feat(webui): add project workspaces and access controls (#4007)

* feat(webui): add project workspaces and access controls

* feat(webui): add project workspaces and access controls

* refactor(tools): centralize workspace access resolution

* refactor(webui): remove unused workspace host state

* fix(webui): hide estimated file edit label

* fix(webui): clarify file edit deletion feedback

* fix(webui): label deleted file activity

* fix(webui): flatten file edit activity rows

* fix(core): remove path-only patch deletion

* fix(core): keep apply patch non-destructive

* refactor(webui): trim workspace host plumbing

* fix(tools): register exec with tools config

tests/tools/test_web_fetch_security.py

@@ -12,6 +12,7 @@ import pytest
 from nanobot.agent.tools import web as web_module
 from nanobot.agent.tools.web import WebFetchTool
 from nanobot.config.schema import WebFetchConfig
+from nanobot.security.workspace_access import bind_workspace_scope, build_workspace_scope, reset_workspace_scope
 
 _REAL_GETADDRINFO = socket.getaddrinfo
 
@@ -45,6 +46,24 @@ async def test_web_fetch_blocks_localhost():
     assert "error" in data
 
 
+@pytest.mark.asyncio
+async def test_web_fetch_blocks_localhost_even_in_full_workspace_scope(tmp_path):
+    tool = WebFetchTool()
+    scope = build_workspace_scope(tmp_path, "full")
+
+    def _resolve_localhost(hostname, port, family=0, type_=0):
+        return [(socket.AF_INET, socket.SOCK_STREAM, 0, "", ("127.0.0.1", 0))]
+
+    token = bind_workspace_scope(scope)
+    try:
+        with patch("nanobot.security.network.socket.getaddrinfo", _resolve_localhost):
+            result = await tool.execute(url="http://localhost/admin")
+    finally:
+        reset_workspace_scope(token)
+    data = json.loads(result)
+    assert "error" in data
+
+
 @pytest.mark.asyncio
 async def test_web_fetch_result_contains_untrusted_flag():
     """When fetch succeeds, result JSON must include untrusted=True and the banner."""