Workspaces

A workspace groups boxes that belong together. Each workspace has its own shared /wrk drive, its own persistent box homes, and (with secrets) its own credentials — so different projects stay isolated instead of sharing one flat pool.

You always have a default workspace: with no workspace named, everything works exactly as before. Naming one is purely additive.

Using a workspace

The workspace is a prefix on the box name — <workspace>/<box>:

ssh cli@box.hopbox.dev ws create acme      # create a workspace
ssh acme/web:python@box.hopbox.dev         # box "web" (python) in workspace "acme"
ssh acme/db@box.hopbox.dev                 # box "db" in the same workspace
ssh web@box.hopbox.dev                     # no prefix → your default workspace

Names are per workspace: acme/web and your default web are two different boxes with two different drives and homes.

Managing them

ssh cli@box.hopbox.dev ws ls          # your workspaces + box counts
ssh cli@box.hopbox.dev ls             # all your boxes, grouped by WORKSPACE
ssh cli@box.hopbox.dev ws rm acme     # remove a workspace (refused if it has boxes)
ssh cli@box.hopbox.dev ws rm acme --force   # …or take its boxes with it

Every box command takes a <workspace>/<box> reference (or an id):

ssh cli@box.hopbox.dev suspend acme/web
ssh cli@box.hopbox.dev rm acme/web
ssh cli@box.hopbox.dev clone acme/web acme/web-copy   # dst inherits the src workspace

What a workspace isolates

Per workspace	Notes
Boxes	names are scoped — acme/web ≠ default/web.
/wrk drive	each workspace has its own shared drive; boxes in it share it, boxes elsewhere never see it.
Persistent homes	a box's home is scoped to its workspace.
Secrets	set a secret on a workspace and it reaches that workspace's boxes only.

Nothing changes if you don't use them

The default workspace is the flat model you already have — same boxes, same /wrk, same secrets, same commands. A named workspace is an opt-in grouping on top; there's no migration and nothing to relearn.