Waleed 80735b424b fix(locks): enforce workflow/folder locks on the agent + close manual-UI create gaps (#5107) ...

* fix(locks): enforce workflow/folder locks on the agent + close manual-UI create gaps

The copilot/agent workflow & folder mutation tools and the edit_workflow
tool bypassed lock enforcement, so the agent could edit a locked workflow
and move/create workflows into a locked folder. Add assertWorkflowMutable/
assertFolderMutable guards (from @sim/workflow-authz) to every agent
mutation path, mirroring the REST API.

Also close two parity gaps on the manual-UI REST side: creating a workflow
into a locked folder and creating a subfolder under a locked parent were
previously unguarded. The realtime collaborative canvas already enforced
workflow-level locks server-side.

* fix(locks): normalize optional folderId to null for assertFolderMutable

* refactor(locks): hoist constant folder-lock check out of move loop; scope test mocks with Once

* refactor(locks): drop redundant ensureWorkflowAccess fetch in rename

2026-06-16 20:28:35 -07:00

..

docs

improvement(perm-groups): allow workspace filter for permission groups (#5070)

2026-06-15 20:52:01 -07:00

realtime

fix(realtime): re-check workspace role on mutating socket events (#5080)

2026-06-16 10:50:36 -07:00

sim

fix(locks): enforce workflow/folder locks on the agent + close manual-UI create gaps (#5107)

2026-06-16 20:28:35 -07:00