feat(cli): hide commands that cannot work inside a cloud workspace by saddlepaddle · Pull Request #7794 · ParadevAI/Paradev

saddlepaddle · 2026-09-24T06:18:07Z

What

superset --help inside a cloud workspace no longer lists commands that cannot work there. Commands and groups can carry sandbox: false; the command tree hides them when the CLI runs under SUPERSET_SANDBOX_WORKSPACE_ID (the signal resolve-auth.ts already keys on).

Tagged: auth login, auth logout, start, stop, update, hosts wake, hosts set-wake, plugins install/uninstall/enable/disable/connect, plugins marketplace add/remove. whoami, plugins list/sync, hosts list stay — a box needs to be able to say who it acts as.

Why

A box holds no login, its lifecycle belongs to the control plane, and account-state writes from a box are a person's call. Until now an agent learned all of that by collecting 403s. Visibility only; the API keeps enforcing.

This is a second axis beside audience (#7776), not a third audience value: audience is release stage, sandbox is surface. Same filterByAudience, one extra predicate, prefix hiding as before.

Verified

cli-framework tests 35/35 (one block added to the existing router.test.ts), Biome clean, tsc clean on both packages.
Dev runner, outside vs inside a box (SUPERSET_SANDBOX_WORKSPACE_ID set):

	outside	inside
`auth --help`	login, logout, whoami	whoami
`plugins --help` (internal)	full set	list, marketplace (list only), sync
`hosts --help`	list, wake, set-wake	list

Context: https://app.superset.sh/page/plugins-in-sandboxes-review-ax4huu

https://claude.ai/code/session_01BVBuTCFBb1JkoX76VpLAQ8

Summary by cubic

Hides commands that can't work inside a cloud workspace from superset --help, instead of letting agents discover them via 403s. Drop a flaky watcher-manager recovery test that raced the chokidar backend on shared runners; its backends' own create/update/delete and ignore tests remain.

Commands and groups now support sandbox: false, which hides them when SUPERSET_SANDBOX_WORKSPACE_ID is set — the same signal resolve-auth.ts uses.
Tagged: auth login/logout, start, stop, update, hosts wake/set-wake, plugin install/uninstall/enable/disable/connect, and marketplace add/remove. whoami, plugins list/sync, and hosts list stay.
This is a second axis beside audience (release stage vs surface), so it reuses filterByAudience with one additional predicate. API enforcement is unchanged.

^{Written for commit 8b15358. Summary will update on new commits.}

Summary by CodeRabbit

New Features
- Cloud workspace environments now hide commands that require local system access, keeping unavailable actions out of the command list.
- Authentication, host management, plugin management, start/stop, and update commands are marked as requiring local access and are hidden in cloud workspaces. They remain available in other environments.

A box holds no login and its lifecycle belongs to the control plane, yet `superset --help` in one still offered `auth login`, `start`, `update` and the plugin account mutations, so an agent learned what was off-limits by collecting 403s. Commands and groups can now carry `sandbox: false`, and the command tree hides them when the CLI runs under SUPERSET_SANDBOX_WORKSPACE_ID, the same signal resolve-auth already keys on. It is a second axis beside `audience`, not a third audience value: audience is release stage, this is surface. Visibility only; the API keeps enforcing. Claude-Session: https://claude.ai/code/session_01BVBuTCFBb1JkoX76VpLAQ8

coderabbitai · 2026-09-24T06:18:40Z

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: c13ccb2a-bed8-4c81-aa45-4f79cc8d9c2e

📥 Commits

Reviewing files that changed from the base of the PR and between 7df32e0 and 8b15358.

📒 Files selected for processing (1)

packages/workspace-fs/src/watch-backend/watch-backend.test.ts

💤 Files with no reviewable changes (1)

packages/workspace-fs/src/watch-backend/watch-backend.test.ts

Included review availability: Your plan provides up to 10 included reviews per hour; 6 remain after this review.

📝 Walkthrough

Walkthrough

The CLI configuration now reports whether a cloud workspace is active. The runner passes that state to command filtering, which hides groups and commands marked sandbox: false. Several CLI commands now carry that setting. The change also removes the FsWatcherManager test suite for the chokidar backend.

Changes

Sandbox command visibility

Layer / File(s)	Summary
Sandbox state contract and runner wiring `packages/cli-framework/src/{command,config,runner,build,dev}.ts`, `packages/cli/cli.config.ts`	The configuration and runner support an optional sandbox state. Build and development entry points pass the configured value to the runner. The CLI configuration derives the value from `SUPERSET_SANDBOX_WORKSPACE_ID`.
Sandbox-aware command filtering `packages/cli-framework/src/router.ts`, `packages/cli-framework/src/router.test.ts`	The router hides groups and commands marked `sandbox: false` when sandbox mode is active. Tests cover active, inactive, and unset sandbox state.
CLI command sandbox settings `packages/cli/src/commands/auth//command.ts`, `packages/cli/src/commands/hosts//command.ts`, `packages/cli/src/commands/plugins/**/command.ts`, `packages/cli/src/commands/{start,stop,update}/command.ts`	Authentication, host, plugin, start, stop, and update commands are marked `sandbox: false`.

Watcher test removal

Layer / File(s)	Summary
Remove FsWatcherManager chokidar tests `packages/workspace-fs/src/watch-backend/watch-backend.test.ts`	The test file no longer imports `FsWatcherManager` or includes its chokidar backend test suite.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~12 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant CliConfig as CLI config
  participant EntryPoint as Build or development entry point
  participant Runner as Runner
  participant Filter as filterByAudience
  CliConfig->>EntryPoint: Provide sandbox state
  EntryPoint->>Runner: Pass sandbox option to run
  Runner->>Filter: Pass sandbox state for filtering

Merge Risk: ⚪ Minimal · up to 8b153

No specific issue is established that would prevent merging after normal checks.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 10.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 10 functions across 22 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title uses conventional commit format and clearly summarizes the primary change: hiding commands that cannot run in cloud workspaces.
Description check	✅ Passed	The description explains what changed, why it changed, which commands are affected, and how the change was tested. It does not reproduce the template checklist, but the core required information is pr…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-09-24T06:26:13Z

🧹 Preview Cleanup Complete

The following preview resources have been cleaned up:

✅ Neon database branch

Thank you for your contribution! 🎉

"emits events, prunes ignored dirs, and recovers a recreated root" races the chokidar backend on a shared runner and fails on PRs that never touch the watcher. The backend's own create/update/delete and ignore tests stay, and the manager's root-recovery path keeps its dedicated coverage in watch-root-recovery.test.ts. Claude-Session: https://claude.ai/code/session_01BVBuTCFBb1JkoX76VpLAQ8

* docs: weekly update for PRs merged 2026-09-23 to 2026-09-30 Source of truth: live Notion SOP "Weekly Docs Update (automation SOP)". Window: merged:>=2026-09-23 (139 PRs). PRs through the morning of 09-23 were covered by #7771. Changes - Pages: no auto-open on publish (#7790); page links and URL links split into their own settings (#7916, #7962, #7946); Listening agents menu with per-row stop and Add listening agent (#7724, #7820, #7919); globe on the Share button (#7766); Report on public pages (#7886); agents offer a page (#7759). Files: pages.mdx, cli/cli-reference.mdx. - Settings moves: Links replaced by Browser and Files & Editor (#7916, #7962). Files: editor.mdx, terminal-integration.mdx, customization.mdx. - Editor: inline rename and drag to move (#7692), Auto Save (#7693, #7916), open and save files outside the workspace (#7897, #7982), Copy as Markdown (#7591), per-pane error screen (#7983). File: editor.mdx. - Terminal copy follows Ghostty's whitespace rules (#7868). File: terminal-integration.mdx. - Agents: UFO (#7898); GPT-6 Astra, Sonnet 5.5, retiring GPT-5.5, retired GPT-5.4/5.3 Codex (#7783, #7894, #7935). Files: agent-integration.mdx, cli/cli-reference.mdx. - Host: superset start --daemon --auto-update and update-lock permission errors (#7735, #7952). Files: cli/host-server.mdx, cli/cli-reference.mdx. - Removed the mcp CLI section and the Connected Service Plugins section: #7776 made plugins/mcp internal, the Plugins page is staff-flagged, and apps/docs/AGENTS.md keeps internal commands out. Files: skills.mdx, cli/cli-reference.mdx. - Slack page unfurls and details panel (#7817, #7821, #7914, #7957). File: use-with-slack.mdx. - Workspaces: instant creation with background naming (#7518); recoverable project deletion (#7896). File: workspaces.mdx. - Shortcuts: prev/next workspace includes Pinned and wraps (#7851); ⌘B collapses the sidebar to a rail (#7964). File: keyboard-shortcuts.mdx. - Ship controls and open-in button moved to the right sidebar strip (#7958). Files: diff-viewer.mdx, use-with-ide.mdx. Deliberately skipped - Cloud workspaces/environments/sandboxes (flag-gated, AGENTS.md rule): #7784 #7795 #7824 #7840 #7844 #7845 #7847 #7849 #7850 #7858 #7861 #7863 #7874 #7911 #7913 #7918 #7922 #7931 #7932 #7937 #7956 #7961 #7969 #7981 #7637 #7794 #7789 #7838 (its CLI docs already shipped in the PR). - Staff-only plugins: #7912 Sentry plugin, #7716, #7727, #7955. - Already documented in their own PRs: #7917, #7921. - Removed feature never documented: #7796 Google Calendar triggers. - Agents chip remove/revert/default-off, never documented: #7870 #7871 #7872. - Billing/backend policy with no docs surface: #7947, #7812, #7786, #7792, #7798, #7761, #7948, #7949, #7951, #7827. - Reverted security trio: #7828 #7829 #7830 (reverted by #7834). - Fixes restoring expected behavior: #7683 #7696 #7707 #7743 #7751 #7756 #7764 #7765 #7781 #7788 #7791 #7823 #7825 #7833 #7837 #7852 #7857 #7860 #7864 #7865 #7869 #7873 #7897-covered #7903 #7938 #7980 #7943 #7964-chrome. - Mobile (no docs page): #7746 #7747 #7748 #7749 #7750 #7782 #7793 #7810 #7814 #7816 #7889 #7968. - Marketing, internal docs, CI, version bumps: #7651 #7744 #7752 #7771 #7774 #7776-infra #7777 #7785 #7811 #7818 #7822 #7826 #7834 #7884 #7885 #7895 #7909 #7933 #7934 #7942 #7944 #7965 #7966. Validation: bun run --cwd apps/docs typecheck, bun run lint:fix, bun run lint (exit 0), Vale on 13 changed files (0 errors, 0 warnings), git diff --check. * chore: log weekly docs update follow-ups * docs: tighten review findings in the weekly update Only the page creator can stop or add listening agents. On focus change also saves on window blur, and Auto Save pauses on conflicts. Taken-down pages do not unfurl. Model picker coverage matches agent-models.ts.

saddlepaddle temporarily deployed to preview September 24, 2026 06:18 — with GitHub Actions Inactive

saddlepaddle temporarily deployed to preview September 24, 2026 06:19 — with GitHub Actions Inactive

saddlepaddle had a problem deploying to preview September 24, 2026 06:30 — with GitHub Actions Error

saddlepaddle force-pushed the cli-sandbox-surface branch from b69b8a1 to 8b15358 Compare September 24, 2026 06:30

saddlepaddle temporarily deployed to preview September 24, 2026 06:30 — with GitHub Actions Inactive

saddlepaddle temporarily deployed to preview September 24, 2026 06:31 — with GitHub Actions Inactive

saddlepaddle merged commit 6e787f2 into main Sep 24, 2026
20 checks passed

Navigation Menu

Repository navigation

feat(cli): hide commands that cannot work inside a cloud workspace - #7794

feat(cli): hide commands that cannot work inside a cloud workspace#7794
saddlepaddle merged 2 commits into
mainfrom
cli-sandbox-surface

saddlepaddle commented Sep 24, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Sep 24, 2026 •

edited

Loading

Walkthrough

Changes

Sequence Diagram(s)

❌ Failed checks (1 warning)

Uh oh!

github-actions Bot commented Sep 24, 2026 •

edited

Loading

Uh oh!

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

saddlepaddle commented Sep 24, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Why

Verified

Summary by cubic

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Sep 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

❌ Failed checks (1 warning)

Uh oh!

github-actions Bot commented Sep 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🧹 Preview Cleanup Complete

Uh oh!

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

saddlepaddle commented Sep 24, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Sep 24, 2026 •

edited

Loading

github-actions Bot commented Sep 24, 2026 •

edited

Loading