u

src/tools/patch.js

@@ -1,9 +1,9 @@
 import fs from 'fs';
 import path from 'path';
 import { defineTool, ToolError } from 'libllmorbiter';
-import { isReadOnlyDatabasePath } from './vfs.js';
+import { isReadOnlyDatabasePath, isProtectedAdminVfsPath, prepareVfs } from './vfs.js';
+import { requireSelectedCompanyAdmin } from '../db/companyuser.js';
 import { isSkillPath, renderSkill, parseSkill, SKILL_EXT, skillFileName } from './skill.js';
-import { prepareVfs } from './vfs.js';
 import { TOOL_DESCRIPTIONS, PATCH_PARAMETER_DESCRIPTIONS } from './prompts.js';
 import { getStore } from '../db/store.js';
 
@@ -155,6 +155,10 @@ export function createPatchTool({ googleAuthId }) {
                     );
                 }
 
+                if (isProtectedAdminVfsPath(clean)) {
+                    await requireSelectedCompanyAdmin(googleAuthId);
+                }
+
                 // A SKILL file must be flat — reject an attempted nested path up front.
                 const looksSkillByExt = clean.toLowerCase().endsWith(SKILL_EXT.toLowerCase());
                 if (looksSkillByExt && clean.includes('/')) {