Fence shared workspace readers and preserve projectless chat admission

Retain root source and reader provenance, recheck publication access, keep plain agent transfers independent of repository discovery, and resolve organizational projects without filesystem sources.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
DottaandPaperclip committed 2026-10-12 08:12:05 -05:00
1 parent c205ab39f0
commit e1863d4fe7
24 files changed
+1088 -58320

No files matched your search

@@ -2153,6 +2153,7 @@ export function executionWorkspaceService(db: Db, opts: ExecutionWorkspaceServic
requestTaskRepository: executionWorkspaceRepositoryService(db).request,
listTaskRepositories: executionWorkspaceRepositoryService(db).list,
prepareTaskRepositoriesForAdmission: executionWorkspaceRepositoryService(db).prepareForAdmission,
guardTaskRepositoryRootForPublication: executionWorkspaceRepositoryService(db).guardForPublication,
reserveTaskRepositoryRootForRecovery: executionWorkspaceRepositoryService(db).reserveForRecovery,
resolveSourceWorkspaceStrategy, validateSelection, inspectTaskWorkspace, selectTaskWorkspace, applyPendingTaskWorkspaceSelection, bindTaskWorkspace, prepareTaskWorkspaceUpdate, assertTaskWorkspaceUpdateAccess,
listOverview: async (