feat(server): agents can reach every folder a .code-workspace lists

[LoganRupe]

What Changed

Agents can now reach every folder a project's .code-workspace lists, not only the git repos.

• The server reads the .code-workspace when a provider session starts. Listed folders that exist and are not repositories become the session's plain folders. There is no new column and no migration.
• Claude and Codex get the plain folders outside the session's working directory through the existing extra-roots mechanism. repoRoots is untouched, so git surfaces and checkpoints behave as before.
• Every provider gets a <project_folders> block in its instructions naming the plain folders. In an isolated run it adds one sentence: the folders are the originals, shared with other runs, and outside checkpoints.
• If the file cannot be read, the session starts with the repos only and the server logs a warning.
• A change to the file applies on the next session start.
• docs/user/project-settings.md gains a short section on this.

A listed folder inside a repo root counts as part of that repo, so an isolated run keeps using the worktree for it.

Why

Follow-up 4 (agent half) from the review of #325 on #323. The files panel and @ search offered every listed folder, but the agent was only given repoRoots. A listed folder outside the workspace folder was never granted, and in an isolated run no plain folder was, so an @ reference could point the agent at a path it had to ask for or could not write.

Not covered here: plain folders are outside checkpoints and the diff panel, a recovered session is rebuilt from its working directory alone (the same gap repos have today), and Codex's sandbox may still block writes outside its working directory.

UI Changes

Before (995120e) on the left, this branch on the right. The workspace lists the repo api, the plain folder docs, and ../outside-notes. Both threads run Claude in Supervised mode, where reading outside the granted directories asks first.

1. Current checkout: read a file in ../outside-notes. Left asks for a file read approval. Right answers.
2. New worktree: read a file in docs, which sits beside the repo and not in its worktree. Left asks again. Right answers.

_Video:

compare.mp4

[Copilot]

Copilot review overview

🟡 Changes recommended

Newly listed Git repositories can be misclassified and granted as shared plain folders, bypassing isolated worktrees.

Review effort: Balanced
Findings: 1

Open (1)

• Classify workspace Git folders using current git status · New

What changed in this PR

Adds .code-workspace plain-folder access to provider sessions while preserving repository-based git behavior.

Changes:

• Resolves and grants listed non-repository folders at session start.
• Adds provider instructions describing plain folders and isolation behavior.
• Adds documentation and focused tests.

File	Description
packages/​contracts/​src/​provider.ts	Extends session inputs with plain-folder metadata.
docs/​user/​project-settings.md	Documents workspace-folder behavior.
apps/​server/​src/​workspace/​WorkspaceManifest.ts	Resolves plain folders and grants.
apps/​server/​src/​workspace/​WorkspaceManifest.test.ts	Tests manifest resolution.
apps/​server/​src/​provider/​RuntimeInstructions.ts	Adds project-folder instructions.
apps/​server/​src/​provider/​RuntimeInstructions.test.ts	Tests instruction generation.
apps/​server/​src/​provider/​Layers/​CodexSessionRuntime.ts	Carries metadata into Codex turns.
apps/​server/​src/​provider/​Layers/​CodexAdapter.ts	Forwards metadata to Codex runtime.
apps/​server/​src/​orchestration/​Layers/​ProviderCommandReactor.ts	Reads workspace files when sessions start.
apps/​server/​src/​orchestration/​Layers/​ProviderCommandReactor.test.ts	Tests session folder propagation and failure fallback.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

Incomplete repository-overlap detection can expose original checkouts during isolated runs, and the documentation overstates which folders bypass checkpoints.

Review effort: Balanced
Findings: 1

Open (1)

• Incomplete repository-boundary checks can bypass worktree isolation · New

Resolved since last review (1)

• Classify workspace Git folders using current git status

Previously missed (1)

In code that hasn't changed since last review

Clarify warning to apply only to folders outside repositories

docs/​user/​project-settings.md:111

This warning is inaccurate for a listed subfolder inside a repository: the manifest deliberately treats it as part of that repository, so an isolated thread uses the worktree copy and checkpoints do cover it. Qualify this as folders outside repositories so users are not incorrectly told those edits are shared and unrevertible.