fix(daemon): resolve an unbound project against the caller's current workspace

Every project must resolve to a workspace; when the project itself has no
binding, the workspace is the one the caller is currently acting in. There is no
other candidate.

`GET /api/projects/:id/workspace-scope` read only the persisted
`workspace_projects` row and the membership directory — never the request's
`x-od-workspace-*` identity — so a project with no row answered `unbound` for
every caller forever. `unbound` makes `projectWorkspaceScopeAuthorizesAmr` false,
which disabled the chat composer's send button for an Open Design Cloud run on
that project permanently, with nothing the user could do to clear it. #6178 wrote
user-facing copy for that state instead of fixing it (reverted in #6184).

`resolveProjectWorkspaceScopeForCaller` wraps the existing resolver instead of
branching inside it, so `resolveProjectWorkspaceScope` stays byte-identical and
the bound path is provably untouched. The fallback re-enters that resolver with a
synthetic binding naming the caller's own workspace, so the resulting
`workspaceMemberId` comes from the membership directory and never from the
request header: a caller can only select among workspaces their signed-in
identity is genuinely an active member of, and anything the directory cannot
confirm degrades back to `unbound` rather than to `unavailable` on a workspace the
project was never bound to.

Two cases keep today's behavior, both pinned by spec:

  unavailable — all three of its return sites. A project pinned to workspace X
    read by a member of Y answers X. The scope carries `workspaceMemberId`, the
    wallet that pays for the project's runs; resolving to Y would bill Y for X's
    project. Reachable because `GET /api/projects/:id` has no workspace gate, so
    a deep link or a workspace switch lands there.
  no caller identity — signed out, or a plain curl, has no current workspace to
    fall back to, and inventing one is worse than answering "none".

The fallback deliberately does not persist a binding.
`reconcileUnboundProjectBeforeMutation` was the preferred shape going in and is
wrong here: its own docblock is explicit that a passive read must not hand out
ownership just because it ran first, and this endpoint is a GET. Writing a row
from it would let whichever workspace opened the project first claim authorship
on no user intent, and would race two clients in different workspaces.

Author: lefarcen

apps/daemon/src/collab/project-workspace-scope.ts

@@ -83,3 +83,52 @@ export function resolveProjectWorkspaceScope(input: {
     context: { ...context, workspaceType: 'personal' },
   };
 }
+
+/**
+ * Resolve one project's workspace scope for a SPECIFIC caller.
+ *
+ * Every project resolves to a workspace, and when the project itself does not
+ * name one the answer is the workspace the caller is currently acting in —
+ * there is nothing else an unbound project could sensibly belong to. Answering
+ * `unbound` instead makes `projectWorkspaceScopeAuthorizesAmr` false, which
+ * disables the chat composer's send button for an AMR run on that project
+ * permanently, with nothing the user can do to clear it.
+ *
+ * A project that IS bound is resolved by {@link resolveProjectWorkspaceScope}
+ * alone and the caller's own workspace is irrelevant to it. That asymmetry is
+ * the billing-integrity rule, not an oversight: the scope carries
+ * `workspaceMemberId`, which is the wallet that pays for the project's runs, so
+ * a project pinned to workspace X read by a member of Y must answer X — or
+ * `unavailable` — and never Y.
+ *
+ * The fallback resolves THROUGH the membership directory, so the
+ * `workspaceMemberId` it hands back is always B's for that workspace and never
+ * the request header's. A caller can therefore only select among workspaces
+ * their signed-in identity is genuinely an active member of. Anything the
+ * directory cannot confirm — B unreachable, the claimed workspace not an active
+ * membership, or no caller identity at all — stays `unbound`: reporting "no
+ * workspace" is strictly better than inventing a billing subject.
+ */
+export function resolveProjectWorkspaceScopeForCaller(input: {
+  projectId: string;
+  binding: ProjectWorkspaceBinding | null | undefined;
+  directory: WorkspaceDirectoryFetchResult;
+  /** The caller's current workspace, or null when the request carries no workspace identity. */
+  callerWorkspaceId: string | null | undefined;
+}): ProjectWorkspaceScope {
+  const bound = resolveProjectWorkspaceScope(input);
+  if (bound.kind !== 'unbound') return bound;
+  const callerWorkspaceId =
+    typeof input.callerWorkspaceId === 'string' ? input.callerWorkspaceId.trim() : '';
+  if (!callerWorkspaceId) return bound;
+  const fallback = resolveProjectWorkspaceScope({
+    projectId: input.projectId,
+    // An unbound project is a private local draft. It is not shared with the
+    // team even when the workspace hosting it is one — the same `personal`
+    // visibility every other "claim this orphan into the current workspace"
+    // path writes (`ensureWorkspaceProjection`, `bindDuplicateIntoRequestWorkspace`).
+    binding: { workspaceId: callerWorkspaceId, visibility: 'personal' },
+    directory: input.directory,
+  });
+  return fallback.kind === 'personal' || fallback.kind === 'team' ? fallback : bound;
+}

apps/daemon/src/routes/project/index.ts

@@ -87,7 +87,7 @@ import {
   type WorkspaceResourceMutationCapability,
 } from '../../collab/workspace-resource-mutation.js';
 import type { WorkspaceContextProvider } from '../../collab/workspace-context.js';
-import { resolveProjectWorkspaceScope } from '../../collab/project-workspace-scope.js';
+import { resolveProjectWorkspaceScopeForCaller } from '../../collab/project-workspace-scope.js';
 import {
   authorizeCreatedProjectWorkspace,
   bindCreatedProjectToWorkspace,
@@ -3431,10 +3431,17 @@ export function registerProjectRoutes(app: Express, ctx: RegisterProjectRoutesDe
           (): WorkspaceDirectoryFetchResult => ({ ok: false, items: [] }),
         )
       : { ok: false, items: [] };
-    const scope = resolveProjectWorkspaceScope({
+    // A project with no binding of its own resolves to the workspace THIS
+    // caller is acting in, read the same sanctioned way every neighbouring
+    // handler reads it. A bound project ignores the caller entirely — see
+    // `resolveProjectWorkspaceScopeForCaller`.
+    const callerCtx = workspaceProjectContextFromRequest(req);
+    const scope = resolveProjectWorkspaceScopeForCaller({
       projectId: project.id,
       binding,
       directory,
+      callerWorkspaceId:
+        callerCtx === null || callerCtx === 'missing' ? null : callerCtx.workspaceId,
     });
     /** @type {import('@open-design/contracts').ProjectWorkspaceScopeResponse} */
     const body = { scope };

apps/daemon/tests/collab/project-workspace-scope.test.ts

@@ -1,6 +1,9 @@
 import { describe, expect, it } from 'vitest';
 
-import { resolveProjectWorkspaceScope } from '../../src/collab/project-workspace-scope.js';
+import {
+  resolveProjectWorkspaceScope,
+  resolveProjectWorkspaceScopeForCaller,
+} from '../../src/collab/project-workspace-scope.js';
 
 const directoryItems = [
   {
@@ -137,3 +140,120 @@ describe('resolveProjectWorkspaceScope', () => {
     });
   });
 });
+
+describe('resolveProjectWorkspaceScopeForCaller', () => {
+  it('resolves an unbound project against the caller current workspace', () => {
+    const scope = resolveProjectWorkspaceScopeForCaller({
+      projectId: 'project-unbound',
+      binding: null,
+      directory: { ok: true, items: directoryItems },
+      callerWorkspaceId: 'workspace-b',
+    });
+
+    expect(scope).toMatchObject({
+      kind: 'team',
+      projectId: 'project-unbound',
+      workspaceId: 'workspace-b',
+      // An unbound project is a private local draft even inside a team.
+      visibility: 'personal',
+      context: {
+        workspaceId: 'workspace-b',
+        workspaceType: 'team',
+        workspaceMemberId: 'member-b',
+      },
+    });
+  });
+
+  it('never lets the caller workspace override a project already pinned elsewhere', () => {
+    const scope = resolveProjectWorkspaceScopeForCaller({
+      projectId: 'project-pinned',
+      binding: { workspaceId: 'workspace-gone', visibility: 'team' },
+      directory: { ok: true, items: directoryItems },
+      callerWorkspaceId: 'workspace-b',
+    });
+
+    // `workspaceMemberId` is the billing subject, so borrowing the caller's
+    // would bill their wallet for another workspace's project.
+    expect(scope).toEqual({
+      kind: 'unavailable',
+      projectId: 'project-pinned',
+      workspaceId: 'workspace-gone',
+      visibility: 'team',
+      context: null,
+    });
+  });
+
+  it('leaves a pinned project unavailable when the directory could not be read either', () => {
+    const scope = resolveProjectWorkspaceScopeForCaller({
+      projectId: 'project-pinned',
+      binding: { workspaceId: 'workspace-b', visibility: 'personal' },
+      directory: { ok: false, items: [] },
+      callerWorkspaceId: 'workspace-b',
+    });
+
+    // The caller names the very workspace the project is pinned to, but nothing
+    // confirmed it. `unavailable` keeps its exact pre-existing behavior; the
+    // caller's claim is not a substitute for the membership directory.
+    expect(scope).toEqual({
+      kind: 'unavailable',
+      projectId: 'project-pinned',
+      workspaceId: 'workspace-b',
+      visibility: 'personal',
+      context: null,
+    });
+  });
+
+  it('keeps an unbound project unbound when the caller has no workspace identity', () => {
+    const scope = resolveProjectWorkspaceScopeForCaller({
+      projectId: 'project-anonymous',
+      binding: null,
+      directory: { ok: true, items: directoryItems },
+      callerWorkspaceId: null,
+    });
+
+    expect(scope).toEqual({
+      kind: 'unbound',
+      projectId: 'project-anonymous',
+      workspaceId: null,
+      context: null,
+    });
+  });
+
+  it('keeps an unbound project unbound when the claimed workspace is not an active membership', () => {
+    const unconfirmed = resolveProjectWorkspaceScopeForCaller({
+      projectId: 'project-unconfirmed',
+      binding: null,
+      directory: { ok: true, items: directoryItems },
+      callerWorkspaceId: 'workspace-not-mine',
+    });
+    const outage = resolveProjectWorkspaceScopeForCaller({
+      projectId: 'project-outage',
+      binding: null,
+      directory: { ok: false, items: [] },
+      callerWorkspaceId: 'workspace-b',
+    });
+
+    // The fallback resolves THROUGH the directory, so the member id it returns
+    // is always B's and never the request header's. An unconfirmable claim must
+    // degrade to "no workspace", never to `unavailable` on a workspace the
+    // project was never bound to.
+    expect(unconfirmed.kind).toBe('unbound');
+    expect(unconfirmed.workspaceId).toBeNull();
+    expect(outage.kind).toBe('unbound');
+    expect(outage.workspaceId).toBeNull();
+  });
+
+  it('keeps an unbound project unbound when the caller membership is revoked', () => {
+    const scope = resolveProjectWorkspaceScopeForCaller({
+      projectId: 'project-revoked',
+      binding: null,
+      directory: {
+        ok: true,
+        items: [{ ...directoryItems[0]!, memberStatus: 'removed' as const }],
+      },
+      callerWorkspaceId: 'workspace-b',
+    });
+
+    expect(scope.kind).toBe('unbound');
+  });
+});