feat(cli): cloud workspace commands that work while the sandbox sleeps

Merged
KI
2d ago
+783-71

What

The API already serves these cloud-workspace operations without the sandbox, so the CLI now exposes them. None wakes a sleeping sandbox.

workspaces update on a cloud workspace

  • --task-id <id|slug> links a task (a cloud workspace can link several); --clear-task unlinks all. Before, both were refused for cloud.
  • New: --visibility just_me|org, --add-label <name>, --remove-label <name> (repeatable). On a host workspace these error with "applies to cloud workspaces only".

New commands

  • workspaces unarchive <id> (alias restore)
  • workspaces restart [id]: ends every terminal and agent so they pick up current agent sign-ins
  • workspaces activity [id]: the timeline
  • workspaces pull-requests [id] (alias prs), --all, --archived
  • workspaces share list|add|remove [id]: --user <email|id>, --team <id>

[id] defaults to $SUPERSET_SANDBOX_WORKSPACE_ID, like workspaces sleep, so an agent inside a cloud workspace can act on itself.

workspaces get on a cloud workspace reads cloudWorkspace.get: adds visibility, agent status, description, repositories, tasks, labels, archivedAt.

Skills (superset plugin 0.3.4). Workspace, agent and terminal commands default to the cloud for cloud accounts, and several skills still assumed this machine:

  • standup/scripts/sweep.sh listed local workspaces but read their terminals from the cloud. Now --local throughout.
  • orchestrate: in-workspace calls pass --local.
  • 10x and setup: workspaces create commands failed as written (no --name, no --branch).
  • 10x/scripts/audit.sh failed on large accounts with jq: Argument list too long; it now passes data through files. It also reports local workspaces.
  • doctor, orchestrate, standup, 10x, automate, environment mention the new commands where they help.

Not changed: cloudWorkspace.setProject. The CLI has no way to list task projects, so an agent couldn't find the id to pass.

Verified

  • bun test (packages/cli): 477 pass, 0 fail. bun run typecheck: clean. bun run lint:fix, bun run check:plugins: clean.
  • New tests: updateCloudWorkspace.test.ts (clearing every task, removing a label by name, linking by slug, an unknown label) and resolveGrantees.test.ts (exact email match). I broke each implementation and confirmed the test fails, then restored it.
  • Against production on a cloud workspace I own, every step reversed: add/remove label (case-insensitive), visibility org → just_me → org, link a task by slug and --clear-task, a missing label's error, the host-path refusal, share add for an unknown email and for the owner. get, activity, pull-requests and share list also checked on a teammate's workspace (reads only). activity shows every one of these writes.
  • standup/scripts/sweep.sh against a real account: 10 local workspaces, 18 terminals, 0 errors. 10x/scripts/audit.sh: complete JSON, where before it failed.
  • Not run against production: restart, unarchive, and share add/remove with a real teammate (they end running agents or notify someone). Unit-tested only.

Summary by cubic

Adds cloud workspace operations to the CLI that the API already serves, so none of them wakes a sleeping sandbox. --task-id and --clear-task, previously refused for cloud workspaces, now work there.

New Features

  • workspaces update on a cloud workspace links tasks by id or slug (--task-id, multiple allowed), unlinks them all (--clear-task), and takes new --visibility just_me|org, --add-label <name>, and --remove-label <name>; the new flags error on host workspaces. Tasks and labels resolve before the first write, so a bad id or unknown label changes nothing.
  • Adds workspaces unarchive (alias restore), restart (requires an id), activity, pull-requests (alias prs), and share list|add|remove, which takes --user <email|id> and --team <id>.
  • Cloud workspace commands default to $SUPERSET_SANDBOX_WORKSPACE_ID when run inside one, like workspaces sleep. pull-requests --archived lists every archived workspace's, even when run inside one.
  • workspaces get on a cloud workspace now returns visibility, agent status, description, repositories, tasks, labels, and archivedAt.

Bug Fixes

  • standup/scripts/sweep.sh listed local workspaces but read cloud terminals; it now passes --local throughout.
  • 10x/scripts/audit.sh failed with jq: Argument list too long on large accounts; it now passes data through files and reports local workspaces too.
  • 10x and setup skills' workspaces create calls lacked required --name and --branch; doctor, orchestrate, standup, automate, and environment mention the new commands, and the environment skill stops when a workspace fails.

cloudWorkspace.setProject is not covered: the CLI has no way to list task projects, so an agent cannot find the id to pass.

Summary by CodeRabbit

  • New Features

    • Added CLI commands to restore and restart cloud workspaces, view activity and pull requests, and list, add, or remove workspace shares.
    • Expanded cloud workspace updates with visibility, labels, and task-link options. Workspace details now show additional status and metadata.
    • Cloud workspace activity and sharing details can be queried while a sandbox is asleep.

  • Documentation

    • Updated CLI and plugin guides with cloud workspace commands, sharing permissions, archive restoration details, and workspace-targeting guidance.
    • Clarified setup, automation, and workspace coordination instructions.