Skip to content

Native: move a host session into a Sandbox and open its desktop - #343

Open
kentdebruin wants to merge 1 commit into
mainfrom
report-add-native-sandbox-move-and-desktop-actions
Open

kentdebruin wants to merge 1 commit into
mainfrom
report-add-native-sandbox-move-and-desktop-actions

Conversation

@kentdebruin

Copy link
Copy Markdown
Contributor

Native parity for the Sandbox session actions from ef430bc (attach), 94296ed (desktop) and a2db38b (⋯ menu placement). The native app had creation and pause/wake/recreate; it now has the two newer actions.

Before / after

Before After
Session ⋯ menu No move Move to Sandbox submenu listing the ready providers (Daytona, Box); disabled while the agent runs
428 for unpushed work n/a Asked exactly once: the server's sentence as a destructive Move confirm, then the retry carries confirm
Workspace sheet, awake Sandbox Pause / Wake / Recreate + Open desktop when the status reports canDesktop
Desktop URL n/a Minted on the tap, opened in SFSafariViewController, held only as the sheet's state; never persisted or logged (description is redacted)

Changes

  • Models/SessionSandbox.swift: canDesktop, SandboxDesktopLink (web URLs only, redacted description), SandboxMove (web's eligibility rule, ready providers, attempt classifier that surfaces the 428 once).
  • Networking/OS1API.swift: sandboxAttach(sessionId:provider:confirm:), sandboxDesktop(sessionId:), APIError.confirmRequired via a testable responseError(status:body:) so a 428 keeps its meaning.
  • Views/SessionView.swift: the submenu, the two confirm dialogs, the error alert; success posts a notice and puts the returned sandbox record on the row optimistically (SessionViewModel.noteSandboxMove).
  • Views/WorktreeInfoView.swift: Open desktop row + Safari sheet.
  • Two DEBUG-only capture hooks: OS1_MOVE_TO_SANDBOX=<provider>, OS1_SCROLL_TO=sandbox.
  • OS1Tests/SessionSandboxTests.swift: decoding, bearer-link handling, eligibility, provider resolution, 428 mapping, ask-once flow (11 tests).

Verification

  • OS1 and OS1Mac build on tella-mac-node (Xcode 26.6); OS1Tests selected suites: 66 tests, 0 failures. bun run check passes.
  • Live, against a throwaway host session with one uncommitted file: submenu → Move to Daytona → server 428 shown once → confirmed retry → record became daytona / preparing / volume; notice "Moving to Daytona. The next message runs there." Session archived afterwards.
  • Live, on an awake Box session: Open desktop minted a link and the XFCE desktop rendered inside the app's Safari view.

Simulator screenshots are in the session.

Started by Kent de Bruin in this OS session

The web gained two Sandbox session actions the native app did not have:
Move to Sandbox in the session ⋯ menu (POST /sandbox/attach, with the
server's 428 for unpushed work) and Open desktop on an awake Sandbox
(POST /sandbox/desktop, a one-viewer bearer URL, advertised by canDesktop).

Models: SessionSandboxStatus.canDesktop, SandboxDesktopLink (web URLs only,
description redacted so it cannot leak through a log line), and SandboxMove
with the web's eligibility rule, the ready-provider list and an attempt
classifier that surfaces the 428 exactly once. OS1API: sandboxAttach,
sandboxDesktop, and a confirmRequired error so a 428 keeps its meaning
instead of collapsing into a server message.

SessionView: a Move to Sandbox submenu with the ready providers, disabled
while the agent runs; a confirm, then the server's own sentence as a
destructive confirm on 428, then a notice and an optimistic sandbox record
on the row. WorktreeInfoView: Open desktop when an awake Sandbox reports
canDesktop, minted on the tap and shown in SFSafariViewController; the URL
lives only in the sheet's state. Two DEBUG capture hooks
(OS1_MOVE_TO_SANDBOX, OS1_SCROLL_TO) let the simulator reach both.

Tests cover status and link decoding, eligibility, provider resolution,
the 428 mapping and the ask-once confirm flow.

Co-authored-by: Kent de Bruin <[email protected]>
@open-session-os-tella-dev

open-session-os-tella-dev Bot commented Sep 10, 2026

Copy link
Copy Markdown
Contributor

🤖 OS review · approve · quality 5/5 · risk high

Safe to merge.

🔴 Risk high · recovery in days
Moving persists a one-way sandbox attachment; reverting cannot reconcile host-only and sandbox work created before detection. Require server rollback tooling and workspace reconciliation sign-off before release.

Reviewed cca0757 · GPT-5.6 Sol · open session · labels: os-auto-fix fix and push · os-adversarial deeper pass · os-simplify cleanup

@vercel

vercel Bot commented Sep 10, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
opensession Ready Ready Preview Sep 10, 2026 8:06am UTC

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant