[bendavid]

Workspace Sandbox v0.2.0

• Pins 895c462b77c607587aeaff0a56532c51bed31aeb (tag v0.2.0), up from b8cfe16 (v0.1.2).
• Sandboxed directories get their own path. A sandboxed directory shares the project directory with the project's other workspaces, and agent creation and Paseo's commit-message helpers only carry a directory. A new sandboxed directory therefore lives at its own symlink to the project directory, links/<workspace id> in the plugin's data folder, which Paseo keeps as the workspace's directory. The sandbox mounts the project at the link path and at its real path. Each sandbox also mounts its own empty link-mounts/<workspace id> over links/, so an extra mount covering the data folder (such as ~:ro) cannot turn the link path into a followed symlink. Archiving removes the link and never what it points to. Sandboxed directories created before this keep the project directory.
• Agents run where their own workspace says. An agent runs in its own workspace's sandbox, or on the host when its workspace has none. Previously an agent of an unsandboxed workspace sharing a sandboxed directory borrowed that sandbox. An agent of a workspace whose sandbox is gone shows its history but is refused rather than run on the host; state.json now remembers removed sandboxes for this.
• Sandboxed worktrees cannot prune the repository's other worktrees. Those are not mounted, so git inside saw them as missing, and git worktree prune there removed their registrations on the host. .git/worktrees is now mounted read-only, with the sandbox's own entry read-write over it.
• A workspace's private Claude folder is mode 0710 instead of 0700, so the container engine can reach the shared entries' mount points on NFS. Its parent folders stay 0700.
• Overview: now states that a sandboxed directory does not protect the project's .git, and that commit-message and similar helpers are refused in sandboxed workspaces (Paseo then uses generic text), instead of claiming they run on the host.
• No new runtime dependencies, permissions or network destinations. The only new host writes are the symlinks and empty mount-point folders inside the plugin's own data folder.

Validation

• Plugin: typecheck passed, unit tests 34/34.
• Plugin: npm run test:e2e 7/7. It runs real sandboxes with Bubblewrap, Podman and microsandbox, each with and without a read-only extra mount covering the link. It checks that the working directory is physically the link path, that it is not a symlink, and that writes through either path appear at the other. It also checks that a sandboxed worktree can commit and switch branches while git worktree prune and git gc leave the other worktree registered. Both tests failed without their fixes.
• Plugin: a clean clone of v0.2.0 (no node_modules) installs on a test Paseo daemon and reaches running.
• Plugin: on Paseo's in-process test daemon, two sandboxed directories and an unsandboxed workspace share one project. Each sandboxed workspace's agent ran in its own sandbox, and the unsandboxed workspace's agent kept its own provider, both when created and after a daemon restart. The unsandboxed workspace's commit-message helper ran; the sandboxed one's was refused.
• Registry: node scripts/validate.ts --online --changed --base upstream/main (getpaseo/plugins main) passed; 1 record matches its pinned artifact.
• Registry: npm test passed, 189/189 tests.

🤖 Generated with Claude Code

[paseo-bot]

Workspace Sandbox 0.2.0 is approved, @bendavid. I refreshed the registry review date and retained your overview, descriptions and six interface images. No action is required for this release.

For the next version, update the new-workspace form’s directory note: it still says agents from every workspace sharing the directory enter one sandbox, while this release routes them by their own workspace. This will keep the setup explanation aligned with the fix.

Review data

• Policy: main REVIEW.md blob 3c5e763c9565b93ea33fa48c9aeb83e415c72d67. Read the PR discussion and original accepted submission #1554. Original submitter and this PR author have the same GitHub account ID, 4920798.
• Reviewed registry head: 541e033d739d5a6d2b4091f087626bcba9080ce0, following 86454bcfdbefcdb8e89d25400853aae8ebc165e2. The only reviewer edit is reviewedAt; the author supplied the new pin.
• Git artifact: https://github.com/bendavid/paseo-workspace-sandbox.git, root plugin, tag v0.2.0 resolves to exact commit 895c462b77c607587aeaff0a56532c51bed31aeb. Independently fetched and compared against accepted b8cfe16d306efdec067777bbf89181f32eebe9fe without hooks or submodules. SHA-256 of Git archives: old fa0894d50e7114967f34aaba721f01c4ce8d2fa6bcdb286d5e24a2e03c797f75, new 791b7c991b6bae103d4b9aac43fe6514e0c2079017fe5c7f1b92df8ddca51259. Checked all 59/67 archive paths and types before extraction.
• Inspected all changed production modules and affected session routing, state persistence, workspace creation/removal, mounts, engine invocation, generated launcher and Claude configuration paths. Read image-consent handling and credential synchronization for context. Required local imports and entries exist. English overview, English and Chinese manifest metadata and unchanged interface media are usable; viewed the terminal thumbnail and Sandbox panel. No registry overview or description override is needed.
• A new directory workspace uses a plugin-owned link to its project. Mount resolution covers the link’s parent with that sandbox’s empty mount-point directory, then binds the project at the link and real paths. Archive cleanup removes the link and its plugin-owned mount points, not the project target (server/container.ts, server/service.ts). Worktree mount resolution adds read-only shared worktree registrations and a writable mount for its own registration; all three engine implementations consume that mount list.
• Session routing prefers the known workspace’s sandbox. A derived provider on a never-sandboxed workspace runs on the host; a retired sandbox’s interactive session is refused while history can still be read. Unknown-workspace sessions use directory routing. Removed non-pending sandboxes are persisted as retired, with retained private Claude folders covering older removals. The generated launcher requires an explicit host route for a real agent when no sandbox spec exists. Host providers are refused for interactive sessions in a sandboxed workspace.
• Private Claude directories change to mode 0710 with their workspace parent created as 0700. Existing purposeful access remains: configured provider state/credentials, selected project and extra mounts; host Claude access token copied into protected plugin storage for sandbox authentication, configured host CLI invoked for refresh. Registry metadata requests and image pulls serve the chosen image; a pull requires the explicit image choice, and normal engine creation passes pull-never. No new network destination, collector, credential transmission, runtime installer or unrelated destructive operation found in the changed behavior. The overview discloses host execution, shared-directory Git limitations and provider transmission.
• No manifest build/preparation command or production dependency installation. Runtime libraries are built-ins and host-provided modules. Development lock has 422 exact npm registry entries with integrity, unchanged apart from root version; esbuild/fsevents lifecycle markers are development-only. No plugin code or dependencies installed, built, imported or executed. The generated shell’s eval retrieves values for syntactically filtered environment names; supplied values are not parsed as commands.
• Trusted main scripts/workflows match this branch. Online changed-record validation passes: 435 well-formed records and one matching artifact. All 189 trusted registry tests pass locally. Final-head registry CI also passed.
• Limits: static artifact review, no independent runtime or UI QA. Read the shipped routing and real-engine regression tests; the author reports 34 unit tests, seven engine E2E tests and clean-daemon installation/routing checks. Those author claims were not independently reproduced, and external engine/provider internals were not exhaustively audited. Optional form wording advice is separate from acceptance.