fix: preserve external command attachment authority

web/workspace/tests/workdir-api.test.ts

@@ -53,7 +53,11 @@ Deno.test("Workdir REST validation accepts External grant sources without Runtim
     item: {
       working_directory_id: "external-1",
       display_name: "Session analysis",
-      source: { kind: "external_grant", grant_id: "grant-1" },
+      source: {
+        kind: "external_grant",
+        grant_id: "grant-1",
+        grant_permissions: { read: true, write: false, command: true },
+      },
       materializer_kind: "client_hosted_external",
       status: "active",
       cleanliness: "unknown",
@@ -66,6 +70,52 @@ Deno.test("Workdir REST validation accepts External grant sources without Runtim
   if (detail.item.source.kind !== "external_grant") {
     throw new Error("External Workdir source was not preserved");
   }
+  if (
+    !detail.item.source.grant_permissions.read ||
+    detail.item.source.grant_permissions.write ||
+    !detail.item.source.grant_permissions.command
+  ) {
+    throw new Error("External Workdir grant permissions were not preserved");
+  }
+});
+
+Deno.test("Workdir REST validation rejects missing or misplaced External grant permissions", () => {
+  for (
+    const source of [
+      { kind: "external_grant", grant_id: "grant-1" },
+      {
+        kind: "external_grant",
+        grant_id: "grant-1",
+        grant_permissions: { read: true, write: false, command: "yes" },
+      },
+      {
+        kind: "repository",
+        repository_key: "main",
+        grant_permissions: { read: true, write: false, command: false },
+      },
+    ]
+  ) {
+    let rejected = false;
+    try {
+      parseWorkingDirectoryDetailResponse({
+        workspace_id: "workspace-a",
+        item: {
+          working_directory_id: "invalid-1",
+          source,
+          materializer_kind: source.kind === "repository"
+            ? "runtime_git_clone"
+            : "client_hosted_external",
+          status: "active",
+        },
+        diagnostics: [],
+      });
+    } catch {
+      rejected = true;
+    }
+    if (!rejected) {
+      throw new Error(`invalid External permission projection was accepted: ${JSON.stringify(source)}`);
+    }
+  }
 });
 
 Deno.test("Workdir REST validation rejects stale response JSON", () => {

web/workspace/tests/workdir-permissions.test.ts

@@ -0,0 +1,22 @@
+declare const Deno: {
+  test(name: string, fn: () => void | Promise<void>): void;
+};
+
+import { formatWorkdirPermissions } from "../src/lib/workspace/settings/workdir-permissions.ts";
+
+Deno.test("Workdir permissions render independent categories in stable order", () => {
+  const cases = [
+    [{ read: true, write: false, command: false }, "READ"],
+    [{ read: true, write: true, command: false }, "READ · WRITE"],
+    [{ read: false, write: false, command: true }, "COMMAND"],
+    [{ read: true, write: false, command: true }, "READ · COMMAND"],
+    [{ read: true, write: true, command: true }, "READ · WRITE · COMMAND"],
+  ] as const;
+
+  for (const [permissions, expected] of cases) {
+    const actual = formatWorkdirPermissions(permissions);
+    if (actual !== expected) {
+      throw new Error(`expected ${expected}, got ${actual}`);
+    }
+  }
+});