feat(cloud): a cloud workspace works on its own branch, not on the base

Merged
SA
2mo ago
+62-16

First of three from the cloud-workspace review. A cloud box checked out the branch you picked and left the agent standing on it, so work began on main unless the agent thought to branch on its own — and the control-plane row's branch, documented as "creation inputs, not the workspace's identity", never matched what the box was really on. Both of yesterday's e2e workspaces showed main in the API while the boxes sat on e2e/pages-list-limit and mobile/pages-list-limit.

The change

sandboxRepositorySchema gains baseBranch beside branch. checkout_one fetches the base and cuts the working branch from it:

git -C "$ws" fetch -q --depth 1 origin "$base"
git -C "$ws" checkout -q -B "$branch" FETCH_HEAD

workspaceBranchName() produces superset/<slug>-<id8> from the workspace's name and id — namespaced so it is obvious on the remote who opened it, suffixed because two workspaces can share a name. Every checkout in a multi-repo workspace gets the same working branch off its own base, so the branches line up across repositories.

A repository with no baseBranch still just tracks branch, which is exactly what the golden bake passes, so image releases are unaffected.

One catch worth calling out: repository hooks are now read from the base. The working branch does not exist on the remote when readRepoHooks runs.

Why this shape

It matches what the competing product converged on, which I checked rather than guessed — across 28 of their sessions, baseBranch was main every time, branchName was vendor-namespaced every time, and autoBranch was true. Two fields, and the agent is never on the base.

Verified

  • packages/trpc, packages/shared, packages/sandbox, packages/host-service typecheck clean
  • bun test packages/shared packages/trpc: 1316 pass / 1 fail / 1 error — identical to the same run on origin/main (the pre-existing babel-plugin-macros import)
  • bash -n on superset-boot
  • Not yet exercised in a real box: superset-boot reaches one only through a bundle publish + image release, which I'll run next and confirm the branch on a fresh workspace before this is called done.

https://claude.ai/code/session_01FK6rLzBEUiHHXZWNmpQ2BP

Summary by cubic

Cloud workspaces now work on their own branch instead of sitting on the branch you picked. Boot fetches the base branch and cuts superset/<slug>-<id> from it, so the agent is never on main and the control-plane branch matches what the box is actually on.

  • Repository hooks are read from the base branch, since the working branch doesn't exist on the remote yet.
  • A repository without a baseBranch still tracks its branch directly, so golden image releases are unchanged.
  • Every checkout in a multi-repo workspace gets the same working branch off its own base, so branches line up across repositories.
  • The real-sandbox probe now boots on a cut branch, so its branch check covers the branching itself.

Summary by CodeRabbit

  • New Features

    • Workspaces now use a dedicated working branch based on the workspace name and ID.
    • Workspace repositories can be based on a specified branch while changes are made on the workspace’s working branch.
    • Pull requests now target the configured base branch rather than the default branch.
    • Sandbox checks now run against an isolated working branch based on main.

  • Documentation

    • Updated cloud sandbox documentation to accurately describe workspace branches and checkout behavior.