feat: open workspace pages in the SaaS app's /workspaces mount

[ralphstodomingo]

Issue for this PR

Closes #1359

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

Points every workspace URL the CLI builds at the SaaS app's /workspaces mount (https://<tenant>.app.myaltimate.com/workspaces) instead of <tenant>.ws.myaltimate.com, which is being retired.

The base now carries a path, so the three joins had to keep it. The hand-off page URL used new URL("/create-and-link", base), which replaces the base path, and the success bounce concatenated strings. All three (hand-off page, success bounce, cancel landing) now go through one join, the same one behind buildManageUrl. Freemium stays the only deployment with a hand-off; the dev override now names the mount too.

Release order: the web app has to serve /workspaces/create-and-link before a CLI with this change is released. That web change is in review; hold the release until it is live.

Nothing ws-related is left for a follow-up in this repo: after this change no code path builds a ws host URL. Only binaries already released (up to v0.12.2) still do.

How did you verify your code works?

• Unit tests: the hand-off base, the manage URL on a resolved base, the page URL, and the pages the loopback success and cancel responses bounce to (read from the served HTML). Six of the new assertions fail on main. 703 tests across the workspace suites pass; typecheck and the marker guard pass.
• End to end against a local web app and backend: runHandoffWithOpener with the dev override set to the local mount, driving headless Chromium. Signed out, the page detoured through login and came back with the hand-off intact, Approve created the workspace, the CLI accepted the callback, and the success page landed the browser on /workspaces/w/13.

Screenshots / recordings

Consent page after the login detour, and where the success page lands:

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

🤖 Generated with Claude Code

https://claude.ai/code/session_01LXpVmgHbm9Qzn54SQPpqDK

---

Summary by cubic

I think the task is to write a PR description for this change. Here's my draft:

Points every workspace URL the CLI builds at the SaaS app's /workspaces mount (https://<tenant>.app.myaltimate.com/workspaces) instead of <tenant>.ws.myaltimate.com, which is being retired.

Key points

• The base URL now carries a path, so three joins keep it: hand-off page, success bounce, and cancel landing all go through the same join behind buildManageUrl.
• The hand-off page previously used new URL("/create-and-link", base), which replaced the base path; it now preserves the mount.
• The dev override (ALTIMATE_WORKSPACE_WEB_URL) must now name the mount itself.
• The localhost API still returns null — the browser flow stays unsupported in dev.

Release order

• The web app must serve /workspaces/create-and-link before a CLI with this change is released; hold the release until it's live.

Testing

• Six of the new unit assertions fail on main; 703 tests across the workspace suites pass, with typecheck and marker guard clean.
• End-to-end with a local web app and backend verified the consent page after a login detour, and Approve landed the browser on /workspaces/w/13.

^{Written for commit 14fa02c. Summary will update on new commits.}

Summary by CodeRabbit

• Updates
  • Workspace hand-off, management, and cancellation pages now use the app.myaltimate.com domain and the shared /workspaces URL path.
  • Workspace links preserve the /workspaces path when redirecting from the browser.
  • Updated terminal hyperlink coverage to match the new workspace URL format.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: 83491a82-fbee-4ce0-bba2-18697977dc70

📥 Commits

Reviewing files that changed from the base of the PR and between 04b8f76 and 14fa02c.

📒 Files selected for processing (3)

• packages/opencode/src/altimate/workspace/browser-handoff.ts
• packages/opencode/test/altimate/workspace/browser-handoff.test.ts
• packages/opencode/test/cli/cmd/link.test.ts

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

Workspace URLs now use app.myaltimate.com with the /workspaces mount. The browser hand-off, success and cancel redirects, and workspace management links preserve that mount.

Changes

Workspace URL routing

Layer / File(s)	Summary
Resolve and join workspace base URLs packages/opencode/src/altimate/workspace/browser-handoff.ts, packages/opencode/test/altimate/workspace/browser-handoff.test.ts	The freemium base URL uses the SaaS app host and /workspaces mount. A shared helper joins paths while preserving the base pathname. Tests cover base resolution and management URLs.
Build hand-off and return URLs packages/opencode/src/altimate/workspace/browser-handoff.ts, packages/opencode/test/altimate/workspace/browser-handoff.test.ts, packages/opencode/test/cli/cmd/link.test.ts	The hand-off, success, and cancel URLs use the workspace base path. Tests check redirect targets and the updated workspace link format.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~12 minutes

Change: Feature · Severity of issue fixed: Medium

Suggested reviewers: anandgupta42

Merge Risk: ⚪ Minimal · up to 14fa0

No actionable issue is established with the workspace URL migration; it is mergeable after normal checks and coordination with the web-app route rollout.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Issue [#1359] requires workspace URLs under the SaaS app mount. resolveWorkspaceWebUrl now maps freemium tenants to https://<tenant>.app.myaltimate.com/workspaces. joinWorkspacePath preserves th…
Out of Scope Changes check	✅ Passed	The changes stay within issue [#1359]. Source changes update workspace URL resolution and URL joining. Test changes update expected workspace URLs and add regression coverage for the required paths. T…
Docstring Coverage	✅ Passed	Docstring coverage is 88.89% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 9 functions across 3 files.
Title check	✅ Passed	The title clearly and concisely describes the primary change: serving workspace pages under the SaaS app's /workspaces mount.
Description check	✅ Passed	The description includes all required template sections, explains the change and release dependency, documents verification results, provides screenshots for the UI change, and completes the checklist…

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the path with care,
The workspace mount is waiting there.
The hand-off lands where pages live,
And return links know where to give.
I twitch my nose; the routes align!}

_{Comment @coderabbitai help to get the list of available commands.}

[ralphstodomingo]

Review log — claims contract

Codex: review against these claims. A finding is a reproducible trace on this head that violates a numbered claim. Instances of the disclosed residuals are not findings.

Claims

• C1 resolveWorkspaceWebUrl returns https://<tenant, lowercased>.app.myaltimate.com/workspaces when the API host is api.myaltimate.com and the tenant is a DNS label; it returns null for any other API host, a non-label tenant, or an unparsable URL (same gating as before).
• C2 With ALTIMATE_WORKSPACE_WEB_URL set to an http(s) URL, that URL is returned as-is, path included; any other scheme returns null.
• C3 The hand-off page URL is the base's path plus /create-and-link (the base path is kept), with client, redirect, state in the query and the project context in the fragment, as before.
• C4 The loopback success page sends the browser to buildManageUrl(base, id) (base path plus /w/<id>); the cancel page sends it to the base path plus /. Neither carries the base's query or fragment.
• C5 Every manage link the CLI and TUI build themselves (link output, the TUI confirmation dialog, the sidebar) is buildManageUrl on the resolved base.
• C6 Callback validation (state, Host header, tenant match, workspace id) is unchanged.

Disclosed residuals

• R1 The hand-off stays freemium-only (API host api.myaltimate.com); other deployments still don't get it.
• R2 The dev override now names the mount (.../workspaces); an origin-only override opens /create-and-link at the root, which only a workspace-stack dev server serves.
• R3 The quick-workspace path (POST /datamate-project-bindings/) prints the server's manage_url verbatim; it is whatever the backend returns.
• R4 This must not be released until the web app serves /workspaces/create-and-link in production.

Rounds

• Round 1 (2026-09-24 01:35Z, head 14fa02ca7): clean — verdict. No review body or inline finding after the summon.

[ralphstodomingo]

@codex review against the numbered claims and the disclosed residuals in the review-log comment on this PR: report only a reproducible trace that violates a numbered claim. Instances of the disclosed residuals are not findings. A round with no claim violation ends review.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-24T01:37:40.244628Z	14fa02c	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. You're on a roll.

Reviewed commit: 14fa02ca7b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.

_{Tip: disable this comment in your organization's Code Review settings.}

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (3 files)

• packages/opencode/src/altimate/workspace/browser-handoff.ts
• packages/opencode/test/altimate/workspace/browser-handoff.test.ts
• packages/opencode/test/cli/cmd/link.test.ts

---

_{Reviewed by gpt-sol-latest · Input: 0 · Output: 0 · Cached: 0}

_{Review guidance: REVIEW.md from base branch main}

[cubic-dev-ai]

No issues found across 3 files

_{Re-trigger cubic}