: string | undefined;
     }, {
         type: "branch" | "entry" | "field";
         text: string;
-        entryPath?: import("../paths/index.js").LogicalPath | undefined;
+        entryPath?: LogicalPath | undefined;
         threadId?: string | undefined;
         canopyPath?: string | undefined;
     }>, AddCommentResponse>;

package/dist/api/comments.js

@@ -1,6 +1,8 @@
 import { z } from 'zod';
 import { CommentStore } from '../comment-store.js';
 import { isReviewer } from '../authorization/index.js';
+import { parseLogicalPath } from '../paths/validation.js';
+import { normalizeFilesystemPath } from '../paths/normalize.js';
 import { defineEndpoint } from './route-builder.js';
 import { branchParamSchema, branchNameSchema, logicalPathSchema } from './validators.js';
 // ============================================================================
@@ -17,13 +19,47 @@ const addCommentBodySchema = z.object({
     entryPath: logicalPathSchema.optional(),
     canopyPath: z.string().optional(), // Canopy field path, not a file path
 });
-const listCommentsHandler = async (gc, _ctx, _req, _params) => {
+/**
+ * Whether `entryPath` is spelled the way path rules expect an entry's logical path: rooted at
+ * the content root, with no empty or `.` segment. Rules are globs over that spelling, so
+ * `secret/plan` (which the content API reads as `content/secret/plan`) and
+ * `content/./secret/plan` both miss a rule written for `content/secret/**`.
+ */
+const isCanonicalEntryPath = (entryPath, contentRoot) => entryPath.startsWith(`${normalizeFilesystemPath(contentRoot)}/`) &&
+    entryPath.split('/').every((segment) => segment !== '' && segment !== '.');
+/**
+ * Whether the user may see a thread: its entry's path rules at `read`, the level a content
+ * read needs, so a thread discloses nothing about an entry its reader could not open. A
+ * field thread is governed by its entry. A thread with no entry path (a branch thread) is
+ * governed by branch access alone, which the `branchAccess` guard has already passed. An
+ * entry path that is not a canonical logical path is denied: comments.json is read without
+ * schema validation.
+ */
+const canReadThreadEntry = (checkAccess, contentRoot, entryPath) => {
+    if (entryPath === undefined)
+        return true;
+    const parsed = parseLogicalPath(entryPath);
+    return (parsed.ok &&
+        isCanonicalEntryPath(parsed.path, contentRoot) &&
+        checkAccess(parsed.path, 'read').allowed);
+};
+/** One checker per request, bound to the content root its paths are canonical against. */
+const createThreadReadCheck = async (ctx, req, branchContext) => {
+    const checkAccess = await ctx.services.createContentAccessChecker(branchContext, branchContext.branchRoot, req.user);
+    const contentRoot = ctx.services.config.contentRoot || 'content';
+    return (entryPath) => canReadThreadEntry(checkAccess, contentRoot, entryPath);
+};
+const listCommentsHandler = async (gc, ctx, req, _params) => {
     const { branchContext } = gc;
     const commentStore = new CommentStore(branchContext.branchRoot);
-    const threads = await commentStore.listThreads({ includeResolved: true });
+    const [allThreads, canRead] = await Promise.all([
+        commentStore.listThreads({ includeResolved: true }),
+        createThreadReadCheck(ctx, req, branchContext),
+    ]);
+    const threads = allThreads.filter((thread) => canRead(thread.entryPath));
     return { ok: true, status: 200, data: { threads } };
 };
-const addCommentHandler = async (gc, _ctx, req, _params, body) => {
+const addCommentHandler = async (gc, ctx, req, _params, body) => {
     const { branchContext } = gc;
     // Validate required fields based on type
     if (body.type === 'field' && !body.canopyPath) {
@@ -40,22 +76,50 @@ const addCommentHandler = async (gc, _ctx, req, _params, body) => {
             error: 'entryPath required for field/entry comments',
         };
     }
+    // Commenting needs read access to the entry the comment lands on. A reply lands on the
+    // stored thread, so it is checked against that thread's entry path, which never changes
+    // once the thread exists; a reply to a thread the user cannot read answers as missing, as
+    // resolve does.
     const commentStore = new CommentStore(branchContext.branchRoot);
+    const [existing, canRead] = await Promise.all([
+        body.threadId ? commentStore.getThread(body.threadId) : Promise.resolve(null),
+        createThreadReadCheck(ctx, req, branchContext),
+    ]);
+    if (body.threadId) {
+        if (!existing || !canRead(existing.entryPath)) {
+            return { ok: false, status: 404, error: 'Thread not found' };
+        }
+        const reply = await commentStore.addReply({
+            userId: req.user.userId,
+            text: body.text,
+            threadId: body.threadId,
+        });
+        if (!reply) {
+            return { ok: false, status: 404, error: 'Thread not found' };
+        }
+        return { ok: true, status: 201, data: reply };
+    }
+    if (!canRead(body.entryPath)) {
+        return { ok: false, status: 403, error: 'Forbidden' };
+    }
     const result = await commentStore.addComment({
         userId: req.user.userId,
         text: body.text,
-        threadId: body.threadId,
         type: body.type,
         entryPath: body.entryPath,
         canopyPath: body.canopyPath,
     });
     return { ok: true, status: 201, data: result };
 };
-const resolveCommentHandler = async (gc, _ctx, req, params) => {
+const resolveCommentHandler = async (gc, ctx, req, params) => {
     const { branchContext } = gc;
     const commentStore = new CommentStore(branchContext.branchRoot);
-    const thread = await commentStore.getThread(params.threadId);
-    if (!thread) {
+    const [thread, canRead] = await Promise.all([
+        commentStore.getThread(params.threadId),
+        createThreadReadCheck(ctx, req, branchContext),
+    ]);
+    // A thread the user cannot read answers as missing, so its id does not confirm it exists.
+    if (!thread || !canRead(thread.entryPath)) {
         return { ok: false, status: 404, error: 'Thread not found' };
     }
     // Check permissions: thread author, reviewer, or admin

package/dist/api/content.js

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { ENTRY_CHANGED_MESSAGE } from './entries-constants.js';
 import { BranchSyncingError, ContentStore, ContentStoreError, ContentConflictError, DuplicateContentIdError, UrlPathConflictError, getDefaultEntryType, } from '../content-store.js';
 import { defineEndpoint } from './route-builder.js';
 import { SchemaUnavailableError } from '../schema/schema-unavailable-error.js';
@@ -480,7 +481,12 @@ const writeContentHandler = async (gc, ctx, req, params, body) => {
             // refused outright, but a lock compromised mid-write can still land it — each case carries
             // its own message, so pass `err.message` through rather than the generic conflict below.
             if (err instanceof BranchSyncingError) {
-                return { ok: false, status: 409, error: err.message };
+                return {
+                    ok: false,
+                    status: 409,
+                    error: err.message,
+                    ...(err.outcome === 'unknown' ? { code: 'WRITE_OUTCOME_UNKNOWN' } : {}),
+                };
             }
             // [F1] Also not an editor collision: this content ID is quarantined on two files
             // (ContentIdIndex's duplicate-ID detection). The generic message below would send the
@@ -500,11 +506,7 @@ const writeContentHandler = async (gc, ctx, req, params, body) => {
             if (expectedVersion === null) {
                 return { ok: false, status: 409, error: createConflictError };
             }
-            return {
-                ok: false,
-                status: 409,
-                error: 'Content conflict: entry was modified by another editor',
-            };
+            return { ok: false, status: 409, error: ENTRY_CHANGED_MESSAGE };
         }
         // C2: a ContentStoreError is an expected client fault (bad slug, validation, etc.) and keeps
         // its 400. Anything else — ENOSPC, EACCES, a bug — is a genuine server fault and must not be
@@ -624,7 +626,7 @@ const renameEntryHandler = async (gc, ctx, req, params, body) => {
             return {
                 ok: false,
                 status: 409,
-                error: passThrough ? err.message : 'Content conflict: entry was modified by another editor',
+                error: passThrough ? err.message : ENTRY_CHANGED_MESSAGE,
             };
         }
         // C2: same rule as writeContentHandler's catch above (ContentStoreError -> 400, everything

package/dist/api/entries-constants.d.ts

@@ -1,7 +1,7 @@
 /**
- * Pagination constants for the entries list endpoint. Kept dependency-free (no server-only
- * imports) so the editor's browser bundle can import the page-size cap without pulling in
- * `entries.ts` and its `node:fs`-backed deps; `entries.ts` re-exports these for API discoverability.
+ * Constants the entries and content endpoints share with the editor. Kept dependency-free (no
+ * server-only imports) so the editor's browser bundle can import them without pulling in
+ * `entries.ts` and its `node:fs`-backed deps.
  */
 /**
  * Maximum entries the list endpoint returns per request; larger `limit` values are clamped to
@@ -10,3 +10,8 @@
 export declare const MAX_ENTRIES_PER_PAGE = 200;
 /** Default page size when a request omits `limit`. */
 export declare const DEFAULT_ENTRIES_LIMIT = 50;
+/**
+ * The generic 409 for a conflicting change to an entry, usually its version moving on since the
+ * caller read it. Shared with the editor, whose own pre-save staleness check reports the same.
+ */
+export declare const ENTRY_CHANGED_MESSAGE = "This entry changed since you opened it. Reload to see the latest version (your unsaved edits will be lost).";

package/dist/api/entries-constants.js

@@ -1,7 +1,7 @@
 /**
- * Pagination constants for the entries list endpoint. Kept dependency-free (no server-only
- * imports) so the editor's browser bundle can import the page-size cap without pulling in
- * `entries.ts` and its `node:fs`-backed deps; `entries.ts` re-exports these for API discoverability.
+ * Constants the entries and content endpoints share with the editor. Kept dependency-free (no
+ * server-only imports) so the editor's browser bundle can import them without pulling in
+ * `entries.ts` and its `node:fs`-backed deps.
  */
 /**
  * Maximum entries the list endpoint returns per request; larger `limit` values are clamped to
@@ -10,3 +10,8 @@
 export const MAX_ENTRIES_PER_PAGE = 200;
 /** Default page size when a request omits `limit`. */
 export const DEFAULT_ENTRIES_LIMIT = 50;
+/**
+ * The generic 409 for a conflicting change to an entry, usually its version moving on since the
+ * caller read it. Shared with the editor, whose own pre-save staleness check reports the same.
+ */
+export const ENTRY_CHANGED_MESSAGE = 'This entry changed since you opened it. Reload to see the latest version (your unsaved edits will be lost).';

package/dist/api/entries.js

@@ -7,7 +7,7 @@ import { getErrorMessage, isNotFoundError, sanitizeErrorMessage } from '../utils
 import { createDebugLogger } from '../utils/debug.js';
 import { resolveEntryTitle } from '../utils/title-field.js';
 import { branchNameSchema, logicalPathSchema, queryBooleanSchema } from './validators.js';
-import { MAX_ENTRIES_PER_PAGE, DEFAULT_ENTRIES_LIMIT } from './entries-constants.js';
+import { MAX_ENTRIES_PER_PAGE, DEFAULT_ENTRIES_LIMIT, ENTRY_CHANGED_MESSAGE, } from './entries-constants.js';
 import { SchemaOps, SchemaStoreBusyError } from '../schema/schema-store.js';
 import { listCollectionEntries as listCollectionEntriesShared, listEntries as listContentEntries, sortByOrder, } from '../content-listing.js';
 import { findReferencingEntries } from '../validation/deletion-checker.js';
@@ -416,9 +416,7 @@ const deleteEntryHandler = async (gc, ctx, req, params) => {
             return {
                 ok: false,
                 status: 409,
-                error: err instanceof BranchSyncingError
-                    ? err.message
-                    : 'Content conflict: entry was modified by another editor',
+                error: err instanceof BranchSyncingError ? err.message : ENTRY_CHANGED_MESSAGE,
             };
         }
         return {

package/dist/api/github-sync.d.ts

@@ -18,6 +18,8 @@ export interface GitHubSyncResult {
 /** What the PR body records about a submit. */
 export interface SubmissionRecord {
     submitter?: SubmissionEditor;
+    /** Every recorded editor of the branch; the PR body lists those other than the submitter. */
+    editors?: readonly SubmissionEditor[];
     changedPaths: readonly string[];
     /** The submit's `submittedAt`, carried to the worker so its failure handling targets this submit. */
     submittedAt?: string;

package/dist/api/github-sync.js

@@ -5,6 +5,7 @@ import { getErrorMessage, sanitizeErrorMessage } from '../utils/error.js';
 import { sanitizeBranchName } from '../paths/branch-name.js';
 import { buildPrSection, mergePrSection } from '../submission-attribution.js';
 import { isNoCommitsBetweenError, isRefAlreadyGoneError } from '../github-service.js';
+import { baseBranchOf } from '../utils/base-branch.js';
 /**
  * Uses githubService directly if available, otherwise queues a task for the worker.
  *
@@ -18,10 +19,11 @@ export async function syncSubmitPr(ctx, context, submission) {
     const prSection = buildPrSection({
         description: context.branch.description,
         submitter: submission.submitter,
+        editors: submission.editors,
         changedPaths: submission.changedPaths,
     });
     // Target the fork point recorded at branch creation when available.
-    const baseBranch = context.branch.baseBranch ?? ctx.services.config.defaultBaseBranch ?? 'main';
+    const baseBranch = context.branch.baseBranch ?? baseBranchOf(ctx.services.config);
     if (!clientOperatingStrategy(mode).supportsPullRequests()) {
         return {};
     }

package/dist/api/groups.js

@@ -180,6 +180,7 @@ const updateInternalGroupsHandler = async (_gc, ctx, req, body) => {
             branchRoot: context.branchRoot,
             fileName: 'groups.json',
             message: 'Update internal groups',
+            actor: req.user,
             mode,
         });
         if (!commitResult.pushed) {

package/dist/api/guards.js

@@ -94,6 +94,10 @@ const runBranchAccessWithSchemaGuard = async (ctx, req, params, accumulated) =>
     }
     return { ok: true, context: { branchContext: context } };
 };
+/**
+ * A success records the user as an editor the next submit credits (route-builder.ts), so give
+ * this guard only to endpoints that change the branch's working tree.
+ */
 const runWritableBranchGuard = async (ctx, _req, params, accumulated) => {
     const branch = extractBranchName(params);
     if (typeof branch !== 'string')

package/dist/api/permissions.js

@@ -82,6 +82,7 @@ const updatePermissionsHandler = async (_gc, ctx, req, body) => {
             branchRoot: context.branchRoot,
             fileName: 'permissions.json',
             message: 'Update permissions',
+            actor: req.user,
             mode,
         });
         if (!commitResult.pushed) {

package/dist/api/route-builder.js

@@ -9,6 +9,9 @@
  * - Self-documents the API surface
  */
 import { executeGuards } from './guards.js';
+function isOkResponse(response) {
+    return (typeof response === 'object' && response !== null && 'ok' in response && response.ok === true);
+}
 /**
  * Global registry - generator reads this
  */
@@ -71,6 +74,7 @@ export function defineEndpoint(config) {
     if (config.guards && config.guards.length > 0) {
         const guards = config.guards;
         const guardedHandler = config.handler;
+        const recordsEditor = guards.includes('writableBranch');
         handler = async (ctx, req, ...args) => {
             // Extract params from args (first arg after ctx/req if present)
             const params = args[0] ?? {};
@@ -79,7 +83,14 @@ export function defineEndpoint(config) {
                 return guardResult.response;
             }
             // eslint-disable-next-line @typescript-eslint/no-unsafe-function-type
-            return guardedHandler(guardResult.guardContext, ctx, req, ...args);
+            const response = await guardedHandler(guardResult.guardContext, ctx, req, ...args);
+            // Every 'writableBranch' endpoint changes the branch's working tree, so one that succeeds
+            // makes its user an editor of the branch.
+            if (recordsEditor && isOkResponse(response)) {
+                const { branchContext } = guardResult.guardContext;
+                await ctx.services.recordBranchEditor(branchContext, req.user);
+            }
+            return response;
         };
     }
     else {

package/dist/api/settings-helpers.d.ts

@@ -1,5 +1,6 @@
 import type { ApiContext } from './types.js';
 import type { OperatingMode } from '../operating-mode/index.js';
+import type { CanopyUser } from '../user.js';
 /**
  * Get the appropriate root path for settings (permissions/groups).
  * Returns the settings root managed by the settings workspace.
@@ -30,7 +31,8 @@ export interface CommitSettingsResult {
 /**
  * Commit and push settings changes based on the mode.
  * Both prod and dev use commitToSettingsBranch.
- * Settings changes are never reviewed through a PR (see commitToSettingsBranch).
+ * Settings changes are never reviewed through a PR (see commitToSettingsBranch), and the bot
+ * authors the commit, so its trailers, not its author line, name who made the change.
  */
 export declare function commitSettings(ctx: ApiContext, options: {
     context: {
@@ -39,5 +41,7 @@ export declare function commitSettings(ctx: ApiContext, options: {
     branchRoot: string;
     fileName: string;
     message: string;
+    /** The user making the change, named in the commit's trailers as a submit names its editors. */
+    actor: CanopyUser;
     mode: OperatingMode;
 }): Promise<CommitSettingsResult>;