@maintainer-pro/ai-bridge 0.1.16 → 0.1.19

package/src/daemon.mjs

@@ -23,7 +23,13 @@ import {
   lookupShareResponse,
   prepareShareHttpRequest,
   processShareHttpResponse,
+  rewriteMappedLocalUrls,
+  rewriteShareRequestBody,
+  shareServiceWorkerScript,
+  shareShimScript,
+  shareTokenRoot,
   shouldProcessShareResponse,
+  shouldRewriteBody,
 } from "./share-rewrite.mjs";
 import {
   canonicalActionCode,
@@ -80,6 +86,34 @@ function shortId(value) {
   return text.length > 12 ? `${text.slice(0, 8)}…` : text;
 }
 
+function sameFolder(a, b) {
+  const na = path.resolve(String(a || ""));
+  const nb = path.resolve(String(b || ""));
+  if (process.platform === "win32") return na.toLowerCase() === nb.toLowerCase();
+  return na === nb;
+}
+
+function workspaceFolders(ws) {
+  const primary = String(ws?.folderPath || "").trim();
+  const extra = Array.isArray(ws?.extraFolders) ? ws.extraFolders : [];
+  const out = [];
+  const seen = new Set();
+  for (const raw of [primary, ...extra]) {
+    if (!raw || typeof raw !== "string") continue;
+    const resolved = path.resolve(raw);
+    const key = process.platform === "win32" ? resolved.toLowerCase() : resolved;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push(resolved);
+  }
+  return out;
+}
+
+function folderForApp(ws, app) {
+  if (app?.folderPath) return path.resolve(String(app.folderPath));
+  return path.resolve(ws?.folderPath || "");
+}
+
 function actionLabel(action) {
   const sandbox = action.sandboxId || action.payload?.sandboxId;
   const folder = action.payload?.folderPath;
@@ -364,7 +398,8 @@ async function detectCliProviders() {
 }
 
 async function resolveWorkspaceHostApps(ws, opts = {}) {
-  const folder = path.resolve(ws.folderPath || "");
+  const folders = workspaceFolders(ws);
+  const folder = folders[0] || path.resolve(ws.folderPath || "");
   const label = ws.sandboxName || shortId(ws.sandboxId) || "sandbox";
   const desired = Array.isArray(opts.desired)
     ? opts.desired
@@ -379,10 +414,11 @@ async function resolveWorkspaceHostApps(ws, opts = {}) {
     activity(
       ws.sandboxId,
       "info",
-      `detecting ports for ${label} in ${folder} (env first${opts.force ? ", redetect" : ""})`
+      `detecting ports for ${label} in ${folders.join(", ") || folder} (env first${opts.force ? ", redetect" : ""})`
     );
     const result = await cli.resolveHostApps({
       workspaceDir: folder,
+      workspaceDirs: folders,
       appName: ws.applicationName || ws.sandboxName,
       preferredAiPort: Number(ws.port) || 3100,
       desired: opts.ignoreDesired ? [] : desired,
@@ -391,6 +427,9 @@ async function resolveWorkspaceHostApps(ws, opts = {}) {
       sandboxId: ws.sandboxId,
     });
     const previous = Array.isArray(ws.hostApps) ? ws.hostApps : [];
+    if (opts.unionDetected && previous.length && typeof cli.unionHostApps === "function") {
+      result.apps = cli.unionHostApps(previous, result.apps);
+    }
     result.apps = result.apps.map((app) => {
       const match = previous.find((row) => row && row.id === app.id);
       return match ? { ...app, host: match.host === true || app.host === true } : app;
@@ -494,6 +533,14 @@ function projectFingerprint(folder) {
     "next.config.js",
     "next.config.mjs",
     "next.config.ts",
+    "pom.xml",
+    "build.gradle",
+    "build.gradle.kts",
+    "build.sbt",
+    "src/main/resources/application.yml",
+    "src/main/resources/application.properties",
+    "src/main/resources/application.conf",
+    "conf/application.conf",
   ]) {
     const file = path.join(resolved, rel);
     if (!fs.existsSync(file)) continue;
@@ -1440,28 +1487,71 @@ function proxySlugForApp(app) {
   return id || "app";
 }
 
+function uniqueProxySlugs(apps) {
+  const used = new Set();
+  /** @type {Record<string, string>} */
+  const slugs = {};
+  for (const app of apps || []) {
+    let slug = proxySlugForApp(app);
+    if (!slug || !app?.id) continue;
+    if (used.has(slug)) {
+      const fromId = String(app.id)
+        .trim()
+        .toLowerCase()
+        .replace(/[^a-z0-9_-]+/g, "-")
+        .replace(/^-+|-+$/g, "");
+      slug =
+        fromId && !used.has(fromId)
+          ? fromId
+          : `${slug}-${Number(app.port) || used.size}`;
+    }
+    used.add(slug);
+    slugs[app.id] = slug;
+  }
+  return slugs;
+}
+
+function sharePortUrls(ws) {
+  const apps = Array.isArray(ws?.hostApps) ? ws.hostApps : [];
+  /** @type {Record<string, string>} */
+  const out = {};
+  for (const app of apps) {
+    const port = Number(app.port);
+    if (!port) continue;
+    const url = proxyUrlForApp(ws, app);
+    if (url) out[String(port)] = url.replace(/\/$/, "");
+  }
+  return out;
+}
+
 function applyAssignedProxy(ws, remote, cfg) {
   const proxy =
     remote?.proxy && typeof remote.proxy === "object" ? remote.proxy : null;
   if (!proxy?.token) return;
   const origin = String(proxy.origin || cfg?.adminUrl || "").replace(/\/$/, "");
-  const slugs =
+  const assigned =
     proxy.slugs && typeof proxy.slugs === "object" ? proxy.slugs : {};
+  const unique = uniqueProxySlugs(appsFrom(ws, remote));
+  /** @type {Record<string, string>} */
+  const slugs = {};
   /** @type {Record<string, string>} */
   const urls = {};
-  const apps = Array.isArray(ws.hostApps)
-    ? ws.hostApps
-    : Array.isArray(remote.hostApps)
-      ? remote.hostApps
-      : [];
+  const apps = appsFrom(ws, remote);
   for (const app of apps) {
-    const slug = slugs[app.id] || proxySlugForApp(app);
+    const slug = assigned[app.id] || unique[app.id] || proxySlugForApp(app);
     if (!slug || !origin) continue;
+    slugs[app.id] = slug;
     urls[app.id] = `${origin}/p/${proxy.token}/${slug}`;
   }
   ws.proxy = { origin, token: String(proxy.token), slugs, urls };
 }
 
+function appsFrom(ws, remote) {
+  if (Array.isArray(ws?.hostApps) && ws.hostApps.length) return ws.hostApps;
+  if (Array.isArray(remote?.hostApps)) return remote.hostApps;
+  return [];
+}
+
 function proxyUrlForApp(ws, app) {
   if (!usesBridgeProxy(app)) return "";
   const urls =
@@ -1478,15 +1568,17 @@ function proxyUrlForApp(ws, app) {
   return `${origin}/p/${token}/${slug}`;
 }
 
-function jobsFromHostApps(ws) {
+function jobsFromHostApps(ws, filter = {}) {
   const apps = Array.isArray(ws.hostApps) ? ws.hostApps : [];
   const hostId = hostAppOf(ws)?.id;
   return apps
     .filter((app) => app && app.role !== "ai-server")
+    .filter((app) => (filter.appId ? app.id === filter.appId : true))
     .map((app) => {
       const port = Number(app.port) || 3000;
       const command = String(app.startCommand || "").trim();
-      const script = command.replace(/^npm\s+run\s+/, "") || "dev";
+      const script = command.replace(/^npm\s+run\s+/, "") || command || "dev";
+      const folder = folderForApp(ws, app);
       return {
         role: isBackendApp(app)
           ? "backend"
@@ -1500,6 +1592,7 @@ function jobsFromHostApps(ws) {
         port,
         probeUrl: `http://127.0.0.1:${port}`,
         appId: app.id,
+        folder,
       };
     });
 }
@@ -2021,7 +2114,7 @@ const embeddedChat = new Map();
 const embeddedChatStarting = new Map();
 
 const PROXY_CHUNK_BYTES = 256 * 1024;
-/** @type {Map<string, import("node:http").ClientRequest>} */
+/** @type {Map<string, { req: import("node:http").ClientRequest, rewrite?: boolean, chunks?: Buffer[], headers?: Record<string, string>, portUrls?: Record<string, string> } | import("node:http").ClientRequest>} */
 const proxyHttpReqs = new Map();
 /** Reuse sockets to the local app — Next/Vite fetch many files per page. */
 const proxyKeepAliveAgent = new http.Agent({
@@ -2032,6 +2125,8 @@ const proxyKeepAliveAgent = new http.Agent({
 });
 /** @type {Map<string, WebSocket>} */
 const proxyLocalSockets = new Map();
+/** @type {Map<string, Record<string, string>>} */
+const proxyWsPortUrls = new Map();
 /** @type {Record<string, unknown> | null} */
 let bridgeCfg = null;
 
@@ -2145,6 +2240,9 @@ function shareProxyContext(msg, ws, appId) {
   ).replace(/\/$/, "");
   const acceptEncoding =
     typeof msg.acceptEncoding === "string" ? msg.acceptEncoding : "";
+  const fromWs = sharePortUrls(ws);
+  const fromMsg =
+    msg?.portUrls && typeof msg.portUrls === "object" ? msg.portUrls : {};
   return {
     path: safeProxyPath(msg.path),
     slug,
@@ -2152,6 +2250,7 @@ function shareProxyContext(msg, ws, appId) {
     aiPublicBase,
     acceptEncoding,
     port: localPortForProxy(ws, appId),
+    portUrls: { ...fromWs, ...fromMsg },
   };
 }
 
@@ -2165,6 +2264,43 @@ function sendProcessedProxyHttp(id, ctx, status, headers, body) {
   replyProxyHttp(id, processed.status, processed.headers, processed.body);
 }
 
+function publicPathPrefix(publicBase) {
+  try {
+    return new URL(String(publicBase || "")).pathname.replace(/\/$/, "") || "";
+  } catch {
+    return "";
+  }
+}
+
+function replyShareInterceptor(id, ctx, path) {
+  const pathname = String(path || "").split("?")[0] || "";
+  if (pathname !== "/__mp/shim.js" && pathname !== "/__mp/sw.js") return false;
+  const tokenRoot = shareTokenRoot(ctx.publicBase) || "/";
+  /** @type {Record<string, string>} */
+  const headers = {
+    "content-type": "application/javascript; charset=utf-8",
+    "cache-control": "private, no-store",
+  };
+  let body = "";
+  if (pathname === "/__mp/sw.js") {
+    headers["service-worker-allowed"] = tokenRoot;
+    body = shareServiceWorkerScript(ctx.portUrls, tokenRoot);
+  } else {
+    body = shareShimScript(publicPathPrefix(ctx.publicBase), ctx.portUrls);
+  }
+  replyProxyHttp(id, 200, headers, body);
+  return true;
+}
+
+function destroyProxyHttpReq(entry) {
+  const req = entry?.req || entry;
+  try {
+    req?.destroy?.();
+  } catch {
+    /* ignore */
+  }
+}
+
 function bridgeEmbedConfigJs(ws) {
   const store = ws?.store && typeof ws.store === "object" ? ws.store : {};
   const aiApp = { id: "ai-server", role: "ai-server" };
@@ -2191,19 +2327,25 @@ async function handleAiProxyHttpFromAdmin(msg, ws) {
   const reqPath = safeProxyPath(msg.path);
   const pathname = reqPath.split("?")[0] || "/";
   const ctx = shareProxyContext(msg, ws, "ai-server");
+  if (replyShareInterceptor(id, ctx, reqPath)) return;
   const prepared = prepareShareHttpRequest(
     proxyReqHeaders(msg.headers),
     ctx.publicBase,
     ctx.acceptEncoding,
-    reqPath
+    reqPath,
+    ctx.portUrls
   );
   ctx.acceptEncoding = prepared.acceptEncoding;
   ctx.ifNoneMatch = prepared.ifNoneMatch;
   const headers = prepared.headers;
-  const body =
+  const body = rewriteShareRequestBody(
     typeof msg.body === "string" && msg.body
       ? Buffer.from(msg.body, "base64")
-      : Buffer.alloc(0);
+      : Buffer.alloc(0),
+    headers,
+    ctx.portUrls,
+    ctx.publicBase
+  );
 
   if (pathname === "/ai-ui.iife.js") {
     const file = findIife();
@@ -2295,11 +2437,7 @@ function handleProxyHttpFromAdmin(msg) {
   }
   const existing = proxyHttpReqs.get(id);
   if (existing) {
-    try {
-      existing.destroy();
-    } catch {
-      /* ignore */
-    }
+    destroyProxyHttpReq(existing);
     proxyHttpReqs.delete(id);
   }
   const port = localPortForProxy(ws, appId);
@@ -2315,11 +2453,13 @@ function handleProxyHttpFromAdmin(msg) {
   const path = safeProxyPath(msg.path);
   const ctx = shareProxyContext(msg, ws, appId);
   ctx.port = port;
+  if (replyShareInterceptor(id, ctx, path)) return;
   const prepared = prepareShareHttpRequest(
     proxyReqHeaders(msg.headers),
     ctx.publicBase,
     ctx.acceptEncoding,
-    path
+    path,
+    ctx.portUrls
   );
   ctx.acceptEncoding = prepared.acceptEncoding;
   ctx.ifNoneMatch = prepared.ifNoneMatch;
@@ -2467,20 +2607,62 @@ function handleProxyHttpFromAdmin(msg) {
         error: err instanceof Error ? err.message : String(err),
       });
     });
-    proxyHttpReqs.set(id, req);
-    if (initialBody?.length) req.write(initialBody);
-    if (endAfter) req.end();
+    proxyHttpReqs.set(id, {
+      req,
+      rewrite:
+        shouldRewriteBody(headers) &&
+        ctx.portUrls &&
+        Object.keys(ctx.portUrls).length > 0,
+      chunks: [],
+      headers,
+      portUrls: ctx.portUrls,
+      publicBase: ctx.publicBase,
+    });
+    const entry = proxyHttpReqs.get(id);
+    if (entry.rewrite) {
+      if (initialBody?.length) entry.chunks.push(initialBody);
+      if (endAfter) {
+        const body = rewriteShareRequestBody(
+          Buffer.concat(entry.chunks),
+          headers,
+          ctx.portUrls,
+          ctx.publicBase
+        );
+        if (body?.length) req.write(body);
+        req.end();
+      }
+    } else {
+      if (initialBody?.length) req.write(initialBody);
+      if (endAfter) req.end();
+    }
   };
   connect();
 }
 
 function handleProxyHttpBodyFromAdmin(msg) {
   const id = typeof msg.id === "string" ? msg.id : "";
-  const req = proxyHttpReqs.get(id);
-  if (!req) return;
-  if (typeof msg.data === "string" && msg.data) {
-    req.write(Buffer.from(msg.data, "base64"));
+  const entry = proxyHttpReqs.get(id);
+  if (!entry) return;
+  const req = entry.req || entry;
+  const chunk =
+    typeof msg.data === "string" && msg.data
+      ? Buffer.from(msg.data, "base64")
+      : null;
+  if (entry.rewrite) {
+    if (chunk?.length) entry.chunks.push(chunk);
+    if (msg.eof === true) {
+      const body = rewriteShareRequestBody(
+        Buffer.concat(entry.chunks || []),
+        entry.headers,
+        entry.portUrls,
+        entry.publicBase
+      );
+      if (body?.length) req.write(body);
+      req.end();
+    }
+    return;
   }
+  if (chunk?.length) req.write(chunk);
   if (msg.eof === true) req.end();
 }
 
@@ -2509,10 +2691,14 @@ function attachProxyLocalWs(id, socket) {
   socket.addEventListener("message", (event) => {
     try {
       if (typeof event.data === "string") {
+        const portUrls = proxyWsPortUrls.get(id);
+        const data = portUrls
+          ? rewriteMappedLocalUrls(event.data, portUrls)
+          : event.data;
         bridgeSend({
           type: "proxy.ws.frame",
           id,
-          data: event.data,
+          data,
           binary: false,
         });
         return;
@@ -2532,6 +2718,7 @@ function attachProxyLocalWs(id, socket) {
   });
   socket.addEventListener("close", (event) => {
     proxyLocalSockets.delete(id);
+    proxyWsPortUrls.delete(id);
     bridgeSend({
       type: "proxy.ws.close",
       id,
@@ -2616,6 +2803,9 @@ function handleProxyWsOpenFromAdmin(msg) {
   }
   const path = safeProxyPath(msg.path);
   const protocols = wsProtocolsFromMsg(msg);
+  const fromMsg =
+    msg?.portUrls && typeof msg.portUrls === "object" ? msg.portUrls : {};
+  proxyWsPortUrls.set(id, { ...sharePortUrls(ws), ...fromMsg });
   if (isAiServerAppId(appId, ws)) {
     void (async () => {
       const embedded = await ensureEmbeddedChat(ws);
@@ -2644,7 +2834,9 @@ function handleProxyWsFrameFromAdmin(msg) {
     if (msg.binary === true) {
       socket.send(Buffer.from(String(msg.data || ""), "base64"));
     } else {
-      socket.send(String(msg.data || ""));
+      const portUrls = proxyWsPortUrls.get(id);
+      const data = String(msg.data || "");
+      socket.send(portUrls ? rewriteMappedLocalUrls(data, portUrls) : data);
     }
   } catch {
     /* ignore */
@@ -2656,6 +2848,7 @@ function handleProxyWsCloseFromAdmin(msg) {
   const socket = proxyLocalSockets.get(id);
   if (!socket) return;
   proxyLocalSockets.delete(id);
+  proxyWsPortUrls.delete(id);
   try {
     socket.close(
       typeof msg.code === "number" ? msg.code : 1000,
@@ -3089,6 +3282,10 @@ async function openInNewTerminal(opts) {
 }
 
 function commandWithPort(job, scripts, port) {
+  const command = String(job.command || "");
+  if (!/^(npm|pnpm|yarn|npx)\s/i.test(command)) {
+    return command;
+  }
   const raw = String(scripts?.[job.script] || "");
   if (
     job.role === "ui" ||
@@ -3096,9 +3293,9 @@ function commandWithPort(job, scripts, port) {
     isUiCommand(raw) ||
     /--port\b/i.test(raw)
   ) {
-    return `${job.command} -- --port ${port}`;
+    return `${command} -- --port ${port}`;
   }
-  return job.command;
+  return command;
 }
 
 async function stopEmbeddedChat(sandboxId) {
@@ -3551,9 +3748,8 @@ async function startSingleApp(ws, cfg, payload = {}, opts = {}) {
     await ensureHostProcesses(ws, {
       reserved,
       cfg,
-      onlyRoles: [app.role === "custom" ? "app" : app.role],
       force: true,
-      plannedJobs: jobsFromHostApps(ws),
+      plannedJobs: jobsFromHostApps(ws, { appId: app.id }),
     });
   }
   const status = await reconcileWorkspacePresence(ws, cfg, {
@@ -3665,32 +3861,21 @@ async function ensureHostProcesses(ws, opts = {}) {
   const reserved = opts.reserved instanceof Set ? opts.reserved : new Set();
   const cfg = opts.cfg || null;
   const folder = path.resolve(ws.folderPath);
-  const scripts = readPackageJson(folder)?.scripts || {};
   const jobs = Array.isArray(opts.plannedJobs)
     ? opts.plannedJobs
-    : planHostJobs(
-        folder,
-        ws.appUrl && isLocalAppUrl(ws.appUrl) ? ws.appUrl : null,
-        ws.projectInfo
-      );
+    : jobsFromHostApps(ws).length
+      ? jobsFromHostApps(ws)
+      : planHostJobs(
+          folder,
+          ws.appUrl && isLocalAppUrl(ws.appUrl) ? ws.appUrl : null,
+          ws.projectInfo
+        );
   const onlyRoles = Array.isArray(opts.onlyRoles) ? new Set(opts.onlyRoles) : null;
   const extraEnv = opts.extraEnv && typeof opts.extraEnv === "object" ? opts.extraEnv : {};
   const started = [];
   let persisted = false;
   const label = ws.sandboxName || "this sandbox";
 
-  if (jobs.length > 0 && !fs.existsSync(folder)) {
-    recordProcessProblem({
-      sandboxId: ws.sandboxId,
-      code: "host_process_launch",
-      role: "app",
-      title: `Could not start the app (${label})`,
-      message: `The project folder is missing: ${folder}`,
-      resolution: "Attach the folder again from Local setup.",
-    });
-    return started;
-  }
-
   log(
     `start hosts ${label}: ${
       jobs.length
@@ -3704,6 +3889,19 @@ async function ensureHostProcesses(ws, opts = {}) {
 
   for (const job of jobs) {
     if (onlyRoles && !onlyRoles.has(job.role)) continue;
+    const jobFolder = path.resolve(job.folder || folder);
+    if (!fs.existsSync(jobFolder)) {
+      recordProcessProblem({
+        sandboxId: ws.sandboxId,
+        code: "host_process_launch",
+        role: job.role,
+        title: `Could not start the ${processRoleLabel(job.role)} (${label})`,
+        message: `The project folder is missing: ${jobFolder}`,
+        resolution: "Attach the folder again from Local setup.",
+      });
+      continue;
+    }
+    const scripts = readPackageJson(jobFolder)?.scripts || {};
     const preferred = Number(job.port || job.preferredPort) || 3000;
     const probe = job.port
       ? `http://127.0.0.1:${job.port}`
@@ -3715,7 +3913,7 @@ async function ensureHostProcesses(ws, opts = {}) {
       log(`${job.role} already running at ${job.probeUrl || probe}`);
       continue;
     }
-    const launchKey = `${ws.sandboxId}:${folder}:${job.script}`;
+    const launchKey = `${ws.sandboxId}:${jobFolder}:${job.command || job.script}:${preferred}`;
     if (!opts.force && recentlyLaunched(launchKey)) {
       reserved.add(preferred);
       log(`start ${job.role} skip ${label}: launched recently`);
@@ -3747,13 +3945,13 @@ async function ensureHostProcesses(ws, opts = {}) {
     }
 
     const needsInstall =
-      fs.existsSync(path.join(folder, "package.json")) &&
-      !fs.existsSync(path.join(folder, "node_modules"));
+      fs.existsSync(path.join(jobFolder, "package.json")) &&
+      !fs.existsSync(path.join(jobFolder, "node_modules"));
     const run = commandWithPort(job, scripts, port);
     const command = needsInstall ? `npm install && ${run}` : run;
     const opened = await openInNewTerminal({
       title: `MP-${job.role}-${port}`,
-      folder,
+      folder: jobFolder,
       command,
       env: { PORT: String(port), ...extraEnv },
       launchKey,
@@ -3812,7 +4010,7 @@ async function inspectHostJobs(ws) {
     const preferred = Number(job.preferredPort) || 3000;
     const probe = job.probeUrl || `http://127.0.0.1:${preferred}`;
     const up = await probeLoopbackUrl(probe);
-    const launchKey = `${ws.sandboxId}:${folder}:${job.script}`;
+    const launchKey = `${ws.sandboxId}:${job.folder || folder}:${job.command || job.script}:${preferred}`;
     const starting = recentlyLaunched(launchKey);
     hosts.push({
       role: job.role,
@@ -3904,6 +4102,79 @@ async function setupWorkspace(cfg, action) {
     config.sandbox?.name ||
     "Maintainer Pro App";
 
+  const partnerIgnorePaths = Array.isArray(config.aiIgnorePaths)
+    ? config.aiIgnorePaths
+    : [];
+  const addFolder = Boolean(action.payload?.addFolder);
+  cfg.workspaces = cfg.workspaces || [];
+  const existingIdx = cfg.workspaces.findIndex((w) => w.sandboxId === sandboxId);
+  const existingWs = existingIdx >= 0 ? cfg.workspaces[existingIdx] : null;
+
+  if (addFolder && existingWs?.folderPath) {
+    const extra = Array.isArray(existingWs.extraFolders)
+      ? [...existingWs.extraFolders]
+      : [];
+    if (
+      !sameFolder(existingWs.folderPath, resolved) &&
+      !extra.some((folder) => sameFolder(folder, resolved))
+    ) {
+      extra.push(resolved);
+    }
+    existingWs.extraFolders = extra;
+    const access = applyAccessPolicy(resolved, partnerIgnorePaths, sandboxId);
+    persistWorkspaceEntry(cfg, existingWs);
+    const ports = await resolveWorkspaceHostApps(existingWs, {
+      cfg,
+      allowAi: false,
+      ignoreDesired: true,
+      unionDetected: true,
+      force: true,
+    });
+    const needsReview =
+      Boolean(ports.confused) ||
+      !(ports.apps || []).some((app) => app && app.role !== "ai-server");
+    if (needsReview) {
+      activity(
+        sandboxId,
+        "warn",
+        "Review the suggested apps and ports in Maintainer Pro before Start Apps."
+      );
+    }
+    await inspectHostJobs(existingWs);
+    const host = workspaceHostReport(existingWs);
+    const aiServerUp = await isChatServerOnPort(existingWs.port);
+    log(`setup added folder ${resolved} sandbox=${shortId(sandboxId)}`);
+    return {
+      sandboxId,
+      folderPath: existingWs.folderPath,
+      extraFolders: extra,
+      addFolder: true,
+      addedFolder: resolved,
+      port: existingWs.port,
+      appUrl: host.appUrl || existingWs.appUrl || null,
+      origins: host.origins,
+      wroteEnv: false,
+      clientKind: existingWs.clientKind || "skip",
+      clientFiles: [],
+      clientNotes: [`Added folder ${resolved}`],
+      aiServerUp,
+      startedHosts: [],
+      openUrl: existingWs.appUrl || `http://localhost:${existingWs.port}`,
+      processIssues: issuesForSandbox(sandboxId).map(
+        ({ role: _role, ...issue }) => issue
+      ),
+      warning: needsReview
+        ? "Folder attached. Review the suggested apps and ports in Maintainer Pro, then Start Apps."
+        : "Folder attached. Review apps if needed, then use Start Apps.",
+      waitingForStart: !aiServerUp,
+      needsReview,
+      hostApps: ports.apps || existingWs.hostApps || [],
+      reasons: ports.reasons || [],
+      projectInfo: existingWs.projectInfo || null,
+      ignorePaths: access.ignorePaths,
+    };
+  }
+
   const client = configureClient({
     dir: resolved,
     port,
@@ -3916,23 +4187,22 @@ async function setupWorkspace(cfg, action) {
   const corsOrigin = client.corsOrigin || aiOrigin;
   const appUrl = client.appUrl || corsOrigin;
 
-  const partnerIgnorePaths = Array.isArray(config.aiIgnorePaths)
-    ? config.aiIgnorePaths
-    : [];
   const access = applyAccessPolicy(resolved, partnerIgnorePaths, sandboxId);
 
-  cfg.workspaces = cfg.workspaces || [];
-  const existing = cfg.workspaces.findIndex((w) => w.sandboxId === sandboxId);
   const entry = {
     sandboxId,
     folderPath: resolved,
+    extraFolders: Array.isArray(existingWs?.extraFolders)
+      ? existingWs.extraFolders.filter((folder) => !sameFolder(folder, resolved))
+      : [],
     port,
     sandboxName: config.sandbox?.name,
     applicationName: config.sandbox?.applicationName,
     clientKind: client.kind,
     appUrl,
     sameOrigin: Boolean(client.sameOrigin),
-    appsRequested: false,
+    appsRequested: existingWs?.appsRequested || false,
+    hostApps: existingWs?.hostApps,
     store: {
       serverKey: String(config.env?.MAINTAINER_PRO_API_KEY || "").trim(),
       clientKey: String(
@@ -3942,7 +4212,7 @@ async function setupWorkspace(cfg, action) {
       ).trim(),
     },
   };
-  if (existing >= 0) cfg.workspaces[existing] = entry;
+  if (existingIdx >= 0) cfg.workspaces[existingIdx] = { ...existingWs, ...entry };
   else cfg.workspaces.push(entry);
   saveConfig(cfg);
 
@@ -3994,7 +4264,9 @@ async function setupWorkspace(cfg, action) {
   const host = workspaceHostReport(entry);
   return {
     sandboxId,
-    folderPath: resolved,
+    folderPath: entry.folderPath,
+    extraFolders: entry.extraFolders || [],
+    addFolder: false,
     port: entry.port,
     appUrl: host.appUrl || entry.appUrl || appUrl,
     origins: host.origins.length
@@ -4019,7 +4291,8 @@ async function setupWorkspace(cfg, action) {
 }
 
 async function proposeSetupForWorkspace(ws, cfg, opts = {}) {
-  const folder = path.resolve(ws.folderPath || "");
+  const folders = workspaceFolders(ws);
+  const folder = folders[0] || path.resolve(ws.folderPath || "");
   const label = ws.sandboxName || shortId(ws.sandboxId) || "sandbox";
   activity(ws.sandboxId, "info", `Suggesting setup for ${label} from config files`);
   try {
@@ -4031,6 +4304,7 @@ async function proposeSetupForWorkspace(ws, cfg, opts = {}) {
     }
     const proposal = await cli.proposeHostAppsFromConfig({
       workspaceDir: folder,
+      workspaceDirs: folders,
       appName: ws.applicationName || ws.sandboxName,
       preferredAiPort: Number(ws.port) || 3100,
       allowAi: opts.allowAi !== false,
@@ -4145,12 +4419,17 @@ async function runActions(cfg, actions) {
             partnerIgnorePaths,
             ws.sandboxId
           );
+          const extras = workspaceFolders(ws).slice(1).map((folder) =>
+            applyAccessPolicy(folder, partnerIgnorePaths, ws.sandboxId)
+          );
           log(
-            `access policy synced for ${ws.folderPath} (${access.ignorePaths.length} ignore rules)`
+            `access policy synced for ${workspaceFolders(ws).join(", ")} (${access.ignorePaths.length} ignore rules)`
           );
           result = {
             folderPath: path.resolve(ws.folderPath),
+            extraFolders: workspaceFolders(ws).slice(1),
             ignorePaths: access.ignorePaths,
+            extraIgnorePaths: extras.map((row) => row.ignorePaths),
             syncedAt: new Date().toISOString(),
           };
         }
@@ -4386,13 +4665,46 @@ async function runActions(cfg, actions) {
         const sandboxId = String(
           action.sandboxId || action.payload?.sandboxId || ""
         );
-        await forgetLaunch(sandboxId);
-        cfg.workspaces = (cfg.workspaces || []).filter(
-          (w) => w.sandboxId !== sandboxId
-        );
-        saveConfig(cfg);
-        result = { removedSandboxId: sandboxId };
-        log(`${label} removed workspace`);
+        if (action.payload?.keepWorkspace) {
+          const ws = (cfg.workspaces || []).find((w) => w.sandboxId === sandboxId);
+          if (!ws) {
+            ok = false;
+            result = { error: "No folder is attached for this sandbox" };
+          } else {
+            const removed = String(action.payload.folderPath || "");
+            const remaining = Array.isArray(action.payload.extraFolders)
+              ? action.payload.extraFolders
+              : workspaceFolders(ws).filter((folder) => !sameFolder(folder, removed));
+            const primary =
+              String(action.payload.folderPathRemaining || remaining[0] || ws.folderPath);
+            ws.folderPath = primary;
+            ws.extraFolders = remaining.filter((folder) => !sameFolder(folder, primary));
+            ws.hostApps = (Array.isArray(ws.hostApps) ? ws.hostApps : []).filter(
+              (app) =>
+                !app ||
+                app.role === "ai-server" ||
+                !app.folderPath ||
+                !sameFolder(app.folderPath, removed)
+            );
+            persistWorkspaceEntry(cfg, ws);
+            result = {
+              sandboxId,
+              folderPath: ws.folderPath,
+              extraFolders: ws.extraFolders,
+              port: ws.port,
+              hostApps: ws.hostApps,
+            };
+            log(`${label} removed extra folder ${removed}`);
+          }
+        } else {
+          await forgetLaunch(sandboxId);
+          cfg.workspaces = (cfg.workspaces || []).filter(
+            (w) => w.sandboxId !== sandboxId
+          );
+          saveConfig(cfg);
+          result = { removedSandboxId: sandboxId };
+          log(`${label} removed workspace`);
+        }
       } else {
         ok = false;
         result = { error: `Unknown action ${action.code}` };