fix: enforce hierarchical external Workdir permissions

web/workspace/tests/workdir-api.test.ts

@@ -56,7 +56,7 @@ Deno.test("Workdir REST validation accepts External grant sources without Runtim
       source: {
         kind: "external_grant",
         grant_id: "grant-1",
-        grant_permissions: { read: true, write: false, command: true },
+        grant_permissions: { read: true, write: true, command: true },
       },
       materializer_kind: "client_hosted_external",
       status: "active",
@@ -72,7 +72,7 @@ Deno.test("Workdir REST validation accepts External grant sources without Runtim
   }
   if (
     !detail.item.source.grant_permissions.read ||
-    detail.item.source.grant_permissions.write ||
+    !detail.item.source.grant_permissions.write ||
     !detail.item.source.grant_permissions.command
   ) {
     throw new Error("External Workdir grant permissions were not preserved");
@@ -83,6 +83,11 @@ Deno.test("Workdir REST validation rejects missing or misplaced External grant p
   for (
     const source of [
       { kind: "external_grant", grant_id: "grant-1" },
+      {
+        kind: "external_grant",
+        grant_id: "grant-1",
+        grant_permissions: { read: false, write: false, command: true },
+      },
       {
         kind: "external_grant",
         grant_id: "grant-1",
@@ -113,7 +118,11 @@ Deno.test("Workdir REST validation rejects missing or misplaced External grant p
       rejected = true;
     }
     if (!rejected) {
-      throw new Error(`invalid External permission projection was accepted: ${JSON.stringify(source)}`);
+      throw new Error(
+        `invalid External permission projection was accepted: ${
+          JSON.stringify(source)
+        }`,
+      );
     }
   }
 });

web/workspace/tests/workdir-permissions.test.ts

@@ -2,9 +2,12 @@ declare const Deno: {
   test(name: string, fn: () => void | Promise<void>): void;
 };
 
-import { formatWorkdirPermissions } from "../src/lib/workspace/settings/workdir-permissions.ts";
+import {
+  formatExternalGrantPermissionLevel,
+  formatWorkdirPermissions,
+} from "../src/lib/workspace/settings/workdir-permissions.ts";
 
-Deno.test("Workdir permissions render independent categories in stable order", () => {
+Deno.test("effective Workdir permissions render partial intersections without widening", () => {
   const cases = [
     [{ read: true, write: false, command: false }, "READ"],
     [{ read: true, write: true, command: false }, "READ · WRITE"],
@@ -20,3 +23,32 @@ Deno.test("Workdir permissions render independent categories in stable order", (
     }
   }
 });
+
+Deno.test("External grant levels show inherited authority and reject partial grants", () => {
+  const cases = [
+    [{ read: true, write: false, command: false }, "READ"],
+    [{ read: true, write: true, command: false }, "WRITE (includes READ)"],
+    [
+      { read: true, write: true, command: true },
+      "COMMAND (includes WRITE + READ)",
+    ],
+  ] as const;
+  for (const [permissions, expected] of cases) {
+    const actual = formatExternalGrantPermissionLevel(permissions);
+    if (actual !== expected) {
+      throw new Error(`expected ${expected}, got ${actual}`);
+    }
+  }
+
+  let rejected = false;
+  try {
+    formatExternalGrantPermissionLevel({
+      read: false,
+      write: false,
+      command: true,
+    });
+  } catch {
+    rejected = true;
+  }
+  if (!rejected) throw new Error("command-only External grant was accepted");
+});