Workspaces 4/10: dor workspace verbs

[nedtwigg]

dor workspace new|rename|close|switch, dor list --workspaces|--all, --workspace on every action command, the VS Code refusal of Workspace-spanning requests.

Based on workspaces-multiwindow.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PkPyEFCxiPo5UFeju5Ya9u

[cloudflare-workers-and-pages]

Deploying mouseterm with    Cloudflare Pages

Latest commit:	9e3b0ec
Status:	✅  Deploy successful!
Preview URL:	https://83abb09d.mouseterm.pages.dev
Branch Preview URL:	https://workspaces-dor.mouseterm.pages.dev

View logs

[dormouse-bot]

Feedback on work in progress — not a merge verdict. The routing rewrite, the --all fan-out and the VS Code guard all land with tests I'd have asked for, and pnpm lint:specs / lint:public-docs pass on the head once AGENTS.md is read from the PR rather than the base-restored worktree copy. Five points are inline; two spec-drift items sit outside the diff hunks and are below.

docs/specs/layout.md corner case #8 now contradicts the code and notepad.md. It still reads "A refused close reveals its Workspace: a closeAll that returns a refusal activates that Workspace" — unconditional — while revealForPrompt in lib/src/components/wall/workspace-lifecycle.ts reveals only in prompt mode. docs/specs/notepad.md got the qualified version in this PR; layout.md did not, and the corner-case list is the one whose "numbers are stable" for cross-spec citation. The same section's close-refusal enumeration ("the last remaining Workspace cannot be closed", "One close runs at a time") also predates the new NO_WALL_REFUSAL, which the strip and the command-mode & can now hit — it is documented only in dor-cli.md's close row, i.e. in the spec that does not own the strip path.

docs/specs/dor-tool.md links a scope this PR deleted. Its "Dehydrate and rehydrate" section points at "docs/specs/layout.md → Future, workspaces-rollout", and **Scope: workspaces-rollout** is gone from layout.md's ## Future as of this PR. It is the only remaining hit in docs/, and spec-lint's scope check does not catch it: SCOPE_REF_RE matches only the bolded forms, so this prose reference reads as fine forever. docs/specs/layout.md → Workspaces is the live target.

[dormouse-bot]

Feedback on work in progress — not a merge verdict; mark the PR ready when you want the full one. Every finding from the previous round is genuinely closed: the lsof stdout salvage, the batched budget, the router answering the no-Wall case, the --all workspace pointers, and the key scrub all land with tests, and the layout.md / dor-tool.md spec drift is fixed (pnpm lint:specs and lint:public-docs pass on the head once AGENTS.md is read from the PR rather than the base-restored worktree copy). Two new points, both inline.

The first is a hard failure: the new sessionForKey scrub assertion does not match what the function returns, so pnpm -r run test (which builds dor-lib-common first) goes red. Build & Test is still pending at 70de2a3, so this hasn't surfaced yet.

Two smaller things, neither worth a change on its own:

resolveDorControlRoute's pending and none variants are now handled identically at their only consumer — dor-control-router.ts does if (route.kind === 'none' || route.kind === 'pending') and then reads route.message from either. Nothing outside the tests distinguishes them any more. Worth collapsing them, or keeping both deliberately because the provenance (a named Workspace vs the active fallback) is what a future consumer would branch on.

docs/specs/standalone.md → "Open ports" states the batch budget unconditionally — "the socket scan runs under OPEN_PORT_TIMEOUT_MS + OPEN_PORT_TIMEOUT_PER_ID_MS × ids" — but only macListeningPorts reads scanTimeoutMs. The Windows branch still passes a flat timeout: OPEN_PORT_TIMEOUT_MS to its PowerShell call and Linux reads /proc with no subprocess at all. No bug follows (the Windows scan's cost doesn't grow with the batch — Get-NetTCPConnection lists every connection regardless), but the rule as written is macOS-only, and the sidecar's own comment on OPEN_PORT_TIMEOUT_PER_ID_MS reads the same way.

[dormouse-bot]

Feedback on work in progress — not a merge verdict; mark the PR ready when you want the full one.

One new point inline: the deadline this commit matched to both scans is matched only on the Tauri side. The VS Code host runs the same pty-core — pty-host.js requires a shim re-exporting standalone/sidecar/pty-core.js — behind a flat 3 s at two boundaries, so the pane header there can still abandon a scan the host is about to answer. A smaller note on the 1000 literal is inline too.

[dormouse-bot]

Feedback on work in progress — not a merge verdict; mark the PR ready when you want the full one.

Both prior points are closed: pty_get_open_ports now takes open_ports_many_timeout(1), the VS Code child and webview boundaries carry the derived deadline, and the 1000 is a named constant with a mirror pin. The two new tests discriminate the change they pin — 6500 ms fails at hops = 0, 7500 ms fails at hops = 1. pnpm lint:specs and lint:public-docs pass on the head (reading AGENTS.md from the PR rather than the base-restored worktree copy).

Four points inline, the first about the rule itself rather than the arithmetic.

[dormouse-bot]

Feedback on work in progress — not a merge verdict; mark the PR ready when you want the full one.

The deadline gap from the last round is closed on the arithmetic: all three Windows subprocesses now draw on one openPortScanTimeoutMs(count), so the worst case is 2 × OPEN_PORT_TIMEOUT_MS + count × OPEN_PORT_TIMEOUT_PER_ID_MS on every platform, matching what docs/specs/transport.md → "Port scan deadlines" now states. Both new tests discriminate the change — the budget test pins the exact remaining-time sequence [3000, budget, budget − 500, budget − 1500], and the exhaustion test pins that netstat is never spawned. node --test standalone/sidecar/pty-core.test.js is green (101/101), and pnpm lint:specs passes on the head once AGENTS.md is read from the PR rather than the base-restored worktree copy.

One point inline is about what sharing the budget does to the fallback order; the second is a naming collision.

One smaller thing, outside the hunks: the netstat call in windowsListeningPorts still passes timeout: OPEN_PORT_TIMEOUT_MS in its options literal, which execFileSyncFn now always overwrites with remaining. It is the one place a reader would look to check the new rule, and it reads as the old flat 3 s — worth deleting so the options object doesn't contradict the comment above it.

[dormouse-bot]

Feedback on work in progress — not a merge verdict; mark the PR ready when you want the full one.

The reorder closes the ordering point from the last round, and both tests discriminate it: the budget test's [3000, budget, budget − 1000, budget − 1500] sequence only holds if Get-NetTCPConnection draws on the scan allowance first, and the new test pins that a name lookup consuming the entire remainder still returns the port that was already enumerated. node --test standalone/sidecar/pty-core.test.js is green (102/102), and pnpm lint:specs passes on the head once AGENTS.md is read from the PR rather than the base-restored worktree copy.

One point inline, about what the reorder left behind at the two parse calls.

[dormouse-bot]

Out of draft, so here is the verdict the draft rounds deferred: comment, not
approve. All four threads from the last three rounds are still open at
9e3b0ec, and the code they point at is unchanged — the only commit since
99161e1 is the workspaces-multiwindow merge.

Nothing new surfaced in this pass. I re-read the routing rewrite, the
workspace.* verbs, the --all fan-out, the VS Code guard and the port-scan
deadline arithmetic end to end. node --test standalone/sidecar/pty-core.test.js
is green (102/102) and lint:public-docs passes on the head; lint:specs is
clean apart from two standalone/sidecar/node_modules path checks that need a
pnpm install this checkout does not have.

What holds the approval, most consequential first:

• docs/specs/dor-cli.md → "Port enumeration is opt-in" still caps the scan
  at OPEN_PORT_TIMEOUT_MS. The Windows reorder made that wrong on both
  scanning platforms rather than just macOS — windowsListeningPorts derives
  its deadline from runtime.scanTimeoutMs now too, so this is the one number
  in the diff a reader would take and be wrong about.
• windowsListeningPorts threads nameByPid into both parse calls where it
  can only be empty, and the netstat call lost the comment recording why
  windowsHide is load-bearing there.
• The budget formula's two hand-written copies — openPortRequestTimeoutMs
  and open_ports_many_timeout — plus the 1000 restated as prose in that
  function's doc comment, are unpinned: docs/specs/transport.md names both as
  Source of truth: for one formula and nothing goes red if they diverge.

Three of the four carry a single-line suggestion on their thread.

[dormouse-bot]

All four findings are resolved in #630 at 3c5fc72c, verified file by file against that commit. Nothing in them holds this PR from my side.

The review I posted four minutes after your replies was composed against 9e3b0ec and read the four threads as open because the fixes live downstream in the train, not on this branch. The three blockers it lists are exactly these — that verdict is stale, disregard it.

What I checked on workspaces-transfer-fixes:

• docs/specs/dor-cli.md — "Port enumeration is opt-in" no longer names a cap, and docs/specs/transport.md → "Port scan deadlines" carries the contract with the full formula, the per-hop counts, and lib/src/lib/mirrored-constants.test.ts named as a pin. That is the right owner for it.
• The budget formula's two hand-written copies — the new port request deadline derivation mirrors case parses open_ports_many_timeout's actual Duration::from_millis expression and evaluates its terms instead of restating the formula, so a change to one side the other does not follow goes red. I traced it against the current Rust source rather than running it (no pnpm install in this checkout): the expression strips as u64, resolves to the three named constants, and reproduces openPortRequestTimeoutMs(count) at its default hops = 1. An unknown term throws, so the pin cannot silently weaken to a tautology — which is the failure mode a mirror test of this shape usually has.
• standalone/src-tauri/src/lib.rs — the doc comment reads plus OPEN_PORT_ROUND_TRIP_MARGIN_MS for IPC in place of the hand-written 1 s.
• windowsListeningPorts — nameByPid is now constructed beside its population, both parse calls dropped the argument, and the windowsHide console-allocation comment is back on the netstat call.