fix: enforce hierarchical external Workdir permissions

web/workspace/tests/workdir-permissions.test.ts

@@ -2,9 +2,12 @@ declare const Deno: {
   test(name: string, fn: () => void | Promise<void>): void;
 };
 
-import { formatWorkdirPermissions } from "../src/lib/workspace/settings/workdir-permissions.ts";
+import {
+  formatExternalGrantPermissionLevel,
+  formatWorkdirPermissions,
+} from "../src/lib/workspace/settings/workdir-permissions.ts";
 
-Deno.test("Workdir permissions render independent categories in stable order", () => {
+Deno.test("effective Workdir permissions render partial intersections without widening", () => {
   const cases = [
     [{ read: true, write: false, command: false }, "READ"],
     [{ read: true, write: true, command: false }, "READ · WRITE"],
@@ -20,3 +23,32 @@ Deno.test("Workdir permissions render independent categories in stable order", (
     }
   }
 });
+
+Deno.test("External grant levels show inherited authority and reject partial grants", () => {
+  const cases = [
+    [{ read: true, write: false, command: false }, "READ"],
+    [{ read: true, write: true, command: false }, "WRITE (includes READ)"],
+    [
+      { read: true, write: true, command: true },
+      "COMMAND (includes WRITE + READ)",
+    ],
+  ] as const;
+  for (const [permissions, expected] of cases) {
+    const actual = formatExternalGrantPermissionLevel(permissions);
+    if (actual !== expected) {
+      throw new Error(`expected ${expected}, got ${actual}`);
+    }
+  }
+
+  let rejected = false;
+  try {
+    formatExternalGrantPermissionLevel({
+      read: false,
+      write: false,
+      command: true,
+    });
+  } catch {
+    rejected = true;
+  }
+  if (!rejected) throw new Error("command-only External grant was accepted");
+});