fix(core): save external permissions at project root

packages/core/src/location-mutation.ts

@@ -5,6 +5,8 @@ import path from "path"
 import { Context, Effect, Layer, Schema } from "effect"
 import { FSUtil } from "./fs-util"
 import { Location } from "./location"
+import { Project } from "./project"
+import { AbsolutePath } from "./schema"
 
 export const Kind = Schema.Literals(["file", "directory"])
 export type Kind = typeof Kind.Type
@@ -143,7 +145,12 @@ export const layer = Layer.effect(
               action: "external_directory",
               directory: externalDirectory,
               resource: externalResource,
-              save: externalResource,
+              save: slash(
+                path.join(
+                  (yield* Project.root(fs, AbsolutePath.make(externalDirectory))) ?? externalDirectory,
+                  "*",
+                ),
+              ),
             }
           : undefined,
       } satisfies Target

packages/core/src/project.ts

@@ -40,6 +40,17 @@ export interface Resolved {
   readonly vcs?: Vcs
 }
 
+// Keep this filesystem-only; permission checks use it and should not execute VCS commands.
+export const root = Effect.fn("Project.root")(function* (
+  fs: FSUtil.Interface,
+  input: AbsolutePath,
+) {
+  return yield* fs.up({ targets: [".git"], start: input }).pipe(
+    Effect.map((matches) => matches[0] ? AbsolutePath.make(path.dirname(matches[0])) : undefined),
+    Effect.catch(() => Effect.succeed(undefined)),
+  )
+})
+
 export interface Interface {
   readonly directories: (input: DirectoriesInput) => Effect.Effect<Directories>
   readonly resolve: (input: AbsolutePath) => Effect.Effect<Resolved>