add harness checks for first workdir write + open-folder action

Author: ferologics

AGENTS.md

@@ -87,6 +87,8 @@ mise run test-delete-tasks
 mise run test-auth-list / test-auth-set-key / test-auth-delete / test-auth-import-pi
 mise run test-send-login                 # trigger /login UI flow
 mise run test-open-preview <task> <path> # open file preview
+mise run test-write-working-file <path> [content] # write file via runtime /mnt/workdir path
+mise run test-open-working-folder <task> # open task working folder via Finder action path
 mise run test-check-permissions          # verify screenshot capture works
 ```
 

README.md

@@ -56,6 +56,8 @@ mise run test-auth-set-key <provider> <key>
 mise run test-auth-delete <provider>
 mise run test-auth-import-pi
 mise run test-open-preview <task-id> <relative-path>
+mise run test-write-working-file <relative-path> [content]
+mise run test-open-working-folder <task-id>
 mise run test-dump-state
 mise run test-screenshot name
 mise run test-check-permissions   # quick preflight for screenshot visibility

TODO.md

@@ -29,8 +29,8 @@
 - [x] **Fix opener permission path** — added `opener:allow-open-path` capability so `Open in Finder` is authorized.
 - [x] **Fix right-panel error isolation** — Working-folder action errors are now scoped to the Working folder card.
 - [x] **Fix first `/mnt/workdir` write reliability (race mitigation)** — task-bound folder changes now mark `taskSwitching` before validation, and prompt send is blocked until runtime is ready.
-- [ ] **Add harness regression for working-folder writes** — set folder → write file immediately → assert host path has file.
-- [ ] **Add harness check for open-folder action** — validate Working-folder header icon opens Finder path successfully.
+- [x] **Add harness regression for working-folder writes** — set folder → write file immediately → assert host path has file.
+- [x] **Add harness check for open-folder action** — validate Working-folder header icon opens Finder path successfully.
 - [ ] **Inject minimal FS runtime hint into prompts** — include working-folder host path + `/mnt/workdir` alias + scratchpad path, and refresh when folder is bound later (not just at startup).
 - [x] **Fix dev cwd chip staleness on task reopen** — reopen now validates persisted working folder before runtime prep, then refreshes on `task_ready`, so cwd settles to `/mnt/workdir...` instead of sticking at `/mnt/taskstate/.../outputs`.
 - [ ] **Delete remaining slop** — review docs for stale references to v1, v2 flags, sync protocol, smoke suites
@@ -84,6 +84,6 @@
 
 ## Testing
 
-- Harness primitives: `test-start`, `test-prompt`, `test-screenshot`, `test-set-folder`, `test-set-task`, `test-create-task`, `test-delete-tasks`, `test-dump-state`, `test-stop`, `test-open-preview`, `test-auth-*`, `test-send-login`, `test-check-permissions`
+- Harness primitives: `test-start`, `test-prompt`, `test-screenshot`, `test-set-folder`, `test-set-task`, `test-create-task`, `test-delete-tasks`, `test-dump-state`, `test-stop`, `test-open-preview`, `test-write-working-file`, `test-open-working-folder`, `test-auth-*`, `test-send-login`, `test-check-permissions`
 - Scope enforcement: `scripts/harness/path-i-lite-negative.sh`
 - Rule: primitives only, no monolithic E2E scripts

docs/task-artifact-contract.md

@@ -61,8 +61,8 @@ Last updated: 2026-02-06
 - [ ] Add harness evidence for contract:
   - [x] folder-change rejection on existing task
   - [x] scratchpad aggregation (`outputs` + `uploads`)
-  - [ ] opener action permission success (`Open in Finder` works in packaged UI)
-  - [ ] first-write working-folder reliability (`/mnt/workdir` write appears on host without retry)
+  - [x] opener action permission success (`Open in Finder` works in packaged UI)
+  - [x] first-write working-folder reliability (`/mnt/workdir` write appears on host without retry)
   - [ ] uploads write-denied behavior
 
 ## Notes

docs/testing-strategy.md

@@ -22,6 +22,7 @@ Tasks: `test-create-task`, `test-delete-tasks`, `test-set-task`
 Folders: `test-set-folder` (one-time bind; existing bound task rejects changes)
 Auth: `test-auth-list`, `test-auth-set-key`, `test-auth-delete`, `test-auth-import-pi`, `test-send-login`
 Preview: `test-open-preview`
+Working-folder helpers: `test-write-working-file`, `test-open-working-folder`
 Preflight: `test-check-permissions` (screenshot permission)
 
 Screenshot checks require Screen Recording permission. Blank/black captures fail.

mise-tasks/test-open-working-folder

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+#MISE description="Open a task's working folder via the Finder action path (test harness)"
+set -euo pipefail
+
+TASK_ID="${1:-}"
+
+if [[ -z "$TASK_ID" ]]; then
+    echo "Usage: mise run test-open-working-folder <task-id>"
+    exit 1
+fi
+
+if ! nc -z localhost 19385 2>/dev/null; then
+    echo "Test server not running. Run: mise run test-start"
+    exit 1
+fi
+
+RESULT=$(python - "$TASK_ID" <<'PY' | nc -w 2 localhost 19385
+import json
+import sys
+
+payload = {
+    "cmd": "open_working_folder",
+    "taskId": sys.argv[1],
+}
+print(json.dumps(payload))
+PY
+)
+
+if [[ "$RESULT" == ERR:* ]]; then
+    echo "$RESULT"
+    exit 1
+fi
+
+echo "$RESULT"

mise-tasks/test-write-working-file

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+#MISE description="Write a file into /mnt/workdir via runtime (test harness)"
+set -euo pipefail
+
+RELATIVE_PATH="${1:-}"
+CONTENT="${2:-}"
+
+if [[ -z "$RELATIVE_PATH" ]]; then
+    echo "Usage: mise run test-write-working-file <relative-path> [content]"
+    exit 1
+fi
+
+if ! nc -z localhost 19385 2>/dev/null; then
+    echo "Test server not running. Run: mise run test-start"
+    exit 1
+fi
+
+RESULT=$(python - "$RELATIVE_PATH" "$CONTENT" <<'PY' | nc -w 2 localhost 19385
+import json
+import sys
+
+payload = {
+    "cmd": "write_working_file",
+    "relativePath": sys.argv[1],
+    "content": sys.argv[2],
+}
+print(json.dumps(payload))
+PY
+)
+
+if [[ "$RESULT" == ERR:* ]]; then
+    echo "$RESULT"
+    exit 1
+fi
+
+echo "$RESULT"

src-tauri/src/lib.rs

@@ -963,6 +963,8 @@ fn sanitize_test_server_value(value: &serde_json::Value) -> serde_json::Value {
 /// - `{"cmd":"artifact_list","taskId":"..."}` - returns scratchpad artifact list JSON (`outputs` + `uploads`)
 /// - `{"cmd":"artifact_read","taskId":"...","source":"outputs|uploads","relativePath":"..."}` - returns artifact file content JSON
 /// - `{"cmd":"open_preview","taskId":"...","relativePath":"..."}` - opens preview pane in UI
+/// - `{"cmd":"write_working_file","relativePath":"...","content":"..."}` - writes a file via runtime `system_bash` after folder bind settles
+/// - `{"cmd":"open_working_folder","taskId":"..."}` - opens a task working folder via the same `open_path_in_finder` path as the UI action
 /// - `{"cmd":"rpc",...}` - sends raw RPC to VM
 #[cfg(debug_assertions)]
 #[allow(clippy::too_many_lines)]
@@ -1236,6 +1238,70 @@ fn start_test_server(app_handle: tauri::AppHandle) {
                             let _ = app.emit("test_open_preview", payload);
                             let _ = stream.write_all(b"OK\n");
                         }
+                        "write_working_file" => {
+                            let relative_path = json.get("relativePath").and_then(|v| v.as_str()).unwrap_or("");
+                            let content = json.get("content").and_then(|v| v.as_str()).unwrap_or("");
+
+                            if relative_path.trim().is_empty() {
+                                let _ = stream.write_all(b"ERR: relativePath is required\n");
+                                continue;
+                            }
+
+                            eprintln!("[test-server] emitting test_write_working_file: {relative_path}");
+                            let payload = serde_json::json!({
+                                "relativePath": relative_path,
+                                "content": content,
+                            });
+                            let _ = app.emit("test_write_working_file", payload);
+                            let _ = stream.write_all(b"OK\n");
+                        }
+                        "open_working_folder" => {
+                            let task_id = json.get("taskId").and_then(|v| v.as_str()).unwrap_or("").trim();
+
+                            if task_id.is_empty() {
+                                let _ = stream.write_all(b"ERR: taskId is required\n");
+                                continue;
+                            }
+
+                            if !is_valid_task_id(task_id) {
+                                let _ = stream.write_all(b"ERR: Invalid task id\n");
+                                continue;
+                            }
+
+                            let tasks_path = match tasks_dir(&app) {
+                                Ok(path) => path,
+                                Err(error) => {
+                                    let _ = stream.write_all(format!("ERR: {error}\n").as_bytes());
+                                    continue;
+                                }
+                            };
+
+                            let task = match task_store::load_task(&tasks_path, task_id) {
+                                Ok(Some(task)) => task,
+                                Ok(None) => {
+                                    let _ = stream.write_all(b"ERR: Task not found\n");
+                                    continue;
+                                }
+                                Err(error) => {
+                                    let _ = stream.write_all(format!("ERR: {error}\n").as_bytes());
+                                    continue;
+                                }
+                            };
+
+                            let Some(folder) = task.working_folder else {
+                                let _ = stream.write_all(b"ERR: Task has no working folder\n");
+                                continue;
+                            };
+
+                            match open_path_in_finder(folder) {
+                                Ok(()) => {
+                                    let _ = stream.write_all(b"OK\n");
+                                }
+                                Err(error) => {
+                                    let _ = stream.write_all(format!("ERR: {error}\n").as_bytes());
+                                }
+                            }
+                        }
                         _ => {
                             // Direct RPC send (bypass UI)
                             let state: tauri::State<vm::VmState> = app.state();

src/lib/__tests__/integration/harness.ts

@@ -458,6 +458,29 @@ export class IntegrationHarness {
         }
     }
 
+    async writeWorkingFile(relativePath: string, content: string): Promise<void> {
+        const response = await this.sendCommand({
+            cmd: "write_working_file",
+            relativePath,
+            content,
+        });
+
+        if (!isOkResponse(response)) {
+            throw new Error(`write_working_file failed: ${response}`);
+        }
+    }
+
+    async openWorkingFolder(taskId: string): Promise<void> {
+        const response = await this.sendCommand({
+            cmd: "open_working_folder",
+            taskId,
+        });
+
+        if (!isOkResponse(response)) {
+            throw new Error(`open_working_folder failed: ${response}`);
+        }
+    }
+
     async previewList(taskId: string): Promise<PreviewListResponse> {
         return await this.sendJson<PreviewListResponse>({ cmd: "preview_list", taskId });
     }
@@ -516,6 +539,27 @@ export class IntegrationHarness {
         );
     }
 
+    async waitForHostFile(filePath: string, expectedContent: string, timeoutMs = 60_000): Promise<string> {
+        return await waitFor(
+            async () => {
+                if (!existsSync(filePath)) {
+                    return null;
+                }
+
+                try {
+                    const content = readFileSync(filePath, "utf8");
+                    return content === expectedContent ? content : null;
+                } catch {
+                    return null;
+                }
+            },
+            timeoutMs,
+            250,
+            `host file ${filePath}`,
+            async () => this.timeoutDiagnostics(`host file ${filePath}`),
+        );
+    }
+
     async listTasks(): Promise<TaskSummary[]> {
         return await this.sendJson<TaskSummary[]>({ cmd: "task_list" });
     }

src/lib/__tests__/integration/runtime-steady-state.integration.test.ts

@@ -1,5 +1,6 @@
 /* @vitest-environment node */
 
+import { mkdirSync, rmSync } from "node:fs";
 import path from "node:path";
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
 import { IntegrationHarness } from "./harness";
@@ -8,15 +9,18 @@ describe.sequential("runtime steady-state contracts", () => {
     const harness = new IntegrationHarness();
     const prefix = `regression-steady-${Date.now()}`;
     const workingFolder = path.resolve(process.cwd());
+    const firstWriteFolder = path.resolve(process.cwd(), "tmp/integration/first-write");
 
     beforeAll(async () => {
+        mkdirSync(firstWriteFolder, { recursive: true });
         await harness.start();
         await harness.deleteTasksByPrefix(prefix);
     }, 360_000);
 
     afterAll(async () => {
         await harness.deleteTasksByPrefix(prefix).catch(() => undefined);
         await harness.stop();
+        rmSync(firstWriteFolder, { recursive: true, force: true });
     }, 120_000);
 
     async function createAndSelectTask(suffix: string) {
@@ -174,6 +178,63 @@ describe.sequential("runtime steady-state contracts", () => {
         expect(settledAfterBind.runtimeDebug.mismatchVisible).toBe(false);
     }, 240_000);
 
+    it("writes to the host working folder when queued immediately after first bind", async () => {
+        const task = await createAndSelectTask("first-write");
+        const fileName = `first-write-${Date.now()}.txt`;
+        const fileContent = `first-write-token-${Date.now()}`;
+        const hostPath = path.join(firstWriteFolder, fileName);
+
+        await harness.setFolder(firstWriteFolder);
+        await harness.writeWorkingFile(fileName, fileContent);
+        await harness.waitForHostFile(hostPath, fileContent, 120_000);
+
+        const settled = await harness.waitForSnapshot((snapshot) => {
+            if (snapshot.task.currentTaskId !== task.id) {
+                return null;
+            }
+
+            if (!snapshot.runtime.rpcConnected || snapshot.runtime.taskSwitching) {
+                return null;
+            }
+
+            if (snapshot.task.currentWorkingFolder !== firstWriteFolder) {
+                return null;
+            }
+
+            if (!snapshot.runtimeDebug.currentCwd?.startsWith("/mnt/workdir")) {
+                return null;
+            }
+
+            return snapshot;
+        }, 150_000);
+
+        expect(settled.runtimeDebug.currentCwd?.startsWith("/mnt/workdir")).toBe(true);
+    }, 240_000);
+
+    it("opens task working folder through the Finder action path", async () => {
+        const task = await createAndSelectTask("open-working-folder");
+
+        await harness.setFolder(workingFolder);
+
+        await harness.waitForSnapshot((snapshot) => {
+            if (snapshot.task.currentTaskId !== task.id) {
+                return null;
+            }
+
+            if (!snapshot.runtime.rpcConnected || snapshot.runtime.taskSwitching) {
+                return null;
+            }
+
+            if (snapshot.task.currentWorkingFolder !== workingFolder) {
+                return null;
+            }
+
+            return snapshot;
+        }, 150_000);
+
+        await harness.openWorkingFolder(task.id);
+    }, 240_000);
+
     it("keeps model picker state truthful (empty/error/real)", async () => {
         const task = await createAndSelectTask("models");