Workspaces 4/10: dor workspace verbs

[nedtwigg]

dor workspace new|rename|close|switch, dor list --workspaces|--all, --workspace on every action command, the VS Code refusal of Workspace-spanning requests.

Based on workspaces-multiwindow.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PkPyEFCxiPo5UFeju5Ya9u

[cloudflare-workers-and-pages]

Deploying mouseterm with    Cloudflare Pages

Latest commit:	99161e1
Status:	✅  Deploy successful!
Preview URL:	https://621c55a2.mouseterm.pages.dev
Branch Preview URL:	https://workspaces-dor.mouseterm.pages.dev

View logs

[dormouse-bot]

Feedback on work in progress — not a merge verdict. The routing rewrite, the --all fan-out and the VS Code guard all land with tests I'd have asked for, and pnpm lint:specs / lint:public-docs pass on the head once AGENTS.md is read from the PR rather than the base-restored worktree copy. Five points are inline; two spec-drift items sit outside the diff hunks and are below.

docs/specs/layout.md corner case #8 now contradicts the code and notepad.md. It still reads "A refused close reveals its Workspace: a closeAll that returns a refusal activates that Workspace" — unconditional — while revealForPrompt in lib/src/components/wall/workspace-lifecycle.ts reveals only in prompt mode. docs/specs/notepad.md got the qualified version in this PR; layout.md did not, and the corner-case list is the one whose "numbers are stable" for cross-spec citation. The same section's close-refusal enumeration ("the last remaining Workspace cannot be closed", "One close runs at a time") also predates the new NO_WALL_REFUSAL, which the strip and the command-mode & can now hit — it is documented only in dor-cli.md's close row, i.e. in the spec that does not own the strip path.

docs/specs/dor-tool.md links a scope this PR deleted. Its "Dehydrate and rehydrate" section points at "docs/specs/layout.md → Future, workspaces-rollout", and **Scope: workspaces-rollout** is gone from layout.md's ## Future as of this PR. It is the only remaining hit in docs/, and spec-lint's scope check does not catch it: SCOPE_REF_RE matches only the bolded forms, so this prose reference reads as fine forever. docs/specs/layout.md → Workspaces is the live target.

[dormouse-bot]

Feedback on work in progress — not a merge verdict; mark the PR ready when you want the full one. Every finding from the previous round is genuinely closed: the lsof stdout salvage, the batched budget, the router answering the no-Wall case, the --all workspace pointers, and the key scrub all land with tests, and the layout.md / dor-tool.md spec drift is fixed (pnpm lint:specs and lint:public-docs pass on the head once AGENTS.md is read from the PR rather than the base-restored worktree copy). Two new points, both inline.

The first is a hard failure: the new sessionForKey scrub assertion does not match what the function returns, so pnpm -r run test (which builds dor-lib-common first) goes red. Build & Test is still pending at 70de2a3, so this hasn't surfaced yet.

Two smaller things, neither worth a change on its own:

resolveDorControlRoute's pending and none variants are now handled identically at their only consumer — dor-control-router.ts does if (route.kind === 'none' || route.kind === 'pending') and then reads route.message from either. Nothing outside the tests distinguishes them any more. Worth collapsing them, or keeping both deliberately because the provenance (a named Workspace vs the active fallback) is what a future consumer would branch on.

docs/specs/standalone.md → "Open ports" states the batch budget unconditionally — "the socket scan runs under OPEN_PORT_TIMEOUT_MS + OPEN_PORT_TIMEOUT_PER_ID_MS × ids" — but only macListeningPorts reads scanTimeoutMs. The Windows branch still passes a flat timeout: OPEN_PORT_TIMEOUT_MS to its PowerShell call and Linux reads /proc with no subprocess at all. No bug follows (the Windows scan's cost doesn't grow with the batch — Get-NetTCPConnection lists every connection regardless), but the rule as written is macOS-only, and the sidecar's own comment on OPEN_PORT_TIMEOUT_PER_ID_MS reads the same way.

[dormouse-bot]

Feedback on work in progress — not a merge verdict; mark the PR ready when you want the full one.

One new point inline: the deadline this commit matched to both scans is matched only on the Tauri side. The VS Code host runs the same pty-core — pty-host.js requires a shim re-exporting standalone/sidecar/pty-core.js — behind a flat 3 s at two boundaries, so the pane header there can still abandon a scan the host is about to answer. A smaller note on the 1000 literal is inline too.

[dormouse-bot]

Feedback on work in progress — not a merge verdict; mark the PR ready when you want the full one.

Both prior points are closed: pty_get_open_ports now takes open_ports_many_timeout(1), the VS Code child and webview boundaries carry the derived deadline, and the 1000 is a named constant with a mirror pin. The two new tests discriminate the change they pin — 6500 ms fails at hops = 0, 7500 ms fails at hops = 1. pnpm lint:specs and lint:public-docs pass on the head (reading AGENTS.md from the PR rather than the base-restored worktree copy).

Four points inline, the first about the rule itself rather than the arithmetic.

[dormouse-bot]

This cap is stale for the case the sentence is about. getOpenPortsForPids passes scanTimeoutMs: openPortScanTimeoutMs(roots.length) to the socket scan, and macListeningPorts reads it — so the batched lsof this paragraph describes runs under OPEN_PORT_TIMEOUT_MS + OPEN_PORT_TIMEOUT_PER_ID_MS × terminals, not OPEN_PORT_TIMEOUT_MS. It stays flat only on the Windows branch, which is the half the named cap now describes least well.

Simplest resolution is to drop the claim rather than qualify it per-platform here — the deadline rule now lives in docs/specs/transport.md → "Port scan deadlines" and the sidecar's scan budget in docs/specs/standalone.md, and AGENTS.md wants it stated once in the spec that owns it.

Suggested change

	`Get-NetTCPConnection`) under `OPEN_PORT_TIMEOUT_MS`. **One listing costs one
	`Get-NetTCPConnection`). **One listing costs one

[dormouse-bot]

The constant is pinned but the derivation that uses it is not, and there are now two hand-written copies of it: openPortRequestTimeoutMs here in TS and open_ports_many_timeout in lib.rs. docs/specs/transport.md names both as Source of truth: for one formula, so a change to either — dropping a 2 × once the two scans stop being serial, scaling the margin — leaves the other silently on the old budget and the spec's single formula false for one host. Nothing goes red.

This file already has the shape for it: counts the round-trip margin Rust adds in %s reads Duration::from_millis(timeout + (\d+)) out of each Rust command body and compares it to the quit.ts derivation. The same read over open_ports_many_timeout's body against openPortRequestTimeoutMs would close it, and it belongs in this describe rather than beside the constant pin.

[dormouse-bot]

Same hand-written margin the last round moved into a constant, one layer up as prose — change OPEN_PORT_ROUND_TRIP_MARGIN_MS and this sentence is wrong with nothing to catch it.

Suggested change

	/// Budget for either port command over `count` ids, including 1 s for IPC. The sidecar runs two
	/// Budget for either port command over `count` ids, plus `OPEN_PORT_ROUND_TRIP_MARGIN_MS` for IPC. The sidecar runs two

[dormouse-bot]

Feedback on work in progress — not a merge verdict; mark the PR ready when you want the full one.

The deadline gap from the last round is closed on the arithmetic: all three Windows subprocesses now draw on one openPortScanTimeoutMs(count), so the worst case is 2 × OPEN_PORT_TIMEOUT_MS + count × OPEN_PORT_TIMEOUT_PER_ID_MS on every platform, matching what docs/specs/transport.md → "Port scan deadlines" now states. Both new tests discriminate the change — the budget test pins the exact remaining-time sequence [3000, budget, budget − 500, budget − 1500], and the exhaustion test pins that netstat is never spawned. node --test standalone/sidecar/pty-core.test.js is green (101/101), and pnpm lint:specs passes on the head once AGENTS.md is read from the PR rather than the base-restored worktree copy.

One point inline is about what sharing the budget does to the fallback order; the second is a naming collision.

One smaller thing, outside the hunks: the netstat call in windowsListeningPorts still passes timeout: OPEN_PORT_TIMEOUT_MS in its options literal, which execFileSyncFn now always overwrites with remaining. It is the one place a reader would look to check the new rule, and it reads as the old flat 3 s — worth deleting so the options object doesn't contradict the comment above it.

[dormouse-bot]

Feedback on work in progress — not a merge verdict; mark the PR ready when you want the full one.

The reorder closes the ordering point from the last round, and both tests discriminate it: the budget test's [3000, budget, budget − 1000, budget − 1500] sequence only holds if Get-NetTCPConnection draws on the scan allowance first, and the new test pins that a name lookup consuming the entire remainder still returns the port that was already enumerated. node --test standalone/sidecar/pty-core.test.js is green (102/102), and pnpm lint:specs passes on the head once AGENTS.md is read from the PR rather than the base-restored worktree copy.

One point inline, about what the reorder left behind at the two parse calls.

[dormouse-bot]

nameByPid can no longer hold anything at either parse call — it is built empty on the line above and populated only after both, so processName comes entirely from the .map at the end. Threading it in tells a reader checking whether the netstat path gets names the opposite of what happens, on the one function whose subject is now the order these steps run in. Both parameters default to new Map(), so dropping them is a no-op, and the const nameByPid = new Map() above can move down beside the lookup that fills it.

The same hunk dropped windowsHide's reason on the netstat call. It is the one option here whose deletion reintroduces a deadlock rather than a slowdown, and it went as collateral in a commit that only meant to remove the timeout beside it.

Suggested change

	ports = parseNetTcpConnections(json, pidSet, nameByPid);
	} catch {
	return [];
	try {
	const out = execFileSyncFn('netstat', ['-ano', '-p', 'TCP'], {
	encoding: 'utf-8',
	stdio: ['ignore', 'pipe', 'ignore'],
	windowsHide: true,
	});
	ports = parseNetstatListening(out, pidSet, nameByPid);
	ports = parseNetTcpConnections(json, pidSet);
	} catch {
	try {
	const out = execFileSyncFn('netstat', ['-ano', '-p', 'TCP'], {
	encoding: 'utf-8',
	stdio: ['ignore', 'pipe', 'ignore'],
	windowsHide: true, // see runPowerShell: avoid the console-allocation deadlock
	});
	ports = parseNetstatListening(out, pidSet);