Merge pull request #145 from codeflash-ai/feature/workspace-materializer-v2

Materialize secure portable workspaces in loc and Desktop

Author: Saga4

Cargo.lock

@@ -96,3 +96,8 @@ starts the Notion broker OAuth flow, exposes the main daily-use screens, and
 opens a tray popover window. Remaining product gaps, especially workspace-level
 Notion mount creation and multi-file push orchestration, are tracked in
 `docs/deviations.md`.
+
+The Hosted settings panel is an explicitly manual generation-2 materializer
+preview. It accepts an API origin, absolute destination, and Workspace Profile
+key for one invocation; it is not canonical Desktop source/mount integration
+and does not persist hosted credentials.

apps/desktop/README.md

@@ -47,6 +47,10 @@ use loc_cli::push::{
     PushOptions, PushReport, push_report_exit_code, run_push_with_daemon_at_state_root,
 };
 use loc_cli::restore::{RestoreOptions, run_restore};
+use loc_cli::sandbox::{
+    SandboxContentEncodingPreference, SandboxInitOptions, SandboxInitReport, SandboxProfileKey,
+    run_sandbox_init_with_profile_key, validate_sandbox_api_url,
+};
 use loc_cli::search::{
     SearchOptions, SearchResult, is_notion_url_host, notion_id_from_url,
     run_search_with_access_roots, source_url_host,
@@ -453,6 +457,14 @@ struct WorkspaceMountOnboardingRequest {
     action: String,
 }
 
+#[derive(Clone, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct PortableWorkspaceMaterializationRequest {
+    api_url: String,
+    root: String,
+    profile_key: String,
+}
+
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 enum WorkspaceMountOnboardingAction {
     Start,
@@ -1429,6 +1441,43 @@ async fn create_workspace_mount(app: AppHandle, path: String) -> ActionReport {
     .await
 }
 
+#[tauri::command]
+async fn materialize_portable_workspace(
+    request: PortableWorkspaceMaterializationRequest,
+) -> Result<SandboxInitReport, String> {
+    let (options, profile_key) = portable_workspace_options(request)?;
+    tauri::async_runtime::spawn_blocking(move || {
+        run_sandbox_init_with_profile_key(
+            options,
+            profile_key,
+            SandboxContentEncodingPreference::Automatic,
+        )
+        .map_err(|error| format!("Portable workspace materialization failed: {error}"))
+    })
+    .await
+    .map_err(|error| format!("Portable workspace worker failed: {error}"))?
+}
+
+fn portable_workspace_options(
+    request: PortableWorkspaceMaterializationRequest,
+) -> Result<(SandboxInitOptions, SandboxProfileKey), String> {
+    validate_sandbox_api_url(&request.api_url)
+        .map_err(|error| format!("Portable workspace API URL is invalid: {error}"))?;
+    let root = PathBuf::from(request.root);
+    if !root.is_absolute() {
+        return Err("Portable workspace root must be an absolute path".to_string());
+    }
+    let profile_key = SandboxProfileKey::new(request.profile_key)
+        .map_err(|error| format!("Portable workspace credential is invalid: {error}"))?;
+    Ok((
+        SandboxInitOptions {
+            api_url: request.api_url,
+            root,
+        },
+        profile_key,
+    ))
+}
+
 #[tauri::command]
 async fn create_desktop_mount(app: AppHandle, request: CreateDesktopMountRequest) -> ActionReport {
     create_desktop_mount_command(app, request).await
@@ -12083,6 +12132,54 @@ mod tests {
         assert!(super::absolute_state_root(PathBuf::from(".loc")).is_absolute());
     }
 
+    #[test]
+    fn portable_workspace_invoke_boundary_rejects_invalid_urls_and_relative_roots() {
+        for api_url in [
+            "https://workspace.example.test/api",
+            "https://user@workspace.example.test",
+            "https://workspace.example.test?tenant=7",
+            "https://workspace.example.test#fragment",
+            "http://workspace.example.test",
+        ] {
+            let error =
+                super::portable_workspace_options(super::PortableWorkspaceMaterializationRequest {
+                    api_url: api_url.to_string(),
+                    root: std::env::temp_dir().join("Locality").display().to_string(),
+                    profile_key: "a".repeat(64),
+                })
+                .expect_err("invalid Desktop API URL must fail before invocation");
+            assert!(error.contains("API URL is invalid"), "{api_url}: {error}");
+        }
+
+        let error =
+            super::portable_workspace_options(super::PortableWorkspaceMaterializationRequest {
+                api_url: "https://workspace.example.test".to_string(),
+                root: "relative/Locality".to_string(),
+                profile_key: "a".repeat(64),
+            })
+            .expect_err("relative Desktop root must fail before invocation");
+        assert!(error.contains("absolute path"));
+    }
+
+    #[test]
+    fn portable_workspace_invoke_boundary_accepts_https_and_loopback_http() {
+        for api_url in [
+            "https://workspace.example.test",
+            "http://127.0.0.1:8080",
+            "http://127.1:8080",
+        ] {
+            let (options, _) =
+                super::portable_workspace_options(super::PortableWorkspaceMaterializationRequest {
+                    api_url: api_url.to_string(),
+                    root: std::env::temp_dir().join("Locality").display().to_string(),
+                    profile_key: "a".repeat(64),
+                })
+                .expect("valid Desktop workspace request");
+            assert_eq!(options.api_url, api_url);
+            assert!(options.root.is_absolute());
+        }
+    }
+
     #[cfg(unix)]
     #[test]
     fn write_file_atomic_falls_back_to_existing_file_overwrite() {
@@ -18106,6 +18203,7 @@ fn main() {
             ensure_runtime_ready,
             ensure_terminal_cli_available,
             create_workspace_mount,
+            materialize_portable_workspace,
             create_desktop_mount,
             connect_granola,
             connect_linear,

apps/desktop/src-tauri/src/main.rs

@@ -110,6 +110,13 @@ import {
   type SourceConnectorId,
   type SourceSetupState,
 } from "./source-setup";
+import {
+  invokePortableWorkspace,
+  portableWorkspaceSuccessMessage,
+  validatePortableWorkspaceForm,
+  workspaceWorkflowCommand,
+  type PortableWorkspaceReport,
+} from "./portable-workspace";
 import gmailIconUrl from "./assets/connectors/gmail.svg";
 import googleCalendarIconUrl from "./assets/connectors/google-calendar.svg";
 import googleDocsIconUrl from "./assets/connectors/google-docs.svg";
@@ -131,7 +138,7 @@ type OnboardingConnectorId = SourceConnectorId;
 type ReviewFilter = "all" | "approvals" | "problems";
 type FileStatusFilter = "all" | "review" | "conflict" | "synced";
 type DestructiveSettingsAction = "reset" | "uninstall";
-type SettingsSection = "general" | "sources" | "sync" | "activity" | "agents" | "advanced" | "about";
+type SettingsSection = "general" | "sources" | "hosted" | "sync" | "activity" | "agents" | "advanced" | "about";
 type SourceListViewMode = "list" | "tiles";
 type AppTheme = "system" | "light" | "dark";
 
@@ -3108,7 +3115,7 @@ function HomeView({
   async function createMount() {
     setActionError("");
     const report = await callCommand<ActionReport>(
-      "create_workspace_mount",
+      workspaceWorkflowCommand("local"),
       { path: snapshot.mount.localPath },
       { ok: true, message: "Created demo mount." },
     );
@@ -5954,6 +5961,13 @@ function SettingsView({
   const [settingsSection, setSettingsSection] = useState<SettingsSection>("general");
   const [busySetting, setBusySetting] = useState("");
   const [localSettings, setLocalSettings] = useState(snapshot.settings);
+  const [portableApiUrl, setPortableApiUrl] = useState("");
+  const [portableRoot, setPortableRoot] = useState("");
+  const [portableProfileKey, setPortableProfileKey] = useState("");
+  const [portableWorkspaceState, setPortableWorkspaceState] = useState<
+    "idle" | "materializing" | "success" | "error"
+  >("idle");
+  const [portableWorkspaceMessage, setPortableWorkspaceMessage] = useState("");
   const daemonStopped = snapshot.health.state === "stopped";
   const runtimeStopped = snapshot.health.state === "runtime_stopped";
   const runtimeNeedsRepair = daemonStopped || runtimeStopped;
@@ -6131,9 +6145,51 @@ function SettingsView({
     }
   }
 
+  async function materializePortableWorkspace() {
+    if (portableWorkspaceState === "materializing") {
+      return;
+    }
+    const validation = validatePortableWorkspaceForm({
+      apiUrl: portableApiUrl,
+      root: portableRoot,
+      profileKey: portableProfileKey,
+    });
+    if (!validation.ok) {
+      setPortableWorkspaceState("error");
+      setPortableWorkspaceMessage(validation.message);
+      return;
+    }
+    setPortableWorkspaceState("materializing");
+    setPortableWorkspaceMessage("Negotiating and materializing the hosted workspace…");
+    try {
+      const fallback: PortableWorkspaceReport = {
+        ok: true,
+        root: validation.request.root,
+        session_id: "demo-session",
+        content_encoding: "identity",
+        entries: 0,
+        files: 0,
+        directories: 0,
+        materialized_bytes: 0,
+        decoded_bytes: 0,
+      };
+      const report = await invokePortableWorkspace(
+        (command, args) => callCommand<PortableWorkspaceReport>(command, args, fallback),
+        validation.request,
+      );
+      setPortableProfileKey("");
+      setPortableWorkspaceState("success");
+      setPortableWorkspaceMessage(portableWorkspaceSuccessMessage(report));
+    } catch (error) {
+      setPortableWorkspaceState("error");
+      setPortableWorkspaceMessage(errorMessage(error));
+    }
+  }
+
   const settingsSections: Array<{ id: SettingsSection; label: string; description: string }> = [
     { id: "general", label: "General", description: "Startup and desktop behavior" },
     { id: "sources", label: "Sources", description: "Connected workspaces and local folders" },
+    { id: "hosted", label: "Hosted (preview)", description: "Manual portable materializer" },
     { id: "sync", label: "Sync", description: "Live Mode and review policy" },
     { id: "activity", label: "Activity", description: "Recent events and debug queue" },
     { id: "agents", label: "Agents", description: "Local agent instructions" },
@@ -6217,6 +6273,68 @@ function SettingsView({
             </section>
           )}
 
+          {settingsSection === "hosted" && (
+            <section className="panel settings-section-panel portable-workspace-panel">
+              <PanelTitle title="Hosted materializer preview" />
+              <p className="quiet-note">
+                Manually materialize or recover a generation-2 workspace. This preview is not yet bound to Desktop sources, mounts, or stored credentials.
+              </p>
+              <div className="portable-workspace-fields">
+                <label className="source-inline-field">
+                  <span>Workspace API URL</span>
+                  <input
+                    type="url"
+                    value={portableApiUrl}
+                    placeholder="https://workspace.example.com"
+                    disabled={portableWorkspaceState === "materializing"}
+                    onChange={(event) => setPortableApiUrl(event.target.value)}
+                  />
+                </label>
+                <label className="source-inline-field">
+                  <span>Local workspace root</span>
+                  <input
+                    value={portableRoot}
+                    placeholder="/mnt/locality"
+                    disabled={portableWorkspaceState === "materializing"}
+                    onChange={(event) => setPortableRoot(event.target.value)}
+                  />
+                </label>
+                <label className="source-inline-field portable-workspace-key-field">
+                  <span>Workspace Profile key</span>
+                  <input
+                    type="password"
+                    autoComplete="off"
+                    value={portableProfileKey}
+                    placeholder="64-character key"
+                    disabled={portableWorkspaceState === "materializing"}
+                    onChange={(event) => setPortableProfileKey(event.target.value)}
+                    onKeyDown={(event) => {
+                      if (event.key === "Enter") {
+                        void materializePortableWorkspace();
+                      }
+                    }}
+                  />
+                </label>
+              </div>
+              <PrimaryButton
+                compact
+                icon={portableWorkspaceState === "materializing" ? <Loader2 className="spin-icon" /> : <Download />}
+                disabled={portableWorkspaceState === "materializing"}
+                onClick={() => void materializePortableWorkspace()}
+              >
+                {portableWorkspaceState === "materializing" ? "Materializing" : "Materialize Workspace"}
+              </PrimaryButton>
+              {portableWorkspaceMessage && (
+                <p
+                  className={portableWorkspaceState === "error" ? "field-error" : "quiet-note inline-note"}
+                  role={portableWorkspaceState === "error" ? "alert" : "status"}
+                >
+                  {portableWorkspaceMessage}
+                </p>
+              )}
+            </section>
+          )}
+
           {settingsSection === "sync" && (
             <section className="panel settings-section-panel">
               <PanelTitle title="Sync and review policy" />