deepdebug-local-agent 1.10.0 → 1.12.0

package/test/la-protocol-v2/workspace-materializer.test.js

@@ -0,0 +1,341 @@
+// LA-2: the Local Agent materializes a workspace itself for a job.assign (flag LOCAL_AGENT_JOBS_AUTO_WORKSPACE, default off). Allowlist (fail closed),
+// customer-side credentials only, tenant gate, cache safety (symlink, foreign dir), no secret anywhere, one clone at a time, job manager integration.
+// Real git is used against a local bare repository (the test seam allows the file transport; production never does).
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import crypto from "node:crypto";
+import { execFileSync } from "node:child_process";
+import { createWorkspaceMaterializer, resolveMaterializeConfig, parseAllowlist, repoTarget, MaterializeError } from "../../src/la-protocol-v2/jobs/workspace-materializer.js";
+import { classifyGitFailure, gitEnv, ensureAskpassScript, SAFE_GIT_CONFIG } from "../../src/la-protocol-v2/jobs/git-exec.js";
+import { createJobManager } from "../../src/la-protocol-v2/jobs/manager.js";
+import { resolveJobsConfig } from "../../src/la-protocol-v2/jobs/config.js";
+import { createAudit } from "../../src/la-protocol-v2/content-handlers/audit.js";
+import { WorkspaceManager } from "../../src/workspace-manager.js";
+import { WORKSPACE_SIDECAR } from "../../src/utils/open-gate.js";
+
+const TENANT = "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f";
+const OTHER = "9a9a9a9a-5a4d-4e7b-9c21-0a1b2c3d4e5f";
+const WS = "11111111-2222-4333-8444-555555555555";
+const SECRET = "ghp_PLANTEDsecretTOKEN0123456789abcdef";
+const REF = { provider: "github", org: "acme", repo: "app", branch: "main" };
+const noop = () => {};
+const tmp = (p) => fs.mkdtempSync(path.join(os.tmpdir(), `la-mat-${p}-`));
+const git = (cwd, ...a) => execFileSync("git", ["-c", "user.email=t@t", "-c", "user.name=t", ...a], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+
+/** A bare "remote" with one commit on main (and one on `dev`); returns its path. */
+function makeRemote() {
+    const bare = tmp("remote");
+    const work = tmp("seed");
+    git(bare, "init", "--bare", "-b", "main", ".");
+    git(work, "init", "-b", "main", ".");
+    fs.writeFileSync(path.join(work, "a.txt"), "one\n");
+    git(work, "add", "."); git(work, "commit", "-m", "one");
+    git(work, "remote", "add", "origin", bare);
+    git(work, "push", "origin", "main");
+    return { bare, work, push(text) { fs.writeFileSync(path.join(work, "a.txt"), text); git(work, "commit", "-am", "more"); git(work, "push", "origin", "main"); } };
+}
+
+function setup({ allow = "github.com/acme/app", remote = null, env = {}, runGit = undefined, tenant = TENANT } = {}) {
+    const cache = tmp("cache");
+    const warn = [];
+    const cfg = resolveMaterializeConfig({ LOCAL_AGENT_JOBS_AUTO_WORKSPACE: "true", LOCAL_AGENT_ALLOWED_REPOS: allow, LOCAL_AGENT_WORKSPACE_CACHE: cache, ...env }, (m) => warn.push(m));
+    const wsManager = new WorkspaceManager();
+    const audit = createAudit({});
+    const seams = remote ? { remoteUrl: () => remote.bare, gitConfig: ["-c", "protocol.file.allow=always"] } : {};
+    if (runGit) seams.runGit = runGit;
+    const mat = createWorkspaceMaterializer({ config: cfg, tenantId: tenant, wsManager, audit, env: { PATH: process.env.PATH, HOME: process.env.HOME, ...(env.PROC || {}) }, seams });
+    return { mat, cfg, cache, wsManager, audit, warn };
+}
+
+// ---------------------------------------------------------------- config / parsing
+
+test("config: off by default; on needs the flag; an empty allowlist warns and admits nothing", () => {
+    for (const v of [undefined, "", "false", "0", "nope"]) assert.deepEqual(resolveMaterializeConfig({ LOCAL_AGENT_JOBS_AUTO_WORKSPACE: v, LOCAL_AGENT_ALLOWED_REPOS: "github.com/acme/app" }), { enabled: false });
+    const w = [];
+    const c = resolveMaterializeConfig({ LOCAL_AGENT_JOBS_AUTO_WORKSPACE: "true" }, (m) => w.push(m));
+    assert.equal(c.enabled, true);
+    assert.match(w.join("\n"), /empty/);
+    const { mat } = setup({ allow: "" });
+    assert.equal(mat.admit(WS, REF), false);
+    assert.equal(mat.stats.refused.repo_not_allowed, 1);
+});
+
+test("allowlist parsing: exact and org/*; garbage (scheme, @, .., bare *, host/*) is dropped", () => {
+    const a = parseAllowlist("github.com/Acme/App, github.com/corp/*\nhttps://github.com/x/y git@github.com:x/y.git github.com/../x github.com/o/.. * github.com/* # c");
+    assert.deepEqual([...a.exact], ["github.com/acme/app"]);
+    assert.deepEqual([...a.orgs], ["github.com/corp"]);
+    assert.ok(a.invalid >= 6);
+});
+
+test("repoTarget: closed provider list, strict segments, branch rules, no credentials in the URL", () => {
+    const ok = repoTarget(REF);
+    assert.equal(ok.url, "https://github.com/acme/app.git");
+    assert.ok(!/@/.test(ok.url));
+    for (const bad of [{ ...REF, org: ".." }, { ...REF, repo: "." }, { ...REF, org: "a/b" }, { ...REF, org: "a@b" }, { ...REF, repo: "x y" }, { ...REF, provider: "azure" }, { ...REF, provider: "other" },
+        { ...REF, provider: "evil.com" }, { ...REF, branch: "-x" }, { ...REF, branch: "a..b" }, { ...REF, branch: "a//b" }, { ...REF, branch: "x.lock" }, { ...REF, branch: "/x" }, { ...REF, branch: "a b" }, null, {}]) assert.equal(repoTarget(bad), null, JSON.stringify(bad));
+    assert.equal(repoTarget({ ...REF, provider: "gitlab" }).url, "https://gitlab.com/acme/app.git");
+});
+
+test("git-exec: failure classification by code only; env is minimal and never carries the agent's own secrets", () => {
+    assert.equal(classifyGitFailure({}, "fatal: Authentication failed for 'https://x/'"), "auth");
+    assert.equal(classifyGitFailure({}, "fatal: could not read Username for 'https://github.com': terminal prompts disabled"), "auth");
+    assert.equal(classifyGitFailure({}, "fatal: Remote branch zz not found in upstream origin"), "branch_missing");
+    assert.equal(classifyGitFailure({}, "remote: Repository not found."), "not_found");
+    assert.equal(classifyGitFailure({ killed: true }, ""), "timeout");
+    assert.equal(classifyGitFailure({}, "boom"), "failed");
+    const ac = new AbortController(); ac.abort();
+    assert.equal(classifyGitFailure({}, "", ac.signal), "aborted");
+    const e = gitEnv({ PATH: "/bin", HOME: "/h", LOCAL_AGENT_TOKEN: "x", DEEPDEBUG_API_KEY: "y", LOCAL_AGENT_LLM_KEY: "z", SSH_AUTH_SOCK: "/s" });
+    assert.deepEqual(Object.keys(e).sort(), ["GCM_INTERACTIVE", "GIT_TERMINAL_PROMPT", "HOME", "LC_ALL", "PATH", "SSH_AUTH_SOCK"]);
+    assert.ok(SAFE_GIT_CONFIG.includes("protocol.ext.allow=never") && SAFE_GIT_CONFIG.includes("protocol.file.allow=never"));
+});
+
+// ---------------------------------------------------------------- admission
+
+test("admit: allowlisted repo ok; org/* ok; repo outside the allowlist, bad ids and 'default' are refused with a code", () => {
+    const { mat, audit } = setup({ allow: "github.com/acme/app,github.com/corp/*" });
+    assert.equal(mat.admit(WS, REF), true);
+    assert.equal(mat.admit(WS, { ...REF, org: "corp", repo: "anything" }), true);
+    assert.equal(mat.admit(WS, { ...REF, org: "evil" }), false);
+    assert.equal(mat.admit(WS, { ...REF, repo: "other" }), false);
+    assert.equal(mat.admit(WS, { ...REF, org: "..", repo: ".." }), false);
+    for (const id of ["default", "../x", "a/b", "", ".hidden", "x".repeat(101), null, 5]) assert.equal(mat.admit(id, REF), false, String(id));
+    assert.equal(mat.admit(WS, null), false);
+    assert.ok(mat.stats.refused.repo_not_allowed >= 2);
+    assert.ok(mat.stats.refused.bad_workspace_id >= 7);
+    const trail = JSON.stringify(audit.tail(100));
+    assert.ok(!trail.includes("evil") && !trail.includes(WS), "audit holds short hashes and codes, not names");
+});
+
+test("admit: an id already open (here or for another tenant) is never replaced", async () => {
+    const { mat, wsManager, cache } = setup();
+    const d = path.join(cache, "other"); fs.mkdirSync(d);
+    await wsManager.open(WS, d, { tenantId: OTHER });
+    assert.equal(mat.admit(WS, REF), false);
+    assert.equal(mat.stats.refused.already_open_elsewhere, 1);
+});
+
+test("admit: a cache entry that is a symlink, a directory without registration, or one of ANOTHER tenant is refused", () => {
+    const { mat, cache } = setup();
+    const outside = tmp("outside");
+    fs.symlinkSync(outside, path.join(cache, WS));
+    assert.equal(mat.admit(WS, REF), false);
+    assert.equal(mat.stats.refused.cache_entry_unsafe, 1);
+    const ws2 = "22222222-2222-4333-8444-555555555555";
+    fs.mkdirSync(path.join(cache, ws2));
+    assert.equal(mat.admit(ws2, REF), false);
+    assert.equal(mat.stats.refused.foreign_directory, 1);
+    const ws3 = "33333333-2222-4333-8444-555555555555";
+    const d3 = path.join(fs.realpathSync(cache), ws3); fs.mkdirSync(d3);
+    fs.writeFileSync(path.join(d3, WORKSPACE_SIDECAR), JSON.stringify({ id: ws3, tenantId: OTHER, root: d3, openedAt: "x" }));
+    assert.equal(mat.admit(ws3, REF), false);
+    assert.equal(mat.stats.refused.tenant_mismatch, 1);
+    assert.deepEqual(fs.readdirSync(outside), [], "nothing was written through the symlink");
+});
+
+test("admit: a configured token file that cannot be read is a clear refusal (credential_unavailable); without a token file the machine's own credentials are used", () => {
+    const { mat } = setup({ env: { LOCAL_AGENT_GIT_TOKEN_FILE: "/nonexistent/token" } });
+    assert.equal(mat.admit(WS, REF), false);
+    assert.equal(mat.stats.refused.credential_unavailable, 1);
+    assert.equal(setup().mat.admit(WS, REF), true);
+});
+
+// ---------------------------------------------------------------- real clone against a local bare repository
+
+test("ensure: clones into the cache, registers the workspace under the SESSION tenant, leaves no token and no credential in .git/config", async () => {
+    const remote = makeRemote();
+    const { mat, wsManager, cache, audit } = setup({ remote });
+    assert.equal(mat.admit(WS, REF), true);
+    const r = await mat.ensure(WS, REF);
+    assert.equal(r.root, path.join(fs.realpathSync(cache), WS));
+    assert.equal(fs.readFileSync(path.join(r.root, "a.txt"), "utf8"), "one\n");
+    const w = wsManager.list().find((x) => x.id === WS);
+    assert.equal(w.tenantId, TENANT);
+    const cfg = fs.readFileSync(path.join(r.root, ".git", "config"), "utf8");
+    assert.ok(!/@|token|password|x-access-token/i.test(cfg.replace(/user\.email/g, "")), "config has no credential");
+    assert.deepEqual(fs.readdirSync(cache).filter((n) => n.startsWith(".tmp-")), [], "no temp clone left");
+    assert.equal(mat.stats.cloned, 1);
+    assert.ok(audit.tail().some((e) => e.event === "workspace_ready"));
+});
+
+test("ensure: second call fetches and fast-forwards a CLEAN clone; a DIRTY one is kept untouched", async () => {
+    const remote = makeRemote();
+    const { mat } = setup({ remote });
+    const r = await mat.ensure(WS, REF);
+    remote.push("two\n");
+    await mat.ensure(WS, REF);
+    assert.equal(fs.readFileSync(path.join(r.root, "a.txt"), "utf8"), "two\n");
+    fs.writeFileSync(path.join(r.root, "a.txt"), "local work\n");
+    remote.push("three\n");
+    await mat.ensure(WS, REF);
+    assert.equal(fs.readFileSync(path.join(r.root, "a.txt"), "utf8"), "local work\n", "previous job's work is never reset");
+    assert.equal(mat.stats.reused, 2);
+});
+
+test("ensure: a missing branch fails with a code, leaves no directory behind and nothing registered", async () => {
+    const remote = makeRemote();
+    const { mat, wsManager, cache } = setup({ remote });
+    await assert.rejects(() => mat.ensure(WS, { ...REF, branch: "nope" }), (e) => e instanceof MaterializeError && e.code === "branch_missing" && e.jobErrorCode === "infra" && !/nope|acme|bare|remote/.test(e.message));
+    assert.deepEqual(fs.readdirSync(cache), []);
+    assert.equal(wsManager.list().length, 0);
+});
+
+test("ensure: concurrent jobs for the same workspace share ONE clone; two workspaces are serialized (one clone at a time)", async () => {
+    const remote = makeRemote();
+    let active = 0, peak = 0, clones = 0;
+    const real = (await import("../../src/la-protocol-v2/jobs/git-exec.js")).runGit;
+    const spy = async (args, o) => { const isClone = args[0] === "clone"; if (isClone) { clones++; active++; peak = Math.max(peak, active); await new Promise((r) => setTimeout(r, 40)); } try { return await real(args, o); } finally { if (isClone) active--; } };
+    const { mat } = setup({ remote, allow: "github.com/acme/*", runGit: spy });
+    const WS2 = "44444444-2222-4333-8444-555555555555";
+    await Promise.all([mat.ensure(WS, REF), mat.ensure(WS, REF), mat.ensure(WS2, REF)]);
+    assert.equal(clones, 2);
+    assert.equal(peak, 1);
+});
+
+test("ensure: a workspace of another tenant on disk, a symlinked cache entry and a repo outside the allowlist are refused even if admit() was skipped", async () => {
+    const remote = makeRemote();
+    const { mat, cache } = setup({ remote });
+    const outside = tmp("outside");
+    fs.symlinkSync(outside, path.join(cache, WS));
+    await assert.rejects(() => mat.ensure(WS, REF), (e) => e.code === "cache_entry_unsafe");
+    assert.deepEqual(fs.readdirSync(outside), []);
+    await assert.rejects(() => mat.ensure("55555555-2222-4333-8444-555555555555", { ...REF, org: "evil" }), (e) => e.code === "repo_not_allowed");
+    const other = setup({ remote, tenant: OTHER });
+    const first = await mat.ensure("66666666-2222-4333-8444-555555555555", REF);
+    fs.cpSync(first.root, path.join(other.cache, "66666666-2222-4333-8444-555555555555"), { recursive: true });   // same sidecar, tenant TENANT, found by OTHER's agent
+    await assert.rejects(() => other.mat.ensure("66666666-2222-4333-8444-555555555555", REF), (e) => e.code === "tenant_mismatch" || e.code === "foreign_directory");
+});
+
+test("ensure: a clone above the size limit is removed (too_large); an abort before start does not run git", async () => {
+    const remote = makeRemote();
+    const { mat, cache } = setup({ remote, env: { LOCAL_AGENT_WORKSPACE_MAX_BYTES: String(1024 * 1024) } });
+    fs.writeFileSync(path.join(remote.work, "big.bin"), crypto.randomBytes(1200 * 1024));
+    git(remote.work, "add", "."); git(remote.work, "commit", "-m", "big"); git(remote.work, "push", "origin", "main");
+    await assert.rejects(() => mat.ensure(WS, REF), (e) => e.code === "too_large");
+    assert.deepEqual(fs.readdirSync(cache), []);
+    const ac = new AbortController(); ac.abort();
+    await assert.rejects(() => mat.ensure("77777777-2222-4333-8444-555555555555", REF, ac.signal), (e) => e.code === "aborted");
+});
+
+// ---------------------------------------------------------------- secrets
+
+test("secrets: the token file is only passed by PATH (askpass), never in args, env values, logs, audit or errors; the askpass script holds no token", async () => {
+    const dir = tmp("tok");
+    const tokenFile = path.join(dir, "token");
+    fs.writeFileSync(tokenFile, SECRET, { mode: 0o600 });
+    const calls = [];
+    const fake = async (args, o) => { calls.push({ args, env: o.env }); return { ok: false, code: "auth" }; };
+    const logs = [];
+    const { mat, audit, cache } = setup({ env: { LOCAL_AGENT_GIT_TOKEN_FILE: tokenFile }, runGit: fake });
+    await assert.rejects(() => mat.ensure(WS, REF), (e) => e.code === "auth" && !e.message.includes(SECRET));
+    const everything = JSON.stringify({ calls, audit: audit.tail(100), logs, stats: mat.stats });
+    assert.ok(!everything.includes(SECRET));
+    assert.equal(calls[0].env.LA_GIT_TOKEN_FILE, tokenFile);
+    assert.ok(calls[0].env.GIT_ASKPASS && calls[0].env.GIT_TERMINAL_PROMPT === "0");
+    assert.ok(!calls[0].args.some((a) => /@|ghp_|x-access-token/.test(a)), "no credential in any git argument");
+    const script = fs.readFileSync(ensureAskpassScript(fs.realpathSync(cache)), "utf8");
+    assert.ok(!script.includes(SECRET));
+    assert.equal(fs.statSync(path.join(fs.realpathSync(cache), ".vh-git-askpass.sh")).mode & 0o777, 0o700);
+});
+
+test("secrets: with a real git the askpass script answers from the file (user constant, password = file content) without the agent holding it", () => {
+    const dir = tmp("ask");
+    const tokenFile = path.join(dir, "token");
+    fs.writeFileSync(tokenFile, SECRET + "\n", { mode: 0o600 });
+    const s = ensureAskpassScript(dir);
+    const env = { PATH: process.env.PATH, LA_GIT_TOKEN_FILE: tokenFile };
+    assert.equal(execFileSync(s, ["Username for 'https://github.com': "], { env, encoding: "utf8" }).trim(), "x-access-token");
+    assert.equal(execFileSync(s, ["Password for 'https://x-access-token@github.com': "], { env, encoding: "utf8" }).trim(), SECRET);
+});
+
+// ---------------------------------------------------------------- job manager
+
+const uuid = () => crypto.randomUUID();
+const tick = (ms = 5) => new Promise((r) => setTimeout(r, ms));
+const until = async (cond, ms = 3000) => { const t0 = Date.now(); while (!cond()) { if (Date.now() - t0 > ms) throw new Error("until: timed out"); await tick(5); } };
+const params = (over = {}) => ({ jobId: uuid(), kind: "fix", repoRef: REF, policy: { operationMode: "assist", automationLevel: 2, ceiling: "assist" }, budget: { tokens: 50_000, seconds: 60 },
+    llm: { alias: "a", keyRef: "ab".repeat(32) }, inputs: [], ...over });
+function mgr({ materializer, resolveWorkspace = () => null }) {
+    const frames = [];
+    const session = { enqueue: async (type, payload) => { frames.push({ type, payload }); return { acked: Promise.resolve() }; } };
+    const started = [];
+    const runner = { name: "r", needsLlm: false, start(job) { started.push(job.jobId); return Promise.resolve({ outcome: "no_change" }); }, cancel() {} };
+    const config = resolveJobsConfig({ LOCAL_AGENT_JOBS: "true", LOCAL_AGENT_JOBS_EVENT_MIN_MS: "50", LOCAL_AGENT_JOBS_TERMINAL_RETRY_MS: "10" }, noop);
+    const m = createJobManager({ session, tenantId: TENANT, resolveWorkspace, materializer, config, env: { LOCAL_AGENT_DLP_MODE: "enforce" }, runner, log: { warn: noop } });
+    return { m, frames, started };
+}
+
+test("manager: without a materializer (flag off) a workspace not served here is rejected unauthorized, as before", () => {
+    const { m, started } = mgr({ materializer: null });
+    const r = m.handleAssign({ params: params(), workspaceId: WS });
+    assert.deepEqual(r, { reject: "unauthorized" });
+    assert.equal(started.length, 0);
+});
+
+test("manager: a repo outside the allowlist is rejected unauthorized and nothing is cloned", () => {
+    const { mat } = setup({ allow: "github.com/other/thing" });
+    let ensured = 0;
+    const spy = { admit: (...a) => mat.admit(...a), ensure: () => { ensured++; }, bindAudit() {} };
+    const { m, started } = mgr({ materializer: spy });
+    assert.deepEqual(m.handleAssign({ params: params(), workspaceId: WS }), { reject: "unauthorized" });
+    assert.equal(ensured, 0);
+    assert.equal(started.length, 0);
+});
+
+test("manager: an allowlisted workspace is accepted, materialized INSIDE the job (after the ack), then the runner starts", async () => {
+    const order = [];
+    let release;
+    const gate = new Promise((r) => { release = r; });
+    const materializer = { admit: () => true, bindAudit() {}, ensure: async (id, ref) => { order.push(["ensure", id, ref.repo]); await gate; order.push(["ensured"]); return { root: "/x" }; } };
+    const { m, started, frames } = mgr({ materializer });
+    const p = params();
+    assert.deepEqual(m.handleAssign({ params: p, workspaceId: WS }), { accept: true });
+    await until(() => order.length === 1);
+    assert.equal(started.length, 0, "the runner waits for the clone");
+    release();
+    await until(() => started.length === 1);
+    assert.deepEqual(order.map((o) => o[0]), ["ensure", "ensured"]);
+    await until(() => frames.some((f) => f.type === "job.result"));
+});
+
+test("manager: a failed materialization (no credential, auth) ends the job failed/infra with a code only; the runner never starts", async () => {
+    const materializer = { admit: () => true, bindAudit() {}, ensure: async () => { throw new MaterializeError("auth"); } };
+    const { m, started, frames } = mgr({ materializer });
+    const p = params();
+    assert.deepEqual(m.handleAssign({ params: p, workspaceId: WS }), { accept: true });
+    await until(() => frames.some((f) => f.type === "job.result"));
+    const res = frames.find((f) => f.type === "job.result").payload;
+    assert.equal(res.outcome, "failed");
+    const fin = frames.filter((f) => f.type === "job.event").pop().payload;
+    assert.equal(fin.state, "failed");
+    assert.equal(fin.errorCode, "infra");
+    assert.equal(started.length, 0);
+    assert.ok(!JSON.stringify(frames).includes("auth"), "the wire carries infra, not the cause");
+});
+
+test("manager: job.cancel while the workspace is being cloned aborts the clone and the runner never starts", async () => {
+    let sig = null;
+    const materializer = { admit: () => true, bindAudit() {}, ensure: (id, ref, signal) => new Promise((_, rej) => { sig = signal; signal.addEventListener("abort", () => rej(new MaterializeError("aborted"))); }) };
+    const { m, started, frames } = mgr({ materializer });
+    const p = params();
+    m.handleAssign({ params: p, workspaceId: WS });
+    await until(() => sig);
+    m.handleCancel({ params: { jobId: p.jobId, reason: "user" } });
+    await until(() => frames.some((f) => f.type === "job.result"));
+    assert.equal(frames.find((f) => f.type === "job.result").payload.outcome, "cancelled");
+    assert.equal(started.length, 0);
+});
+
+test("manager + real materializer: a workspace of another tenant already open here is not touched (resolver refuses, materializer refuses)", async () => {
+    const { mat, wsManager, cache } = setup();
+    const d = path.join(cache, "x"); fs.mkdirSync(d);
+    await wsManager.open(WS, d, { tenantId: OTHER });
+    const resolve = (id) => { const w = wsManager.list().find((x) => x.id === id); return w && String(w.tenantId).toLowerCase() === TENANT ? { root: w.root } : null; };
+    const { m, started } = mgr({ materializer: mat, resolveWorkspace: resolve });
+    assert.deepEqual(m.handleAssign({ params: params(), workspaceId: WS }), { reject: "unauthorized" });
+    assert.equal(started.length, 0);
+    assert.equal(wsManager.list().find((x) => x.id === WS).tenantId, OTHER);
+});