Accept a workspace passed by name off the live list (fixes #317)

[ProfSynapse]

Fixes #317.

The bug

validateWorkspaceId tested the name and the id against different lists:

const byName = this.knownWorkspaces.find(...)        // boot-time snapshot
const byUuid = workspaces.find(w => w.id === ...)    // live listWorkspaces()

This file's own comment, three lines below, notes that the snapshot "is taken at boot and is empty whenever SQLite was not ready then" — which is exactly why #311 moved the error message to the live list. The acceptance check never moved with it.

So on the vaults #311 was written for, the guard could only ever suggest a name it had never checked for acceptance, and the rejection refuted itself:

Invalid workspace "Desenvolvedor". Closest match: "Desenvolvedor". Use one of these
exact values — do not infer a workspace name from the user's wording.

That also put the two halves of the mandatory pair in contradiction: getTools grounds the caller with the live names and instructs it to pass one verbatim, then useTools answers "do not infer a workspace name from the user's wording." An agent following the grounding perfectly was told it invented the name, and every by-name envelope stayed unusable until callers were rewritten to pass UUIDs — the opposite of what #311 introduced.

Fix

Match id or name against the live list in one pass, so acceptance and suggestion read the same source.

The snapshot fast path stays — it avoids the async lookup on vaults where the snapshot is populated — but is now documented as accept-only: a miss falls through to the live list rather than rejecting, so a stale or empty snapshot can never reject a real workspace. That asymmetry is what keeps it from becoming a second source of truth again, and there's a comment saying so.

Tests

tests/unit/EnvelopeWorkspaceValidation.test.ts, 7 cases, RED verified before the fix: the name cases failed while the id case and the legitimate rejection passed, which pins the defect to the by-name path rather than to the guard as a whole. Removing the name clause afterwards puts the same 4 back to red, confirming it is load-bearing.

Two cases beyond the reported repro:

• Archived workspace by name. The id branch matches the full list, so the name branch must too, or the two forms disagree for archived rows.
• A self-contradiction lock rather than another hand-picked case: for every live workspace, a rejection may never name that same value as its closest match. Any future divergence between the list the guard accepts from and the list it suggests from fails there, whichever direction it drifts.

That lock plus the rejection case earned their keep during this change: a dropped listWorkspaces() line mid-fix sent a ReferenceError into the enclosing catch and made the guard fail open, accepting everything. Three of the acceptance tests went green for the wrong reason; the rejection case caught it. Worth keeping in mind for this guard generally — a fail-open regression is indistinguishable from a fix if only the happy path is asserted.

Verification

tsc --noEmit clean, eslint clean, full suite 4257 passed. The single failure is the pre-existing LocalCliInstaller "namesake command earlier on PATH" case, unrelated and untouched.

Credit

Reported with an accurate diagnosis and a proposed patch by @gcp007-ops. The fix here was verified independently against the code rather than applied as given, and lands as a single combined id-or-name lookup instead of a second find.

---

Generated by Claude Code