Bump lefos13/workspace-snippets to 0.2.6

[github-actions]

lefos13/workspace-snippets: {"kind":"npm","package":"paseo-workspace-snippets","version":"0.2.4","resolved":"https://registry.npmjs.org/paseo-workspace-snippets/-/paseo-workspace-snippets-0.2.4.tgz","integrity":"sha512-VnPmS8NmXVJjcvbOz7MuMAfFo6bf2L6SDjfaadLUOuFbjd+COIa47QtczT9CMmB7+Kmc0FlhMc4u+fb5ou2n/g=="} -> {"kind":"npm","package":"paseo-workspace-snippets","version":"0.2.6","resolved":"https://registry.npmjs.org/paseo-workspace-snippets/-/paseo-workspace-snippets-0.2.6.tgz","integrity":"sha512-qGGF62XM1DuXloF9fbKDJyg9S0KvYSXgiIJINawScpVXDWX/pLDefy5EjbqXsakxrc2nFcVpZfwxuj/nTh/I9g=="}
No npm provenance for this version. Review the tarball diff below, not the repository.
Submitted by @lefos13.

Merging approves this version. The published index keeps pointing at the previous one until then.

Artifact diff

diff -ruN a/package/OVERVIEW.md b/package/OVERVIEW.md
--- a/package/OVERVIEW.md	1970-01-01 00:00:00.000000000 +0000
+++ b/package/OVERVIEW.md	1985-10-26 08:15:00.000000000 +0000
@@ -0,0 +1,16 @@
+Workspace Snippets runs commands in terminal tabs of your workspace: the scripts from a project's `package.json`, plus shell commands you save yourself. You can open it from a Snippets screen in the sidebar, a Snippets button in each workspace header, the Command Center ("Open snippets"), or the `/snippet <name>` slash command.
+
+Each entry gets its own terminal tab (`script:<name>` or `snippet:<name>`) with Run, Restart, Stop and Close, plus a peek at its last lines of output. The sidebar screen works before any workspace is open: Run reuses the most recent workspace at the project's root directory, opens one if there is none, and switches to it.
+
+## Setup
+
+Requires Paseo 0.10.2 or newer. Nothing to configure.
+
+## Things to know
+
+- Each snippet is scoped either to a project, where it is shared by every worktree of that project, or to a single workspace directory.
+- Scripts are detected from the root `package.json` only, so scripts in monorepo subpackages are not listed. They run with the package manager the project declares or its lockfile indicates (npm, pnpm, yarn or bun).
+- Commands are typed into an interactive shell in the workspace terminal, so they run with the same shell authority as a terminal you open yourself on that host.
+- Snippets are stored as unencrypted JSON in plugin settings shared across the whole host, so do not put secrets in them.
+- The plugin reads the root `package.json` and makes no network requests.
+- The status shown for an entry only reflects whether its terminal tab is open. It does not show whether the command finished or what its exit status was.
diff -ruN a/package/package.json b/package/package.json
--- a/package/package.json	1985-10-26 08:15:00.000000000 +0000
+++ b/package/package.json	1985-10-26 08:15:00.000000000 +0000
@@ -1,6 +1,6 @@
 {
   "name": "paseo-workspace-snippets",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "files": [
     "paseo-plugin.json",
     "index.client.tsx",
@@ -9,6 +9,7 @@
     "server/",
     "shared/",
     "README.md",
+    "OVERVIEW.md",
     "LICENSE",
     "images/"
   ],
diff -ruN a/package/server/projects.ts b/package/server/projects.ts
--- a/package/server/projects.ts	1985-10-26 08:15:00.000000000 +0000
+++ b/package/server/projects.ts	1985-10-26 08:15:00.000000000 +0000
@@ -24,32 +24,46 @@
   };
 }
 
+function timestamp(value: string | null | undefined): number {
+  const parsed = value ? Date.parse(value) : NaN;
+  return Number.isNaN(parsed) ? -Infinity : parsed;
+}
+
 export async function findLocalWorkspace(
   paseo: Paseo,
   projectRootPath: string,
 ): Promise<string | null> {
-  const { entries } = await paseo.workspaces.list();
   const normalizedRoot = projectRootPath.replace(/[/\\]+$/, "");
-  // Several workspaces can share a directory; prefer the most recently active.
-  // Workspaces without activity rank lowest, and ties go to the later entry
-  // because the daemon lists older workspaces first.
-  let best: { id: string; activityAt: number } | null = null;
-  for (const ws of entries) {
-    if (ws.archivingAt) continue;
-    // Older daemons may omit workspaceDirectory; only a local checkout or plain
-    // directory workspace can then be assumed to sit at the project root.
-    const rawDir =
-      ws.workspaceDirectory ??
-      (ws.workspaceKind === "local_checkout" || ws.workspaceKind === "directory"
-        ? ws.projectRootPath
-        : undefined);
-    const normalizedDir = rawDir ? rawDir.replace(/[/\\]+$/, "") : "";
-    if (normalizedDir !== normalizedRoot) continue;
-    const parsed = ws.activityAt ? Date.parse(ws.activityAt) : NaN;
-    const activityAt = Number.isNaN(parsed) ? -Infinity : parsed;
-    if (!best || activityAt >= best.activityAt) {
-      best = { id: ws.id, activityAt };
+  // Several workspaces can share a directory; prefer the most recent one.
+  // activityAt is often null, so statusEnteredAt (last agent status change,
+  // which drives the sidebar order) also counts.
+  let best: { id: string; recency: number } | null = null;
+  let cursor: string | undefined;
+  do {
+    // The daemon pages workspace lists, so walk every page.
+    const { entries, pageInfo } = await paseo.workspaces.list({
+      page: { limit: 200, ...(cursor ? { cursor } : {}) },
+    });
+    for (const ws of entries) {
+      if (ws.archivingAt) continue;
+      // Older daemons may omit workspaceDirectory; only a local checkout or plain
+      // directory workspace can then be assumed to sit at the project root.
+      const rawDir =
+        ws.workspaceDirectory ??
+        (ws.workspaceKind === "local_checkout" || ws.workspaceKind === "directory"
+          ? ws.projectRootPath
+          : undefined);
+      const normalizedDir = rawDir ? rawDir.replace(/[/\\]+$/, "") : "";
+      if (normalizedDir !== normalizedRoot) continue;
+      const recency = Math.max(
+        timestamp(ws.activityAt),
+        timestamp(ws.statusEnteredAt),
+      );
+      if (!best || recency > best.recency) {
+        best = { id: ws.id, recency };
+      }
     }
-  }
+    cursor = pageInfo?.hasMore ? (pageInfo.nextCursor ?? undefined) : undefined;
+  } while (cursor);
   return best?.id ?? null;
 }

This version has no OVERVIEW.md. The registry requires one to update a listing; the bump cannot merge until the repository adds it.

Inline validation failed. See the Bump workflow log.

[paseo-bot]

Needs from you: nothing, merged

paseo-workspace-snippets 0.2.6 is approved. It now ships its own OVERVIEW.md, so I removed the registry copy plugins/lefos13/workspace-snippets.md in this pull request and the listing page shows the author's overview from now on.

Review data

• Artifact: npm paseo-workspace-snippets 0.2.6 (from 0.2.4), https://registry.npmjs.org/paseo-workspace-snippets/-/paseo-workspace-snippets-0.2.6.tgz
• Integrity: SHA-512 of both tarballs matches the record (old and new pin). npm reports the same version, tarball, and integrity for 0.2.6. No npm provenance; npm gitHead is 20642968bb997c14222a890a3e786f355011817c.
• Validation: npm test passes (140/140). node scripts/validate.ts --online --changed with the validator from main passes (the branch predates #155, whose validator reads OVERVIEW.md from the artifact), before and after removing the registry copy.
• Extracted and inspected: both tarballs, extracted and diffed locally. The diff adds OVERVIEW.md, adds it to files and bumps the version in package.json, and changes findLocalWorkspace in server/projects.ts:53-79: it reads every page of paseo.workspaces.list (200 per page) and ranks workspaces by the newer of activityAt and statusEnteredAt (server/projects.ts:27-30). No capability change.
• Install-time commands: none. paseo-plugin.json has no install or build. package.json has no preinstall, install, postinstall, or prepare; its only script is typecheck (tsc --noEmit).
• Dependencies: no runtime dependencies or peerDependencies; dev dependencies unchanged from 0.2.4. The package-lock.json at the source commit has 317 entries, each resolved on registry.npmjs.org with an integrity, and npm ci --ignore-scripts installs it. The only entry with an install script is the optional macOS dev dependency fsevents.
• Hosts: none. No fetch, WebSocket, HTTP client, or URL literal in the code.
• Credentials and environment: none. No process.env, credential files, keychain, or token reads. Snippets live in the plugin's host-scoped settings (shared/settings.ts:12-24).
• Filesystem: reads the workspace's root package.json, kept inside the directory and capped at 1 MiB (server/package-json.ts:66-100), and checks for lockfiles to pick the package manager (server/package-json.ts:149-160). No writes.
• Execution: no child_process, eval, new Function, or dynamic import(). When the user runs a script or snippet, the command is typed into a Paseo workspace terminal (server/terminals.ts:61-102), which is the plugin's stated purpose. Script names are shell-quoted (shared/entries.ts:28-40).
• Runtime installs: none.
• Source match: all 31 tarball files are byte-identical to the declared repository at 2064296. Between 671ae0b (0.2.5) and 2064296 only OVERVIEW.md and package.json change.
• Listing media: four PNG screenshots of the sidebar screen, header button, panel, and Command Center, each HTTP 200 image/png.
• Overview: OVERVIEW.md follows the shape in REVIEW.md (what it is, how it works, setup, things to know) with no install steps, badges, or marketing, and each claim matches the code, including that it makes no network requests.
• Decision: merge.
• Reviewed commit: db60f602efd436e7c3218ca429577782b4ad518a