Restore project grouping across hosts (#2565)

* fix(projects): restore cross-host grouping

Random host-local project IDs replaced the remote-derived value that had also served as grouping identity. Persist a separate opaque group key and let normal boot reconciliation backfill older records without a migration.

* fix(projects): keep ambiguous clones separate

A shared remote can identify a project across hosts, but it cannot distinguish two independent clones on one host. Treat those keys as ambiguous so host-local project IDs remain separate.

* fix(projects): preserve host-local project identity

* fix(projects): strengthen grouping identity

* test(app): update project host shape contract

* fix(projects): preserve selected host identity

* fix(projects): close grouped routing gaps

* fix(projects): stabilize legacy subproject grouping

* fix(projects): preserve selected project identity

* fix(projects): isolate legacy host identity

* fix(projects): preserve symlinked bootstrap roots

* fix(projects): reconcile grouped custom names

* fix(projects): stabilize settings and path identity

* fix(projects): normalize default remote ports

* fix(projects): harden host and remote identity

* fix(projects): preserve host-scoped actions

* fix(projects): preserve remote path semantics

* fix(projects): model SCP remote semantics

* fix(projects): keep settings on routed host

* fix(projects): preserve SSH URL path semantics

* fix(projects): separate identity from presentation

* test(projects): use grouped identity in UI specs

* fix(projects): harden grouped project routing

* test(projects): expect framed settings route

* fix(projects): preserve exact placement identity

* fix(projects): harden grouping identity and routing

* fix(projects): restore project key as grouping identity

Random host-local project IDs had replaced the persisted cross-host value carried by projectKey. Keep projectId for routing while reconciliation owns and persists projectKey for grouping.

* fix(projects): prevent project key collisions

Preserve platform path semantics and generic remote transports in cross-host keys, and compare legacy checkout roots using filesystem equivalence before materializing ownership.

* test(projects): assert host-scoped project keys

* fix(projects): preserve project key compatibility

Resolve legacy workspace project references at the daemon boundary while keeping projectKey as the cross-host identity. Complete generic SSH normalization without collapsing distinct repositories.

* fix(projects): harden project reference identity

* fix(projects): retain archived reference errors

* fix(projects): scope legacy paths to hosts

* test(app): model persisted project keys

* fix(projects): retain absolute scp users

* fix(projects): resolve legacy mutation aliases

* fix(projects): preserve conservative identity boundaries

* fix(projects): preserve legacy placement identity

* test(projects): assert legacy placement identity

* test(projects): expect canonical Windows keys

* fix(projects): separate bootstrap identity fields

* fix(projects): scope legacy paths by host

* fix(projects): stabilize opaque project identity

* fix(projects): preserve remaining opaque identities

* fix(projects): classify forward-slash UNC roots

* fix(projects): preserve opaque selection keys

* fix(projects): frame host-local project keys

* fix(projects): canonicalize framed identities

* test(projects): isolate repeated remote fixtures

* fix(projects): keep project key as UI identity

* fix(projects): reconcile hydrated project references

* fix(projects): preserve archived project identity

* refactor(projects): group projects from project records, not workspaces

Cross-host grouping had been built by hanging a projectKey off every
workspace descriptor. That scoped the key to the wrong entity: the app
then had to reconstruct project identity per workspace in six modules,
which forced projectKey fallbacks into RPC arguments and a server-side
resolver that turned grouping keys back into project ids.

A workspace has a projectId. The key belongs to the project, and
grouping is a display concern, so the daemon now publishes projects
over project.list plus the existing project.update channel and the app
groups them in one place. Projects are addressed by host-local
projectId everywhere, including the settings route.

Projects persisted without a key are backfilled by ordinary boot
reconciliation, with no migration. Old daemons advertise no projectList
capability and simply do not group.

* test(projects): seed projects alongside workspaces in fixtures

Sidebar fixtures seeded workspaces without their projects, which the
daemon cannot produce now that projects arrive on their own channel, so
nothing rendered. Adds a seeding helper that supplies both.

Also drops the provisioning test for accepting a project key where a
project id belongs; that resolver was removed deliberately.

* fix(projects): keep derived project identity stable

Four gaps left by shrinking the key derivation:

Local keys used a bare path resolve, so one directory reached by a
different spelling produced a different key and reset grouped identity.
Windows CI caught this with the 8.3 and long-name forms of one temp
path. Canonicalize through the shared realpath-aware normalization.

Subproject display names lost their selected-path input, so every
subproject of a monorepo rendered under the same remote-derived name.

Reconciliation only ever backfilled a missing key, so a project whose
remote changed stayed grouped with hosts on the old remote.

Project settings kept a disconnected host selected and rendered a dead
end with no way back to an editable host.

* fix(projects): read scheme remotes as URLs, not scp form

An `ssh://user@host:22/org/repo` remote matched the scp-form pattern
first, because `[^@]+` happily eats `ssh://git`, so the port landed in
the path and the project keyed as `remote:host/22/org/repo`. Two
spellings of one remote therefore never grouped.

Try scp form only when there is no scheme, and drop protocol-default
ports so an explicitly written `:22` matches the same remote without it.

packages/app/e2e/helpers/add-project-flow.ts

@@ -37,17 +37,6 @@ export function addProjectFlowMethod(page: Page, method: AddProjectMethod): Loca
   return page.getByTestId(`add-project-flow-method-${method}`);
 }
 
-export async function waitForConnectedHost(
-  page: Page,
-  input: { serverId: string; endpoint: string },
-): Promise<void> {
-  await page.getByTestId("sidebar-hosts-trigger").click();
-  const host = page.getByTestId(`sidebar-host-row-${input.serverId}`);
-  await expect(host).toContainText(input.endpoint, { timeout: 30_000 });
-  await page.keyboard.press("Escape");
-  await expect(host).not.toBeVisible();
-}
-
 export async function expectAddProjectPage(page: Page, kind: AddProjectFlowPage): Promise<Locator> {
   const currentPage = page.getByTestId(`add-project-flow-page-${kind}`);
   await expect(currentPage).toBeVisible({ timeout: 30_000 });

packages/app/e2e/helpers/hosts.ts

@@ -57,6 +57,69 @@ export async function addOfflineHostAndReload(
   await page.reload();
 }
 
+export async function addConnectedHostAndReload(
+  page: Page,
+  input: { serverId: string; label: string; port: number; primaryLabel?: string },
+): Promise<void> {
+  await addConnectedHostsAndReload(page, [input], { primaryLabel: input.primaryLabel });
+}
+
+export async function addConnectedHostsAndReload(
+  page: Page,
+  inputs: Array<{ serverId: string; label: string; port: number }>,
+  options?: { primaryLabel?: string },
+): Promise<void> {
+  const connectedHosts = inputs.map((input) =>
+    buildSeededHost({
+      serverId: input.serverId,
+      label: input.label,
+      endpoint: `127.0.0.1:${input.port}`,
+      nowIso: new Date().toISOString(),
+    }),
+  );
+
+  await page.evaluate(
+    ({ hosts, keys, primaryLabel }) => {
+      const nonce = localStorage.getItem(keys.nonce);
+      if (!nonce) {
+        throw new Error("Expected the e2e seed nonce before overriding the host registry.");
+      }
+      const raw = localStorage.getItem(keys.registry);
+      const registry: Array<{ serverId: string; label?: string }> = raw ? JSON.parse(raw) : [];
+      if (primaryLabel && registry[0]) registry[0].label = primaryLabel;
+      for (const host of hosts) {
+        if (!registry.some((entry) => entry.serverId === host.serverId)) {
+          registry.push(host);
+        }
+      }
+      localStorage.setItem(keys.registry, JSON.stringify(registry));
+      localStorage.setItem(keys.disableSeedOnce, nonce);
+    },
+    {
+      hosts: connectedHosts,
+      keys: {
+        registry: REGISTRY_KEY,
+        nonce: SEED_NONCE_KEY,
+        disableSeedOnce: DISABLE_DEFAULT_SEED_ONCE_KEY,
+      },
+      primaryLabel: options?.primaryLabel,
+    },
+  );
+
+  await page.reload();
+}
+
+export async function waitForConnectedHost(
+  page: Page,
+  input: { serverId: string; endpoint: string },
+): Promise<void> {
+  await page.getByTestId("sidebar-hosts-trigger").click();
+  const host = page.getByTestId(`sidebar-host-row-${input.serverId}`);
+  await expect(host).toContainText(input.endpoint, { timeout: 30_000 });
+  await page.keyboard.press("Escape");
+  await expect(host).not.toBeVisible();
+}
+
 export async function openSidebarDisplayPreferences(page: Page): Promise<void> {
   await page.getByTestId("sidebar-display-preferences-menu").click();
   await expect(page.getByTestId("sidebar-display-preferences-content")).toBeVisible({

packages/app/e2e/helpers/isolated-host-daemon.ts

@@ -9,6 +9,7 @@ import { withDisabledE2ESpeechEnv } from "./speech-env";
 export interface IsolatedHostDaemon {
   serverId: string;
   port: number;
+  paseoHome: string;
   restart(): Promise<void>;
   close(): Promise<void>;
 }
@@ -133,6 +134,7 @@ export async function startIsolatedHostDaemon(serverId: string): Promise<Isolate
   return {
     serverId,
     port,
+    paseoHome,
     restart: async () => {
       if (closed) throw new Error(`Cannot restart closed isolated daemon ${serverId}`);
       await stopProcess(child);

packages/app/e2e/helpers/new-workspace.ts

@@ -18,6 +18,7 @@ type NewWorkspaceDaemonClient = Pick<
   | "getPaseoWorktreeList"
   | "getDaemonConfig"
   | "inspectWorkspaceRecovery"
+  | "listProjects"
   | "on"
   | "patchDaemonConfig"
   | "removeProject"
@@ -29,6 +30,7 @@ type WorkspaceDescriptor = NonNullable<CreateWorkspacePayload["workspace"]>;
 
 export interface OpenedProject {
   workspaceId: string;
+  projectId: string;
   projectKey: string;
   projectDisplayName: string;
   workspaceName: string;
@@ -45,10 +47,19 @@ function requireWorkspace(payload: WorkspacePayload) {
   return payload.workspace;
 }
 
-function openedProjectFromWorkspace(workspace: WorkspaceDescriptor): OpenedProject {
+async function openedProjectFromWorkspace(
+  client: NewWorkspaceDaemonClient,
+  workspace: WorkspaceDescriptor,
+): Promise<OpenedProject> {
+  const payload = await client.listProjects();
+  const project = payload.projects.find((candidate) => candidate.projectId === workspace.projectId);
+  if (!project?.projectKey) {
+    throw new Error(`Project ${workspace.projectId} has no project key`);
+  }
   return {
     workspaceId: workspace.id,
-    projectKey: workspace.projectId,
+    projectId: workspace.projectId,
+    projectKey: project.projectKey,
     projectDisplayName: workspace.projectDisplayName,
     workspaceName: workspace.name,
     workspaceDirectory: workspace.workspaceDirectory,
@@ -107,7 +118,7 @@ export async function openProjectViaDaemon(
       source: { kind: "directory", path: repoPath },
     }),
   );
-  return openedProjectFromWorkspace(workspace);
+  return openedProjectFromWorkspace(client, workspace);
 }
 
 export async function archiveWorkspaceFromDaemon(
@@ -149,7 +160,7 @@ export async function createWorktreeViaDaemon(
     worktreeSlug: input.slug,
   });
   const workspace = requireWorkspace(payload);
-  return openedProjectFromWorkspace(workspace);
+  return openedProjectFromWorkspace(client, workspace);
 }
 
 export async function openNewWorkspaceComposer(

packages/app/e2e/helpers/project-grouping.ts

@@ -0,0 +1,131 @@
+import { expect, type Locator, type Page } from "@playwright/test";
+import { gotoAppShell } from "./app";
+import { addConnectedHostsAndReload, waitForConnectedHost } from "./hosts";
+import { openProjectSettings } from "./project-settings";
+import { waitForSidebarHydration } from "./workspace-ui";
+
+const PROJECT_VISIBILITY_TIMEOUT = 30_000;
+
+function projectGroup(page: Page, projectName: string): Locator {
+  return page.getByRole("group", { name: projectName, exact: true });
+}
+
+function projectGroupWithWorkspace(
+  page: Page,
+  projectName: string,
+  workspaceName: string,
+): Locator {
+  return projectGroup(page, projectName).filter({ hasText: workspaceName });
+}
+
+export async function openProjectDirectory(page: Page): Promise<void> {
+  await gotoAppShell(page);
+  await waitForSidebarHydration(page);
+}
+
+export async function openProjectDirectoryWithHosts(
+  page: Page,
+  input: {
+    hosts: Array<{ serverId: string; label: string; port: number }>;
+    primaryLabel?: string;
+  },
+): Promise<void> {
+  await gotoAppShell(page);
+  await addConnectedHostsAndReload(page, input.hosts, { primaryLabel: input.primaryLabel });
+  for (const host of input.hosts) {
+    await waitForConnectedHost(page, {
+      serverId: host.serverId,
+      endpoint: `localhost:${host.port}`,
+    });
+  }
+  await waitForSidebarHydration(page);
+}
+
+export async function expectProjectContainsWorkspaces(
+  page: Page,
+  input: { projectName: string; workspaceNames: string[] },
+): Promise<void> {
+  const group = projectGroup(page, input.projectName);
+  await expect(group).toHaveCount(1, { timeout: PROJECT_VISIBILITY_TIMEOUT });
+  for (const workspaceName of input.workspaceNames) {
+    await expect(group.getByRole("button").filter({ hasText: workspaceName })).toBeVisible({
+      timeout: PROJECT_VISIBILITY_TIMEOUT,
+    });
+  }
+}
+
+export async function expectSeparateProjects(
+  page: Page,
+  projects: Array<{ projectName: string; workspaceName: string }>,
+): Promise<void> {
+  for (const project of projects) {
+    await expect(
+      projectGroupWithWorkspace(page, project.projectName, project.workspaceName),
+    ).toHaveCount(1, { timeout: PROJECT_VISIBILITY_TIMEOUT });
+  }
+}
+
+export async function beginWorkspaceFromProject(page: Page, projectName: string): Promise<void> {
+  const group = projectGroup(page, projectName);
+  await expect(group).toBeVisible({ timeout: PROJECT_VISIBILITY_TIMEOUT });
+  await group.hover();
+  await group.getByLabel(`Create a new workspace for ${projectName}`).click();
+  await expect(page.getByRole("button", { name: "Workspace project", exact: true })).toContainText(
+    projectName,
+    { timeout: PROJECT_VISIBILITY_TIMEOUT },
+  );
+}
+
+export async function selectWorkspaceHost(page: Page, hostName: string): Promise<void> {
+  await page.getByRole("button", { name: "Host", exact: true }).click();
+  await page.getByRole("button", { name: hostName, exact: true }).click();
+  await expect(page.getByRole("button", { name: "Host", exact: true })).toContainText(hostName);
+}
+
+export async function createWorkspaceWithoutAgent(page: Page): Promise<void> {
+  await page.getByRole("button", { name: "Create", exact: true }).click();
+}
+
+export async function expectProjectWorkspaceCountForHost(
+  page: Page,
+  input: { projectName: string; hostName: string; count: number },
+): Promise<void> {
+  const group = projectGroup(page, input.projectName);
+  await expect(group.getByRole("button").filter({ hasText: input.hostName })).toHaveCount(
+    input.count,
+    { timeout: PROJECT_VISIBILITY_TIMEOUT },
+  );
+}
+
+export async function renameProject(page: Page, name: string): Promise<void> {
+  await page.getByRole("button", { name: "Rename project", exact: true }).click();
+  await page.getByRole("textbox", { name: "Project name", exact: true }).fill(name);
+  await page.getByRole("button", { name: "Save project name", exact: true }).click();
+  await expect(page.getByText("Project renamed", { exact: true })).toBeVisible({
+    timeout: PROJECT_VISIBILITY_TIMEOUT,
+  });
+}
+
+export async function openGroupedProjectSettings(page: Page, projectName: string): Promise<void> {
+  await page.getByRole("button", { name: "Settings", exact: true }).click();
+  await expect(page).toHaveURL(/\/settings\/general$/);
+  await page.getByRole("button", { name: "Projects", exact: true }).click();
+  await expect(page).toHaveURL(/\/settings\/projects$/);
+  await openProjectSettings(page, projectName);
+}
+
+export async function switchProjectSettingsHost(page: Page, hostName: string): Promise<void> {
+  const projectSettings = page.getByRole("main");
+  await projectSettings.getByRole("button", { name: "Switch host", exact: true }).click();
+  await page.getByRole("button", { name: hostName, exact: true }).click();
+  await expect(
+    projectSettings.getByRole("button", { name: "Switch host", exact: true }),
+  ).toContainText(hostName);
+}
+
+export async function expectProjectSettingsName(page: Page, projectName: string): Promise<void> {
+  await expect(page.getByRole("group", { name: "Project name", exact: true })).toContainText(
+    projectName,
+    { timeout: PROJECT_VISIBILITY_TIMEOUT },
+  );
+}

packages/app/e2e/helpers/project-picker-ui.ts

@@ -7,7 +7,8 @@ export async function expectOpenedProject(page: Page, projectName: string): Prom
     .first();
   await expect(projectRow).toBeVisible({ timeout: 30_000 });
 
-  const testId = await projectRow.getAttribute("data-testid");
-  expect(testId).not.toBeNull();
-  return testId!.replace("sidebar-project-row-", "");
+  await expect(page).toHaveURL(/\/new\?.*projectId=/u, { timeout: 30_000 });
+  const projectId = new URL(page.url()).searchParams.get("projectId");
+  expect(projectId).not.toBeNull();
+  return projectId!;
 }

packages/app/e2e/helpers/schedule-fake-host.ts

@@ -16,6 +16,7 @@ type SessionRequest = Record<string, unknown> & { type?: string; requestId?: str
 export interface FakeScheduleHostWorkspace {
   serverId: string;
   projectId: string;
+  projectKey: string;
   projectDisplayName: string;
   workspace: Record<string, unknown>;
 }
@@ -120,6 +121,7 @@ export async function buildFakeScheduleHostWorkspace(
   return {
     serverId: "schedule-fake-host",
     projectId,
+    projectKey: workspace.projectKey,
     projectDisplayName: FAKE_HOST_PROJECT_DISPLAY_NAME,
     workspace: {
       ...baseWorkspace,
@@ -139,6 +141,7 @@ export async function installFakeScheduleHost(input: {
   port: string;
   serverId: string;
   workspace: Record<string, unknown>;
+  project: Pick<FakeScheduleHostWorkspace, "projectId" | "projectKey" | "projectDisplayName">;
   schedules?: FakeScheduleSummary[];
 }): Promise<void> {
   await input.page.routeWebSocket(wsRoutePatternForPort(input.port), (ws) => {
@@ -154,6 +157,7 @@ export async function installFakeScheduleHost(input: {
             features: {
               providersSnapshot: true,
               workspaceMultiplicity: true,
+              projectList: true,
               projectAdd: true,
               projectRemove: true,
               workspaceRecovery: true,
@@ -197,6 +201,22 @@ export async function installFakeScheduleHost(input: {
             }),
           );
           return;
+        case "project.list.request":
+          ws.send(
+            buildSessionMessage("project.list.response", {
+              requestId,
+              projects: [
+                {
+                  projectId: input.project.projectId,
+                  projectKey: input.project.projectKey,
+                  projectDisplayName: input.project.projectDisplayName,
+                  projectRootPath: String(input.workspace.projectRootPath),
+                  projectKind: "git",
+                },
+              ],
+            }),
+          );
+          return;
         case "fetch_agents_request":
           ws.send(
             buildSessionMessage("fetch_agents_response", {

packages/app/e2e/helpers/seed-client.ts

@@ -13,6 +13,11 @@ export interface SeedWorkspaceDescriptor {
   workspaceDirectory: string;
 }
 
+interface SeedProjectDescriptor {
+  projectId: string;
+  projectKey?: string;
+}
+
 /**
  * The general-purpose E2E daemon client used to seed and drive state out of
  * band (workspaces, agents, terminals) while the UI is exercised through the
@@ -25,15 +30,18 @@ export interface SeedDaemonClient {
   addProject(cwd: string): Promise<{
     project: {
       projectId: string;
+      projectKey?: string;
       projectDisplayName: string;
       projectRootPath: string;
     } | null;
     error: string | null;
   }>;
   removeProject(projectId: string): Promise<{ removedWorkspaceIds: string[] }>;
+  renameProject(projectId: string, customName: string | null): Promise<void>;
   fetchWorkspaces(options?: { filter?: { projectId?: string } }): Promise<{
     entries: SeedWorkspaceDescriptor[];
   }>;
+  listProjects(): Promise<{ projects: SeedProjectDescriptor[] }>;
   createWorkspace(input: {
     source:
       | { kind: "directory"; path: string; projectId?: string }
@@ -179,8 +187,10 @@ export interface SeededWorkspace {
   workspaceId: string;
   workspaceName: string;
   workspaceDirectory: string;
-  /** Stable project identity the daemon groups workspaces under. */
+  /** Host-local identity used by daemon project operations. */
   projectId: string;
+  /** Opaque cross-host key used by grouped project UI. */
+  projectKey: string;
   /** Project label the UI shows (owner/repo for known remotes, else basename). */
   projectDisplayName: string;
   cleanup(): Promise<void>;
@@ -208,6 +218,11 @@ export async function seedWorkspace(options: {
       throw new Error(created.error ?? `Failed to create workspace ${project.path}`);
     }
     const workspace = created.workspace;
+    const listed = await client.listProjects();
+    const descriptor = listed.projects.find((item) => item.projectId === workspace.projectId);
+    if (!descriptor?.projectKey) {
+      throw new Error(`Created project ${workspace.projectId} has no project key`);
+    }
     return {
       client,
       repoPath: project.path,
@@ -215,6 +230,7 @@ export async function seedWorkspace(options: {
       workspaceName: workspace.name,
       workspaceDirectory: workspace.workspaceDirectory,
       projectId: workspace.projectId,
+      projectKey: descriptor.projectKey,
       projectDisplayName: workspace.projectDisplayName,
       cleanup: async () => {
         await client.removeProject(workspace.projectId).catch(() => undefined);