Add server-side workspaceRoot uniqueness invariant

[jonsing]

Duplicate workspaceRoot detection previously only happened client-side in Sidebar.tsx. This adds a server-side invariant in the orchestration decider that rejects project.create and project.meta.update commands when the target workspaceRoot is already used by another non-deleted project. Soft-deleted projects are excluded from the check. Reason for this change is reported bug #1595

What Changed

In total 46 additions, the additional 198 additions are test code.

Adds a helper function in apps/server/src/orchestration/commandInvariants.ts to easily find existing projects given a workspaceRoot. Only used within requireWorkspaceRootUnique function so one could argue that this is unnecessary abstraction at this point, happy to change this to be inline.

exportfunctionfindProjectByWorkspaceRoot(readModel: OrchestrationReadModel,workspaceRoot: string,): OrchestrationProject|undefined{returnreadModel.projects.find((project)=>project.workspaceRoot===workspaceRoot&&project.deletedAt===null,);}

Adds a function that check if there is already a project with the workspaceRoot property persited. If so return a Effect.fail else void.

exportfunctionrequireWorkspaceRootUnique(input: {readonlyreadModel: OrchestrationReadModel;readonlycommand: OrchestrationCommand;readonlyworkspaceRoot: string;readonlyexcludeProjectId?: ProjectId;}): Effect.Effect<void,OrchestrationCommandInvariantError>{constexisting=findProjectByWorkspaceRoot(input.readModel,input.workspaceRoot);if(!existing||existing.id===input.excludeProjectId){returnEffect.void;}returnEffect.fail(invariantError(input.command.type,`Workspace root '${input.workspaceRoot}' is already used by project '${existing.id}'.`,),);}

In the apps/server/src/orchestration/decider.ts code I imported the new requireWorkspaceRootUnique function and used it inside the project.create and project.meta.update case handlers to verify that project with same workspaceRoot does not already exist.

Added relevant new test to assert the checks are working as intended. All existing test pass after change.

Why

Server code should have the same validations as the client code has to avoid duplicate project creation (same workspaceRoot) in the db. Either this check should be done in the two handlers changed in this PR or the db schema should enforce the workspaceRoot to be unique.

I would argue that this is a good first step to avoid the issue expressed in #1595 to occur and then if the db should enforce this (which is a much bigger change) db migrations would most likely be added to handle "bad" client state.

UI Changes

No UI changes have been made.

Checklist

• This PR is small and focused
• I explained what changed and why

---

Note

Medium Risk
Adds new server-side validation that can cause project.create and project.meta.update commands to start failing for previously-allowed duplicate workspaceRoot values; impact is limited to orchestration command handling and covered by new tests.

Overview
Enforces server-side uniqueness of workspaceRoot across active projects. The orchestration decider now rejects project.create and project.meta.update (when changing workspaceRoot) if the path is already used by another non-deleted project.

Adds findProjectByWorkspaceRoot/requireWorkspaceRootUnique invariants (including an excludeProjectId self-update case) and expands unit/integration tests to cover conflicts, soft-deleted projects, and edge cases with pre-existing duplicates.

^{Written by Cursor Bugbot for commit 983f1bb. This will update automatically on new commits. Configure here.}

Note

Add server-side uniqueness invariant for workspaceRoot on project create and update

• Adds requireWorkspaceRootUnique in commandInvariants.ts that scans non-deleted projects and rejects with an OrchestrationCommandInvariantError if the given workspaceRoot is already in use.
• Integrates the check into decider.ts for both project.create and project.meta.update; the update path excludes the current project from the check to allow self-retention.
• Also adds findProjectByWorkspaceRoot, a helper that returns the first non-deleted project matching a given path.
• Behavioral Change: project.create and project.meta.update commands now fail with an invariant error when another non-deleted project already uses the requested workspaceRoot.

^{Macroscope summarized 983f1bb.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 10214698-3ce3-451f-abdf-84331018293d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[cursor]

Unused helper duplicates workspace lookup logic

Low Severity

findProjectByWorkspaceRoot is exported but not used by runtime code, and requireWorkspaceRootUnique reimplements the same workspaceRoot lookup inline. This creates dead API surface and duplicated logic in commandInvariants.ts, increasing the chance these checks drift apart later.

Additional Locations (1)

• apps/server/src/orchestration/commandInvariants.ts#L48-L54

[juliusmarminge]

Closing as superseded by merged PR #3829, which landed the current workspace-root uniqueness behavior.

[jonsing]

Duplicate workspaceRoot detection previously only happened client-side in Sidebar.tsx. This adds a server-side invariant in the orchestration decider that rejects project.create and project.meta.update commands when the target workspaceRoot is already used by another non-deleted project. Soft-deleted projects are excluded from the check. Reason for this change is reported bug #1595

What Changed

In total 46 additions, the additional 198 additions are test code.

Adds a helper function in apps/server/src/orchestration/commandInvariants.ts to easily find existing projects given a workspaceRoot. Only used within requireWorkspaceRootUnique function so one could argue that this is unnecessary abstraction at this point, happy to change this to be inline.

exportfunctionfindProjectByWorkspaceRoot(readModel: OrchestrationReadModel,workspaceRoot: string,): OrchestrationProject|undefined{returnreadModel.projects.find((project)=>project.workspaceRoot===workspaceRoot&&project.deletedAt===null,);}

Adds a function that check if there is already a project with the workspaceRoot property persited. If so return a Effect.fail else void.

exportfunctionrequireWorkspaceRootUnique(input: {readonlyreadModel: OrchestrationReadModel;readonlycommand: OrchestrationCommand;readonlyworkspaceRoot: string;readonlyexcludeProjectId?: ProjectId;}): Effect.Effect<void,OrchestrationCommandInvariantError>{constexisting=findProjectByWorkspaceRoot(input.readModel,input.workspaceRoot);if(!existing||existing.id===input.excludeProjectId){returnEffect.void;}returnEffect.fail(invariantError(input.command.type,`Workspace root '${input.workspaceRoot}' is already used by project '${existing.id}'.`,),);}

In the apps/server/src/orchestration/decider.ts code I imported the new requireWorkspaceRootUnique function and used it inside the project.create and project.meta.update case handlers to verify that project with same workspaceRoot does not already exist.

Added relevant new test to assert the checks are working as intended. All existing test pass after change.

Why

Server code should have the same validations as the client code has to avoid duplicate project creation (same workspaceRoot) in the db. Either this check should be done in the two handlers changed in this PR or the db schema should enforce the workspaceRoot to be unique.

I would argue that this is a good first step to avoid the issue expressed in #1595 to occur and then if the db should enforce this (which is a much bigger change) db migrations would most likely be added to handle "bad" client state.

UI Changes

No UI changes have been made.

Checklist

• This PR is small and focused
• I explained what changed and why

---

Note

Medium Risk
Adds new server-side validation that can cause project.create and project.meta.update commands to start failing for previously-allowed duplicate workspaceRoot values; impact is limited to orchestration command handling and covered by new tests.

Overview
Enforces server-side uniqueness of workspaceRoot across active projects. The orchestration decider now rejects project.create and project.meta.update (when changing workspaceRoot) if the path is already used by another non-deleted project.

Adds findProjectByWorkspaceRoot/requireWorkspaceRootUnique invariants (including an excludeProjectId self-update case) and expands unit/integration tests to cover conflicts, soft-deleted projects, and edge cases with pre-existing duplicates.

^{Written by Cursor Bugbot for commit 983f1bb. This will update automatically on new commits. Configure here.}

Note

Add server-side uniqueness invariant for workspaceRoot on project create and update

• Adds requireWorkspaceRootUnique in commandInvariants.ts that scans non-deleted projects and rejects with an OrchestrationCommandInvariantError if the given workspaceRoot is already in use.
• Integrates the check into decider.ts for both project.create and project.meta.update; the update path excludes the current project from the check to allow self-retention.
• Also adds findProjectByWorkspaceRoot, a helper that returns the first non-deleted project matching a given path.
• Behavioral Change: project.create and project.meta.update commands now fail with an invariant error when another non-deleted project already uses the requested workspaceRoot.

^{Macroscope summarized 983f1bb.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 10214698-3ce3-451f-abdf-84331018293d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[cursor]

Unused helper duplicates workspace lookup logic

Low Severity

findProjectByWorkspaceRoot is exported but not used by runtime code, and requireWorkspaceRootUnique reimplements the same workspaceRoot lookup inline. This creates dead API surface and duplicated logic in commandInvariants.ts, increasing the chance these checks drift apart later.

Additional Locations (1)

• apps/server/src/orchestration/commandInvariants.ts#L48-L54

[juliusmarminge]

Closing as superseded by merged PR #3829, which landed the current workspace-root uniqueness behavior.

[jonsing]

Duplicate workspaceRoot detection previously only happened client-side in Sidebar.tsx. This adds a server-side invariant in the orchestration decider that rejects project.create and project.meta.update commands when the target workspaceRoot is already used by another non-deleted project. Soft-deleted projects are excluded from the check. Reason for this change is reported bug #1595

What Changed

In total 46 additions, the additional 198 additions are test code.

Adds a helper function in apps/server/src/orchestration/commandInvariants.ts to easily find existing projects given a workspaceRoot. Only used within requireWorkspaceRootUnique function so one could argue that this is unnecessary abstraction at this point, happy to change this to be inline.

exportfunctionfindProjectByWorkspaceRoot(readModel: OrchestrationReadModel,workspaceRoot: string,): OrchestrationProject|undefined{returnreadModel.projects.find((project)=>project.workspaceRoot===workspaceRoot&&project.deletedAt===null,);}

Adds a function that check if there is already a project with the workspaceRoot property persited. If so return a Effect.fail else void.

exportfunctionrequireWorkspaceRootUnique(input: {readonlyreadModel: OrchestrationReadModel;readonlycommand: OrchestrationCommand;readonlyworkspaceRoot: string;readonlyexcludeProjectId?: ProjectId;}): Effect.Effect<void,OrchestrationCommandInvariantError>{constexisting=findProjectByWorkspaceRoot(input.readModel,input.workspaceRoot);if(!existing||existing.id===input.excludeProjectId){returnEffect.void;}returnEffect.fail(invariantError(input.command.type,`Workspace root '${input.workspaceRoot}' is already used by project '${existing.id}'.`,),);}

In the apps/server/src/orchestration/decider.ts code I imported the new requireWorkspaceRootUnique function and used it inside the project.create and project.meta.update case handlers to verify that project with same workspaceRoot does not already exist.

Added relevant new test to assert the checks are working as intended. All existing test pass after change.

Why

Server code should have the same validations as the client code has to avoid duplicate project creation (same workspaceRoot) in the db. Either this check should be done in the two handlers changed in this PR or the db schema should enforce the workspaceRoot to be unique.

I would argue that this is a good first step to avoid the issue expressed in #1595 to occur and then if the db should enforce this (which is a much bigger change) db migrations would most likely be added to handle "bad" client state.

UI Changes

No UI changes have been made.

Checklist

• This PR is small and focused
• I explained what changed and why

---

Note

Medium Risk
Adds new server-side validation that can cause project.create and project.meta.update commands to start failing for previously-allowed duplicate workspaceRoot values; impact is limited to orchestration command handling and covered by new tests.

Overview
Enforces server-side uniqueness of workspaceRoot across active projects. The orchestration decider now rejects project.create and project.meta.update (when changing workspaceRoot) if the path is already used by another non-deleted project.

Adds findProjectByWorkspaceRoot/requireWorkspaceRootUnique invariants (including an excludeProjectId self-update case) and expands unit/integration tests to cover conflicts, soft-deleted projects, and edge cases with pre-existing duplicates.

^{Written by Cursor Bugbot for commit 983f1bb. This will update automatically on new commits. Configure here.}

Note

Add server-side uniqueness invariant for workspaceRoot on project create and update

• Adds requireWorkspaceRootUnique in commandInvariants.ts that scans non-deleted projects and rejects with an OrchestrationCommandInvariantError if the given workspaceRoot is already in use.
• Integrates the check into decider.ts for both project.create and project.meta.update; the update path excludes the current project from the check to allow self-retention.
• Also adds findProjectByWorkspaceRoot, a helper that returns the first non-deleted project matching a given path.
• Behavioral Change: project.create and project.meta.update commands now fail with an invariant error when another non-deleted project already uses the requested workspaceRoot.

^{Macroscope summarized 983f1bb.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 10214698-3ce3-451f-abdf-84331018293d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[cursor]

Unused helper duplicates workspace lookup logic

Low Severity

findProjectByWorkspaceRoot is exported but not used by runtime code, and requireWorkspaceRootUnique reimplements the same workspaceRoot lookup inline. This creates dead API surface and duplicated logic in commandInvariants.ts, increasing the chance these checks drift apart later.

Additional Locations (1)

• apps/server/src/orchestration/commandInvariants.ts#L48-L54

[juliusmarminge]

Closing as superseded by merged PR #3829, which landed the current workspace-root uniqueness behavior.

[jonsing]

Duplicate workspaceRoot detection previously only happened client-side in Sidebar.tsx. This adds a server-side invariant in the orchestration decider that rejects project.create and project.meta.update commands when the target workspaceRoot is already used by another non-deleted project. Soft-deleted projects are excluded from the check. Reason for this change is reported bug #1595

What Changed

In total 46 additions, the additional 198 additions are test code.

Adds a helper function in apps/server/src/orchestration/commandInvariants.ts to easily find existing projects given a workspaceRoot. Only used within requireWorkspaceRootUnique function so one could argue that this is unnecessary abstraction at this point, happy to change this to be inline.

exportfunctionfindProjectByWorkspaceRoot(readModel: OrchestrationReadModel,workspaceRoot: string,): OrchestrationProject|undefined{returnreadModel.projects.find((project)=>project.workspaceRoot===workspaceRoot&&project.deletedAt===null,);}

Adds a function that check if there is already a project with the workspaceRoot property persited. If so return a Effect.fail else void.

exportfunctionrequireWorkspaceRootUnique(input: {readonlyreadModel: OrchestrationReadModel;readonlycommand: OrchestrationCommand;readonlyworkspaceRoot: string;readonlyexcludeProjectId?: ProjectId;}): Effect.Effect<void,OrchestrationCommandInvariantError>{constexisting=findProjectByWorkspaceRoot(input.readModel,input.workspaceRoot);if(!existing||existing.id===input.excludeProjectId){returnEffect.void;}returnEffect.fail(invariantError(input.command.type,`Workspace root '${input.workspaceRoot}' is already used by project '${existing.id}'.`,),);}

In the apps/server/src/orchestration/decider.ts code I imported the new requireWorkspaceRootUnique function and used it inside the project.create and project.meta.update case handlers to verify that project with same workspaceRoot does not already exist.

Added relevant new test to assert the checks are working as intended. All existing test pass after change.

Why

Server code should have the same validations as the client code has to avoid duplicate project creation (same workspaceRoot) in the db. Either this check should be done in the two handlers changed in this PR or the db schema should enforce the workspaceRoot to be unique.

I would argue that this is a good first step to avoid the issue expressed in #1595 to occur and then if the db should enforce this (which is a much bigger change) db migrations would most likely be added to handle "bad" client state.

UI Changes

No UI changes have been made.

Checklist

• This PR is small and focused
• I explained what changed and why

---

Note

Medium Risk
Adds new server-side validation that can cause project.create and project.meta.update commands to start failing for previously-allowed duplicate workspaceRoot values; impact is limited to orchestration command handling and covered by new tests.

Overview
Enforces server-side uniqueness of workspaceRoot across active projects. The orchestration decider now rejects project.create and project.meta.update (when changing workspaceRoot) if the path is already used by another non-deleted project.

Adds findProjectByWorkspaceRoot/requireWorkspaceRootUnique invariants (including an excludeProjectId self-update case) and expands unit/integration tests to cover conflicts, soft-deleted projects, and edge cases with pre-existing duplicates.

^{Written by Cursor Bugbot for commit 983f1bb. This will update automatically on new commits. Configure here.}

Note

Add server-side uniqueness invariant for workspaceRoot on project create and update

• Adds requireWorkspaceRootUnique in commandInvariants.ts that scans non-deleted projects and rejects with an OrchestrationCommandInvariantError if the given workspaceRoot is already in use.
• Integrates the check into decider.ts for both project.create and project.meta.update; the update path excludes the current project from the check to allow self-retention.
• Also adds findProjectByWorkspaceRoot, a helper that returns the first non-deleted project matching a given path.
• Behavioral Change: project.create and project.meta.update commands now fail with an invariant error when another non-deleted project already uses the requested workspaceRoot.

^{Macroscope summarized 983f1bb.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 10214698-3ce3-451f-abdf-84331018293d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[cursor]

Unused helper duplicates workspace lookup logic

Low Severity

findProjectByWorkspaceRoot is exported but not used by runtime code, and requireWorkspaceRootUnique reimplements the same workspaceRoot lookup inline. This creates dead API surface and duplicated logic in commandInvariants.ts, increasing the chance these checks drift apart later.

Additional Locations (1)

• apps/server/src/orchestration/commandInvariants.ts#L48-L54

[juliusmarminge]

Closing as superseded by merged PR #3829, which landed the current workspace-root uniqueness behavior.

[jonsing]

Duplicate workspaceRoot detection previously only happened client-side in Sidebar.tsx. This adds a server-side invariant in the orchestration decider that rejects project.create and project.meta.update commands when the target workspaceRoot is already used by another non-deleted project. Soft-deleted projects are excluded from the check. Reason for this change is reported bug #1595

What Changed

In total 46 additions, the additional 198 additions are test code.

Adds a helper function in apps/server/src/orchestration/commandInvariants.ts to easily find existing projects given a workspaceRoot. Only used within requireWorkspaceRootUnique function so one could argue that this is unnecessary abstraction at this point, happy to change this to be inline.

exportfunctionfindProjectByWorkspaceRoot(readModel: OrchestrationReadModel,workspaceRoot: string,): OrchestrationProject|undefined{returnreadModel.projects.find((project)=>project.workspaceRoot===workspaceRoot&&project.deletedAt===null,);}

Adds a function that check if there is already a project with the workspaceRoot property persited. If so return a Effect.fail else void.

exportfunctionrequireWorkspaceRootUnique(input: {readonlyreadModel: OrchestrationReadModel;readonlycommand: OrchestrationCommand;readonlyworkspaceRoot: string;readonlyexcludeProjectId?: ProjectId;}): Effect.Effect<void,OrchestrationCommandInvariantError>{constexisting=findProjectByWorkspaceRoot(input.readModel,input.workspaceRoot);if(!existing||existing.id===input.excludeProjectId){returnEffect.void;}returnEffect.fail(invariantError(input.command.type,`Workspace root '${input.workspaceRoot}' is already used by project '${existing.id}'.`,),);}

In the apps/server/src/orchestration/decider.ts code I imported the new requireWorkspaceRootUnique function and used it inside the project.create and project.meta.update case handlers to verify that project with same workspaceRoot does not already exist.

Added relevant new test to assert the checks are working as intended. All existing test pass after change.

Why

Server code should have the same validations as the client code has to avoid duplicate project creation (same workspaceRoot) in the db. Either this check should be done in the two handlers changed in this PR or the db schema should enforce the workspaceRoot to be unique.

I would argue that this is a good first step to avoid the issue expressed in #1595 to occur and then if the db should enforce this (which is a much bigger change) db migrations would most likely be added to handle "bad" client state.

UI Changes

No UI changes have been made.

Checklist

• This PR is small and focused
• I explained what changed and why

---

Note

Medium Risk
Adds new server-side validation that can cause project.create and project.meta.update commands to start failing for previously-allowed duplicate workspaceRoot values; impact is limited to orchestration command handling and covered by new tests.

Overview
Enforces server-side uniqueness of workspaceRoot across active projects. The orchestration decider now rejects project.create and project.meta.update (when changing workspaceRoot) if the path is already used by another non-deleted project.

Adds findProjectByWorkspaceRoot/requireWorkspaceRootUnique invariants (including an excludeProjectId self-update case) and expands unit/integration tests to cover conflicts, soft-deleted projects, and edge cases with pre-existing duplicates.

^{Written by Cursor Bugbot for commit 983f1bb. This will update automatically on new commits. Configure here.}

Note

Add server-side uniqueness invariant for workspaceRoot on project create and update

• Adds requireWorkspaceRootUnique in commandInvariants.ts that scans non-deleted projects and rejects with an OrchestrationCommandInvariantError if the given workspaceRoot is already in use.
• Integrates the check into decider.ts for both project.create and project.meta.update; the update path excludes the current project from the check to allow self-retention.
• Also adds findProjectByWorkspaceRoot, a helper that returns the first non-deleted project matching a given path.
• Behavioral Change: project.create and project.meta.update commands now fail with an invariant error when another non-deleted project already uses the requested workspaceRoot.

^{Macroscope summarized 983f1bb.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 10214698-3ce3-451f-abdf-84331018293d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[cursor]

Unused helper duplicates workspace lookup logic

Low Severity

findProjectByWorkspaceRoot is exported but not used by runtime code, and requireWorkspaceRootUnique reimplements the same workspaceRoot lookup inline. This creates dead API surface and duplicated logic in commandInvariants.ts, increasing the chance these checks drift apart later.

Additional Locations (1)

• apps/server/src/orchestration/commandInvariants.ts#L48-L54

[juliusmarminge]

Closing as superseded by merged PR #3829, which landed the current workspace-root uniqueness behavior.

[jonsing]

Duplicate workspaceRoot detection previously only happened client-side in Sidebar.tsx. This adds a server-side invariant in the orchestration decider that rejects project.create and project.meta.update commands when the target workspaceRoot is already used by another non-deleted project. Soft-deleted projects are excluded from the check. Reason for this change is reported bug #1595

What Changed

In total 46 additions, the additional 198 additions are test code.

Adds a helper function in apps/server/src/orchestration/commandInvariants.ts to easily find existing projects given a workspaceRoot. Only used within requireWorkspaceRootUnique function so one could argue that this is unnecessary abstraction at this point, happy to change this to be inline.

exportfunctionfindProjectByWorkspaceRoot(readModel: OrchestrationReadModel,workspaceRoot: string,): OrchestrationProject|undefined{returnreadModel.projects.find((project)=>project.workspaceRoot===workspaceRoot&&project.deletedAt===null,);}

Adds a function that check if there is already a project with the workspaceRoot property persited. If so return a Effect.fail else void.

exportfunctionrequireWorkspaceRootUnique(input: {readonlyreadModel: OrchestrationReadModel;readonlycommand: OrchestrationCommand;readonlyworkspaceRoot: string;readonlyexcludeProjectId?: ProjectId;}): Effect.Effect<void,OrchestrationCommandInvariantError>{constexisting=findProjectByWorkspaceRoot(input.readModel,input.workspaceRoot);if(!existing||existing.id===input.excludeProjectId){returnEffect.void;}returnEffect.fail(invariantError(input.command.type,`Workspace root '${input.workspaceRoot}' is already used by project '${existing.id}'.`,),);}

In the apps/server/src/orchestration/decider.ts code I imported the new requireWorkspaceRootUnique function and used it inside the project.create and project.meta.update case handlers to verify that project with same workspaceRoot does not already exist.

Added relevant new test to assert the checks are working as intended. All existing test pass after change.

Why

Server code should have the same validations as the client code has to avoid duplicate project creation (same workspaceRoot) in the db. Either this check should be done in the two handlers changed in this PR or the db schema should enforce the workspaceRoot to be unique.

I would argue that this is a good first step to avoid the issue expressed in #1595 to occur and then if the db should enforce this (which is a much bigger change) db migrations would most likely be added to handle "bad" client state.

UI Changes

No UI changes have been made.

Checklist

• This PR is small and focused
• I explained what changed and why

---

Note

Medium Risk
Adds new server-side validation that can cause project.create and project.meta.update commands to start failing for previously-allowed duplicate workspaceRoot values; impact is limited to orchestration command handling and covered by new tests.

Overview
Enforces server-side uniqueness of workspaceRoot across active projects. The orchestration decider now rejects project.create and project.meta.update (when changing workspaceRoot) if the path is already used by another non-deleted project.

Adds findProjectByWorkspaceRoot/requireWorkspaceRootUnique invariants (including an excludeProjectId self-update case) and expands unit/integration tests to cover conflicts, soft-deleted projects, and edge cases with pre-existing duplicates.

^{Written by Cursor Bugbot for commit 983f1bb. This will update automatically on new commits. Configure here.}

Note

Add server-side uniqueness invariant for workspaceRoot on project create and update

• Adds requireWorkspaceRootUnique in commandInvariants.ts that scans non-deleted projects and rejects with an OrchestrationCommandInvariantError if the given workspaceRoot is already in use.
• Integrates the check into decider.ts for both project.create and project.meta.update; the update path excludes the current project from the check to allow self-retention.
• Also adds findProjectByWorkspaceRoot, a helper that returns the first non-deleted project matching a given path.
• Behavioral Change: project.create and project.meta.update commands now fail with an invariant error when another non-deleted project already uses the requested workspaceRoot.

^{Macroscope summarized 983f1bb.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 10214698-3ce3-451f-abdf-84331018293d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[cursor]

Unused helper duplicates workspace lookup logic

Low Severity

findProjectByWorkspaceRoot is exported but not used by runtime code, and requireWorkspaceRootUnique reimplements the same workspaceRoot lookup inline. This creates dead API surface and duplicated logic in commandInvariants.ts, increasing the chance these checks drift apart later.

Additional Locations (1)

• apps/server/src/orchestration/commandInvariants.ts#L48-L54

[juliusmarminge]

Closing as superseded by merged PR #3829, which landed the current workspace-root uniqueness behavior.

[jonsing]

Duplicate workspaceRoot detection previously only happened client-side in Sidebar.tsx. This adds a server-side invariant in the orchestration decider that rejects project.create and project.meta.update commands when the target workspaceRoot is already used by another non-deleted project. Soft-deleted projects are excluded from the check. Reason for this change is reported bug #1595

What Changed

In total 46 additions, the additional 198 additions are test code.

Adds a helper function in apps/server/src/orchestration/commandInvariants.ts to easily find existing projects given a workspaceRoot. Only used within requireWorkspaceRootUnique function so one could argue that this is unnecessary abstraction at this point, happy to change this to be inline.

exportfunctionfindProjectByWorkspaceRoot(readModel: OrchestrationReadModel,workspaceRoot: string,): OrchestrationProject|undefined{returnreadModel.projects.find((project)=>project.workspaceRoot===workspaceRoot&&project.deletedAt===null,);}

Adds a function that check if there is already a project with the workspaceRoot property persited. If so return a Effect.fail else void.

exportfunctionrequireWorkspaceRootUnique(input: {readonlyreadModel: OrchestrationReadModel;readonlycommand: OrchestrationCommand;readonlyworkspaceRoot: string;readonlyexcludeProjectId?: ProjectId;}): Effect.Effect<void,OrchestrationCommandInvariantError>{constexisting=findProjectByWorkspaceRoot(input.readModel,input.workspaceRoot);if(!existing||existing.id===input.excludeProjectId){returnEffect.void;}returnEffect.fail(invariantError(input.command.type,`Workspace root '${input.workspaceRoot}' is already used by project '${existing.id}'.`,),);}

In the apps/server/src/orchestration/decider.ts code I imported the new requireWorkspaceRootUnique function and used it inside the project.create and project.meta.update case handlers to verify that project with same workspaceRoot does not already exist.

Added relevant new test to assert the checks are working as intended. All existing test pass after change.

Why

Server code should have the same validations as the client code has to avoid duplicate project creation (same workspaceRoot) in the db. Either this check should be done in the two handlers changed in this PR or the db schema should enforce the workspaceRoot to be unique.

I would argue that this is a good first step to avoid the issue expressed in #1595 to occur and then if the db should enforce this (which is a much bigger change) db migrations would most likely be added to handle "bad" client state.

UI Changes

No UI changes have been made.

Checklist

• This PR is small and focused
• I explained what changed and why

---

Note

Medium Risk
Adds new server-side validation that can cause project.create and project.meta.update commands to start failing for previously-allowed duplicate workspaceRoot values; impact is limited to orchestration command handling and covered by new tests.

Overview
Enforces server-side uniqueness of workspaceRoot across active projects. The orchestration decider now rejects project.create and project.meta.update (when changing workspaceRoot) if the path is already used by another non-deleted project.

Adds findProjectByWorkspaceRoot/requireWorkspaceRootUnique invariants (including an excludeProjectId self-update case) and expands unit/integration tests to cover conflicts, soft-deleted projects, and edge cases with pre-existing duplicates.

^{Written by Cursor Bugbot for commit 983f1bb. This will update automatically on new commits. Configure here.}

Note

Add server-side uniqueness invariant for workspaceRoot on project create and update

• Adds requireWorkspaceRootUnique in commandInvariants.ts that scans non-deleted projects and rejects with an OrchestrationCommandInvariantError if the given workspaceRoot is already in use.
• Integrates the check into decider.ts for both project.create and project.meta.update; the update path excludes the current project from the check to allow self-retention.
• Also adds findProjectByWorkspaceRoot, a helper that returns the first non-deleted project matching a given path.
• Behavioral Change: project.create and project.meta.update commands now fail with an invariant error when another non-deleted project already uses the requested workspaceRoot.

^{Macroscope summarized 983f1bb.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 10214698-3ce3-451f-abdf-84331018293d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[cursor]

Unused helper duplicates workspace lookup logic

Low Severity

findProjectByWorkspaceRoot is exported but not used by runtime code, and requireWorkspaceRootUnique reimplements the same workspaceRoot lookup inline. This creates dead API surface and duplicated logic in commandInvariants.ts, increasing the chance these checks drift apart later.

Additional Locations (1)

• apps/server/src/orchestration/commandInvariants.ts#L48-L54

[juliusmarminge]

Closing as superseded by merged PR #3829, which landed the current workspace-root uniqueness behavior.

[jonsing]

Duplicate workspaceRoot detection previously only happened client-side in Sidebar.tsx. This adds a server-side invariant in the orchestration decider that rejects project.create and project.meta.update commands when the target workspaceRoot is already used by another non-deleted project. Soft-deleted projects are excluded from the check. Reason for this change is reported bug #1595

What Changed

In total 46 additions, the additional 198 additions are test code.

Adds a helper function in apps/server/src/orchestration/commandInvariants.ts to easily find existing projects given a workspaceRoot. Only used within requireWorkspaceRootUnique function so one could argue that this is unnecessary abstraction at this point, happy to change this to be inline.

exportfunctionfindProjectByWorkspaceRoot(readModel: OrchestrationReadModel,workspaceRoot: string,): OrchestrationProject|undefined{returnreadModel.projects.find((project)=>project.workspaceRoot===workspaceRoot&&project.deletedAt===null,);}

Adds a function that check if there is already a project with the workspaceRoot property persited. If so return a Effect.fail else void.

exportfunctionrequireWorkspaceRootUnique(input: {readonlyreadModel: OrchestrationReadModel;readonlycommand: OrchestrationCommand;readonlyworkspaceRoot: string;readonlyexcludeProjectId?: ProjectId;}): Effect.Effect<void,OrchestrationCommandInvariantError>{constexisting=findProjectByWorkspaceRoot(input.readModel,input.workspaceRoot);if(!existing||existing.id===input.excludeProjectId){returnEffect.void;}returnEffect.fail(invariantError(input.command.type,`Workspace root '${input.workspaceRoot}' is already used by project '${existing.id}'.`,),);}

In the apps/server/src/orchestration/decider.ts code I imported the new requireWorkspaceRootUnique function and used it inside the project.create and project.meta.update case handlers to verify that project with same workspaceRoot does not already exist.

Added relevant new test to assert the checks are working as intended. All existing test pass after change.

Why

Server code should have the same validations as the client code has to avoid duplicate project creation (same workspaceRoot) in the db. Either this check should be done in the two handlers changed in this PR or the db schema should enforce the workspaceRoot to be unique.

I would argue that this is a good first step to avoid the issue expressed in #1595 to occur and then if the db should enforce this (which is a much bigger change) db migrations would most likely be added to handle "bad" client state.

UI Changes

No UI changes have been made.

Checklist

• This PR is small and focused
• I explained what changed and why

---

Note

Medium Risk
Adds new server-side validation that can cause project.create and project.meta.update commands to start failing for previously-allowed duplicate workspaceRoot values; impact is limited to orchestration command handling and covered by new tests.

Overview
Enforces server-side uniqueness of workspaceRoot across active projects. The orchestration decider now rejects project.create and project.meta.update (when changing workspaceRoot) if the path is already used by another non-deleted project.

Adds findProjectByWorkspaceRoot/requireWorkspaceRootUnique invariants (including an excludeProjectId self-update case) and expands unit/integration tests to cover conflicts, soft-deleted projects, and edge cases with pre-existing duplicates.

^{Written by Cursor Bugbot for commit 983f1bb. This will update automatically on new commits. Configure here.}

Note

Add server-side uniqueness invariant for workspaceRoot on project create and update

• Adds requireWorkspaceRootUnique in commandInvariants.ts that scans non-deleted projects and rejects with an OrchestrationCommandInvariantError if the given workspaceRoot is already in use.
• Integrates the check into decider.ts for both project.create and project.meta.update; the update path excludes the current project from the check to allow self-retention.
• Also adds findProjectByWorkspaceRoot, a helper that returns the first non-deleted project matching a given path.
• Behavioral Change: project.create and project.meta.update commands now fail with an invariant error when another non-deleted project already uses the requested workspaceRoot.

^{Macroscope summarized 983f1bb.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 10214698-3ce3-451f-abdf-84331018293d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[cursor]

Unused helper duplicates workspace lookup logic

Low Severity

findProjectByWorkspaceRoot is exported but not used by runtime code, and requireWorkspaceRootUnique reimplements the same workspaceRoot lookup inline. This creates dead API surface and duplicated logic in commandInvariants.ts, increasing the chance these checks drift apart later.

Additional Locations (1)

• apps/server/src/orchestration/commandInvariants.ts#L48-L54

[juliusmarminge]

Closing as superseded by merged PR #3829, which landed the current workspace-root uniqueness behavior.