feat(R06): workspace session snapshot, atomic persistence, history-dir race fix

EPIC R06 (Team Hoa) - workspace/filesystem isolation, no cross-project
mutable state.

R06-T01 domain/workspaces/workspace_session.py
  WorkspaceSession - project_id/workspace_root/sandbox_dir/allowed_paths
  frozen snapshot + is_allowed(path), same "capture once at submit time"
  shape as R04's ConversationExecutionRequest.

R06-T02 infrastructure/persistence/json/{atomic_write,workspace_repository_impl,conversation_repository_impl}.py
  Real bug fixed: core/projects.py::save_project and core/history.py's
  save_conversation/rename_conversation/set_pinned did a plain
  path.write_text(json.dumps(...)) - two syscalls, no atomicity. A crash
  between them leaves a half-written file that load_project/load_conversation
  then silently treat as "missing". All four now write through
  atomic_write.write_json (temp file + os.replace). WorkspaceRepository/
  ConversationRepository are thin object-shaped facades over the same
  (now-atomic) functions, for future application-layer callers.
  NOTE: atomic_write.py is deliberately NOT named atomic_json_file.py -
  R02-T01 (Team Nam) claims that filename for the same purpose app-wide;
  see the checklist for the consolidation TODO.

R06-T03 infrastructure/filesystem/execution_workspace.py
  ExecutionWorkspace names the output_dir/scratch_dir split that already
  exists (core/chat_agent.py's flat workspace_root/.scratch) - does not
  move anything.

R06-T04 ui/chat_panel.py
  The actual race: ChatPanel._persist_session (saves a BACKGROUND turn's
  conversation) resolved its save directory via a live
  self.ctx.config.history_dir() read at save time. ui/workspace_tab.py::
  _load_current mutates that same config field on every project switch, so
  a turn still running when the user switched projects got saved into the
  NEW project's history folder. Fixed by adding "home_history_dir" to the
  per-turn ctx dict (same "home_*" snapshot convention already used for
  session id/messages/title), captured at submit time. Verified with a real
  offscreen-Qt test, not just a unit double:
  tests/integration/test_history_dir_race.py.

R06-T05 application/workspaces/file_workspace_service.py
  FileWorkspaceService - the File Explorer / AI Editor entry point for the
  same safe read/write/edit operations the agent tool loop has, by calling
  core/tools.py::execute_tool directly (same dispatch, same ToolContext
  containment, same audit log) rather than reimplementing any of it.

New tests: tests/unit/test_workspace_session.py,
test_atomic_write_and_repositories.py, test_execution_workspace.py,
test_file_workspace_service.py, tests/integration/test_history_dir_race.py
(29 new tests, incl. 2 real offscreen-Qt integration tests).

Suite: 283 passed, 4 pre-existing failures unrelated to R05/R06 (see
checklist). check_imports: PASS. All new files < 400 LOC.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/unit/test_atomic_write_and_repositories.py

@@ -0,0 +1,83 @@
+"""EPIC R06-T02: atomic JSON writes + the WorkspaceRepository/
+ConversationRepository facades over core/projects.py and core/history.py.
+
+The motivating bug: ``core/projects.py::save_project`` used to
+``path.write_text(json.dumps(...))`` — two syscalls, no atomicity. A failure
+between them must never leave a half-written file on disk; that is the one
+property these tests exist to pin.
+"""
+from __future__ import annotations
+
+import json
+
+import pytest
+
+from cowork_local.infrastructure.persistence.json import (
+    ConversationRepository,
+    WorkspaceRepository,
+    write_json,
+)
+from cowork_local.infrastructure.persistence.json.atomic_write import write_json as _write_json
+
+
+def test_write_json_round_trips(tmp_path):
+    path = tmp_path / "a.json"
+    write_json(path, {"hello": "world", "n": 3})
+    assert json.loads(path.read_text(encoding="utf-8")) == {"hello": "world", "n": 3}
+
+
+def test_write_json_leaves_no_temp_file_behind(tmp_path):
+    write_json(tmp_path / "a.json", {"x": 1})
+    assert list(tmp_path.iterdir()) == [tmp_path / "a.json"]
+
+
+def test_a_failed_write_never_corrupts_the_existing_file(tmp_path, monkeypatch):
+    """The whole point of write-temp-then-replace: if the replace step blows
+    up, the ORIGINAL file must still be there and still be readable — not
+    truncated, not half-written."""
+    path = tmp_path / "a.json"
+    write_json(path, {"version": 1})
+
+    import cowork_local.infrastructure.persistence.json.atomic_write as mod
+
+    def boom(*_a, **_k):
+        raise OSError("simulated crash between write and replace")
+
+    monkeypatch.setattr(mod.os, "replace", boom)
+    with pytest.raises(OSError):
+        write_json(path, {"version": 2})
+
+    assert json.loads(path.read_text(encoding="utf-8")) == {"version": 1}
+    # the abandoned temp file was cleaned up, not left orphaned
+    assert list(tmp_path.iterdir()) == [path]
+
+
+def test_workspace_repository_crud_round_trip(tmp_path):
+    repo = WorkspaceRepository(tmp_path)
+    project = repo.create("My Project", description="d")
+
+    assert [p.project_id for p in repo.list()] == [project.project_id]
+
+    project.description = "updated"
+    repo.save(project)
+    assert repo.get(project.project_id).description == "updated"
+
+    assert repo.delete(project.project_id) is True
+    assert repo.get(project.project_id) is None
+
+
+def test_conversation_repository_crud_round_trip(tmp_path):
+    repo = ConversationRepository(tmp_path)
+    session_id = repo.new_session_id()
+    path = repo.save("cowork", session_id, [{"role": "user", "content": "hi"}])
+
+    assert [c["session_id"] for c in repo.list()] == [session_id]
+
+    repo.rename(path, "Renamed")
+    repo.set_pinned(path, True)
+    data = repo.load(path)
+    assert data["title"] == "Renamed"
+    assert data["pinned"] is True
+
+    repo.delete(path)
+    assert repo.list() == []

tests/unit/test_execution_workspace.py

@@ -0,0 +1,51 @@
+"""EPIC R06-T03: ExecutionWorkspace names the output-dir/scratch-dir split
+that already exists in ``core/chat_agent.py`` (``.scratch`` under the
+workspace root) without changing where anything lands."""
+from __future__ import annotations
+
+from cowork_local.domain.workspaces import WorkspaceSession
+from cowork_local.infrastructure.filesystem.execution_workspace import ExecutionWorkspace
+
+
+def test_output_dir_is_the_workspace_root_itself(tmp_path):
+    session = WorkspaceSession.unscoped(tmp_path)
+    workspace = ExecutionWorkspace(session, turn_id="turn-1")
+
+    assert workspace.output_dir == tmp_path
+
+
+def test_scratch_dir_matches_the_existing_flat_convention(tmp_path):
+    """core/chat_agent.py::_cleanup_cowork_intermediates operates on
+    ``output_dir / ".scratch"`` with no per-turn subfolder — this must agree,
+    or cleanup_scratch() would target a directory nothing ever wrote to."""
+    session = WorkspaceSession.unscoped(tmp_path)
+    workspace = ExecutionWorkspace(session, turn_id="turn-1")
+
+    assert workspace.scratch_dir == tmp_path / ".scratch"
+
+
+def test_ensure_dirs_creates_both_folders(tmp_path):
+    session = WorkspaceSession.unscoped(tmp_path / "root")
+    workspace = ExecutionWorkspace(session, turn_id="t")
+    workspace.ensure_dirs()
+
+    assert workspace.output_dir.is_dir()
+    assert workspace.scratch_dir.is_dir()
+
+
+def test_cleanup_scratch_removes_it_and_leaves_output_dir_alone(tmp_path):
+    session = WorkspaceSession.unscoped(tmp_path)
+    workspace = ExecutionWorkspace(session, turn_id="t")
+    workspace.ensure_dirs()
+    (workspace.scratch_dir / "helper.py").write_text("print(1)", encoding="utf-8")
+    (workspace.output_dir / "deliverable.txt").write_text("done", encoding="utf-8")
+
+    workspace.cleanup_scratch()
+
+    assert not workspace.scratch_dir.exists()
+    assert (workspace.output_dir / "deliverable.txt").exists()
+
+
+def test_cleanup_scratch_is_a_no_op_when_never_created(tmp_path):
+    workspace = ExecutionWorkspace(WorkspaceSession.unscoped(tmp_path), turn_id="t")
+    workspace.cleanup_scratch()  # must not raise

tests/unit/test_file_workspace_service.py

@@ -0,0 +1,62 @@
+"""EPIC R06-T05: FileWorkspaceService gives File Explorer / AI Editor the
+same safe file operations the agent tool loop already has, via the SAME
+``core/tools.py::execute_tool`` dispatch (not a reimplementation)."""
+from __future__ import annotations
+
+from cowork_local.application.workspaces import FileWorkspaceService
+from cowork_local.domain.workspaces import WorkspaceSession
+
+
+def _service(tmp_path) -> FileWorkspaceService:
+    return FileWorkspaceService(WorkspaceSession.unscoped(tmp_path))
+
+
+def test_write_then_read_round_trips(tmp_path):
+    service = _service(tmp_path)
+    written = service.write_file("notes.md", "# Hello")
+    assert written["ok"] is True
+
+    read = service.read_preview("notes.md")
+    assert read == {"ok": True, "output": "# Hello"}
+
+
+def test_list_tree_reflects_written_files(tmp_path):
+    service = _service(tmp_path)
+    service.write_file("a.txt", "x")
+    listing = service.list_tree()
+    assert listing["ok"] is True and "a.txt" in listing["output"]
+
+
+def test_apply_edit_uses_the_context_anchored_replace(tmp_path):
+    service = _service(tmp_path)
+    service.write_file("code.py", "value = 1\n")
+    edited = service.apply_edit("code.py", "value = 1", "value = 2")
+    assert edited["ok"] is True
+    assert service.read_preview("code.py")["output"].strip() == "value = 2"
+
+
+def test_apply_edit_reports_ambiguous_match_like_the_agent_tool_does(tmp_path):
+    service = _service(tmp_path)
+    service.write_file("code.py", "x = 1\nx = 1\n")
+    edited = service.apply_edit("code.py", "x = 1", "x = 2")
+    assert edited["ok"] is False
+    assert "appears" in edited["output"]
+
+
+def test_path_escape_is_refused_not_a_crash(tmp_path):
+    workspace = tmp_path / "workspace"
+    workspace.mkdir()
+    (tmp_path / "outside.txt").write_text("secret", encoding="utf-8")
+    service = FileWorkspaceService(WorkspaceSession.unscoped(workspace))
+
+    result = service.read_preview("../outside.txt")
+    assert result["ok"] is False
+    assert "outside the working folder" in result["output"]
+
+
+def test_write_preserves_subfolders_unlike_cowork_flatten_writes(tmp_path):
+    """File Explorer must not collapse a write into the workspace root the
+    way Cowork's agent context does (flatten_writes=True there, False here)."""
+    service = _service(tmp_path)
+    service.write_file("sub/dir/file.txt", "content")
+    assert (tmp_path / "sub" / "dir" / "file.txt").read_text(encoding="utf-8") == "content"

tests/unit/test_workspace_session.py

@@ -0,0 +1,64 @@
+"""EPIC R06-T01: WorkspaceSession is a frozen snapshot, captured once, that a
+turn keeps using regardless of what the UI does to the live project
+selection afterwards - see the module docstring for the race this replaces.
+"""
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+from cowork_local.domain.workspaces import WorkspaceSession
+
+
+class _FakeProject:
+    def __init__(self, project_id: str, root: Path):
+        self.project_id = project_id
+        self._root = root
+
+    def workspace_dir(self) -> Path:
+        return self._root
+
+
+def test_from_project_derives_sandbox_dir_under_the_workspace_root(tmp_path):
+    project = _FakeProject("proj-a", tmp_path)
+    session = WorkspaceSession.from_project(project)
+
+    assert session.project_id == "proj-a"
+    assert session.workspace_root == tmp_path
+    assert session.sandbox_dir == tmp_path / ".scratch"
+    assert session.allowed_paths == (tmp_path,)
+
+
+def test_is_allowed_true_for_the_root_and_descendants(tmp_path):
+    session = WorkspaceSession.from_project(_FakeProject("p", tmp_path))
+    nested = tmp_path / "sub" / "file.txt"
+    nested.parent.mkdir(parents=True)
+    nested.write_text("x", encoding="utf-8")
+
+    assert session.is_allowed(tmp_path) is True
+    assert session.is_allowed(nested) is True
+
+
+def test_is_allowed_false_outside_the_workspace(tmp_path):
+    session = WorkspaceSession.from_project(_FakeProject("p", tmp_path / "a"))
+    outside = tmp_path / "b" / "secret.txt"
+
+    assert session.is_allowed(outside) is False
+
+
+def test_two_sessions_from_different_projects_stay_independent(tmp_path):
+    """The exact race this snapshot exists to prevent: a turn holding session
+    A must never start accepting paths that belong to session B, no matter
+    what the (mutable, shared) AppContext does after the snapshot was taken."""
+    session_a = WorkspaceSession.from_project(_FakeProject("a", tmp_path / "a"))
+    session_b = WorkspaceSession.from_project(_FakeProject("b", tmp_path / "b"))
+
+    assert session_a.is_allowed(tmp_path / "b" / "file.txt") is False
+    assert session_b.is_allowed(tmp_path / "a" / "file.txt") is False
+
+
+def test_unscoped_session_has_no_project_id(tmp_path):
+    session = WorkspaceSession.unscoped(tmp_path)
+    assert session.project_id == ""
+    assert session.is_allowed(tmp_path / "code.py") is True