refactor: split window IPC by feature, simplify naming

Address review feedback:
- Move OAuthCallback out of SecretsManager into src/oauth/oauthCallback.ts
- Move WindowBroadcast (the generic primitive) into src/ipc/
- Rename WindowIpc to DuplicateWorkspaceIpc and move it into src/workspace/, since it covers a single workspace-coordination feature, not all window IPC
- Use Zod schemas in both DuplicateWorkspaceIpc and OAuthCallback for consistent validation
- Tighten tests: the broadcast key-isolation test now also asserts delivery on the matching key, and the stale-request test asserts delivery of fresh requests

Author: EhabY

src/commands.ts

@@ -1,7 +1,3 @@
-import {
-	type Workspace,
-	type WorkspaceAgent,
-} from "coder/site/src/api/typesGenerated";
 import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
@@ -13,20 +9,11 @@ import {
 	extractAgents,
 	workspaceStatusLabel,
 } from "./api/api-helper";
-import { type CoderApi } from "./api/coderApi";
 import * as cliExec from "./core/cliExec";
-import { type CliManager } from "./core/cliManager";
-import { type ServiceContainer } from "./core/container";
-import { type MementoManager } from "./core/mementoManager";
-import { type PathResolver } from "./core/pathResolver";
-import { type SecretsManager } from "./core/secretsManager";
 import { appendVsCodeLogs } from "./core/supportBundleLogs";
-import { type DeploymentManager } from "./deployment/deploymentManager";
 import { CertificateError } from "./error/certificateError";
 import { toError } from "./error/errorUtils";
 import { type FeatureSet, featureSetForVersion } from "./featureSet";
-import { type Logger } from "./logging/logger";
-import { type LoginCoordinator } from "./login/loginCoordinator";
 import { withCancellableProgress, withProgress } from "./progress";
 import { maybeAskAgent, maybeAskUrl } from "./promptUtils";
 import {
@@ -36,13 +23,31 @@ import {
 import { resolveCliAuth } from "./settings/cli";
 import { toRemoteAuthority, toSafeHost } from "./util";
 import { vscodeProposed } from "./vscodeProposed";
-import { type PongMessage, type WindowIpc } from "./windowIpc";
 import {
 	AgentTreeItem,
 	type OpenableTreeItem,
 	WorkspaceTreeItem,
 } from "./workspace/workspacesProvider";
 
+import type {
+	Workspace,
+	WorkspaceAgent,
+} from "coder/site/src/api/typesGenerated";
+
+import type { CoderApi } from "./api/coderApi";
+import type { CliManager } from "./core/cliManager";
+import type { ServiceContainer } from "./core/container";
+import type { MementoManager } from "./core/mementoManager";
+import type { PathResolver } from "./core/pathResolver";
+import type { SecretsManager } from "./core/secretsManager";
+import type { DeploymentManager } from "./deployment/deploymentManager";
+import type { Logger } from "./logging/logger";
+import type { LoginCoordinator } from "./login/loginCoordinator";
+import type {
+	DuplicateWorkspaceIpc,
+	PongMessage,
+} from "./workspace/duplicateWorkspaceIpc";
+
 interface OpenOptions {
 	workspaceOwner?: string;
 	workspaceName?: string;
@@ -66,7 +71,7 @@ export class Commands {
 	private readonly secretsManager: SecretsManager;
 	private readonly cliManager: CliManager;
 	private readonly loginCoordinator: LoginCoordinator;
-	private readonly windowIpc: WindowIpc;
+	private readonly duplicateWorkspaceIpc: DuplicateWorkspaceIpc;
 
 	// These will only be populated when actively connected to a workspace and are
 	// used in commands.  Because commands can be executed by the user, it is not
@@ -90,7 +95,7 @@ export class Commands {
 		this.secretsManager = serviceContainer.getSecretsManager();
 		this.cliManager = serviceContainer.getCliManager();
 		this.loginCoordinator = serviceContainer.getLoginCoordinator();
-		this.windowIpc = serviceContainer.getWindowIpc();
+		this.duplicateWorkspaceIpc = serviceContainer.getDuplicateWorkspaceIpc();
 	}
 
 	/**
@@ -1083,8 +1088,9 @@ export class Commands {
 		// Only set the memento when opening a new folder/window
 		await this.mementoManager.setStartupMode("start");
 
-		// Best-effort: detect other connected windows in the background.
-		this.windowIpc
+		// Best-effort check for an already-connected window. Runs in the
+		// background so it never delays openFolder.
+		this.duplicateWorkspaceIpc
 			.sendPing(remoteAuthority)
 			.then((pong) => {
 				if (pong) {
@@ -1117,10 +1123,8 @@ export class Commands {
 		return true;
 	}
 
-	/**
-	 * Non-blocking notification — VS Code may dismiss it at any time,
-	 * so this must not be awaited.
-	 */
+	// VS Code may dismiss a non-modal info message without resolving the
+	// thenable, so this must not be awaited from the open path.
 	private showMultiWindowNotification(
 		pong: PongMessage,
 		remoteAuthority: string,
@@ -1129,13 +1133,13 @@ export class Commands {
 		const openEmptyAction = "Open Without Folder";
 		vscode.window
 			.showInformationMessage(
-				`A window is already connected to this workspace (${pong.folder}).`,
+				"This workspace is already open in another window.",
 				duplicateAction,
 				openEmptyAction,
 			)
 			.then(async (choice) => {
 				if (choice === duplicateAction) {
-					await this.windowIpc.sendDuplicate(pong.sessionId);
+					await this.duplicateWorkspaceIpc.sendDuplicate(pong.sessionId);
 				} else if (choice === openEmptyAction) {
 					await vscode.commands.executeCommand("vscode.newWindow", {
 						remoteAuthority,

src/core/container.ts

@@ -1,9 +1,9 @@
 import * as vscode from "vscode";
 
 import { CoderApi } from "../api/coderApi";
-import { type Logger } from "../logging/logger";
 import { LoginCoordinator } from "../login/loginCoordinator";
-import { WindowIpc } from "../windowIpc";
+import { OAuthCallback } from "../oauth/oauthCallback";
+import { DuplicateWorkspaceIpc } from "../workspace/duplicateWorkspaceIpc";
 
 import { CliCredentialManager } from "./cliCredentialManager";
 import { CliManager } from "./cliManager";
@@ -12,6 +12,8 @@ import { MementoManager } from "./mementoManager";
 import { PathResolver } from "./pathResolver";
 import { SecretsManager } from "./secretsManager";
 
+import type { Logger } from "../logging/logger";
+
 /**
  * Service container for dependency injection.
  * Centralizes the creation and management of all core services.
@@ -25,7 +27,8 @@ export class ServiceContainer implements vscode.Disposable {
 	private readonly cliManager: CliManager;
 	private readonly contextManager: ContextManager;
 	private readonly loginCoordinator: LoginCoordinator;
-	private readonly windowIpc: WindowIpc;
+	private readonly duplicateWorkspaceIpc: DuplicateWorkspaceIpc;
+	private readonly oauthCallback: OAuthCallback;
 
 	constructor(context: vscode.ExtensionContext) {
 		this.logger = vscode.window.createOutputChannel("Coder", { log: true });
@@ -65,14 +68,19 @@ export class ServiceContainer implements vscode.Disposable {
 			this.cliCredentialManager,
 		);
 		this.contextManager = new ContextManager(context);
+		this.oauthCallback = new OAuthCallback(context.secrets, this.logger);
 		this.loginCoordinator = new LoginCoordinator(
 			this.secretsManager,
 			this.mementoManager,
 			this.logger,
 			this.cliCredentialManager,
+			this.oauthCallback,
 			context.extension.id,
 		);
-		this.windowIpc = new WindowIpc(context.secrets, this.logger);
+		this.duplicateWorkspaceIpc = new DuplicateWorkspaceIpc(
+			context.secrets,
+			this.logger,
+		);
 	}
 
 	getPathResolver(): PathResolver {
@@ -107,8 +115,12 @@ export class ServiceContainer implements vscode.Disposable {
 		return this.loginCoordinator;
 	}
 
-	getWindowIpc(): WindowIpc {
-		return this.windowIpc;
+	getDuplicateWorkspaceIpc(): DuplicateWorkspaceIpc {
+		return this.duplicateWorkspaceIpc;
+	}
+
+	getOAuthCallback(): OAuthCallback {
+		return this.oauthCallback;
 	}
 
 	/**

src/core/secretsManager.ts

@@ -2,7 +2,6 @@ import { z } from "zod";
 
 import { DeploymentSchema, type Deployment } from "../deployment/types";
 import { toSafeHost } from "../util";
-import { WindowBroadcast } from "../windowBroadcast";
 
 import type { OAuth2ClientRegistrationResponse } from "coder/site/src/api/typesGenerated";
 import type { Memento, SecretStorage, Disposable } from "vscode";
@@ -17,7 +16,6 @@ const DEPLOYMENT_ACCESS_PREFIX = "coder.access.";
 
 type SecretKeyPrefix = typeof SESSION_KEY_PREFIX | typeof OAUTH_CLIENT_PREFIX;
 
-const OAUTH_CALLBACK_KEY = "coder.oauthCallback";
 const CURRENT_DEPLOYMENT_KEY = "coder.currentDeployment";
 const DEFAULT_MAX_DEPLOYMENTS = 10;
 
@@ -52,30 +50,12 @@ const SessionAuthSchema = z.object({
 
 export type SessionAuth = z.infer<typeof SessionAuthSchema>;
 
-const OAuthCallbackDataSchema = z.object({
-	state: z.string(),
-	code: z.string().nullable(),
-	error: z.string().nullable(),
-});
-
-export type OAuthCallbackData = z.infer<typeof OAuthCallbackDataSchema>;
-
 export class SecretsManager {
-	public readonly oauthCallback: WindowBroadcast<OAuthCallbackData>;
-
 	constructor(
 		private readonly secrets: SecretStorage,
 		private readonly memento: Memento,
 		private readonly logger: Logger,
-	) {
-		this.oauthCallback = new WindowBroadcast(
-			secrets,
-			OAUTH_CALLBACK_KEY,
-			(v: unknown): v is OAuthCallbackData =>
-				OAuthCallbackDataSchema.safeParse(v).success,
-			logger,
-		);
-	}
+	) {}
 
 	private buildKey(prefix: SecretKeyPrefix, safeHostname: string): string {
 		return `${prefix}${safeHostname || "<legacy>"}`;

src/extension.ts

@@ -336,19 +336,16 @@ export async function activate(ctx: vscode.ExtensionContext): Promise<void> {
 	const remote = new Remote(serviceContainer, commands, ctx);
 
 	// Respond to PINGs and DUPLICATE commands from other windows.
-	const windowIpc = serviceContainer.getWindowIpc();
+	const duplicateWorkspaceIpc = serviceContainer.getDuplicateWorkspaceIpc();
 	ctx.subscriptions.push(
-		windowIpc.onRequest(async (msg) => {
+		duplicateWorkspaceIpc.onRequest(async (msg) => {
 			const currentAuthority = vscodeProposed.env.remoteAuthority;
 			if (!currentAuthority) {
 				return;
 			}
 
 			if (msg.type === "ping" && msg.authority === currentAuthority) {
-				// Only the first folder matters for dedup; multi-root
-				// workspaces use a different URI scheme.
-				const folder = vscode.workspace.workspaceFolders?.[0]?.uri.path ?? "";
-				await windowIpc.sendPong(msg.id, vscode.env.sessionId, folder);
+				await duplicateWorkspaceIpc.sendPong(msg.id, vscode.env.sessionId);
 			}
 
 			if (

src/windowBroadcast.ts src/ipc/windowBroadcast.tssrc/windowBroadcast.ts renamed to src/ipc/windowBroadcast.ts

@@ -1,19 +1,18 @@
 import type { Disposable, SecretStorage } from "vscode";
+import type { ZodType } from "zod";
 
-import type { Logger } from "./logging/logger";
+import type { Logger } from "../logging/logger";
 
 /**
- * Typed pub/sub over a single SecretStorage key.
- *
- * SecretStorage.onDidChange fires across all VS Code windows, so each
- * WindowBroadcast instance acts as a cross-window channel for messages
- * of type T.
+ * Typed pub/sub over a single SecretStorage key. SecretStorage.onDidChange
+ * fires across all VS Code windows, so each instance is a cross-window
+ * channel for messages of type T.
  */
 export class WindowBroadcast<T> {
 	constructor(
 		private readonly secrets: SecretStorage,
 		private readonly key: string,
-		private readonly validate: (value: unknown) => value is T,
+		private readonly schema: ZodType<T>,
 		private readonly logger: Logger,
 	) {}
 
@@ -31,11 +30,11 @@ export class WindowBroadcast<T> {
 				if (!raw) {
 					return;
 				}
-				const parsed: unknown = JSON.parse(raw);
-				if (!this.validate(parsed)) {
+				const parsed = this.schema.safeParse(JSON.parse(raw));
+				if (!parsed.success) {
 					return;
 				}
-				await handler(parsed);
+				await handler(parsed.data);
 			} catch (err) {
 				this.logger.error(`Error handling broadcast on ${this.key}`, err);
 			}

src/login/loginCoordinator.ts

@@ -19,6 +19,7 @@ import type { MementoManager } from "../core/mementoManager";
 import type { OAuthTokenData, SecretsManager } from "../core/secretsManager";
 import type { Deployment } from "../deployment/types";
 import type { Logger } from "../logging/logger";
+import type { OAuthCallback } from "../oauth/oauthCallback";
 
 type LoginResult =
 	| { success: false }
@@ -43,10 +44,12 @@ export class LoginCoordinator implements vscode.Disposable {
 		private readonly mementoManager: MementoManager,
 		private readonly logger: Logger,
 		private readonly cliCredentialManager: CliCredentialManager,
+		oauthCallback: OAuthCallback,
 		extensionId: string,
 	) {
 		this.oauthAuthorizer = new OAuthAuthorizer(
 			secretsManager,
+			oauthCallback,
 			logger,
 			extensionId,
 		);

src/oauth/authorizer.ts

@@ -1,10 +1,6 @@
-import { type AxiosInstance } from "axios";
 import * as vscode from "vscode";
 
 import { CoderApi } from "../api/coderApi";
-import { type SecretsManager } from "../core/secretsManager";
-import { type Deployment } from "../deployment/types";
-import { type Logger } from "../logging/logger";
 
 import {
 	AUTH_GRANT_TYPE,
@@ -21,6 +17,7 @@ import {
 	toUrlSearchParams,
 } from "./utils";
 
+import type { AxiosInstance } from "axios";
 import type {
 	OAuth2AuthorizationServerMetadata,
 	OAuth2ClientRegistrationRequest,
@@ -30,6 +27,12 @@ import type {
 	User,
 } from "coder/site/src/api/typesGenerated";
 
+import type { SecretsManager } from "../core/secretsManager";
+import type { Deployment } from "../deployment/types";
+import type { Logger } from "../logging/logger";
+
+import type { OAuthCallback } from "./oauthCallback";
+
 /**
  * Handles the OAuth authorization code flow for authenticating with Coder deployments.
  * Encapsulates client registration, PKCE challenge, and token exchange.
@@ -39,6 +42,7 @@ export class OAuthAuthorizer implements vscode.Disposable {
 
 	constructor(
 		private readonly secretsManager: SecretsManager,
+		private readonly oauthCallback: OAuthCallback,
 		private readonly logger: Logger,
 		private readonly extensionId: string,
 	) {}
@@ -247,7 +251,7 @@ export class OAuthAuthorizer implements vscode.Disposable {
 					timeoutMins * 60 * 1000,
 				);
 
-				const listener = this.secretsManager.oauthCallback.onReceive(
+				const listener = this.oauthCallback.onReceive(
 					({ state: callbackState, code, error }) => {
 						if (callbackState !== state) {
 							this.logger.warn(