[skevetter]

Existing MicroSandbox workspaces need evidence that changing the same provider name from the embedded driver to the published external provider preserves their VM and data. This adds running and stopped provider set-source scenarios against external provider 0.1.8, using the existing shared test session, independent suite deadline and report validator.

Each scenario starts with the embedded provider and user-provided memory, storage and ephemeral-root options. It verifies the new pinned source and external driver, successful initialization, unchanged provider name/default/options, persisted workspace and SSH records, VM creation time and root/named-volume/bind markers. A running guest keeps its boot ID through migration and ordinary up. A stopped guest stays stopped through source replacement, then ordinary up resumes the same VM with a new boot ID and retained data. Workspace deletion must remove the record and exact owned sandbox; fallback cleanup and named-volume removal have independent bounded attempts. The command test separately proves that failed initialization after committing a replacement leaves that source selected but uninitialized, records the error and preserves options/default/workspace bytes. It does not promise rollback or binary-tree replacement recovery.

The branch normally integrates actual merged PR1485 and current related main, retaining the Go helper foundation, remote-agent row, direct shared SSH calls, dynamic Windows coverage and existing caching/deadlines. The new external-only two-case row makes the configured catalogue 16 suites/80 cases (37 built-in, 43 external). No production behavior or default selection changes; the embedded manifest and driver remain intact.

Local validation: full affected command/up/helper races, Linux E2E/command/helper vet, Linux amd64 and arm64 E2E compilation, Windows command-package compilation, module verification and strict Linux CI lint with zero issues passed. A network-isolated Linux dry run selected exactly the two external migration cases; that proves registration only. All 13 affected-file hooks completed: nine passed and four had expected no-file skips; formatting and diff checks passed. Local CodeRabbit remains temporarily waived by the user while its service cannot start; no local review coverage is claimed.

Exact-head implementation run 38628263920 passed all 88 jobs. All 16 native reports passed once: 80 selected cases (37 built-in, 43 external), including both actual running/stopped migration cases, with no selected skips, dry run or focus. Windows passed all 42 discovered roots and 84 test/subtest IDs plus both helper units. The current performance artifact records 808 reaped warm probes and successful fresh/reused up; it makes no cold-cache or speedup claim. Fresh Greptile completed for this exact head with confidence 5/5 and no actionable findings. Full CodeRabbit completed while draft for all four files with no actionable comments and Minimal merge risk. A supplemental exact-head security/architecture assessment completed with no significant unresolved concerns; its full source-backed limits were inspected. The embedded zizmor parser failure reproduces on the unchanged base expression, and semantically equivalent temporary YAML scans show no introduced finding; the original scanner result is not claimed as passing. Final live checks, threads and all 23 GitHub signatures were refreshed before readiness. The external-provider transition stays conditional on these and the remaining documentation/applicability gates.

[netlify]

✅ Deploy Preview for devsydev canceled.

Name	Link
🔨 Latest commit	0aeea93
🔍 Latest deploy log	https://app.netlify.com/projects/devsydev/deploys/6acfdf1e471f701bdc2df732

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4b98975b-8f6d-4895-b72b-8d5b8277100a

📥 Commits

Reviewing files that changed from the base of the PR and between 571d46e and 0aeea93.

📒 Files selected for processing: 4

• .github/workflows/pr-ci.yml
• cmd/provider/set_source_init_failure_test.go
• e2e/tests/up/MICROSANDBOX.md
• e2e/tests/up/provider_microsandbox_migration.go

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

📝 Walkthrough

The pull request adds end-to-end tests for migrating running and stopped workspaces from the built-in MicroSandbox provider to the published provider. It also adds a unit test for failed initialization after source replacement, and updates CI registration and migration documentation.

Changes: MicroSandbox migration

Layer / File(s)	Summary
Migration test setup .github/workflows/pr-ci.yml, e2e/tests/up/provider_microsandbox_migration.go	The CI matrix adds two external-provider specs. The test creates isolated workspace, sandbox, and volume fixtures, starts the built-in provider, and registers cleanup.
Source switch and state verification e2e/tests/up/provider_microsandbox_migration.go, e2e/tests/up/MICROSANDBOX.md	The test switches to the published provider and checks provider options, workspace and VM state, preserved data, and deletion. The documentation describes the cases and the updated catalogue requirements.
Failed source initialization test cmd/provider/set_source_init_failure_test.go	The unit test checks that replacement configuration remains installed after initialization fails, while provider options, default-provider status, and associated workspace data remain unchanged.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Other

Sequence Diagram(s)

sequenceDiagram
  participant MigrationTest
  participant ProviderConfig
  participant Workspace
  participant MicroSandbox
  MigrationTest->>ProviderConfig: Switch source to published provider
  MigrationTest->>Workspace: Run up and inspect workspace and VM state
  Workspace->>MicroSandbox: Retain or restart workspace sandbox
  MigrationTest->>Workspace: Delete workspace
  MigrationTest->>MicroSandbox: Verify sandbox is absent

Loading

Merge Risk: ⚪ Minimal · up to 0aeea

No actionable merge-blocking issue is established. The migration and failed-initialization coverage can proceed through the remaining normal review and validation steps.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 2 files. (2 skipped: 2 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: tests for existing MicroSandbox provider-source migration. It matches the running and stopped workspace migration scenarios in the changeset.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 2 files. (2 skipped: 2 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

✨ Simplify code

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[netlify]

✅ Deploy Preview for images-devsy-sh canceled.

Name	Link
🔨 Latest commit	0aeea93
🔍 Latest deploy log	https://app.netlify.com/projects/images-devsy-sh/deploys/6acfdf1ed9fb3491e32a9596

[skevetter]

@greptileai review

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The reviewed changes appear safe to merge, with no actionable issues found.

Summary

Adds coverage for moving an existing MicroSandbox workspace from the embedded driver to external provider v0.1.8.

• The test suite checks migration of running and stopped MicroSandbox workspaces.
• The command test checks what remains after source replacement fails to initialize.

No actionable issues were found. This review used source inspection; it did not run the native migration cases.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Create workspace with embedded driver] --> B[Save identity and write data markers]
  B --> C{Starting state}
  C --> D[Keep VM running]
  C --> E[Stop VM]
  D --> F[Replace source with external provider]
  E --> F
  F --> G[Check saved records and unchanged VM]
  G --> H[Run ordinary up]
  H --> I[Check boot ID and retained data]
  I --> J[Delete workspace and check sandbox removal]

Loading

_{Reviews (1) · Last reviewed commit: "chore: integrate reviewed remote-agent f..." · Reviewed by Greptile}

[skevetter]

@coderabbitai full review

Please review the complete current draft at 0aeea93, covering all four changed files and retained security, architecture, lifecycle/cleanup and merge-risk concerns. Exact-head implementation CI and all 80 native scenarios passed; Greptile completed 5/5. Keep the PR draft while the full review completes.

[coderabbitai]

✅ Action performed

Full review finished.

[skevetter]

@coderabbitai Please supplement your completed full review (run 4b98975b-8f6d-4895-b72b-8d5b8277100a) of exact head 0aeea93 with an explicit security/architecture assessment of all four changed files. The completed summary contains merge risk but no security/architecture section. Assess provider/source trust boundaries, workspace/VM preservation assertions, ownership and bounded cleanup, and the post-commit init-failure contract. Identify any significant unresolved concern, or state that none was found. This asks for the missing assessment, not another full review; keep the PR draft. We are independently investigating the reported zizmor parser failure against the unchanged base expression.

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail
git rev-parse HEAD
gh pr view 1487 --repo devsy-org/devsy --json headRefOid,baseRefOid,isDraft
git show --stat --oneline 0aeea936aba901a4d2a1622458cda1dfb9ac0cdf
ast-grep outline e2e/tests/up/provider_microsandbox_migration.go --items all
ast-grep outline cmd/provider/set_source_init_failure_test.go --items all
gh pr diff 1487 --repo devsy-org/devsy -- .github/workflows/pr-ci.yml e2e/tests/up/MICROSANDBOX.md 2>/dev/null || git diff HEAD^ HEAD -- .github/workflows/pr-ci.yml e2e/tests/up/MICROSANDBOX.md
sed -n '1,380p' e2e/tests/up/provider_microsandbox_migration.go
sed -n '1,220p' cmd/provider/set_source_init_failure_test.go

Length of output: 25046

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail
git diff --stat 571d46ed222ef1ac6e2ba19e2e701f390358b38a...0aeea936aba901a4d2a1622458cda1dfb9ac0cdf
git diff 571d46ed222ef1ac6e2ba19e2e701f390358b38a...0aeea936aba901a4d2a1622458cda1dfb9ac0cdf -- .github/workflows/pr-ci.yml e2e/tests/up/MICROSANDBOX.md
rg -n -C3 'func .*snapshotCompatibilityWorkspace|type compatibilityWorkspaceState|func .*inspectSafeRecreate|func .*microsandboxResourceCommand|func .*newMicrosandboxTestSession|microsandboxExternalProvider\s*=|func .*CleanupWorkspace|func .*SetSourceCmd.*Run|func .*SetProviderSource|func .*ReplaceProvider|func .*InitProvider' --type go .
fd -i 'set_source|compatibility|safe_recreate|resource|provider' cmd/provider pkg/workspace e2e/tests/up e2e/framework
ast-grep outline cmd/provider --items all --type function,method --match 'Run|Source'
ast-grep outline pkg/workspace --items all --type function --match 'Provider|Init'
ast-grep outline e2e/framework/util.go --items all --match 'Cleanup|Workspace'
sed -n '370,540p' .github/workflows/pr-ci.yml
sed -n '100,155p' e2e/tests/up/MICROSANDBOX.md

Length of output: 27861

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail
ast-grep outline cmd/provider/set_source.go --items all
ast-grep outline pkg/workspace/provider.go --items all
ast-grep outline e2e/tests/up/microsandbox_session.go --items all
ast-grep outline e2e/tests/up/provider_microsandbox_compatibility.go --items all --match 'compatibilityWorkspaceState|compatibilityFileState|snapshotCompatibilityWorkspace|snapshotCompatibilityFile'
ast-grep outline e2e/tests/up/provider_microsandbox_recreate.go --items all --match 'safeRecreateInspection|inspectSafeRecreate'
ast-grep outline e2e/tests/up/provider_microsandbox_resources.go --items all --match microsandboxResourceCommand
ast-grep outline e2e/framework/command.go --items all --match 'CleanupWorkspace|DevsyWorkspaceDelete'
sed -n '1,250p' cmd/provider/set_source.go
sed -n '80,220p' e2e/tests/up/microsandbox_session.go
sed -n '500,620p' e2e/tests/up/provider_microsandbox_compatibility.go
sed -n '40,85p' e2e/tests/up/provider_microsandbox_recreate.go
sed -n '335,375p' e2e/tests/up/provider_microsandbox_recreate.go
sed -n '350,380p' e2e/tests/up/provider_microsandbox_resources.go
sed -n '505,550p' e2e/framework/command.go
rg -n -C8 'func (UpdateProvider|updateProvider|SwitchProvider)\b|func .*Init\b|InitAttempted|InitError' pkg/workspace/provider.go pkg/provider --glob '*.go' --glob '!**/*_test.go'

Length of output: 25220

---

@skevetter, I found no significant unresolved security or architecture concern in the four-file PR diff at 0aeea936aba901a4d2a1622458cda1dfb9ac0cdf. This assessment supplements the completed review. I did not trigger another review or change the PR state. The PR remains a draft.

Security and architecture assessment

e2e/tests/up/provider_microsandbox_migration.go

• Provider/source trust boundary: Migration explicitly selects github.com/devsy-org/devsy-provider-microsandbox@v0.1.8. The test checks the stored source, internal/external flag, and driver change while retaining the provider name. External provider code remains trusted executable code; a version tag alone does not establish supply-chain authenticity. This PR does not add a new production trust mechanism.
• Workspace/VM preservation: The assertions compare the persisted workspace record, excluding only lastUsed. They also compare workspace identity and SSH file content, permissions, and ownership. VM creation time and guest boot IDs distinguish preservation from recreation or restart. The running case requires an unchanged boot ID. The stopped case requires the VM to remain stopped until up, then requires a changed boot ID.
• Data preservation: Both cases check root, named-volume, and host-bind markers after up. The running case also checks the markers immediately after migration.
• Ownership and cleanup: Each case isolates Devsy and MicroSandbox configuration in temporary directories. Cleanup targets the generated sandbox name and volume name, not a broad resource set. Volume removal requires successful creation. Workspace deletion, sandbox fallback, and volume removal have independent cleanup callbacks with fresh one-minute contexts. Normal deletion also checks removal of the workspace record and exact sandbox.

cmd/provider/set_source_init_failure_test.go

• Post-commit init-failure contract: The test matches the command ordering: replacement completes before activation starts. A missing init executable must return an error while leaving the replacement source installed.
• The test requires Initialized=false, InitAttempted=true, and a stored executable-path error. It also requires retained user options, the existing default provider, an unchanged workspace record, and unchanged workspace content.
• This contract does not guarantee rollback or protection from side effects of a malicious or partially executed init command. The fixture fails before that executable can run. Those limits do not invalidate the stated coverage.

.github/workflows/pr-ci.yml

The change adds only a fixed external-provider matrix row with two expected cases. It does not change permissions, secrets, actions, or shell expressions. It reuses the existing native-test and evidence path.

e2e/tests/up/MICROSANDBOX.md

The documentation matches the assertions and states that native execution is required. It distinguishes registration checks from migration proof. It also identifies the need for a literal legacy built-in fixture before a future bundled-default transition.

Scope: This conclusion comes from exact-head source inspection, including supporting helpers. I did not rerun tests or independently revalidate the reported CI results. The reported zizmor parser failure remains a separate gate under investigation; this assessment does not resolve it.

You are interacting with an AI system.

[skevetter]

Final disposition for exact head 0aeea936aba901a4d2a1622458cda1dfb9ac0cdf:

• Greptile completed with confidence 5/5 and no actionable issues. CodeRabbit full review 4b98975b-8f6d-4895-b72b-8d5b8277100a completed for all four changed files, with no actionable comments and Minimal merge risk. Its complete summary and empty review/inline/thread endpoints were inspected. Because that summary omitted a security/architecture section, a separate exact-head supplemental analysis was requested and completed in comment 6178857500; it explicitly found no significant unresolved security or architecture concerns across all four files. Its trust, preservation, cleanup and post-commit failure limits were inspected.
• The embedded zizmor 1.30.1 invocation failed before auditing because of the existing quoted matrix.provider-mode || 'parity' expression. This fatal/no-audit result reproduces on both this head and its exact base 571d46ed. Temporary block-scalar copies retain identical decoded yaml.v3 nodes. Offline normalized scans have the same 30 findings and 52 stable semantic finding locations, with no additions/removals. The PR changes only a fixed external matrix row, not the failing expression, permissions, secrets or shell commands. This is a source-backed baseline tool limitation; the original workflow did not pass zizmor, and no scanner setting or repository source was changed to hide it.
• The docstring-percentage warning concerns private test helpers and conventional test functions. The guide documents state preservation, cleanup ownership and failure boundaries; the cleanup comment preserves the non-obvious independence contract. No missing public API contract or useful reason for restating each private helper name was identified.
• Exact-head implementation run 38628263920 passed all 88 jobs and all 80 selected native cases, including both actual running/stopped migrations. Windows passed all 42 discovered roots/84 test IDs and both helper units; current warm performance/provenance/reaping was verified. Current applicable checks, latest main, threads and all 23 GitHub signatures were refreshed. The local CodeRabbit service remains temporarily waived by the user; no local review coverage is claimed.

This establishes the tested migration and init-failure contracts. It does not promise rollback after committed initialization/recreation effects, raw VM configuration equivalence, or runtime behavior on other host profiles.