Fix/qa defects df002 df011 (#9)

## Summary

What changed and why?

## Change Type

- [ ] Cowork feature
- [ ] Bug fix
- [ ] Core AI contribution
- [ ] Test / hardening
- [ ] Performance
- [ ] Documentation

## Related Work

Cowork Task:

Core Repo: http://34.143.229.138/gitea-admin/fsg-ai-core-assets

Core AI Issue:

Core Task:

Related PR:

## Scope

What is intentionally included?

What is intentionally NOT included?

## Validation

- [ ] Unit tests
- [ ] Integration tests
- [ ] Manual verification
- [ ] Regression check

Commands / evidence:

## Security Impact

Permission / credential / network / customer data impact:

## Compatibility

- [ ] No breaking change
- [ ] Breaking change documented

## Reviewer Notes

Anything Cowork reviewers should pay attention to.

---------

Co-authored-by: thanhnv <thanhnv.ip@gmail.com>
Co-authored-by: Vu Dam Tuan <vudt15@fpt.com>
Reviewed-on: #9

core/cloud_workspace_sync.py

@@ -0,0 +1,114 @@
+"""Mirror a OneDrive/SharePoint folder to/from a local directory (DF-007).
+
+This is deliberately NOT a general sync engine: every existing tool
+(``run_command``, ``read_file``, ``write_file``...) operates on a real local
+``Path`` (``Project.output_dir`` — see ``core/projects.py::Project.workspace_dir``),
+and that contract does not change here. A cloud-backed project's
+``output_dir`` still points at a real local folder; this module only knows how
+to pull that folder's content down from Graph once, and push it back up once,
+both on explicit user action (a button click) — there is no background
+watcher, no continuous sync, no delete propagation, and no conflict
+resolution beyond "whichever side ran last wins" for a given file. See the
+DF-007 plan for why: OneDrive/SharePoint sync-client detection is unreliable,
+so a local mirror + manual sync is the only predictable option that does not
+touch the sandboxed command/file tools.
+"""
+from __future__ import annotations
+
+import os
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Dict, List
+
+from . import ms365_graph as graph
+
+
+@dataclass
+class SyncReport:
+    """Kết quả một lượt tải xuống/đẩy lên — hiển thị cho người dùng sau khi chạy."""
+    transferred: int = 0
+    skipped_too_large: List[str] = field(default_factory=list)
+    errors: List[str] = field(default_factory=list)
+
+
+def _list_children(token: str, cloud_source: Dict[str, str], remote_path: str) -> List[dict]:
+    provider = cloud_source.get("provider")
+    if provider == "sharepoint":
+        return graph.list_sharepoint_files(token, cloud_source["site_id"], remote_path)
+    return graph.list_onedrive_files(token, remote_path)
+
+
+def _download_file(token: str, cloud_source: Dict[str, str], remote_path: str) -> bytes:
+    if cloud_source.get("provider") == "sharepoint":
+        return graph.download_sharepoint_file_bytes(token, cloud_source["site_id"], remote_path)
+    return graph.download_onedrive_file_bytes(token, remote_path)
+
+
+def _upload_file(token: str, cloud_source: Dict[str, str], remote_path: str, data: bytes) -> None:
+    if cloud_source.get("provider") == "sharepoint":
+        graph.upload_sharepoint_file_bytes(token, cloud_source["site_id"], remote_path, data)
+    else:
+        graph.upload_onedrive_file_bytes(token, remote_path, data)
+
+
+def download_folder(token: str, cloud_source: Dict[str, str], local_dir: Path) -> SyncReport:
+    """Tải toàn bộ cây thư mục ``cloud_source['remote_path']`` xuống ``local_dir``,
+    giữ nguyên cấu trúc thư mục con. Ghi đè file local nếu đã tồn tại (một
+    chiều: cloud thắng). Không xoá file local nào không còn ở phía cloud."""
+    report = SyncReport()
+    root_remote = cloud_source.get("remote_path", "")
+    local_dir.mkdir(parents=True, exist_ok=True)
+
+    def _walk(remote_path: str, local_sub: Path) -> None:
+        try:
+            children = _list_children(token, cloud_source, remote_path)
+        except graph.Ms365GraphError as exc:
+            report.errors.append(f"{remote_path or '/'}: {exc}")
+            return
+        for item in children:
+            name = item.get("name", "")
+            if not name:
+                continue
+            child_remote = f"{remote_path}/{name}" if remote_path else name
+            child_local = local_sub / name
+            if "folder" in item:
+                child_local.mkdir(parents=True, exist_ok=True)
+                _walk(child_remote, child_local)
+            else:
+                try:
+                    data = _download_file(token, cloud_source, child_remote)
+                    child_local.write_bytes(data)
+                    report.transferred += 1
+                except graph.Ms365GraphError as exc:
+                    report.errors.append(f"{child_remote}: {exc}")
+
+    _walk(root_remote, local_dir)
+    return report
+
+
+def upload_folder(token: str, cloud_source: Dict[str, str], local_dir: Path) -> SyncReport:
+    """Đẩy mọi file dưới ``local_dir`` lên đúng đường dẫn tương ứng phía cloud
+    (tạo mới hoặc ghi đè). Một chiều: local thắng cho từng file được duyệt qua.
+    Không xoá file cloud nào đã bị xoá ở local, không phát hiện xung đột."""
+    report = SyncReport()
+    root_remote = cloud_source.get("remote_path", "")
+    local_dir = Path(local_dir)
+    for dirpath, _dirnames, filenames in os.walk(local_dir):
+        rel_dir = Path(dirpath).relative_to(local_dir)
+        for fname in filenames:
+            local_file = Path(dirpath) / fname
+            rel_parts = [] if str(rel_dir) == "." else list(rel_dir.parts)
+            rel_parts.append(fname)
+            child_remote = "/".join(([root_remote] if root_remote else []) + rel_parts)
+            try:
+                data = local_file.read_bytes()
+                _upload_file(token, cloud_source, child_remote, data)
+                report.transferred += 1
+            except graph.Ms365GraphError as exc:
+                if "too large" in str(exc):
+                    report.skipped_too_large.append(child_remote)
+                else:
+                    report.errors.append(f"{child_remote}: {exc}")
+            except OSError as exc:
+                report.errors.append(f"{child_remote}: {exc}")
+    return report

core/ms365_graph.py

@@ -196,6 +196,40 @@ def write_onedrive_file(token: str, path: str, content: str) -> dict:
     return resp.json()
 
 
+# Graph's "simple upload" (a single PUT to .../content) is documented to only
+# support items up to 4 MiB; anything larger needs a chunked "upload session"
+# (createUploadSession + PUT-per-range), which this module does not implement
+# (see DF-007 cloud workspace picker — v1 explicitly skips large files rather
+# than silently truncating or corrupting them).
+MAX_SIMPLE_UPLOAD_BYTES = 4 * 1024 * 1024
+
+
+def _check_upload_size(data: bytes) -> None:
+    if len(data) > MAX_SIMPLE_UPLOAD_BYTES:
+        raise Ms365GraphError(
+            f"File too large for simple upload ({len(data)} bytes > "
+            f"{MAX_SIMPLE_UPLOAD_BYTES} bytes) — chunked upload sessions are not "
+            "implemented yet."
+        )
+
+
+def download_onedrive_file_bytes(token: str, path: str) -> bytes:
+    """Đọc RAW BYTES một tệp OneDrive (không ép UTF-8/không cắt) — dùng cho
+    mirror thư mục cloud xuống local, khác với :func:`read_onedrive_file` vốn
+    chỉ dành cho việc đọc nội dung văn bản vào ngữ cảnh chat."""
+    resp = _request("GET", f"/me/drive/root:/{_path_segment(path)}:/content", token)
+    return resp.content
+
+
+def upload_onedrive_file_bytes(token: str, path: str, data: bytes) -> dict:
+    """Ghi RAW BYTES vào một tệp OneDrive (tạo mới hoặc ghi đè). Xem
+    :data:`MAX_SIMPLE_UPLOAD_BYTES`."""
+    _check_upload_size(data)
+    resp = _request("PUT", f"/me/drive/root:/{_path_segment(path)}:/content", token,
+                     data=data, headers={"Content-Type": "application/octet-stream"})
+    return resp.json()
+
+
 def _encode_share_url(url: str) -> str:
     """Encode a OneDrive/SharePoint sharing URL into Graph's ``u!<base64url>``
     share-id form (see Microsoft's 'Get access to shared items' docs)."""
@@ -229,6 +263,24 @@ def list_sharepoint_files(token: str, site_id: str, path: str = "") -> List[dict
     return resp.json().get("value", [])
 
 
+def download_sharepoint_file_bytes(token: str, site_id: str, path: str) -> bytes:
+    """Đọc RAW BYTES một tệp trong thư viện tài liệu SharePoint — xem
+    :func:`download_onedrive_file_bytes`."""
+    resp = _request(
+        "GET", f"/sites/{quote(site_id)}/drive/root:/{_path_segment(path)}:/content", token)
+    return resp.content
+
+
+def upload_sharepoint_file_bytes(token: str, site_id: str, path: str, data: bytes) -> dict:
+    """Ghi RAW BYTES vào một tệp trong thư viện tài liệu SharePoint. Xem
+    :data:`MAX_SIMPLE_UPLOAD_BYTES`."""
+    _check_upload_size(data)
+    resp = _request(
+        "PUT", f"/sites/{quote(site_id)}/drive/root:/{_path_segment(path)}:/content", token,
+        data=data, headers={"Content-Type": "application/octet-stream"})
+    return resp.json()
+
+
 # ---- Teams meeting transcripts ------------------------------------------
 def find_online_meeting(token: str, join_url: str) -> List[dict]:
     """Tìm cuộc họp online theo link tham gia."""

core/projects.py

@@ -65,6 +65,13 @@ class Project:
     #   auto_run: None → follow the global agent_security.cowork_confirm_commands;
     #     True → auto-approve commands (no confirm); False → always confirm.
     auto_run: Optional[bool] = None
+    # {} = an ordinary local/managed workspace. Non-empty when ``output_dir``
+    # is a LOCAL MIRROR of a OneDrive/SharePoint folder (see
+    # core/cloud_workspace_sync.py) — {"provider": "onedrive"|"sharepoint",
+    # "site_id": "", "site_name": "", "remote_path": ""}. ``output_dir`` itself
+    # always stays a real local path; nothing that reads ``workspace_dir()``
+    # needs to change because of this field.
+    cloud_source: Dict[str, str] = field(default_factory=dict)
 
     def workspace_dir(self, base: Path = None) -> Path:
         """The project's sandbox root. Every chat of the project writes inside