fix(qa): resolve DF-002 through DF-011 from QA defect tracking sheet

Batch of fixes for defects tracked in "Task Tracking Template.xlsx" (sheet
Defect Management), verified against the sheet's Root Cause/Cach xu ly
columns before this commit:

- DF-002: Co4E node status not reflected after tab switch + missing
  edit-lock on running/done nodes (node_property_panel.py, co4e_runs.py,
  co4e_workflow_crud.py, co4e_canvas_widget.py, co4e_flow_tabs.py,
  canvas_items.py)
- DF-003: hide the run.bat console window unless the app exits with an
  error (run.bat, scripts/console_visibility.ps1 - new)
- DF-004: floating Help Assistant icon covering the Send button after a
  window resize (presentation/shell/main_window.py)
- DF-005: "block network" toggle didn't stop ICMP/raw-socket tools like
  ping (infrastructure/filesystem/command_tools.py,
  security/command_risk_classifier.py)
- DF-006: Monitoring "gay nang khi log lon" - root cause was re-reading
  the ENTIRE audit log history every 3s tick, not missing pagination;
  bounded to a 30-day window (presentation/monitoring/monitoring_tab.py)
  AND added the "So dong/trang" page-size control the ticket also asked
  for (presentation/monitoring/shared/event_table.py,
  shared/filter_scaffold.py, tabs/action_logs_tab.py, tabs/mcp_tab.py,
  tabs/security_events_tab.py, i18n/agents_admin_tab.py)
- DF-007: support choosing a OneDrive/SharePoint folder as a project's
  working directory via Microsoft Graph, downloaded as a local mirror
  with manual sync (core/projects.py, core/ms365_graph.py,
  core/cloud_workspace_sync.py - new, ui/ms365_signin_dialog.py - new,
  ui/cloud_folder_picker_dialog.py - new, i18n/cloud_workspace.py - new,
  ui/workspace_tab.py)
- DF-008: AI-edit instruction box was a fixed-height single-line QLineEdit;
  replaced with an auto-expanding, Enter-to-send/Shift+Enter-newline input
  (presentation/folder/ai_file_editor_dialog.py)
- DF-011: run_command failed with WinError 267 for a project whose
  per-turn output directory had never been created
  (application/conversations/core_runtime_adapter.py)

DF-009 (AI-edit Apply/Discard buttons easy to miss) and DF-010 (AI reply
language - dev-confirmed not a bug) are intentionally NOT part of this
commit: DF-009 has no code fix yet (still "Assigned" in the sheet, only a
UX recommendation was recorded), DF-010 was rejected as expected behavior.

Tests: tests/test_cloud_workspace_sync.py, tests/test_ms365_cloud_dialogs.py,
tests/test_ai_file_editor_input.py, tests/test_monitoring_page_size.py (all
new, all passing). Full suite: 896 passed, 13 known-and-documented failures
unrelated to this change (an existing core/audit_log.py bug, this checkout
not being a git repo before now, and a repo/subprocess folder-naming
mismatch affecting ~66 characterization tests) - see the sheet's DF-006
Evidence column for details.

ui/cloud_folder_picker_dialog.py

@@ -0,0 +1,212 @@
+"""DF-007 — browse OneDrive/SharePoint via Microsoft Graph and pick a folder
+to use as (a local mirror of) a project's working directory. See
+``core/cloud_workspace_sync.py`` for the mirror/sync side and
+``ui/ms365_signin_dialog.py`` for the sign-in gate this calls first.
+"""
+from __future__ import annotations
+
+from typing import Optional
+
+from PySide6.QtCore import Qt
+from PySide6.QtWidgets import (
+    QDialog, QHBoxLayout, QLabel, QLineEdit, QMessageBox, QPushButton,
+    QRadioButton, QTreeWidget, QTreeWidgetItem, QVBoxLayout,
+)
+
+from ..core import ms365_auth
+from ..core import ms365_graph as graph
+from ..i18n import tr
+from .icons import icon
+from .ms365_signin_dialog import ensure_signed_in
+
+_ITEM_KIND = Qt.UserRole
+_ITEM_NAME = Qt.UserRole + 1
+
+
+class CloudFolderPickerDialog(QDialog):
+    """Chọn "OneDrive của tôi" hoặc tìm 1 site SharePoint, rồi duyệt thư mục
+    con của nó; "Chọn thư mục này" trả về thư mục ĐANG HIỂN THỊ (không phải
+    dòng đang bôi đen — giống hành vi ``QFileDialog`` khi đang ở trong 1
+    thư mục)."""
+
+    def __init__(self, config, parent=None):
+        super().__init__(parent)
+        self._config = config
+        ms365 = (config.ms365 if config is not None else {}) or {}
+        self._token = ms365_auth.get_access_token(
+            ms365.get("tenant_id", ""), ms365.get("client_id", ""))
+        self._site_id = ""
+        self._site_name = ""
+        self._path_parts: list[str] = []  # relative path segments from the drive root
+
+        self.setWindowTitle(tr("cloud_picker.title"))
+        self.setModal(True)
+        self.resize(520, 480)
+        layout = QVBoxLayout(self)
+
+        source_row = QHBoxLayout()
+        self._onedrive_radio = QRadioButton(tr("cloud_picker.source_onedrive"))
+        self._onedrive_radio.setChecked(True)
+        self._onedrive_radio.toggled.connect(self._on_source_toggled)
+        self._sharepoint_radio = QRadioButton(tr("cloud_picker.source_sharepoint"))
+        source_row.addWidget(self._onedrive_radio)
+        source_row.addWidget(self._sharepoint_radio)
+        source_row.addStretch(1)
+        layout.addLayout(source_row)
+
+        search_row = QHBoxLayout()
+        self._site_search = QLineEdit()
+        self._site_search.setPlaceholderText(tr("cloud_picker.search_sites_placeholder"))
+        self._site_search.setEnabled(False)
+        self._site_search.returnPressed.connect(self._search_sites)
+        self._search_btn = QPushButton(tr("cloud_picker.search_btn"))
+        self._search_btn.setEnabled(False)
+        self._search_btn.clicked.connect(self._search_sites)
+        search_row.addWidget(self._site_search, 1)
+        search_row.addWidget(self._search_btn)
+        layout.addLayout(search_row)
+
+        self._path_lbl = QLabel()
+        self._path_lbl.setWordWrap(True)
+        layout.addWidget(self._path_lbl)
+
+        self._tree = QTreeWidget()
+        self._tree.setHeaderHidden(True)
+        self._tree.itemDoubleClicked.connect(self._on_item_activated)
+        layout.addWidget(self._tree, 1)
+
+        btn_row = QHBoxLayout()
+        self._choose_btn = QPushButton(tr("cloud_picker.choose_here"))
+        self._choose_btn.setObjectName("primary")
+        self._choose_btn.setIcon(icon("cloud"))
+        self._choose_btn.clicked.connect(self.accept)
+        self._cancel_btn = QPushButton(tr("cloud_picker.cancel"))
+        self._cancel_btn.clicked.connect(self.reject)
+        btn_row.addStretch(1)
+        btn_row.addWidget(self._cancel_btn)
+        btn_row.addWidget(self._choose_btn)
+        layout.addLayout(btn_row)
+
+        self._refresh_path_label()
+        self._reload()
+
+    # ---- source switching -------------------------------------------------
+    def _on_source_toggled(self, _checked: bool) -> None:
+        is_sharepoint = self._sharepoint_radio.isChecked()
+        self._site_search.setEnabled(is_sharepoint)
+        self._search_btn.setEnabled(is_sharepoint)
+        self._choose_btn.setEnabled(not is_sharepoint or bool(self._site_id))
+        if not is_sharepoint:
+            self._site_id = ""
+            self._site_name = ""
+            self._path_parts = []
+            self._refresh_path_label()
+            self._reload()
+
+    def _search_sites(self) -> None:
+        query = self._site_search.text().strip()
+        if not query:
+            return
+        self._tree.clear()
+        try:
+            sites = graph.list_sharepoint_sites(self._token, query)
+        except graph.Ms365GraphError as exc:
+            QMessageBox.warning(self, tr("cloud_picker.title"),
+                                 tr("cloud_picker.load_failed", err=str(exc)))
+            return
+        if not sites:
+            item = QTreeWidgetItem([tr("cloud_picker.no_sites")])
+            item.setData(0, _ITEM_KIND, "empty")
+            self._tree.addTopLevelItem(item)
+            return
+        for site in sites:
+            item = QTreeWidgetItem([site.get("displayName") or site.get("name") or site.get("id", "")])
+            item.setIcon(0, icon("globe"))
+            item.setData(0, _ITEM_KIND, "site")
+            item.setData(0, _ITEM_NAME, site.get("id", ""))
+            item.setData(0, Qt.UserRole + 2, site.get("displayName") or site.get("name") or "")
+            self._tree.addTopLevelItem(item)
+        self._choose_btn.setEnabled(False)  # must pick a site before choosing a folder
+
+    def _on_item_activated(self, item: QTreeWidgetItem, _col: int) -> None:
+        kind = item.data(0, _ITEM_KIND)
+        if kind == "site":
+            self._site_id = item.data(0, _ITEM_NAME)
+            self._site_name = item.data(0, Qt.UserRole + 2)
+            self._path_parts = []
+            self._choose_btn.setEnabled(True)
+            self._refresh_path_label()
+            self._reload()
+        elif kind == "up":
+            self._path_parts.pop()
+            self._refresh_path_label()
+            self._reload()
+        elif kind == "folder":
+            self._path_parts.append(item.data(0, _ITEM_NAME))
+            self._refresh_path_label()
+            self._reload()
+        # kind == "file": not navigable, double-click does nothing
+
+    # ---- listing ------------------------------------------------------------
+    def _current_remote_path(self) -> str:
+        return "/".join(self._path_parts)
+
+    def _refresh_path_label(self) -> None:
+        if self._sharepoint_radio.isChecked():
+            root = self._site_name or tr("cloud_picker.source_sharepoint")
+        else:
+            root = tr("cloud_picker.source_onedrive")
+        parts = "/".join([root] + self._path_parts)
+        self._path_lbl.setText(parts)
+
+    def _reload(self) -> None:
+        self._tree.clear()
+        if self._sharepoint_radio.isChecked() and not self._site_id:
+            return  # waiting on a site search/selection
+        if self._path_parts:
+            up = QTreeWidgetItem([tr("cloud_picker.up")])
+            up.setData(0, _ITEM_KIND, "up")
+            self._tree.addTopLevelItem(up)
+        try:
+            if self._sharepoint_radio.isChecked():
+                children = graph.list_sharepoint_files(
+                    self._token, self._site_id, self._current_remote_path())
+            else:
+                children = graph.list_onedrive_files(self._token, self._current_remote_path())
+        except graph.Ms365GraphError as exc:
+            QMessageBox.warning(self, tr("cloud_picker.title"),
+                                 tr("cloud_picker.load_failed", err=str(exc)))
+            return
+        for entry in children:
+            name = entry.get("name", "")
+            if not name:
+                continue
+            is_folder = "folder" in entry
+            item = QTreeWidgetItem([name])
+            item.setIcon(0, icon("folder" if is_folder else "file"))
+            item.setData(0, _ITEM_KIND, "folder" if is_folder else "file")
+            item.setData(0, _ITEM_NAME, name)
+            self._tree.addTopLevelItem(item)
+
+    # ---- result ---------------------------------------------------------
+    def cloud_source(self) -> dict:
+        """Chỉ gọi sau khi ``exec()`` trả về ``QDialog.Accepted``."""
+        if self._sharepoint_radio.isChecked():
+            return {
+                "provider": "sharepoint", "site_id": self._site_id,
+                "site_name": self._site_name, "remote_path": self._current_remote_path(),
+            }
+        return {"provider": "onedrive", "site_id": "", "site_name": "",
+                "remote_path": self._current_remote_path()}
+
+
+def pick_cloud_folder(parent, config) -> Optional[dict]:
+    """Đảm bảo đã đăng nhập MS365 rồi mở dialog duyệt; trả về ``cloud_source``
+    dict nếu người dùng xác nhận một thư mục, ``None`` nếu hủy hoặc chưa đăng
+    nhập."""
+    if not ensure_signed_in(parent, config):
+        return None
+    dialog = CloudFolderPickerDialog(config, parent)
+    if dialog.exec() == QDialog.Accepted:
+        return dialog.cloud_source()
+    return None

ui/ms365_signin_dialog.py

@@ -0,0 +1,137 @@
+"""Microsoft 365 sign-in dialog (DF-007) — thin UI over the working device-code
+flow in ``core/ms365_auth.py``. There was an older MS365 sign-in UI in this
+app; it was removed as dead code (no entry point — see
+``ui/settings_dialog.py`` module docstring) before this feature existed, so
+this is a fresh, small dialog rather than a resurrection of that one.
+
+Usage: ``if ensure_signed_in(parent, ctx.config): ...`` — returns ``True``
+immediately (no dialog shown) when already signed in.
+"""
+from __future__ import annotations
+
+import webbrowser
+
+from PySide6.QtCore import QThread, Signal
+from PySide6.QtWidgets import (
+    QDialog, QHBoxLayout, QLabel, QMessageBox, QPushButton, QVBoxLayout,
+)
+
+from ..core import ms365_auth
+from ..i18n import tr
+
+
+class _SignInWorker(QThread):
+    """Chạy ``sign_in_device_code()`` (blocking, poll tới khi xong/hết hạn) ở
+    luồng nền — xem ``core/worker.py::AgentWorker`` cho cùng idiom (bắt hết
+    exception, phát signal thay vì để lỗi giết luồng âm thầm)."""
+    code_ready = Signal(dict)
+    finished_ok = Signal(dict)
+    failed = Signal(str)
+
+    def __init__(self, config, parent=None):
+        super().__init__(parent)
+        self._config = config
+
+    def run(self) -> None:  # noqa: D401
+        try:
+            result = ms365_auth.sign_in(lambda flow: self.code_ready.emit(flow), self._config)
+            self.finished_ok.emit(result or {})
+        except Exception as exc:  # noqa: BLE001 - surfaced to the UI, never crashes the thread
+            self.failed.emit(str(exc))
+
+
+class Ms365SignInDialog(QDialog):
+    """Modal: hiện user_code + verification_uri, tự mở trình duyệt, đóng lại
+    khi đăng nhập xong (hoặc người dùng bấm Hủy)."""
+
+    def __init__(self, config, parent=None):
+        super().__init__(parent)
+        self._config = config
+        self._worker: _SignInWorker | None = None
+        self.setWindowTitle(tr("ms365_signin.title"))
+        self.setModal(True)
+
+        layout = QVBoxLayout(self)
+        self._intro_lbl = QLabel(tr("ms365_signin.intro"))
+        self._intro_lbl.setWordWrap(True)
+        layout.addWidget(self._intro_lbl)
+
+        self._code_lbl = QLabel()
+        self._code_lbl.setWordWrap(True)
+        self._code_lbl.hide()
+        layout.addWidget(self._code_lbl)
+
+        self._open_link_btn = QPushButton(tr("ms365_signin.open_link"))
+        self._open_link_btn.hide()
+        self._open_link_btn.clicked.connect(self._open_link)
+        layout.addWidget(self._open_link_btn)
+
+        self._error_lbl = QLabel()
+        self._error_lbl.setWordWrap(True)
+        self._error_lbl.setStyleSheet("color: #c0392b;")
+        self._error_lbl.hide()
+        layout.addWidget(self._error_lbl)
+
+        btn_row = QHBoxLayout()
+        self._signin_btn = QPushButton(tr("ms365_signin.button"))
+        self._signin_btn.setObjectName("primary")
+        self._signin_btn.clicked.connect(self._start_sign_in)
+        self._cancel_btn = QPushButton(tr("ms365_signin.cancel"))
+        self._cancel_btn.clicked.connect(self.reject)
+        btn_row.addStretch(1)
+        btn_row.addWidget(self._cancel_btn)
+        btn_row.addWidget(self._signin_btn)
+        layout.addLayout(btn_row)
+
+        self._verification_uri = ""
+
+    def _open_link(self) -> None:
+        if self._verification_uri:
+            webbrowser.open(self._verification_uri)
+
+    def _start_sign_in(self) -> None:
+        self._signin_btn.setEnabled(False)
+        self._signin_btn.setText(tr("ms365_signin.signing_in"))
+        self._error_lbl.hide()
+        self._worker = _SignInWorker(self._config, self)
+        self._worker.code_ready.connect(self._on_code_ready)
+        self._worker.finished_ok.connect(self._on_finished_ok)
+        self._worker.failed.connect(self._on_failed)
+        self._worker.start()
+
+    def _on_code_ready(self, flow: dict) -> None:
+        self._verification_uri = flow.get("verification_uri_complete") or flow.get(
+            "verification_uri", "")
+        self._code_lbl.setText(
+            tr("ms365_signin.code_hint", url=flow.get("verification_uri", "")) +
+            f"\n\n{flow.get('user_code', '')}")
+        self._code_lbl.show()
+        self._open_link_btn.show()
+        if self._verification_uri:
+            webbrowser.open(self._verification_uri)
+
+    def _on_finished_ok(self, _result: dict) -> None:
+        self.accept()
+
+    def _on_failed(self, err: str) -> None:
+        self._signin_btn.setEnabled(True)
+        self._signin_btn.setText(tr("ms365_signin.button"))
+        self._error_lbl.setText(tr("ms365_signin.failed", err=err))
+        self._error_lbl.show()
+
+    def reject(self) -> None:
+        # NOTE: MSAL's acquire_token_by_device_flow() has no cancellation hook,
+        # so a worker already polling keeps polling in the background until it
+        # times out on its own (a few minutes) — closing this dialog just stops
+        # the UI from waiting on it. Its late signals are harmless no-ops
+        # against an already-closed (but not destroyed) dialog.
+        super().reject()
+
+
+def ensure_signed_in(parent, config) -> bool:
+    """True nếu đã (hoặc vừa) đăng nhập MS365; False nếu người dùng hủy hoặc
+    đăng nhập thất bại và đóng dialog."""
+    if ms365_auth.is_signed_in(config):
+        return True
+    dialog = Ms365SignInDialog(config, parent)
+    return dialog.exec() == QDialog.Accepted

ui/workspace_tab.py

@@ -309,6 +309,28 @@ class WorkspaceTab(QWidget):
         folder_row.addWidget(self._open_btn)
         rl.addLayout(folder_row)
 
+        # DF-007 — an ALTERNATIVE way to set output_dir: browse OneDrive/
+        # SharePoint via Graph API and download a local mirror instead of
+        # picking an already-local folder. output_dir still always ends up a
+        # real local path (see Project.cloud_source) — nothing downstream
+        # (run_command/read_file/...) needs to know the difference.
+        cloud_row = QHBoxLayout()
+        self._cloud_pick_btn = QPushButton()
+        self._cloud_pick_btn.setIcon(icon("cloud"))
+        self._cloud_pick_btn.clicked.connect(self._pick_cloud_folder)
+        self._cloud_sync_btn = QPushButton()
+        self._cloud_sync_btn.setIcon(icon("refresh"))
+        self._cloud_sync_btn.clicked.connect(self._sync_cloud_folder)
+        self._cloud_sync_btn.hide()
+        cloud_row.addWidget(self._cloud_pick_btn)
+        cloud_row.addWidget(self._cloud_sync_btn)
+        cloud_row.addStretch(1)
+        rl.addLayout(cloud_row)
+        self._cloud_badge_lbl = QLabel()
+        self._cloud_badge_lbl.setWordWrap(True)
+        self._cloud_badge_lbl.hide()
+        rl.addWidget(self._cloud_badge_lbl)
+
         rl.addStretch(1)      # the drawing floats Lưu project at the bottom
         save_row = QHBoxLayout()
         self._save_btn = QPushButton()
@@ -494,6 +516,9 @@ class WorkspaceTab(QWidget):
         self._browse_btn.setText(tr("workspace.browse"))
         self._browse_btn.setToolTip(tr("workspace.browse_tooltip"))
         self._open_btn.setText(tr("workspace.open_folder"))
+        self._cloud_pick_btn.setText(tr("workspace.cloud_pick"))
+        self._cloud_sync_btn.setText(tr("workspace.cloud_sync"))
+        self._refresh_cloud_badge()
         self._save_btn.setText(tr("workspace.save"))
         self._proj_collapse_btn.setToolTip(tr("workspace.collapse_projects_tooltip"))
         self._projects_strip.setToolTip(tr("workspace.expand_projects_tooltip"))
@@ -692,6 +717,7 @@ class WorkspaceTab(QWidget):
                 self.instr_edit.clear()
                 self.folder_lbl.setText("")
                 self._del_btn.setEnabled(False)
+            self._refresh_cloud_badge(project)
             # Show Cowork/GraphRAG ONLY when a project is actually selected.
             self._update_tab_visibility(project is not None)
             # Bind the embedded Cowork/GraphRAG/History to this project's sandbox.
@@ -948,3 +974,105 @@ class WorkspaceTab(QWidget):
         wd = project.workspace_dir()
         wd.mkdir(parents=True, exist_ok=True)
         open_folder(str(wd))
+
+    def _cloud_token(self):
+        """Lấy access token MS365 hiện tại theo cấu hình — raise
+        ``Ms365AuthError`` nếu chưa đăng nhập/hết hạn (gọi picker trước nên
+        thường đã có sẵn phiên đăng nhập)."""
+        from ..core.ms365_auth import get_access_token
+
+        ms365 = (self.ctx.config.ms365 or {})
+        return get_access_token(ms365.get("tenant_id", ""), ms365.get("client_id", ""))
+
+    def _pick_cloud_folder(self) -> None:
+        """DF-007 — duyệt OneDrive/SharePoint qua Graph API, tải một bản
+        mirror cục bộ xuống rồi dùng bản mirror đó làm output_dir của
+        project. Xem core/cloud_workspace_sync.py cho giới hạn (một chiều,
+        thủ công, không đồng bộ liên tục, không xử lý xung đột)."""
+        from ..core.cloud_workspace_sync import download_folder
+        from ..core.ms365_auth import Ms365AuthError
+        from ..core.projects import WORKSPACES_DIR, load_project, save_project
+        from .cloud_folder_picker_dialog import pick_cloud_folder
+
+        pid = self._current_id
+        project = load_project(pid) if pid else None
+        if project is None:
+            return
+        cloud_source = pick_cloud_folder(self, self.ctx.config)
+        if not cloud_source:
+            return
+        local_dir = WORKSPACES_DIR / project.project_id / "_cloud_mirror"
+        self._cloud_pick_btn.setEnabled(False)
+        try:
+            token = self._cloud_token()
+            report = download_folder(token, cloud_source, local_dir)
+        except Ms365AuthError as exc:
+            QMessageBox.warning(self, tr("workspace.cloud_pick"), str(exc))
+            return
+        finally:
+            self._cloud_pick_btn.setEnabled(True)
+        project.output_dir = str(local_dir)
+        project.cloud_source = cloud_source
+        save_project(project)
+        self.folder_lbl.setText(str(local_dir))
+        self._refresh_cloud_badge(project)
+        self.projects_changed.emit()
+        if report.errors:
+            QMessageBox.warning(self, tr("workspace.cloud_pick"),
+                                 tr("workspace.cloud_sync_errors", n=len(report.errors)))
+        self.status_message.emit(tr("workspace.saved", name=project.name))
+
+    def _sync_cloud_folder(self) -> None:
+        """DF-007 — đẩy thay đổi cục bộ lên cloud rồi tải lại (một chiều mỗi
+        bước, thủ công, chạy khi bấm nút). Không xoá file 2 phía, không phát
+        hiện xung đột — xem core/cloud_workspace_sync.py."""
+        from ..core.cloud_workspace_sync import download_folder, upload_folder
+        from ..core.ms365_auth import Ms365AuthError
+        from ..core.projects import load_project
+
+        pid = self._current_id
+        project = load_project(pid) if pid else None
+        if project is None or not project.cloud_source:
+            return
+        self._cloud_sync_btn.setEnabled(False)
+        try:
+            token = self._cloud_token()
+            up_report = upload_folder(token, project.cloud_source, project.workspace_dir())
+            down_report = download_folder(token, project.cloud_source, project.workspace_dir())
+        except Ms365AuthError as exc:
+            QMessageBox.warning(self, tr("workspace.cloud_sync"), str(exc))
+            return
+        finally:
+            self._cloud_sync_btn.setEnabled(True)
+        lines = [tr("workspace.cloud_sync_result",
+                     up=up_report.transferred, down=down_report.transferred)]
+        n_errors = len(up_report.errors) + len(down_report.errors)
+        if n_errors:
+            lines.append(tr("workspace.cloud_sync_errors", n=n_errors))
+        n_skipped = len(up_report.skipped_too_large)
+        if n_skipped:
+            lines.append(tr("workspace.cloud_sync_skipped", n=n_skipped))
+        QMessageBox.information(self, tr("workspace.cloud_sync"), "\n".join(lines))
+
+    def _refresh_cloud_badge(self, project=None) -> None:
+        """Hiện/ẩn badge ☁ + nút Đồng bộ theo project đang mở có phải một
+        mirror cloud hay không (``project.cloud_source``)."""
+        if project is None:
+            from ..core.projects import load_project
+
+            project = load_project(self._current_id) if self._current_id else None
+        cloud_source = project.cloud_source if project is not None else None
+        if not cloud_source:
+            self._cloud_badge_lbl.hide()
+            self._cloud_sync_btn.hide()
+            return
+        if cloud_source.get("provider") == "sharepoint":
+            text = tr("workspace.cloud_badge_sharepoint",
+                      site=cloud_source.get("site_name", ""),
+                      path=cloud_source.get("remote_path", "") or "/")
+        else:
+            text = tr("workspace.cloud_badge_onedrive",
+                      path=cloud_source.get("remote_path", "") or "/")
+        self._cloud_badge_lbl.setText(text)
+        self._cloud_badge_lbl.show()
+        self._cloud_sync_btn.show()