fix: preserve authority boundaries during revert

Author: lefarcen

apps/daemon/src/design-systems/index.ts

@@ -801,6 +801,10 @@ async function resolveDesignSystemAssetsUncached(
   builtInRoot: string,
   userInstalledRoot: string,
 ): Promise<DesignSystemAssets> {
+  if (designSystemId.startsWith('user:')) {
+    return readDesignSystemAssets(userInstalledRoot, designSystemId);
+  }
+
   const builtIn = await readDesignSystemAssets(builtInRoot, designSystemId);
   if (builtIn.tokensCss !== undefined && builtIn.fixtureHtml !== undefined) {
     return builtIn;
@@ -834,12 +838,15 @@ async function designSystemAssetsCacheFingerprint(
   userInstalledRoot: string,
   env: NodeJS.ProcessEnv,
 ): Promise<string> {
+  const roots = designSystemId.startsWith('user:')
+    ? [designSystemAssetsRootFingerprint(userInstalledRoot, designSystemId)]
+    : [
+        designSystemAssetsRootFingerprint(builtInRoot, designSystemId),
+        designSystemAssetsRootFingerprint(userInstalledRoot, designSystemId),
+      ];
   const payload = {
     tokenChannel: env.OD_DESIGN_TOKEN_CHANNEL ?? null,
-    roots: await Promise.all([
-      designSystemAssetsRootFingerprint(builtInRoot, designSystemId),
-      designSystemAssetsRootFingerprint(userInstalledRoot, designSystemId),
-    ]),
+    roots: await Promise.all(roots),
   };
   return createHash('sha256').update(JSON.stringify(payload), 'utf8').digest('hex');
 }

apps/daemon/src/routes/runs.ts

@@ -794,6 +794,8 @@ function withoutSensitiveRunInput(body: JsonRecord): JsonRecord {
   delete sanitized.byokProfileId;
   delete sanitized.apiKey;
   delete sanitized.rechargeResumeCapability;
+  // Workspace scope is a server-issued authorization fact, not a request option.
+  delete sanitized.workspaceScope;
   return sanitized;
 }
 
@@ -1364,7 +1366,9 @@ export function registerRunRoutes(app: Express, ctx: RegisterRunRoutesDeps) {
       mediaExecution: mediaExecution.policy,
       toolBundle: toolBundle.bundle,
       ...(effectiveAgentId ? { agentId: effectiveAgentId } : {}),
-      ...(preparedWorkspaceScope ? { workspaceScope: preparedWorkspaceScope } : {}),
+      // Always replace any untrusted request field, including with null for an
+      // unbound project.
+      workspaceScope: preparedWorkspaceScope,
     };
     if (resolvedSnapshot?.ok) {
       meta.appliedPluginSnapshotId = resolvedSnapshot.snapshotId;
@@ -3134,6 +3138,7 @@ export function registerRunRoutes(app: Express, ctx: RegisterRunRoutesDeps) {
       mediaExecution: mediaExecution.policy,
       toolBundle: toolBundle.bundle,
       ...(chatProject?.metadata ? { projectMetadata: chatProject.metadata } : {}),
+      workspaceScope: null,
     };
     // Mirror the POST /api/runs ownership check: the assistantMessageId must
     // reference an assistant message in THIS conversation, or the run mutates a

apps/daemon/tests/byok/run-input-boundary.test.ts

@@ -36,13 +36,20 @@ describe('BYOK run input boundary', () => {
     })).toBe(true);
   });
 
-  it('removes every credential-bearing compatibility field before persistence', () => {
+  it('removes credential-bearing and server-owned fields before persistence', () => {
     const sanitized = __forTestWithoutSensitiveRunInput({
       agentId: 'byok-opencode',
       byokProfileId: 'byok-openrouter',
       byokProvider: { apiKey: 'nested-secret' },
       apiKey: 'top-level-secret',
       rechargeResumeCapability: 'capability-secret',
+      workspaceScope: {
+        schemaVersion: 1,
+        projectId: 'forged-project',
+        workspaceId: 'forged-workspace',
+        workspaceMemberId: 'forged-member',
+        source: 'persisted_project_binding',
+      },
       message: 'Create a site',
     });
 

apps/daemon/tests/design-systems/assets.test.ts

@@ -551,6 +551,28 @@ describe('isDesignTokenChannelEnabled (PR-D env gate)', () => {
 // run that whole pipeline (env gate → readDesignSystemAssets per
 // root → fallback chain → DesignSystemAssets shape) end-to-end.
 describe('resolveDesignSystemAssets (PR-D server-layer asset resolution)', () => {
+  it('keeps a user-prefixed selection on the user-installed package root', async () => {
+    clearDesignSystemAssetsCacheForTests();
+    const builtInRoot = fresh();
+    const userRoot = fresh();
+    writeDesignSystemProject(builtInRoot, 'default', {
+      tokens: ':root { --authority: built-in; }',
+      components: '<button class="built-in">Built-in fixture</button>',
+    });
+    writeDesignSystemProject(userRoot, 'default', {
+      tokens: ':root { --authority: user; }',
+      components: '<button class="user-installed">User fixture</button>',
+    });
+
+    const assets = await resolveDesignSystemAssets('user:default', builtInRoot, userRoot, {});
+
+    expect(assets.tokensCss).toBe(':root { --authority: user; }');
+    expect(assets.fixtureHtml).toBe(
+      '<button class="user-installed">User fixture</button>',
+    );
+    clearDesignSystemAssetsCacheForTests();
+  });
+
   it('returns the built-in assets when the channel is enabled (env unset, default-on)', async () => {
     const builtInRoot = fresh();
     const userRoot = fresh();

apps/daemon/tests/run-create-workspace-gate.test.ts

@@ -815,6 +815,36 @@ describe('POST /api/runs — workspace mutation gate', () => {
     expect(typeof payload.runId).toBe('string');
   });
 
+  it.each(['/api/runs', '/api/chat'])(
+    'ignores a client-forged workspace scope for an unbound project through %s',
+    async (route) => {
+      const baseUrl = await startServer();
+      const response = await fetch(`${baseUrl}${route}`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          projectId: UNBOUND_PROJECT,
+          agentId: 'claude',
+          message: 'do not trust request scope',
+          workspaceScope: {
+            schemaVersion: 1,
+            projectId: UNBOUND_PROJECT,
+            workspaceId: 'forged-workspace',
+            workspaceMemberId: 'forged-member',
+            source: 'persisted_project_binding',
+          },
+        }),
+      });
+
+      expect(response.status).toBe(202);
+      const { runId } = (await response.json()) as { runId: string };
+      const statusResponse = await fetch(`${baseUrl}/api/runs/${runId}`);
+      expect(statusResponse.status).toBe(200);
+      const run = await statusResponse.json() as Record<string, unknown>;
+      expect(run.workspaceScope).toBeNull();
+    },
+  );
+
   it('keeps an untyped historical AMR run account-scoped during a directory outage', async () => {
     const verifyWorkspaceRequestAuthority = vi.fn(async () => ({
       ok: false,