feat(provider): deprecate built-in MicroSandbox and update CLI alias

[skevetter]

Fresh devsy provider add microsandbox installs the published external provider pinned to github.com/devsy-org/devsy-provider-microsandbox@v0.1.8. The deliberate compatibility source builtin:microsandbox selects the existing embedded implementation and retains its canonical internal identity. Source-omitted reloads and saved internal records keep their current behavior.

Installed providers using the built-in MicroSandbox driver now expose deprecation metadata in CLI JSON, a separate lifecycle column in CLI output, and a badge and notice in Desktop. Classification resolves driver templates using saved provider options without running option commands, including custom provider definitions; an external provider named microsandbox is not deprecated. Names, defaults, initialization state, options and existing workspaces remain unchanged.

The shared native fixtures explicitly select the real built-in implementation. The external lifecycle case installs through the fresh CLI alias and asserts the installed source and driver before exercising the existing lifecycle and performance checks. The catalogue remains sixteen suites and eighty cases. Documentation explains the compatibility selector and explicit source migration. Migration tooling, a compatibility flag and physical runtime removal remain subsequent stages.

Validation: affected Go races, Linux vet, Linux amd64/arm64 E2E compilation, Windows test compilation, module verification, strict Linux lint (zero issues), documentation build/link checking and all applicable scoped hooks passed. Desktop type checking reported zero errors or warnings and all 909 unit tests passed. Exact-head CI passed all 88 implementation jobs and seven Desktop jobs, including 62 Playwright tests on each platform, packaging, tray and Flatpak. All sixteen actual MicroSandbox suites passed all eighty selected cases (37 built-in, 43 external), including the fresh CLI alias lifecycle and running/stopped migration. Windows dynamically discovered provider tests passed all 42 roots/84 test IDs and both helper unit packages. The current performance artifact records 808 reaped warm/first process observations; no cold-cache or all-host runtime claim is made. Full primary and Luna source audits found no additional defect. The temporary waiver of unavailable local CodeRabbit service-start gating remains in effect; no local CodeRabbit coverage is claimed. Fresh final-head Greptile completed at 5/5 and full CodeRabbit covered all 21 files with no actionable comments, Minimal merge risk and Low security architecture risk. All actionable threads are resolved and both commits have valid GitHub signatures. The retained recovery/provenance observations and docstring-coverage warning received a source-backed no-change disposition.

[netlify]

✅ Deploy Preview for devsydev ready!

Name	Link
🔨 Latest commit	ef8253f
🔍 Latest deploy log	https://app.netlify.com/projects/devsydev/deploys/6ad11e66da2553621fc64b71
😎 Deploy Preview	https://deploy-preview-1497--devsydev.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 30bf49fb-3fe9-49b6-be50-c287088a479f

📥 Commits

Reviewing files that changed from the base of the PR and between efdf6b1 and ef8253f.

📒 Files selected for processing: 21

• cmd/provider/add.go
• cmd/provider/add_test.go
• cmd/provider/list.go
• cmd/provider/list_test.go
• desktop/src/main/__tests__/watcher.test.ts
• desktop/src/main/watcher.ts
• desktop/src/renderer/src/lib/components/provider/ProviderCard.svelte
• desktop/src/renderer/src/lib/components/provider/ProviderCard.test.ts
• desktop/src/renderer/src/lib/components/provider/ProviderSheet.svelte
• desktop/src/renderer/src/lib/components/provider/ProviderSheet.test.ts
• desktop/src/renderer/src/lib/components/provider/ProviderWizard.test.ts
• desktop/src/renderer/src/lib/types/index.ts
• e2e/tests/up/MICROSANDBOX.md
• e2e/tests/up/microsandbox_session.go
• e2e/tests/up/provider_microsandbox.go
• pkg/provider/microsandbox_source_test.go
• pkg/provider/resolve.go
• pkg/workspace/provider.go
• pkg/workspace/provider_deprecation_test.go
• sites/docs-devsy-sh/content/docs/developing-providers/external-runtime-rollout.mdx
• sites/docs-devsy-sh/content/docs/managing-providers/manage-providers.mdx

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

📝 Walkthrough

Fresh microsandbox provider installs resolve to the pinned external provider. The built-in implementation remains available through builtin:microsandbox and is marked deprecated in CLI and Desktop provider views.

Changes: MicroSandbox provider rollout

Layer / File(s)	Summary
Provider source selection cmd/provider/add.go, cmd/provider/add_test.go, pkg/provider/resolve.go, pkg/provider/microsandbox_source_test.go	The microsandbox add alias resolves to the pinned external provider, while builtin:microsandbox selects the built-in driver. Tests cover both selectors and verify that a failed manifest request does not install the provider or change saved configuration.
Deprecation metadata and CLI listing pkg/workspace/provider.go, pkg/workspace/provider_deprecation_test.go, cmd/provider/list.go, cmd/provider/list_test.go	Provider loading sets deprecation metadata when the resolved driver is the built-in MicroSandbox driver. CLI listings display a Lifecycle column, and tests cover plain-text and JSON output.
Desktop deprecation display desktop/src/main/watcher.ts, desktop/src/main/__tests__/watcher.test.ts, desktop/src/renderer/src/lib/types/index.ts, desktop/src/renderer/src/lib/components/provider/ProviderCard.svelte, desktop/src/renderer/src/lib/components/provider/ProviderCard.test.ts, desktop/src/renderer/src/lib/components/provider/ProviderSheet.svelte, desktop/src/renderer/src/lib/components/provider/ProviderSheet.test.ts, desktop/src/renderer/src/lib/components/provider/ProviderWizard.test.ts	The Desktop provider entry carries a deprecation flag, defaulting to false when absent. Provider cards and sheets display deprecation information when the flag is true.
Rollout validation and documentation e2e/tests/up/MICROSANDBOX.md, e2e/tests/up/microsandbox_session.go, e2e/tests/up/provider_microsandbox.go, sites/docs-devsy-sh/content/docs/developing-providers/external-runtime-rollout.mdx, sites/docs-devsy-sh/content/docs/managing-providers/manage-providers.mdx	End-to-end setup and lifecycle checks distinguish built-in and external providers. Documentation describes the pinned external install, the built-in compatibility selector, deprecation reporting, and explicit source migration.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant ProviderAdd
  participant resolveAddSource
  participant ResolveProvider
  participant GitHubManifest
  ProviderAdd->>resolveAddSource: microsandbox alias
  resolveAddSource->>ResolveProvider: pinned external source
  ResolveProvider->>GitHubManifest: fetch provider manifest
  GitHubManifest-->>ResolveProvider: manifest response

Loading

Merge Risk: ⚪ Minimal · up to ef825

No actionable merge-blocking issue was established for the MicroSandbox rollout; it is mergeable after normal checks.

Security architecture risk: 🔵 Low · up to ef825

Fresh CLI installations now trust a separately published, version-pinned provider release. Executable checksums remain enforced, existing installations are not automatically migrated, and deprecation reporting does not execute option commands. The published release’s provenance and full runtime behavior were not independently verified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The changed trust scope is fresh CLI alias installation. An attacker controlling the selected release content could influence the manifest and its executable declarations for installers receiving that content. The external runtime receives the agent process environment and provider options, so its trust scope is not confined to guest workspace data. Actual privileges depend on the invoking environment; release compromise was not established.

Trust Boundaries and Controls

• observed — Existing external-driver controls require platform-specific SHA-256 declarations, verify downloaded bytes, and recheck the prepared executable before runtime use. Relative executable paths also undergo real-path containment checks. These controls protect executable consistency with the trusted manifest; they do not independently establish the manifest publisher’s provenance.

Resilience and Maintainability Implications

• inferred — A hard interruption while installation downloads binaries can leave a provider directory before provider.json is saved. Directory existence then blocks a repeated add. This inherited installation behavior becomes relevant to the fresh external alias, but provider deletion can remove the orphan directory; the inspected path does not show it activating a runtime or changing the default.

Hardening Proposals

• proposed — For stronger release assurance, bind the default external manifest to reviewed content through a trusted digest or verified signature, and document the release ownership and immutability controls. This would strengthen the supply-chain boundary; it is not evidence that the selected release is compromised.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 10.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 10 functions across 16 files. (5 skipped:…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly summarizes the primary changes: deprecating the built-in MicroSandbox provider and updating the CLI alias.

Full details: Docstring Coverage

Explanation

Docstring coverage is 10.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 10 functions across 16 files. (5 skipped: 5 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

✨ Simplify code

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[netlify]

✅ Deploy Preview for images-devsy-sh canceled.

Name	Link
🔨 Latest commit	ef8253f
🔍 Latest deploy log	https://app.netlify.com/projects/images-devsy-sh/deploys/6ad11e664c7c8076ade0d7bf

[skevetter]

@greptileai review

Please review the complete current PR at head 3a85082a0cdd9dec228e94d535e14f405f4b9a11, including the fresh-add alias boundary, preserved legacy reload identity, deprecation metadata and native fixture attribution. All current-head implementation checks have passed.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable issues remain from this review.

Summary

Fresh devsy provider add microsandbox installs the pinned external provider. builtin:microsandbox keeps the embedded implementation and its stored identity.

• Fresh MicroSandbox installs use the published provider, with an explicit selector for the built-in one.
• Providers using the built-in MicroSandbox driver are marked deprecated in the CLI and Desktop.

_{Reviews (2) · Last reviewed commit: "fix(provider): resolve templated drivers..." · Reviewed by Greptile}

[skevetter]

@greptileai review

Please review the complete current PR at final head ef8253f, all 21 changed files, including the fresh-add alias boundary, preserved legacy reload identity, saved-option driver classification without command execution or state mutation, Desktop metadata, and truthful built-in/external native fixtures. All current implementation/external checks and actual native80/Desktop gates passed. The earlier templated-driver finding is fixed and its thread resolved.

[skevetter]

@coderabbitai full review

Please perform a full review of final head ef8253f while this PR remains draft, covering all 21 changed files, with explicit current security/architecture and merge-risk analysis as well as inline findings.

This first deprecation stage routes only fresh CLI installs to the published external pin, retains an explicit builtin:microsandbox selector and existing internal-record behavior, and labels the selected built-in driver in CLI/Desktop. Driver templates use saved provider options without executing commands or mutating state. Existing defaults/options/workspaces and the real built-in compatibility/native fixtures remain intact. Migration tooling, a compatibility flag and runtime removal are outside this PR.

[coderabbitai]

✅ Action performed

Full review finished.

[skevetter]

Final review disposition for ef8253f: Greptile completed at 5/5, and the completed full CodeRabbit run reviewed all 21 files with no actionable comments, Minimal merge risk and Low security architecture risk. I inspected the entire retained risk assessment and all inlines/threads.

The interrupted-install note describes the unchanged generic installer: returned binary-download errors remove the candidate directory; an uncatchable hard interruption can leave a directory before provider.json is saved. This PR changes source selection, not that installer/cleanup ordering. A candidate is registered only after installation succeeds, and the default changes only after successful configuration. Existing deletion code can remove such a directory without a saved provider manifest. This remains an inherited recovery limit, not a new rollback guarantee. The stronger release-provenance proposal is separate hardening; checksums bind executable bytes to the selected trusted manifest, and this stage preserves the documented external-provider trust boundary.

The docstring-coverage item is a non-blocking review warning, not an inline defect or failed repository check. No code change is warranted to add comments that restate these named functions and tests. All required lint, documentation, CI and native gates passed; no threshold or setting was changed. The valid templated-driver finding was fixed with a regression and its thread is resolved.