feat(up): return the resolved workspace folder in JSON results

[atty303]

I’m integrating Devsy with an external tool that starts a workspace and then connects over SSH to run commands in the project directory. I want to obtain the container-side workspace folder from the successful workspace up --result-format json result, alongside the container ID and remote user.

Currently, remoteWorkspaceFolder can be empty when workspaceFolder is omitted, even though Devsy has already resolved the folder. The integration must then discover the path separately or reproduce Devsy’s default-path logic.

Return the already-resolved folder so integrations can use Devsy’s result directly. This fits the existing success output: containerId identifies the actual container, remoteUser is the resolved user, and workspace build already reports the resolved workspace folder.

When emitting the success JSON, use SubstitutionContext.ContainerWorkspaceFolder only if the existing workdir is empty. Preserve explicit workspaceFolder, Git subpath, and CLI override results. Keep the shared resolver and the workdir passed to SSH configuration and tunnels unchanged.

This intentionally changes the previously accepted empty-folder behavior when the folder is unspecified.

Validation:

• Added nine unit-test cases covering default and custom mount folders, a literal shell-expression path, missing merged config, explicit settings, Git subpaths, and CLI overrides. Verify that JSON emission preserves the workdir used by SSH, and cover missing result/substitution context.
• Verified the default-folder JSON cases fail against the original implementation, and the SSH-default preservation cases fail against the previous PR revision.
• Passed CLI lint and race tests for cmd/workspace/up and pkg/devcontainer/config.
• Passed the focused Docker JSON and OpenVSCode E2E tests.

Summary by CodeRabbit

• Bug Fixes
  • Workspace results now include the configured workspace folder when no other folder is specified.
  • Explicit workspace-folder settings and command-line overrides take precedence, while Git subpaths and merged settings are respected.

[netlify]

✅ Deploy Preview for images-devsy-sh canceled.

Name	Link
🔨 Latest commit	91ecb26
🔍 Latest deploy log	https://app.netlify.com/projects/images-devsy-sh/deploys/6acb985e15dedb000809a389

[netlify]

✅ Deploy Preview for devsydev canceled.

Name	Link
🔨 Latest commit	91ecb26
🔍 Latest deploy log	https://app.netlify.com/projects/devsydev/deploys/6acb985ea200f20008a551b3

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-11T14:12:29.195367Z	91ecb26	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[devsy-app]

All contributors have signed the CLA.
_{Posted by the CLA Assistant Lite bot.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 98c50bcd-7cc7-4135-940d-d77c58405c64

---

---

📥 Commits

Reviewing files that changed from the base of the PR and between f9135ae and 91ecb26.

---

---

📒 Files selected for processing (2)

• cmd/workspace/up/up.go
• cmd/workspace/up/up_workdir_test.go

---

---

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 0 remain after this review.

---

---

---

📝 Walkthrough

📝 Walkthrough

Walkthrough

emitUpResult now uses the resolved workdir for the remote workspace folder. If the workdir is empty and a substitution context exists, it uses that context’s workspace folder. Unit and end-to-end tests check the emitted value.

Changes

Workspace folder result

Layer / File(s)	Summary
Resolve and verify the remote workspace folder cmd/workspace/up/up.go, cmd/workspace/up/up_workdir_test.go, e2e/tests/up/up_behaviors.go	emitUpResult falls back to the substitution-context workspace folder when the workdir is empty. Unit tests cover folder sources, override precedence, and preservation of supplied workdirs. End-to-end tests assert that success results contain a non-empty remote workspace folder.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Suggested reviewers: skevetter

---

---

Merge Risk: ⚪ Minimal · up to 91ecb

The JSON result now reports the resolved workspace folder when no workdir is supplied, without changing SSH or tunnel behavior. No material merge risk is evident.

Security Architecture Review

Security architecture risk: ⚪ Minimal · up to 91ecb

The change reports an already-resolved folder without changing workspace execution, SSH configuration, tunnel setup, or permissions. No material security risk was identified in the changed production flow. External integrations that consume the result were not available for review.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The demonstrated exposure change is limited to recipients of the workspace-up JSON result receiving the resolved workspace path when workdir is empty. No changed tenant selection, credentials, privileges, or repository-local execution consumer was established. The external integration's subsequent use of that path remains outside reviewed evidence.

Trust Boundaries and Controls

• observed — The changed path value crosses a JSON serialization boundary, not a shell-execution or authorization boundary. WriteResultJSON marshals the envelope. The supplied public-entrypoint ranges are same-package tests and helpers; their calls to emitUpResult do not create a new externally callable production entrypoint.

Resilience and Maintainability Implications

• observed — The fallback changes only a local emission variable. It does not mutate workspaceContext or SubstitutionContext, introduce a shared-state transition, or change cleanup and recovery ownership. Existing warning and recovery indicators remain separate envelope fields.

---

Pre-merge checks | 4 | 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 3 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: returning the resolved workspace folder in JSON results.

---

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

---

---

✨ Simplify code

• Create a new PR

---

---

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[atty303]

I have read the CLA Document and I hereby sign the CLA

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request