Drop workspace provider and sandbox indirection. Use Filer for IO. (#3975)

## Changes
<!-- Brief summary of your changes that is easy to understand -->

## Why
<!-- Why are these changes needed? Provide the context that the reviewer
might be missing.
For example, were there any decisions behind the change that are not
reflected in the code itself? -->

## Tests
<!-- How have you tested the changes? -->

<!-- If your PR needs to be included in the release notes for next
release,
add a separate entry in NEXT_CHANGELOG.md as part of your PR. -->

Author: igrekun

experimental/apps-mcp/lib/errors/errors.go

@@ -29,12 +29,6 @@ const (
 	CodeConfigMissing = -32101
 	CodeConfigWorkDir = -32102
 
-	// Sandbox errors (-32110 to -32119)
-	CodeSandboxFailed   = -32110
-	CodeSandboxNotFound = -32111
-	CodeSandboxExec     = -32112
-	CodeSandboxDocker   = -32113
-
 	// Databricks errors (-32120 to -32129)
 	CodeDatabricksAuth      = -32120
 	CodeDatabricksQuery     = -32121
@@ -186,20 +180,6 @@ func ConfigWorkDir(message string) *Error {
 	return NewWithCode(CodeConfigWorkDir, message)
 }
 
-// Sandbox error helpers
-
-// SandboxFailed creates an error for sandbox operation failures.
-func SandboxFailed(operation, message string) *Error {
-	err := NewWithCode(CodeSandboxFailed, fmt.Sprintf("sandbox %s failed: %s", operation, message))
-	return err.WithDetail("operation", operation)
-}
-
-// SandboxDocker creates an error for Docker-related issues.
-func SandboxDocker(message string) *Error {
-	err := NewWithCode(CodeSandboxDocker, message)
-	return WithSuggestion(err, "Ensure Docker is running: docker info")
-}
-
 // Databricks error helpers
 
 // DatabricksAuth creates an error for authentication failures.

experimental/apps-mcp/lib/fileutil/atomic.go

@@ -3,7 +3,7 @@ Your session in Databricks MCP has been successfully initialized. Here are the g
 ## Project State Management:
 This project uses a state file (`.edda_state`) managed by edda MCP to enforce the correct workflow order:
 1. **Scaffolded**: `scaffold_data_app` creates project structure from template (starts in this state)
-2. **Validated**: `validate_data_app` runs build + tests in sandbox, computes BLAKE3 checksum of package.json and all core source files
+2. **Validated**: `validate_data_app` runs build + tests, computes BLAKE3 checksum of package.json and all core source files
 3. **Deployed**: `deploy_databricks_app` deploys to Databricks Apps, but ONLY if checksum hasn't changed since validation
 
 Re-validation is allowed (Deployed → Validated) to update the checksum after intentional changes. The databricks_mcp tools enforce these state transitions and prevent invalid state changes.

experimental/apps-mcp/lib/fileutil/atomic_test.go

@@ -129,7 +129,7 @@ func (p *Provider) deployDatabricksApp(ctx context.Context, args *DeployDatabric
 		}, nil
 	}
 
-	projectState, err := io.LoadState(workPath)
+	projectState, err := io.LoadState(ctx, workPath)
 	if err != nil {
 		return &DeployResult{
 			Success: false,
@@ -155,7 +155,7 @@ func (p *Provider) deployDatabricksApp(ctx context.Context, args *DeployDatabric
 		}, nil
 	}
 
-	checksumValid, err := io.VerifyChecksum(workPath, expectedChecksum)
+	checksumValid, err := io.VerifyChecksum(ctx, workPath, expectedChecksum)
 	if err != nil {
 		return &DeployResult{
 			Success: false,
@@ -248,7 +248,7 @@ func (p *Provider) deployDatabricksApp(ctx context.Context, args *DeployDatabric
 		}, nil
 	}
 
-	if err := io.SaveState(workPath, deployedState); err != nil {
+	if err := io.SaveState(ctx, workPath, deployedState); err != nil {
 		log.Warnf(ctx, "Failed to save deployed state: error=%v", err)
 	}
 

experimental/apps-mcp/lib/prompts/initialization_message.tmpl

@@ -90,7 +90,7 @@ func (p *Provider) RegisterTools(server *mcpsdk.Server) error {
 	mcpsdk.AddTool(server,
 		&mcpsdk.Tool{
 			Name:        "validate_data_app",
-			Description: "Validate a project by copying files to a sandbox and running validation checks. Project should be scaffolded first. Returns validation result with success status and details.",
+			Description: "Validate a project by running validation checks. Project should be scaffolded first. Returns validation result with success status and details.",
 		},
 		func(ctx context.Context, req *mcpsdk.CallToolRequest, args ValidateInput) (*mcpsdk.CallToolResult, any, error) {
 			log.Debugf(ctx, "validate_data_app called: work_dir=%s", args.WorkDir)

experimental/apps-mcp/lib/providers/deployment/provider.go

@@ -1,13 +1,15 @@
 package io
 
 import (
+	"bytes"
 	"context"
 	"errors"
 	"fmt"
-	"os"
+	"io/fs"
 	"path/filepath"
 
 	"github.com/databricks/cli/experimental/apps-mcp/lib/templates"
+	"github.com/databricks/cli/libs/filer"
 	"github.com/databricks/cli/libs/log"
 )
 
@@ -33,14 +35,19 @@ func (p *Provider) Scaffold(ctx context.Context, args *ScaffoldArgs) (*ScaffoldR
 		return nil, fmt.Errorf("invalid work directory: %w", err)
 	}
 
+	f, err := filer.NewLocalClient(workDir)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create filer: %w", err)
+	}
+
 	// Check if directory exists
-	if stat, err := os.Stat(workDir); err == nil {
+	if stat, err := f.Stat(ctx, "."); err == nil {
 		if !stat.IsDir() {
 			return nil, errors.New("work_dir exists but is not a directory")
 		}
 
 		// Check if empty
-		entries, err := os.ReadDir(workDir)
+		entries, err := f.ReadDir(ctx, ".")
 		if err != nil {
 			return nil, err
 		}
@@ -51,14 +58,20 @@ func (p *Provider) Scaffold(ctx context.Context, args *ScaffoldArgs) (*ScaffoldR
 
 		// Clear directory if force_rewrite
 		if args.ForceRewrite {
-			if err := os.RemoveAll(workDir); err != nil {
-				return nil, fmt.Errorf("failed to clear directory: %w", err)
+			for _, entry := range entries {
+				if err := f.Delete(ctx, entry.Name(), filer.DeleteRecursively); err != nil {
+					return nil, fmt.Errorf("failed to delete %s: %w", entry.Name(), err)
+				}
 			}
 		}
+	} else if !errors.Is(err, fs.ErrNotExist) {
+		// Some other error
+		// filer.FileDoesNotExistError implements Is(fs.ErrNotExist)
+		return nil, fmt.Errorf("failed to check work directory: %w", err)
 	}
 
 	// Create directory
-	if err := os.MkdirAll(workDir, 0o755); err != nil {
+	if err := f.Mkdir(ctx, "."); err != nil {
 		return nil, fmt.Errorf("failed to create directory: %w", err)
 	}
 
@@ -72,15 +85,8 @@ func (p *Provider) Scaffold(ctx context.Context, args *ScaffoldArgs) (*ScaffoldR
 	// Copy files
 	filesCopied := 0
 	for path, content := range files {
-		targetPath := filepath.Join(workDir, path)
-
-		// Create parent directories
-		if err := os.MkdirAll(filepath.Dir(targetPath), 0o755); err != nil {
-			return nil, fmt.Errorf("failed to create directory for %s: %w", path, err)
-		}
-
-		// Write file
-		if err := os.WriteFile(targetPath, []byte(content), 0o644); err != nil {
+		// filer.Write handles creating parent directories if requested
+		if err := f.Write(ctx, path, bytes.NewReader([]byte(content)), filer.CreateParentDirectories); err != nil {
 			return nil, fmt.Errorf("failed to write %s: %w", path, err)
 		}