deepdebug-local-agent 1.0.11 → 1.0.13

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepdebug-local-agent",
-  "version": "1.0.11",
+  "version": "1.0.13",
   "description": "DeepDebug Local Agent - AI-powered code debugging assistant",
   "private": false,
   "type": "module",

package/src/git/github-provider.js

@@ -780,7 +780,6 @@ export class GitHubProvider extends BaseGitProvider {
         // - git@github.com:owner/repo.git
 
         let match = url.match(/github\.com[/:]([\w-]+)\/([\w-]+?)(?:\.git)?$/);
-
         if (match) {
             return {
                 owner: match[1],
@@ -792,4 +791,4 @@ export class GitHubProvider extends BaseGitProvider {
     }
 }
 
-export default GitHubProvider;
+export default GitHubProvider

package/src/server.js

@@ -583,6 +583,14 @@ if (WORKSPACE_ROOT) {
 let DETECTED_SERVICES = [];
 const processManager = new ProcessManager();
 const wsManager = new WorkspaceManager();
+
+function resolveWorkspaceRoot(req) {
+    const wsId = req.headers['x-workspace-id']
+        || (req.body && req.body.workspaceId)
+        || req.query.workspaceId;
+    if (wsId && wsManager.isOpen(wsId)) return wsManager.getRoot(wsId);
+    return WORKSPACE_ROOT;
+}
 const MCP_PORT = process.env.MCP_PORT || 5056;
 
 // 🧠 Inicializar AI Vibe Coding Engine
@@ -702,7 +710,7 @@ function updateServiceStatus(serviceId, status) {
 }
 
 /** Health */
-app.get("/health", (_req, res) => {
+app.get("/health", (req, res) => {
     res.json({
         status: "ok",
         workspace: WORKSPACE_ROOT || null,
@@ -741,9 +749,24 @@ app.post("/workspace/open", async (req, res) => {
             await fsPromises.mkdir(cacheDir, { recursive: true });
 
             // Build authenticated URL
-            const authUrl = token
-                ? repoUrl.replace('https://', `https://x-access-token:${token}@`)
-                : repoUrl;
+            // Token formats:
+            //   GitHub:    TOKEN (uses x-access-token:TOKEN@)
+            //   Bitbucket: x-token-auth:TOKEN or username:appPassword
+            //   GitLab:    oauth2:TOKEN
+            let authUrl;
+            if (token) {
+                // Strip any existing username@ from URL first
+                let cleanUrl = repoUrl.replace(/https:\/\/[^@]+@/, 'https://');
+                if (token.includes(':')) {
+                    // Already in user:pass format (Bitbucket/GitLab)
+                    authUrl = cleanUrl.replace('https://', `https://${token}@`);
+                } else {
+                    // Plain token — GitHub style
+                    authUrl = cleanUrl.replace('https://', `https://x-access-token:${token}@`);
+                }
+            } else {
+                authUrl = repoUrl;
+            }
 
             const gitDir = path.join(clonePath, '.git');
             const alreadyCloned = await exists(gitDir);
@@ -770,7 +793,10 @@ app.post("/workspace/open", async (req, res) => {
             }
 
             // Set as active workspace
-            WORKSPACE_ROOT = clonePath;
+            // TENANT ISOLATION: Only set global for default
+            if (!workspaceId || workspaceId === "default") {
+                WORKSPACE_ROOT = clonePath;
+            }
             const wsId = workspaceId || "default";
             try { await wsManager.open(wsId, clonePath); } catch (err) {
                 console.warn(`⚠️ WorkspaceManager.open failed (non-fatal): ${err.message}`);
@@ -806,7 +832,10 @@ app.post("/workspace/open", async (req, res) => {
     const abs = path.resolve(root);
     if (!(await exists(abs))) return res.status(404).json({ error: "path not found" });
 
-    WORKSPACE_ROOT = abs;
+    // TENANT ISOLATION: Only set global for default
+    if (wsId === "default") {
+        WORKSPACE_ROOT = abs;
+    }
 
     // Registar no WorkspaceManager (multi-workspace support)
     const wsId = workspaceId || "default";
@@ -887,19 +916,21 @@ app.post("/workspace/clone", async (req, res) => {
 });
 
 /** Info do workspace */
-app.get("/workspace/info", async (_req, res) => {
-    if (!WORKSPACE_ROOT) return res.status(400).json({ error: "workspace not set" });
-    const meta = await detectProject(WORKSPACE_ROOT);
-    const port = await detectPort(WORKSPACE_ROOT);
-    res.json({ root: WORKSPACE_ROOT, meta, port });
+app.get("/workspace/info", async (req, res) => {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) return res.status(400).json({ error: "workspace not set" });
+    const meta = await detectProject(wsRoot);
+    const port = await detectPort(wsRoot);
+    res.json({ root: wsRoot, meta, port });
 });
 
 /** Scan completo do workspace */
-app.get("/workspace/scan", async (_req, res) => {
-    if (!WORKSPACE_ROOT) return res.status(400).json({ error: "workspace not set" });
+app.get("/workspace/scan", async (req, res) => {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) return res.status(400).json({ error: "workspace not set" });
 
     try {
-        const scanner = new WorkspaceScanner(WORKSPACE_ROOT);
+        const scanner = new WorkspaceScanner(wsRoot);
         const structure = await scanner.scan();
         res.json(structure);
     } catch (err) {
@@ -908,17 +939,18 @@ app.get("/workspace/scan", async (_req, res) => {
 });
 
 /** Análise completa: language + framework */
-app.get("/workspace/analyze", async (_req, res) => {
-    if (!WORKSPACE_ROOT) return res.status(400).json({ error: "workspace not set" });
+app.get("/workspace/analyze", async (req, res) => {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) return res.status(400).json({ error: "workspace not set" });
 
     try {
-        const scanner = new WorkspaceScanner(WORKSPACE_ROOT);
+        const scanner = new WorkspaceScanner(wsRoot);
         const structure = await scanner.scan();
 
         const languageDetector = new LanguageDetector(structure.files);
         const languageInfo = languageDetector.detect();
 
-        const fileReader = new FileReader(WORKSPACE_ROOT);
+        const fileReader = new FileReader(wsRoot);
         const frameworkDetector = new FrameworkDetector(
             languageInfo.primary,
             structure.files,
@@ -927,7 +959,7 @@ app.get("/workspace/analyze", async (_req, res) => {
         const frameworkInfo = await frameworkDetector.detect();
 
         res.json({
-            workspace: WORKSPACE_ROOT,
+            workspace: wsRoot,
             language: languageInfo,
             framework: frameworkInfo,
             stats: structure.metadata,
@@ -940,13 +972,14 @@ app.get("/workspace/analyze", async (_req, res) => {
 
 /** Lê conteúdo de arquivo específico */
 app.get("/workspace/file-content", async (req, res) => {
-    if (!WORKSPACE_ROOT) return res.status(400).json({ error: "workspace not set" });
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) return res.status(400).json({ error: "workspace not set" });
 
     const { path: relativePath } = req.query;
     if (!relativePath) return res.status(400).json({ error: "path query param required" });
 
     try {
-        const reader = new FileReader(WORKSPACE_ROOT);
+        const reader = new FileReader(wsRoot);
         const file = await reader.read(relativePath);
         res.json(file);
     } catch (err) {
@@ -956,7 +989,8 @@ app.get("/workspace/file-content", async (req, res) => {
 
 /** Lê múltiplos arquivos */
 app.post("/workspace/batch-read", async (req, res) => {
-    if (!WORKSPACE_ROOT) return res.status(400).json({ error: "workspace not set" });
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) return res.status(400).json({ error: "workspace not set" });
 
     const { paths } = req.body || {};
     if (!paths || !Array.isArray(paths)) {
@@ -964,7 +998,7 @@ app.post("/workspace/batch-read", async (req, res) => {
     }
 
     try {
-        const reader = new FileReader(WORKSPACE_ROOT);
+        const reader = new FileReader(wsRoot);
         const files = await reader.readMultiple(paths);
         res.json(files);
     } catch (err) {
@@ -981,7 +1015,8 @@ app.post("/workspace/batch-read", async (req, res) => {
  * Checks if a file exists in the workspace
  */
 app.get("/workspace/file-exists", async (req, res) => {
-    if (!WORKSPACE_ROOT) {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) {
         return res.status(400).json({ error: "workspace not set" });
     }
 
@@ -991,7 +1026,7 @@ app.get("/workspace/file-exists", async (req, res) => {
     }
 
     try {
-        const fullPath = path.join(WORKSPACE_ROOT, relativePath);
+        const fullPath = path.join(wsRoot, relativePath);
         const fileExists = await exists(fullPath);
 
         console.log(`🔍 [file-exists] ${relativePath} -> ${fileExists ? 'EXISTS' : 'NOT FOUND'}`);
@@ -1013,7 +1048,8 @@ app.get("/workspace/file-exists", async (req, res) => {
  * Validates multiple file paths at once
  */
 app.post("/workspace/validate-paths", async (req, res) => {
-    if (!WORKSPACE_ROOT) {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) {
         return res.status(400).json({ error: "workspace not set" });
     }
 
@@ -1025,7 +1061,7 @@ app.post("/workspace/validate-paths", async (req, res) => {
     try {
         const results = await Promise.all(
             pathList.map(async (relativePath) => {
-                const fullPath = path.join(WORKSPACE_ROOT, relativePath);
+                const fullPath = path.join(wsRoot, relativePath);
                 const fileExists = await exists(fullPath);
                 return { path: relativePath, exists: fileExists };
             })
@@ -1056,7 +1092,8 @@ app.post("/workspace/validate-paths", async (req, res) => {
  * FIXED: Handle both string arrays and object arrays from listRecursive
  */
 app.post("/workspace/search-file", async (req, res) => {
-    if (!WORKSPACE_ROOT) {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) {
         return res.status(400).json({ error: "workspace not set" });
     }
 
@@ -1068,7 +1105,7 @@ app.post("/workspace/search-file", async (req, res) => {
     try {
         console.log(`🔍 [search-file] Searching for: ${fileName}`);
 
-        const rawFiles = await listRecursive(WORKSPACE_ROOT, {
+        const rawFiles = await listRecursive(wsRoot, {
             maxDepth: 15,
             includeHidden: false,
             extensions: null
@@ -1132,7 +1169,8 @@ app.post("/workspace/search-file", async (req, res) => {
  * FIXED: Handle both string arrays and object arrays from listRecursive
  */
 app.post("/workspace/search-by-content", async (req, res) => {
-    if (!WORKSPACE_ROOT) {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) {
         return res.status(400).json({ error: "workspace not set" });
     }
 
@@ -1145,7 +1183,7 @@ app.post("/workspace/search-by-content", async (req, res) => {
     try {
         console.log(`🔍 [search-by-content] Searching for terms: ${terms.join(', ')}`);
 
-        const rawFiles = await listRecursive(WORKSPACE_ROOT, {
+        const rawFiles = await listRecursive(wsRoot, {
             maxDepth: 15,
             includeHidden: false
         });
@@ -1171,7 +1209,7 @@ app.post("/workspace/search-by-content", async (req, res) => {
             if (results.length >= maxResults * 2) break;
 
             try {
-                const fullPath = path.join(WORKSPACE_ROOT, filePath);
+                const fullPath = path.join(wsRoot, filePath);
                 const content = await readFile(fullPath, 'utf8');
                 const lines = content.split('\n');
 
@@ -1229,7 +1267,8 @@ app.post("/workspace/search-by-content", async (req, res) => {
  * FIXED: Handle both string arrays and object arrays from listRecursive
  */
 app.post("/workspace/find-field-definition", async (req, res) => {
-    if (!WORKSPACE_ROOT) {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) {
         return res.status(400).json({ error: "workspace not set" });
     }
 
@@ -1242,7 +1281,7 @@ app.post("/workspace/find-field-definition", async (req, res) => {
     try {
         console.log(`🔍 [find-field] Searching for field: ${fieldName}`);
 
-        const rawFiles = await listRecursive(WORKSPACE_ROOT, {
+        const rawFiles = await listRecursive(wsRoot, {
             maxDepth: 15,
             includeHidden: false
         });
@@ -1266,7 +1305,7 @@ app.post("/workspace/find-field-definition", async (req, res) => {
 
         for (const filePath of targetFiles) {
             try {
-                const fullPath = path.join(WORKSPACE_ROOT, filePath);
+                const fullPath = path.join(wsRoot, filePath);
                 const content = await readFile(fullPath, 'utf8');
                 const lines = content.split('\n');
 
@@ -1339,17 +1378,18 @@ app.post("/workspace/find-field-definition", async (req, res) => {
 // ============================================
 
 /** Detecta serviços no workspace */
-app.get("/workspace/services/detect", async (_req, res) => {
-    if (!WORKSPACE_ROOT) return res.status(400).json({ error: "workspace not set" });
+app.get("/workspace/services/detect", async (req, res) => {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) return res.status(400).json({ error: "workspace not set" });
 
     try {
-        const scanner = new WorkspaceScanner(WORKSPACE_ROOT);
+        const scanner = new WorkspaceScanner(wsRoot);
         const structure = await scanner.scan();
 
         const languageDetector = new LanguageDetector(structure.files);
         const languageInfo = languageDetector.detect();
 
-        const fileReader = new FileReader(WORKSPACE_ROOT);
+        const fileReader = new FileReader(wsRoot);
         const frameworkDetector = new FrameworkDetector(
             languageInfo.primary,
             structure.files,
@@ -1358,7 +1398,7 @@ app.get("/workspace/services/detect", async (_req, res) => {
         const frameworkInfo = await frameworkDetector.detect();
 
         const serviceDetector = new ServiceDetector(
-            WORKSPACE_ROOT,
+            wsRoot,
             languageInfo,
             frameworkInfo
         );
@@ -1375,8 +1415,9 @@ app.get("/workspace/services/detect", async (_req, res) => {
 });
 
 /** Lista todos os serviços */
-app.get("/workspace/services", (_req, res) => {
-    if (!WORKSPACE_ROOT) return res.status(400).json({ error: "workspace not set" });
+app.get("/workspace/services", (req, res) => {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) return res.status(400).json({ error: "workspace not set" });
 
     // Atualizar status dos serviços com info do ProcessManager
     const servicesWithStatus = DETECTED_SERVICES.map(service => {
@@ -1392,7 +1433,8 @@ app.get("/workspace/services", (_req, res) => {
 
 /** Inicia um serviço */
 app.post("/workspace/services/:serviceId/start", async (req, res) => {
-    if (!WORKSPACE_ROOT) return res.status(400).json({ error: "workspace not set" });
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) return res.status(400).json({ error: "workspace not set" });
 
     const { serviceId } = req.params;
     const service = DETECTED_SERVICES.find(s => s.id === serviceId);
@@ -1418,7 +1460,8 @@ app.post("/workspace/services/:serviceId/start", async (req, res) => {
 
 /** Para um serviço */
 app.post("/workspace/services/:serviceId/stop", async (req, res) => {
-    if (!WORKSPACE_ROOT) return res.status(400).json({ error: "workspace not set" });
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) return res.status(400).json({ error: "workspace not set" });
 
     const { serviceId } = req.params;
 
@@ -1432,7 +1475,8 @@ app.post("/workspace/services/:serviceId/stop", async (req, res) => {
 
 /** Retorna status de um serviço */
 app.get("/workspace/services/:serviceId/status", (req, res) => {
-    if (!WORKSPACE_ROOT) return res.status(400).json({ error: "workspace not set" });
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) return res.status(400).json({ error: "workspace not set" });
 
     const { serviceId } = req.params;
     const status = processManager.getStatus(serviceId);
@@ -1442,7 +1486,8 @@ app.get("/workspace/services/:serviceId/status", (req, res) => {
 
 /** Retorna logs de um serviço */
 app.get("/workspace/services/:serviceId/logs", (req, res) => {
-    if (!WORKSPACE_ROOT) return res.status(400).json({ error: "workspace not set" });
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) return res.status(400).json({ error: "workspace not set" });
 
     const { serviceId } = req.params;
     const { limit = 100 } = req.query;
@@ -1457,7 +1502,8 @@ app.get("/workspace/services/:serviceId/logs", (req, res) => {
 
 /** Streaming de logs em tempo real (SSE) */
 app.get("/workspace/services/:serviceId/logs/stream", (req, res) => {
-    if (!WORKSPACE_ROOT) return res.status(400).json({ error: "workspace not set" });
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) return res.status(400).json({ error: "workspace not set" });
 
     const { serviceId } = req.params;
 
@@ -1492,18 +1538,20 @@ app.get("/workspace/services/:serviceId/logs/stream", (req, res) => {
 // ============================================
 
 app.get("/workspace/files", async (req, res) => {
-    if (!WORKSPACE_ROOT) return res.status(400).json({ error: "workspace not set" });
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) return res.status(400).json({ error: "workspace not set" });
     const { max = 5000 } = req.query;
-    const tree = await listRecursive(WORKSPACE_ROOT, { maxFiles: Number(max) });
-    res.json({ root: WORKSPACE_ROOT, count: tree.length, tree });
+    const tree = await listRecursive(wsRoot, { maxFiles: Number(max) });
+    res.json({ root: wsRoot, count: tree.length, tree });
 });
 
 app.get("/workspace/file", async (req, res) => {
-    if (!WORKSPACE_ROOT) return res.status(400).json({ error: "workspace not set" });
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) return res.status(400).json({ error: "workspace not set" });
     const rel = req.query.path;
     if (!rel) return res.status(400).json({ error: "path is required" });
     try {
-        const content = await readText(WORKSPACE_ROOT, rel);
+        const content = await readText(wsRoot, rel);
         res.json({ path: rel, content });
     } catch (e) {
         res.status(404).json({ error: "file not found", details: String(e) });
@@ -1511,11 +1559,12 @@ app.get("/workspace/file", async (req, res) => {
 });
 
 app.post("/workspace/write", async (req, res) => {
-    if (!WORKSPACE_ROOT) return res.status(400).json({ error: "workspace not set" });
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) return res.status(400).json({ error: "workspace not set" });
     const { path: rel, content } = req.body || {};
     if (!rel) return res.status(400).json({ error: "path is required" });
     try {
-        await writeFile(path.join(WORKSPACE_ROOT, rel), content ?? "", "utf8");
+        await writeFile(path.join(wsRoot, rel), content ?? "", "utf8");
         res.json({ ok: true, path: rel, bytes: Buffer.byteLength(content ?? "", "utf8") });
     } catch (e) {
         res.status(400).json({ error: "write failed", details: String(e) });
@@ -1526,13 +1575,14 @@ app.post("/workspace/write", async (req, res) => {
 // ✅ CORRECTED: /workspace/patch endpoint
 // ============================================
 app.post("/workspace/patch", async (req, res) => {
-    if (!WORKSPACE_ROOT) return res.status(400).json({ error: "workspace not set" });
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) return res.status(400).json({ error: "workspace not set" });
     const { diff, incidentId } = req.body || {};
     if (!diff) return res.status(400).json({ error: "diff is required" });
 
     try {
         console.log(`📝 Applying patch for incident: ${incidentId || 'unknown'}`);
-        const out = await applyUnifiedDiff(WORKSPACE_ROOT, diff);
+        const out = await applyUnifiedDiff(wsRoot, diff);
 
         // ✅ CRITICAL FIX: Format response as expected by Gateway
         const response = {
@@ -1565,18 +1615,20 @@ app.post("/workspace/patch", async (req, res) => {
     }
 });
 
-app.post("/workspace/test", async (_req, res) => {
-    if (!WORKSPACE_ROOT) return res.status(400).json({ error: "workspace not set" });
-    const meta = await detectProject(WORKSPACE_ROOT);
-    const result = await compileAndTest({ language: meta.language, buildTool: meta.buildTool, cwd: WORKSPACE_ROOT });
-    res.json({ root: WORKSPACE_ROOT, meta, result });
+app.post("/workspace/test", async (req, res) => {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) return res.status(400).json({ error: "workspace not set" });
+    const meta = await detectProject(wsRoot);
+    const result = await compileAndTest({ language: meta.language, buildTool: meta.buildTool, cwd: wsRoot });
+    res.json({ root: wsRoot, meta, result });
 });
 
 app.post("/workspace/run", async (req, res) => {
-    if (!WORKSPACE_ROOT) return res.status(400).json({ error: "workspace not set" });
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) return res.status(400).json({ error: "workspace not set" });
     const { cmd, args = [] } = req.body || {};
     if (!cmd) return res.status(400).json({ error: "cmd is required" });
-    const out = await run(cmd, args, WORKSPACE_ROOT, 5 * 60 * 1000);
+    const out = await run(cmd, args, wsRoot, 5 * 60 * 1000);
     res.json(out);
 });
 
@@ -1639,17 +1691,18 @@ app.get("/workspace/test-local/state", async (req, res) => {
  * Compiles the project without starting server
  */
 app.post("/workspace/test-local/compile", async (req, res) => {
-    if (!WORKSPACE_ROOT) return res.status(400).json({ error: "workspace not set" });
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) return res.status(400).json({ error: "workspace not set" });
 
     try {
         console.log("🔨 [TEST-LOCAL] Starting compilation...");
         TEST_LOCAL_STATE.status = "compiling";
 
-        const meta = await detectProject(WORKSPACE_ROOT);
+        const meta = await detectProject(wsRoot);
         const compileResult = await compileAndTest({
             language: meta.language,
             buildTool: meta.buildTool,
-            cwd: WORKSPACE_ROOT,
+            cwd: wsRoot,
             skipTests: true
         });
 
@@ -1700,7 +1753,8 @@ app.post("/workspace/test-local/compile", async (req, res) => {
  * 🧠 UPDATED: Now uses AI Vibe Coding Engine for auto-healing
  */
 app.post("/workspace/test-local/start", async (req, res) => {
-    if (!WORKSPACE_ROOT) return res.status(400).json({ error: "workspace not set" });
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) return res.status(400).json({ error: "workspace not set" });
 
     const { port } = req.body || {};
 
@@ -1708,14 +1762,14 @@ app.post("/workspace/test-local/start", async (req, res) => {
         console.log(`\n🚀 [TEST-LOCAL] Starting server (SIMPLE MODE)...`);
         TEST_LOCAL_STATE.status = "starting";
 
-        const meta = await detectProject(WORKSPACE_ROOT);
+        const meta = await detectProject(wsRoot);
 
         // Detect port if not provided
         let serverPort = port || 8080;
 
         // Para Java, encontrar o JAR e correr directamente
         if (meta.language === 'java') {
-            const targetDir = path.join(WORKSPACE_ROOT, 'target');
+            const targetDir = path.join(wsRoot, 'target');
 
             if (!fs.existsSync(targetDir)) {
                 throw new Error('target/ directory not found. Run mvn clean install first.');
@@ -1759,7 +1813,7 @@ app.post("/workspace/test-local/start", async (req, res) => {
             const startConfig = {
                 command,
                 args,
-                cwd: WORKSPACE_ROOT,
+                cwd: wsRoot,
                 port: serverPort,
                 env: cleanEnv
             };
@@ -1802,7 +1856,7 @@ app.post("/workspace/test-local/start", async (req, res) => {
             await processManager.start('test-local', {
                 command,
                 args,
-                cwd: WORKSPACE_ROOT,
+                cwd: wsRoot,
                 port: serverPort,
                 env: { ...process.env, PORT: String(serverPort) }
             });
@@ -1853,7 +1907,8 @@ app.post("/workspace/test-local/stop", async (req, res) => {
  * Returns discovered endpoints
  */
 app.get("/workspace/test-local/endpoints", async (req, res) => {
-    if (!WORKSPACE_ROOT) return res.status(400).json({ error: "workspace not set" });
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) return res.status(400).json({ error: "workspace not set" });
 
     try {
         console.log("📋 [TEST-LOCAL] Getting endpoints...");
@@ -1868,13 +1923,13 @@ app.get("/workspace/test-local/endpoints", async (req, res) => {
         }
 
         // Otherwise discover them
-        const scanner = new WorkspaceScanner(WORKSPACE_ROOT);
+        const scanner = new WorkspaceScanner(wsRoot);
         const structure = await scanner.scan();
 
-        const controllerAnalyzer = new ControllerAnalyzer(WORKSPACE_ROOT);
+        const controllerAnalyzer = new ControllerAnalyzer(wsRoot);
         const apiDocs = await controllerAnalyzer.generateApiDocs(structure.files);
 
-        const dtoAnalyzer = new DTOAnalyzer(WORKSPACE_ROOT);
+        const dtoAnalyzer = new DTOAnalyzer(wsRoot);
         const payloadDocs = await dtoAnalyzer.generatePayloadDocs(structure.files, apiDocs.endpoints);
 
         TEST_LOCAL_STATE.endpoints = payloadDocs.endpoints;
@@ -2027,16 +2082,17 @@ app.get("/workspace/test-local/logs", (req, res) => {
 
 
 /** Discover controllers and endpoints */
-app.get("/workspace/controllers", async (_req, res) => {
-    if (!WORKSPACE_ROOT) return res.status(400).json({ error: "workspace not set" });
+app.get("/workspace/controllers", async (req, res) => {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) return res.status(400).json({ error: "workspace not set" });
 
     try {
         console.log("🔍 [CONTROLLERS] Discovering controllers...");
 
-        const scanner = new WorkspaceScanner(WORKSPACE_ROOT);
+        const scanner = new WorkspaceScanner(wsRoot);
         const structure = await scanner.scan();
 
-        const controllerAnalyzer = new ControllerAnalyzer(WORKSPACE_ROOT);
+        const controllerAnalyzer = new ControllerAnalyzer(wsRoot);
         const apiDocs = await controllerAnalyzer.generateApiDocs(structure.files);
 
         console.log(`✅ [CONTROLLERS] Found ${apiDocs.totalEndpoints} endpoints in ${apiDocs.totalControllers} controllers`);
@@ -2052,19 +2108,20 @@ app.get("/workspace/controllers", async (_req, res) => {
 });
 
 /** Analyze DTOs and payloads */
-app.get("/workspace/dtos", async (_req, res) => {
-    if (!WORKSPACE_ROOT) return res.status(400).json({ error: "workspace not set" });
+app.get("/workspace/dtos", async (req, res) => {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) return res.status(400).json({ error: "workspace not set" });
 
     try {
         console.log("📦 [DTOS] Analyzing DTOs...");
 
-        const scanner = new WorkspaceScanner(WORKSPACE_ROOT);
+        const scanner = new WorkspaceScanner(wsRoot);
         const structure = await scanner.scan();
 
-        const controllerAnalyzer = new ControllerAnalyzer(WORKSPACE_ROOT);
+        const controllerAnalyzer = new ControllerAnalyzer(wsRoot);
         const apiDocs = await controllerAnalyzer.generateApiDocs(structure.files);
 
-        const dtoAnalyzer = new DTOAnalyzer(WORKSPACE_ROOT);
+        const dtoAnalyzer = new DTOAnalyzer(wsRoot);
         const payloadDocs = await dtoAnalyzer.generatePayloadDocs(structure.files, apiDocs.endpoints);
 
         console.log(`✅ [DTOS] Found ${payloadDocs.totalDtos} DTOs`);
@@ -2080,13 +2137,14 @@ app.get("/workspace/dtos", async (_req, res) => {
 });
 
 /** Get server configuration */
-app.get("/workspace/config", async (_req, res) => {
-    if (!WORKSPACE_ROOT) return res.status(400).json({ error: "workspace not set" });
+app.get("/workspace/config", async (req, res) => {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) return res.status(400).json({ error: "workspace not set" });
 
     try {
         console.log("⚙️ [CONFIG] Analyzing configuration...");
 
-        const configAnalyzer = new ConfigAnalyzer(WORKSPACE_ROOT);
+        const configAnalyzer = new ConfigAnalyzer(wsRoot);
         const config = await configAnalyzer.analyze();
 
         console.log(`✅ [CONFIG] Server port: ${config.server.port}`);
@@ -2154,7 +2212,8 @@ function extractTargetFiles(diff) {
  * Applies patch with automatic backup and rollback on failure
  */
 app.post("/workspace/safe-patch", async (req, res) => {
-    if (!WORKSPACE_ROOT) {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) {
         return res.status(400).json({
             error: "workspace not set",
             hint: "call POST /workspace/open first"
@@ -2186,7 +2245,7 @@ app.post("/workspace/safe-patch", async (req, res) => {
         const backupFiles = [];
 
         for (const relPath of targetFiles) {
-            const fullPath = path.join(WORKSPACE_ROOT, relPath);
+            const fullPath = path.join(wsRoot, relPath);
             if (await exists(fullPath)) {
                 const content = await readFile(fullPath, 'utf8');
                 backupFiles.push({ path: relPath, content });
@@ -2225,7 +2284,7 @@ app.post("/workspace/safe-patch", async (req, res) => {
 
         // 4. Apply patch
         try {
-            const result = await applyUnifiedDiff(WORKSPACE_ROOT, diff);
+            const result = await applyUnifiedDiff(wsRoot, diff);
             console.log(`✅ Patch applied successfully: ${result.target}`);
 
             res.json({
@@ -2240,7 +2299,7 @@ app.post("/workspace/safe-patch", async (req, res) => {
             console.error(`❌ Patch failed, rolling back: ${patchError.message}`);
 
             for (const file of backupFiles) {
-                const fullPath = path.join(WORKSPACE_ROOT, file.path);
+                const fullPath = path.join(wsRoot, file.path);
                 await writeFile(fullPath, file.content, 'utf8');
             }
 
@@ -2264,7 +2323,8 @@ app.post("/workspace/safe-patch", async (req, res) => {
  * Validates and simulates patch application WITHOUT modifying files
  */
 app.post("/workspace/patch/dry-run", async (req, res) => {
-    if (!WORKSPACE_ROOT) {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) {
         return res.status(400).json({
             error: "workspace not set",
             hint: "call POST /workspace/open first"
@@ -2296,7 +2356,7 @@ app.post("/workspace/patch/dry-run", async (req, res) => {
         // 3. Check if files exist
         const fileChecks = await Promise.all(
             targetFiles.map(async (relPath) => {
-                const fullPath = path.join(WORKSPACE_ROOT, relPath);
+                const fullPath = path.join(wsRoot, relPath);
                 const fileExists = await exists(fullPath);
                 let currentContent = null;
                 let lineCount = 0;
@@ -2367,7 +2427,8 @@ app.post("/workspace/validate-diff", async (req, res) => {
  * Creates manual backup of specific files
  */
 app.post("/workspace/backup", async (req, res) => {
-    if (!WORKSPACE_ROOT) {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) {
         return res.status(400).json({
             error: "workspace not set",
             hint: "call POST /workspace/open first"
@@ -2384,7 +2445,7 @@ app.post("/workspace/backup", async (req, res) => {
         const backupFiles = [];
 
         for (const relPath of files) {
-            const fullPath = path.join(WORKSPACE_ROOT, relPath);
+            const fullPath = path.join(wsRoot, relPath);
             if (await exists(fullPath)) {
                 const content = await readFile(fullPath, 'utf8');
                 backupFiles.push({ path: relPath, content });
@@ -2424,7 +2485,8 @@ app.post("/workspace/backup", async (req, res) => {
  * Restores files from a backup
  */
 app.post("/workspace/rollback", async (req, res) => {
-    if (!WORKSPACE_ROOT) {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) {
         return res.status(400).json({
             error: "workspace not set",
             hint: "call POST /workspace/open first"
@@ -2448,7 +2510,7 @@ app.post("/workspace/rollback", async (req, res) => {
         console.log(`♻️ Rolling back to backup: ${backupId}`);
 
         for (const file of backup.files) {
-            const fullPath = path.join(WORKSPACE_ROOT, file.path);
+            const fullPath = path.join(wsRoot, file.path);
             await writeFile(fullPath, file.content, 'utf8');
         }
 
@@ -2470,7 +2532,7 @@ app.post("/workspace/rollback", async (req, res) => {
  * GET /workspace/backups
  * Lists all available backups
  */
-app.get("/workspace/backups", (_req, res) => {
+app.get("/workspace/backups", (req, res) => {
     const backupList = Array.from(BACKUPS.entries()).map(([id, data]) => ({
         backupId: id,
         timestamp: data.timestamp,
@@ -2524,7 +2586,8 @@ app.delete("/workspace/backups/:backupId", (req, res) => {
 app.get("/workspace/diff/by-incident/:incidentId", async (req, res) => {
     const { incidentId } = req.params;
 
-    if (!WORKSPACE_ROOT) {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) {
         return res.status(400).json({ error: "workspace not set" });
     }
 
@@ -2574,7 +2637,7 @@ app.get("/workspace/diff/by-incident/:incidentId", async (req, res) => {
     try {
         const diffs = [];
         for (const file of matchedBackup.files) {
-            const fullPath = path.join(WORKSPACE_ROOT, file.path);
+            const fullPath = path.join(wsRoot, file.path);
             let currentContent = '';
             try {
                 currentContent = await readFile(fullPath, 'utf8');
@@ -2635,7 +2698,8 @@ app.get("/workspace/diff/by-incident/:incidentId", async (req, res) => {
 app.get("/workspace/diff/:backupId", async (req, res) => {
     const { backupId } = req.params;
 
-    if (!WORKSPACE_ROOT) {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) {
         return res.status(400).json({ error: "workspace not set" });
     }
 
@@ -2652,7 +2716,7 @@ app.get("/workspace/diff/:backupId", async (req, res) => {
         const diffs = [];
 
         for (const file of backup.files) {
-            const fullPath = path.join(WORKSPACE_ROOT, file.path);
+            const fullPath = path.join(wsRoot, file.path);
             let currentContent = '';
 
             try {
@@ -2709,7 +2773,8 @@ app.get("/workspace/diff/:backupId", async (req, res) => {
  * - framework: spring-boot, express, flask, etc (optional)
  */
 app.get("/workspace/detect-port", async (req, res) => {
-    if (!WORKSPACE_ROOT) {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) {
         return res.status(400).json({
             error: "workspace not set",
             hint: "call POST /workspace/open first"
@@ -2719,7 +2784,7 @@ app.get("/workspace/detect-port", async (req, res) => {
     const { servicePath = '', language, framework } = req.query;
 
     try {
-        const fullPath = path.join(WORKSPACE_ROOT, servicePath);
+        const fullPath = path.join(wsRoot, servicePath);
         console.log(`🔍 Detecting port for service at: ${fullPath}`);
 
         let port = null;
@@ -2973,18 +3038,19 @@ async function detectDotNetPort(servicePath) {
 
 /** Prepare for testing: compile + discover endpoints */
 app.post("/workspace/test-local/prepare", async (req, res) => {
-    if (!WORKSPACE_ROOT) return res.status(400).json({ error: "workspace not set" });
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) return res.status(400).json({ error: "workspace not set" });
 
     try {
         console.log("🔧 [TEST-LOCAL] Preparing test environment...");
         TEST_LOCAL_STATE.status = "compiling";
 
         // Step 1: Compile
-        const meta = await detectProject(WORKSPACE_ROOT);
+        const meta = await detectProject(wsRoot);
         const compileResult = await compileAndTest({
             language: meta.language,
             buildTool: meta.buildTool,
-            cwd: WORKSPACE_ROOT,
+            cwd: wsRoot,
             skipTests: true
         });
 
@@ -3000,19 +3066,19 @@ app.post("/workspace/test-local/prepare", async (req, res) => {
         TEST_LOCAL_STATE.status = "compiled";
 
         // Step 2: Discover endpoints
-        const scanner = new WorkspaceScanner(WORKSPACE_ROOT);
+        const scanner = new WorkspaceScanner(wsRoot);
         const structure = await scanner.scan();
 
-        const controllerAnalyzer = new ControllerAnalyzer(WORKSPACE_ROOT);
+        const controllerAnalyzer = new ControllerAnalyzer(wsRoot);
         const apiDocs = await controllerAnalyzer.generateApiDocs(structure.files);
 
-        const dtoAnalyzer = new DTOAnalyzer(WORKSPACE_ROOT);
+        const dtoAnalyzer = new DTOAnalyzer(wsRoot);
         const payloadDocs = await dtoAnalyzer.generatePayloadDocs(structure.files, apiDocs.endpoints);
 
         TEST_LOCAL_STATE.endpoints = payloadDocs.endpoints;
 
         // Step 3: Get config
-        const configAnalyzer = new ConfigAnalyzer(WORKSPACE_ROOT);
+        const configAnalyzer = new ConfigAnalyzer(wsRoot);
         const config = await configAnalyzer.analyze();
         TEST_LOCAL_STATE.config = config;
 
@@ -3050,7 +3116,8 @@ app.post("/workspace/test-local/prepare", async (req, res) => {
  * SSE endpoint for real-time compilation logs
  */
 app.get("/workspace/test-local/compile/stream", async (req, res) => {
-    if (!WORKSPACE_ROOT) {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) {
         res.status(400).json({ error: "workspace not set" });
         return;
     }
@@ -3064,7 +3131,7 @@ app.get("/workspace/test-local/compile/stream", async (req, res) => {
     res.flushHeaders();
 
     try {
-        const meta = await detectProject(WORKSPACE_ROOT);
+        const meta = await detectProject(wsRoot);
 
         // Send initial event
         res.write(`event: log\n`);
@@ -3106,7 +3173,7 @@ app.get("/workspace/test-local/compile/stream", async (req, res) => {
 
         const startTime = Date.now();
         const proc = spawn(command, args, {
-            cwd: WORKSPACE_ROOT,
+            cwd: wsRoot,
             shell: true,
             env: { ...process.env, MAVEN_OPTS: "-Dorg.slf4j.simpleLogger.defaultLogLevel=info" }
         });
@@ -3578,14 +3645,15 @@ app.get("/system/info", (req, res) => {
  * Analisa controllers e retorna todos os endpoints da API
  */
 app.get("/workspace/api-docs", async (req, res) => {
-    if (!WORKSPACE_ROOT) {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) {
         return res.status(400).json({
             error: "workspace not set",
             hint: "call POST /workspace/open first"
         });
     }
 
-    console.log(`📚 [API-DOCS] Analyzing controllers in ${WORKSPACE_ROOT}`);
+    console.log(`📚 [API-DOCS] Analyzing controllers in ${wsRoot}`);
 
     try {
         // Primeiro, escanear arquivos do workspace
@@ -3602,7 +3670,7 @@ app.get("/workspace/api-docs", async (req, res) => {
 
                 for (const entry of entries) {
                     const fullPath = pathModule.join(dir, entry.name);
-                    const relativePath = pathModule.relative(WORKSPACE_ROOT, fullPath);
+                    const relativePath = pathModule.relative(wsRoot, fullPath);
 
                     // Skip common ignored directories
                     if (entry.name === 'node_modules' || entry.name === 'target' ||
@@ -3622,12 +3690,12 @@ app.get("/workspace/api-docs", async (req, res) => {
             }
         }
 
-        await scanDir(WORKSPACE_ROOT);
+        await scanDir(wsRoot);
 
         console.log(`📁 [API-DOCS] Found ${files.length} Java files`);
 
         // Agora analisar os controllers
-        const controllerAnalyzer = new ControllerAnalyzer(WORKSPACE_ROOT);
+        const controllerAnalyzer = new ControllerAnalyzer(wsRoot);
         const apiDocs = await controllerAnalyzer.generateApiDocs(files);
 
         console.log(`✅ [API-DOCS] Found ${apiDocs.totalEndpoints} endpoints in ${apiDocs.totalControllers} controllers`);
@@ -3638,7 +3706,7 @@ app.get("/workspace/api-docs", async (req, res) => {
             controllers: apiDocs.controllers.map(c => c.className),
             totalEndpoints: apiDocs.totalEndpoints,
             totalControllers: apiDocs.totalControllers,
-            workspace: WORKSPACE_ROOT
+            workspace: wsRoot
         });
 
     } catch (error) {
@@ -3660,7 +3728,8 @@ app.get("/workspace/api-docs", async (req, res) => {
  * Retorna endpoints de uma controller específica
  */
 app.get("/workspace/api-docs/:controller", async (req, res) => {
-    if (!WORKSPACE_ROOT) {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) {
         return res.status(400).json({
             error: "workspace not set",
             hint: "call POST /workspace/open first"
@@ -3685,7 +3754,7 @@ app.get("/workspace/api-docs/:controller", async (req, res) => {
 
                 for (const entry of entries) {
                     const fullPath = pathModule.join(dir, entry.name);
-                    const relativePath = pathModule.relative(WORKSPACE_ROOT, fullPath);
+                    const relativePath = pathModule.relative(wsRoot, fullPath);
 
                     if (entry.name === 'node_modules' || entry.name === 'target' ||
                         entry.name === 'build' || entry.name === '.git' ||
@@ -3704,10 +3773,10 @@ app.get("/workspace/api-docs/:controller", async (req, res) => {
             }
         }
 
-        await scanDir(WORKSPACE_ROOT);
+        await scanDir(wsRoot);
 
         // Analisar os controllers
-        const controllerAnalyzer = new ControllerAnalyzer(WORKSPACE_ROOT);
+        const controllerAnalyzer = new ControllerAnalyzer(wsRoot);
         const apiDocs = await controllerAnalyzer.generateApiDocs(files);
 
         const found = apiDocs.controllers?.find(c =>
@@ -3828,7 +3897,8 @@ app.get("/ai-engine/fixes", (req, res) => {
  * Recolhe ficheiros de configuração para análise AI
  */
 app.get("/workspace/smart-config", async (req, res) => {
-    if (!WORKSPACE_ROOT) {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) {
         return res.status(400).json({ error: "workspace not set" });
     }
 
@@ -3851,10 +3921,10 @@ app.get("/workspace/smart-config", async (req, res) => {
         ];
 
         const collectedFiles = [];
-        const meta = await detectProject(WORKSPACE_ROOT);
+        const meta = await detectProject(wsRoot);
 
         for (const pattern of configPatterns) {
-            const filePath = path.join(WORKSPACE_ROOT, pattern);
+            const filePath = path.join(wsRoot, pattern);
             if (fs.existsSync(filePath)) {
                 try {
                     const content = fs.readFileSync(filePath, 'utf8');
@@ -3875,7 +3945,7 @@ app.get("/workspace/smart-config", async (req, res) => {
 
         // Detectar profiles disponíveis
         const availableProfiles = [];
-        const resourcesDir = path.join(WORKSPACE_ROOT, 'src/main/resources');
+        const resourcesDir = path.join(wsRoot, 'src/main/resources');
         if (fs.existsSync(resourcesDir)) {
             const files = fs.readdirSync(resourcesDir);
             files.forEach(file => {
@@ -3888,7 +3958,7 @@ app.get("/workspace/smart-config", async (req, res) => {
 
         res.json({
             ok: true,
-            workspace: WORKSPACE_ROOT,
+            workspace: wsRoot,
             language: meta.language,
             buildTool: meta.buildTool,
             framework: meta.framework || 'unknown',
@@ -3974,7 +4044,8 @@ app.post("/workspace/test-local/restart", async (req, res) => {
  * Response: { "ok": true, "results": "file:line: matching text\n...", "count": 15 }
  */
 app.post("/workspace/search", async (req, res) => {
-    if (!WORKSPACE_ROOT) {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) {
         return res.status(400).json({
             ok: false,
             error: "workspace not set",
@@ -4009,7 +4080,7 @@ app.post("/workspace/search", async (req, res) => {
 
         // Escape pattern for shell safety and limit results
         const safePattern = pattern.replace(/"/g, '\\"').replace(/`/g, '\\`').replace(/\$/g, '\\$');
-        cmd += `"${safePattern}" "${WORKSPACE_ROOT}" | head -100`;
+        cmd += `"${safePattern}" "${wsRoot}" | head -100`;
 
         let stdout = '';
         try {
@@ -4041,7 +4112,7 @@ app.post("/workspace/search", async (req, res) => {
         const results = stdout
             .split('\n')
             .filter(line => line.trim())
-            .map(line => line.replace(WORKSPACE_ROOT + '/', ''))
+            .map(line => line.replace(wsRoot + '/', ''))
             .join('\n');
 
         const count = results.split('\n').filter(l => l.trim()).length;
@@ -4071,7 +4142,8 @@ app.post("/workspace/search", async (req, res) => {
  * Dangerous commands are blocked.
  */
 app.post("/workspace/exec", async (req, res) => {
-    if (!WORKSPACE_ROOT) {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) {
         return res.status(400).json({
             ok: false,
             error: "workspace not set",
@@ -4107,7 +4179,7 @@ app.post("/workspace/exec", async (req, res) => {
         const execAsync = promisify(execCb);
 
         const result = await execAsync(command, {
-            cwd: WORKSPACE_ROOT,
+            cwd: wsRoot,
             timeout: 60000,
             maxBuffer: 5 * 1024 * 1024,
             env: { ...process.env, FORCE_COLOR: '0' }
@@ -4238,7 +4310,8 @@ app.post("/workspace/test-endpoint", async (req, res) => {
  * Body: { branchName, commitMessage, files? }
  */
 app.post("/workspace/git/create-fix-branch", async (req, res) => {
-    if (!WORKSPACE_ROOT) {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) {
         return res.status(400).json({ error: "workspace not set" });
     }
 
@@ -4250,7 +4323,7 @@ app.post("/workspace/git/create-fix-branch", async (req, res) => {
     try {
         const { execSync } = await import('child_process');
         const opts = {
-            cwd: WORKSPACE_ROOT,
+            cwd: wsRoot,
             encoding: 'utf8',
             timeout: 30000,
             env: {
@@ -4612,14 +4685,32 @@ app.post("/workspace/git/create-fix-branch", async (req, res) => {
                         .replace(/\.git$/, '');
                     const [workspace, repoSlug] = repoPath.split('/');
 
-                    // gitToken é "username:appPassword" — codificar para Basic Auth
-                    const credentials = Buffer.from(gitToken).toString('base64');
+                    // gitToken may be:
+                    //   - "x-token-auth:TOKEN" (Repository Access Token from Gateway)
+                    //   - "username:appPassword" (App Password)
+                    //   - plain TOKEN (Repository Access Token)
+                    let authHeader;
+                    if (gitToken.includes(':')) {
+                        // Contains colon — could be user:pass (App Password) or x-token-auth:token
+                        const [user, pass] = gitToken.split(':', 2);
+                        if (user === 'x-token-auth') {
+                            // Repository Access Token — use Bearer with the token part
+                            authHeader = `Bearer ${pass}`;
+                        } else {
+                            // App Password — use Basic auth
+                            const credentials = Buffer.from(gitToken).toString('base64');
+                            authHeader = `Basic ${credentials}`;
+                        }
+                    } else {
+                        // Plain token — use Bearer (Repository Access Token)
+                        authHeader = `Bearer ${gitToken}`;
+                    }
 
                     const response = await fetch(
                         `https://api.bitbucket.org/2.0/repositories/${workspace}/${repoSlug}/pullrequests`, {
                             method: 'POST',
                             headers: {
-                                'Authorization': `Basic ${credentials}`,
+                                'Authorization': authHeader,
                                 'Content-Type': 'application/json'
                             },
                             body: JSON.stringify({
@@ -4674,13 +4765,14 @@ app.post("/workspace/git/create-fix-branch", async (req, res) => {
  * Returns current git status (branch, changes, remote)
  */
 app.get("/workspace/git/status", async (req, res) => {
-    if (!WORKSPACE_ROOT) {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) {
         return res.status(400).json({ error: "workspace not set" });
     }
 
     try {
         const { execSync } = await import('child_process');
-        const opts = { cwd: WORKSPACE_ROOT, encoding: 'utf8', timeout: 10000 };
+        const opts = { cwd: wsRoot, encoding: 'utf8', timeout: 10000 };
 
         let branch = '', remoteUrl = '', status = '';
         let isGitRepo = false;
@@ -4723,7 +4815,8 @@ app.get("/workspace/git/status", async (req, res) => {
  *   - filter: 'all' | 'unresolved' | 'review' (default: 'all')
  */
 app.get("/workspace/git/pr/comments", async (req, res) => {
-    if (!WORKSPACE_ROOT) {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) {
         return res.status(400).json({ error: "workspace not set" });
     }
 
@@ -4788,7 +4881,8 @@ app.get("/workspace/git/pr/comments", async (req, res) => {
  *   - prNumber (required): PR/MR number
  */
 app.get("/workspace/git/pr/comments/:commentId", async (req, res) => {
-    if (!WORKSPACE_ROOT) {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) {
         return res.status(400).json({ error: "workspace not set" });
     }
 
@@ -4831,7 +4925,8 @@ app.get("/workspace/git/pr/comments/:commentId", async (req, res) => {
  *   - inReplyToId: Parent comment ID (for thread replies)
  */
 app.post("/workspace/git/pr/comments", async (req, res) => {
-    if (!WORKSPACE_ROOT) {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) {
         return res.status(400).json({ error: "workspace not set" });
     }
 
@@ -4888,7 +4983,8 @@ app.post("/workspace/git/pr/comments", async (req, res) => {
  *   - prNumber (required): PR/MR number
  */
 app.post("/workspace/git/pr/comments/:commentId/resolve", async (req, res) => {
-    if (!WORKSPACE_ROOT) {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) {
         return res.status(400).json({ error: "workspace not set" });
     }
 
@@ -4925,7 +5021,8 @@ app.post("/workspace/git/pr/comments/:commentId/resolve", async (req, res) => {
  *   - prNumber (required): PR/MR number
  */
 app.post("/workspace/git/pr/comments/:commentId/unresolve", async (req, res) => {
-    if (!WORKSPACE_ROOT) {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) {
         return res.status(400).json({ error: "workspace not set" });
     }
 
@@ -4966,7 +5063,8 @@ app.post("/workspace/git/pr/comments/:commentId/unresolve", async (req, res) =>
  *   - branch: Branch to apply fix on (defaults to current branch)
  */
 app.post("/workspace/git/pr/comments/:commentId/fix-and-resolve", async (req, res) => {
-    if (!WORKSPACE_ROOT) {
+    const wsRoot = resolveWorkspaceRoot(req);
+    if (!wsRoot) {
         return res.status(400).json({ error: "workspace not set" });
     }
 
@@ -5101,7 +5199,7 @@ async function _getGitProvider() {
 // ============================================
 
 /** Lista todos os workspaces abertos */
-app.get("/workspaces", (_req, res) => {
+app.get("/workspaces", (req, res) => {
     res.json({
         workspaces: wsManager.list(),
         total: wsManager.count,