fix(workspace): hydrate access policy before rendering chat

[waleedlatif1]

Summary

• Hydrate workspace permission policy with the initial layout data so chat opens without a second access-loading screen.
• Prefetch feature request state only for restricted workspaces, preserving existing retry, polling, and invalidation behavior.
• Share one session-authorized policy read between the server and API; fail closed when entitlement lookup fails.
• Record the affected module graphs after shared query-key extraction and conditional server discovery loading. The graph audit includes lazy imports; feature discovery returns before loading integration registries.

Type of Change

• Bug fix

Testing

• 482 tests passed across permission policy, access requests, authorization, routes, and hydration (5 existing skips).
• First-render tests cover allowed, restricted, pending, disabled, failed-read, retry, workspace-switch, and background invalidation states.
• All eight cleanup passes completed; lint, all 46 audits, docs manifest, and all 26 workspace type checks passed.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 16, 2026 5:38am UTC

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge. No new issue was found in the changes since the last review.

Summary

Workspace access data is now loaded on the server before chat renders, so allowed chat opens without a second access screen. Restricted workspaces also load request details only when needed, while the server and API share one policy read.

• Hydrates access policy before the workspace renders.
• Loads access-request discovery only for restricted workspaces.
• Shares policy logic and query keys between server and client code.

Diagram

sequenceDiagram
    participant Browser
    participant Layout as Workspace layout
    participant Policy as Permission policy
    participant Requests as Access requests
    participant Cache as Query cache

    Browser->>Layout: Open workspace
    Layout->>Policy: Read policy with session principal
    Policy-->>Layout: Authorized workspace policy
    Layout->>Cache: Seed policy query
    alt A workspace feature is restricted
        Layout->>Requests: Discover feature requests
        Requests-->>Layout: Request state
        Layout->>Cache: Seed discovery query
    end
    Layout-->>Browser: Render dehydrated workspace
    Browser->>Cache: Read hydrated access state
    alt Access is allowed
        Cache-->>Browser: Show chat
    else Access is restricted
        Cache-->>Browser: Show access request state
    else A server read failed
        Cache-->>Browser: Keep chat closed and retry on client
    end

Loading

_{Reviews (2) · Last reviewed commit: "fix(workspace): update layout test setup..."}

[cubic-dev-ai]

All reported issues were addressed across 13 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 14 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}