fix(clodex): isolate file tree diff by workspace

[mereyabdenbekuly-ctrl]

Linked issue

No separate issue: this is a bounded, reproducible local UI bug found during repository review. The regression tests below specify the intended outcome.

Contribution category

• Independent Clodex implementation
• Migration adapter, shadow comparison, or cutover
• Legacy / compatibility fix
• Legacy removal
• Specification or documentation
• Security-sensitive change

Components and registry status: browser-legacy (apps/browser/**), status remains legacy, owner desktop.

Artifact classification: All four changed/new files are PUBLIC CORE: the existing sidebar, its workspace-scoped diff-state helper, and synthetic unit/component tests. No private product code, restricted data, dependency, license, registry-status, or public protocol change.

Verification state: IMPLEMENTED_UNVERIFIED pending GitHub CI, desktop visual evidence, and maintainer review. This is a Draft PR, not merge or release authorization.

Problem and outcome

Opening project A's Diff and then selecting project B while its Git-summary request is pending retains A's rows and totals. The click handler already uses B's workspace key, so a row from A can open the same relative path in B. A file preview can likewise survive a workspace switch, and removing all workspaces during a request can leave the loading state stuck.

After this change, Diff data and previews are scoped to the workspace that produced them. Switching projects hides the previous project's rows, totals, and preview immediately. Same-workspace refreshes retain their existing summary without flicker. File-tree state is not remounted, preserving the existing cross-workspace clipboard behavior.

Scope boundaries

In scope

• file-tree-sidebar.tsx: workspace-scoped diff and preview presentation; existing request cancellation.
• file-tree-diff-state.ts: pure selection of the current workspace's diff snapshot/loading state.
• Helper and real React component lifecycle tests with synthetic workspaces and deferred requests.

Out of scope

• Other directory-loading races, backend Git operations, copying/pasting implementation, approval or enforcement behavior.
• Context compression, watchdogs, providers, refactoring of other components, dependency updates, or packaging.
• Protocol v0 schemas/conformance/SDK work, Gateway, enterprise/cloud implementation, billing, entitlement, or licensing changes. All Protocol v0 gates remain OPEN.

Implementation summary

• Store each completed summary together with its originating workspaceKey.
• Derive visible data, Git-repository status, and loading state synchronously from the selected workspace; a mismatched snapshot is never rendered under a new workspace.
• Keep cancellation guards for obsolete workspace/revision requests, including rapid A -> B -> A switching.
• Associate preview targets with their originating workspace, mask mismatches before effects run, and clear old targets after switching.
• Preserve the existing FileTreeWorkspaceView instance rather than using a keyed remount that would discard its cross-workspace clipboard.
• Use existing hoisted jsdom/React/Vitest test dependencies; package manifests and lockfile are unchanged.

Risk assessment

Risk level: Low, limited to transient renderer state and existing async request presentation.

• Security/trust: no authority, approval, filesystem, or network access is added or weakened.
• Privacy: no new telemetry, credentials, logging, or real project/customer fixtures.
• State/data: only in-memory presentation state changes; no database, persisted format, migration, or file mutation changes.
• Compatibility/performance: existing Git-summary API and request cancellation remain; the most recent same-workspace snapshot stays visible during refresh.
• Supply chain/release: no dependency or lockfile changes, packaging/signing/publishing changes, or release action.

Rollback or recovery plan: Revert the single functional commit 2e81568963180787cb612473db600691d6355be4. No data migration is needed; the previous stale-Diff/preview behavior returns.

Source of truth before this PR: Unscoped component-local summary and preview path paired with whichever workspace is currently selected.

Source of truth after this PR: A completed summary/preview plus its originating workspace key; only matching state is presented.

Tests and verification

Check	Command or procedure	Result
Frozen dependency bootstrap	pnpm install --offline --frozen-lockfile --ignore-scripts --package-import-method=clone	Passed; lockfile/manifests unchanged; no downloads
Package build prerequisites	pnpm build:packages	7 successful tasks restored from matching local Turbo cache
All browser UI tests	pnpm --dir apps/browser exec vitest run src/ui	38 files, 228 tests passed
Focused regression coverage	pnpm --dir apps/browser exec vitest run src/ui/screens/main/file-tree/file-tree-sidebar.test.ts src/ui/screens/main/file-tree/file-tree-diff-state.test.ts	13/13 passed
Regression sensitivity	Run the new 9 component tests temporarily against the unchanged public-main sidebar, then restore the fix	Original: 3 failed / 6 passed; fixed: 9/9 passed
UI TypeScript	pnpm --dir apps/browser exec tsc -p tsconfig.ui.json --noEmit	Passed
Full browser pre-commit typecheck	pnpm -F clodex typecheck (agent-core/shell rebuilt, then UI/pages/backend/preload/storybook/visual TypeScript)	All six targets passed
All commit hooks	Staged Biome, repository pnpm check, browser typecheck, commitlint	Passed without bypass; repository-wide Biome reports existing warnings/info only
Changed-file lint	Biome on all four changed files	Passed
Boundaries and provenance	pnpm check:boundaries && pnpm check:community-free-boundary && pnpm check:protocol-v0-governance && pnpm check:provenance	Passed; no gates closed
Secret scan	scripts/security/scan-secrets.sh working-tree with an external temporary report path	No findings
Patch hygiene	git diff --check and staged-path inspection	Passed; exactly four public-core files
Independent read-only review	Workspace isolation, cancellation, stable procedure identity, preview effect ordering, clipboard preservation, and public/private boundary	No blocking findings
GitHub CI	PR/push check-run annotations inspected on September 6, 2026	Jobs did not start: GitHub reports the account is locked due to a billing issue. This is an infrastructure blocker, not an executed test failure; CI remains unverified.
Desktop visual evidence	Not yet collected	Required before ready-for-review/merge; no checks bypassed

GitHub CI blocker confirmed on this commit: PR lint job and push lint job both report: “The job was not started because your account is locked due to a billing issue.” Local hooks/tests passed, but this does not replace remote CI.

User evidence

Synthetic before/after evidence from the actual sidebar component tests:

Public-main sidebar: 3 failed, 6 passed
- previous-workspace diff rows/totals leak while the new request is pending
- previous preview target survives a workspace switch
- removing all workspaces during a request leaves a loading spinner

Fixed sidebar: 9 passed
Diff selector: 4 passed

The tests also cover out-of-order workspace and revision responses, A -> B -> A switching, current-workspace refresh, fallback selection, request errors, correct target workspace for row clicks, and preservation of the file-view instance. A packaged-desktop screenshot/recording has not been collected; this PR remains Draft while that evidence and CI/review are pending.

Documentation

No user-facing setting, environment variable, external dependency, API, stored format, or migration is introduced. Source comments and regression tests document the invariant. Release notes are deferred to an authorized release.

Upstream and third-party attribution

No external implementation or assets were copied. This is a compatibility fix to the existing public repository, not an independent replacement; existing copyrights, attribution, and licenses are unchanged.

Provenance and AI assistance

Sources used: The public repository's contribution/provenance/boundary rules, existing sidebar and file-tree code, workspace identity contract, Karton procedure proxy, and existing React/Vitest testing setup.

Other implementations inspected: None outside the existing public repository.

AI assistance: OpenAI Codex assisted with diagnosis, the public-core implementation, synthetic regression tests, local verification, independent read-only review, and PR preparation. No private implementation, credentials, customer prompts/data, or restricted fixtures were used for this change.

Contributor checklist

• The intended outcome is specified above; a separate issue is not needed for this bounded fix.
• The change stays within its stated scope, without unrelated formatting or refactoring.
• Behavioral changes have regression coverage, including a demonstrated failing baseline.
• Synthetic before/after test evidence is included.
• Packaged-desktop visual evidence is attached.
• Relevant security, privacy, data, migration, network, provider, compatibility, packaging, and rollback risks are documented.
• Documentation needs are explained.
• No secrets, credentials, private data, unreviewed generated output, or sensitive logs are included.
• Existing attribution and licenses are preserved; this is not claimed as an independent rewrite.
• No shadow side effects, dependency-boundary exceptions, or component registry changes are introduced.
• The commit includes an author-matching DCO Signed-off-by trailer.
• GitHub CI and maintainer review have passed; the PR is ready for review.