Released 0.3.0 with visible, cancellable and single-flight sandbox operations

[dzykovic]

Risk & Size

Risk: Low
Size: Small

Version bump, changelog, and one user-facing message reworded. No behaviour beyond that
string changed since #23, which is what this release ships.

What & Why

Cuts 0.3.0, releasing the work merged in #23: long operations (image builds, sandbox
creation) are now visible while they run, cancellable where that is safe, and cannot be
started twice against the same sandbox.

Released on its own rather than bundled with the next iteration: #23 fixes a pain that
users of 0.2.0 have today, while the follow-up work (docs/specs/014, not in this PR)
changes a default — how new sandbox keys are derived, and therefore whether two sandboxes
share one Dockerfile by default. Those deserve separate release notes and separate
acceptance.

One wording fix travels with the bump. The stuck-sandbox-name error introduced by #23
advised "change this sandbox's key", which frees that key — and the New Sandbox form
then hands it to the next sandbox, walking straight back onto the unusable name. This was
hit for real during #23's acceptance. The message now asks for a distinctive key and
says why a bare agent name is the wrong choice. The systematic fix is spec 014.

Changes

• package.json / package-lock.json: 0.2.0 → 0.3.0 (minor — new command and new
  behaviour, no breaking change to the recipe format).
• CHANGELOG.md: [0.3.0] section in user language (operation log, live progress,
  cancel, one operation per sandbox, busy Explorer items, form feedback, clearer stuck-name
  error; fixes for the doubled Rebuild and silently failing background checks) plus its
  release-tag link definition.
• src/sbx.ts: the stuck-name message now asks for a distinctive key instead of just "a
  different key".

How to Verify

Release gates, all run on this branch before the Marketplace upload (versions are
write-once there):

1. npm ci — lockfile in sync, 0 vulnerabilities.
2. npm run verify — green, reports sandbox-console@0.3.0.
3. npm audit — 0 across info/low/moderate/high/critical.
4. npx vsce ls — exactly THIRD_PARTY_NOTICES.txt, README.md, package.json,
   LICENSE, CHANGELOG.md, media/icon.png, dist/extension.js; nothing extra.
5. Listing sanity — README images resolve in-repo (docs/media/explorer.png,
   docs/media/create.png), CI badge absolute, no "not yet published"-class text.
6. npx vsce package — sandbox-console-0.3.0.vsix (95.26 KB), only the known
   bundle-size warning.
7. Gallery query — live version is 0.2.0, so 0.3.0 is a fresh number.

Behaviour acceptance was done on #23's code against sbx v0.31.3 / Docker 29.6.2 on
Windows 11 and is recorded there: quiet startup, the declined second operation, a full
rebuild, Explorer busy state, and cancellation on both the killed-docker and the
wait-then-undo sbx paths. The only user-visible delta since is the reworded message
above.

[Copilot]

Pull request overview

Cuts the 0.3.0 release of the VS Code extension by updating published metadata (version + changelog) and refining one user-facing error message in sbx error handling; no behavioral changes beyond messaging.

Changes:

• Bumped extension version 0.2.0 → 0.3.0 in package.json and package-lock.json.
• Added 0.3.0 release notes + tag link to CHANGELOG.md.
• Reworded the “stuck sandbox name” guidance in src/sbx.ts to recommend a distinctive key and explain why.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated no comments.

File	Description
src/sbx.ts	Updates the stuck-name remediation message to reduce users re-selecting keys that collide again.
package.json	Version bump to 0.3.0 for the Marketplace/published extension metadata.
package-lock.json	Lockfile version fields updated to stay consistent with the package version.
CHANGELOG.md	Adds the 0.3.0 release notes and release-tag link definition.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.