[bendavid]

Workspace Sandbox v0.1.2

• Pins b8cfe16d306efdec067777bbf89181f32eebe9fe (tag v0.1.2), up from f9b9d1d (v0.1.1).
• Fixes registry installation. Installing bendavid/workspace-sandbox failed with Could not resolve type dependency "@getpaseo/client". Five server modules had import type { PaseoApi } from "@getpaseo/client". That resolved only in checkouts with development dependencies installed, never in the clean checkout a registry install builds from. They now use PluginHandlerContext["paseo"] from @getpaseo/plugin/server (new server/paseo.ts). @getpaseo/client is removed from the development dependencies.
• No behavior change otherwise: two commits since v0.1.1, the type import fix and the version bump. No new runtime dependencies, permissions or network destinations.

Validation

• Plugin: typecheck passed, unit tests 21/21.
• Plugin: a clean clone of v0.1.1 (no node_modules) installed on a test Paseo daemon reproduced the reported build error. A clean clone of the fix installs and reaches running.
• Registry: node scripts/validate.ts --online --changed --base upstream/main (getpaseo/plugins main) passed; 1 record matches its pinned artifact.
• Registry: npm test passed, 181/181 tests.

🤖 Generated with Claude Code

[paseo-bot]

Workspace Sandbox v0.1.2 is approved, @bendavid. The update is merged; I recorded the review date and retained your overview and interface images. No action is needed from you. Registry publication is pending.

Review data

• Main REVIEW.md blob: 3c5e763c9565b93ea33fa48c9aeb83e415c72d67. Reviewed registry head: bd0fb3f38247f179a55911beb578608cad4ac79c. PR discussion and existing registry attribution agree with the submitter and source owner.
• Independently fetched and compared Git artifacts from https://github.com/bendavid/paseo-workspace-sandbox.git: f9b9d1d45dc871bf3fe8fa31c48dc17a186b1140 to b8cfe16d306efdec067777bbf89181f32eebe9fe. Annotated tag v0.1.2 peels to the new commit. Git archive SHA-256 values: old 2e8af145ccd0f0bf2f5d9e7e79f36969d090076fb8ec355186fde4bbf77da02e, new fa0894d50e7114967f34aaba721f01c4ce8d2fa6bcdb286d5e24a2e03c797f75. Checked paths/types before confined extraction, with no hooks or submodules.
• Compared every changed file; read the affected server modules, new type alias, manifest/package metadata, lockfile and displayed overview. The five previous SDK-client type imports now resolve through a local alias of PluginHandlerContext["paseo"] from the host plugin SDK. Runtime statements are unchanged. Version and development peer flags account for the remaining differences.
• No manifest preparation/build command, runtime dependency installation or lifecycle script. All 422 dependency entries are development-only and retain npm resolutions with integrity; esbuild/fsevents hooks are development-only. Required local entries and the new imported module exist. No plugin or dependency code installed, built, imported or executed.
• Existing sandbox management, generated launcher, configured provider commands, Claude credential copying/refresh and image-registry requests remain unchanged. Rechecked service image acquisition: a missing/outdated image is pulled only after an exact-image download choice; declining does not pull it. The overview explains credentials, provider configuration changes, downloads and host-side limits. No new network, credential, execution or filesystem capability is introduced by this release. This is a changed-artifact review, not a fresh full audit of unchanged backends.
• Author description/overview and six existing pinned PNGs retained; inspected the Sandbox panel image and verified listing media through online validation. Chinese name/description remain accurate; no translated artifact overview is supplied.
• Trusted current-main online validation passes for the changed artifact; trusted registry suite passes 189 tests. Static inspection only: author-reported clean installation and plugin tests were not rerun, and no live container/daemon/UI test was performed.