feat(#3996): add workspace media writes and session provenance - #4024
Open
aheritier wants to merge 4 commits into
Open
feat(#3996): add workspace media writes and session provenance#4024aheritier wants to merge 4 commits into
aheritier wants to merge 4 commits into
Conversation
aheritier
added
area/a2a
aheritier
force-pushed
the
workspace-media-foundations
branch
from
August 24, 2026 15:13
7d14235 to
8ddf26c
Compare
aheritier
force-pushed
the
workspace-media-foundations
branch
2 times, most recently
from
August 25, 2026 08:15
3033054 to
8480264
Compare
aheritier
force-pushed
the
workspace-media-foundations
branch
from
August 25, 2026 20:24
8480264 to
750b125
Compare
aheritier
force-pushed
the
workspace-media-foundations
branch
from
August 26, 2026 11:09
750b125 to
3ef730d
Compare
aheritier
force-pushed
the
workspace-media-foundations
branch
2 times, most recently
from
September 1, 2026 16:13
b90d66a to
3ef730d
Compare
aheritier
force-pushed
the
workspace-media-foundations
branch
from
September 1, 2026 16:30
3ef730d to
85b7e3b
Compare
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
aheritier
force-pushed
the
workspace-media-foundations
branch
from
September 8, 2026 07:57
3fea84b to
4400283
Compare
aheritier
force-pushed
the
workspace-media-foundations
branch
from
September 8, 2026 17:31
4400283 to
f0afe11
Compare
aheritier
force-pushed
the
workspace-media-foundations
branch
from
September 8, 2026 20:34
f0afe11 to
8cd7c8d
Compare
aheritier
changed the title
aheritier
marked this pull request as ready for review
September 8, 2026 20:38
dgageot
force-pushed
the
workspace-media-foundations
branch
from
September 9, 2026 07:41
8cd7c8d to
f7404fe
Compare
dgageot
previously approved these changes
Sep 9, 2026
aheritier
force-pushed
the
workspace-media-foundations
branch
from
September 9, 2026 11:56
f7404fe to
0b4142d
Compare
dgageot
force-pushed
the
workspace-media-foundations
branch
from
September 9, 2026 12:15
0b4142d to
932bd80
Compare
aheritier
force-pushed
the
workspace-media-foundations
branch
from
September 9, 2026 12:56
932bd80 to
f349c29
Compare
aheritier
force-pushed
the
workspace-media-foundations
branch
from
September 9, 2026 13:32
f349c29 to
65d9e2c
Compare
aheritier
force-pushed
the
workspace-media-foundations
branch
from
September 9, 2026 14:07
65d9e2c to
3c1b2cd
Compare
…eation path Every session created against a local workspace now records the absolute workspace root that owns it, so generated files can later be resolved against the owning workspace instead of whatever cwd the viewer happens to run from: - delegated/nested sub-sessions inherit parent.WorkingDir - serve mcp / a2a / chatserver capture the server workspace once at startup instead of reading os.Getwd per request (or not at all) - embeddedchat conversations and `docker-agent new` capture the configured root or the creation-time cwd - --working-dir writes the absolutized path back into RuntimeConfig so a relative flag value cannot leak into persisted provenance - compaction runs inherit the compacted session's workspace Remote/headless surfaces (remote backend template, API templates without working_dir, ACP without client cwd, evaluation container transcripts) intentionally keep an empty WorkingDir and now document that choice. session.ResolveWorkingDir adds a bounded, cycle-safe, validated parent-chain fallback for old persisted sub-sessions with an empty WorkingDir; it rejects relative/malformed roots and never falls back to the process cwd. It is the primitive the generated-media resolver will build on.
Sanitize workspace-relative paths, derive MIME extensions and publish complete sibling temporary files through an atomic no-replace hard link. Retry collision suffixes without overwriting files created during publication. Confine operations to os.Root and fail safely on filesystems without hard-link support. Regression coverage preserves concurrent destination writes and verifies failed-write cleanup.
Exercise atomicfile.Write cleanup after real partial data has reached its temporary file, with and without an existing destination. Drain the test reader's prefix across arbitrary buffer sizes before injecting an error, and pin that reader contract directly with a small-buffer test. Use non-default creation permissions to make chmod coverage load-bearing, retain overwrite retightening and missing-parent errors, and verify that a publish-rename failure leaves no temporary file or altered destination.
Rename local session fixtures to sess so package-qualified constructors remain unambiguous when testing persisted workspace provenance. Keep the fixture setup and assertions unchanged.
aheritier
force-pushed
the
workspace-media-foundations
branch
from
September 9, 2026 15:55
3c1b2cd to
28b91fc
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
Add collision-safe workspace media writes, nested parent creation, MIME-corrected extensions, no-overwrite publication, and cleanup on failure. Persist absolute local workspace provenance across session creation surfaces and resolve it through a bounded parent walk. Relative nesting, MIME correction, collision handling, no overwrite, and partial success are retained. This is production infrastructure, not a test-only change.
Part of #3996. Review this PR against its immediate parent, #4023, rather than the aggregate stack against
main.Publication hard-links a complete sibling temporary file to an unused final name atomically; concurrent destination creation cannot be overwritten. Filesystems without hard-link support fail safely.
Commit inventory
Head:
8cd7c8d6182ec1a60d9a404268f88887f19c80fa; parent SHA:dfca90319859bd683dd1103d48ed43ed043bddd2.0b7300ac4342355e3d7a3b06d98b336f22091bf9— feat(Epic: Gemini image output with workspace deliverables and portable session copies #3996): persist absolute WorkingDir provenance at every local creation patha532ba0a62ac42d3a1d853b8fd41991ca865200b— feat: publish workspace media without replacing existing files71ec85cb5c31543e57e25d29df648c15364ac1c9— test(Epic: Gemini image output with workspace deliverables and portable session copies #3996): cover atomic-file cleanup after partial writes8cd7c8d6182ec1a60d9a404268f88887f19c80fa— test(Epic: Gemini image output with workspace deliverables and portable session copies #3996): avoid shadowing the session package in MCP fixturesValidation
Build, test compilation, owning-package tests and the named fixture passed at this PR head.
Exact deterministic fixture command:
Matched top-level tests:
pkg/atomicfile: 6;pkg/session: 11;pkg/workspacemedia: 21.Deterministic scope: the named local fixture exercises this PR boundary with disposable configuration/stores and fake or loopback providers as applicable. Every listed package ran nonzero matching top-level tests.
Deferred/live scope: Live provider, remote CI, and platform execution are not claimed by this deterministic receipt. The final stack head passed build, lint, full tests, an uncached full suite, focused race tests and documentation checks in disposable environments. Remote CI is tracked by the checks below; no new paid-provider or active-database validation was run.