Function getWorkspaceId

src/gep/paths.js:421–500

()

}

function getWorkspaceId() {
  if (process.env.EVOLVER_WORKSPACE_ID) return String(process.env.EVOLVER_WORKSPACE_ID);
  const workspaceRoot = getWorkspaceRoot();
  const dir = path.join(workspaceRoot, '.evolver');
  const file = path.join(dir, 'workspace-id');

  let mode = 'off';
  let keychain = null;
  try {
    keychain = require('./workspaceKeychain');
    mode = keychain.getMode();
  } catch {
    // workspaceKeychain.js missing — degrade silently to FS-only.
    mode = 'off';
  }

  if (mode !== 'off' && keychain) {
    const addonAvailable = keychain.loadAddon() !== null;
    if (mode === 'force' && !addonAvailable) {
      throw new Error(
        'EVOLVER_WORKSPACE_KEYCHAIN=force but @napi-rs/keyring is not installed. ' +
        'Install it (`npm i @napi-rs/keyring`) or set EVOLVER_WORKSPACE_KEYCHAIN=auto/off.'
      );
    }
    if (addonAvailable) {
      const hit = keychain.readFromKeychain(workspaceRoot);
      if (hit.available && hit.id) return hit.id;

      // `force` must NEVER fall back to FS read/write — that would
      // silently re-introduce same-uid plaintext exposure of the
      // workspace secret, which is exactly what `force` exists to
      // prevent (Bugbot PR #121 round-2 MEDIUM Agentic Security).
      // Generate a fresh id and write it ONLY to the keychain; if
      // that write fails, throw rather than mirror to FS.
      if (mode === 'force') {
        if (hit.available) {
          // Keychain reachable but empty — mint and write keychain-only.
          const newId = require('crypto').randomBytes(16).toString('hex');
          if (!keychain.writeToKeychain(workspaceRoot, newId)) {
            throw new Error(
              'EVOLVER_WORKSPACE_KEYCHAIN=force: keychain write failed; ' +
              'refusing to fall back to filesystem secret.'
            );
          }
          return newId;
        }
        // Addon loaded but read claims unavailable (e.g. locked
        // keyring on Linux, no D-Bus session). Refuse rather than
        // silently degrade.
        throw new Error(
          'EVOLVER_WORKSPACE_KEYCHAIN=force: keychain reports unavailable ' +
          '(locked keyring / no session?); refusing to fall back to filesystem.'
        );
      }

      // mode === 'auto', keychain miss — try to migrate an existing
      // FS secret in.
      const fsId = _readWorkspaceIdFromFs(file);