esedre 0.1.7 → 0.1.8

package/README.md

@@ -88,6 +88,8 @@ ese start
 # Open dashboard: http://localhost:5674/app
 ```
 
+The server launches with unconstrained portfolio visibility across all registered data hubs and projects, allowing the main Esedre Web UI (as opposed to embedded component and LLM agent project-scoped behavior) to manage them seamlessly. Incoming agent requests enforce project scoping dynamically via the `x-esedre-allowed-projects` header or `?allowedProjects=...` query parameter.
+
 ### 4. Create Your First Ticket
 
 ```bash
@@ -260,6 +262,7 @@ Esedre enforces clean project isolation so each LLM agent is informed only of th
 - Unauthorized requests throw `EsedreAuthorizationError`:
   - **CLI**: Prints `Access Denied: ...` and exits with status code 1.
   - **MCP**: Responds with standard JSON-RPC error `-32603`.
+  - **REST API**: Responds with HTTP status code `403 Forbidden`.
 
 ---
 

package/dist/esedre.mjs

@@ -9,7 +9,7 @@ import fs3 from "node:fs";
 import path3 from "node:path";
 
 // src/types.ts
-var CURRENT_ESEDRE_VERSION = "0.1.7";
+var CURRENT_ESEDRE_VERSION = "0.1.8";
 var EsedreConflictError = class extends Error {
   constructor(ticketId, currentHash, lastHash) {
     super(
@@ -539,12 +539,12 @@ async function generateProjectSnapshot(storage, projectCode, outputDir) {
 }
 
 // src/storage/filesystem.ts
-function isProjectMatch(code, slug, filter) {
+function isProjectMatch(code, filter) {
+  if (!code || !filter) return false;
   const f = filter.trim().toLowerCase();
   const c = code.trim().toLowerCase();
-  const s = slug.trim().toLowerCase();
-  if (c === f || s === f) return true;
-  if ((f === "prof" || f === "core" || f === "pasrc") && (c === "prof" || c === "core")) return true;
+  if (c === f) return true;
+  if ((f === "profe" || f === "prof" || f === "core" || f === "pasrc") && (c === "profe" || c === "prof" || c === "core")) return true;
   if ((f === "esedre" || f === "ese" || f === "docs") && (c === "esedre" || c === "docs")) return true;
   if ((f === "alce" || f === "web") && (c === "alce" || c === "web")) return true;
   return false;
@@ -572,6 +572,9 @@ function writeSafeFile(filePath, content) {
 var FilesystemStorageAdapter = class {
   workspaceRoot;
   config;
+  isConfigExplicit = false;
+  lastConfigCheck = 0;
+  configTtlMs = 3e3;
   duplicateProjectWarnings = [];
   getDuplicateProjectWarnings() {
     this.resolveProjectLocations();
@@ -581,13 +584,39 @@ var FilesystemStorageAdapter = class {
     this.workspaceRoot = workspaceRoot || this.resolveWorkspaceRoot();
     if (config) {
       this.config = config;
+      this.isConfigExplicit = true;
+      this.lastConfigCheck = Date.now();
     } else {
-      try {
-        const discovered = findEsedreConfig(this.workspaceRoot);
-        this.config = discovered.config || {};
-      } catch {
-        this.config = {};
+      this.config = {};
+      this.refreshConfig();
+    }
+  }
+  refreshConfig() {
+    try {
+      const discovered = findEsedreConfig(this.workspaceRoot);
+      this.config = discovered.config || {};
+    } catch {
+      this.config = {};
+    }
+    this.lastConfigCheck = Date.now();
+  }
+  ensureFreshConfig() {
+    if (this.isConfigExplicit && this.config.allowedProjects?.includes("*")) {
+      if (Date.now() - this.lastConfigCheck > this.configTtlMs) {
+        try {
+          const discovered = findEsedreConfig(this.workspaceRoot, { fallbackToGlobal: true });
+          this.config = {
+            ...discovered.config,
+            allowedProjects: ["*"]
+          };
+        } catch {
+        }
+        this.lastConfigCheck = Date.now();
       }
+      return;
+    }
+    if (!this.isConfigExplicit && Date.now() - this.lastConfigCheck > this.configTtlMs) {
+      this.refreshConfig();
     }
   }
   resolveWorkspaceRoot() {
@@ -606,6 +635,7 @@ var FilesystemStorageAdapter = class {
     return process.cwd();
   }
   resolveProjectLocations() {
+    this.ensureFreshConfig();
     const locations = [];
     const seenCodes = /* @__PURE__ */ new Set();
     const codeToSource = /* @__PURE__ */ new Map();
@@ -649,9 +679,6 @@ var FilesystemStorageAdapter = class {
           if (fs3.existsSync(pJsonPath)) {
             try {
               desc = JSON.parse(fs3.readFileSync(pJsonPath, "utf-8"));
-              if (desc && !desc.slug) {
-                desc.slug = (desc.code || ent.name).toLowerCase();
-              }
             } catch {
             }
           }
@@ -663,7 +690,7 @@ var FilesystemStorageAdapter = class {
                 try {
                   const hubProjs = JSON.parse(fs3.readFileSync(f, "utf-8"));
                   desc = hubProjs.find(
-                    (p) => p.code.toLowerCase() === ent.name.toLowerCase() || p.slug.toLowerCase() === ent.name.toLowerCase()
+                    (p) => p.code.toLowerCase() === ent.name.toLowerCase()
                   );
                   if (desc) break;
                 } catch {
@@ -675,7 +702,6 @@ var FilesystemStorageAdapter = class {
             desc = {
               id: locations.length + 1,
               code: ent.name,
-              slug: ent.name.toLowerCase(),
               name: ent.name,
               description: `${ent.name} project`
             };
@@ -727,7 +753,6 @@ var FilesystemStorageAdapter = class {
           descs = [{
             id: 1,
             code: pCode,
-            slug: pCode.toLowerCase(),
             name: pCode,
             description: `${pCode} project`
           }];
@@ -782,9 +807,6 @@ var FilesystemStorageAdapter = class {
           if (fs3.existsSync(cand)) {
             try {
               desc = JSON.parse(fs3.readFileSync(cand, "utf-8"));
-              if (desc && !desc.slug) {
-                desc.slug = (desc.code || code).toLowerCase();
-              }
               break;
             } catch {
             }
@@ -794,7 +816,6 @@ var FilesystemStorageAdapter = class {
           desc = {
             id: locations.length + 1,
             code,
-            slug: code.toLowerCase(),
             name: code,
             description: `${code} project`
           };
@@ -862,7 +883,6 @@ var FilesystemStorageAdapter = class {
           descs = [{
             id: 1,
             code: this.config.projectCode,
-            slug: this.config.projectCode.toLowerCase(),
             name: pName,
             description: `${pName} project`
           }];
@@ -894,7 +914,7 @@ var FilesystemStorageAdapter = class {
     const cleanCode = rawCode;
     const cleanName = input.name?.trim() || cleanCode;
     const cleanDesc = input.description?.trim() || `${cleanName} project`;
-    const slug = cleanCode.toLowerCase();
+    const cleanLower = cleanCode.toLowerCase();
     const colors2 = input.colors || {
       badge: "border-cyan-500/30 bg-cyan-500/10 text-cyan-300",
       dot: "bg-cyan-400",
@@ -978,7 +998,7 @@ ${formattedList}`
       const normalizedTargetHub = path3.resolve(targetHub).toLowerCase();
       const existingLocations = this.resolveProjectLocations();
       const existingConflict = existingLocations.find((l) => {
-        if (l.project.code.toLowerCase() !== slug) return false;
+        if (l.project.code.toLowerCase() !== cleanLower) return false;
         if (l.sourceType === "hub" && l.hubDir) {
           return path3.resolve(l.hubDir).toLowerCase() !== normalizedTargetHub;
         }
@@ -996,7 +1016,7 @@ ${formattedList}`
         try {
           const entries = fs3.readdirSync(hubProjectsDir, { withFileTypes: true });
           const matchedDir = entries.find(
-            (e) => e.isDirectory() && e.name.toLowerCase() === slug
+            (e) => e.isDirectory() && e.name.toLowerCase() === cleanLower
           );
           if (matchedDir) {
             resolvedDirName = matchedDir.name;
@@ -1024,7 +1044,6 @@ ${formattedList}`
       const projectDesc2 = {
         id: id2,
         code: resolvedCode2,
-        slug,
         name: cleanName,
         description: cleanDesc,
         colors: colors2
@@ -1034,7 +1053,7 @@ ${formattedList}`
       if (fs3.existsSync(hubProjectsFile)) {
         try {
           const arr = JSON.parse(fs3.readFileSync(hubProjectsFile, "utf-8"));
-          const idx = arr.findIndex((p) => p.code.toLowerCase() === slug);
+          const idx = arr.findIndex((p) => p.code.toLowerCase() === cleanLower);
           if (idx >= 0) {
             arr[idx] = projectDesc2;
           } else {
@@ -1059,12 +1078,11 @@ ${formattedList}`
       } catch {
       }
     }
-    const resolvedCode = existingPJson?.code && existingPJson.code.toLowerCase() === slug ? existingPJson.code : cleanCode;
+    const resolvedCode = existingPJson?.code && existingPJson.code.toLowerCase() === cleanLower ? existingPJson.code : cleanCode;
     const id = existingPJson?.id || 1;
     const projectDesc = {
       id,
       code: resolvedCode,
-      slug,
       name: cleanName,
       description: cleanDesc,
       colors: colors2
@@ -1074,7 +1092,7 @@ ${formattedList}`
     if (fs3.existsSync(projectsJsonPath)) {
       try {
         const arr = JSON.parse(fs3.readFileSync(projectsJsonPath, "utf-8"));
-        const idx = arr.findIndex((p) => p.code.toLowerCase() === slug);
+        const idx = arr.findIndex((p) => p.code.toLowerCase() === cleanLower);
         if (idx >= 0) {
           arr[idx] = projectDesc;
         } else {
@@ -1094,7 +1112,7 @@ ${formattedList}`
     if (prefixMatch) {
       const code = prefixMatch[1].toLowerCase();
       const num2 = parseInt(prefixMatch[2], 10);
-      const loc = locations.find((l) => isProjectMatch(l.project.code, l.project.slug, code));
+      const loc = locations.find((l) => isProjectMatch(l.project.code, code));
       if (!loc) return null;
       const ticketDir = path3.join(loc.ticketsDir, String(num2));
       const metaPath = path3.join(ticketDir, "meta.json");
@@ -1106,7 +1124,7 @@ ${formattedList}`
             meta.type = meta.type || meta.category || "Feature";
             meta.category = meta.type;
             const mProj = (meta.project || "").toLowerCase();
-            if (mProj && mProj !== code && mProj !== loc.project.slug.toLowerCase()) {
+            if (mProj && mProj !== code && mProj !== loc.project.code.toLowerCase()) {
               return null;
             }
           } catch {
@@ -1131,7 +1149,7 @@ ${formattedList}`
           const metaRaw = fs3.readFileSync(metaPath, "utf-8");
           const meta = JSON.parse(metaRaw);
           const matchedLoc = locations.find(
-            (l) => meta.projectId !== void 0 && l.project.id === meta.projectId || meta.project && (l.project.code.toLowerCase() === meta.project.toLowerCase() || l.project.slug.toLowerCase() === meta.project.toLowerCase())
+            (l) => meta.projectId !== void 0 && l.project.id === meta.projectId || meta.project && l.project.code.toLowerCase() === meta.project.toLowerCase()
           ) || loc;
           matches.push({ loc: matchedLoc, ticketDir, id: num });
         } catch {
@@ -1144,7 +1162,7 @@ ${formattedList}`
     if (this.config.projectCode) {
       const prefLower = this.config.projectCode.toLowerCase();
       const preferredMatch = matches.find(
-        (m) => m.loc.project.code.toLowerCase() === prefLower || m.loc.project.slug.toLowerCase() === prefLower
+        (m) => m.loc.project.code.toLowerCase() === prefLower
       );
       if (preferredMatch) return preferredMatch;
     }
@@ -1166,7 +1184,7 @@ ${formattedList}`
     for (const loc of locations) {
       if (filter?.project && filter.project !== "all") {
         const pLower = filter.project.toLowerCase();
-        if (!isProjectMatch(loc.project.code, loc.project.slug, filter.project)) {
+        if (!isProjectMatch(loc.project.code, filter.project)) {
           continue;
         }
       }
@@ -1198,7 +1216,7 @@ ${formattedList}`
           let effectiveLoc = loc;
           if (loc.isSharedDir) {
             const found = locations.find(
-              (l) => meta.projectId !== void 0 && l.project.id === meta.projectId || meta.project && (l.project.code.toLowerCase() === meta.project.toLowerCase() || l.project.slug.toLowerCase() === meta.project.toLowerCase())
+              (l) => meta.projectId !== void 0 && l.project.id === meta.projectId || meta.project && l.project.code.toLowerCase() === meta.project.toLowerCase()
             );
             if (found) effectiveLoc = found;
           }
@@ -1206,7 +1224,7 @@ ${formattedList}`
           meta.projectId = effectiveLoc.project.id;
           if (filter?.project && filter.project !== "all") {
             const pLower = filter.project.toLowerCase();
-            if (!isProjectMatch(meta.project, effectiveLoc.project.slug, filter.project)) {
+            if (!isProjectMatch(meta.project, filter.project)) {
               continue;
             }
           }
@@ -1373,7 +1391,7 @@ ${formattedList}`
     if (requestedIdentifier) {
       const lower = String(requestedIdentifier).trim().toLowerCase();
       targetLoc = locations.find(
-        (l) => l.project.code?.toLowerCase() === lower || l.project.slug?.toLowerCase() === lower || String(l.project.id) === lower || l.project.name?.toLowerCase() === lower
+        (l) => l.project.code?.toLowerCase() === lower || String(l.project.id) === lower || l.project.name?.toLowerCase() === lower
       );
       if (!targetLoc) {
         throw new Error(`Project '${requestedIdentifier}' is invalid or not registered in this workspace.`);
@@ -2579,11 +2597,13 @@ async function startDaemon(options = {}) {
   if (!pid) {
     throw new Error("Failed to spawn Esedre daemon background process.");
   }
+  const timeoutMs = process.platform === "win32" ? 1e4 : 5e3;
+  const pingTimeout = process.platform === "win32" ? 500 : 300;
   const startTime = Date.now();
   let ready = false;
-  while (Date.now() - startTime < 3500) {
-    await new Promise((r) => setTimeout(r, 100));
-    const ping = await pingDaemon(port, 150);
+  while (Date.now() - startTime < timeoutMs) {
+    await new Promise((r) => setTimeout(r, 150));
+    const ping = await pingDaemon(port, pingTimeout);
     if (ping.responding && ping.isEsedre) {
       ready = true;
       break;
@@ -3228,7 +3248,6 @@ function configureWorkspace(targetDir, options = {}) {
       const projDesc = {
         id: 1,
         code: projectCode.toUpperCase(),
-        slug: projectCode.toLowerCase(),
         name: projectName || projectCode.toUpperCase(),
         description: `${projectName || projectCode.toUpperCase()} project`,
         colors: {
@@ -3401,16 +3420,30 @@ function sendJson(res, status, data) {
     "Content-Type": "application/json; charset=utf-8",
     "Access-Control-Allow-Origin": "*",
     "Access-Control-Allow-Methods": "GET, POST, PATCH, OPTIONS",
-    "Access-Control-Allow-Headers": "Content-Type, Authorization"
+    "Access-Control-Allow-Headers": "Content-Type, Authorization, x-esedre-allowed-projects"
   });
   res.end(JSON.stringify(data));
 }
-var cachedAllData = null;
-var cachedAllTimestamp = 0;
+var cachedAllData = /* @__PURE__ */ new Map();
 var CACHE_TTL_MS = 5e3;
 function invalidateApiCache() {
-  cachedAllData = null;
-  cachedAllTimestamp = 0;
+  cachedAllData.clear();
+}
+function getRequestStorage(baseStorage, req, url) {
+  const headerAllowed = req.headers["x-esedre-allowed-projects"];
+  const queryAllowed = url.searchParams.get("allowedProjects");
+  const rawAllowed = (typeof headerAllowed === "string" ? headerAllowed : Array.isArray(headerAllowed) ? headerAllowed[0] : null) || queryAllowed;
+  if (rawAllowed && typeof rawAllowed === "string") {
+    const list = rawAllowed.split(",").map((s) => s.trim()).filter(Boolean);
+    if (list.length > 0 && !list.includes("*")) {
+      const sortedKey = [...list].sort().join(",");
+      return {
+        storage: new SecurityFilter(baseStorage, { allowedProjects: list }),
+        cacheKey: sortedKey
+      };
+    }
+  }
+  return { storage: baseStorage, cacheKey: "*" };
 }
 function createApiHandler(storage, workspaceRoot) {
   return async (req, res) => {
@@ -3436,6 +3469,7 @@ function createApiHandler(storage, workspaceRoot) {
     if (pathname.startsWith("/esedre/api")) {
       pathname = pathname.slice("/esedre".length);
     }
+    const { storage: reqStorage, cacheKey } = getRequestStorage(storage, req, url);
     try {
       if (req.method === "GET") {
         if (pathname === "/api/ping") {
@@ -3443,7 +3477,7 @@ function createApiHandler(storage, workspaceRoot) {
           return true;
         }
         if (pathname === "/api/planning/projects") {
-          const projects = await storage.getProjects();
+          const projects = await reqStorage.getProjects();
           sendJson(res, 200, projects);
           return true;
         }
@@ -3453,7 +3487,7 @@ function createApiHandler(storage, workspaceRoot) {
           const type = url.searchParams.get("type") || url.searchParams.get("category") || void 0;
           const category = type;
           const search = url.searchParams.get("search") || void 0;
-          const tickets = await storage.listTickets({
+          const tickets = await reqStorage.listTickets({
             project: project === "all" ? void 0 : project,
             status,
             type,
@@ -3469,7 +3503,7 @@ function createApiHandler(storage, workspaceRoot) {
             sendJson(res, 400, { error: "Invalid ticket ID" });
             return true;
           }
-          const ticket = await storage.getTicket(idStr);
+          const ticket = await reqStorage.getTicket(idStr);
           if (!ticket) {
             sendJson(res, 400, { error: "Ticket not found" });
             return true;
@@ -3479,11 +3513,12 @@ function createApiHandler(storage, workspaceRoot) {
         }
         if (pathname === "/api/planning/all") {
           const now = Date.now();
-          if (cachedAllData && now - cachedAllTimestamp < CACHE_TTL_MS) {
-            sendJson(res, 200, cachedAllData);
+          const cached = cachedAllData.get(cacheKey);
+          if (cached && now - cached.timestamp < CACHE_TTL_MS) {
+            sendJson(res, 200, cached.data);
             return true;
           }
-          const tickets = await storage.listTickets({});
+          const tickets = await reqStorage.listTickets({});
           const metasMap = {};
           const detailsMap = {};
           const plansMap = {};
@@ -3513,7 +3548,7 @@ function createApiHandler(storage, workspaceRoot) {
               }
             }
           }
-          const projects = await storage.getProjects();
+          const projects = await reqStorage.getProjects();
           const responsePayload = {
             success: true,
             projects,
@@ -3526,13 +3561,12 @@ function createApiHandler(storage, workspaceRoot) {
             planHistory: {},
             ticketHistory: {}
           };
-          cachedAllData = responsePayload;
-          cachedAllTimestamp = now;
+          cachedAllData.set(cacheKey, { data: responsePayload, timestamp: now });
           sendJson(res, 200, responsePayload);
           return true;
         }
         if (pathname === "/api/planning/metas") {
-          const tickets = await storage.listTickets({});
+          const tickets = await reqStorage.listTickets({});
           const metasMap = {};
           for (const t of tickets) {
             metasMap[String(t.meta.id)] = t.meta;
@@ -3541,7 +3575,7 @@ function createApiHandler(storage, workspaceRoot) {
           return true;
         }
         if (pathname === "/api/planning/details") {
-          const tickets = await storage.listTickets({});
+          const tickets = await reqStorage.listTickets({});
           const detailsMap = {};
           for (const t of tickets) {
             if (t.detail?.raw) {
@@ -3552,7 +3586,7 @@ function createApiHandler(storage, workspaceRoot) {
           return true;
         }
         if (pathname === "/api/planning/plans") {
-          const tickets = await storage.listTickets({});
+          const tickets = await reqStorage.listTickets({});
           const plansMap = {};
           for (const t of tickets) {
             if (t.planMarkdown) {
@@ -3563,7 +3597,7 @@ function createApiHandler(storage, workspaceRoot) {
           return true;
         }
         if (pathname === "/api/planning/comments") {
-          const tickets = await storage.listTickets({});
+          const tickets = await reqStorage.listTickets({});
           const commentsMap = {};
           for (const t of tickets) {
             commentsMap[String(t.meta.id)] = t.comments || [];
@@ -3593,7 +3627,7 @@ function createApiHandler(storage, workspaceRoot) {
             sendJson(res, 400, { error: "Project query parameter is required for snapshot generation (no default fallback)." });
             return true;
           }
-          const snapshot = await generateProjectSnapshot(storage, projectCode, workspaceRoot);
+          const snapshot = await generateProjectSnapshot(reqStorage, projectCode, workspaceRoot);
           sendJson(res, 200, snapshot);
           return true;
         }
@@ -3602,7 +3636,7 @@ function createApiHandler(storage, workspaceRoot) {
         const body = await readJsonBody(req);
         if (pathname === "/api/planning/tickets") {
           invalidateApiCache();
-          const created = await storage.createTicket(body);
+          const created = await reqStorage.createTicket(body);
           sendJson(res, 201, { ticketId: String(created.meta.id), meta: created.meta });
           return true;
         }
@@ -3623,7 +3657,7 @@ function createApiHandler(storage, workspaceRoot) {
             return true;
           }
           invalidateApiCache();
-          const project = await storage.registerProject({
+          const project = await reqStorage.registerProject({
             code,
             name,
             description,
@@ -3636,27 +3670,27 @@ function createApiHandler(storage, workspaceRoot) {
         if (pathname === "/api/planning/plans") {
           const { ticketId, planMarkdown, lastHash } = body;
           invalidateApiCache();
-          await storage.savePlan(ticketId, planMarkdown, lastHash);
+          await reqStorage.savePlan(ticketId, planMarkdown, lastHash);
           sendJson(res, 200, { success: true });
           return true;
         }
         if (pathname === "/api/planning/comments") {
           const { ticketId, text, author } = body;
           invalidateApiCache();
-          await storage.addComment(ticketId, { author: author || "Developer", text });
-          const ticket = await storage.getTicket(ticketId);
+          await reqStorage.addComment(ticketId, { author: author || "Developer", text });
+          const ticket = await reqStorage.getTicket(ticketId);
           sendJson(res, 200, { comments: ticket?.comments || [] });
           return true;
         }
         if (pathname === "/api/planning/update-meta") {
           const { ticketId, updates, lastHash } = body;
-          const updated = await storage.updateTicket(ticketId, updates, lastHash);
+          const updated = await reqStorage.updateTicket(ticketId, updates, lastHash);
           sendJson(res, 200, { meta: updated.meta });
           return true;
         }
         if (pathname === "/api/planning/toggle-flag") {
           const { ticketId, flagged } = body;
-          const updated = await storage.updateTicket(ticketId, {
+          const updated = await reqStorage.updateTicket(ticketId, {
             featureFlag: flagged ? "chat_enhanced" : ""
           });
           sendJson(res, 200, { meta: updated.meta });
@@ -3665,7 +3699,7 @@ function createApiHandler(storage, workspaceRoot) {
         if (pathname === "/api/planning/details") {
           const { ticketId, detailMarkdown, metaUpdates } = body;
           if (metaUpdates) {
-            await storage.updateTicket(ticketId, metaUpdates);
+            await reqStorage.updateTicket(ticketId, metaUpdates);
           }
           sendJson(res, 200, { success: true, detail: detailMarkdown });
           return true;
@@ -3674,6 +3708,10 @@ function createApiHandler(storage, workspaceRoot) {
       sendJson(res, 404, { error: `Endpoint not found: ${pathname}` });
       return true;
     } catch (err) {
+      if (err.name === "EsedreAuthorizationError" || err.message?.includes("outside this workspace's authorized scope") || err.message?.includes("Access Denied")) {
+        sendJson(res, 403, { error: err.message });
+        return true;
+      }
       console.error("[Esedre API Error]:", err);
       sendJson(res, 500, { error: err.message });
       return true;
@@ -4435,17 +4473,22 @@ ${colors.bold}Commands:${colors.reset}`);
         return;
       }
       case "start": {
-        printDuplicateProjectWarnings(storage, isJson);
         const flagPort = flags["port"] ? parseInt(String(flags["port"]), 10) : void 0;
         const ports = resolvePorts(discovered.config, { port: flagPort });
         const port = ports.gateway;
         const isForeground = Boolean(flags["foreground"] || flags["f"]);
+        const serverConfig = {
+          ...discovered.config,
+          allowedProjects: ["*"]
+        };
+        const serverStorage = new FilesystemStorageAdapter(discovered.workspaceRoot, serverConfig);
+        printDuplicateProjectWarnings(serverStorage, isJson);
         if (isForeground) {
           const cluster = startGatewayCluster({
             gatewayPort: ports.gateway,
             uiPort: ports.ui,
             apiPort: ports.api,
-            storage,
+            storage: serverStorage,
             workspaceRoot: discovered.workspaceRoot
           });
           console.log(`${colors.bold}${colors.green}\u2714 Esedre Server active on http://localhost:${ports.gateway}${colors.reset}`);