diff --git a/packages/docs/src/content/docs/operate/dashboard.md b/packages/docs/src/content/docs/operate/dashboard.md
index 5be5987846..6b5b000be8 100644
--- a/packages/docs/src/content/docs/operate/dashboard.md
+++ b/packages/docs/src/content/docs/operate/dashboard.md
@@ -87,6 +87,7 @@ The dashboard package owns these routes:
 | `/system/people/:email`         | Actor activity profile.                     |
 | `/system/locations`             | Public location activity directory.         |
 | `/system/locations/:location`   | Public location activity detail.            |
+| `/system/workspaces`            | Install-wide repository Workspace recipes.  |
 | `/system/plugins`               | Loaded plugin and skill inventory.          |
 | `/system/plugins/:plugin`       | Plugin details and operational reports.     |
 | `/_junior/dashboard/client.js`  | Authenticated dashboard browser bundle.     |
diff --git a/packages/docs/src/content/docs/operate/sandbox-snapshots.md b/packages/docs/src/content/docs/operate/sandbox-snapshots.md
index d65870c8a2..63e138f062 100644
--- a/packages/docs/src/content/docs/operate/sandbox-snapshots.md
+++ b/packages/docs/src/content/docs/operate/sandbox-snapshots.md
@@ -46,6 +46,8 @@ Any change to those inputs produces a new profile hash and a new snapshot.
 
 Junior stores install-wide Workspace recipes and their repositories in SQL. The agent reads this configuration when it lists a Workspace, resumes an active Workspace, or starts a switch.
 
+Manage recipes from the authenticated dashboard at `/system/workspaces`, or through the `/api/workspaces` REST routes. Each recipe has a stable name, optional setup script, and one or more repositories. Mark exactly one repository as primary when the recipe includes repositories so Junior can select `AGENTS.md`.
+
 Junior builds one complete snapshot for each selected Workspace. The build installs runtime dependencies, prepares repositories, runs the setup script, and then captures the snapshot. The first switch builds the snapshot on demand. Later switches reuse it until its floating profile becomes stale.
 
 Provider plugins prepare repositories through Junior's host egress proxy. Junior removes the credential route before it runs the setup script and captures the snapshot. Real provider credentials do not enter the Sandbox or the captured snapshot.
diff --git a/packages/junior-dashboard/e2e/harness.ts b/packages/junior-dashboard/e2e/harness.ts
index 89accf13e1..9b7fbbed7d 100644
--- a/packages/junior-dashboard/e2e/harness.ts
+++ b/packages/junior-dashboard/e2e/harness.ts
@@ -540,6 +540,9 @@ export async function mockDashboardApis(page: Page) {
       },
     });
   });
+  await page.route("**/api/workspaces", async (route) => {
+    await route.fulfill({ json: { workspaces: [] } });
+  });
   await page.route("**/api/plugins", async (route) => {
     await route.fulfill({
       json: [
diff --git a/packages/junior-dashboard/e2e/system.spec.ts b/packages/junior-dashboard/e2e/system.spec.ts
index 0df3df0d5c..7e908334a1 100644
--- a/packages/junior-dashboard/e2e/system.spec.ts
+++ b/packages/junior-dashboard/e2e/system.spec.ts
@@ -37,6 +37,7 @@ test("shows system usage and plugin details", async ({ page }) => {
     "Overview",
     "People",
     "Locations",
+    "Workspaces",
     "Plugins",
   ]);
   const pluginsLink = systemNavigation.getByRole("link", {
@@ -66,6 +67,55 @@ test("shows system usage and plugin details", async ({ page }) => {
   await expect(page.getByText("github.organization")).toBeVisible();
 });
 
+test("creates a Workspace recipe", async ({ page }) => {
+  let createdBody: unknown;
+  await page.route("**/api/workspaces", async (route) => {
+    if (route.request().method() === "POST") {
+      createdBody = route.request().postDataJSON();
+      await route.fulfill({
+        json: {
+          id: "11111111-1111-4111-8111-111111111111",
+          name: "sentry",
+          setupScript: "pnpm install",
+          repos: [
+            {
+              checkoutPath: "repos/sentry",
+              isPrimary: true,
+              provider: "github",
+              repo: "getsentry/sentry",
+            },
+          ],
+        },
+        status: 201,
+      });
+      return;
+    }
+    await route.fulfill({ json: { workspaces: [] } });
+  });
+
+  await page.goto(`${server.baseURL}/system/workspaces`);
+  await page.getByRole("button", { name: "New Workspace" }).click();
+  await page.getByLabel("Name").fill("sentry");
+  await page
+    .getByLabel("Repository 1", { exact: true })
+    .fill("getsentry/sentry");
+  await page.getByLabel("Setup script").fill("pnpm install");
+  await page.getByRole("button", { name: "Create Workspace" }).click();
+
+  await expect(page.getByText("github:getsentry/sentry")).toBeVisible();
+  expect(createdBody).toEqual({
+    name: "sentry",
+    repos: [
+      {
+        isPrimary: true,
+        provider: "github",
+        repo: "getsentry/sentry",
+      },
+    ],
+    setupScript: "pnpm install",
+  });
+});
+
 test("keeps System navigation usable on mobile", async ({ page }) => {
   await page.setViewportSize({ height: 844, width: 390 });
   await page.goto(`${server.baseURL}/system`);
@@ -79,6 +129,7 @@ test("keeps System navigation usable on mobile", async ({ page }) => {
     "Overview",
     "People",
     "Locations",
+    "Workspaces",
     "Plugins",
   ]);
   await systemNavigation.getByRole("link", { name: "Plugins" }).click();
diff --git a/packages/junior-dashboard/src/client/App.tsx b/packages/junior-dashboard/src/client/App.tsx
index 16acdf4597..ccb3053b36 100644
--- a/packages/junior-dashboard/src/client/App.tsx
+++ b/packages/junior-dashboard/src/client/App.tsx
@@ -27,6 +27,7 @@ import { PersonProfilePage } from "./pages/people/PersonProfilePage";
 import { SettingsPage } from "./pages/SettingsPage";
 import { SystemPage } from "./pages/system/SystemPage";
 import { SystemPageLayout } from "./pages/system/SystemPageLayout";
+import { WorkspacesPage } from "./pages/system/WorkspacesPage";
 import { TaskExecutionsPage } from "./pages/tasks/TaskExecutionsPage";
 import { TaskRunsPage } from "./pages/tasks/TaskRunsPage";
 import { TasksPage } from "./pages/tasks/TasksPage";
@@ -313,6 +314,18 @@ export function DashboardShell() {
           }
           path="/system/people"
         />
+        <Route
+          element={
+            loading ? (
+              <SystemPageLayout>
+                <LoadingView label="Loading Workspaces" />
+              </SystemPageLayout>
+            ) : (
+              <WorkspacesPage />
+            )
+          }
+          path="/system/workspaces"
+        />
         <Route
           element={
             loading ? (
diff --git a/packages/junior-dashboard/src/client/http.ts b/packages/junior-dashboard/src/client/http.ts
index 9eb2a8b43e..a5aa29a7a7 100644
--- a/packages/junior-dashboard/src/client/http.ts
+++ b/packages/junior-dashboard/src/client/http.ts
@@ -3,13 +3,29 @@ import type { ZodType } from "zod";
 /** An authenticated dashboard request rejected by the product API. */
 export class DashboardApiError extends Error {
   readonly status: number;
+  readonly apiError?: string;
 
-  constructor(path: string, status: number) {
+  constructor(path: string, status: number, apiError?: string) {
     super(`${path} returned ${status}`);
     this.status = status;
+    if (apiError?.trim()) this.apiError = apiError.trim();
   }
 }
 
+async function throwDashboardApiError(
+  path: string,
+  response: Response,
+): Promise<never> {
+  let apiError: string | undefined;
+  try {
+    const body = (await response.json()) as { error?: unknown };
+    if (typeof body.error === "string") apiError = body.error;
+  } catch {
+    // Keep the status-only fallback when the body is not JSON.
+  }
+  throw new DashboardApiError(path, response.status, apiError);
+}
+
 function restartDashboardSignIn(): void {
   if (typeof window === "undefined") {
     return;
@@ -45,7 +61,7 @@ export async function patch<T>(
     method: "PATCH",
   });
   if (response.status === 401) restartDashboardSignIn();
-  if (!response.ok) throw new DashboardApiError(path, response.status);
+  if (!response.ok) await throwDashboardApiError(path, response);
   return schema.parse(await response.json());
 }
 
@@ -62,7 +78,24 @@ export async function post<T>(
     method: "POST",
   });
   if (response.status === 401) restartDashboardSignIn();
-  if (!response.ok) throw new DashboardApiError(path, response.status);
+  if (!response.ok) await throwDashboardApiError(path, response);
+  return schema.parse(await response.json());
+}
+
+/** Send one authenticated PUT request and validate its response. */
+export async function put<T>(
+  schema: ZodType<T>,
+  path: string,
+  body: unknown,
+): Promise<T> {
+  const response = await fetch(path, {
+    body: JSON.stringify(body),
+    credentials: "same-origin",
+    headers: { "content-type": "application/json" },
+    method: "PUT",
+  });
+  if (response.status === 401) restartDashboardSignIn();
+  if (!response.ok) await throwDashboardApiError(path, response);
   return schema.parse(await response.json());
 }
 
@@ -73,7 +106,7 @@ export async function deleteDashboardResource(path: string): Promise<void> {
     method: "DELETE",
   });
   if (response.status === 401) restartDashboardSignIn();
-  if (!response.ok) throw new DashboardApiError(path, response.status);
+  if (!response.ok) await throwDashboardApiError(path, response);
 }
 
 /** Send one authenticated DELETE request with JSON body and validate its response. */
@@ -89,7 +122,7 @@ export async function del<T>(
     method: "DELETE",
   });
   if (response.status === 401) restartDashboardSignIn();
-  if (!response.ok) throw new DashboardApiError(path, response.status);
+  if (!response.ok) await throwDashboardApiError(path, response);
   return schema.parse(await response.json());
 }
 
@@ -105,8 +138,8 @@ export async function fetchDashboardJson<T>(
   });
   if (response.status === 401) {
     restartDashboardSignIn();
-    throw new DashboardApiError(path, response.status);
+    await throwDashboardApiError(path, response);
   }
-  if (!response.ok) throw new DashboardApiError(path, response.status);
+  if (!response.ok) await throwDashboardApiError(path, response);
   return schema.parse(await response.json());
 }
diff --git a/packages/junior-dashboard/src/client/pages/system/SystemNavigation.tsx b/packages/junior-dashboard/src/client/pages/system/SystemNavigation.tsx
index 9aa2f775e0..dd8c16d2d8 100644
--- a/packages/junior-dashboard/src/client/pages/system/SystemNavigation.tsx
+++ b/packages/junior-dashboard/src/client/pages/system/SystemNavigation.tsx
@@ -5,6 +5,7 @@ const systemNavigationItems = [
   { end: true, label: "Overview", to: "/system" },
   { label: "People", to: "/system/people" },
   { label: "Locations", to: "/system/locations" },
+  { label: "Workspaces", to: "/system/workspaces" },
   { label: "Plugins", to: systemPluginsPath },
 ];
 
diff --git a/packages/junior-dashboard/src/client/pages/system/WorkspaceEditor.tsx b/packages/junior-dashboard/src/client/pages/system/WorkspaceEditor.tsx
new file mode 100644
index 0000000000..f8ffd5d7fc
--- /dev/null
+++ b/packages/junior-dashboard/src/client/pages/system/WorkspaceEditor.tsx
@@ -0,0 +1,201 @@
+import { Plus, Star, Trash2 } from "lucide-react";
+import type { FormEvent } from "react";
+
+import { Button } from "../../components/Button";
+import { Card } from "../../components/layout/Card";
+import {
+  createRepoDraft,
+  type RepoDraft,
+  type WorkspaceDraft,
+} from "./workspaceDraft";
+
+type WorkspaceEditorProps = {
+  busy: boolean;
+  canSave: boolean;
+  draft: WorkspaceDraft;
+  error?: string;
+  editing: boolean;
+  onCancel(): void;
+  onChange(draft: WorkspaceDraft): void;
+  onSubmit(): void;
+};
+
+/** Edit one Workspace recipe without owning persistence. */
+export function WorkspaceEditor(props: WorkspaceEditorProps) {
+  function updateRepo(key: string, patch: Partial<RepoDraft>) {
+    props.onChange({
+      ...props.draft,
+      repos: props.draft.repos.map((repo) =>
+        repo.key === key ? { ...repo, ...patch } : repo,
+      ),
+    });
+  }
+
+  function setPrimary(key: string) {
+    props.onChange({
+      ...props.draft,
+      repos: props.draft.repos.map((repo) => ({
+        ...repo,
+        isPrimary: repo.key === key,
+      })),
+    });
+  }
+
+  function removeRepo(key: string) {
+    const repos = props.draft.repos.filter((repo) => repo.key !== key);
+    if (repos.length === 0) {
+      props.onChange({ ...props.draft, repos: [createRepoDraft(true)] });
+      return;
+    }
+    if (!repos.some((repo) => repo.isPrimary)) {
+      repos[0] = { ...repos[0]!, isPrimary: true };
+    }
+    props.onChange({ ...props.draft, repos });
+  }
+
+  function submit(event: FormEvent<HTMLFormElement>) {
+    event.preventDefault();
+    if (props.canSave) props.onSubmit();
+  }
+
+  return (
+    <Card className="p-5" padding="none">
+      <form className="space-y-5" onSubmit={submit}>
+        <div className="flex items-start justify-between gap-4">
+          <div>
+            <h3 className="m-0 text-lg font-semibold">
+              {props.editing ? "Edit Workspace" : "New Workspace"}
+            </h3>
+            <p className="mt-1 mb-0 text-sm text-dashboard-text-muted">
+              Repositories use fixed <code>repos/{"{name}"}</code> paths. Mark
+              one primary repository for AGENTS.md.
+            </p>
+          </div>
+          <Button disabled={props.busy} onClick={props.onCancel} type="button">
+            Cancel
+          </Button>
+        </div>
+
+        <label className="block text-sm font-semibold" htmlFor="workspace-name">
+          Name
+        </label>
+        <input
+          autoComplete="off"
+          className="mt-2 block w-full rounded border border-white/15 bg-black px-3 py-2 text-sm text-dashboard-text focus:border-[#beaaff] focus:outline-none"
+          id="workspace-name"
+          maxLength={64}
+          onChange={(event) =>
+            props.onChange({ ...props.draft, name: event.target.value })
+          }
+          placeholder="sentry"
+          value={props.draft.name}
+        />
+
+        <div className="space-y-3">
+          <div className="flex items-center justify-between gap-3">
+            <h4 className="m-0 text-sm font-semibold">Repositories</h4>
+            <Button
+              disabled={props.busy}
+              onClick={() =>
+                props.onChange({
+                  ...props.draft,
+                  repos: [
+                    ...props.draft.repos,
+                    createRepoDraft(props.draft.repos.length === 0),
+                  ],
+                })
+              }
+              type="button"
+            >
+              <Plus aria-hidden="true" size={14} />
+              Add repository
+            </Button>
+          </div>
+          {props.draft.repos.map((repo, index) => (
+            <div
+              className="grid gap-2 rounded border border-white/10 p-3 md:grid-cols-[7rem_minmax(0,1fr)_auto]"
+              key={repo.key}
+            >
+              <input
+                aria-label={`Provider ${index + 1}`}
+                className="rounded border border-white/15 bg-black px-3 py-2 text-sm text-dashboard-text focus:border-[#beaaff] focus:outline-none"
+                onChange={(event) =>
+                  updateRepo(repo.key, { provider: event.target.value })
+                }
+                placeholder="github"
+                value={repo.provider}
+              />
+              <input
+                aria-label={`Repository ${index + 1}`}
+                className="min-w-0 rounded border border-white/15 bg-black px-3 py-2 text-sm text-dashboard-text focus:border-[#beaaff] focus:outline-none"
+                onChange={(event) =>
+                  updateRepo(repo.key, { repo: event.target.value })
+                }
+                placeholder="getsentry/sentry"
+                value={repo.repo}
+              />
+              <div className="flex items-center justify-end gap-2">
+                <button
+                  aria-label={`Mark repository ${index + 1} primary`}
+                  aria-pressed={repo.isPrimary}
+                  className={`inline-flex h-9 items-center justify-center gap-1 rounded border px-3 text-xs font-semibold uppercase ${
+                    repo.isPrimary
+                      ? "border-[#beaaff]/50 bg-[#beaaff]/15 text-[#beaaff]"
+                      : "border-white/10 bg-transparent text-dashboard-text-muted hover:border-white/25 hover:text-dashboard-text"
+                  }`}
+                  onClick={() => setPrimary(repo.key)}
+                  type="button"
+                >
+                  <Star aria-hidden="true" size={14} />
+                  Primary
+                </button>
+                <button
+                  aria-label={`Remove repository ${index + 1}`}
+                  className="inline-flex size-9 shrink-0 items-center justify-center rounded border border-white/10 bg-transparent text-dashboard-text-muted hover:border-rose-300/40 hover:text-rose-300"
+                  onClick={() => removeRepo(repo.key)}
+                  type="button"
+                >
+                  <Trash2 aria-hidden="true" size={14} />
+                </button>
+              </div>
+            </div>
+          ))}
+        </div>
+
+        <label
+          className="block text-sm font-semibold"
+          htmlFor="workspace-setup"
+        >
+          Setup script
+        </label>
+        <textarea
+          className="mt-2 block min-h-32 w-full rounded border border-white/15 bg-black px-3 py-2 font-mono text-sm text-dashboard-text focus:border-[#beaaff] focus:outline-none"
+          id="workspace-setup"
+          onChange={(event) =>
+            props.onChange({ ...props.draft, setupScript: event.target.value })
+          }
+          placeholder={"pnpm install\n# repos live under $JUNIOR_REPOS_ROOT"}
+          value={props.draft.setupScript}
+        />
+        <p className="mt-2 mb-0 text-xs text-dashboard-text-muted">
+          Runs once during snapshot build with{" "}
+          <code>JUNIOR_WORKSPACE_ROOT</code> and <code>JUNIOR_REPOS_ROOT</code>.
+        </p>
+
+        {props.error ? (
+          <p className="m-0 text-sm text-rose-300" role="alert">
+            {props.error}
+          </p>
+        ) : null}
+
+        <Button disabled={!props.canSave} type="submit">
+          {props.busy
+            ? "Saving…"
+            : props.editing
+              ? "Save changes"
+              : "Create Workspace"}
+        </Button>
+      </form>
+    </Card>
+  );
+}
diff --git a/packages/junior-dashboard/src/client/pages/system/WorkspaceList.tsx b/packages/junior-dashboard/src/client/pages/system/WorkspaceList.tsx
new file mode 100644
index 0000000000..7cf8a95d9e
--- /dev/null
+++ b/packages/junior-dashboard/src/client/pages/system/WorkspaceList.tsx
@@ -0,0 +1,117 @@
+import { FolderGit2, Star, Trash2 } from "lucide-react";
+import type { WorkspaceReport } from "@sentry/junior/api/schema";
+
+import { Button } from "../../components/Button";
+import { EmptyTelemetry } from "../../components/EmptyTelemetry";
+import { Card } from "../../components/layout/Card";
+
+type WorkspaceListProps = {
+  busy: boolean;
+  onDelete(workspace: WorkspaceReport): void;
+  onEdit(workspace: WorkspaceReport): void;
+  workspaces: WorkspaceReport[];
+};
+
+/** List Workspace recipes and expose their edit and delete actions. */
+export function WorkspaceList(props: WorkspaceListProps) {
+  return (
+    <Card padding="none">
+      {props.workspaces.length === 0 ? (
+        <div className="p-5">
+          <EmptyTelemetry>
+            No Workspaces yet. Create one so agents can switch into a prepared
+            multi-repo Sandbox.
+          </EmptyTelemetry>
+        </div>
+      ) : (
+        <ul className="m-0 list-none divide-y divide-white/10 p-0">
+          {props.workspaces.map((workspace) => (
+            <WorkspaceListItem
+              busy={props.busy}
+              key={workspace.id}
+              onDelete={props.onDelete}
+              onEdit={props.onEdit}
+              workspace={workspace}
+            />
+          ))}
+        </ul>
+      )}
+    </Card>
+  );
+}
+
+function WorkspaceListItem(props: {
+  busy: boolean;
+  onDelete(workspace: WorkspaceReport): void;
+  onEdit(workspace: WorkspaceReport): void;
+  workspace: WorkspaceReport;
+}) {
+  const { workspace } = props;
+  return (
+    <li className="flex items-start gap-3 p-4">
+      <div className="grid size-9 shrink-0 place-items-center rounded border border-white/10 bg-white/[0.03] text-[#beaaff]">
+        <FolderGit2 aria-hidden="true" size={16} />
+      </div>
+      <div className="min-w-0 flex-1">
+        <div className="flex flex-wrap items-center gap-2">
+          <p className="m-0 text-sm font-semibold text-dashboard-text">
+            {workspace.name}
+          </p>
+          <span className="font-mono text-xs text-dashboard-text-muted">
+            {workspace.repos.length} repo
+            {workspace.repos.length === 1 ? "" : "s"}
+          </span>
+        </div>
+        <div className="mt-2 flex flex-wrap gap-2">
+          {workspace.repos.length === 0 ? (
+            <span className="text-xs text-dashboard-text-muted">
+              No repositories
+            </span>
+          ) : (
+            workspace.repos.map((repo) => (
+              <span
+                className="inline-flex items-center gap-1 rounded border border-white/10 px-2 py-1 font-mono text-xs text-dashboard-text-muted"
+                key={`${repo.provider}:${repo.repo}`}
+              >
+                {repo.isPrimary ? (
+                  <Star
+                    aria-label="Primary"
+                    className="text-[#beaaff]"
+                    size={12}
+                  />
+                ) : null}
+                {repo.provider}:{repo.repo}
+                <span className="text-dashboard-text-muted/70">
+                  → {repo.checkoutPath}
+                </span>
+              </span>
+            ))
+          )}
+        </div>
+        {workspace.setupScript.trim() ? (
+          <p className="mt-2 mb-0 line-clamp-2 font-mono text-xs text-dashboard-text-muted">
+            {workspace.setupScript.trim()}
+          </p>
+        ) : null}
+      </div>
+      <div className="flex shrink-0 items-center gap-2">
+        <Button
+          disabled={props.busy}
+          onClick={() => props.onEdit(workspace)}
+          type="button"
+        >
+          Edit
+        </Button>
+        <button
+          aria-label={`Delete ${workspace.name}`}
+          className="inline-flex size-9 items-center justify-center rounded border border-white/10 bg-transparent text-dashboard-text-muted hover:border-rose-300/40 hover:text-rose-300 disabled:cursor-not-allowed disabled:opacity-50"
+          disabled={props.busy}
+          onClick={() => props.onDelete(workspace)}
+          type="button"
+        >
+          <Trash2 aria-hidden="true" size={14} />
+        </button>
+      </div>
+    </li>
+  );
+}
diff --git a/packages/junior-dashboard/src/client/pages/system/WorkspacesPage.tsx b/packages/junior-dashboard/src/client/pages/system/WorkspacesPage.tsx
new file mode 100644
index 0000000000..96f1fcd014
--- /dev/null
+++ b/packages/junior-dashboard/src/client/pages/system/WorkspacesPage.tsx
@@ -0,0 +1,226 @@
+import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
+import { Plus } from "lucide-react";
+import { useRef, useState } from "react";
+import {
+  workspaceListSchema,
+  workspaceSchema,
+  type WorkspaceReport,
+} from "@sentry/junior/api/schema";
+
+import { getDashboardAgentName } from "../../agentName";
+import { Button } from "../../components/Button";
+import { EmptyTelemetry } from "../../components/EmptyTelemetry";
+import { LoadingView } from "../../components/LoadingView";
+import { Card } from "../../components/layout/Card";
+import { PageHeader } from "../../components/layout/PageHeader";
+import {
+  DashboardApiError,
+  deleteDashboardResource,
+  fetchDashboardJson,
+  post,
+  put,
+} from "../../http";
+import { SystemPageLayout } from "./SystemPageLayout";
+import { WorkspaceEditor } from "./WorkspaceEditor";
+import { WorkspaceList } from "./WorkspaceList";
+import {
+  canSaveWorkspaceDraft,
+  createWorkspaceDraft,
+  editWorkspaceDraft,
+  type WorkspaceDraft,
+  workspaceDraftBody,
+} from "./workspaceDraft";
+
+const workspacesQueryKey = ["dashboard", "workspaces"] as const;
+
+function readApiError(error: unknown, fallback: string): string {
+  if (error instanceof DashboardApiError) {
+    return error.apiError ?? fallback;
+  }
+  if (error instanceof Error && error.message.trim()) {
+    return error.message;
+  }
+  return fallback;
+}
+
+/** Manage install-wide repository Workspace recipes. */
+export function WorkspacesPage() {
+  const queryClient = useQueryClient();
+  const editorSessionRef = useRef(0);
+  const [editingId, setEditingId] = useState<string | undefined>();
+  const [draft, setDraft] = useState<WorkspaceDraft>();
+  const [formError, setFormError] = useState<string>();
+  const [actionError, setActionError] = useState<string>();
+
+  const workspacesQuery = useQuery({
+    queryKey: workspacesQueryKey,
+    queryFn: ({ signal }) =>
+      fetchDashboardJson(workspaceListSchema, "/api/workspaces", signal),
+    retry: false,
+  });
+
+  const saveMutation = useMutation({
+    mutationFn: async (input: {
+      draft: WorkspaceDraft;
+      editingId?: string;
+      session: number;
+    }) => {
+      const body = workspaceDraftBody(input.draft);
+      return input.editingId
+        ? put(
+            workspaceSchema,
+            `/api/workspaces/${encodeURIComponent(input.editingId)}`,
+            body,
+          )
+        : post(workspaceSchema, "/api/workspaces", body);
+    },
+    onSuccess: async (workspace, input) => {
+      // Only dismiss the editor that started this save.
+      if (editorSessionRef.current === input.session) closeEditor();
+      setActionError(undefined);
+      await queryClient.cancelQueries({ queryKey: workspacesQueryKey });
+      queryClient.setQueryData<{ workspaces: WorkspaceReport[] }>(
+        workspacesQueryKey,
+        (current) => ({
+          workspaces: [
+            workspace,
+            ...(current?.workspaces ?? []).filter(
+              (item) => item.id !== workspace.id,
+            ),
+          ].sort((left, right) => left.name.localeCompare(right.name)),
+        }),
+      );
+    },
+    onError: (error, input) => {
+      if (editorSessionRef.current !== input.session) return;
+      setFormError(
+        readApiError(error, "Could not save the Workspace. Try again."),
+      );
+    },
+  });
+
+  const deleteMutation = useMutation({
+    mutationFn: async (workspace: WorkspaceReport) => {
+      await deleteDashboardResource(
+        `/api/workspaces/${encodeURIComponent(workspace.id)}`,
+      );
+      return workspace;
+    },
+    onSuccess: async (workspace) => {
+      setActionError(undefined);
+      if (editingId === workspace.id) closeEditor();
+      await queryClient.cancelQueries({ queryKey: workspacesQueryKey });
+      queryClient.setQueryData<{ workspaces: WorkspaceReport[] }>(
+        workspacesQueryKey,
+        (current) => ({
+          workspaces: (current?.workspaces ?? []).filter(
+            (item) => item.id !== workspace.id,
+          ),
+        }),
+      );
+    },
+    onError: (error) => {
+      setActionError(
+        readApiError(error, "Could not delete the Workspace. Try again."),
+      );
+    },
+  });
+
+  const workspaces = workspacesQuery.data?.workspaces ?? [];
+  const busy = saveMutation.isPending || deleteMutation.isPending;
+
+  function closeEditor() {
+    editorSessionRef.current += 1;
+    setDraft(undefined);
+    setEditingId(undefined);
+    setFormError(undefined);
+  }
+
+  function openCreate() {
+    editorSessionRef.current += 1;
+    setEditingId(undefined);
+    setDraft(createWorkspaceDraft());
+    setFormError(undefined);
+  }
+
+  function openEdit(workspace: WorkspaceReport) {
+    editorSessionRef.current += 1;
+    setEditingId(workspace.id);
+    setDraft(editWorkspaceDraft(workspace));
+    setFormError(undefined);
+  }
+
+  function confirmDelete(workspace: WorkspaceReport) {
+    if (
+      window.confirm(
+        `Delete Workspace “${workspace.name}”? Active conversations keep their current Sandbox until the next switch.`,
+      )
+    ) {
+      deleteMutation.mutate(workspace);
+    }
+  }
+
+  if (!workspacesQuery.data && !workspacesQuery.error) {
+    return (
+      <SystemPageLayout>
+        <LoadingView label="Loading Workspaces" />
+      </SystemPageLayout>
+    );
+  }
+
+  return (
+    <SystemPageLayout>
+      <PageHeader
+        actions={
+          <Button disabled={busy} onClick={openCreate}>
+            <Plus aria-hidden="true" size={14} />
+            New Workspace
+          </Button>
+        }
+        description={`Named repository recipes ${getDashboardAgentName()} can switch into without cloning each turn.`}
+        title="Workspaces"
+      />
+
+      {workspacesQuery.error ? (
+        <Card padding="sm">
+          <EmptyTelemetry>
+            Workspaces failed to load. Try refreshing the dashboard.
+          </EmptyTelemetry>
+        </Card>
+      ) : null}
+
+      {actionError ? (
+        <p className="m-0 text-sm text-rose-300" role="alert">
+          {actionError}
+        </p>
+      ) : null}
+
+      {draft ? (
+        <WorkspaceEditor
+          busy={busy}
+          canSave={canSaveWorkspaceDraft(draft, busy)}
+          draft={draft}
+          editing={editingId !== undefined}
+          error={formError}
+          onCancel={closeEditor}
+          onChange={setDraft}
+          onSubmit={() => {
+            if (!draft) return;
+            saveMutation.mutate({
+              draft,
+              editingId,
+              session: editorSessionRef.current,
+            });
+          }}
+        />
+      ) : null}
+
+      <WorkspaceList
+        busy={busy}
+        onDelete={confirmDelete}
+        onEdit={openEdit}
+        workspaces={workspaces}
+      />
+    </SystemPageLayout>
+  );
+}
diff --git a/packages/junior-dashboard/src/client/pages/system/workspaceDraft.ts b/packages/junior-dashboard/src/client/pages/system/workspaceDraft.ts
new file mode 100644
index 0000000000..77e223b2da
--- /dev/null
+++ b/packages/junior-dashboard/src/client/pages/system/workspaceDraft.ts
@@ -0,0 +1,70 @@
+import type { WorkspaceReport } from "@sentry/junior/api/schema";
+
+export type RepoDraft = {
+  key: string;
+  provider: string;
+  repo: string;
+  isPrimary: boolean;
+};
+
+export type WorkspaceDraft = {
+  name: string;
+  setupScript: string;
+  repos: RepoDraft[];
+};
+
+export function createRepoDraft(isPrimary = false): RepoDraft {
+  return {
+    key: crypto.randomUUID(),
+    provider: "github",
+    repo: "",
+    isPrimary,
+  };
+}
+
+export function createWorkspaceDraft(): WorkspaceDraft {
+  return {
+    name: "",
+    setupScript: "",
+    repos: [createRepoDraft(true)],
+  };
+}
+
+export function editWorkspaceDraft(workspace: WorkspaceReport): WorkspaceDraft {
+  return {
+    name: workspace.name,
+    setupScript: workspace.setupScript,
+    repos:
+      workspace.repos.length > 0
+        ? workspace.repos.map((repo) => ({
+            key: crypto.randomUUID(),
+            provider: repo.provider,
+            repo: repo.repo,
+            isPrimary: repo.isPrimary,
+          }))
+        : [createRepoDraft(true)],
+  };
+}
+
+export function workspaceDraftBody(draft: WorkspaceDraft) {
+  return {
+    name: draft.name.trim(),
+    setupScript: draft.setupScript,
+    repos: draft.repos.map((repo) => ({
+      provider: repo.provider.trim(),
+      repo: repo.repo.trim(),
+      isPrimary: repo.isPrimary,
+    })),
+  };
+}
+
+export function canSaveWorkspaceDraft(
+  draft: WorkspaceDraft,
+  busy: boolean,
+): boolean {
+  if (busy || !draft.name.trim()) return false;
+  if (draft.repos.some((repo) => !repo.provider.trim() || !repo.repo.trim())) {
+    return false;
+  }
+  return draft.repos.length === 0 || draft.repos.some((repo) => repo.isPrimary);
+}
diff --git a/packages/junior-dashboard/tests/dashboard-routes.test.ts b/packages/junior-dashboard/tests/dashboard-routes.test.ts
index 65051a421e..ef7bcbb9b4 100644
--- a/packages/junior-dashboard/tests/dashboard-routes.test.ts
+++ b/packages/junior-dashboard/tests/dashboard-routes.test.ts
@@ -72,6 +72,7 @@ describe("dashboard routes", () => {
       "/memories/memory-1",
       "/settings",
       "/settings/api-tokens",
+      "/system/workspaces",
     ]) {
       const response = await app.fetch(new Request(`http://localhost${path}`));
       expect(response.status).toBe(302);
@@ -436,6 +437,7 @@ describe("dashboard routes", () => {
       "/memories/memory-1",
       "/settings",
       "/settings/api-tokens",
+      "/system/workspaces",
       "/plugins/memory/memories",
       "/plugins/memory/memories/library",
     ]) {
diff --git a/packages/junior-dashboard/tests/telemetry-components.test.tsx b/packages/junior-dashboard/tests/telemetry-components.test.tsx
index 9cc0790c82..235a8c69a7 100644
--- a/packages/junior-dashboard/tests/telemetry-components.test.tsx
+++ b/packages/junior-dashboard/tests/telemetry-components.test.tsx
@@ -1608,6 +1608,7 @@ describe("dashboard canonical-event components", () => {
     expect(systemHtml).toContain('aria-label="System navigation"');
     expect(systemHtml).toContain('href="/system/people"');
     expect(systemHtml).toContain('href="/system/locations"');
+    expect(systemHtml).toContain('href="/system/workspaces"');
     expect(systemHtml).toContain('href="/system/plugins"');
     expect(systemHtml).toContain(">Plugins</a>");
     expect(systemHtml).not.toContain(">Capabilities<");
diff --git a/packages/junior/src/api.ts b/packages/junior/src/api.ts
index 3e66ef69a5..b36138cb84 100644
--- a/packages/junior/src/api.ts
+++ b/packages/junior/src/api.ts
@@ -8,6 +8,7 @@ import { createPeopleRoutes } from "./api/people/routes";
 import { createPersonalTokenRoutes } from "./api/personal-tokens/routes";
 import { createUserPageRoutes } from "./api/user-pages/routes";
 import { createTaskRoutes } from "./api/tasks/routes";
+import { createWorkspaceRoutes } from "./api/workspaces/routes";
 import type { JuniorApiEnv, JuniorApiVariables } from "./api/route";
 import { apiErrorSchema } from "./api/schema/common";
 import {
@@ -73,6 +74,7 @@ export function createJuniorApi(): Hono<JuniorApiEnv> {
   app.route("/api/locations", createLocationRoutes());
   app.route("/api/user-pages", createUserPageRoutes());
   app.route("/api/tasks", createTaskRoutes());
+  app.route("/api/workspaces", createWorkspaceRoutes());
   app.notFound(() =>
     jsonResponse(
       apiErrorSchema,
diff --git a/packages/junior/src/api/schema.ts b/packages/junior/src/api/schema.ts
index 02326405ca..2bcfb5de49 100644
--- a/packages/junior/src/api/schema.ts
+++ b/packages/junior/src/api/schema.ts
@@ -100,6 +100,15 @@ export {
   revokePersonalTokenResponseSchema,
 } from "./schema/personal-token";
 export type { PersonalTokenMetadata } from "./schema/personal-token";
+export {
+  deleteWorkspaceResponseSchema,
+  workspaceBodySchema,
+  workspaceListSchema,
+  workspaceParamsSchema,
+  workspaceRepoSchema,
+  workspaceSchema,
+} from "./schema/workspace";
+export type { WorkspaceReport } from "./schema/workspace";
 export {
   eventTaskSummarySchema,
   scheduledTaskSummarySchema,
diff --git a/packages/junior/src/api/schema/workspace.ts b/packages/junior/src/api/schema/workspace.ts
new file mode 100644
index 0000000000..2c8a5ecaa3
--- /dev/null
+++ b/packages/junior/src/api/schema/workspace.ts
@@ -0,0 +1,49 @@
+import { z } from "zod";
+
+const workspaceRepoInputSchema = z
+  .object({
+    provider: z.string(),
+    repo: z.string(),
+    isPrimary: z.boolean().optional(),
+  })
+  .strict();
+
+export const workspaceRepoSchema = z
+  .object({
+    provider: z.string(),
+    repo: z.string(),
+    checkoutPath: z.string(),
+    isPrimary: z.boolean(),
+  })
+  .strict();
+
+export const workspaceSchema = z
+  .object({
+    id: z.string().uuid(),
+    name: z.string(),
+    setupScript: z.string(),
+    repos: z.array(workspaceRepoSchema),
+  })
+  .strict();
+
+export const workspaceListSchema = z
+  .object({ workspaces: z.array(workspaceSchema) })
+  .strict();
+
+export const workspaceBodySchema = z
+  .object({
+    name: z.string(),
+    setupScript: z.string().optional(),
+    repos: z.array(workspaceRepoInputSchema),
+  })
+  .strict();
+
+export const workspaceParamsSchema = z
+  .object({ id: z.string().uuid() })
+  .strict();
+
+export const deleteWorkspaceResponseSchema = z
+  .object({ deleted: z.literal(true) })
+  .strict();
+
+export type WorkspaceReport = z.infer<typeof workspaceSchema>;
diff --git a/packages/junior/src/api/workspaces/routes.ts b/packages/junior/src/api/workspaces/routes.ts
new file mode 100644
index 0000000000..ece253c933
--- /dev/null
+++ b/packages/junior/src/api/workspaces/routes.ts
@@ -0,0 +1,129 @@
+import { Hono } from "hono";
+import { getDb } from "@/chat/db";
+import { workspaceRepoCheckoutPath } from "@/chat/workspaces/checkout-path";
+import {
+  createWorkspace,
+  deleteWorkspace,
+  getWorkspace,
+  listWorkspaces,
+  updateWorkspace,
+  WorkspaceValidationError,
+} from "@/chat/workspaces/store";
+import type { Workspace } from "@/chat/workspaces/types";
+import { jsonResponse, throwApiError } from "../http";
+import type { JuniorApiEnv } from "../route";
+import {
+  deleteWorkspaceResponseSchema,
+  workspaceBodySchema,
+  workspaceListSchema,
+  workspaceParamsSchema,
+  workspaceSchema,
+} from "../schema/workspace";
+import { validateRequest } from "../validation";
+import { requireViewer } from "../viewer";
+
+function view(workspace: Workspace) {
+  return {
+    id: workspace.id,
+    name: workspace.name,
+    setupScript: workspace.setupScript,
+    repos: workspace.repos.map((repo) => ({
+      provider: repo.provider,
+      repo: repo.repo,
+      checkoutPath: workspaceRepoCheckoutPath(repo.repo),
+      isPrimary: repo.isPrimary,
+    })),
+  };
+}
+
+function handleValidationError(error: unknown): never {
+  if (error instanceof WorkspaceValidationError) {
+    throwApiError(400, error.message);
+  }
+  throw error;
+}
+
+/** Create authenticated native Workspace list and admin routes. */
+export function createWorkspaceRoutes(): Hono<JuniorApiEnv> {
+  const app = new Hono<JuniorApiEnv>();
+
+  app.get("/", requireViewer, async () => {
+    return jsonResponse(workspaceListSchema, {
+      workspaces: (await listWorkspaces(getDb())).map(view),
+    });
+  });
+
+  app.post(
+    "/",
+    requireViewer,
+    validateRequest("json", workspaceBodySchema, "Invalid request body."),
+    async (context) => {
+      const body = context.req.valid("json");
+      try {
+        const workspace = await createWorkspace(body);
+        return jsonResponse(workspaceSchema, view(workspace), { status: 201 });
+      } catch (error) {
+        handleValidationError(error);
+      }
+    },
+  );
+
+  app.get(
+    "/:id",
+    requireViewer,
+    validateRequest(
+      "param",
+      workspaceParamsSchema,
+      "Invalid route parameters.",
+    ),
+    async (context) => {
+      const { id } = context.req.valid("param");
+      const workspace = await getWorkspace(getDb(), id);
+      if (!workspace) throwApiError(404, "Workspace not found.");
+      return jsonResponse(workspaceSchema, view(workspace));
+    },
+  );
+
+  app.put(
+    "/:id",
+    requireViewer,
+    validateRequest(
+      "param",
+      workspaceParamsSchema,
+      "Invalid route parameters.",
+    ),
+    validateRequest("json", workspaceBodySchema, "Invalid request body."),
+    async (context) => {
+      const { id } = context.req.valid("param");
+      const body = context.req.valid("json");
+      try {
+        const workspace = await updateWorkspace(id, body);
+        if (!workspace) throwApiError(404, "Workspace not found.");
+        return jsonResponse(workspaceSchema, view(workspace));
+      } catch (error) {
+        handleValidationError(error);
+      }
+    },
+  );
+
+  app.delete(
+    "/:id",
+    requireViewer,
+    validateRequest(
+      "param",
+      workspaceParamsSchema,
+      "Invalid route parameters.",
+    ),
+    async (context) => {
+      const { id } = context.req.valid("param");
+      if (!(await deleteWorkspace(id))) {
+        throwApiError(404, "Workspace not found.");
+      }
+      return jsonResponse(deleteWorkspaceResponseSchema, {
+        deleted: true as const,
+      });
+    },
+  );
+
+  return app;
+}
diff --git a/packages/junior/src/app.ts b/packages/junior/src/app.ts
index e8bd583cbe..85365b5995 100644
--- a/packages/junior/src/app.ts
+++ b/packages/junior/src/app.ts
@@ -458,6 +458,8 @@ function dashboardHostRoutePaths(dashboard: JuniorDashboardOptions): string[] {
     "/api/people/*",
     "/api/personal-tokens",
     "/api/personal-tokens/*",
+    "/api/workspaces",
+    "/api/workspaces/*",
     "/api/config",
     "/api/me",
     authPath,
diff --git a/packages/junior/src/chat/sandbox/README.md b/packages/junior/src/chat/sandbox/README.md
index 935ce84abf..010b2b14fa 100644
--- a/packages/junior/src/chat/sandbox/README.md
+++ b/packages/junior/src/chat/sandbox/README.md
@@ -50,7 +50,8 @@ traffic through verified host egress.
   steps for that profile.
 - A Workspace recipe is part of the profile hash. One build installs runtime
   dependencies, prepares repositories, runs setup, and captures the complete
-  snapshot.
+  snapshot. Operators manage recipes from `/system/workspaces` or
+  `/api/workspaces`.
 - Workspace repositories clone to fixed `repos/{name}` paths. Setup scripts
   receive `JUNIOR_WORKSPACE_ROOT` and `JUNIOR_REPOS_ROOT` so they do not depend
   on the provider's absolute Sandbox path.
diff --git a/packages/junior/src/chat/workspaces/store.ts b/packages/junior/src/chat/workspaces/store.ts
index 53b81156d0..5d6f6f09b5 100644
--- a/packages/junior/src/chat/workspaces/store.ts
+++ b/packages/junior/src/chat/workspaces/store.ts
@@ -1,7 +1,14 @@
+import { randomUUID } from "node:crypto";
 import { asc, eq } from "drizzle-orm";
+import { getSqlExecutor } from "@/chat/db";
 import type { JuniorDatabase } from "@/db/db";
 import { juniorWorkspaceRepos, juniorWorkspaces } from "@/db/schema";
 import type { Workspace } from "./types";
+import {
+  normalizeWorkspaceRecipe,
+  WorkspaceValidationError,
+  type WorkspaceRecipeInput,
+} from "./validation";
 
 function workspaceFromRows(
   row: typeof juniorWorkspaces.$inferSelect,
@@ -19,6 +26,58 @@ function workspaceFromRows(
   };
 }
 
+async function loadWorkspaceRepos(
+  db: JuniorDatabase,
+  workspaceId: string,
+): Promise<Array<typeof juniorWorkspaceRepos.$inferSelect>> {
+  return await db
+    .select()
+    .from(juniorWorkspaceRepos)
+    .where(eq(juniorWorkspaceRepos.workspaceId, workspaceId))
+    .orderBy(
+      asc(juniorWorkspaceRepos.provider),
+      asc(juniorWorkspaceRepos.repo),
+    );
+}
+
+async function replaceWorkspaceRepos(
+  db: JuniorDatabase,
+  workspaceId: string,
+  repos: WorkspaceRecipeInput["repos"],
+): Promise<void> {
+  await db
+    .delete(juniorWorkspaceRepos)
+    .where(eq(juniorWorkspaceRepos.workspaceId, workspaceId));
+  if (repos.length === 0) return;
+  await db.insert(juniorWorkspaceRepos).values(
+    repos.map((repo) => ({
+      workspaceId,
+      provider: repo.provider,
+      repo: repo.repo,
+      isPrimary: repo.isPrimary,
+    })),
+  );
+}
+
+function isUniqueViolation(error: unknown): boolean {
+  let current: unknown = error;
+  for (let depth = 0; current && depth < 6; depth += 1) {
+    if (
+      typeof current === "object" &&
+      current !== null &&
+      "code" in current &&
+      (current as { code?: unknown }).code === "23505"
+    ) {
+      return true;
+    }
+    current =
+      typeof current === "object" && current !== null && "cause" in current
+        ? (current as { cause?: unknown }).cause
+        : undefined;
+  }
+  return false;
+}
+
 /** List Workspace recipes by stable name. */
 export async function listWorkspaces(db: JuniorDatabase): Promise<Workspace[]> {
   const [workspaces, repos] = await Promise.all([
@@ -52,15 +111,10 @@ export async function getWorkspaceByName(
     .limit(1);
   const workspace = rows[0];
   if (!workspace) return undefined;
-  const repos = await db
-    .select()
-    .from(juniorWorkspaceRepos)
-    .where(eq(juniorWorkspaceRepos.workspaceId, workspace.id))
-    .orderBy(
-      asc(juniorWorkspaceRepos.provider),
-      asc(juniorWorkspaceRepos.repo),
-    );
-  return workspaceFromRows(workspace, repos);
+  return workspaceFromRows(
+    workspace,
+    await loadWorkspaceRepos(db, workspace.id),
+  );
 }
 
 /** Resolve one Workspace recipe by id. */
@@ -75,13 +129,108 @@ export async function getWorkspace(
     .limit(1);
   const workspace = rows[0];
   if (!workspace) return undefined;
-  const repos = await db
-    .select()
-    .from(juniorWorkspaceRepos)
-    .where(eq(juniorWorkspaceRepos.workspaceId, workspace.id))
-    .orderBy(
-      asc(juniorWorkspaceRepos.provider),
-      asc(juniorWorkspaceRepos.repo),
-    );
-  return workspaceFromRows(workspace, repos);
+  return workspaceFromRows(
+    workspace,
+    await loadWorkspaceRepos(db, workspace.id),
+  );
 }
+
+/** Create one install-wide Workspace recipe. */
+export async function createWorkspace(input: {
+  name: string;
+  setupScript?: string;
+  repos: Array<{
+    provider: string;
+    repo: string;
+    isPrimary?: boolean;
+  }>;
+}): Promise<Workspace> {
+  const recipe = normalizeWorkspaceRecipe(input);
+  const executor = getSqlExecutor();
+  const now = new Date();
+  const id = randomUUID();
+
+  try {
+    await executor.transaction(async () => {
+      const db = executor.db();
+      await db.insert(juniorWorkspaces).values({
+        id,
+        name: recipe.name,
+        setupScript: recipe.setupScript,
+        createdAt: now,
+        updatedAt: now,
+      });
+      await replaceWorkspaceRepos(db, id, recipe.repos);
+    });
+  } catch (error) {
+    if (isUniqueViolation(error)) {
+      throw new WorkspaceValidationError(
+        `Workspace name already exists: ${recipe.name}`,
+      );
+    }
+    throw error;
+  }
+
+  return (await getWorkspace(executor.db(), id))!;
+}
+
+/** Replace one install-wide Workspace recipe. */
+export async function updateWorkspace(
+  id: string,
+  input: {
+    name: string;
+    setupScript?: string;
+    repos: Array<{
+      provider: string;
+      repo: string;
+      isPrimary?: boolean;
+    }>;
+  },
+): Promise<Workspace | undefined> {
+  const recipe = normalizeWorkspaceRecipe(input);
+  const executor = getSqlExecutor();
+  const now = new Date();
+
+  try {
+    const updated = await executor.transaction(async () => {
+      const db = executor.db();
+      const rows = await db
+        .update(juniorWorkspaces)
+        .set({
+          name: recipe.name,
+          setupScript: recipe.setupScript,
+          updatedAt: now,
+        })
+        .where(eq(juniorWorkspaces.id, id))
+        .returning();
+      if (!rows[0]) return undefined;
+      await replaceWorkspaceRepos(db, id, recipe.repos);
+      return rows[0];
+    });
+    if (!updated) return undefined;
+  } catch (error) {
+    if (isUniqueViolation(error)) {
+      throw new WorkspaceValidationError(
+        `Workspace name already exists: ${recipe.name}`,
+      );
+    }
+    throw error;
+  }
+
+  return await getWorkspace(executor.db(), id);
+}
+
+/** Delete one install-wide Workspace recipe. */
+export async function deleteWorkspace(id: string): Promise<boolean> {
+  const executor = getSqlExecutor();
+  return await executor.transaction(async () => {
+    const rows = await executor
+      .db()
+      .delete(juniorWorkspaces)
+      .where(eq(juniorWorkspaces.id, id))
+      .returning({ id: juniorWorkspaces.id });
+    return rows.length > 0;
+  });
+}
+
+export { WorkspaceValidationError };
diff --git a/packages/junior/src/chat/workspaces/validation.ts b/packages/junior/src/chat/workspaces/validation.ts
new file mode 100644
index 0000000000..2a12d4b20a
--- /dev/null
+++ b/packages/junior/src/chat/workspaces/validation.ts
@@ -0,0 +1,122 @@
+import { tryWorkspaceRepoCheckoutPath } from "./checkout-path";
+import type { WorkspaceRepo } from "./types";
+
+const WORKSPACE_NAME_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/;
+const PROVIDER_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/;
+const REPO_PATTERN = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
+const MAX_SETUP_SCRIPT_BYTES = 64 * 1024;
+const MAX_REPOS = 32;
+
+/** Normalized recipe fields accepted by Workspace write paths. */
+export interface WorkspaceRecipeInput {
+  name: string;
+  setupScript: string;
+  repos: WorkspaceRepo[];
+}
+
+/** Validation failure for one Workspace recipe write. */
+export class WorkspaceValidationError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "WorkspaceValidationError";
+  }
+}
+
+/** Normalize and validate one Workspace recipe write payload. */
+export function normalizeWorkspaceRecipe(input: {
+  name: string;
+  setupScript?: string;
+  repos: Array<{
+    provider: string;
+    repo: string;
+    isPrimary?: boolean;
+  }>;
+}): WorkspaceRecipeInput {
+  const name = input.name.trim().toLowerCase();
+  if (!WORKSPACE_NAME_PATTERN.test(name)) {
+    throw new WorkspaceValidationError(
+      "Workspace name must start with a letter and use only lowercase letters, digits, underscores, or hyphens.",
+    );
+  }
+
+  const setupScript = input.setupScript ?? "";
+  if (typeof setupScript !== "string") {
+    throw new WorkspaceValidationError("Setup script must be a string.");
+  }
+  if (Buffer.byteLength(setupScript, "utf8") > MAX_SETUP_SCRIPT_BYTES) {
+    throw new WorkspaceValidationError(
+      `Setup script must be at most ${MAX_SETUP_SCRIPT_BYTES} bytes.`,
+    );
+  }
+
+  if (!Array.isArray(input.repos)) {
+    throw new WorkspaceValidationError("Repositories must be an array.");
+  }
+  if (input.repos.length > MAX_REPOS) {
+    throw new WorkspaceValidationError(
+      `A Workspace can include at most ${MAX_REPOS} repositories.`,
+    );
+  }
+
+  const repos: WorkspaceRepo[] = input.repos.map((entry, index) => {
+    const provider = entry.provider.trim().toLowerCase();
+    if (!PROVIDER_PATTERN.test(provider)) {
+      throw new WorkspaceValidationError(
+        `Repository ${index + 1} provider is invalid.`,
+      );
+    }
+    const repo = entry.repo.trim();
+    if (!REPO_PATTERN.test(repo)) {
+      throw new WorkspaceValidationError(
+        `Repository ${index + 1} must use owner/name format.`,
+      );
+    }
+    if (!tryWorkspaceRepoCheckoutPath(repo)) {
+      throw new WorkspaceValidationError(
+        `Repository ${index + 1} name cannot be used as a checkout path.`,
+      );
+    }
+    return {
+      provider,
+      repo,
+      isPrimary: entry.isPrimary === true,
+    };
+  });
+
+  const identities = new Set<string>();
+  for (const repo of repos) {
+    const identity = `${repo.provider}:${repo.repo.toLowerCase()}`;
+    if (identities.has(identity)) {
+      throw new WorkspaceValidationError(
+        `Duplicate repository in Workspace: ${repo.provider}:${repo.repo}`,
+      );
+    }
+    identities.add(identity);
+  }
+
+  const checkoutPaths = new Set<string>();
+  for (const repo of repos) {
+    const path = tryWorkspaceRepoCheckoutPath(repo.repo)!;
+    const key = path.toLowerCase();
+    if (checkoutPaths.has(key)) {
+      throw new WorkspaceValidationError(
+        `Workspace checkout path collision: ${path}`,
+      );
+    }
+    checkoutPaths.add(key);
+  }
+
+  const primaryCount = repos.filter((repo) => repo.isPrimary).length;
+  if (repos.length > 0 && primaryCount === 0) {
+    throw new WorkspaceValidationError(
+      "Select one primary repository for AGENTS.md instructions.",
+    );
+  }
+  if (primaryCount > 1) {
+    throw new WorkspaceValidationError(
+      "A Workspace can have only one primary repository.",
+    );
+  }
+
+  return { name, setupScript, repos };
+}
diff --git a/packages/junior/tests/integration/api/workspaces/routes.test.ts b/packages/junior/tests/integration/api/workspaces/routes.test.ts
new file mode 100644
index 0000000000..dae12f28c7
--- /dev/null
+++ b/packages/junior/tests/integration/api/workspaces/routes.test.ts
@@ -0,0 +1,257 @@
+import { Hono } from "hono";
+import { afterEach, describe, expect, it } from "vitest";
+import { createJuniorApi, type JuniorApiVariables } from "@/api";
+import {
+  apiErrorSchema,
+  deleteWorkspaceResponseSchema,
+  workspaceListSchema,
+  workspaceSchema,
+} from "@/api/schema";
+import { closeDb, getDb, getSqlExecutor } from "@/chat/db";
+import { resolveViewerUser } from "@/chat/plugins/viewer";
+import {
+  createWorkspace,
+  getWorkspace,
+  getWorkspaceByName,
+  updateWorkspace,
+} from "@/chat/workspaces/store";
+
+function authenticatedApi(email = "person@example.com") {
+  const app = new Hono<{ Variables: JuniorApiVariables }>();
+  app.use("*", async (c, next) => {
+    const viewer = await resolveViewerUser(email);
+    if (!viewer) {
+      throw new Error(`missing viewer for ${email}`);
+    }
+    c.set("viewer", viewer);
+    await next();
+  });
+  app.route("/", createJuniorApi());
+  return app;
+}
+
+describe("workspace admin API", () => {
+  afterEach(async () => {
+    await closeDb();
+  });
+
+  it("creates, lists, updates, and deletes Workspace recipes", async () => {
+    const app = authenticatedApi();
+
+    const createResponse = await app.request("http://localhost/api/workspaces", {
+      body: JSON.stringify({
+        name: "Sentry",
+        setupScript: "pnpm install",
+        repos: [
+          {
+            provider: "github",
+            repo: "getsentry/sentry",
+            isPrimary: true,
+          },
+          {
+            provider: "github",
+            repo: "getsentry/getsentry",
+          },
+        ],
+      }),
+      headers: { "content-type": "application/json" },
+      method: "POST",
+    });
+    expect(createResponse.status).toBe(201);
+    const created = workspaceSchema.parse(await createResponse.json());
+    expect(created).toMatchObject({
+      name: "sentry",
+      setupScript: "pnpm install",
+      repos: [
+        {
+          provider: "github",
+          repo: "getsentry/getsentry",
+          checkoutPath: "repos/getsentry",
+          isPrimary: false,
+        },
+        {
+          provider: "github",
+          repo: "getsentry/sentry",
+          checkoutPath: "repos/sentry",
+          isPrimary: true,
+        },
+      ],
+    });
+
+    const listResponse = await app.request("http://localhost/api/workspaces");
+    expect(listResponse.status).toBe(200);
+    const listed = workspaceListSchema.parse(await listResponse.json());
+    expect(listed.workspaces.map((workspace) => workspace.id)).toContain(
+      created.id,
+    );
+
+    const updateResponse = await app.request(
+      `http://localhost/api/workspaces/${created.id}`,
+      {
+        body: JSON.stringify({
+          name: "sentry-core",
+          setupScript: "pnpm install --frozen-lockfile",
+          repos: [
+            {
+              provider: "github",
+              repo: "getsentry/sentry",
+              isPrimary: true,
+            },
+          ],
+        }),
+        headers: { "content-type": "application/json" },
+        method: "PUT",
+      },
+    );
+    expect(updateResponse.status).toBe(200);
+    const updated = workspaceSchema.parse(await updateResponse.json());
+    expect(updated).toMatchObject({
+      id: created.id,
+      name: "sentry-core",
+      setupScript: "pnpm install --frozen-lockfile",
+      repos: [
+        {
+          provider: "github",
+          repo: "getsentry/sentry",
+          checkoutPath: "repos/sentry",
+          isPrimary: true,
+        },
+      ],
+    });
+
+    const deleteResponse = await app.request(
+      `http://localhost/api/workspaces/${created.id}`,
+      { method: "DELETE" },
+    );
+    expect(deleteResponse.status).toBe(200);
+    expect(
+      deleteWorkspaceResponseSchema.parse(await deleteResponse.json()),
+    ).toEqual({ deleted: true });
+
+    const missing = await app.request(
+      `http://localhost/api/workspaces/${created.id}`,
+    );
+    expect(missing.status).toBe(404);
+    expect(apiErrorSchema.parse(await missing.json())).toEqual({
+      error: "Workspace not found.",
+    });
+  });
+
+  it("rejects invalid recipes with the stable error contract", async () => {
+    const response = await authenticatedApi().request(
+      "http://localhost/api/workspaces",
+      {
+        body: JSON.stringify({
+          name: "bad name",
+          repos: [{ provider: "github", repo: "getsentry/sentry" }],
+        }),
+        headers: { "content-type": "application/json" },
+        method: "POST",
+      },
+    );
+
+    expect(response.status).toBe(400);
+    expect(apiErrorSchema.parse(await response.json()).error).toMatch(
+      /name must start with a letter/i,
+    );
+  });
+
+  it("rolls back recipe writes when repository replacement fails", async () => {
+    const executor = getSqlExecutor();
+    const original = await createWorkspace({
+      name: "original",
+      setupScript: "pnpm install",
+      repos: [
+        {
+          provider: "github",
+          repo: "getsentry/junior",
+          isPrimary: true,
+        },
+      ],
+    });
+
+    await executor.execute(`
+CREATE OR REPLACE FUNCTION junior_test_reject_workspace_repo()
+RETURNS trigger AS $$
+BEGIN
+  RAISE EXCEPTION 'reject workspace repo for rollback test';
+END;
+$$ LANGUAGE plpgsql
+`);
+    await executor.execute(`
+CREATE TRIGGER junior_test_reject_workspace_repo
+BEFORE INSERT ON junior_workspace_repos
+FOR EACH ROW EXECUTE FUNCTION junior_test_reject_workspace_repo()
+`);
+
+    try {
+      await expect(
+        createWorkspace({
+          name: "partial-create",
+          repos: [
+            {
+              provider: "github",
+              repo: "getsentry/sentry",
+              isPrimary: true,
+            },
+          ],
+        }),
+      ).rejects.toThrow(/junior_workspace_repos/);
+      expect(
+        await getWorkspaceByName(getDb(), "partial-create"),
+      ).toBeUndefined();
+
+      await expect(
+        updateWorkspace(original.id, {
+          name: "partial-update",
+          setupScript: "changed",
+          repos: [
+            {
+              provider: "github",
+              repo: "getsentry/sentry",
+              isPrimary: true,
+            },
+          ],
+        }),
+      ).rejects.toThrow(/junior_workspace_repos/);
+      expect(await getWorkspace(getDb(), original.id)).toEqual(original);
+    } finally {
+      await executor.execute(
+        "DROP TRIGGER IF EXISTS junior_test_reject_workspace_repo ON junior_workspace_repos",
+      );
+      await executor.execute(
+        "DROP FUNCTION IF EXISTS junior_test_reject_workspace_repo()",
+      );
+    }
+  });
+
+  it("rejects duplicate names", async () => {
+    const app = authenticatedApi();
+    const body = {
+      name: "shared",
+      repos: [
+        {
+          provider: "github",
+          repo: "getsentry/sentry",
+          isPrimary: true,
+        },
+      ],
+    };
+    const first = await app.request("http://localhost/api/workspaces", {
+      body: JSON.stringify(body),
+      headers: { "content-type": "application/json" },
+      method: "POST",
+    });
+    expect(first.status).toBe(201);
+
+    const second = await app.request("http://localhost/api/workspaces", {
+      body: JSON.stringify(body),
+      headers: { "content-type": "application/json" },
+      method: "POST",
+    });
+    expect(second.status).toBe(400);
+    expect(apiErrorSchema.parse(await second.json())).toEqual({
+      error: "Workspace name already exists: shared",
+    });
+  });
+});
diff --git a/packages/junior/tests/unit/workspaces/validation.test.ts b/packages/junior/tests/unit/workspaces/validation.test.ts
new file mode 100644
index 0000000000..d6d718a603
--- /dev/null
+++ b/packages/junior/tests/unit/workspaces/validation.test.ts
@@ -0,0 +1,74 @@
+import { describe, expect, it } from "vitest";
+import {
+  normalizeWorkspaceRecipe,
+  WorkspaceValidationError,
+} from "@/chat/workspaces/validation";
+
+describe("normalizeWorkspaceRecipe", () => {
+  it("normalizes names and providers", () => {
+    expect(
+      normalizeWorkspaceRecipe({
+        name: " Sentry ",
+        setupScript: "pnpm install",
+        repos: [
+          {
+            provider: " GitHub ",
+            repo: " getsentry/sentry ",
+            isPrimary: true,
+          },
+        ],
+      }),
+    ).toEqual({
+      name: "sentry",
+      setupScript: "pnpm install",
+      repos: [
+        {
+          provider: "github",
+          repo: "getsentry/sentry",
+          isPrimary: true,
+        },
+      ],
+    });
+  });
+
+  it("requires one primary repository when repos exist", () => {
+    expect(() =>
+      normalizeWorkspaceRecipe({
+        name: "sentry",
+        repos: [{ provider: "github", repo: "getsentry/sentry" }],
+      }),
+    ).toThrow(WorkspaceValidationError);
+  });
+
+  it("rejects checkout path collisions", () => {
+    expect(() =>
+      normalizeWorkspaceRecipe({
+        name: "sentry",
+        repos: [
+          {
+            provider: "github",
+            repo: "getsentry/sentry",
+            isPrimary: true,
+          },
+          {
+            provider: "github",
+            repo: "acme/sentry",
+          },
+        ],
+      }),
+    ).toThrow(/checkout path collision/i);
+  });
+
+  it("allows empty repository lists", () => {
+    expect(
+      normalizeWorkspaceRecipe({
+        name: "empty",
+        repos: [],
+      }),
+    ).toEqual({
+      name: "empty",
+      setupScript: "",
+      repos: [],
+    });
+  });
+});