[LinuxDevil]

Why

P1.5: the runtime enforces the workspace policy, already narrowed by the host ceiling. A page cannot get past workspace security through its harness, page.json or agents.json.

Changes

• src/workspaces/runtime/policy.ts:
  • effectiveToolset returns agentTools ∩ host registry ∩ policy.tools.allow ∩ (attachment.tools.only ?? all). Tools come only from the host HostToolRegistry, matched by name, and workspace .ts files are never imported. An agent tool with no matching host tool is reported as a warning.
  • effectivePermissions orders rules so a ceiling or workspace deny or ask always beats an agent allow. An agent allow that a policy rule shadows produces a warning at load.
  • Secrets: a tool gets only the secrets the policy lists and that the tool itself declares.
  • Network and sandbox: the agent can only tighten them.
  • approvals.require turns into an enforced approval, which also applies in workflow toolCall steps through flowToolGate.
  • agentPolicyOptions builds the createAgent options for an attachment or the main agent. pagePolicy fails page start with LOUSHO_WORKSPACE_CAPABILITY_MISSING (capability-missing).
• alwaysAsk in src/execution/permissions.ts is now shared with registryEnforce.ts, so the enforced-approval wrapper is no longer duplicated.
• Follow-ups from feat(workspaces): resolve agent references for each page #1058:
  • A tool's name is its file stem. Studio { file } tool refs now use the stem and fill toolFiles.
  • Studio keys that a workspace agent never runs are refused: mcpServers, guardrails, subagents, handoffs, triggers, flow. So are the folders subagents/, schedules/ and channels/.
  • A skills and memory parity fixture (note-keeper) is added.
• Adds the error code LOUSHO_WORKSPACE_CAPABILITY_MISSING, plus updates to docs/errors.md and docs/workspaces.md and regenerated api reports.

Testing

• npx vitest run src/workspaces passes, including the ticket's six tests and a grep test checking that no code under src/workspaces/runtime builds a toolset without effectiveToolset.
• typecheck, typecheck:tests, lint, api:check, docs:llms:check and the docs ratchet (1649 ≤ 1724) pass.
• I ran the full vitest suite without the cf-cron tests. Every failure is in a file this PR does not touch: create-lousho index (3) and NodeWorkspace symlink/shell (4) fail the same way on origin/main locally. The create-lousho template e2e tests need a local pack and install. devSpecTriggers failed under full load and passes on its own.

🤖 Generated with Claude Code