daycare-cli 0.0.26 → 0.0.27

package/dist/engine/permissions/permissionTagsNormalize.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissionTagsNormalize.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionTagsNormalize.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACvD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAqB,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAChE,IAAI,GAAW,CAAC;QAChB,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,GAAG,GAAG,UAAU,CAAC;QACnB,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACpC,GAAG,GAAG,SAAS,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,GAAG,GAAG,GAAG,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QACxE,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC"}
+{"version":3,"file":"permissionTagsNormalize.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionTagsNormalize.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACvD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAqB,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAChE,IAAI,GAAW,CAAC;QAChB,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,GAAG,GAAG,UAAU,CAAC;QACnB,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACpC,GAAG,GAAG,SAAS,CAAC;QAClB,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACvC,GAAG,GAAG,YAAY,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,GAAG,GAAG,GAAG,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QACxE,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/engine/permissions/permissionTagsNormalize.spec.js

@@ -5,11 +5,12 @@ describe("permissionTagsNormalize", () => {
         const result = permissionTagsNormalize([
             " @network ",
             "@events",
+            "@workspace",
             "@read:/tmp",
             "@read:/tmp",
             "@write:/var/log"
         ]);
-        expect(result).toEqual(["@network", "@events", "@read:/tmp", "@write:/var/log"]);
+        expect(result).toEqual(["@network", "@events", "@workspace", "@read:/tmp", "@write:/var/log"]);
     });
     it("returns empty for missing values", () => {
         expect(permissionTagsNormalize(undefined)).toEqual([]);

package/dist/engine/permissions/permissionTagsNormalize.spec.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissionTagsNormalize.spec.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionTagsNormalize.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,MAAM,GAAG,uBAAuB,CAAC;YACrC,YAAY;YACZ,SAAS;YACT,YAAY;YACZ,YAAY;YACZ,iBAAiB;SAClB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"permissionTagsNormalize.spec.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionTagsNormalize.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,MAAM,GAAG,uBAAuB,CAAC;YACrC,YAAY;YACZ,SAAS;YACT,YAAY;YACZ,YAAY;YACZ,YAAY;YACZ,iBAAiB;SAClB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACjG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/permissions/permissionTagsValidate.d.ts

@@ -3,7 +3,7 @@ import type { SessionPermissions } from "@/types";
  * Validates that all permission tags are allowed by current permissions.
  * Throws an error if any permission is not already held by the caller.
  *
- * Expects: tags are @network, @events, @read:<path>, or @write:<path>.
+ * Expects: tags are @network, @events, @workspace, @read:<path>, or @write:<path>.
  */
 export declare function permissionTagsValidate(permissions: SessionPermissions, tags: string[]): Promise<void>;
 //# sourceMappingURL=permissionTagsValidate.d.ts.map

package/dist/engine/permissions/permissionTagsValidate.js

@@ -4,7 +4,7 @@ import { permissionAccessParse } from "./permissionAccessParse.js";
  * Validates that all permission tags are allowed by current permissions.
  * Throws an error if any permission is not already held by the caller.
  *
- * Expects: tags are @network, @events, @read:<path>, or @write:<path>.
+ * Expects: tags are @network, @events, @workspace, @read:<path>, or @write:<path>.
  */
 export async function permissionTagsValidate(permissions, tags) {
     for (const tag of tags) {

package/dist/engine/permissions/permissionTagsValidate.spec.js

@@ -15,6 +15,7 @@ describe("permissionTagsValidate", () => {
         const target = path.join(dir, "file.txt");
         await fs.writeFile(target, "ok", "utf8");
         const permissions = {
+            workspaceDir: dir,
             workingDir: dir,
             writeDirs: [dir],
             readDirs: [dir],
@@ -25,6 +26,7 @@ describe("permissionTagsValidate", () => {
         await permissionTagsValidate(permissions, [
             "@network",
             "@events",
+            "@workspace",
             `@read:${target}`,
             `@write:${dir}`
         ]);
@@ -40,6 +42,18 @@ describe("permissionTagsValidate", () => {
         await expect(permissionTagsValidate(permissions, ["@network"]))
             .rejects.toThrow("Cannot attach permission '@network' - you don't have it.");
     });
+    it("rejects workspace permission when caller lacks it", async () => {
+        const permissions = {
+            workspaceDir: "/tmp/workspace",
+            workingDir: "/tmp/workspace/apps/my-app/data",
+            writeDirs: ["/tmp/workspace/apps/my-app/data"],
+            readDirs: ["/tmp/workspace"],
+            network: false,
+            events: false
+        };
+        await expect(permissionTagsValidate(permissions, ["@workspace"]))
+            .rejects.toThrow("Cannot attach permission '@workspace' - you don't have it.");
+    });
     it("rejects events permission when caller lacks it", async () => {
         const permissions = {
             workingDir: "/tmp",

package/dist/engine/permissions/permissionTagsValidate.spec.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissionTagsValidate.spec.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionTagsValidate.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACvF,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;QACvE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAC1C,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAEzC,MAAM,WAAW,GAAG;YAClB,UAAU,EAAE,GAAG;YACf,SAAS,EAAE,CAAC,GAAG,CAAC;YAChB,QAAQ,EAAE,CAAC,GAAG,CAAC;YACf,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,IAAI;SACb,CAAC;QAEF,mBAAmB;QACnB,MAAM,sBAAsB,CAAC,WAAW,EAAE;YACxC,UAAU;YACV,SAAS;YACT,SAAS,MAAM,EAAE;YACjB,UAAU,GAAG,EAAE;SAChB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,WAAW,GAAG;YAClB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,EAAE;YACb,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SACd,CAAC;QAEF,MAAM,MAAM,CAAC,sBAAsB,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;aAC5D,OAAO,CAAC,OAAO,CAAC,0DAA0D,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,WAAW,GAAG;YAClB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,EAAE;YACb,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SACd,CAAC;QAEF,MAAM,MAAM,CAAC,sBAAsB,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;aAC3D,OAAO,CAAC,OAAO,CAAC,yDAAyD,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,WAAW,GAAG;YAClB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,CAAC,MAAM,CAAC;YACnB,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SACd,CAAC;QAEF,MAAM,MAAM,CAAC,sBAAsB,CAAC,WAAW,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;aAC/D,OAAO,CAAC,OAAO,CAAC,6DAA6D,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,WAAW,GAAG;YAClB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,EAAE;YACb,QAAQ,EAAE,CAAC,MAAM,CAAC;YAClB,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SACd,CAAC;QAEF,MAAM,MAAM,CAAC,sBAAsB,CAAC,WAAW,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;aAC9D,OAAO,CAAC,OAAO,CAAC,4DAA4D,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,WAAW,GAAG;YAClB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,EAAE;YACb,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SACd,CAAC;QAEF,MAAM,MAAM,CACV,sBAAsB,CAAC,WAAW,EAAE,CAAC,YAAY,CAAC,CAAC,CACpD,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"permissionTagsValidate.spec.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionTagsValidate.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACvF,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;QACvE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAC1C,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAEzC,MAAM,WAAW,GAAG;YAClB,YAAY,EAAE,GAAG;YACjB,UAAU,EAAE,GAAG;YACf,SAAS,EAAE,CAAC,GAAG,CAAC;YAChB,QAAQ,EAAE,CAAC,GAAG,CAAC;YACf,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,IAAI;SACb,CAAC;QAEF,mBAAmB;QACnB,MAAM,sBAAsB,CAAC,WAAW,EAAE;YACxC,UAAU;YACV,SAAS;YACT,YAAY;YACZ,SAAS,MAAM,EAAE;YACjB,UAAU,GAAG,EAAE;SAChB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,WAAW,GAAG;YAClB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,EAAE;YACb,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SACd,CAAC;QAEF,MAAM,MAAM,CAAC,sBAAsB,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;aAC5D,OAAO,CAAC,OAAO,CAAC,0DAA0D,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,WAAW,GAAG;YAClB,YAAY,EAAE,gBAAgB;YAC9B,UAAU,EAAE,iCAAiC;YAC7C,SAAS,EAAE,CAAC,iCAAiC,CAAC;YAC9C,QAAQ,EAAE,CAAC,gBAAgB,CAAC;YAC5B,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SACd,CAAC;QAEF,MAAM,MAAM,CAAC,sBAAsB,CAAC,WAAW,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;aAC9D,OAAO,CAAC,OAAO,CAAC,4DAA4D,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,WAAW,GAAG;YAClB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,EAAE;YACb,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SACd,CAAC;QAEF,MAAM,MAAM,CAAC,sBAAsB,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;aAC3D,OAAO,CAAC,OAAO,CAAC,yDAAyD,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,WAAW,GAAG;YAClB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,CAAC,MAAM,CAAC;YACnB,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SACd,CAAC;QAEF,MAAM,MAAM,CAAC,sBAAsB,CAAC,WAAW,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;aAC/D,OAAO,CAAC,OAAO,CAAC,6DAA6D,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,WAAW,GAAG;YAClB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,EAAE;YACb,QAAQ,EAAE,CAAC,MAAM,CAAC;YAClB,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SACd,CAAC;QAEF,MAAM,MAAM,CAAC,sBAAsB,CAAC,WAAW,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;aAC9D,OAAO,CAAC,OAAO,CAAC,4DAA4D,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,WAAW,GAAG;YAClB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,EAAE;YACb,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SACd,CAAC;QAEF,MAAM,MAAM,CACV,sBAAsB,CAAC,WAAW,EAAE,CAAC,YAAY,CAAC,CAAC,CACpD,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/permissions/permissionWorkspaceGranted.d.ts

@@ -0,0 +1,7 @@
+import type { SessionPermissions } from "@/types";
+/**
+ * Checks whether @workspace access is currently granted.
+ * Expects: permissions are normalized absolute paths.
+ */
+export declare function permissionWorkspaceGranted(permissions: SessionPermissions): boolean;
+//# sourceMappingURL=permissionWorkspaceGranted.d.ts.map

package/dist/engine/permissions/permissionWorkspaceGranted.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionWorkspaceGranted.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionWorkspaceGranted.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAIlD;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,kBAAkB,GAAG,OAAO,CAKnF"}

package/dist/engine/permissions/permissionWorkspaceGranted.js

@@ -0,0 +1,12 @@
+import path from "node:path";
+import { isWithinSecure } from "./pathResolveSecure.js";
+import { permissionWorkspacePathResolve } from "./permissionWorkspacePathResolve.js";
+/**
+ * Checks whether @workspace access is currently granted.
+ * Expects: permissions are normalized absolute paths.
+ */
+export function permissionWorkspaceGranted(permissions) {
+    const workspacePath = permissionWorkspacePathResolve(permissions);
+    return permissions.writeDirs.some((entry) => isWithinSecure(path.resolve(entry), workspacePath));
+}
+//# sourceMappingURL=permissionWorkspaceGranted.js.map

package/dist/engine/permissions/permissionWorkspaceGranted.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionWorkspaceGranted.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionWorkspaceGranted.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AAErF;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,WAA+B;IACxE,MAAM,aAAa,GAAG,8BAA8B,CAAC,WAAW,CAAC,CAAC;IAClE,OAAO,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAC1C,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,CACnD,CAAC;AACJ,CAAC"}

package/dist/engine/permissions/permissionWorkspaceGranted.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=permissionWorkspaceGranted.spec.d.ts.map

package/dist/engine/permissions/permissionWorkspaceGranted.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionWorkspaceGranted.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionWorkspaceGranted.spec.ts"],"names":[],"mappings":""}

package/dist/engine/permissions/permissionWorkspaceGranted.spec.js

@@ -0,0 +1,35 @@
+import { describe, expect, it } from "vitest";
+import { permissionWorkspaceGranted } from "./permissionWorkspaceGranted.js";
+describe("permissionWorkspaceGranted", () => {
+    it("returns true for workspace-scoped write permissions", () => {
+        expect(permissionWorkspaceGranted({
+            workspaceDir: "/workspace",
+            workingDir: "/workspace",
+            writeDirs: ["/workspace"],
+            readDirs: ["/workspace"],
+            network: false,
+            events: false
+        })).toBe(true);
+    });
+    it("returns false for app-scoped default writes", () => {
+        expect(permissionWorkspaceGranted({
+            workspaceDir: "/workspace",
+            workingDir: "/workspace/apps/reviewer/data",
+            writeDirs: ["/workspace/apps/reviewer/data"],
+            readDirs: ["/workspace"],
+            network: false,
+            events: false
+        })).toBe(false);
+    });
+    it("returns true for app permissions after @workspace grant", () => {
+        expect(permissionWorkspaceGranted({
+            workspaceDir: "/workspace",
+            workingDir: "/workspace/apps/reviewer/data",
+            writeDirs: ["/workspace/apps/reviewer/data", "/workspace"],
+            readDirs: ["/workspace"],
+            network: false,
+            events: false
+        })).toBe(true);
+    });
+});
+//# sourceMappingURL=permissionWorkspaceGranted.spec.js.map

package/dist/engine/permissions/permissionWorkspaceGranted.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionWorkspaceGranted.spec.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionWorkspaceGranted.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAE7E,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CACJ,0BAA0B,CAAC;YACzB,YAAY,EAAE,YAAY;YAC1B,UAAU,EAAE,YAAY;YACxB,SAAS,EAAE,CAAC,YAAY,CAAC;YACzB,QAAQ,EAAE,CAAC,YAAY,CAAC;YACxB,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SACd,CAAC,CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CACJ,0BAA0B,CAAC;YACzB,YAAY,EAAE,YAAY;YAC1B,UAAU,EAAE,+BAA+B;YAC3C,SAAS,EAAE,CAAC,+BAA+B,CAAC;YAC5C,QAAQ,EAAE,CAAC,YAAY,CAAC;YACxB,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SACd,CAAC,CACH,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,CACJ,0BAA0B,CAAC;YACzB,YAAY,EAAE,YAAY;YAC1B,UAAU,EAAE,+BAA+B;YAC3C,SAAS,EAAE,CAAC,+BAA+B,EAAE,YAAY,CAAC;YAC1D,QAAQ,EAAE,CAAC,YAAY,CAAC;YACxB,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SACd,CAAC,CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/permissions/permissionWorkspacePathResolve.d.ts

@@ -0,0 +1,7 @@
+import type { SessionPermissions } from "@/types";
+/**
+ * Resolves the shared workspace root path for a permission set.
+ * Expects: permission paths are absolute and normalized.
+ */
+export declare function permissionWorkspacePathResolve(permissions: SessionPermissions): string;
+//# sourceMappingURL=permissionWorkspacePathResolve.d.ts.map

package/dist/engine/permissions/permissionWorkspacePathResolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionWorkspacePathResolve.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionWorkspacePathResolve.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAGlD;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,WAAW,EAAE,kBAAkB,GAAG,MAAM,CAkBtF"}

package/dist/engine/permissions/permissionWorkspacePathResolve.js

@@ -0,0 +1,42 @@
+import path from "node:path";
+import { isWithinSecure } from "./pathResolveSecure.js";
+/**
+ * Resolves the shared workspace root path for a permission set.
+ * Expects: permission paths are absolute and normalized.
+ */
+export function permissionWorkspacePathResolve(permissions) {
+    if (typeof permissions.workspaceDir === "string" && permissions.workspaceDir.trim().length > 0) {
+        return path.resolve(permissions.workspaceDir);
+    }
+    const appWorkspace = appWorkspacePathResolve(permissions.workingDir);
+    if (appWorkspace) {
+        return appWorkspace;
+    }
+    const workingDir = path.resolve(permissions.workingDir);
+    const candidates = Array.from(new Set([...permissions.readDirs, ...permissions.writeDirs].map((entry) => path.resolve(entry))));
+    const parentCandidates = candidates
+        .filter((entry) => isWithinSecure(entry, workingDir))
+        .sort((left, right) => right.length - left.length);
+    return parentCandidates[0] ?? workingDir;
+}
+function appWorkspacePathResolve(workingDir) {
+    const resolved = path.resolve(workingDir);
+    const segments = resolved.split(path.sep).filter((entry) => entry.length > 0);
+    const root = path.parse(resolved).root;
+    let workspaceSegments = null;
+    for (let index = 0; index < segments.length; index += 1) {
+        if (segments[index] !== "apps") {
+            continue;
+        }
+        const marker = segments[index + 2];
+        if (marker !== "data") {
+            continue;
+        }
+        workspaceSegments = segments.slice(0, index);
+    }
+    if (!workspaceSegments) {
+        return null;
+    }
+    return path.join(root, ...workspaceSegments);
+}
+//# sourceMappingURL=permissionWorkspacePathResolve.js.map

package/dist/engine/permissions/permissionWorkspacePathResolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionWorkspacePathResolve.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionWorkspacePathResolve.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAExD;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,WAA+B;IAC5E,IAAI,OAAO,WAAW,CAAC,YAAY,KAAK,QAAQ,IAAI,WAAW,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/F,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,YAAY,GAAG,uBAAuB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IACrE,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAC3B,IAAI,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC,QAAQ,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CACjG,CAAC;IACF,MAAM,gBAAgB,GAAG,UAAU;SAChC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;SACpD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACrD,OAAO,gBAAgB,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC;AAC3C,CAAC;AAED,SAAS,uBAAuB,CAAC,UAAkB;IACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;IACvC,IAAI,iBAAiB,GAAoB,IAAI,CAAC;IAC9C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxD,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACnC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,SAAS;QACX,CAAC;QACD,iBAAiB,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,iBAAiB,CAAC,CAAC;AAC/C,CAAC"}

package/dist/engine/permissions/permissionWorkspacePathResolve.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=permissionWorkspacePathResolve.spec.d.ts.map

package/dist/engine/permissions/permissionWorkspacePathResolve.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionWorkspacePathResolve.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionWorkspacePathResolve.spec.ts"],"names":[],"mappings":""}

package/dist/engine/permissions/permissionWorkspacePathResolve.spec.js

@@ -0,0 +1,36 @@
+import { describe, expect, it } from "vitest";
+import { permissionWorkspacePathResolve } from "./permissionWorkspacePathResolve.js";
+describe("permissionWorkspacePathResolve", () => {
+    it("prefers explicit workspaceDir when present", () => {
+        const result = permissionWorkspacePathResolve({
+            workspaceDir: "/workspace",
+            workingDir: "/workspace/apps/my-app/data",
+            writeDirs: ["/workspace/apps/my-app/data"],
+            readDirs: ["/workspace"],
+            network: false,
+            events: false
+        });
+        expect(result).toBe("/workspace");
+    });
+    it("derives workspace root from app workingDir when workspaceDir is missing", () => {
+        const result = permissionWorkspacePathResolve({
+            workingDir: "/workspace/apps/my-app/data",
+            writeDirs: ["/workspace/apps/my-app/data"],
+            readDirs: ["/workspace"],
+            network: false,
+            events: false
+        });
+        expect(result).toBe("/workspace");
+    });
+    it("falls back to closest ancestor permission root for cron-like workingDir", () => {
+        const result = permissionWorkspacePathResolve({
+            workingDir: "/workspace/cron/my-task/files",
+            writeDirs: ["/workspace"],
+            readDirs: ["/workspace"],
+            network: false,
+            events: false
+        });
+        expect(result).toBe("/workspace");
+    });
+});
+//# sourceMappingURL=permissionWorkspacePathResolve.spec.js.map

package/dist/engine/permissions/permissionWorkspacePathResolve.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionWorkspacePathResolve.spec.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionWorkspacePathResolve.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AAErF,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,MAAM,GAAG,8BAA8B,CAAC;YAC5C,YAAY,EAAE,YAAY;YAC1B,UAAU,EAAE,6BAA6B;YACzC,SAAS,EAAE,CAAC,6BAA6B,CAAC;YAC1C,QAAQ,EAAE,CAAC,YAAY,CAAC;YACxB,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,MAAM,MAAM,GAAG,8BAA8B,CAAC;YAC5C,UAAU,EAAE,6BAA6B;YACzC,SAAS,EAAE,CAAC,6BAA6B,CAAC;YAC1C,QAAQ,EAAE,CAAC,YAAY,CAAC;YACxB,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,MAAM,MAAM,GAAG,8BAA8B,CAAC;YAC5C,UAAU,EAAE,+BAA+B;YAC3C,SAAS,EAAE,CAAC,YAAY,CAAC;YACzB,QAAQ,EAAE,CAAC,YAAY,CAAC;YACxB,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/permissions.d.ts

@@ -1,5 +1,6 @@
 import type { AssistantSettings } from "../settings.js";
 export type SessionPermissions = {
+    workspaceDir?: string;
     workingDir: string;
     writeDirs: string[];
     readDirs: string[];

package/dist/engine/permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../sources/engine/permissions.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAExD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,iBAAiB,GAAG,IAAI,GACnC,MAAM,CAQR;AAED,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnE;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,iBAAiB,EAAE,MAAM,GACxB,kBAAkB,CAoDpB;AAED,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAO/E"}
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../sources/engine/permissions.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAExD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,iBAAiB,GAAG,IAAI,GACnC,MAAM,CAQR;AAED,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnE;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,iBAAiB,EAAE,MAAM,GACxB,kBAAkB,CA4DpB;AAED,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAO/E"}

package/dist/engine/permissions.js

@@ -41,7 +41,13 @@ export function normalizePermissions(value, defaultWorkingDir) {
                 if (typeof candidate.events === "boolean") {
                     events = candidate.events;
                 }
+                const workspaceDir = typeof candidate.workspaceDir === "string" &&
+                    candidate.workspaceDir.trim().length > 0 &&
+                    path.isAbsolute(candidate.workspaceDir)
+                    ? path.resolve(candidate.workspaceDir)
+                    : path.resolve(candidate.workingDir);
                 return {
+                    workspaceDir,
                     workingDir: path.resolve(candidate.workingDir),
                     writeDirs: dedupe(writeDirs),
                     readDirs: dedupe(readDirs),
@@ -52,6 +58,7 @@ export function normalizePermissions(value, defaultWorkingDir) {
         }
     }
     return {
+        workspaceDir: path.resolve(defaultWorkingDir),
         workingDir: path.resolve(defaultWorkingDir),
         writeDirs: [],
         readDirs: [],

package/dist/engine/permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../sources/engine/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAY7B,MAAM,UAAU,mBAAmB,CACjC,SAAiB,EACjB,SAAoC;IAEpC,MAAM,UAAU,GAAG,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACnD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAChC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;YAC1B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAW;IAClD,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,KAAc,EACd,iBAAyB;IAEzB,IAAI,SAAS,GAAa,EAAE,CAAC;IAC7B,IAAI,QAAQ,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,SAAS,GAAG,KAMjB,CAAC;QACF,IAAI,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvF,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;oBACvC,SAAS,GAAG,SAAS,CAAC,SAAS;yBAC5B,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;yBACxF,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;yBAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;yBACzC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;gBACzC,CAAC;gBACD,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACtC,QAAQ,GAAG,SAAS,CAAC,QAAQ;yBAC1B,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;yBACxF,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;yBAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;yBACzC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;gBACzC,CAAC;gBACD,IAAI,OAAO,SAAS,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;oBAC3C,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;gBAC9B,CAAC;gBACD,IAAI,OAAO,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBAC1C,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;gBAC5B,CAAC;gBACD,OAAO;oBACL,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC;oBAC9C,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC;oBAC5B,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;oBAC1B,OAAO;oBACP,MAAM;iBACP,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;QAC3C,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,KAAK;KACd,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,UAAkB,EAAE,MAAc;IACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACrD,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,MAAM,CAAC,MAAgB;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AACrC,CAAC"}
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../sources/engine/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAa7B,MAAM,UAAU,mBAAmB,CACjC,SAAiB,EACjB,SAAoC;IAEpC,MAAM,UAAU,GAAG,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACnD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAChC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;YAC1B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAW;IAClD,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,KAAc,EACd,iBAAyB;IAEzB,IAAI,SAAS,GAAa,EAAE,CAAC;IAC7B,IAAI,QAAQ,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,SAAS,GAAG,KAOjB,CAAC;QACF,IAAI,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvF,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;oBACvC,SAAS,GAAG,SAAS,CAAC,SAAS;yBAC5B,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;yBACxF,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;yBAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;yBACzC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;gBACzC,CAAC;gBACD,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACtC,QAAQ,GAAG,SAAS,CAAC,QAAQ;yBAC1B,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;yBACxF,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;yBAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;yBACzC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;gBACzC,CAAC;gBACD,IAAI,OAAO,SAAS,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;oBAC3C,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;gBAC9B,CAAC;gBACD,IAAI,OAAO,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBAC1C,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;gBAC5B,CAAC;gBACD,MAAM,YAAY,GAAG,OAAO,SAAS,CAAC,YAAY,KAAK,QAAQ;oBAC3D,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;oBACxC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,YAAY,CAAC;oBACzC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC;oBACtC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;gBACvC,OAAO;oBACL,YAAY;oBACZ,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC;oBAC9C,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC;oBAC5B,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;oBAC1B,OAAO;oBACP,MAAM;iBACP,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;QAC7C,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;QAC3C,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,KAAK;KACd,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,UAAkB,EAAE,MAAc;IACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACrD,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,MAAM,CAAC,MAAgB;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AACrC,CAAC"}

package/dist/engine/scheduling/gatePermissionsCheck.d.ts

@@ -5,7 +5,7 @@ export type GatePermissionsCheckResult = {
 };
 /**
  * Checks gate permission tags against the current permissions.
- * Expects: tags are @network, @events, @read:<path>, or @write:<path>.
+ * Expects: tags are @network, @events, @workspace, @read:<path>, or @write:<path>.
  */
 export declare function gatePermissionsCheck(permissions: SessionPermissions, tags?: string[]): Promise<GatePermissionsCheckResult>;
 //# sourceMappingURL=gatePermissionsCheck.d.ts.map

package/dist/engine/scheduling/gatePermissionsCheck.js

@@ -1,7 +1,7 @@
 import { permissionAccessAllows } from "../permissions/permissionAccessAllows.js";
 /**
  * Checks gate permission tags against the current permissions.
- * Expects: tags are @network, @events, @read:<path>, or @write:<path>.
+ * Expects: tags are @network, @events, @workspace, @read:<path>, or @write:<path>.
  */
 export async function gatePermissionsCheck(permissions, tags) {
     if (!tags || tags.length === 0) {
@@ -33,6 +33,9 @@ function parsePermissionAccess(tag) {
     if (tag === "@events") {
         return { access: { kind: "events" } };
     }
+    if (tag === "@workspace") {
+        return { access: { kind: "workspace" } };
+    }
     if (tag.startsWith("@read:")) {
         const pathValue = tag.slice("@read:".length).trim();
         if (!pathValue) {
@@ -49,7 +52,7 @@ function parsePermissionAccess(tag) {
     }
     return {
         access: null,
-        error: "Permission must be @network, @events, @read:<path>, or @write:<path>."
+        error: "Permission must be @network, @events, @workspace, @read:<path>, or @write:<path>."
     };
 }
 //# sourceMappingURL=gatePermissionsCheck.js.map

package/dist/engine/scheduling/gatePermissionsCheck.js.map

@@ -1 +1 @@
-{"version":3,"file":"gatePermissionsCheck.js","sourceRoot":"","sources":["../../../sources/engine/scheduling/gatePermissionsCheck.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAOlF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,WAA+B,EAC/B,IAAe;IAEf,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;YAC1D,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,KAAK,MAAM,CAAC,KAAK,IAAI,0BAA0B,GAAG,CAAC,CAAC;YAC3E,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACzE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,qBAAqB,CAC5B,GAAW;IAEX,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;QACvB,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;IACxC,CAAC;IAED,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACpD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC;QACrE,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC;IACvD,CAAC;IAED,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;QACtE,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC;IACxD,CAAC;IAED,OAAO;QACL,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,uEAAuE;KAC/E,CAAC;AACJ,CAAC"}
+{"version":3,"file":"gatePermissionsCheck.js","sourceRoot":"","sources":["../../../sources/engine/scheduling/gatePermissionsCheck.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAOlF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,WAA+B,EAC/B,IAAe;IAEf,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;YAC1D,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,KAAK,MAAM,CAAC,KAAK,IAAI,0BAA0B,GAAG,CAAC,CAAC;YAC3E,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACzE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,qBAAqB,CAC5B,GAAW;IAEX,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;QACvB,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;IACxC,CAAC;IACD,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;QACzB,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC;IAC3C,CAAC;IAED,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACpD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC;QACrE,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC;IACvD,CAAC;IAED,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;QACtE,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC;IACxD,CAAC;IAED,OAAO;QACL,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,mFAAmF;KAC3F,CAAC;AACJ,CAAC"}

package/dist/engine/scheduling/gatePermissionsCheck.spec.js

@@ -1,6 +1,7 @@
 import { describe, expect, it } from "vitest";
 import { gatePermissionsCheck } from "./gatePermissionsCheck.js";
 const basePermissions = {
+    workspaceDir: "/tmp",
     workingDir: "/tmp",
     readDirs: ["/tmp"],
     writeDirs: ["/tmp"],
@@ -32,6 +33,24 @@ describe("gatePermissionsCheck", () => {
         const result = await gatePermissionsCheck(permissions, ["@events"]);
         expect(result).toEqual({ allowed: true, missing: [] });
     });
+    it("denies workspace when not allowed", async () => {
+        const appPermissions = {
+            workspaceDir: "/tmp",
+            workingDir: "/tmp/apps/my-app/data",
+            readDirs: ["/tmp"],
+            writeDirs: ["/tmp/apps/my-app/data"],
+            network: false,
+            events: false
+        };
+        const result = await gatePermissionsCheck(appPermissions, ["@workspace"]);
+        expect(result.allowed).toBe(false);
+        expect(result.missing).toEqual(["@workspace"]);
+    });
+    it("allows workspace when permitted", async () => {
+        const permissions = { ...basePermissions };
+        const result = await gatePermissionsCheck(permissions, ["@workspace"]);
+        expect(result).toEqual({ allowed: true, missing: [] });
+    });
     it("denies paths outside allowed roots", async () => {
         const result = await gatePermissionsCheck(basePermissions, ["@read:/etc"]);
         expect(result.allowed).toBe(false);
@@ -41,7 +60,7 @@ describe("gatePermissionsCheck", () => {
         const result = await gatePermissionsCheck(basePermissions, ["@banana"]);
         expect(result.allowed).toBe(false);
         expect(result.missing).toEqual([
-            "@banana (Permission must be @network, @events, @read:<path>, or @write:<path>.)"
+            "@banana (Permission must be @network, @events, @workspace, @read:<path>, or @write:<path>.)"
         ]);
     });
 });

package/dist/engine/scheduling/gatePermissionsCheck.spec.js.map

@@ -1 +1 @@
-{"version":3,"file":"gatePermissionsCheck.spec.js","sourceRoot":"","sources":["../../../sources/engine/scheduling/gatePermissionsCheck.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAG9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,MAAM,eAAe,GAAuB;IAC1C,UAAU,EAAE,MAAM;IAClB,QAAQ,EAAE,CAAC,MAAM,CAAC;IAClB,SAAS,EAAE,CAAC,MAAM,CAAC;IACnB,OAAO,EAAE,KAAK;IACd,MAAM,EAAE,KAAK;CACd,CAAC;AAEF,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,mBAAmB,EAAE,KAAK,IAAI,EAAE;QACjC,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,eAAe,CAAC,CAAC;QAC3D,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,eAAe,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QACzE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,WAAW,GAAuB,EAAE,GAAG,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC9E,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,eAAe,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QACxE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,WAAW,GAAuB,EAAE,GAAG,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC7E,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QACpE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,eAAe,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QAC3E,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,eAAe,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QACxE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;YAC7B,iFAAiF;SAClF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"gatePermissionsCheck.spec.js","sourceRoot":"","sources":["../../../sources/engine/scheduling/gatePermissionsCheck.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAG9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,MAAM,eAAe,GAAuB;IAC1C,YAAY,EAAE,MAAM;IACpB,UAAU,EAAE,MAAM;IAClB,QAAQ,EAAE,CAAC,MAAM,CAAC;IAClB,SAAS,EAAE,CAAC,MAAM,CAAC;IACnB,OAAO,EAAE,KAAK;IACd,MAAM,EAAE,KAAK;CACd,CAAC;AAEF,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,mBAAmB,EAAE,KAAK,IAAI,EAAE;QACjC,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,eAAe,CAAC,CAAC;QAC3D,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,eAAe,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QACzE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,WAAW,GAAuB,EAAE,GAAG,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC9E,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,eAAe,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QACxE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,WAAW,GAAuB,EAAE,GAAG,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC7E,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QACpE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,cAAc,GAAuB;YACzC,YAAY,EAAE,MAAM;YACpB,UAAU,EAAE,uBAAuB;YACnC,QAAQ,EAAE,CAAC,MAAM,CAAC;YAClB,SAAS,EAAE,CAAC,uBAAuB,CAAC;YACpC,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SACd,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,cAAc,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QAC1E,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,WAAW,GAAuB,EAAE,GAAG,eAAe,EAAE,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,WAAW,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QACvE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,eAAe,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QAC3E,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,eAAe,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QACxE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;YAC7B,6FAA6F;SAC9F,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/plugins/telegram/connector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connector.d.ts","sourceRoot":"","sources":["../../../sources/plugins/telegram/connector.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,EAEhB,qBAAqB,EACrB,cAAc,EACd,cAAc,EACd,cAAc,EACd,eAAe,EAEf,iBAAiB,EACjB,iBAAiB,EAEjB,iBAAiB,EAClB,MAAM,SAAS,CAAC;AAEjB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAItD,MAAM,MAAM,wBAAwB,GAAG;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,SAAS,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;CACrD,CAAC;AAkBF,qBAAa,iBAAkB,YAAW,SAAS;IACjD,YAAY,EAAE,qBAAqB,CAQjC;IACF,OAAO,CAAC,GAAG,CAAc;IACzB,OAAO,CAAC,QAAQ,CAAwB;IACxC,OAAO,CAAC,eAAe,CAAwB;IAC/C,OAAO,CAAC,kBAAkB,CAA2B;IACrD,OAAO,CAAC,cAAc,CAAU;IAChC,OAAO,CAAC,SAAS,CAAgB;IACjC,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,SAAS,CAAY;IAC7B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,YAAY,CAA+B;IACnD,OAAO,CAAC,YAAY,CAAqC;IACzD,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,eAAe,CAA2B;IAClD,OAAO,CAAC,gBAAgB,CAA+B;IACvD,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,kBAAkB,CAGtB;IACJ,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,mBAAmB,CAAU;IACrC,OAAO,CAAC,cAAc,CAAS;gBAEnB,OAAO,EAAE,wBAAwB;IAsI7C,SAAS,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,IAAI;IAU9C,SAAS,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,IAAI;IAU9C,cAAc,CAAC,QAAQ,EAAE,iBAAiB,EAAE,GAAG,IAAI;IAQnD,gBAAgB,IAAI,IAAI;IAKxB,YAAY,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,IAAI;IAU9C,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAqCvE,iBAAiB,CACrB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE,cAAc,EACvB,UAAU,EAAE,eAAe,GAC1B,OAAO,CAAC,IAAI,CAAC;IAmBhB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,IAAI;IA0BnC,WAAW,CACf,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;YAUF,QAAQ;YAwBR,oBAAoB;YAOpB,aAAa;YAoBb,mBAAmB;YAkCnB,UAAU;IAexB,OAAO,CAAC,WAAW;YAWL,SAAS;IAsCvB,OAAO,CAAC,eAAe;YAUT,YAAY;YAqBZ,mBAAmB;YAkBnB,YAAY;IAiD1B,OAAO,CAAC,kBAAkB;IAU1B,OAAO,CAAC,YAAY;IAOpB,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,oBAAoB;IAStB,QAAQ,CAAC,MAAM,GAAE,MAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;YAuC5C,WAAW;YAUX,oBAAoB;IAclC,OAAO,CAAC,UAAU;YASJ,YAAY;YA8BZ,YAAY;YA6BZ,uBAAuB;IAiCrC,OAAO,CAAC,mBAAmB;YAUb,gBAAgB;CAqB/B"}
+{"version":3,"file":"connector.d.ts","sourceRoot":"","sources":["../../../sources/plugins/telegram/connector.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,EAEhB,qBAAqB,EACrB,cAAc,EACd,cAAc,EACd,cAAc,EACd,eAAe,EAEf,iBAAiB,EACjB,iBAAiB,EAEjB,iBAAiB,EAClB,MAAM,SAAS,CAAC;AAEjB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAItD,MAAM,MAAM,wBAAwB,GAAG;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,SAAS,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;CACrD,CAAC;AAkBF,qBAAa,iBAAkB,YAAW,SAAS;IACjD,YAAY,EAAE,qBAAqB,CAQjC;IACF,OAAO,CAAC,GAAG,CAAc;IACzB,OAAO,CAAC,QAAQ,CAAwB;IACxC,OAAO,CAAC,eAAe,CAAwB;IAC/C,OAAO,CAAC,kBAAkB,CAA2B;IACrD,OAAO,CAAC,cAAc,CAAU;IAChC,OAAO,CAAC,SAAS,CAAgB;IACjC,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,SAAS,CAAY;IAC7B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,YAAY,CAA+B;IACnD,OAAO,CAAC,YAAY,CAAqC;IACzD,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,eAAe,CAA2B;IAClD,OAAO,CAAC,gBAAgB,CAA+B;IACvD,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,kBAAkB,CAGtB;IACJ,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,mBAAmB,CAAU;IACrC,OAAO,CAAC,cAAc,CAAS;gBAEnB,OAAO,EAAE,wBAAwB;IAuI7C,SAAS,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,IAAI;IAU9C,SAAS,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,IAAI;IAU9C,cAAc,CAAC,QAAQ,EAAE,iBAAiB,EAAE,GAAG,IAAI;IAQnD,gBAAgB,IAAI,IAAI;IAKxB,YAAY,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,IAAI;IAU9C,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAqCvE,iBAAiB,CACrB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE,cAAc,EACvB,UAAU,EAAE,eAAe,GAC1B,OAAO,CAAC,IAAI,CAAC;IAmBhB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,IAAI;IA0BnC,WAAW,CACf,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;YAUF,QAAQ;YAwBR,oBAAoB;YAOpB,aAAa;YAoBb,mBAAmB;YAkCnB,UAAU;IAexB,OAAO,CAAC,WAAW;YAWL,SAAS;IAsCvB,OAAO,CAAC,eAAe;YAUT,YAAY;YAqBZ,mBAAmB;YAkBnB,YAAY;IAiD1B,OAAO,CAAC,kBAAkB;IAU1B,OAAO,CAAC,YAAY;IAOpB,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,oBAAoB;IAStB,QAAQ,CAAC,MAAM,GAAE,MAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;YAuC5C,WAAW;YAUX,oBAAoB;IAclC,OAAO,CAAC,UAAU;YASJ,YAAY;YA8BZ,YAAY;YA6BZ,uBAAuB;IAiCrC,OAAO,CAAC,mBAAmB;YAUb,gBAAgB;CAqB/B"}

package/dist/plugins/telegram/connector.js

@@ -145,7 +145,8 @@ export class TelegramConnector {
                 token,
                 agentId: pending.request.agentId,
                 approved,
-                permissions: pending.request.permissions
+                permissions: pending.request.permissions,
+                ...(pending.request.scope ? { scope: pending.request.scope } : {})
             };
             for (const handler of this.permissionHandlers) {
                 await handler(decision, pending.context, pending.descriptor);
@@ -719,12 +720,18 @@ function formatPermissionMessage(request, status) {
     const requesterLine = request.requester.kind === "background"
         ? `<b>Requester</b>: ${escapeHtml(request.requester.label)} (background agent)`
         : null;
+    const scopeLine = request.scope === "always"
+        ? "<b>Scope</b>: Always (all future runs for this app)"
+        : request.scope === "now"
+            ? "<b>Scope</b>: One time (this app run only)"
+            : null;
     const lines = [
         heading,
         "",
         "<b>Permissions</b>:",
         ...permissionLines,
         requesterLine,
+        scopeLine,
         `<b>Reason</b>: ${escapedReason}`,
         "",
         footer
@@ -741,6 +748,9 @@ function describePermissionKind(access) {
     if (access.kind === "write") {
         return `Write/edit files: ${access.path}`;
     }
+    if (access.kind === "workspace") {
+        return "Workspace write access";
+    }
     if (access.kind === "events") {
         return "Events access";
     }