feat(workspaces): define project runtime source authority

Route probe and user materialization through one projectRuntimeSource seam, where persisted Git source overrides the host-only convenience root and must belong to Git project data.

Lock default revision, explicit revision, and subdirectory semantics with real Docker acceptance. Enforce provider-probe internals structurally and document that the current Docker POC needs a locally built image because its default reference is unpublished.
This commit is contained in:
Mohamed Boudra
2026-08-12 20:53:05 +02:00
parent 527b252497
commit 33afa7283b
24 changed files with 750 additions and 74 deletions
+23
View File
@@ -22,6 +22,29 @@ the web UI. The served app receives a same-origin connection hint and connects
back to that daemon. Static UI files load without daemon auth; API and
WebSocket requests still require `PASEO_PASSWORD` when one is configured.
## Docker workspace runtime
The Desktop New Workspace screen includes a built-in **Docker** runtime. It is separate from running the Paseo daemon image described on this page: the daemon stays on the host and materializes each selected project's committed Git content into a runtime-owned Docker volume. Files, watching, terminals, Git, scripts, provider discovery, and agents then use the same workspace-runtime boundary.
The current POC requires a locally built workspace-runtime image. The configured default, `ghcr.io/getpaseo/workspace-runtime:latest`, is not published, so it does not currently work. Build the image from the repository root and override `workspaceRuntimes.docker.image` in daemon configuration:
```bash
docker build -f packages/docker-workspace-runtime/Dockerfile -t paseo-workspace-runtime:local .
```
```json
{
"workspaceRuntimes": {
"docker": {
"type": "docker",
"image": "paseo-workspace-runtime:local"
}
}
}
```
Optional bind mounts require absolute host and container paths, must target outside `/workspace`, and declare `readOnly` explicitly. They are available during Git materialization and in the running workspace. They cannot replace the runtime-owned project volume. Set `enabled: false` to remove Docker from the runtime catalog.
## Quick Start
```bash