feat(workspace): expose /workspace Refresh and Sync over serve HTTP

packages/opencode/src/altimate/workspace/manage.ts

@@ -33,6 +33,7 @@ import {
   peekRowUnscoped,
   readLocalBinding,
   resolveBinding,
+  resolvePinnedBindingForRouting,
   type CachedBinding,
 } from "./state"
 
@@ -81,7 +82,7 @@ export interface SyncReport {
    * and only one of them is the workspace's memory toggle; a toast that said
    * "memory is off" for a failed local read sent the user to a setting that was
    * fine. */
-  gatedBecause?: "flag-off" | "no-binding" | "memory-off" | "read-failed"
+  gatedBecause?: "flag-off" | "no-binding" | "pin-unresolved" | "memory-off" | "read-failed"
   sent: number
   failed: number
   /** Already present in the workspace at their current payload. */
@@ -226,7 +227,15 @@ export async function sync(directory: string): Promise<SyncReport> {
     deferred: 0,
   })
   if (!MemorySync.isEnabled()) return gated("flag-off")
-  const binding = await readLocalBinding(directory).catch(() => null)
+  // altimate_change — the IDE extension's pin outranks the project's own link, as it does for
+  // the per-write mirror (`memory-sync.resolveBinding`). Without it an extension-launched `serve`
+  // answered "not linked" for the workspace it was pinned to. Only the pin arm is layered, so an
+  // unpinned session keeps the cache-only read, and a pin that cannot be honoured stays gated —
+  // under its own reason, since "nothing is linked" would misdescribe a workspace that exists —
+  // rather than falling through to the project's link.
+  const pinned = await resolvePinnedBindingForRouting(directory).catch(() => ({ status: "unknown" as const }))
+  if (pinned && pinned.status !== "bound") return gated("pin-unresolved")
+  const binding = pinned ? pinned.binding : await readLocalBinding(directory).catch(() => null)
   if (!binding) return gated("no-binding")
 
   const blocks = await MemoryStore.listAll({ directory }).catch((err) => {

packages/opencode/src/plugin/tui/altimate/workspace.tsx

@@ -1789,6 +1789,8 @@ function syncMessage(result: Manage.SyncReport): string {
         return "Could not read this project's local memory, so nothing was synced."
       case "no-binding":
         return "Nothing to sync — this project is not linked to a workspace."
+      case "pin-unresolved":
+        return "Nothing to sync — the pinned workspace could not be confirmed for this project."
       case "flag-off":
         return "Nothing to sync — workspace memory is not enabled in this build."
       default:

packages/opencode/src/server/server.ts

@@ -45,6 +45,10 @@ import { FreeTierConsent } from "../altimate/free/consent"
 import { InstanceStore } from "@/project/instance-store"
 import { AppRuntime } from "@/effect/app-runtime"
 // altimate_change end
+// altimate_change - `/workspace` Refresh and Sync: pilot flag gate, and the session-directory check
+import { Flag as CoreFlag } from "@opencode-ai/core/flag/flag"
+import nodePath from "node:path"
+import { Session } from "../session"
 // altimate_change end
 import { FileRoutes } from "./routes/file"
 import { ConfigRoutes } from "./routes/config"
@@ -71,6 +75,51 @@ globalThis.AI_SDK_LOG_WARNINGS = false
 
 export namespace Server {
   const log = Log.create({ service: "server" })
+  // altimate_change start — shared gate for the `/altimate/workspace/*` routes
+  /** Why a `/workspace` action must not run, or undefined when it may.
+   *
+   * 409 is reserved for the pilot gate, so a caller can tell "this server is not in workspace mode"
+   * apart from a bad request (400) without parsing the message.
+   *
+   * Outside the workspace pilot a skill sync purges the snapshot, so the flag is checked first.
+   * A browser origin on an unsecured server is refused for the same reason as Altimate Base
+   * registration: a CORS-allowed page is not a local process. Native clients (the extension host,
+   * curl) send no Origin. With a server password set, a same-origin page may call; others may not. */
+  export function workspaceRouteRefusal(
+    origin: string | undefined,
+    host: string | undefined,
+    password: string | undefined = Flag.OPENCODE_SERVER_PASSWORD,
+  ): { status: 403 | 409; body: { ok: false; error: string } } | undefined {
+    if (!CoreFlag.ALTIMATE_WORKSPACE) {
+      return { status: 409, body: { ok: false, error: "Workspace mode is not enabled for this server." } }
+    }
+    if (!origin) return undefined
+    if (!password) {
+      log.warn("refused browser-originated workspace action on an unsecured server", { origin })
+      return {
+        status: 403,
+        body: {
+          ok: false,
+          error: "Workspace actions cannot be run from a browser origin on an unsecured server. Set OPENCODE_SERVER_PASSWORD.",
+        },
+      }
+    }
+    // With a password set, basicAuth has vetted the credentials — but a browser replays cached
+    // Basic credentials on a cross-site form POST too, so only this server's own pages may call.
+    if (!sameOrigin(origin, host)) {
+      log.warn("refused cross-origin workspace action", { origin })
+      return { status: 403, body: { ok: false, error: "Workspace actions cannot be run from another origin." } }
+    }
+    return undefined
+  }
+  export function sameOrigin(origin: string, host: string | undefined): boolean {
+    try {
+      return !!host && new URL(origin).host === host
+    } catch {
+      return false
+    }
+  }
+  // altimate_change end
   // altimate_change start — the Base credential every provider cache in this process is known to
   // reflect: set after the register route has disposed both registries for it. Unset until then,
   // because a cache built before a background registration finished cannot be told apart from one
@@ -949,6 +998,88 @@ export namespace Server {
         }
       })
       // altimate_change end
+      // altimate_change start — POST /altimate/workspace/{refresh,sync}
+      // The `/workspace` menu's Refresh and Sync for the IDE extension, which runs this CLI
+      // headless and cannot reach the TUI slash command. Both act on the request's instance
+      // directory and return the `Manage` report as is; wording is the caller's job.
+      .post("/altimate/workspace/refresh", async (c) => {
+        const refused = workspaceRouteRefusal(c.req.header("origin"), c.req.header("host"))
+        if (refused) return c.json(refused.body, refused.status)
+        // An absent or empty body is a session-less refresh; anything else must be well formed.
+        // Falling back to "no session" on bad input would silently widen the operation to
+        // resetting every session's memory overlay.
+        let text: string
+        try {
+          text = await c.req.text()
+        } catch (err) {
+          const error = err instanceof Error ? err.message : String(err)
+          log.error("workspace refresh: could not read the request body", { error })
+          return c.json({ ok: false, error }, 500)
+        }
+        let body: unknown = {}
+        if (text.trim()) {
+          try {
+            body = JSON.parse(text)
+          } catch {
+            return c.json({ ok: false, error: "Request body is not valid JSON." }, 400)
+          }
+        }
+        if (body === null || typeof body !== "object" || Array.isArray(body)) {
+          return c.json({ ok: false, error: "Request body must be a JSON object." }, 400)
+        }
+        const raw = (body as Record<string, unknown>).sessionID
+        if (raw !== undefined && (typeof raw !== "string" || !raw)) {
+          return c.json({ ok: false, error: "sessionID must be a non-empty string." }, 400)
+        }
+        const sessionID = raw as string | undefined
+        // The memory reload loads THIS directory's workspace memory into the named session, so the
+        // session must be one of this directory's; another project's would receive it.
+        if (sessionID) {
+          // `Session.get` validates the id synchronously, so the call is deferred into the promise
+          // chain for a malformed id to land in the handler below rather than escape the route.
+          const session = await Promise.resolve()
+            .then(() => Session.get(sessionID as never))
+            .catch((err) => err as Error)
+          if (session instanceof NotFoundError) {
+            return c.json({ ok: false, error: `Session not found: ${sessionID}` }, 404)
+          }
+          if (session instanceof z.ZodError) {
+            return c.json({ ok: false, error: `Invalid sessionID: ${sessionID}` }, 400)
+          }
+          if (session instanceof Error) {
+            log.error("workspace refresh: session lookup failed", { error: session.message })
+            return c.json({ ok: false, error: session.message }, 500)
+          }
+          if (nodePath.resolve(session.directory) !== nodePath.resolve(Instance.directory)) {
+            return c.json({ ok: false, error: "That session belongs to a different project directory." }, 400)
+          }
+        }
+        try {
+          const Manage = await import("../altimate/workspace/manage")
+          // A changed skill snapshot reaches the registry at the start of the next turn
+          // (`refreshSkillRegistry` in session/prompt.ts), so nothing is invalidated here.
+          const report = await Manage.refresh(Instance.directory, sessionID)
+          return c.json({ ok: true as const, ...report })
+        } catch (err) {
+          const error = err instanceof Error ? err.message : String(err)
+          log.error("workspace refresh: failed", { error })
+          return c.json({ ok: false, error }, 500)
+        }
+      })
+      .post("/altimate/workspace/sync", async (c) => {
+        const refused = workspaceRouteRefusal(c.req.header("origin"), c.req.header("host"))
+        if (refused) return c.json(refused.body, refused.status)
+        try {
+          const Manage = await import("../altimate/workspace/manage")
+          const report = await Manage.sync(Instance.directory)
+          return c.json({ ok: true as const, ...report })
+        } catch (err) {
+          const error = err instanceof Error ? err.message : String(err)
+          log.error("workspace sync: failed", { error })
+          return c.json({ ok: false, error }, 500)
+        }
+      })
+      // altimate_change end
       .all("/*", async (c) => {
         const path = c.req.path
 

packages/opencode/test/altimate/workspace/manage-pin.test.ts

@@ -0,0 +1,157 @@
+// altimate_change - new file
+//
+// `/workspace` Sync follows the IDE extension's pin. `Manage.sync` read only the on-disk link, so a
+// `serve` pinned by the extension answered "not linked" for the workspace it was pinned to, while
+// the per-write mirror (which resolves through the pin) sent to it. These cover which binding the
+// sweep runs against; the sweep itself is covered by manage.test.ts and memory-sync.test.ts.
+import { afterAll, afterEach, beforeEach, describe, expect, test } from "bun:test"
+import { mkdirSync, rmSync } from "node:fs"
+import path from "node:path"
+import os from "node:os"
+
+const ORIGINAL_XDG_STATE_HOME = process.env.XDG_STATE_HOME
+const ORIGINAL_PILOT = process.env.ALTIMATE_WORKSPACE
+const SANDBOX = path.join(os.tmpdir(), `altimate-manage-pin-test-${process.pid}-${Date.now()}`)
+mkdirSync(path.join(SANDBOX, "state"), { recursive: true })
+process.env.XDG_STATE_HOME = path.join(SANDBOX, "state")
+
+const { recordApprovedBinding, __resetPinValidation } = await import("../../../src/altimate/workspace/state")
+const { sync } = await import("../../../src/altimate/workspace/manage")
+const { resetEnablementMemoForTests } = await import("../../../src/altimate/workspace/memory-sync")
+const { AltimateApi } = await import("../../../src/altimate/api/client")
+const { WorkspaceApi } = await import("../../../src/altimate/workspace/api-client")
+
+const ROOT = path.join(SANDBOX, "project")
+const OUTSIDE = path.join(SANDBOX, "elsewhere")
+mkdirSync(ROOT, { recursive: true })
+mkdirSync(OUTSIDE, { recursive: true })
+
+const originalIsConfigured = AltimateApi.isConfigured
+const originalGetCreds = AltimateApi.getCredentials
+const originalList = WorkspaceApi.listDatamates
+type Creds = Awaited<ReturnType<typeof AltimateApi.getCredentials>>
+
+const PIN_VARS = [
+  "ALTIMATE_CODE_SERVE",
+  "ALTIMATE_PINNED_WORKSPACE_ID",
+  "ALTIMATE_PINNED_WORKSPACE_NAME",
+  "ALTIMATE_PINNED_WORKSPACE_ROOT",
+]
+// Restored in `afterAll`: `bun test` shares one process, and later files must see the pin they had.
+const ORIGINAL_PIN = Object.fromEntries(PIN_VARS.map((k) => [k, process.env[k]]))
+const originalFetch = globalThis.fetch
+
+/** The pinned workspace has memory ON and the project's own link has it OFF, so the gate reason
+ * says which of the two the sweep ran against. */
+const WORKSPACES = [
+  { id: 42, name: "pinned-workspace", memoryEnabled: true },
+  { id: 7, name: "project-link", memoryEnabled: false },
+]
+
+function setPin(id = "42") {
+  process.env.ALTIMATE_CODE_SERVE = "1"
+  process.env.ALTIMATE_PINNED_WORKSPACE_ID = id
+  process.env.ALTIMATE_PINNED_WORKSPACE_NAME = "pinned-workspace"
+  process.env.ALTIMATE_PINNED_WORKSPACE_ROOT = ROOT
+}
+
+function clearPin() {
+  for (const k of PIN_VARS) delete process.env[k]
+}
+
+async function seedLocalLink(directory = ROOT) {
+  // Awaited, so the bind's skill sync and memory backfill finish inside this test's stubbed
+  // `fetch` instead of straddling `afterEach` into another file's request log.
+  await recordApprovedBinding(
+    directory,
+    {
+      datamateId: 7,
+      datamateName: "project-link",
+      linkedAt: Date.now(),
+      repoRemote: "git@example.com:acme/project.git",
+      projectPath: null,
+    } as never,
+    { awaitBackfill: true },
+  )
+}
+
+beforeEach(() => {
+  process.env.ALTIMATE_WORKSPACE = "1"
+  __resetPinValidation()
+  resetEnablementMemoForTests()
+  ;(AltimateApi as unknown as { isConfigured: () => Promise<boolean> }).isConfigured = async () => true
+  ;(AltimateApi as unknown as { getCredentials: () => Promise<Creds> }).getCredentials = async () =>
+    ({ altimateInstanceName: "acme", altimateUrl: "https://api.test", altimateApiKey: "k" }) as Creds
+  ;(WorkspaceApi as unknown as { listDatamates: () => Promise<unknown> }).listDatamates = async () => WORKSPACES
+  clearPin()
+  globalThis.fetch = (async (_input: unknown, _init?: unknown) =>
+    new Response(JSON.stringify({}), { status: 200, headers: { "content-type": "application/json" } })) as typeof fetch
+})
+
+afterEach(() => {
+  clearPin()
+  globalThis.fetch = originalFetch
+})
+
+afterAll(() => {
+  ;(AltimateApi as unknown as { isConfigured: typeof originalIsConfigured }).isConfigured = originalIsConfigured
+  ;(AltimateApi as unknown as { getCredentials: typeof originalGetCreds }).getCredentials = originalGetCreds
+  ;(WorkspaceApi as unknown as { listDatamates: typeof originalList }).listDatamates = originalList
+  if (ORIGINAL_XDG_STATE_HOME === undefined) delete process.env.XDG_STATE_HOME
+  else process.env.XDG_STATE_HOME = ORIGINAL_XDG_STATE_HOME
+  if (ORIGINAL_PILOT === undefined) delete process.env.ALTIMATE_WORKSPACE
+  else process.env.ALTIMATE_WORKSPACE = ORIGINAL_PILOT
+  for (const [k, v] of Object.entries(ORIGINAL_PIN)) {
+    if (v === undefined) delete process.env[k]
+    else process.env[k] = v
+  }
+  rmSync(SANDBOX, { recursive: true, force: true })
+})
+
+describe("sync under an IDE pin", () => {
+  test("runs against the pinned workspace in a project that was never linked", async () => {
+    setPin()
+    const report = await sync(ROOT)
+    expect(report.gated).toBe(false)
+    expect(report.gatedBecause).toBeUndefined()
+  })
+
+  test("the pin outranks the project's own link", async () => {
+    await seedLocalLink()
+    setPin()
+    // The local link (7) has memory off and would gate; the pin (42) has it on.
+    expect((await sync(ROOT)).gated).toBe(false)
+  })
+
+  test("a pin naming a workspace this account cannot see fails closed, not onto the local link", async () => {
+    await seedLocalLink()
+    setPin("99")
+    const report = await sync(ROOT)
+    expect(report.gated).toBe(true)
+    // Its own reason: the project IS linked (to 7), so "no-binding" would misdescribe it.
+    expect(report.gatedBecause).toBe("pin-unresolved")
+  })
+
+  test("a directory outside the pinned root is not treated as pinned", async () => {
+    setPin()
+    const report = await sync(OUTSIDE)
+    expect(report.gated).toBe(true)
+    expect(report.gatedBecause).toBe("pin-unresolved")
+  })
+})
+
+describe("sync without a pin", () => {
+  test("still reads the project's own link", async () => {
+    await seedLocalLink()
+    const report = await sync(ROOT)
+    // Reached the sweep with link 7, whose memory is off.
+    expect(report.gated).toBe(true)
+    expect(report.gatedBecause).toBe("memory-off")
+  })
+
+  test("an unlinked project is still gated on the missing binding", async () => {
+    // A directory no test links: the binding cache is process-memoized, so `ROOT` may still hold one.
+    const report = await sync(OUTSIDE)
+    expect(report.gatedBecause).toBe("no-binding")
+  })
+})