fix(provider): install latest MicroSandbox release by default

[skevetter]

Fresh devsy provider add microsandbox and the Desktop MicroSandbox preset now select the untagged external repository source, so the existing resolver installs the latest published release. Explicit user-selected tags retain their existing behavior, and saved providers are not automatically changed.

The native lifecycle/performance row now selects the same explicit v0.1.8 source used by the other integration fixtures. This keeps all sixteen suites and eighty cases reproducible while unit tests verify the latest-release endpoint and explicit pin preservation. Desktop tests cover preset selection and exact add/init IPC arguments for both unpinned and pinned sources; documentation distinguishes fresh defaults, existing installations and pinned evidence. Resolver, update, migration, built-in compatibility, workflows, cache settings, deadlines and suite counts are unchanged.

Validation: the updated CLI and Desktop assertions reproduced failures against the former defaults. Affected Go race tests, Linux vet, Linux amd64/arm64 E2E compilation, Windows command-package compilation and module verification passed. All 79 Desktop test files/910 tests passed, type checking reported zero errors or warnings, and formatting/lint passed. Documentation build and link checking passed with zero errors, and required Linux CLI lint reported zero issues. All thirteen scoped pre-commit hooks completed (nine passed, four expected no-file skips). Exact-head CI passed: all 88 implementation jobs and seven Desktop jobs, including all 80 native cases, dynamically discovered Windows coverage and both helper packages, 62 Desktop E2E cases on each platform, packaging/tray/Flatpak, and the current pinned runtime performance artifact. Fresh Greptile scored 5/5; completed full remote CodeRabbit covered all nine files with no actionable findings and current Minimal merge risk/Low security architecture risk. Commit identity and GitHub signature verification passed. Full primary and bounded Luna source audits covered all nine files. The temporary waiver of unavailable local CodeRabbit service-start gating remains in effect; no local CodeRabbit coverage is claimed.

[netlify]

✅ Deploy Preview for devsydev ready!

Name	Link
🔨 Latest commit	32f61dd
🔍 Latest deploy log	https://app.netlify.com/projects/devsydev/deploys/6ad13e62d66a5b485adadb7b
😎 Deploy Preview	https://deploy-preview-1498--devsydev.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: e5211407-5045-4b1f-b287-e5269a0a44dc

📥 Commits

Reviewing files that changed from the base of the PR and between 8cb3e7b and 32f61dd.

📒 Files selected for processing: 9

• cmd/provider/add.go
• cmd/provider/add_test.go
• desktop/src/main/__tests__/ipc-provider-jobs.test.ts
• desktop/src/renderer/src/lib/components/provider/ProviderWizard.svelte
• desktop/src/renderer/src/lib/components/provider/ProviderWizard.test.ts
• e2e/tests/up/MICROSANDBOX.md
• e2e/tests/up/provider_microsandbox.go
• sites/docs-devsy-sh/content/docs/developing-providers/external-runtime-rollout.mdx
• sites/docs-devsy-sh/content/docs/managing-providers/manage-providers.mdx

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

📝 Walkthrough

The CLI and Desktop Microsandbox defaults now use the unpinned provider repository, while explicit version pins remain supported. The external end-to-end fixture uses the explicitly published provider version. Documentation describes latest-release resolution, pin selection, reload behavior, and fixture versioning.

Changes: Microsandbox source selection

Layer / File(s)	Summary
Default source and pin handling cmd/provider/add.go, cmd/provider/add_test.go, desktop/src/renderer/src/lib/components/provider/ProviderWizard.svelte, desktop/src/renderer/src/lib/components/provider/ProviderWizard.test.ts, desktop/src/main/__tests__/ipc-provider-jobs.test.ts	The CLI alias and Desktop preset use the unpinned repository source. Tests cover latest-release resolution, explicit pin preservation, and provider job behavior for both source forms.
Fixture versioning and release guidance e2e/tests/up/MICROSANDBOX.md, e2e/tests/up/provider_microsandbox.go, sites/docs-devsy-sh/content/docs/developing-providers/external-runtime-rollout.mdx, sites/docs-devsy-sh/content/docs/managing-providers/manage-providers.mdx	The external end-to-end fixture uses the explicitly published provider version. Setup and provider documentation describe the latest-release default, explicit tag selection, reload behavior, and the version scope of performance evidence.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 32f61

Fresh MicroSandbox installs select the latest release, while explicit pins and reproducible fixtures remain available. No actionable merge-blocking issue was identified; merge after normal checks.

Security architecture risk: 🔵 Low · up to 32f61

The change makes fresh installations follow the latest published provider release without changing its execution privileges. Explicit version pins and existing installations remain supported. No new control bypass was established, but testing of the pinned release does not establish the security or compatibility of future releases.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — A malicious provider release would affect agents executing that selected release with the agent user's host authority and inherited environment. The default change exposes fresh selections, and later reloads of newly unpinned records, to newer releases; it does not itself update every existing installation or grant a new privilege.

Security Findings and Attack Paths

• inferred — No new authentication bypass or untrusted-network-to-execution exploit was established. The relevant conditional path requires influence over the accepted upstream release or its delivery: provider manifest selection, saved provider configuration, declared executable verification, then supervised execution. An executable checksum supplied by that manifest does not independently authenticate its publisher.

Trust Boundaries and Controls

• observed — The resolver downloads provider.yaml over HTTPS without a manifest digest or signature check in the inspected path. That mechanism predates this PR. The change removes default version selection, not an authentication check; explicit tags remain a selection control but are not cryptographic identity guarantees.

Resilience and Maintainability Implications

• observed — Resolution failure returns before persistence. Although downloads occur before locking, mutation runs under the provider operation lock after configuration reload, and duplicate checks reject an existing provider or directory rather than overwriting it. Binary-download failure attempts directory cleanup. Provider-file persistence and global registration remain separate steps, so arbitrary interruption recovery is not established; this ordering is unchanged by the PR.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 5 files. (4 skipped: 4 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the primary change: fresh provider installations now use the latest MicroSandbox release by default.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 5 files. (4 skipped: 4 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

✨ Simplify code

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[netlify]

✅ Deploy Preview for images-devsy-sh canceled.

Name	Link
🔨 Latest commit	32f61dd
🔍 Latest deploy log	https://app.netlify.com/projects/images-devsy-sh/deploys/6ad13e6289945958c4011e0b

[skevetter]

@greptileai review

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable issues were found.

Summary

Fresh CLI and Desktop MicroSandbox installs now select the latest published external release.

• Fresh MicroSandbox installs now use the latest published release.

No actionable issues found. Review checks were based on source inspection; tests were not run.

_{Reviews (1) · Last reviewed commit: "fix(provider): install latest MicroSandb..." · Reviewed by Greptile}

[skevetter]

@coderabbitai full review

Please perform a full review of exact current head 32f61ddced82ba555fac6091ff13cb7cd2b58456 while this PR remains draft, covering all nine changed files. Include current security/architecture and merge-risk analysis, in addition to inline correctness findings. Fresh CLI/Desktop defaults deliberately select the untagged latest-release source; explicit user tags and integration/performance fixtures remain pinned, and existing installations/defaults/builtin compatibility are preserved. Review the actual diff and adjacent resolver/caller contracts; distinguish deterministic latest-endpoint unit proof from explicitly pinned native VM proof.

All applicable implementation/external checks passed on this head, including 88 PR CI jobs, seven Desktop jobs, all 80 native cases, Windows dynamic selected coverage and both helpers, and current pinned performance artifacts. The unavailable local CodeRabbit service has a temporary user waiver; this completed remote full review is still required.

[coderabbitai]

✅ Action performed

Full review finished.