studiograph 1.3.48-next.26 → 1.3.48-next.261

package/dist/core/workspace-manager.js

@@ -5,16 +5,62 @@
  * Provides cross-repo search, wikilink validation, and unified operations.
  */
 import { join } from 'path';
-import { existsSync, readdirSync, mkdirSync, readFileSync, appendFileSync, writeFileSync } from 'fs';
-import { execSync } from 'child_process';
-import { homedir } from 'os';
+import { existsSync, readdirSync, mkdirSync, readFileSync } from 'fs';
+import { execFileSync } from 'child_process';
 import { BaseGraphManager } from './graph.js';
+import { isArchivedRepo } from './types.js';
+import { isSeedFolderName, seedFolderName } from './seed-folder.js';
+import { Workspace } from './workspace.js';
 import { ENTITY_SCHEMAS } from './validation.js';
+import { AssetIndexService } from '../services/assets/asset-index-service.js';
 import { VectorService } from '../services/vector-service.js';
-import { loadUserConfig } from './user-config.js';
+import { loadUserConfig, resolveVectorDbPath } from './user-config.js';
+import { tryResolve } from './secrets/read-flip.js';
 import { SchemaRegistry } from './schema-registry.js';
+/**
+ * Resolve an R2 credential field, Phase 6-aware.
+ *
+ * Order: encrypted store (when flag on) → workspace.json field →
+ * user.json field → env var → empty string. The first three are the
+ * legacy precedence the original initializeGraphs reproduced
+ * literally; we keep them as transitional fallback so a misconfigured
+ * importer doesn't break R2 access. The env var is included for the
+ * standard `R2_*` shell-override case (existing behavior).
+ *
+ * The store wins over workspace.json on purpose: post Phase 6, the
+ * file is no longer authoritative for secrets, and a stale value in
+ * it should not shadow whatever the operator set via the API.
+ */
+function resolveR2Field(storeKey, workspaceField, userField, envField) {
+    const fromStore = tryResolve(storeKey);
+    if (fromStore)
+        return fromStore;
+    return workspaceField || userField || envField || '';
+}
+/**
+ * Resolve an R2 structural field (account_id / bucket / public_url).
+ *
+ * Same precedence shape as `resolveR2Field`: store wins, legacy
+ * workspace.json block is the transitional fallback. The store path
+ * covers the env-var case automatically (registry entries have R2_*
+ * aliases). The legacy fallback is what keeps mis-migrated workspaces
+ * working until they're either redeployed or hand-edited.
+ *
+ * No `endpoint` field — the S3 client below derives it from
+ * `accountId` (`https://<account>.r2.cloudflarestorage.com`). If a
+ * future change adds non-Cloudflare S3-compatible storage, register
+ * `r2.endpoint` then alongside the R2AssetService change that
+ * consumes it.
+ */
+function resolveR2StructuralField(storeKey, workspaceField) {
+    const fromStore = tryResolve(storeKey);
+    if (fromStore)
+        return fromStore;
+    return workspaceField || undefined;
+}
 export class WorkspaceManager {
     workspacePath;
+    assetIndex;
     config;
     graphs;
     gitUser;
@@ -25,15 +71,27 @@ export class WorkspaceManager {
         this.config = config;
         this.gitUser = gitUser;
         this.graphs = new Map();
+        // Workspace-global asset ownership index (one assets.db per workspace,
+        // repo is a column). Constructed before initializeGraphs so it can be
+        // injected into every graph.
+        this.assetIndex = new AssetIndexService(workspacePath);
         // Build SchemaRegistry from workspace config extensions (empty if none defined)
         this.schemaRegistry = new SchemaRegistry(config.schema_extensions);
         // Initialize VectorService from user config (non-fatal if unavailable)
         const userConfig = loadUserConfig();
-        const dbPath = userConfig.vector_db_path || join(homedir(), '.studiograph', 'vector');
+        const dbPath = resolveVectorDbPath(userConfig);
         this.vectorService = new VectorService(dbPath, userConfig.voyage_api_key);
+        // Give the vector service the assets.db handle so entry upserts can fold an
+        // embedded image's caption (assets.db, keyed by assetId) into the entry's
+        // search text — asset-as-embed search surfacing (decision D2).
+        this.vectorService.setAssetIndex(this.assetIndex);
         // Initialize graph managers for all repos (including private)
         this.initializeGraphs();
     }
+    /** Absolute filesystem path to the workspace root. */
+    getWorkspacePath() {
+        return this.workspacePath;
+    }
     /**
      * Get the workspace SchemaRegistry (includes custom extension types and field defs)
      */
@@ -41,40 +99,26 @@ export class WorkspaceManager {
         return this.schemaRegistry;
     }
     /**
-     * Check if a repo is private (local-only, excluded from push/pull)
+     * Ensure the seed "My Folder" (entries-<userId>) directory exists and has an
+     * initial commit in its own git repo. The seed is committed like any other
+     * folder; we do NOT add it to a workspace-root .gitignore (see registerRepo —
+     * that entry was always inert and misleading). It is skipped from the routine
+     * member push/pull (a user's home folder isn't pushed to the shared remote).
      */
-    isPrivateRepo(repoName) {
-        const repoConfig = this.getRepoConfig(repoName);
-        return repoConfig?.private === true;
-    }
-    /**
-     * Ensure a private collection's directory exists and is gitignored.
-     */
-    ensurePrivateRepo(repo) {
+    ensureSeedRepo(repo) {
         const repoPath = join(this.workspacePath, repo.path);
         // Create directory if missing
         if (!existsSync(repoPath)) {
             mkdirSync(repoPath, { recursive: true });
         }
-        // Ensure workspace root .gitignore includes this private path
-        const gitignorePath = join(this.workspacePath, '.gitignore');
-        const entry = `${repo.path}/`;
-        if (existsSync(gitignorePath)) {
-            const content = readFileSync(gitignorePath, 'utf-8');
-            if (!content.split('\n').some(line => line.trim() === entry)) {
-                appendFileSync(gitignorePath, `\n${entry}\n`);
-            }
-        }
-        else {
-            writeFileSync(gitignorePath, `${entry}\n`);
-        }
-        // Make initial commit if the private repo has no commits yet
+        // Make initial commit if the seed repo has no commits yet
         try {
-            execSync('git rev-parse HEAD', { cwd: repoPath, stdio: 'pipe' });
+            execFileSync('git', ['rev-parse', 'HEAD'], { cwd: repoPath, stdio: 'pipe' });
         }
         catch {
             try {
-                execSync('git add -A && git commit -m "Initialize private"', { cwd: repoPath, stdio: 'pipe' });
+                execFileSync('git', ['add', '-A'], { cwd: repoPath, stdio: 'pipe' });
+                execFileSync('git', ['commit', '-m', 'Initialize seed folder'], { cwd: repoPath, stdio: 'pipe' });
             }
             catch { /* non-fatal */ }
         }
@@ -84,39 +128,17 @@ export class WorkspaceManager {
      */
     initializeGraphs() {
         for (const repo of this.config.repos) {
-            // Private repos: ensure directory exists (excluded from git push/pull and git HTTP)
-            if (repo.private) {
-                this.ensurePrivateRepo(repo);
+            // Seed "My Folder" repos: ensure directory exists (skipped from routine
+            // member git push/pull, but committed to their own repo).
+            if (isSeedFolderName(repo.name)) {
+                this.ensureSeedRepo(repo);
             }
             const repoPath = join(this.workspacePath, repo.path);
             if (!existsSync(repoPath)) {
                 console.warn(`Repository path does not exist: ${repoPath} (skipping)`);
                 continue;
             }
-            let assetConfig;
-            if (this.config.r2_config?.account_id && this.config.r2_config?.bucket) {
-                const uc = loadUserConfig();
-                assetConfig = {
-                    storage: 'r2',
-                    r2Config: {
-                        accountId: this.config.r2_config.account_id,
-                        bucket: this.config.r2_config.bucket,
-                        publicUrl: this.config.r2_config.public_url,
-                        accessKeyId: this.config.r2_config.access_key_id
-                            || uc.r2?.access_key_id
-                            || process.env.R2_ACCESS_KEY_ID || '',
-                        secretAccessKey: this.config.r2_config.secret_access_key
-                            || uc.r2?.secret_access_key
-                            || process.env.R2_SECRET_ACCESS_KEY || '',
-                    },
-                };
-            }
-            else {
-                assetConfig = {
-                    storage: 'local',
-                    localPath: join(this.workspacePath, '.studiograph', 'assets'),
-                };
-            }
+            const assetConfig = this.buildAssetConfig();
             const graph = new BaseGraphManager({
                 repoPath,
                 repoName: repo.name,
@@ -124,13 +146,65 @@ export class WorkspaceManager {
                 gitUser: this.gitUser,
                 vectorService: this.vectorService,
                 schemaRegistry: this.schemaRegistry,
+                workspaceRoot: this.workspacePath,
             });
+            graph.setAssetIndex(this.assetIndex);
             this.graphs.set(repo.name, graph);
         }
     }
     /**
-     * Re-read workspace.json and initialize graphs for any newly added collections.
-     * Called after creating a collection so the workspace manager picks it up
+     * Build the AssetConfig for a graph manager. Picks `r2` when both
+     * account_id and bucket resolve (via the store first, falling back
+     * to workspace.json:r2_config); falls back to `local` otherwise.
+     *
+     * Shared between initializeGraphs and reloadConfig so the resolution
+     * logic stays in one place — pre-2026-05-12 the two call sites had
+     * drifted enough that the store-vs-file precedence diverged.
+     */
+    buildAssetConfig() {
+        const accountId = resolveR2StructuralField('r2.account_id', this.config.r2_config?.account_id);
+        const bucket = resolveR2StructuralField('r2.bucket', this.config.r2_config?.bucket);
+        const publicUrl = resolveR2StructuralField('r2.public_url', this.config.r2_config?.public_url);
+        if (accountId && bucket) {
+            const uc = loadUserConfig();
+            return {
+                storage: 'r2',
+                r2Config: {
+                    accountId,
+                    bucket,
+                    publicUrl: publicUrl ?? '',
+                    accessKeyId: resolveR2Field('r2.access_key_id', this.config.r2_config?.access_key_id, uc.r2?.access_key_id, process.env.R2_ACCESS_KEY_ID),
+                    secretAccessKey: resolveR2Field('r2.secret_access_key', this.config.r2_config?.secret_access_key, uc.r2?.secret_access_key, process.env.R2_SECRET_ACCESS_KEY),
+                },
+            };
+        }
+        return {
+            storage: 'local',
+            localPath: join(this.workspacePath, '.studiograph', 'assets'),
+        };
+    }
+    /**
+     * The workspace-global asset storage backend. Storage is resolved once at
+     * graph init (one buildAssetConfig shared by every graph), so this reads
+     * the value the asset services are ACTUALLY serving with — the same
+     * discriminant the serve routes branch on (local-stream vs R2-redirect) —
+     * as a plain in-memory field. Avoids re-running buildAssetConfig per call,
+     * which on an R2 workspace would re-read user.json and decrypt the R2
+     * secrets just to learn a 5-char string. Falls back to 'local' before any
+     * graph is initialized (the unconfigured default). Surfaced read-only to
+     * any member (e.g. the Library "About assets" dialog) via GET /api/workspace.
+     */
+    getAssetStorage() {
+        for (const cfg of this.config.repos) {
+            const storage = this.graphs.get(cfg.name)?.getAssetStorage();
+            if (storage)
+                return storage;
+        }
+        return 'local';
+    }
+    /**
+     * Re-read workspace.json and initialize graphs for any newly added folders.
+     * Called after creating a folder so the workspace manager picks it up
      * without a full server restart.
      */
     reloadConfig() {
@@ -149,35 +223,12 @@ export class WorkspaceManager {
         for (const repo of this.config.repos) {
             if (this.graphs.has(repo.name))
                 continue;
-            if (repo.private)
-                this.ensurePrivateRepo(repo);
+            if (isSeedFolderName(repo.name))
+                this.ensureSeedRepo(repo);
             const repoPath = join(this.workspacePath, repo.path);
             if (!existsSync(repoPath))
                 continue;
-            let refreshAssetConfig;
-            if (this.config.r2_config?.account_id && this.config.r2_config?.bucket) {
-                const uc = loadUserConfig();
-                refreshAssetConfig = {
-                    storage: 'r2',
-                    r2Config: {
-                        accountId: this.config.r2_config.account_id,
-                        bucket: this.config.r2_config.bucket,
-                        publicUrl: this.config.r2_config.public_url,
-                        accessKeyId: this.config.r2_config.access_key_id
-                            || uc.r2?.access_key_id
-                            || process.env.R2_ACCESS_KEY_ID || '',
-                        secretAccessKey: this.config.r2_config.secret_access_key
-                            || uc.r2?.secret_access_key
-                            || process.env.R2_SECRET_ACCESS_KEY || '',
-                    },
-                };
-            }
-            else {
-                refreshAssetConfig = {
-                    storage: 'local',
-                    localPath: join(this.workspacePath, '.studiograph', 'assets'),
-                };
-            }
+            const refreshAssetConfig = this.buildAssetConfig();
             const graph = new BaseGraphManager({
                 repoPath,
                 repoName: repo.name,
@@ -185,10 +236,102 @@ export class WorkspaceManager {
                 gitUser: this.gitUser,
                 vectorService: this.vectorService,
                 schemaRegistry: this.schemaRegistry,
+                workspaceRoot: this.workspacePath,
             });
+            // Inherit structural callbacks + body-write coordinator installed by
+            // the server bootstrap so newly-added folders' Y.Doc snapshots and
+            // body-write critical section stay in sync without a server restart.
+            if (this.persistenceCallbacks)
+                graph.setPersistenceCallbacks(this.persistenceCallbacks);
+            if (this.bodyWriteCoordinator)
+                graph.setBodyWriteCoordinator(this.bodyWriteCoordinator);
+            graph.setAssetIndex(this.assetIndex);
             this.graphs.set(repo.name, graph);
         }
     }
+    /** Workspace-global asset ownership index (immutable-keyed assets). */
+    getAssetIndex() {
+        return this.assetIndex;
+    }
+    /**
+     * Archive (or unarchive) a repo by flipping the `archived_at`/`archived_by`
+     * flags on its config — a reversible, lossless, identity-preserving hide
+     * (NOT a rename). Persists workspace.json (commit + push to the config repo
+     * when one is configured) and reloads the in-memory config so the knowledge-
+     * surface filters pick it up immediately.
+     *
+     * Idempotent: archiving an already-archived repo (or unarchiving a live one)
+     * is a no-op that returns the current config without rewriting workspace.json.
+     * Refuses archiving `system` repos only (the reserved Workspace Assets store).
+     * Throws `Folder "<name>" not found` for an unknown repo (callers
+     * surface that verbatim — same wording as a missing/forbidden repo so
+     * existence isn't leaked). Returns the updated RepoConfig.
+     */
+    async setRepoArchived(repoName, archived, actor) {
+        const workspace = new Workspace(this.workspacePath);
+        const config = await workspace.loadConfig();
+        const repo = config.repos.find(r => r.name === repoName);
+        if (!repo)
+            throw new Error(`Folder "${repoName}" not found`);
+        if (repo.system)
+            throw new Error('System folders cannot be archived.');
+        if (isArchivedRepo(repo) === archived) {
+            // No state change — don't churn a commit. Return the live config.
+            return this.getRepoConfig(repoName) ?? repo;
+        }
+        if (archived) {
+            repo.archived_at = new Date().toISOString();
+            if (actor)
+                repo.archived_by = actor;
+            else
+                delete repo.archived_by;
+        }
+        else {
+            delete repo.archived_at;
+            delete repo.archived_by;
+        }
+        workspace.writeConfig(config);
+        workspace.pushWorkspaceConfig(archived ? `Archive folder: ${repoName}` : `Unarchive folder: ${repoName}`);
+        this.reloadConfig();
+        return this.getRepoConfig(repoName) ?? repo;
+    }
+    /**
+     * Install structural-mutation callbacks on every graph (current + future).
+     * Called once at server startup by the Yjs persistence wiring so the
+     * snapshot store stays in sync with rename / delete / type change.
+     *
+     * Stored on the WM so reloadConfig (which builds new graphs for newly-
+     * added repos at runtime) can apply the same callbacks without a server
+     * restart.
+     */
+    setPersistenceCallbacks(callbacks) {
+        this.persistenceCallbacks = callbacks;
+        for (const graph of this.graphs.values()) {
+            graph.setPersistenceCallbacks(callbacks);
+        }
+    }
+    /**
+     * Install the body-write coordinator on every graph (current + future).
+     * Routes every body write (autosave + server-write) through a single
+     * critical section with assertWritable, per-doc lock, base-hash
+     * precondition, atomic disk write, commit, broadcast, and
+     * mdRevisionHash bookkeeping.
+     */
+    setBodyWriteCoordinator(coordinator) {
+        this.bodyWriteCoordinator = coordinator;
+        for (const graph of this.graphs.values()) {
+            graph.setBodyWriteCoordinator(coordinator);
+        }
+    }
+    /** The body-write coordinator, if the editor layer is wired (server only —
+     *  undefined for CLI/tests). Lets read paths that must reconcile against
+     *  LIVE editor state (e.g. the delete-impact reference scan) enumerate
+     *  active docs and peek live bodies. */
+    getBodyWriteCoordinator() {
+        return this.bodyWriteCoordinator;
+    }
+    persistenceCallbacks;
+    bodyWriteCoordinator;
     /**
      * Get graph manager for a specific repo.
      */
@@ -212,10 +355,15 @@ export class WorkspaceManager {
         return this.config.repos.find(r => r.name === repoName);
     }
     /**
-     * Get the private collection owned by a specific user.
+     * Get the seed "My Folder" auto-provisioned for a specific user, resolved by
+     * its `entries-<userId>` name. Used for the agent's repo:"private" default and
+     * the user's "home" capture / My-Tasks target. Returns undefined if the user
+     * deleted their seed (callers fall back or re-provision). NOTE: this is just
+     * the seed folder, NOT "the user's one private folder" — a user may have many
+     * solo folders; only this one is the home/default.
      */
-    getUserPrivateRepo(userId) {
-        return this.config.repos.find(r => r.private === true && r.owner_id === userId);
+    getUserSeedRepo(userId) {
+        return this.config.repos.find(r => r.name === seedFolderName(userId));
     }
     /**
      * Get all repository configurations
@@ -223,14 +371,94 @@ export class WorkspaceManager {
     getAllRepoConfigs() {
         return this.config.repos;
     }
+    /**
+     * Mint/read the stable sidecar id for a folder (or the repo root), committing
+     * the sidecar if a new id is minted. Saved views key folder scopes on this id
+     * so they survive folder rename / move (D2).
+     */
+    ensureFolderId(repoName, folderPath, user) {
+        return this.getGraph(repoName).ensureFolderId(folderPath, user);
+    }
+    /**
+     * Resolve a stable folder id to its `{ repo, folderPath }` across all repos,
+     * or null when the id no longer maps to any folder (e.g. the folder was
+     * deleted). `folderPath` is `''` for a repo root.
+     */
+    resolveFolderById(id) {
+        for (const cfg of this.config.repos) {
+            try {
+                const path = this.getGraph(cfg.name).findFolderPathById(id);
+                if (path !== null)
+                    return { repo: cfg.name, folderPath: path };
+            }
+            catch { /* skip unmounted repos */ }
+        }
+        return null;
+    }
+    /**
+     * Build a single `folderId → { repo, folderPath }` index across all repos in
+     * one pass (each repo's folder tree walked once). Use this when resolving many
+     * folder ids in one request — e.g. enriching the caller's saved views — so the
+     * cost is O(repos) tree walks instead of O(views × repos) (one
+     * `resolveFolderById` per view each re-walking every repo).
+     */
+    buildFolderIdIndex() {
+        const index = new Map();
+        for (const cfg of this.config.repos) {
+            try {
+                for (const e of this.getGraph(cfg.name).folderIdEntries()) {
+                    if (!index.has(e.id))
+                        index.set(e.id, { repo: cfg.name, folderPath: e.path });
+                }
+            }
+            catch { /* skip unmounted repos */ }
+        }
+        return index;
+    }
+    /**
+     * Content/knowledge repos only — excludes `system` folders (the reserved
+     * "Workspace Assets" store). Use this for knowledge surfaces that should
+     * not see the app-managed asset folder: the agent folder inventory +
+     * list_repos, graph maintenance, lint, and orphan detection. The asset
+     * manager and authz checks (getAccessibleRepos / hasRepoAccess) keep
+     * seeing system folders so assets stay listable + referenceable. See
+     * ~/.claude/plans/workspace-asset-rearchitecture.md.
+     *
+     * Archived repos (reversible repo-level hide) are excluded here alongside
+     * `system` — this is the single chokepoint behind the agent folder inventory,
+     * list_repos, orphan/lint/graph-maintenance. Authz (getAccessibleRepos) still
+     * sees them so unarchive stays reachable.
+     */
+    getContentRepoConfigs() {
+        return this.config.repos.filter(r => !r.system && !isArchivedRepo(r));
+    }
+    /**
+     * Read-only view of the live workspace config. Use this for lookups that
+     * need fields beyond repos/r2 (e.g. `railway`, `team_name`). Mutations
+     * go through dedicated methods so the in-memory copy and `workspace.json`
+     * stay in sync.
+     */
+    getConfig() {
+        return this.config;
+    }
     /**
      * Search across all repositories.
      * Uses LanceDB vector/FTS search when available, keyword search as fallback.
      */
     async search(options) {
-        const reposToSearch = options.repoNames || this.getRepoNames();
-        // Vector/FTS path: use LanceDB when a text query is present
-        if (options.query && this.vectorService) {
+        // Archived repos are filtered out of search UNCONDITIONALLY — even an
+        // explicit `repoNames` scope can't surface them. Search is a knowledge
+        // surface, and the locked design hides archived folders from it entirely;
+        // an agent/tool that remembered or guessed an archived folder name must not
+        // get its entries back. (Their entries stay indexed for instant unarchive;
+        // management/unarchive lists archived folders from config, not via search.)
+        const reposToSearch = (options.repoNames ?? this.getRepoNames()).filter(name => {
+            const cfg = this.getRepoConfig(name);
+            return !cfg || !isArchivedRepo(cfg);
+        });
+        // Vector/FTS path: use LanceDB when a text query is present.
+        // mode=keyword opts out — autosuggest doesn't want a Voyage round-trip.
+        if (options.query && this.vectorService && options.mode !== 'keyword') {
             try {
                 const vectorResults = await this.vectorService.search(options.query, {
                     limit: options.limit ?? 10,
@@ -262,18 +490,27 @@ export class WorkspaceManager {
     }
     /**
      * Keyword search across repos (original implementation).
+     *
+     * mode=keyword (autosuggest) forwards `nameOnly: true` so each repo
+     * skips the per-entity body content scan.
      */
     keywordSearch(options, reposToSearch) {
         const results = [];
+        const perRepoOptions = options.mode === 'keyword'
+            ? { ...options, nameOnly: true }
+            : options;
         for (const repoName of reposToSearch) {
             const graph = this.graphs.get(repoName);
             if (!graph)
                 continue;
             try {
-                const entities = graph.search(options);
+                const entities = graph.search(perRepoOptions);
                 for (const entity of entities) {
                     results.push({ ...entity, repoName });
                 }
+                // Early-exit once we have enough top-tier matches across repos.
+                if (options.limit && results.length >= options.limit * 4)
+                    break;
             }
             catch (error) {
                 console.warn(`Error searching repo ${repoName}:`, error);
@@ -327,9 +564,35 @@ export class WorkspaceManager {
         }
         return null;
     }
+    /**
+     * Find entity by (type, id) across all repositories. Use this when you
+     * have BOTH the type and the id (e.g., the asset route's URL params)
+     * — entity_id is unique within (repo, entity_type) but NOT across the
+     * whole workspace. A `case-study` in `portfolio` and a `reference` in
+     * `analogous-experiences` can both have id `actively-learn-website`;
+     * the type-blind {@link findEntityById} returns whichever repo iterates
+     * first and breaks consumers that need a specific type.
+     */
+    findEntityByTypeAndId(entityType, entityId) {
+        for (const [repoName, graph] of this.graphs) {
+            try {
+                const all = graph.list();
+                const match = all.find(e => e.data?.entity_id === entityId && e.entityType === entityType);
+                if (match)
+                    return { ...match, repoName };
+            }
+            catch {
+                // continue
+            }
+        }
+        return null;
+    }
     /**
      * Find entity by ID across all repositories, regardless of entity type.
-     * Used for workspace-level deduplication checks.
+     * Used for workspace-level deduplication checks (where the question is
+     * "is this id taken anywhere"). When you have both a type and an id,
+     * prefer {@link findEntityByTypeAndId} — see the bug history note
+     * there for why this matters.
      */
     findEntityById(entityId) {
         for (const [repoName, graph] of this.graphs) {
@@ -489,6 +752,15 @@ export class WorkspaceManager {
             }
             const entryPath = join(workspacePath, entry.name);
             const markerPath = join(entryPath, '.studiograph');
+            const gitPath = join(entryPath, '.git');
+            // Loud assertion: a .git directory without a .studiograph marker
+            // indicates the marker was removed out-of-band (production has shown
+            // ~12 such repos with no in-code deletion path). Flag it so the
+            // missing marker can be traced from logs.
+            if (existsSync(gitPath) && !existsSync(markerPath)) {
+                console.warn(`[workspace-manager] WARNING: ${entry.name} has .git but no .studiograph marker — ` +
+                    `repo will NOT be auto-discovered. Marker may have been deleted out-of-band.`);
+            }
             // Check for .studiograph marker directory
             if (existsSync(markerPath)) {
                 // Infer type from directory name patterns