Merge the updated legacy cleanup (#109, with main) into the Phase 2 integration branch

The consent-first scan replaces the automatic project creation that main fixed in #116; main's git checkout fix and sidebar classes are kept. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
2026-10-03 17:01:13 +00:00 · 2026-10-03 17:01:13 +00:00 · ade6c5d116
commit ade6c5d116
parent ef15ec61b1 dd5080ea36
17 changed files with 334 additions and 91 deletions
--- a/.github/workflows/publish-server-image.yml
+++ b/.github/workflows/publish-server-image.yml
@ -256,9 +256,23 @@ jobs:
            grep -Fqx "$want" <<< "$platforms" || { echo "$first_tag is missing $want" >&2; exit 1; }
          done
          echo "digest=$(docker buildx imagetools inspect "$first_tag" --format '{{.Manifest.Digest}}')" >> "$GITHUB_OUTPUT"
-      # GitHub artifact attestations are unavailable for private repos on personal accounts.
+      # Owner type is not exposed on the github context; resolve it from the repository metadata API.
+      - name: Resolve registry attestation eligibility
+        id: attestation
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          owner_type="$(gh api "repos/${GITHUB_REPOSITORY}" --jq -r '.owner.type')"
+          private="$(gh api "repos/${GITHUB_REPOSITORY}" --jq -r '.private')"
+          if [[ "$owner_type" == "User" && "$private" == "true" ]]; then
+            echo "enabled=false" >> "$GITHUB_OUTPUT"
+            echo "Skipping registry attestation: unavailable for private repositories on personal accounts."
+          else
+            echo "enabled=true" >> "$GITHUB_OUTPUT"
+          fi
      - name: Attest the published image
-        if: github.event.repository.private != true || github.repository_owner_type != 'User'
+        if: steps.attestation.outputs.enabled == 'true'
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-name: ghcr.io/${{ steps.ns.outputs.repo }}/${{ matrix.name }}
--- a/AGENTS.md
+++ b/AGENTS.md
@ -10,6 +10,7 @@
 - Keep code simple: reuse existing primitives and one source of truth, remove duplication and unused flexibility, and avoid speculative abstractions. Add an interface when it protects a real external or platform boundary, not for its own sake.
 - Treat auth, secret handling, sandbox boundaries, host commands, and integrations as security-sensitive. Keep tests deterministic and offline by default.
 - The desktop Playwright suite (`pnpm --filter @rakazo/desktop test:e2e`) opens real Electron windows and steals focus on macOS. Do not run it on a maintainer's machine as routine verification; run the unit tests locally and let CI's virtual-display job run the e2e on push.
+- Work autonomously. Make routine calls yourself, such as opening or reopening a pull request, linking CI screenshots, or fixing gaps you found that belong to the task, then verify and report the outcome. Ask the maintainer only before irreversible actions or for product decisions without a sensible default.
 - After creating a pull request, stay with it until CI and automated review bots have finished; passing checks alone do not mean the review is complete. Follow `.agents/skills/pr-watch/SKILL.md`: run its `pr-digest --watch` helper as a single backgrounded call that blocks until the checks on the current head commit are terminal, then act on the verdict it prints. Do not poll in the foreground on a timer, which mostly buys repeated snapshots of an unchanged PR and dies at the tool timeout. Address every actionable issue, push the fixes, and repeat until no actionable feedback remains. Do not merge while review bots are still pending or review issues remain unresolved.
 - PR descriptions say why the change exists, what changed, and how it was tested. Write Why as the product reason (what was wrong and what this changes); never "Elie wants" or a third-person briefing of a named person; the maintainer is the author.
 - Commit messages, PR descriptions, issues, and review replies are public too. Describe test results in words instead of pasting tool output, and never include anything that identifies a person, machine, or account: local paths, usernames, hostnames, signing identities, legal entity names, Apple Team IDs, API key IDs, issuer or tenant IDs, account emails, or the accounts, machines, and files that secret values came from. Naming the secrets a workflow reads is fine; use placeholders when a value must be shown.
--- a/apps/api/src/router.ts
+++ b/apps/api/src/router.ts
@ -645,6 +645,10 @@ export function createRouter(deps: RouterDeps) {
        spaceNavigationDto(deps, context.actor, repos, groupRepos),
      ),
      create: authed.spaces.create.handler(async ({ context, input }) => {
+        // A linked folder lives on the host, and the host is the deployment owner's machine.
+        if (input.workspacePath && !context.actor.isDeploymentOwner) {
+          throw new ORPCError("FORBIDDEN");
+        }
        let space: { id: string; name: string };
        try {
          space = await createSpaceForMember(deps.prisma, {
@ -2306,10 +2310,7 @@ export function createRouter(deps: RouterDeps) {
          }
        }
        if (isProjectWorkspacePath(storedPath)) {
-          const workspaceRoot = await requireProjectWorkspaceRoot(
-            deps.prisma,
-            context.actor.spaceId,
-          );
+          const workspaceRoot = await requireProjectWorkspaceRoot(deps.prisma, context.actor);
          const entries = await listProjectWorkspaceFiles(workspaceRoot, storedPath);
          return entries.map((entry) => ({
            ...entry,
@ -2357,10 +2358,7 @@ export function createRouter(deps: RouterDeps) {
          }
        }
        if (isProjectWorkspacePath(storedPath)) {
-          const workspaceRoot = await requireProjectWorkspaceRoot(
-            deps.prisma,
-            context.actor.spaceId,
-          );
+          const workspaceRoot = await requireProjectWorkspaceRoot(deps.prisma, context.actor);
          const bytes = await readProjectWorkspaceFile(workspaceRoot, storedPath, {
            maxBytes: MAX_COMPUTER_TEXT_FILE_BYTES,
          });
@ -5033,10 +5031,13 @@ function mapUpdaterError(error: unknown): never {

 async function requireProjectWorkspaceRoot(
  prisma: Pick<PrismaClient, "space">,
-  spaceId: string,
+  actor: Actor,
 ): Promise<string> {
+  // Only the deployment owner may link a host folder, so only they may browse one. This also
+  // closes folders that other members linked before linking was limited to the owner.
+  if (!actor.isDeploymentOwner) throw new ORPCError("FORBIDDEN");
  const space = await prisma.space.findUnique({
-    where: { id: spaceId },
+    where: { id: actor.spaceId },
    select: { workspacePath: true },
  });
  if (!space?.workspacePath) {
@ -5148,7 +5149,8 @@ async function spaceNavigationDto(
          memberships.length > 1 &&
          !spacesWithContent.has(membership.spaceId) &&
          (membership.space.deletingAt === null || membership.space.deletingAt < staleClaimBefore),
-        workspace: projectWorkspaceDto(membership.space),
+        // A linked folder is on the owner's host; other members see neither its path nor remote.
+        workspace: actor.isDeploymentOwner ? projectWorkspaceDto(membership.space) : null,
        bots: spaceBots.map((bot) => ({
          id: bot.id,
          spaceId: bot.spaceId,
--- a/apps/web/e2e/chat-contrast.spec.ts
+++ b/apps/web/e2e/chat-contrast.spec.ts
@ -16,11 +16,12 @@ test.use({ viewport: { width: 1280, height: 1000 } });

 /**
 * Texts in `locator` below WCAG AA against the surface they are painted on. With `inside`, every
- * visible text and typed value within it counts, except in disabled controls, which WCAG exempts.
+ * visible text and typed value within it counts, except in disabled controls, which WCAG exempts,
+ * and in elements matching `skip`.
 */
-function unreadableTexts(locator: Locator, inside: boolean) {
+function unreadableTexts(locator: Locator, inside: boolean, skip: string | null) {
  return locator.evaluate(
-    (root, { inside, min }) => {
+    (root, { inside, skip, min }) => {
      const context = document
        .createElement("canvas")
        .getContext("2d", { willReadFrequently: true });
@ -81,7 +82,11 @@ function unreadableTexts(locator: Locator, inside: boolean) {
      };
      const elements = inside
        ? [root, ...root.querySelectorAll("*")].filter(
-            (element) => ownText(element) && shown(element) && !element.closest(":disabled"),
+            (element) =>
+              ownText(element) &&
+              shown(element) &&
+              !element.closest(":disabled") &&
+              !(skip && element.closest(skip)),
          )
        : [root];
      return elements.flatMap((element) => {
@ -90,14 +95,18 @@ function unreadableTexts(locator: Locator, inside: boolean) {
        return ratio < min ? [`${ratio.toFixed(2)}:1 ${text.slice(0, 48)}`] : [];
      });
    },
-    { inside, min: MIN_CONTRAST },
+    { inside, skip, min: MIN_CONTRAST },
  );
 }

-async function expectReadable(locator: Locator, what: string, { inside = false } = {}) {
+async function expectReadable(
+  locator: Locator,
+  what: string,
+  { inside = false, skip = null }: { inside?: boolean; skip?: string | null } = {},
+) {
  await expect(locator).toBeVisible();
  await expect
-    .poll(() => unreadableTexts(locator, inside), { message: `${what} is readable` })
+    .poll(() => unreadableTexts(locator, inside, skip), { message: `${what} is readable` })
    .toEqual([]);
 }

@ -213,6 +222,8 @@ test("shell surfaces stay readable in light and dark themes", async ({ page }, t
  await composer.fill("Draft a note about owls");
  const sidebar = page.getByTestId("bots-sidebar");
  const sidePanel = page.getByTestId("side-panel");
+  await expect(sidebar.locator("[data-main-conversation]")).toBeVisible();
+  await expect(sidebar.getByRole("button", { name: "Researcher, 1:1 conversation" })).toBeVisible();

  await inEachTheme(page, async (theme) => {
    await captureScreenshot(page, testInfo, `shell-contrast-${theme}`);
@ -220,24 +231,9 @@ test("shell surfaces stay readable in light and dark themes", async ({ page }, t
    await expectReadable(page.getByTestId("composer-bar"), `${theme}: the composer`, {
      inside: true,
    });
-    await expectReadable(
-      sidebar.getByRole("button", { name: "Today", exact: true }),
-      `${theme}: Today`,
-      { inside: true },
-    );
-    await expectReadable(
-      sidebar.locator("[data-main-conversation]"),
-      `${theme}: the main conversation row`,
-      { inside: true },
-    );
-    await expectReadable(
-      sidebar.getByRole("button", { name: "Researcher, 1:1 conversation" }),
-      `${theme}: the selected bot row`,
-      { inside: true },
-    );
-    await expectReadable(page.getByTestId("user-menu-trigger"), `${theme}: the user menu`, {
-      inside: true,
-    });
+    // The header carries the logo, which WCAG exempts; its create button is checked on its own.
+    await expectReadable(sidebar, `${theme}: the sidebar`, { inside: true, skip: ".app-drag" });
+    await expectReadable(page.getByTestId("create-menu-trigger"), `${theme}: the create button`);
  });

  await openNewBot(page);
@ -256,4 +252,12 @@ test("shell surfaces stay readable in light and dark themes", async ({ page }, t
    await captureScreenshot(page, testInfo, `shell-contrast-${theme}-settings`);
    await expectReadable(sidePanel, `${theme}: the bot settings form`, { inside: true });
  });
+
+  await sidebar.getByRole("button", { name: "Today", exact: true }).click();
+  const heute = page.getByTestId("heute-brief");
+  await expect(heute).toBeVisible();
+  await inEachTheme(page, async (theme) => {
+    await captureScreenshot(page, testInfo, `shell-contrast-${theme}-heute`);
+    await expectReadable(heute, `${theme}: the Heute brief`, { inside: true });
+  });
 });
--- a/apps/web/e2e/spaces.spec.ts
+++ b/apps/web/e2e/spaces.spec.ts
@ -3,6 +3,7 @@ import {
  captureScreenshot,
  completeOnboarding,
  openNewSpace,
+  routePatchRpc,
  rpc,
  signup,
  unterhaltungenOnly,
@ -45,6 +46,30 @@ test("Projects + opens new project dialog instead of group form", async ({ page
  await expect(page.getByTestId("project-start-main")).toHaveText(/Start/);
 });

+for (const owner of [true, false]) {
+  const role = owner ? "owner" : "member";
+  const title = owner
+    ? "new project dialog offers a host folder to the deployment owner"
+    : "new project dialog offers no host folder to a member";
+  test(title, async ({ page }, testInfo) => {
+    await signup(page, `proj-folder-${role}-${Date.now()}@rakazo.test`, "password12", "Folder");
+    await completeOnboarding(page);
+    // Whoever signs up first owns the deployment, which depends on spec order.
+    await routePatchRpc(page, "bootstrap", (json) => ({
+      ...json,
+      me: { ...(json.me as Record<string, unknown>), isDeploymentOwner: owner },
+    }));
+    await page.goto("/app");
+    await page.waitForURL(/\/app\/[^/]+$/);
+
+    await page.locator(".sidebar-projekte").getByTestId("create-project-trigger").click();
+    const dialog = page.getByRole("dialog", { name: "New project" });
+    await expect(dialog.getByLabel("Name")).toBeVisible();
+    await expect(dialog.getByLabel("Project folder")).toHaveCount(owner ? 1 : 0);
+    await captureScreenshot(page, testInfo, `new-project-${role}`);
+  });
+}
+
 test("spaces stay invisible by default and chat creation requires approval", async ({
  page,
 }, testInfo) => {
--- a/apps/web/src/pages/HeuteBrief.tsx
+++ b/apps/web/src/pages/HeuteBrief.tsx
@ -285,7 +285,7 @@ function EmptyDay({ onStartChat, hasBots }: { onStartChat: () => void; hasBots:

 function ActionableChip({ label }: { label: string }) {
  return (
-    <span className="shrink-0 rounded-full border border-warning/30 bg-warning/10 px-2 py-0.5 text-ui-label font-medium text-warning">
+    <span className="shrink-0 rounded-full border border-warning/30 bg-warning/10 px-2 py-0.5 text-ui-label font-medium text-foreground dark:text-warning">
      {label}
    </span>
  );
--- a/apps/web/src/pages/Shell.tsx
+++ b/apps/web/src/pages/Shell.tsx
@ -3454,7 +3454,7 @@ export function ShellPage() {
              className={`app-no-drag flex size-control-sm items-center justify-center rounded-full ${
                activityMode
                  ? "bg-primary text-primary-foreground"
-                  : "text-muted-foreground/70 hover:text-foreground/75"
+                  : "rk-sidebar-muted hover:text-foreground/75"
              }`}
            >
              <Bell
@ -3467,7 +3467,7 @@ export function ShellPage() {

            <Popover open={createMenuOpen} onOpenChange={setCreateMenuOpen}>
              <PopoverTrigger
-                className="app-no-drag text-[21px] text-muted-foreground/70 hover:text-foreground/75"
+                className="app-no-drag text-[21px] rk-sidebar-muted hover:text-foreground/75"
                title={t`Create`}
                data-testid="create-menu-trigger"
              >
@ -3590,7 +3590,7 @@ export function ShellPage() {
                        type="button"
                        aria-label={t`New conversation`}
                        data-testid="conversation-picker-trigger"
-                        className="text-muted-foreground/60 hover:text-foreground/90 transition-colors"
+                        className="rk-sidebar-muted hover:text-foreground/90 transition-colors"
                      >
                        <Plus strokeWidth={2.5} className="size-icon-md" />
                      </PopoverTrigger>
@ -3631,7 +3631,7 @@ export function ShellPage() {
                  </div>
                ) : null}
                {conversationSidebarGroups.length === 0 && !mainConversationEntry ? (
-                  <div className="p-4 text-center text-ui-label text-muted-foreground">
+                  <div className="p-4 text-center text-ui-label rk-sidebar-muted">
                    <p>{t`No conversations yet.`}</p>
                    <Button
                      variant="outline"
@ -3655,7 +3655,7 @@ export function ShellPage() {
                        <div className="flex items-center pt-3 pb-0.5">
                          <button
                            type="button"
-                            className="flex min-w-0 flex-1 items-center justify-between gap-2 rounded-lg px-2.5 py-1 text-ui-label font-semibold tracking-wider uppercase text-muted-foreground/60 hover:text-foreground focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-[-2px] focus-visible:outline-ring"
+                            className="flex min-w-0 flex-1 items-center justify-between gap-2 rounded-lg px-2.5 py-1 text-ui-label font-semibold tracking-wider uppercase text-foreground/65 dark:text-muted-foreground/80 hover:text-foreground focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-[-2px] focus-visible:outline-ring"
                            onClick={() => {
                              if (group.emptySpaceId) {
                                openSpaceChat(group.emptySpaceId, "/onboarding");
@ -3839,7 +3839,7 @@ export function ShellPage() {
                                      {item.chat.name}
                                    </span>
                                    {needsYouChipLabel(item.chat.status) ? (
-                                      <span className="shrink-0 rounded-full border border-warning/30 bg-warning/10 px-2 py-0.5 text-ui-label font-medium text-warning">
+                                      <span className="shrink-0 rounded-full border border-warning/30 bg-warning/10 px-2 py-0.5 text-ui-label font-medium text-foreground dark:text-warning">
                                        {needsYouChipLabel(item.chat.status)}
                                      </span>
                                    ) : item.chat.title ? (
@ -3885,7 +3885,7 @@ export function ShellPage() {
                              [group.key]: !prev[group.key],
                            }))
                          }
-                          className="mt-1 w-full flex items-center justify-center gap-1.5 rounded-lg px-2 py-1.5 text-ui-label font-medium text-muted-foreground hover:bg-sidebar-accent hover:text-foreground transition-colors"
+                          className="mt-1 w-full flex items-center justify-center gap-1.5 rounded-lg px-2 py-1.5 text-ui-label font-medium rk-sidebar-muted hover:bg-sidebar-accent hover:text-foreground transition-colors"
                        >
                          {expandedTeamGroups[group.key]
                            ? t`Show less`
@ -3900,7 +3900,7 @@ export function ShellPage() {
                  <div className="flex items-center justify-between pt-4 pb-1 mt-3 border-t border-sidebar-border px-2.5">
                    <div>
                      <div className="rk-shell-section-label">{t`Projects`}</div>
-                      <p className="mt-0.5 px-0.5 text-ui-caption text-muted-foreground/70">
+                      <p className="mt-0.5 px-0.5 text-ui-caption rk-sidebar-muted">
                        {t`Threads by topic · folders`}
                      </p>
                    </div>
@ -3910,14 +3910,14 @@ export function ShellPage() {
                        aria-label={t`Create a project`}
                        data-testid="create-project-trigger"
                        onClick={() => openNewSpaceDialog("project")}
-                        className="text-muted-foreground/60 hover:text-foreground/90 transition-colors"
+                        className="rk-sidebar-muted hover:text-foreground/90 transition-colors"
                      >
                        <Plus strokeWidth={2.5} className="size-icon-md" />
                      </button>
                    </div>
                  </div>
                  {projectSidebarGroups.length === 0 ? (
-                    <div className="p-4 text-center text-ui-label text-muted-foreground">
+                    <div className="p-4 text-center text-ui-label rk-sidebar-muted">
                      <p>{t`No projects yet.`}</p>
                      <Button
                        variant="outline"
@ -3955,7 +3955,7 @@ export function ShellPage() {
                                  </ProjectDragGrip>
                                  <button
                                    type="button"
-                                    className="flex min-w-0 flex-1 items-center justify-between gap-2 rounded-lg pl-8 py-1 text-ui-label font-semibold tracking-wider uppercase text-muted-foreground/60 hover:text-foreground focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-[-2px] focus-visible:outline-ring"
+                                    className="flex min-w-0 flex-1 items-center justify-between gap-2 rounded-lg pl-8 py-1 text-ui-label font-semibold tracking-wider uppercase text-foreground/65 dark:text-muted-foreground/80 hover:text-foreground focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-[-2px] focus-visible:outline-ring"
                                    onClick={() => {
                                      if (group.emptySpaceId) {
                                        openSpaceChat(group.emptySpaceId, "/app");
@ -4151,7 +4151,7 @@ export function ShellPage() {
                type="button"
                aria-expanded={archivedOpen}
                onClick={() => setArchivedOpen((open) => !open)}
-                className="flex w-full items-center justify-between rounded-lg px-2.5 py-2 text-ui-body text-muted-foreground hover:bg-sidebar-accent"
+                className="flex w-full items-center justify-between rounded-lg px-2.5 py-2 text-ui-body rk-sidebar-muted hover:bg-sidebar-accent"
              >
                <span>
                  <Trans>Archived</Trans>
@ -5479,6 +5479,7 @@ export function ShellPage() {
        {newSpaceOpen ? (
          <NewSpaceDialog
            variant={newSpaceDialogVariant}
+            canLinkFolder={bootstrapMe?.isDeploymentOwner === true}
            onCancel={() => setNewSpaceOpen(false)}
            onConfirm={async ({ name, workspacePath }) => {
              const space = await rpc.spaces.create({
--- a/apps/web/src/pages/shell/dialogs.tsx
+++ b/apps/web/src/pages/shell/dialogs.tsx
@ -38,10 +38,13 @@ export type NewSpaceConfirmInput = {

 export function NewSpaceDialog({
  variant = "space",
+  canLinkFolder,
  onCancel,
  onConfirm,
 }: {
  variant?: "space" | "project";
+  /** Folders live on the host, which only the deployment owner may link. */
+  canLinkFolder: boolean;
  onCancel: () => void;
  onConfirm: (input: NewSpaceConfirmInput) => Promise<void>;
 }) {
@ -53,6 +56,7 @@ export function NewSpaceDialog({
  const [saving, setSaving] = useState(false);
  const [error, setError] = useState<string | null>(null);
  const isProject = variant === "project";
+  const showFolder = isProject && canLinkFolder;
  const desktop = desktopBridge();
  const trimmedWorkspacePath = workspacePath.trim();

@ -63,7 +67,7 @@ export function NewSpaceDialog({
    setError(null);
    void onConfirm({
      name: trimmed,
-      ...(isProject && trimmedWorkspacePath ? { workspacePath: trimmedWorkspacePath } : {}),
+      ...(showFolder && trimmedWorkspacePath ? { workspacePath: trimmedWorkspacePath } : {}),
    }).catch((reason: unknown) => {
      setError(
        reason instanceof Error
@ -104,7 +108,7 @@ export function NewSpaceDialog({
            className="mt-2"
          />
        </label>
-        {isProject ? (
+        {showFolder ? (
          <div className="space-y-2">
            <label htmlFor={folderId} className="block text-ui-body text-foreground/75">
              <Trans>Project folder</Trans>
--- a/apps/web/src/pages/shell/roster-row-style.ts
+++ b/apps/web/src/pages/shell/roster-row-style.ts
@ -11,9 +11,7 @@ export function rosterNameClass(unread: boolean): string {
  return unread ? "font-bold text-sidebar-foreground" : "font-semibold text-sidebar-foreground";
 }

-// Muted text measures about 4.4:1 on the light sidebar; a dimmed foreground stays above 4.5:1.
-export const rosterTimeClass =
-  "text-ui-body-sm text-sidebar-foreground/65 tabular-nums font-medium";
+export const rosterTimeClass = "text-ui-body-sm rk-sidebar-muted tabular-nums font-medium";

 export const rosterUnreadDotClass = "inline-block h-2 w-2 rounded-full bg-sidebar-foreground";

--- a/apps/web/src/styles.css
+++ b/apps/web/src/styles.css
@ -73,7 +73,7 @@ body,
 /* Shell layout utilities — token-backed, use instead of one-off pixel classes */
@layer components {
  .rk-shell-section-label {
-    @apply text-ui-label font-bold tracking-wider uppercase text-muted-foreground/80;
+    @apply text-ui-label font-bold tracking-wider uppercase text-foreground/65 dark:text-muted-foreground/80;
  }

  .rk-shell-icon-btn {
@ -84,6 +84,12 @@ body,
    @apply text-ui-body-sm text-muted-foreground;
  }

+  /* Secondary sidebar text and icons. Muted text measures 4.4:1 on the light sidebar;
+     a dimmed foreground stays above 4.5:1. */
+  .rk-sidebar-muted {
+    @apply text-sidebar-foreground/65;
+  }
+
  .rk-shell-row-title {
    @apply text-ui-body font-medium text-foreground;
  }
--- a/infra/updater/src/publish-workflow.test.ts
+++ b/infra/updater/src/publish-workflow.test.ts
@ -38,12 +38,14 @@ describe("server image publish workflow", () => {
    expect(publish.needs).toBe("build");
    expect(workflowText).toContain("push-by-digest=true");
    expect(workflowText).toContain("docker buildx imagetools create");
-    expect(workflowText).toContain('if [[ "${#sources[@]}" -ne 1 ]]');
+    expect(workflowText).toContain(`if [[ "\${#sources[@]}" -ne 1 ]]`);
    expect(workflowText).toContain("for want in linux/amd64; do");
    expect(workflowText).toContain("actions/attest-build-provenance@");
-    expect(workflowText).toContain(
-      "if: github.event.repository.private != true || github.repository_owner_type != 'User'",
-    );
+    expect(workflowText).not.toContain("github.repository_owner_type");
+    expect(workflowText).toContain(`gh api "repos/\${GITHUB_REPOSITORY}"`);
+    expect(workflowText).toContain(".owner.type");
+    expect(workflowText).toContain("if: steps.attestation.outputs.enabled == 'true'");
+    expect(workflowText).toContain('[[ "$owner_type" == "User" && "$private" == "true" ]]');
  });

  it("stores digest markers under RUNNER_TEMP so self-hosted runners do not leak stale files", () => {
@ -52,11 +54,11 @@ describe("server image publish workflow", () => {
  });

  it("names every image under the lowercase repository namespace", () => {
-    expect(workflowText).not.toContain("ghcr.io/${{ github.repository }}");
+    expect(workflowText).not.toContain(`ghcr.io/\${{ github.repository }}`);
    const references =
      workflowText.match(/ghcr\.io\/\$\{\{ steps\.ns\.outputs\.repo \}\}\//g) ?? [];
    expect(references.length).toBeGreaterThanOrEqual(6);
-    expect(workflowText).toContain("repo=${GITHUB_REPOSITORY,,}");
+    expect(workflowText).toContain(`repo=\${GITHUB_REPOSITORY,,}`);
  });

  it("keeps pull requests read-only and every action pinned to a commit", () => {
--- a/packages/adapters/src/project-workspace-files.test.ts
+++ b/packages/adapters/src/project-workspace-files.test.ts
@ -0,0 +1,60 @@
+import { mkdirSync, mkdtempSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { afterEach, describe, expect, it } from "vitest";
+import { listProjectWorkspaceFiles, readProjectWorkspaceFile } from "./project-workspace-files.js";
+
+describe("project workspace files", () => {
+  const roots: string[] = [];
+
+  afterEach(() => {
+    for (const root of roots.splice(0)) {
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  function linkedFolderBesideSecret() {
+    const base = mkdtempSync(path.join(tmpdir(), "project-workspace-files-"));
+    roots.push(base);
+    const project = path.join(base, "project");
+    const outside = path.join(base, "outside");
+    mkdirSync(path.join(project, "docs"), { recursive: true });
+    mkdirSync(outside);
+    writeFileSync(path.join(project, "docs", "readme.md"), "inside");
+    writeFileSync(path.join(outside, "secret.txt"), "outside");
+    return { project, outside };
+  }
+
+  it("lists and reads files inside the linked folder, including symlinks that stay inside", async () => {
+    const { project } = linkedFolderBesideSecret();
+    symlinkSync(path.join(project, "docs", "readme.md"), path.join(project, "readme-link.md"));
+
+    const listed = await listProjectWorkspaceFiles(project, "project");
+    expect(listed.map((entry) => entry.path).sort()).toEqual([
+      "project/docs",
+      "project/readme-link.md",
+    ]);
+    expect(await listProjectWorkspaceFiles(project, "project/docs")).toEqual([
+      { path: "project/docs/readme.md", kind: "file", size: 6 },
+    ]);
+    const read = await readProjectWorkspaceFile(project, "project/readme-link.md");
+    expect(new TextDecoder().decode(read)).toBe("inside");
+  });
+
+  it("keeps symlinks from leaving the linked folder", async () => {
+    const { project, outside } = linkedFolderBesideSecret();
+    symlinkSync(outside, path.join(project, "escape"));
+    symlinkSync(path.join(outside, "secret.txt"), path.join(project, "secret-link.txt"));
+    symlinkSync(path.join(project, "missing"), path.join(project, "dangling"));
+
+    const listed = await listProjectWorkspaceFiles(project, "project");
+    expect(listed.map((entry) => entry.path)).toEqual(["project/docs"]);
+    await expect(listProjectWorkspaceFiles(project, "project/escape")).rejects.toThrow(/escapes/i);
+    await expect(readProjectWorkspaceFile(project, "project/escape/secret.txt")).rejects.toThrow(
+      /escapes/i,
+    );
+    await expect(readProjectWorkspaceFile(project, "project/secret-link.txt")).rejects.toThrow(
+      /escapes/i,
+    );
+  });
+});
--- a/packages/adapters/src/project-workspace-files.ts
+++ b/packages/adapters/src/project-workspace-files.ts
@ -1,6 +1,8 @@
-import { readdir, readFile, stat } from "node:fs/promises";
+import { readdir, readFile, realpath, stat } from "node:fs/promises";
+import path from "node:path";
 import type { ComputerFileEntry } from "@rakazo/adapter-kit";
 import { normalizeWorkspacePath } from "./computer-support.js";
+import { isAllowedDesktopPath } from "./desktop-sandbox-paths.js";
 import {
  isProjectWorkspacePath,
  projectWorkspaceRelativePath,
@ -14,28 +16,34 @@ export async function listProjectWorkspaceFiles(
  if (!isProjectWorkspacePath(storedPath)) {
    throw new Error("Path is not under the project workspace");
  }
-  const hostDirectory = resolveProjectHostPath(workspaceRoot, storedPath);
+  const root = await realpath(workspaceRoot);
+  const hostDirectory = await containedHostPath(
+    root,
+    resolveProjectHostPath(workspaceRoot, storedPath),
+  );
  const relativeDirectory = projectWorkspaceRelativePath(storedPath);
  const entries = await readdir(hostDirectory, { withFileTypes: true });
  const listed = await Promise.all(
    entries.map(async (entry) => {
-      const childHost = resolveProjectHostPath(
-        workspaceRoot,
-        relativeDirectory ? `project/${relativeDirectory}/${entry.name}` : `project/${entry.name}`,
-      );
-      const info = await stat(childHost);
+      // A symlink that leaves the linked folder, or leads nowhere, is not part of the project.
+      const info = await containedHostPath(root, path.join(hostDirectory, entry.name))
+        .then((target) => stat(target))
+        .catch(() => null);
+      if (!info) return [];
      const childStored = normalizeWorkspacePath(
        relativeDirectory ? `project/${relativeDirectory}/${entry.name}` : `project/${entry.name}`,
      );
-      return {
-        path: childStored,
-        kind: info.isDirectory() ? ("dir" as const) : ("file" as const),
-        size: info.size,
-        ...(info.isFile() && info.mode & 0o100 ? { executable: true } : {}),
-      };
+      return [
+        {
+          path: childStored,
+          kind: info.isDirectory() ? ("dir" as const) : ("file" as const),
+          size: info.size,
+          ...(info.isFile() && info.mode & 0o100 ? { executable: true } : {}),
+        },
+      ];
    }),
  );
-  return listed;
+  return listed.flat();
 }

 export async function readProjectWorkspaceFile(
@ -43,10 +51,22 @@ export async function readProjectWorkspaceFile(
  storedPath: string,
  options?: { maxBytes?: number },
 ): Promise<Uint8Array> {
-  const hostPath = resolveProjectHostPath(workspaceRoot, storedPath);
+  const hostPath = await containedHostPath(
+    await realpath(workspaceRoot),
+    resolveProjectHostPath(workspaceRoot, storedPath),
+  );
  const info = await stat(hostPath);
  if (options?.maxBytes !== undefined && info.size > options.maxBytes) {
    throw new Error(`computer file exceeds ${options.maxBytes} bytes`);
  }
  return new Uint8Array(await readFile(hostPath));
 }
+
+/** Follows symlinks, but only to places inside the linked folder. */
+async function containedHostPath(root: string, candidate: string): Promise<string> {
+  const target = await realpath(candidate);
+  if (!isAllowedDesktopPath(target, [root])) {
+    throw new Error("Path escapes the project workspace");
+  }
+  return target;
+}
--- a/packages/core/src/git-checkout.ts
+++ b/packages/core/src/git-checkout.ts
@ -1,4 +1,4 @@
-// Server only: reached through the "@rakazo/core/git-checkout" subpath, never the browser entry.
+// Server-only. Kept out of the package index so browser bundles never load `node:child_process`.
 import { spawn } from "node:child_process";
 import { access } from "node:fs/promises";
 import path from "node:path";
--- a/packages/db/src/project-workspace.test.ts
+++ b/packages/db/src/project-workspace.test.ts
@ -1,12 +1,12 @@
-import { mkdirSync, mkdtempSync, rmSync } from "node:fs";
+import { mkdirSync, mkdtempSync, realpathSync, rmSync, symlinkSync } from "node:fs";
 import { tmpdir } from "node:os";
 import path from "node:path";
 import { afterEach, describe, expect, it, vi } from "vitest";
 import type { PrismaClient } from "./client.js";
 import {
-  assertProjectWorkspaceDirectory,
  InvalidProjectWorkspacePathError,
  normalizeProjectWorkspacePath,
+  resolveProjectWorkspaceDirectory,
  wireProjectWorkspace,
 } from "./project-workspace.js";

@ -43,11 +43,21 @@ describe("project workspace wiring", () => {

  it("rejects missing folders", async () => {
    const missing = path.join(tmpdir(), `missing-${Date.now()}`);
-    await expect(assertProjectWorkspaceDirectory(missing)).rejects.toBeInstanceOf(
+    await expect(resolveProjectWorkspaceDirectory(missing)).rejects.toBeInstanceOf(
      InvalidProjectWorkspacePathError,
    );
  });

+  it("resolves a symlinked folder to the real folder behind it", async () => {
+    const root = tempDir("project-workspace-symlink-");
+    const real = path.join(root, "real");
+    mkdirSync(real);
+    symlinkSync(real, path.join(root, "link"));
+    expect(await resolveProjectWorkspaceDirectory(path.join(root, "link"))).toBe(
+      realpathSync(real),
+    );
+  });
+
  it("persists workspace and git metadata on the space", async () => {
    const root = tempDir("project-workspace-wire-");
    mkdirSync(path.join(root, ".git"));
@ -64,7 +74,7 @@ describe("project workspace wiring", () => {
      spaceId: "space-1",
      workspacePath: root,
    });
-    expect(wired.path).toBe(path.resolve(root));
+    expect(wired.path).toBe(realpathSync(root));
    expect(wired.git).toEqual({
      remoteUrl: "https://github.com/example/demo.git",
      defaultBranch: "main",
@ -73,7 +83,7 @@ describe("project workspace wiring", () => {
      dirtyPaths: [],
    });
    expect(updates[0]).toMatchObject({
-      workspacePath: path.resolve(root),
+      workspacePath: realpathSync(root),
      gitRemoteUrl: "https://github.com/example/demo.git",
      gitDefaultBranch: "main",
      gitHeadCommit: "abc123",
--- a/packages/db/src/project-workspace.ts
+++ b/packages/db/src/project-workspace.ts
@ -1,4 +1,4 @@
-import { access, stat } from "node:fs/promises";
+import { realpath, stat } from "node:fs/promises";
 import path from "node:path";
 import { readGitCheckout } from "@rakazo/core/git-checkout";
 import type { PrismaClient } from "./client.js";
@ -22,11 +22,13 @@ export function normalizeProjectWorkspacePath(input: string): string {
  return path.resolve(trimmed);
 }

-export async function assertProjectWorkspaceDirectory(workspacePath: string): Promise<void> {
-  const resolved = normalizeProjectWorkspacePath(workspacePath);
+/** The real folder behind a path, so a symlink cannot later point the link somewhere else. */
+export async function resolveProjectWorkspaceDirectory(workspacePath: string): Promise<string> {
+  const normalized = normalizeProjectWorkspacePath(workspacePath);
+  let resolved: string;
  let info: Awaited<ReturnType<typeof stat>>;
  try {
-    await access(resolved);
+    resolved = await realpath(normalized);
    info = await stat(resolved);
  } catch {
    throw new InvalidProjectWorkspacePathError("That folder does not exist or is not readable.");
@ -34,6 +36,7 @@ export async function assertProjectWorkspaceDirectory(workspacePath: string): Pr
  if (!info.isDirectory()) {
    throw new InvalidProjectWorkspacePathError("That path is not a folder.");
  }
+  return resolved;
 }

 export interface WiredProjectWorkspace {
@ -52,8 +55,7 @@ export async function wireProjectWorkspace(
  prisma: Pick<PrismaClient, "space">,
  input: { spaceId: string; workspacePath: string },
 ): Promise<WiredProjectWorkspace> {
-  const resolved = normalizeProjectWorkspacePath(input.workspacePath);
-  await assertProjectWorkspaceDirectory(resolved);
+  const resolved = await resolveProjectWorkspaceDirectory(input.workspacePath);
  const git = await readGitCheckout(resolved);

  await prisma.space.update({
--- a/packages/testkit/src/authorization.test.ts
+++ b/packages/testkit/src/authorization.test.ts
@ -1,4 +1,4 @@
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { mkdirSync, mkdtempSync, realpathSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import path from "node:path";
 import { ComposioEmulator, LocalAgentHomeStore, teamBotWorkspaceDirectory } from "@rakazo/adapters";
@ -2213,6 +2213,100 @@ describeWithDatabase("API authorization and resource isolation", () => {
      });
    }
  });
+
+  it("lets only the deployment owner link a host folder and read its files", async () => {
+    const owner = await signup(app, `folder-owner-${stamp}@rakazo.test`, "Folder Owner");
+    const member = await signup(app, `folder-member-${stamp}@rakazo.test`, "Folder Member");
+    const ownerActor = await rpc<Actor>(app, owner, "me");
+    const settings = await handles.prisma.deploymentSettings.findUniqueOrThrow({
+      where: { id: "default" },
+      select: { ownerUserId: true },
+    });
+    await handles.prisma.deploymentSettings.update({
+      where: { id: "default" },
+      data: { ownerUserId: ownerActor.userId },
+    });
+    // Stands in for any folder the API process can read, such as its own checkout.
+    const hostFolder = realpathSync(mkdtempSync(path.join(tmpdir(), "rakazo-authz-host-")));
+    writeFileSync(path.join(hostFolder, ".env"), "HOST_SECRET=not-a-real-secret\n");
+    try {
+      await expectForbidden(app, member, "spaces/create", {
+        name: "Member folder",
+        workspacePath: hostFolder,
+      });
+      const memberNavigation = await rpc<SpaceNavigation>(app, member, "spaces/list");
+      expect(memberNavigation.spaces.map((space) => space.name)).not.toContain("Member folder");
+
+      // A space linked before only the owner could link stays closed to the member.
+      const legacy = await rpc<Space>(app, member, "spaces/create", { name: "Legacy folder" });
+      await handles.prisma.space.update({
+        where: { id: legacy.id },
+        data: { workspacePath: hostFolder },
+      });
+      const memberBot = await rpc<Bot>(
+        app,
+        member,
+        "bots/create",
+        botInput("Member Folder Reader"),
+        legacy.id,
+      );
+      await expectForbidden(
+        app,
+        member,
+        "computer/files",
+        { botId: memberBot.id, path: "project" },
+        legacy.id,
+      );
+      await expectForbidden(
+        app,
+        member,
+        "computer/readFile",
+        { botId: memberBot.id, path: "project/.env" },
+        legacy.id,
+      );
+      const legacyNavigation = await rpc<SpaceNavigation>(app, member, "spaces/list");
+      expect(legacyNavigation.spaces.find((space) => space.id === legacy.id)?.workspace).toBeNull();
+
+      const linked = await rpc<Space>(app, owner, "spaces/create", {
+        name: "Owner folder",
+        workspacePath: hostFolder,
+      });
+      expect(linked.workspace?.path).toBe(hostFolder);
+      const ownerNavigation = await rpc<SpaceNavigation>(app, owner, "spaces/list");
+      expect(ownerNavigation.spaces.find((space) => space.id === linked.id)?.workspace?.path).toBe(
+        hostFolder,
+      );
+      const ownerBot = await rpc<Bot>(
+        app,
+        owner,
+        "bots/create",
+        botInput("Owner Folder Reader"),
+        linked.id,
+      );
+      const listing = await rpc<Array<{ path: string }>>(
+        app,
+        owner,
+        "computer/files",
+        { botId: ownerBot.id, path: "project" },
+        linked.id,
+      );
+      expect(listing.map((entry) => entry.path)).toContain("project/.env");
+      const file = await rpc<{ content: string }>(
+        app,
+        owner,
+        "computer/readFile",
+        { botId: ownerBot.id, path: "project/.env" },
+        linked.id,
+      );
+      expect(file.content).toContain("HOST_SECRET");
+    } finally {
+      await handles.prisma.deploymentSettings.update({
+        where: { id: "default" },
+        data: { ownerUserId: settings.ownerUserId },
+      });
+      rmSync(hostFolder, { recursive: true, force: true });
+    }
+  });
 });

 function botInput(name: string) {