Module facade 

The narrow workspace-state surface the peer-coordination tools depend on, plus the production impl on Workspace and a mock for unit tests.

Why a trait, not direct calls on Workspace

The four Tool impls (C5-C8) hold an Arc<dyn WorkspaceFacade> rather than Arc<Workspace>. Two reasons:

1. Testability. Unit tests instantiate MockWorkspaceFacade (capture-into-Vec) and assert the tool dispatched the expected commands without spinning up real Workspace infrastructure (which needs a workspace dir, account state map, etc.).
2. Narrow API surface. The tools only need ~7 methods; binding them to the full Workspace would surface everything to anyone poking at the tools.

Method shape

All methods are &self + parking_lot::Mutex internally, so the trait is plain (not async_trait). Tools may await other things inside their Tool::call body but the facade calls themselves return synchronously after a mutex acquire.

Re-exports

use std::sync::Arc; 🔒

use std::sync::Weak; 🔒

use crate::mcp::peers::types::PeerLiveness; 🔒

use crate::mcp::peers::types::PeerStatus; 🔒

use crate::mcp::peers::types::WrappedPrompt; 🔒

use crate::SessionSlot; 🔒

use crate::protocol::Command; 🔒

use crate::workspace::Workspace; 🔒

Structs

MockWorkspaceFacade

Mock for unit tests in the Tool impls. Captures every dispatched call into a Vec so tests can assert “tool X dispatched deliver_peer_prompt with these args” without spinning up a real Workspace.

ProdWorkspaceFacade

Production impl. Holds a Weak<Workspace> rather than Arc<Workspace> so the construction sites (Arc::new(weak) as Arc<dyn WorkspaceFacade>) don’t close the Workspace → pool → AgentHandle → bridge → MCP → Tool → facade → Workspace strong cycle. Audit C7.

Enums

DeliverError

Why a deliver_peer_prompt call failed synchronously.

HandoffError

Why a handoff could not be started or completed.

Traits

WorkspaceFacade

The narrow workspace-state surface peer-coordination tools call into. See module docs for design rationale.

Functions

delivery_answer 🔒

The handler’s answer narrowed to the facade’s own: a command the workspace took but nobody answered is a refusal, not a success (#2342).

lead_for 🔒

Return the first non-worker session in view.sessions, i.e. the project’s lead. Worker sessions land in view.sessions once their Connected lands and the catalog indexes them; keying on the slot a spawn stated is what keeps a worker from shadowing its lead, so no filter over the catalog is needed.