WorkspaceFilesRuntimeCapability exposes WorkspaceFilesApi under the stable ID platform.workspace.files. It is the plugin-facing file boundary for Xpert workspace Volumes.
Use this capability instead of reading host filesystem paths or implementing plugin-owned storage. It preserves platform scope, returns portable references for asynchronous work, and integrates existing files with the platform file-understanding pipeline.
Catalogs and scope
The supported logical catalogs are:WorkspaceFileScope fields such as tenantId, organizationId, userId, catalog, scopeId, projectId, knowledgeId, rootId, and xpertId. Runtime-aware APIs infer the current Agent workspace when possible.
For files in the current Agent runtime, the host exposes the capability only after binding a concrete data owner: Project mode binds projectId, while non-Project mode binds xpertId. A personal Xpert uses catalog: 'user-xperts', where scopeId is the Xpert ID and userId remains a separate user-isolation field. Never concatenate userId and xpertId into one scopeId.
filePath is always relative to a workspace Volume. It is not /workspace/... and is never a host/API-process filesystem path.
Resolve Workspace Files in a NestJS provider
Agent middleware usescontext.runtime.capabilities directly. A View Provider, controller, or other NestJS service must inject XPERT_AGENT_MIDDLEWARE_RUNTIME_TOKEN and create a scoped API from host-resolved context:
XPERT_RUNTIME_CAPABILITIES_TOKEN inside a provider. That token represents the global capability set without a bound data owner, and current hosts intentionally omit WorkspaceFilesRuntimeCapability from it. See Runtime Capabilities for the complete provider rules.
Choose the right reference
A portable reference has
source: 'platform.workspace.files', a stable filePath, scope metadata, and a runtime-facing workspacePath. Persist the complete reference; do not reduce it to a sandbox path.
File operations
Read a path received from an Agent tool:
File understanding
The understanding APIs reuse the platform FileAsset and FileChunk index. They do not create a plugin-owned duplicate index.
Register and search a file:
listUnderstandingChunks() is one-based and returns hasMore. The host clamps page sizes, search limits, excerpt lengths, and per-chunk content lengths. Consumers must page rather than assume a full document is returned.
vectorIndexStatus is pending, ready, failed, or unavailable. Check it separately from the general parse status before exposing semantic search.
WorkspaceMediaFilesApi<TLocator> is a narrower type for media-generation adapters. It requires uploadBuffer() and readBuffer() and optionally exposes readRuntimeBuffer() and deleteFile(); use it when a component should not depend on the complete Workspace Files API.
Safety and lifecycle
- Create a scoped API from host-resolved server context for each request. Do not cache file capability instances across users, Xperts, Projects, or requests.
- Prefer
resolveFile()when only metadata or an openable URL is required; use byte-reading methods only for actual processing. - Never pass
/workspace/...paths into a delayed job. Convert them withresolveRuntimeReference()first. - Validate stored evidence with
validateUnderstandingReferences()before presenting or acting on it. - Scope every explicit operation. Do not construct
filePathfrom an untrusted absolute path. - Raw
Buffervalues belong only to the current server operation. Persist portable references for later work.