Finish cross-OS Starter workspace path normalization for session isolation

[benjaminshafii]

Problem

OpenWork relies on OpenCode for session isolation, but OpenWork still owns the path identity it passes into OpenCode. Today, Starter/local workspace behavior is improved but not yet proven cross-OS safe because path resolution and persisted workspace identity can still depend on path formatting details.

This leaves us vulnerable to cases where the same logical workspace is represented differently across app bootstrap, restart, workspace creation, or New session, for example:

• ~/OpenWork/starter
• /Users/name/OpenWork/starter
• non-canonical paths with ..
• Windows separator/casing variants

When that happens, OpenCode may correctly isolate sessions by the directory it receives, but OpenWork may accidentally scope history to the wrong directory or split one logical workspace into multiple identities.

Goal

Make Starter/local workspace session scoping fully cross-OS safe and provably stable across:

• first-run bootstrap
• app restart
• New session
• workspace creation/switching
• persisted workspace state migration

What remains

• Create a single OS-aware source of truth for resolving the Starter workspace path to an absolute canonical path.
• Ensure all local workspace flows use that resolved path instead of raw ~/... strings.
• Never persist or compare raw tilde paths; only persist normalized/canonical absolute paths.
• Migrate existing saved local workspace state that may contain tilde or non-canonical paths.
• Verify workspace identity is derived from normalized canonical paths only.
• Run real desktop verification on macOS, Linux, and Windows for Starter/local workspace session isolation.

Test matrix

Run on each OS:

• first launch bootstraps Starter
• create a session in Starter
• quit/relaunch app and verify Starter history remains
• click New session in Starter and verify it stays attached to Starter
• create another workspace and verify Starter history remains
• switch away/back and verify history remains
• verify migration from old persisted state with tilde/non-canonical paths

Notes

• OpenCode already provides session isolation for the directory/project scope it receives.
• The remaining risk is in OpenWork's path resolution, persistence, and reconnect behavior.
• Related fix work is in PR fix(session): preserve workspace history during local reconnects #1135, but this issue tracks the remaining work needed to call the behavior truly finished and cross-OS safe.

[benjaminshafii]

New evidence from 0.11.186 narrows this substantially: we received a Windows desktop report that historical conversations disappear after switching workers.

I audited the current app/server contract and the strongest remaining hypothesis is now a Windows-specific directory-format mismatch between session.create() and session.list().

Refined hypothesis

OpenCode isolates sessions correctly for the exact directory string it receives.

The likely regression path on Windows is:

1. OpenWork creates a session using the raw active workspace root.
   • apps/app/src/app/app.tsx:6211
   • apps/app/src/app/app.tsx:6212
2. The SDK sends directory for session.create() as a query param, not just as a header.
   • packages/sdk/js/src/v2/gen/sdk.gen.ts:971
   • packages/sdk/js/src/v2/gen/sdk.gen.ts:985
3. OpenCode takes the raw query/header directory and uses it as Instance.directory.
   • packages/opencode/src/server/server.ts:197
4. Later, OpenWork lists sessions using normalizeDirectoryQueryPath(...), which converts backslashes to forward slashes.
   • active sessions: apps/app/src/app/context/session.ts:784
   • active list request: apps/app/src/app/context/session.ts:794
   • sidebar sessions: apps/app/src/app/app.tsx:3188
   • sidebar list request: apps/app/src/app/app.tsx:3193
5. OpenCode session listing is strict on the server side for directory equality.
   • packages/opencode/src/session/index.ts:518

That means Windows can do this:

• create under C:\Users\name\OpenWork\starter
• list under c:/users/name/openwork/starter

Client-side filtering lowercases and normalizes slashes, but by then the server may have already returned zero sessions because the query string no longer exactly matches the stored session.directory.

Why this fits the report

• It explains why conversations are not actually deleted, but disappear from the UI.
• It explains why switching workers or restarting can trigger the issue: those flows often cause a fresh session.list().
• It explains why macOS-only fixes were insufficient.
• It explains why Windows reports still show up after 0.11.186.

Boundary values we should instrument next

For every local worker switch and restart on Windows, log these values together:

• persisted workspace path from Tauri state
• active workspace id
• active workspace root before create/list
• clientDirectory
• engineInfo.projectDir
• session.create directory
• session.list directory
• returned session.directory values from the server
• whether each value differs only by slash/case/verbatim prefix

Concrete execution plan

1. Add Windows-focused debug logging around session.create() and both active/sidebar session.list() calls.
2. Add a normalization invariant test proving create/list use the same wire-format directory on Windows.
3. Standardize one transport format for all OpenCode-bound directory params for local workspaces.
4. Verify that existing persisted workspace state does not reintroduce slash-style drift after restart.
5. Run a Windows desktop regression matrix:
   • create session in worker A
   • switch to worker B
   • switch back to A
   • restart app
   • verify both active view and sidebar still show A’s history

This now looks less like a generic “Starter” bug and more like a transport-contract mismatch for local workspace directory strings on Windows.