feat: harden workspace file APIs

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

internal/workspace/manager.go

@@ -3,6 +3,7 @@ package workspace
 import (
 	"os"
 	"path/filepath"
+	"sort"
 
 	"codespace/internal/util"
 )
@@ -12,6 +13,7 @@ type Manager interface {
 	Create(id string) (*Workspace, error)
 	Get(id string) (*Workspace, error)
 	Delete(id string) error
+	List() ([]Workspace, error)
 }
 
 // LocalManager implements Manager using the local filesystem.
@@ -71,3 +73,29 @@ func (m *LocalManager) Delete(id string) error {
 	}
 	return nil
 }
+
+// List returns all workspaces under the manager root, sorted by ID.
+// Only directories whose names pass ValidID are included.
+func (m *LocalManager) List() ([]Workspace, error) {
+	if err := os.MkdirAll(m.root, 0o755); err != nil {
+		return nil, util.Wrap(util.CodeInternal, "failed to ensure workspace root", err)
+	}
+	entries, err := os.ReadDir(m.root)
+	if err != nil {
+		return nil, util.Wrap(util.CodeInternal, "failed to read workspace root", err)
+	}
+	var result []Workspace
+	for _, e := range entries {
+		if !e.IsDir() {
+			continue
+		}
+		if !ValidID(e.Name()) {
+			continue
+		}
+		result = append(result, Workspace{ID: e.Name(), Root: RootFor(m.root, e.Name())})
+	}
+	sort.Slice(result, func(i, j int) bool {
+		return result[i].ID < result[j].ID
+	})
+	return result, nil
+}

internal/workspace/manager_test.go

@@ -0,0 +1,51 @@
+package workspace
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestLocalManagerListReturnsSortedWorkspaces(t *testing.T) {
+	mgr := NewLocalManager(t.TempDir())
+	if _, err := mgr.Create("beta"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := mgr.Create("alpha"); err != nil {
+		t.Fatal(err)
+	}
+
+	got, err := mgr.List()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 2 {
+		t.Fatalf("len = %d, want 2", len(got))
+	}
+	if got[0].ID != "alpha" || got[1].ID != "beta" {
+		t.Fatalf("ids = %q, %q; want alpha, beta", got[0].ID, got[1].ID)
+	}
+	if got[0].Root == "" || got[1].Root == "" {
+		t.Fatal("manager list should keep internal roots for service use")
+	}
+}
+
+func TestLocalManagerListSkipsUnsafeDirectoryNames(t *testing.T) {
+	root := t.TempDir()
+	if err := os.Mkdir(filepath.Join(root, "valid"), 0755); err != nil {
+		t.Fatal(err)
+	}
+	// Contains space, which is invalid per ValidID regex
+	if err := os.Mkdir(filepath.Join(root, "bad name"), 0755); err != nil {
+		t.Fatal(err)
+	}
+
+	mgr := NewLocalManager(root)
+	got, err := mgr.List()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 1 || got[0].ID != "valid" {
+		t.Fatalf("got %#v, want only valid", got)
+	}
+}