Previews & the workbench

Ask a session to start a dev server and publish it — you get a real URL like https://<label>.preview.… that tunnels straight into the VM: full pages, APIs, websockets and hot reload, on one origin. Previews belong to the thread and are revoked when it closes.

Workbench links are bearer capabilities

Anyone holding an /sparkyard ide or shell URL has that access. The workbench is off until a workspace admin turns it on with /sparkyard settings workbench on.