Function guardOrgWrite

packages/core/sdk/src/executor.ts:1955–1962

(owner?: Owner)

    // operational org-row writes (token refresh, tool-catalog re-sync) must
    // keep working for a denied member.
    const guardOrgWrite = (owner?: Owner): Effect.Effect<void, OrgWriteDeniedError> =>
      Effect.gen(function* () {
        const access =
          config.orgWrites === "request" ? yield* currentOrgWriteAccess : config.orgWrites;
        if (access === "denied" && (owner === undefined || owner === "org")) {
          return yield* new OrgWriteDeniedError();
        }
      });

    // Built-in core-tools plugin: agent-facing static tools over the v2 surface.
    const plugins: readonly AnyPlugin[] = config.coreTools