fix(workspace): stop the TUI sending people to a picker that lists nothing (#1390)

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: saravmajestic

packages/opencode/src/altimate/workspace/api-client.ts

@@ -101,6 +101,16 @@ export const HIDDEN_BINDING_MESSAGE =
   "This project is already linked to a workspace you can't see, most likely a teammate's private one. " +
   "Ask its owner to share it with you in the Altimate web app, or to unlink the project, then run `altimate-code link` again."
 
+/** The other half of the same story, told to the person who creates the workspace.
+ * A create from the CLI or the TUI is always `privacy: "private"`, and the server hides a
+ * private workspace's binding from everyone else — so without this note the creator has no
+ * way to know that the teammate who clones the repo next will be told it is unlinked, and
+ * will hit `HIDDEN_BINDING_MESSAGE` with no idea who to ask. Lives here, beside that
+ * message, because both the CLI command and the TUI plugin have to say it and neither can
+ * import the other. */
+export const QUICK_WORKSPACE_PRIVATE_NOTE =
+  "Only you can see this workspace. Share it from its page in the Altimate web app so teammates who clone this repo are attached to it too."
+
 export function isHiddenBindingConflict(err: unknown): boolean {
   // A binding conflict always names the existing workspace's id; a 409 without one is some
   // other conflict and must not be explained as a teammate's private workspace.

packages/opencode/src/cli/cmd/link.ts

@@ -20,6 +20,7 @@ import {
   ConflictError,
   HIDDEN_BINDING_MESSAGE,
   isHiddenBindingConflict,
+  QUICK_WORKSPACE_PRIVATE_NOTE,
   ForbiddenError,
   NotConfiguredError,
   NotFoundError,
@@ -796,9 +797,6 @@ async function bindOrRebind(
   }
 }
 
-export const QUICK_WORKSPACE_PRIVATE_NOTE =
-  "Only you can see this workspace. Share it from its page in the Altimate web app so teammates who clone this repo are attached to it too."
-
 /** What `link` says about this machine's saved memory after the bind. A seed that left
  * blocks behind used to print the same line as one that stored everything. */
 export function seedMessage(seed: SeedOutcome | null): string {

packages/opencode/src/plugin/tui/altimate/workspace.tsx

@@ -36,6 +36,7 @@ import {
   ConflictError,
   HIDDEN_BINDING_MESSAGE,
   isHiddenBindingConflict,
+  QUICK_WORKSPACE_PRIVATE_NOTE,
   ForbiddenError,
   NotFoundError,
   PreconditionFailedError,
@@ -294,10 +295,14 @@ interface LinkedProps {
 function WorkspaceLinkedDialog(props: LinkedProps) {
   const title = () => {
     const suffix = props.manageUrl ? ` — ${props.manageUrl}` : ""
+    // "Created" is the only verb that just made a NEW workspace, and every create from here
+    // is private. The other two verbs bound an existing workspace whose privacy the user
+    // already chose in the SaaS, so the note would be wrong for them.
+    const privacy = props.verb === "Created" ? ` ${QUICK_WORKSPACE_PRIVATE_NOTE}` : ""
     // DialogSelect doesn't take a top-level description block, so the
     // memory-sync disclosure is packed into the title, matching the
     // AlreadyLinkedDialog convention above.
-    return `${props.verb} workspace "${props.workspaceName}"${suffix} — Saved memory blocks will sync to this workspace if memory is enabled for it.`
+    return `${props.verb} workspace "${props.workspaceName}"${suffix} — Saved memory blocks will sync to this workspace if memory is enabled for it.${privacy}`
   }
   const options = () => {
     if (props.manageUrl) {
@@ -548,7 +553,14 @@ export async function createAndBindInline(
     if (err instanceof ConflictError && !rebindFrom) {
       api.ui.toast({
         variant: "warning",
-        message: `This project is already linked to "${err.detail.existing_datamate_name ?? "another workspace"}". Use the palette's "Link this project to a workspace" to change.`,
+        // A withheld name means the binding belongs to a workspace this user cannot see, so
+        // the palette it would otherwise point at lists nothing to pick — the advice sent
+        // them round a loop with no exit. The three other conflict toasts in this file already
+        // branch here; this one did not.
+        message: isHiddenBindingConflict(err)
+          ? HIDDEN_BINDING_MESSAGE
+          : `This project is already linked to "${err.detail.existing_datamate_name ?? "another workspace"}". Use the palette's "Link this project to a workspace" to change.`,
+        duration: 15_000,
       })
     } else {
       api.ui.toast({
@@ -618,7 +630,11 @@ export async function createAndBindInline(
     log.warn("workspace post-create confirmation failed", { err: String(err) })
     api.ui.toast({
       variant: "info",
-      message: `Workspace "${res.datamate.name}" created and linked.`,
+      // The dialog that would have carried the note never rendered, and this toast is all
+      // the user gets — so it says the whole thing rather than dropping the half that asks
+      // them to act.
+      message: `Workspace "${res.datamate.name}" created and linked. ${QUICK_WORKSPACE_PRIVATE_NOTE}`,
+      duration: 15_000,
     })
   }
 }

packages/opencode/test/altimate/workspace/create-then-rebind.test.ts

@@ -48,7 +48,9 @@ const { createAndBindInline, bindOrRebindInline, runWorkspaceManage } = await im
   "@/plugin/tui/altimate/workspace"
 )
 const { recordApprovedBinding } = await import("@/altimate/workspace/state")
-const { HIDDEN_BINDING_MESSAGE } = await import("@/altimate/workspace/api-client")
+const { HIDDEN_BINDING_MESSAGE, QUICK_WORKSPACE_PRIVATE_NOTE } = await import(
+  "@/altimate/workspace/api-client"
+)
 
 const ORIGINAL_FETCH = globalThis.fetch
 
@@ -293,6 +295,90 @@ describe("TUI: hidden-binding conflict toast", () => {
     expect(toasts.some((t) => t.message === HIDDEN_BINDING_MESSAGE)).toBe(true)
     expect(toasts.some((t) => /claimed this project while you were choosing/i.test(t.message))).toBe(false)
   })
+
+  test("the quick-create row says the same thing — it used to point at a picker with nothing in it", async () => {
+    routes = [
+      {
+        match: /datamate-project-bindings/,
+        method: "POST",
+        status: 409,
+        body: { detail: { message: "already linked", existing_datamate_id: 7 } }, // no existing_datamate_name
+      },
+    ]
+    const { api, toasts } = stubApi()
+    // No `rebindFrom`: the project looks unlinked to this user, because the binding that
+    // owns it belongs to a workspace they cannot see. This is Bob, a minute after cloning.
+    await createAndBindInline(api, IDENTIFIER, "proj")
+    expect(toasts.some((t) => t.message === HIDDEN_BINDING_MESSAGE)).toBe(true)
+    // The advice that sent him round the loop: a picker scoped to workspaces he can see
+    // lists none of them, so "use the palette to change" had nothing to offer.
+    expect(toasts.some((t) => /Link this project to a workspace/.test(t.message))).toBe(false)
+  })
+
+  test("a NAMED 409 is still a real race, and still names the workspace", async () => {
+    routes = [
+      {
+        match: /datamate-project-bindings/,
+        method: "POST",
+        status: 409,
+        body: { detail: { message: "already linked", existing_datamate_id: 7, existing_datamate_name: "team-ws" } },
+      },
+    ]
+    const { api, toasts } = stubApi()
+    await createAndBindInline(api, IDENTIFIER, "proj")
+    expect(toasts.some((t) => /already linked to "team-ws"/.test(t.message))).toBe(true)
+    expect(toasts.some((t) => t.message === HIDDEN_BINDING_MESSAGE)).toBe(false)
+  })
+})
+
+// ─────────────────────────────────────────────────────────────────────────────
+// The other half of the dead end: the person who CREATED the workspace is the
+// only one who can open it up, and nothing on this surface told them so.
+// ─────────────────────────────────────────────────────────────────────────────
+describe("TUI: quick-create privacy note", () => {
+  /** Renders the confirmation dialog instead of discarding it, so the title it
+   * actually shows can be read back. */
+  const dialogApi = () => {
+    const cap: { title: string | null } = { title: null }
+    const toasts: Array<{ variant?: string; message: string }> = []
+    return {
+      cap,
+      toasts,
+      api: {
+        state: { path: { directory: "/tmp/proj" } },
+        ui: {
+          DialogSelect: (props: { title: string }) => {
+            cap.title = props.title
+            return null
+          },
+          dialog: { clear: () => {}, replace: (fn: () => unknown) => void fn() },
+          toast: (t: { variant?: string; message: string }) => toasts.push(t),
+        },
+      } as never,
+    }
+  }
+
+  test("a create tells the creator the workspace is private and how to share it", async () => {
+    routes = [
+      {
+        match: /datamate-project-bindings\/$/,
+        method: "POST",
+        status: 200,
+        body: { datamate: { id: 7, name: "proj" }, binding: BINDING, manage_url: "https://x.test/w/7" },
+      },
+    ]
+    const d = dialogApi()
+    await createAndBindInline(d.api, IDENTIFIER, "proj")
+    expect(d.cap.title).toContain(QUICK_WORKSPACE_PRIVATE_NOTE)
+  })
+
+  test("binding to an EXISTING workspace does not, because its privacy was never this flow's to describe", async () => {
+    routes = [{ match: /\/bind$/, method: "POST", status: 200, body: { binding: BINDING } }]
+    const d = dialogApi()
+    await bindOrRebindInline(d.api, IDENTIFIER, 7, undefined)
+    expect(d.cap.title).toBeTruthy()
+    expect(d.cap.title).not.toContain(QUICK_WORKSPACE_PRIVATE_NOTE)
+  })
 })
 
 // ─────────────────────────────────────────────────────────────────────────────