🐛 Fix workspace lifecycle contracts

[nbsp1221]

Summary

• Require explicitly configured current host roots before clone or direct workspaces can be selected, removing the host-specific implicit default.
• Keep failed sandboxes visible and scoped to their workspace, clean up unhealthy runtimes, and prevent retention cleanup from moving workspaces with unfinished sandboxes.
• Preserve existing retention deadlines when sandbox creation fails and begin retention only after the final unfinished sandbox is removed.

Verification

• pnpm check — formatting, linting, type checking, 64 unit/integration tests, and the production build passed
• pnpm test:e2e — the real Docker Sandbox lifecycle, managed/clone/direct workspace behavior, Bash sessions, and port exposure passed

Notes

Host workspaces are now disabled unless CHAT2SBX_ALLOWED_HOST_ROOTS is explicitly configured. Existing registrations remain stored and become usable again when their paths are allowed. This change does not add automatic retries, restarts, replacement, or failed-record cleanup.

[leverframe]

Leverframe review

🟢 Incremental review completed in 311s

• 0 new findings
• 3 existing findings were verified fixed
• 3 of 3 changed files reviewed
• Verification: 5 passed

Changes efe33fb..15c873b · Commit 15c873b · View check run

[leverframe]

Leverframe review

Found one concurrency defect. Verification used the repository-declared Node 24/pnpm 11.23.0 environment: Node v24.20.0, pnpm 11.23.0, TypeScript 5.9.3, and Vitest 4.1.11. The normal quality gate passed; real Docker Sandboxes E2E remained unavailable because sbx is not installed.

Findings

1 finding was published inline.

Checks

5 passed · 1 failed · 0 not run

Show 6 checks

Status	Check	Evidence
🟢 passed	pnpm install --frozen-lockfile	pnpm 11.23.0 verified the 552-entry lockfile and installed 464 packages on Node v24.20.0.
🟢 passed	pnpm check	Formatting, oxlint/eslint, TypeScript typecheck, 64 unit/integration tests across 13 files, and the production build passed.
🟢 passed	pnpm exec vitest run --project integration test/integration/sandbox-service.test.ts test/integration/workspace-service.test.ts && pnpm exec vitest run --project unit test/unit/config.test.ts	All changed focused suites passed: 24 integration tests and 6 configuration unit tests.
🟢 passed	pnpm exec vitest run --project integration test/integration/review-unhealthy-race.test.ts	A temporary focused regression test reproduced the concurrent false-reuse behavior; the temporary test file was removed afterward.
🟢 passed	git diff --check a7693b08bcc9765cf41fc11fdaac861f1f9151b3...5bb8fe4f9d9c1af878871a58e1c835c9780bd878	No whitespace errors were reported.
🔴 failed	pnpm test:e2e	The suite stopped at its prerequisite check with spawnSync sbx ENOENT; no E2E behavior executed.

Limitations

• Real E2E verification was unavailable because the required Docker Sandboxes sbx executable and plugin are absent. Docker Engine 29.7.2 is available, but the repository provides no container or wrapper substitute for sbx.

[leverframe]

Leverframe review

Reviewed the complete incremental diff using Node v24.20.0 and pnpm 11.23.0, matching CI's Node 24 and the packageManager declaration. Repository checks passed, but a focused concurrency test reproduced one new active-limit defect.

Findings

1 finding was published inline.

Checks

3 passed · 1 failed · 0 not run

Show 4 checks

Status	Check	Evidence
🟢 passed	node --version && pnpm --version	Node v24.20.0 and pnpm 11.23.0.
🟢 passed	pnpm check	Formatting, Oxlint, ESLint, TypeScript typecheck, 65 unit/integration tests across 13 files, and the Node 24 build all passed.
🔴 failed	pnpm exec vitest run --project integration test/integration/review-active-limit-race.test.ts	Temporary focused review test: expected Active sandbox limit reached while removal was blocked, but a second sandbox was created. The temporary test was removed afterward and the worktree was clean.
🟢 passed	git diff --check 5bb8fe4f9d9c1af878871a58e1c835c9780bd878...fc4558b20c7c2111a2f230a1f44f285207d98563	No whitespace errors.

[leverframe]

Leverframe review

Reviewed both incremental changed files using the repository-declared Node 24 and pnpm 11.23.0 environment (actual versions Node v24.20.0, pnpm 11.23.0). The patch fixes both previously reported live-process races, but introduces one limited restart-window lifecycle defect.

Findings

1 finding was published inline.

Checks

4 passed · 1 failed · 0 not run

Show 5 checks

Status	Check	Evidence
🟢 passed	pnpm install --frozen-lockfile	Installed the frozen pnpm lockfile with pnpm 11.23.0; 464 packages were installed and supply-chain policy verification passed.
🟢 passed	pnpm exec vitest run --project integration test/integration/sandbox-service.test.ts -t 'an unhealthy sandbox cannot be reused while its runtime is being removed'	Vitest 4.1.11: 1 test passed, confirming both active-limit and same-workspace reuse races are fixed.
🟢 passed	pnpm check	Formatting, oxlint/eslint, TypeScript 5.9.3 typecheck, all 65 unit/integration tests, and the Node 24 production build passed.
🔴 failed	temporary focused Vitest: interrupted unhealthy cleanup remains failed after restart	Focused diagnostic reproduced the defect: expected failed, received destroyed. The temporary test was removed afterward and git status/diff checks confirmed a clean worktree.
🟢 passed	pnpm exec vitest run --project integration test/integration/sandbox-service.test.ts -t 'an unhealthy sandbox cannot be reused while its runtime is being removed|an unavailable runtime becomes an explicit failed sandbox without automatic restart|a controller restart invalidates runtimes'	Three relevant lifecycle tests passed after removal of the temporary diagnostic test.

Limitations

• Real sandbox E2E tests were unavailable because the repository-required sbx executable and template are not installed. The changed service/database state-machine behavior was exercised at the repository's integration boundary.