feat(chat): migrate POST /api/sandbox/upload to api by arpitgupta1214 · Pull Request #1744 · recoupable/chat

arpitgupta1214 · 2026-05-09T16:50:41Z

Summary

Point the sandbox upload token handshake at the dedicated api route POST /api/sandboxes/staged-file and remove chat's local /api/sandbox/upload route (the commit step already calls POST /api/sandboxes/files).

Test plan

Drop a file into the sandbox file picker on a preview; confirm the Vercel Blob handshake hits api and the file commits to the sandbox repo
Confirm the CORS preflight succeeds from chat against api

Flips `handleUploadUrl` in lib/sandboxes/uploadSandboxFiles.ts from the local /api/sandbox/upload route to the new ${getClientApiBaseUrl()}/api/sandboxes/staged-files on api, then deletes the now-unused local route. Closes Group 6 of the chat→api migration. Pairs with api PR for the staged-files handler and docs PR for the OpenAPI entry. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

vercel · 2026-05-09T16:50:45Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
chat	Ready	Preview	May 9, 2026 5:37pm

coderabbitai · 2026-05-09T16:50:47Z

Warning

Rate limit exceeded

@arpitgupta1214 has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 15 minutes and 6 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 701bd4b4-e77f-4f6a-a010-b8968f0808a2

📥 Commits

Reviewing files that changed from the base of the PR and between 9e94db1 and 6982d75.

📒 Files selected for processing (2)

app/api/sandbox/upload/route.ts
lib/sandboxes/uploadSandboxFiles.ts

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch feature/sandbox-staged-files-cutover

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

cubic-dev-ai

No issues found across 2 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Requires human review: Migrates upload token handshake from chat to api, altering critical path for file uploads. Requires human review to verify API endpoint, CORS, and migration order.}

Pairs with the api-side rename of /api/sandboxes/staged-files to /api/sandboxes/stage-files. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

cubic-dev-ai

1 issue found across 1 file (changes from recent commits).

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="lib/sandboxes/uploadSandboxFiles.ts">

<violation number="1" location="lib/sandboxes/uploadSandboxFiles.ts:43">
P1: The upload handshake endpoint path was changed to `/api/sandboxes/stage-files`, but the migrated API route is `/api/sandboxes/staged-files`. This typo will break sandbox file uploads.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

cubic-dev-ai · 2026-05-09T17:19:07Z

      const blob = await upload(file.name, file, {
        access: "public",
-        handleUploadUrl: "/api/sandbox/upload",
+        handleUploadUrl: `${getClientApiBaseUrl()}/api/sandboxes/stage-files`,


P1: The upload handshake endpoint path was changed to /api/sandboxes/stage-files, but the migrated API route is /api/sandboxes/staged-files. This typo will break sandbox file uploads.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At lib/sandboxes/uploadSandboxFiles.ts, line 43: <comment>The upload handshake endpoint path was changed to `/api/sandboxes/stage-files`, but the migrated API route is `/api/sandboxes/staged-files`. This typo will break sandbox file uploads.</comment> <file context> @@ -40,7 +40,7 @@ export async function uploadSandboxFiles({ const blob = await upload(file.name, file, { access: "public", - handleUploadUrl: `${getClientApiBaseUrl()}/api/sandboxes/staged-files`, + handleUploadUrl: `${getClientApiBaseUrl()}/api/sandboxes/stage-files`, clientPayload: JSON.stringify({ token: accessToken }), }); </file context>

Suggested change

handleUploadUrl: `${getClientApiBaseUrl()}/api/sandboxes/stage-files`,

handleUploadUrl: `${getClientApiBaseUrl()}/api/sandboxes/staged-files`,

Pairs with the api-side rename to the noun-shaped resource path. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

cubic-dev-ai

0 issues found across 1 file (changes from recent commits).

_{Requires human review: Auto-approval blocked by 1 unresolved issue from previous reviews.}

Vercel Blob client's upload() supports a `headers` option that forwards arbitrary headers onto the handshake POST — replacing the clientPayload.token dance with a normal Bearer header. Pairs with the api-side switch to validateAuthContext(). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

cubic-dev-ai

0 issues found across 1 file (changes from recent commits).

_{Requires human review: Auto-approval blocked by 1 unresolved issue from previous reviews.}

sweetmantech · 2026-05-27T13:11:09Z

Manual verification on preview

Tested upload flow on chat-git-feature-sandbox-staged-files-cutover-recoup.vercel.app (signed in via Privy, sandbox: delete-me / myco-wtf).

Observed network sequence per upload:

POST https://test-recoup-api.vercel.app/api/sandboxes/staged-file → 200
PUT https://vercel.com/api/blob/?pathname=<filename> → 200
POST https://test-recoup-api.vercel.app/api/sandboxes/files → 200

Two uploads exercised this path (deal_type.png and pr-1744-test.txt); both succeeded with a "Uploaded 1 file" toast and appeared in the file tree after refetch.

Test plan items confirmed:

✅ Blob handshake hits api (/api/sandboxes/staged-file), not the now-deleted chat route
✅ Auth carried via Authorization: Bearer <privy JWT> header; request body has clientPayload: null — old clientPayload.token path is fully retired
✅ Cross-origin CORS from chat → api succeeds: response returns access-control-allow-origin: * and access-control-allow-headers: Content-Type, Authorization, X-Requested-With, x-api-key
✅ Commit step (POST /api/sandboxes/files) commits the blob URL to the sandbox repo
✅ Zero requests observed against the removed /api/sandbox/upload route on chat

Behavior matches the PR description. 🤖

arpitgupta1214 requested a review from sweetmantech as a code owner May 9, 2026 16:50

cubic-dev-ai Bot reviewed May 9, 2026

View reviewed changes

vercel Bot deployed to Preview – chat May 9, 2026 16:52 View deployment

refactor(chat): point sandbox upload at /api/sandboxes/stage-files

bc281b8

Pairs with the api-side rename of /api/sandboxes/staged-files to /api/sandboxes/stage-files. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

cubic-dev-ai Bot reviewed May 9, 2026

View reviewed changes

vercel Bot deployed to Preview – chat May 9, 2026 17:19 View deployment

refactor(chat): point sandbox upload at /api/sandboxes/staged-file

3fe77d6

Pairs with the api-side rename to the noun-shaped resource path. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

vercel Bot deployed to Preview – chat May 9, 2026 17:23 View deployment

cubic-dev-ai Bot reviewed May 9, 2026

View reviewed changes

vercel Bot deployed to Preview – chat May 9, 2026 17:37 View deployment

arpitgupta1214 closed this May 10, 2026

arpitgupta1214 reopened this May 25, 2026

sweetmantech approved these changes May 27, 2026

View reviewed changes

sweetmantech merged commit 7f0c518 into test May 27, 2026
5 checks passed

sweetmantech deleted the feature/sandbox-staged-files-cutover branch May 27, 2026 13:13

sweetmantech mentioned this pull request May 27, 2026

chore: promote test to main (sandbox staged-files cutover) #1749

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(chat): migrate POST /api/sandbox/upload to api#1744

feat(chat): migrate POST /api/sandbox/upload to api#1744
sweetmantech merged 4 commits into
testfrom
feature/sandbox-staged-files-cutover

arpitgupta1214 commented May 9, 2026 •

edited

Loading

Uh oh!

vercel Bot commented May 9, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented May 9, 2026 •

edited

Loading

Rate limit exceeded

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

cubic-dev-ai Bot May 9, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

sweetmantech commented May 27, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	handleUploadUrl: `${getClientApiBaseUrl()}/api/sandboxes/stage-files`,
	handleUploadUrl: `${getClientApiBaseUrl()}/api/sandboxes/staged-files`,

Uh oh!

Conversation

arpitgupta1214 commented May 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

vercel Bot commented May 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented May 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Rate limit exceeded

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot May 9, 2026

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

sweetmantech commented May 27, 2026

Manual verification on preview

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

arpitgupta1214 commented May 9, 2026 •

edited

Loading

vercel Bot commented May 9, 2026 •

edited

Loading

coderabbitai Bot commented May 9, 2026 •

edited

Loading