@@ -82,7 +82,7 @@ export interface SyncReport {
    * and only one of them is the workspace's memory toggle; a toast that said
    * "memory is off" for a failed local read sent the user to a setting that was
    * fine. */
-  gatedBecause?: "flag-off" | "no-binding" | "memory-off" | "read-failed"
+  gatedBecause?: "flag-off" | "no-binding" | "pin-unresolved" | "memory-off" | "read-failed"
   sent: number
   failed: number
   /** Already present in the workspace at their current payload. */
@@ -230,14 +230,12 @@ export async function sync(directory: string): Promise<SyncReport> {
   // altimate_change — the IDE extension's pin outranks the project's own link, as it does for
   // the per-write mirror (`memory-sync.resolveBinding`). Without it an extension-launched `serve`
   // answered "not linked" for the workspace it was pinned to. Only the pin arm is layered, so an
-  // unpinned session keeps the cache-only read, and a pin that cannot be honoured stays gated
+  // unpinned session keeps the cache-only read, and a pin that cannot be honoured stays gated —
+  // under its own reason, since "nothing is linked" would misdescribe a workspace that exists —
   // rather than falling through to the project's link.
   const pinned = await resolvePinnedBindingForRouting(directory).catch(() => ({ status: "unknown" as const }))
-  const binding = pinned
-    ? pinned.status === "bound"
-      ? pinned.binding
-      : null
-    : await readLocalBinding(directory).catch(() => null)
+  if (pinned && pinned.status !== "bound") return gated("pin-unresolved")
+  const binding = pinned ? pinned.binding : await readLocalBinding(directory).catch(() => null)
   if (!binding) return gated("no-binding")
 
   const blocks = await MemoryStore.listAll({ directory }).catch((err) => {
 
@@ -1789,6 +1789,8 @@ function syncMessage(result: Manage.SyncReport): string {
         return "Could not read this project's local memory, so nothing was synced."
       case "no-binding":
         return "Nothing to sync — this project is not linked to a workspace."
+      case "pin-unresolved":
+        return "Nothing to sync — the pinned workspace could not be confirmed for this project."
       case "flag-off":
         return "Nothing to sync — workspace memory is not enabled in this build."
       default:
 
@@ -73,6 +73,32 @@ globalThis.AI_SDK_LOG_WARNINGS = false
 
 export namespace Server {
   const log = Log.create({ service: "server" })
+  // altimate_change start — shared gate for the `/altimate/workspace/*` routes
+  /** Why a `/workspace` action must not run, or undefined when it may.
+   *
+   * Outside the workspace pilot a skill sync purges the snapshot, so the flag is checked first.
+   * A browser origin on an unsecured server is refused for the same reason as Altimate Base
+   * registration: a CORS-allowed page is not a local process. Native clients (the extension host,
+   * curl) send no Origin; with a server password set, basicAuth has already vetted the caller. */
+  function workspaceRouteRefusal(
+    origin: string | undefined,
+  ): { status: 403 | 409; body: { ok: false; error: string } } | undefined {
+    if (!CoreFlag.ALTIMATE_WORKSPACE) {
+      return { status: 409, body: { ok: false, error: "Workspace mode is not enabled for this server." } }
+    }
+    if (origin && !Flag.OPENCODE_SERVER_PASSWORD) {
+      log.warn("refused browser-originated workspace action on an unsecured server", { origin })
+      return {
+        status: 403,
+        body: {
+          ok: false,
+          error: "Workspace actions cannot be run from a browser origin on an unsecured server. Set OPENCODE_SERVER_PASSWORD.",
+        },
+      }
+    }
+    return undefined
+  }
+  // altimate_change end
   // altimate_change start — the Base credential every provider cache in this process is known to
   // reflect: set after the register route has disposed both registries for it. Unset until then,
   // because a cache built before a background registration finished cannot be told apart from one
@@ -955,14 +981,26 @@ export namespace Server {
       // The `/workspace` menu's Refresh and Sync for the IDE extension, which runs this CLI
       // headless and cannot reach the TUI slash command. Both act on the request's instance
       // directory and return the `Manage` report as is; wording is the caller's job.
-      // Refused outside the workspace pilot: with the flag off, a skill sync purges the snapshot.
       .post("/altimate/workspace/refresh", async (c) => {
-        if (!CoreFlag.ALTIMATE_WORKSPACE) {
-          return c.json({ ok: false, error: "Workspace mode is not enabled for this server." }, 409)
+        const refused = workspaceRouteRefusal(c.req.header("origin"))
+        if (refused) return c.json(refused.body, refused.status)
+        // An absent or empty body is a session-less refresh; a malformed one is an error, not a
+        // silent fall-back to resetting every session's memory overlay.
+        const text = await c.req.text()
+        let body: unknown = {}
+        if (text.trim()) {
+          try {
+            body = JSON.parse(text)
+          } catch {
+            return c.json({ ok: false, error: "Request body is not valid JSON." }, 400)
+          }
         }
+        if (body === null || typeof body !== "object" || Array.isArray(body)) {
+          return c.json({ ok: false, error: "Request body must be a JSON object." }, 400)
+        }
+        const raw = (body as Record<string, unknown>).sessionID
+        const sessionID = typeof raw === "string" && raw ? raw : undefined
         try {
-          const body = await c.req.json().catch(() => ({}))
-          const sessionID = typeof body?.sessionID === "string" && body.sessionID ? body.sessionID : undefined
           const Manage = await import("../altimate/workspace/manage")
           // A changed skill snapshot reaches the registry at the start of the next turn
           // (`refreshSkillRegistry` in session/prompt.ts), so nothing is invalidated here.
@@ -975,9 +1013,8 @@ export namespace Server {
         }
       })
       .post("/altimate/workspace/sync", async (c) => {
-        if (!CoreFlag.ALTIMATE_WORKSPACE) {
-          return c.json({ ok: false, error: "Workspace mode is not enabled for this server." }, 409)
-        }
+        const refused = workspaceRouteRefusal(c.req.header("origin"))
+        if (refused) return c.json(refused.body, refused.status)
         try {
           const Manage = await import("../altimate/workspace/manage")
           const report = await Manage.sync(Instance.directory)
 
@@ -37,6 +37,9 @@ const PIN_VARS = [
   "ALTIMATE_PINNED_WORKSPACE_NAME",
   "ALTIMATE_PINNED_WORKSPACE_ROOT",
 ]
+// Restored in `afterAll`: `bun test` shares one process, and later files must see the pin they had.
+const ORIGINAL_PIN = Object.fromEntries(PIN_VARS.map((k) => [k, process.env[k]]))
+const originalFetch = globalThis.fetch
 
 /** The pinned workspace has memory ON and the project's own link has it OFF, so the gate reason
  * says which of the two the sweep ran against. */
@@ -57,13 +60,19 @@ function clearPin() {
 }
 
 async function seedLocalLink(directory = ROOT) {
-  await recordApprovedBinding(directory, {
-    datamateId: 7,
-    datamateName: "project-link",
-    linkedAt: Date.now(),
-    repoRemote: "[email protected]:acme/project.git",
-    projectPath: null,
-  } as never)
+  // Awaited, so the bind's skill sync and memory backfill finish inside this test's stubbed
+  // `fetch` instead of straddling `afterEach` into another file's request log.
+  await recordApprovedBinding(
+    directory,
+    {
+      datamateId: 7,
+      datamateName: "project-link",
+      linkedAt: Date.now(),
+      repoRemote: "[email protected]:acme/project.git",
+      projectPath: null,
+    } as never,
+    { awaitBackfill: true },
+  )
 }
 
 beforeEach(() => {
@@ -75,10 +84,13 @@ beforeEach(() => {
     ({ altimateInstanceName: "acme", altimateUrl: "https://api.test", altimateApiKey: "k" }) as Creds
   ;(WorkspaceApi as unknown as { listDatamates: () => Promise<unknown> }).listDatamates = async () => WORKSPACES
   clearPin()
+  globalThis.fetch = (async (_input: unknown, _init?: unknown) =>
+    new Response(JSON.stringify({}), { status: 200, headers: { "content-type": "application/json" } })) as typeof fetch
 })
 
 afterEach(() => {
   clearPin()
+  globalThis.fetch = originalFetch
 })
 
 afterAll(() => {
@@ -89,6 +101,10 @@ afterAll(() => {
   else process.env.XDG_STATE_HOME = ORIGINAL_XDG_STATE_HOME
   if (ORIGINAL_PILOT === undefined) delete process.env.ALTIMATE_WORKSPACE
   else process.env.ALTIMATE_WORKSPACE = ORIGINAL_PILOT
+  for (const [k, v] of Object.entries(ORIGINAL_PIN)) {
+    if (v === undefined) delete process.env[k]
+    else process.env[k] = v
+  }
   rmSync(SANDBOX, { recursive: true, force: true })
 })
 
@@ -112,14 +128,15 @@ describe("sync under an IDE pin", () => {
     setPin("99")
     const report = await sync(ROOT)
     expect(report.gated).toBe(true)
-    expect(report.gatedBecause).toBe("no-binding")
+    // Its own reason: the project IS linked (to 7), so "no-binding" would misdescribe it.
+    expect(report.gatedBecause).toBe("pin-unresolved")
   })
 
   test("a directory outside the pinned root is not treated as pinned", async () => {
     setPin()
     const report = await sync(OUTSIDE)
     expect(report.gated).toBe(true)
-    expect(report.gatedBecause).toBe("no-binding")
+    expect(report.gatedBecause).toBe("pin-unresolved")
   })
 })
 
 
@@ -12,11 +12,11 @@ import { disposeAllInstances } from "../fixture/fixture"
 const ORIGINAL_FLAG = process.env.ALTIMATE_WORKSPACE
 let spies: Array<{ mockRestore: () => void }> = []
 
-function post(path: string, body?: unknown) {
+function post(path: string, body?: unknown, headers: Record<string, string> = {}) {
   return Server.Default().request(path, {
     method: "POST",
-    headers: { "content-type": "application/json" },
-    body: body === undefined ? undefined : JSON.stringify(body),
+    headers: { "content-type": "application/json", ...headers },
+    body: body === undefined ? undefined : typeof body === "string" ? body : JSON.stringify(body),
   })
 }
 
@@ -92,6 +92,34 @@ describe("POST /altimate/workspace/refresh", () => {
     expect(response.status).toBe(500)
     expect(await response.json()).toEqual({ ok: false, error: "boom" })
   })
+
+  test("rejects malformed JSON rather than resetting every session's memory", async () => {
+    const refresh = spyOn(Manage, "refresh")
+    spies.push(refresh)
+
+    const response = await post("/altimate/workspace/refresh", "{not json")
+    expect(response.status).toBe(400)
+    expect(((await response.json()) as Record<string, unknown>).ok).toBe(false)
+    expect(refresh).not.toHaveBeenCalled()
+  })
+
+  test("rejects a body that is not an object", async () => {
+    const refresh = spyOn(Manage, "refresh")
+    spies.push(refresh)
+
+    expect((await post("/altimate/workspace/refresh", "[]")).status).toBe(400)
+    expect((await post("/altimate/workspace/refresh", "null")).status).toBe(400)
+    expect(refresh).not.toHaveBeenCalled()
+  })
+
+  test("refuses a browser origin on an unsecured server", async () => {
+    const refresh = spyOn(Manage, "refresh")
+    spies.push(refresh)
+
+    const response = await post("/altimate/workspace/refresh", {}, { origin: "https://evil.test" })
+    expect(response.status).toBe(403)
+    expect(refresh).not.toHaveBeenCalled()
+  })
 })
 
 describe("POST /altimate/workspace/sync", () => {
@@ -130,4 +158,20 @@ describe("POST /altimate/workspace/sync", () => {
     expect((await post("/altimate/workspace/sync")).status).toBe(409)
     expect(sync).not.toHaveBeenCalled()
   })
+
+  test("reports a thrown error as a 500 with its message", async () => {
+    spies.push(spyOn(Manage, "sync").mockRejectedValue(new Error("boom")))
+
+    const response = await post("/altimate/workspace/sync")
+    expect(response.status).toBe(500)
+    expect(await response.json()).toEqual({ ok: false, error: "boom" })
+  })
+
+  test("refuses a browser origin on an unsecured server", async () => {
+    const sync = spyOn(Manage, "sync")
+    spies.push(sync)
+
+    expect((await post("/altimate/workspace/sync", undefined, { origin: "https://evil.test" })).status).toBe(403)
+    expect(sync).not.toHaveBeenCalled()
+  })
 })