[julien-bloch]

Update the Workbench pin from 0.1.0-alpha.30 to 0.1.0-alpha.31 (302ebe5), ready for artifact review. Submitted by @julien-bloch.

Previous update: #1320. Submission issue: #1231.

Details

• This follows up Update Workbench pin to 3bdefcf #1320, which pinned 3bdefcf4ea477e47631d92134726949b65df35c0. This PR moves the pin to 302ebe5abd0d49c4a5ec5520842c8880647a1771 on main. There is no tag.
• Optional Open Workbench button: an icon-only header button (addHeaderButton) in every workspace of the host that opens the Workbench screen. It is off by default and hidden until the user turns it on in Workbench Settings. The client follows the workspace list with an owned workspaces.list subscription to add and remove the buttons, and releases it on cleanup.
• Settings: a new headerButton boolean, default false. No schema version bump or migration; stored documents without it read as false.
• Permissions: one new server RPC, workbench.header_button, which only reads that setting from the plugin's own settings document. No new permissions, network calls or file writes.
• Tested: npm test (unit tests and typecheck) passes. Reloaded on a local Paseo 0.12 daemon, where it reaches running with no errors. I did not run scripts/validate.ts locally. The full list is in CHANGELOG.md.

[paseo-bot]

Workbench alpha.31 is approved, @julien-bloch. I updated the registry review timestamp and retained your overview, description and interface images. Nothing else is needed from you for this update.

For a later release, page through the initial workspace list: the new header-button code initially covers only 200 workspaces, so larger hosts need a later workspace update before omitted buttons appear.

Review data

• Policy: main REVIEW.md, blob 3c5e763c9565b93ea33fa48c9aeb83e415c72d67.
• Reviewed registry head: 321242d5625046d4517a37dd7d5ec542d7ee2c2d.
• Git artifact: https://github.com/julien-bloch/paseo-workbench.git, 3bdefcf4ea477e47631d92134726949b65df35c0 → 302ebe5abd0d49c4a5ec5520842c8880647a1771, no tag or plugin subdirectory. New tree: 8b79783911250c19b7ce59d3e702f5c44416514c.
• Independently fetched both exact commits without hooks or submodules, checked all archive paths and compared all ten changed files. SHA-256 of locally produced Git archives: old 5e4ea72c6a7ad2f0717adabf4fbf208829b5596bcbbd1db21fd4ca98a6158369, new 11e9e1d4bc52303c180fd552be4d7a00f5348bb06b2c9830cccfb731c15bd9b0. These identify the inspected archives; Git identity is the commit/tree above.
• Read changed client contributions, settings UI/schema, RPC declaration/handler, package metadata and documentation, plus the existing compare-and-set settings save path. Required entries/imports are present. Only host-provided runtime libraries and development dependencies are declared; no preparation/build command or runtime dependency installation. Development commands were read, not executed.
• client/headerButtons.ts:13–42 reads workspace metadata through Paseo, registers initially hidden buttons, reads the plugin's own host setting through RPC, and opens the Workbench screen only on button press. Cleanup removes registrations and releases the owned subscription, including late completion after disposal. The shared refresher set invokes each active host client's own RPC; it does not transmit settings between hosts.
• shared/settings.ts defaults the new boolean to false; index.server.ts:25 returns only that boolean when settings are ready. client/SettingsEditor.tsx:98–107 saves through the existing revision-checked settings interface before refreshing visibility. No new subprocess, credential access, filesystem implementation, dependency acquisition or external destination was introduced. Existing coordinator/provider behavior is unchanged and disclosed in the overview.
• English description and author overview remain suitable; no translations supplied. Inspected the existing Command screenshot; all four pinned image URLs return HTTP 200 image/png. No registry fallback page is needed.
• Trusted main scripts/workflows match this branch. Online changed-record validation passed: 435 well-formed records, one matching artifact, zero skipped. All 189 registry tests and whitespace checks passed. Plugin code/dependencies were never installed, built, imported or run. No live UI or multi-device test was performed; unchanged runtime internals and host APIs were not exhaustively re-audited. Author test claims are supporting evidence.