feat(core): hosted workspace execution with modal driver - #40784

What

Hosted Workspace execution for V2. A Workspace is a durable execution environment (a machine with a root, not a repository), a sandbox is one kind of Workspace, and a Session whose Location names a workspaceID runs through the existing runner graph. The same tools and permissions execute locally or through a provider; plugins are hosting-blind.

Ships with a live Modal driver and an LLM-in-the-loop e2e: a scripted model drives the real runner, apply_patch and shell execute inside Modal, and files read back through the hosted filesystem.

Design: specs/v2/workspaces.md.

Includes the three remove-old-workspaces commits (#40760) as its base, so removal and replacement can be reviewed together.

flowchart TD
  Session[Session execution] --> Graph[Location graph]
  Graph --> Tools[edit / write / patch / shell]
  Tools --> Domain[LocationMutation / FileMutation / FileSystem / Shell]
  Domain --> Env[WorkspaceEnvironment]
  Env --> Local[host adapter]
  Env --> Hosted[driver.connect binding]
  Hosted --> Modal[Modal sandbox]

How

• Workspace persists { id, provider, binding, root }; metadata reads never contact a provider.
• WorkspaceDriver provides create / connect / destroy; bindings are opaque to core and decoded by the selected driver.
• WorkspaceEnvironment is the provider primitive seam: files, process spawning, shell lowering, and workspace root.
• Hosted Session admission uses POSIX containment and stated Location/Project data, avoiding host filesystem discovery against provider paths.
• LocationServiceMap binds the environment and swaps Location-scoped core services for hosted Locations. Driver connections live for the cached graph lifetime.
• LocationMutation owns path resolution and external-directory boundaries; permissions follow the lexical path the model named, while canonical referents are used only for reads, writes, and locking.
• FileMutation owns text reads, typed file errors, mutation locking, UTF-8 BOM policy, formatting, writes, and removes. It carries both canonical identity and lexical entry paths so moving a symlink removes the link, not its referent.
• edit, write, and apply_patch consume only LocationMutation and FileMutation; they contain no host/provider branching and cannot access WorkspaceEnvironment.
• Shell backends validate cwd where commands execute. The shell tool only resolves paths and permissions.
• Plugin context no longer carries WorkspaceEnvironment; the hosted-only PluginSupervisor node is gone.
• Hosted catalogs currently omit glob and grep until their search implementation executes through the environment.
• Modal provides direct filesystem operations, realpath -e canonicalization, sandbox process streams, a git/bash/ripgrep image, reconnect, and synchronous termination.

Scope

Deliberately deferred:

• Workspace lifecycle policy beyond the current one-hour sandbox lifetime
• Clone-and-rediscover for Project detection inside a Workspace
• Environment-backed hosted glob / grep
• Hosted MCP execution policy; global-config host-spawn attempts remain tracked separately
• Per-command Modal interrupt; the SDK has no process kill primitive
• Public workspaces.* HTTP/SDK endpoints
• Collapsing local/hosted domain-service nodes by binding the host as the default WorkspaceEnvironment adapter

Testing

• Core: bun run test in packages/core — 1541 pass, 7 skip, 0 fail (1548 tests)
• Server: bun run test in packages/server — 19 pass, 0 fail, including live Modal graph/session coverage
• Focused hosted/tool suites — 87 pass, 0 fail
• Full monorepo typecheck — 32/32 tasks successful
• git diff --check clean

The repository-wide Effect pattern scan still reports seven pre-existing findings outside this change.