wiki-viewer 1.7.2 → 1.8.0

package/.next/standalone/src/components/search/sidebar-search-box.tsx

@@ -0,0 +1,121 @@
+"use client";
+
+/**
+ * Persistent sidebar search box. Renders an inline results dropdown under the
+ * input. Shares state with the cmd+k palette via the search store.
+ * Supports keyboard navigation: ArrowUp / ArrowDown to move, Enter to open,
+ * Escape to clear.
+ */
+import { useEffect, useRef, useState } from "react";
+import { Search } from "lucide-react";
+import { useSearchStore } from "@/stores/search-store";
+import { SnippetText } from "./snippet-text";
+
+export function SidebarSearchBox({
+	onOpenFile,
+}: {
+	onOpenFile: (relPath: string) => void;
+}) {
+	const query = useSearchStore((s) => s.query);
+	const setQuery = useSearchStore((s) => s.setQuery);
+	const results = useSearchStore((s) => s.results);
+	const loading = useSearchStore((s) => s.loading);
+	const search = useSearchStore((s) => s.search);
+	const clear = useSearchStore((s) => s.clear);
+
+	const [active, setActive] = useState(0);
+	const listRef = useRef<HTMLDivElement>(null);
+
+	// Reset / clamp the highlighted row whenever the result set changes.
+	useEffect(() => {
+		setActive(0);
+	}, [results]);
+
+	// Keep the active row scrolled into view.
+	useEffect(() => {
+		const el = listRef.current?.querySelector<HTMLElement>(
+			`[data-idx="${active}"]`,
+		);
+		el?.scrollIntoView({ block: "nearest" });
+	}, [active]);
+
+	function openAt(idx: number) {
+		const r = results[idx];
+		if (!r) return;
+		onOpenFile(r.path);
+		clear();
+	}
+
+	return (
+		<div className="flex flex-col gap-1 px-2 py-1.5">
+			<div className="relative">
+				<Search className="pointer-events-none absolute left-2 top-1/2 h-3.5 w-3.5 -translate-y-1/2 opacity-50" />
+				<input
+					type="text"
+					className="w-full rounded-sm border bg-transparent py-1 pl-7 pr-2 text-xs outline-none focus:ring-1 focus:ring-ring"
+					placeholder="Search… (⌘K)"
+					value={query}
+					onChange={(e) => {
+						setQuery(e.target.value);
+						void search(e.target.value);
+					}}
+					onKeyDown={(e) => {
+						if (e.key === "Escape") {
+							clear();
+							return;
+						}
+						if (results.length === 0) return;
+						if (e.key === "ArrowDown") {
+							e.preventDefault();
+							setActive((i) => (i + 1) % results.length);
+						} else if (e.key === "ArrowUp") {
+							e.preventDefault();
+							setActive((i) => (i - 1 + results.length) % results.length);
+						} else if (e.key === "Enter") {
+							e.preventDefault();
+							openAt(active);
+						}
+					}}
+				/>
+			</div>
+			{query.trim() !== "" && (
+				<div
+					ref={listRef}
+					className="max-h-64 overflow-y-auto rounded-sm border bg-popover"
+				>
+					{loading && (
+						<div className="px-2 py-1 text-xs text-muted-foreground">
+							Searching…
+						</div>
+					)}
+					{!loading && results.length === 0 && (
+						<div className="px-2 py-1 text-xs text-muted-foreground">
+							No matches
+						</div>
+					)}
+					{results.map((r, idx) => (
+						<button
+							key={r.path}
+							type="button"
+							data-idx={idx}
+							onClick={() => openAt(idx)}
+							onMouseEnter={() => setActive(idx)}
+							className={`block w-full px-2 py-1 text-left ${
+								idx === active ? "bg-accent" : "hover:bg-accent"
+							}`}
+						>
+							<div className="truncate font-mono text-xs">
+								{r.path}
+							</div>
+							{r.snippet && (
+								<div className="truncate text-[10px] text-muted-foreground">
+									<SnippetText html={r.snippet} />
+								</div>
+							)}
+						</button>
+					))}
+				</div>
+			)}
+		</div>
+	);
+}

package/.next/standalone/src/components/search/snippet-text.tsx

@@ -0,0 +1,48 @@
+/**
+ * Safe renderer for FTS5 snippet() output.
+ * Parses <mark>...</mark> tags from the snippet string without using
+ * dangerouslySetInnerHTML. Any other HTML in source files is rendered as text.
+ */
+
+interface Part {
+	text: string;
+	mark: boolean;
+}
+
+function parseSnippet(html: string): Part[] {
+	const parts: Part[] = [];
+	const re = /<mark>([\s\S]*?)<\/mark>/g;
+	let last = 0;
+	let m: RegExpExecArray | null;
+	while ((m = re.exec(html)) !== null) {
+		if (m.index > last) {
+			parts.push({ text: html.slice(last, m.index), mark: false });
+		}
+		parts.push({ text: m[1] ?? "", mark: true });
+		last = m.index + m[0].length;
+	}
+	if (last < html.length) {
+		parts.push({ text: html.slice(last), mark: false });
+	}
+	return parts;
+}
+
+export function SnippetText({ html }: { html: string }) {
+	const parts = parseSnippet(html);
+	return (
+		<>
+			{parts.map((p, i) =>
+				p.mark ? (
+					<mark
+						key={i}
+						className="bg-yellow-200 dark:bg-yellow-700 rounded-[2px] px-[1px]"
+					>
+						{p.text}
+					</mark>
+				) : (
+					<span key={i}>{p.text}</span>
+				),
+			)}
+		</>
+	);
+}

package/.next/standalone/src/components/ui/command.tsx

@@ -23,13 +23,14 @@ Command.displayName = CommandPrimitive.displayName;
 
 function CommandDialog({
 	children,
+	shouldFilter,
 	...props
-}: React.ComponentProps<typeof Dialog>) {
+}: React.ComponentProps<typeof Dialog> & { shouldFilter?: boolean }) {
 	return (
 		<Dialog {...props}>
 			<DialogContent className="overflow-hidden p-0 shadow-golden max-w-lg">
 				<DialogTitle className="sr-only">Search</DialogTitle>
-				<Command className="[&_[cmdk-group-heading]]:px-2 [&_[cmdk-group-heading]]:font-normal [&_[cmdk-group-heading]]:text-muted-foreground [&_[cmdk-group]]:px-2 [&_[cmdk-group]:not([hidden])_~[cmdk-group]]:pt-0 [&_[cmdk-input-wrapper]_svg]:h-5 [&_[cmdk-input-wrapper]_svg]:w-5 [&_[cmdk-input]]:h-12 [&_[cmdk-item]]:px-2 [&_[cmdk-item]]:py-3 [&_[cmdk-item]_svg]:h-5 [&_[cmdk-item]_svg]:w-5">
+				<Command shouldFilter={shouldFilter} className="[&_[cmdk-group-heading]]:px-2 [&_[cmdk-group-heading]]:font-normal [&_[cmdk-group-heading]]:text-muted-foreground [&_[cmdk-group]]:px-2 [&_[cmdk-group]:not([hidden])_~[cmdk-group]]:pt-0 [&_[cmdk-input-wrapper]_svg]:h-5 [&_[cmdk-input-wrapper]_svg]:w-5 [&_[cmdk-input]]:h-12 [&_[cmdk-item]]:px-2 [&_[cmdk-item]]:py-3 [&_[cmdk-item]_svg]:h-5 [&_[cmdk-item]_svg]:w-5">
 					{children}
 				</Command>
 			</DialogContent>

package/.next/standalone/src/lib/auth/admin.ts

@@ -0,0 +1,112 @@
+/**
+ * Global admin role.
+ *
+ * Resolution order:
+ *   1. WIKI_ADMIN_EMAILS env (csv, case-insensitive) — seed/override, headless-friendly.
+ *   2. config.adminUserIds — persisted list managed via the admin API.
+ *
+ * Bootstrap: if adminUserIds is empty AND no WIKI_ADMIN_EMAILS is set,
+ * the first call to ensureBootstrapAdmin(userId) writes that user as admin.
+ * Called lazily on the first authenticated request (race-safe: re-read inside).
+ */
+
+import { readConfig, updateConfig } from "@/lib/config";
+import { requireUser } from "@/lib/auth/server";
+
+// ── Internal helpers ───────────────────────────────────────────────────────────
+
+function adminEmailsFromEnv(): string[] {
+	return (process.env.WIKI_ADMIN_EMAILS ?? "")
+		.split(",")
+		.map((e) => e.trim().toLowerCase())
+		.filter(Boolean);
+}
+
+// ── Public API ─────────────────────────────────────────────────────────────────
+
+export async function isAdmin(userId: string, email?: string): Promise<boolean> {
+	// Env override: any matching email is admin
+	if (email) {
+		const envAdmins = adminEmailsFromEnv();
+		if (envAdmins.length > 0 && envAdmins.includes(email.toLowerCase())) {
+			return true;
+		}
+	}
+	const cfg = await readConfig();
+	return (cfg.adminUserIds ?? []).includes(userId);
+}
+
+export async function listAdmins(): Promise<string[]> {
+	const cfg = await readConfig();
+	return cfg.adminUserIds ?? [];
+}
+
+export async function addAdmin(userId: string): Promise<void> {
+	await updateConfig((cfg) => {
+		const current = cfg.adminUserIds ?? [];
+		if (current.includes(userId)) return cfg;
+		return { ...cfg, adminUserIds: [...current, userId] };
+	});
+}
+
+export async function removeAdmin(userId: string): Promise<void> {
+	const hasEnvFallback = adminEmailsFromEnv().length > 0;
+	let rejected = false;
+	await updateConfig((cfg) => {
+		const current = cfg.adminUserIds ?? [];
+		const next = current.filter((id) => id !== userId);
+		// Refuse to remove last admin if no env fallback exists
+		if (next.length === 0 && !hasEnvFallback) {
+			rejected = true;
+			return cfg;
+		}
+		return { ...cfg, adminUserIds: next };
+	});
+	if (rejected) {
+		throw new Error(
+			"LAST_ADMIN: cannot remove the last admin with no WIKI_ADMIN_EMAILS configured",
+		);
+	}
+}
+
+/**
+ * If adminUserIds is empty AND no WIKI_ADMIN_EMAILS, write userId as the first
+ * admin.  Safe to call concurrently: re-reads inside before writing.
+ */
+export async function ensureBootstrapAdmin(userId: string): Promise<void> {
+	if (adminEmailsFromEnv().length > 0) return; // env handles it
+
+	// Fast-path read to avoid the serialized write when an admin already exists.
+	const cfg = await readConfig();
+	if ((cfg.adminUserIds ?? []).length > 0) return;
+
+	let promoted = false;
+	// Atomic: re-check inside the lock so only one concurrent caller writes.
+	await updateConfig((fresh) => {
+		if ((fresh.adminUserIds ?? []).length > 0) return fresh;
+		promoted = true;
+		return { ...fresh, adminUserIds: [userId] };
+	});
+	if (promoted) {
+		console.log(`[wiki-viewer] Bootstrap: first user ${userId} promoted to admin`);
+	}
+}
+
+/**
+ * Use in route handlers.
+ * Returns { ok: true, user } or { ok: false, status, code } ready for NextResponse.
+ */
+export async function requireAdmin(
+	req: Request,
+): Promise<
+	| { ok: true; user: { id: string; email: string; name: string } }
+	| { ok: false; status: number; code: string }
+> {
+	const auth = await requireUser(req);
+	if (!auth.ok) return { ok: false, status: 401, code: "UNAUTHORIZED" };
+
+	const admin = await isAdmin(auth.user.id, auth.user.email);
+	if (!admin) return { ok: false, status: 403, code: "ADMIN_REQUIRED" };
+
+	return { ok: true, user: auth.user };
+}

package/.next/standalone/src/lib/auth/server.ts

@@ -10,8 +10,19 @@ import path from "node:path";
 import os from "node:os";
 import { mkdirSync, readFileSync, writeFileSync, existsSync, chmodSync } from "node:fs";
 import { randomBytes } from "node:crypto";
+import { AsyncLocalStorage } from "node:async_hooks";
 import { isEmailAllowed } from "./allowlist";
 
+// When an admin creates a user, the signup allowlist must not apply (the admin
+// is the gate). We mark that context with an AsyncLocalStorage flag so the
+// user-create hook can skip the allowlist check for that one call only.
+const adminCreateContext = new AsyncLocalStorage<boolean>();
+
+/** Run `fn` with the signup allowlist bypassed (admin-initiated user creation). */
+export function withAdminUserCreate<T>(fn: () => Promise<T>): Promise<T> {
+	return adminCreateContext.run(true, fn);
+}
+
 // Guard runs at server startup, not during next build (NEXT_PHASE=phase-production-build).
 // Set WIKI_ALLOW_INSECURE=1 to bypass the https requirement (development / CI / smoke tests).
 if (
@@ -52,7 +63,7 @@ function resolveSecret(): string {
 	return fresh;
 }
 
-const db = new Database(DB_PATH);
+export const db = new Database(DB_PATH);
 db.pragma("journal_mode = WAL");
 
 function getTrustedOrigins(): string[] {
@@ -142,7 +153,7 @@ export const auth = betterAuth({
 		user: {
 			create: {
 				before: async (user: { email: string }) => {
-					if (!(await isEmailAllowed(user.email))) {
+					if (!adminCreateContext.getStore() && !(await isEmailAllowed(user.email))) {
 						throw new Error("SIGNUP_NOT_ALLOWED");
 					}
 					return { data: user };

package/.next/standalone/src/lib/config.ts

@@ -2,13 +2,30 @@ import { mkdir, readFile, writeFile } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 
-interface WikiViewerConfig {
+// Workspace type is defined in workspaces.ts; we use a forward-compatible
+// inline shape here to avoid a circular import between config ↔ workspaces.
+export interface WorkspaceEntry {
+	id: string;
+	name: string;
+	rootDir: string;
+	createdAt: string;
+	lastOpenedAt?: string;
+	pinnedPaths?: string[];
+	createdBy?: string;
+	allowedUserIds?: string[];
+}
+
+export interface WikiViewerConfig {
 	pinnedPaths?: string[];
 	lastOpenedPath?: string;
 	/** Email allowlist for signup. Empty/undefined = no email restriction. */
 	allowedEmails?: string[];
 	/** Domain allowlist for signup. Empty/undefined = no domain restriction. */
 	allowedDomains?: string[];
+	/** Registered workspaces (replaces flat lastOpenedPath/pinnedPaths over time). */
+	workspaces?: WorkspaceEntry[];
+	/** User IDs with admin privileges. Empty = no admins yet (bootstrap on first request). */
+	adminUserIds?: string[];
 }
 
 function configPath() {
@@ -28,9 +45,44 @@ export async function readConfig(): Promise<WikiViewerConfig> {
 	}
 }
 
-export async function writeConfig(patch: Partial<WikiViewerConfig>): Promise<void> {
+// Serialize all writes so concurrent read-modify-write callers can't lose
+// updates (workspace mutations, admin bootstrap all race on one file).
+let _writeChain: Promise<unknown> = Promise.resolve();
+
+function serialize<T>(fn: () => Promise<T>): Promise<T> {
+	const run = _writeChain.then(fn, fn);
+	// Keep the chain alive but swallow errors so one failure doesn't poison it.
+	_writeChain = run.then(
+		() => undefined,
+		() => undefined,
+	);
+	return run;
+}
+
+async function writeConfigUnsafe(next: WikiViewerConfig): Promise<void> {
 	await ensureDir();
-	const existing = await readConfig();
-	const next = { ...existing, ...patch };
 	await writeFile(configPath(), JSON.stringify(next, null, 2), "utf8");
 }
+
+export async function writeConfig(patch: Partial<WikiViewerConfig>): Promise<void> {
+	return serialize(async () => {
+		const existing = await readConfig();
+		await writeConfigUnsafe({ ...existing, ...patch });
+	});
+}
+
+/**
+ * Atomic read-modify-write. The mutator receives a fresh copy of the config
+ * (read inside the lock) and returns the next config. Serialized against all
+ * other writeConfig/updateConfig callers so updates are never lost.
+ */
+export async function updateConfig(
+	mutator: (cfg: WikiViewerConfig) => WikiViewerConfig,
+): Promise<WikiViewerConfig> {
+	return serialize(async () => {
+		const existing = await readConfig();
+		const next = mutator({ ...existing });
+		await writeConfigUnsafe(next);
+		return next;
+	});
+}

package/.next/standalone/src/lib/proof/audit.ts

@@ -27,16 +27,23 @@ function getDb(): InstanceType<typeof Database> {
 	_db.pragma("journal_mode = WAL");
 	_db.exec(`
 		CREATE TABLE IF NOT EXISTS agent_fs_audit (
-			id      INTEGER PRIMARY KEY AUTOINCREMENT,
-			agent_id TEXT NOT NULL,
-			op      TEXT NOT NULL,
-			path    TEXT NOT NULL,
-			old_sha TEXT,
-			new_sha TEXT,
-			forced  INTEGER NOT NULL DEFAULT 0,
-			at      TEXT NOT NULL
+			id           INTEGER PRIMARY KEY AUTOINCREMENT,
+			agent_id     TEXT NOT NULL,
+			op           TEXT NOT NULL,
+			path         TEXT NOT NULL,
+			old_sha      TEXT,
+			new_sha      TEXT,
+			forced       INTEGER NOT NULL DEFAULT 0,
+			at           TEXT NOT NULL,
+			workspace_id TEXT
 		)
 	`);
+	// Tolerant migration for existing DBs that lack the workspace_id column.
+	try {
+		_db.exec(`ALTER TABLE agent_fs_audit ADD COLUMN workspace_id TEXT`);
+	} catch {
+		// Column already exists — ignore.
+	}
 	return _db;
 }
 
@@ -47,6 +54,7 @@ export interface AuditRow {
 	oldSha?: string;
 	newSha?: string;
 	forced?: boolean;
+	workspaceId?: string;
 }
 
 /**
@@ -57,8 +65,8 @@ export function writeAuditRow(row: AuditRow): void {
 	try {
 		const db = getDb();
 		db.prepare(
-			`INSERT INTO agent_fs_audit (agent_id, op, path, old_sha, new_sha, forced, at)
-			 VALUES (?, ?, ?, ?, ?, ?, ?)`,
+			`INSERT INTO agent_fs_audit (agent_id, op, path, old_sha, new_sha, forced, at, workspace_id)
+			 VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
 		).run(
 			row.agentId,
 			row.op,
@@ -67,6 +75,7 @@ export function writeAuditRow(row: AuditRow): void {
 			row.newSha ?? null,
 			row.forced ? 1 : 0,
 			new Date().toISOString(),
+			row.workspaceId ?? null,
 		);
 	} catch (e) {
 		console.error("[agent-fs audit] write failed:", e);

package/.next/standalone/src/lib/proof/auth.ts

@@ -72,6 +72,8 @@ export async function checkAuth(req: Request): Promise<CheckAuthResult> {
 export interface ScopeParams {
 	filePath?: string;
 	op: "read" | "mutate" | "delete";
+	/** Id of the workspace this request resolved to. If the agent has a workspaceId grant and it differs, 403 is returned. */
+	workspaceId?: string;
 }
 
 export function enforceScope(
@@ -80,6 +82,15 @@ export function enforceScope(
 ): { ok: true } | { ok: false; code: "FORBIDDEN"; message: string } {
 	const { scope } = agent;
 
+	// Workspace grant check: if agent is restricted to a workspace, enforce it.
+	if (scope.workspaceId !== undefined && params.workspaceId !== undefined && scope.workspaceId !== params.workspaceId) {
+		return {
+			ok: false,
+			code: "FORBIDDEN",
+			message: `Agent scope does not cover workspace "${params.workspaceId}" (granted: "${scope.workspaceId}")`,
+		};
+	}
+
 	if (!scope.ops.includes(params.op)) {
 		return { ok: false, code: "FORBIDDEN", message: `Agent scope does not allow "${params.op}"` };
 	}

package/.next/standalone/src/lib/proof/collab-state.ts

@@ -48,13 +48,15 @@ export async function computeCollabState(
 	const snapshotUrl = `/api/agent/files/${relPath}`;
 
 	// Compute revision components
+	// ns = rootDir: workspace-namespaces lease keys so two workspaces sharing
+	// the same relPath never collide in the lease store.
 	const sidecar = await readSidecar(rootDir, relPath);
-	const gen = leaseGeneration(relPath);
+	const gen = leaseGeneration(rootDir, relPath);
 	const sidecarRevision = sidecar?.revision ?? 0;
 	const revision = sidecarRevision + gen;
 
 	// Lease check — do after reading sidecar to keep gen stable within this call
-	const leaseActive = hasActiveLease(relPath);
+	const leaseActive = hasActiveLease(rootDir, relPath);
 
 	if (!sidecar && !leaseActive) {
 		return { state: "untracked", revision, snapshotUrl };

package/.next/standalone/src/lib/proof/file-lock.ts

@@ -1,3 +1,8 @@
+// Workspacing note (Phase B): the lockKey must be workspace-unique. Callers
+// should prefix lockKey with rootDir (or wsId): `${rootDir}\0${relPath}`.
+// The cross-process sentinel hash then differs per workspace automatically.
+// Phase B call sites will make this change when route threading is done.
+
 /**
  * Cross-process file locking via proper-lockfile.
  *

package/.next/standalone/src/lib/proof/idempotency.ts

@@ -1,3 +1,8 @@
+// Workspacing note (Phase B): the idempotency key must be prefixed with wsId
+// (or rootDir) at the call site to prevent cross-workspace collisions:
+// e.g. key = `${rootDir}\0${idempotencyHeader}`. Phase B call sites will
+// make this change when route threading is done.
+
 // Tiny in-memory LRU. Lives for process lifetime. Acceptable: idempotency
 // guards retries within seconds, not days.
 const MAX = 1000;

package/.next/standalone/src/lib/proof/lease.ts

@@ -1,20 +1,25 @@
 /**
  * Human edit-lease store (in-memory, globalThis for hot-reload survival).
  *
+ * Namespace choice (workspacing): the first argument to every public function
+ * is `ns` — a namespace string that MUST be the workspace rootDir (or wsId in
+ * future phases).  The internal map key is `${ns}\u0000${relPath}`.  Two
+ * workspaces that share the same relative path (e.g. "notes.md") therefore
+ * never collide.  Phase B routes pass rootDir from resolveWorkspaceForUser;
+ * Phase A callers pass getRootDir() or tmpRoot in tests.
+ *
  * A lease is set when a human opens a .md doc in the editor and refreshed
  * via heartbeat while the doc stays open.  Its presence makes collab-state
- * "active" even before the human has typed a single suggestion (closes the
- * false-negative GPT-5.5 caught in the design review).
+ * "active" even before the human has typed a single suggestion.
  *
  * TTL: LEASE_TTL_MS (default 90 s). Editor should heartbeat every ~30 s.
  *
  * Collab-generation counter:
- *   - Starts at 0 per path.
+ *   - Starts at 0 per (ns, path).
  *   - Increments on EVERY 0→1 transition (first setLease, or setLease after
  *     all prior leases expired) AND on every 1→0 transition (clearLease or
  *     expiry-on-read).
- *   - X-Collab-Revision = sidecar.revision + leaseGeneration(path).
- *     Any lease or sidecar state change therefore bumps the combined revision.
+ *   - X-Collab-Revision = sidecar.revision + leaseGeneration(ns, path).
  */
 
 export const LEASE_TTL_MS = 90_000;
@@ -38,62 +43,70 @@ function store(): LeaseStore {
 	return g.__wikiLeaseStore!;
 }
 
-/** True if relPath has a non-expired lease RIGHT NOW (lazy-sweeps on check). */
-function isLeaseActiveInternal(relPath: string): boolean {
+function storeKey(ns: string, relPath: string): string {
+	return `${ns}\u0000${relPath}`;
+}
+
+/** True if (ns, relPath) has a non-expired lease RIGHT NOW (lazy-sweeps on check). */
+function isLeaseActiveInternal(ns: string, relPath: string): boolean {
 	const s = store();
-	const entry = s.leases.get(relPath);
+	const key = storeKey(ns, relPath);
+	const entry = s.leases.get(key);
 	if (!entry) return false;
 	if (Date.now() >= entry.expiresAt) {
-		s.leases.delete(relPath);
+		s.leases.delete(key);
 		// 1→0 transition: bump generation
-		s.generations.set(relPath, (s.generations.get(relPath) ?? 0) + 1);
+		s.generations.set(key, (s.generations.get(key) ?? 0) + 1);
 		return false;
 	}
 	return true;
 }
 
 /**
- * Set (or refresh) a lease for relPath by userId.
+ * Set (or refresh) a lease for (ns, relPath) by userId.
  * Bumps the generation counter on a 0→1 transition.
+ * `ns` must be the workspace rootDir (or a stable workspace identifier).
  */
-export function setLease(relPath: string, userId: string, ttlMs = LEASE_TTL_MS): void {
+export function setLease(ns: string, relPath: string, userId: string, ttlMs = LEASE_TTL_MS): void {
 	const s = store();
-	const wasActive = isLeaseActiveInternal(relPath);
-	s.leases.set(relPath, { userId, expiresAt: Date.now() + ttlMs });
+	const key = storeKey(ns, relPath);
+	const wasActive = isLeaseActiveInternal(ns, relPath);
+	s.leases.set(key, { userId, expiresAt: Date.now() + ttlMs });
 	if (!wasActive) {
 		// 0→1 transition: bump generation
-		s.generations.set(relPath, (s.generations.get(relPath) ?? 0) + 1);
+		s.generations.set(key, (s.generations.get(key) ?? 0) + 1);
 	}
 }
 
-/** True if relPath has a current non-expired lease. */
-export function hasActiveLease(relPath: string): boolean {
-	return isLeaseActiveInternal(relPath);
+/** True if (ns, relPath) has a current non-expired lease. */
+export function hasActiveLease(ns: string, relPath: string): boolean {
+	return isLeaseActiveInternal(ns, relPath);
 }
 
 /**
- * Clear the lease for relPath (on doc close).
+ * Clear the lease for (ns, relPath) (on doc close).
  * Only clears if the existing lease belongs to userId.
  * Bumps generation on removal.
  */
-export function clearLease(relPath: string, userId: string): void {
+export function clearLease(ns: string, relPath: string, userId: string): void {
 	const s = store();
-	const entry = s.leases.get(relPath);
+	const key = storeKey(ns, relPath);
+	const entry = s.leases.get(key);
 	if (!entry) return;
-	// Still clear expired leases owned by the same user
 	if (entry.userId === userId) {
-		s.leases.delete(relPath);
+		s.leases.delete(key);
 		// 1→0 transition: bump generation
-		s.generations.set(relPath, (s.generations.get(relPath) ?? 0) + 1);
+		s.generations.set(key, (s.generations.get(key) ?? 0) + 1);
 	}
 }
 
 /**
- * Returns the monotonic-ish collab generation for relPath.
+ * Returns the monotonic-ish collab generation for (ns, relPath).
  * Increments on every 0→1 and 1→0 lease transition.
  */
-export function leaseGeneration(relPath: string): number {
-	return store().generations.get(relPath) ?? 0;
+export function leaseGeneration(ns: string, relPath: string): number {
+	const key = storeKey(ns, relPath);
+	return store().generations.get(key) ?? 0;
 }
 
 /** Reset store — for tests only. */

package/.next/standalone/src/lib/proof/mutex.ts

@@ -1,3 +1,7 @@
+// Workspacing note (Phase B): callers must prefix the lock key with rootDir
+// (or wsId) to ensure two workspaces sharing the same relPath do not serialize
+// against each other. e.g. key = `${rootDir}\0${relPath}`. Phase B call sites
+// will make this change when route threading is done.
 import { withFileLock } from "./file-lock";
 
 const locks = new Map<string, Promise<void>>();