harden: per-project preview status/console/wake + remove sandbox_destroy footgun

Sweep of per-sandbox assumptions that break under one-sandbox-per-user (audit
found 6, all in agent-worker + the agent tool-set; core plumbing verified clean):

- GAP1 (data-loss): drop sandbox_destroy/create/snapshot/restore from the agent
  tool-set — sandbox_destroy nuked the whole per-user sandbox (every project) and
  its description invited 'project cleanup'. DO methods kept for deletion routes.
- GAP2: preview/status now reports THIS project's dev server (projectPreviewStatus
  probes app-preview:<slug>'s port without booting the VM), not the sandbox state,
  so a dead dev server auto-wakes instead of showing a blank preview forever.
- GAP3: console dev-server logs keyed by workspaceSlug (was project UUID -> leaked
  another project's logs).
- GAP4: legacy null-slug normalized to 'app' across wake/status/console.
- GAP5: port-alloc failure throws instead of falling back to shared 5173 (no cross-
  project kill via deleteProcessesOnPort).
- GAP6: port-bound startProcess requires an explicit per-project processId.

Gates: typecheck 39/39, turbo build 22/22, biome clean.

Author: iamjr15

apps/agent-worker/src/durable-objects/agent-run-app-builder.ts

@@ -24,10 +24,12 @@ import { signedUrlToExpo } from "./project-sandbox-preview";
 
 export { restoreBestEffortSnapshot, snapshotAppBuilderWorkspace };
 
-// Fallback app dir + ports for legacy/slug-less runs. Per-project runs derive their own dir from
-// the project's workspaceSlug and their own stable port from the sandbox's per-project allocator.
+// Fallback app dir for legacy/slug-less runs; per-project runs derive their own dir from the
+// project's workspaceSlug. Ports are NEVER a fixed fallback in the per-user sandbox — each project
+// draws a unique dev-server port from the DO's per-project allocator (see allocateAppPort).
 const DEFAULT_APP_BUILDER_DIR = "/workspace/app";
-const DEFAULT_WEB_PORT = 5173;
+// Informational only: the mobile port hint threaded into an imported project's context note. The
+// actual Metro port is allocated per-project by the DO, not fixed to this value.
 const DEFAULT_MOBILE_PORT = 8081;
 // 24h is Daytona's max signed-preview TTL; the token rides in the subdomain so Expo Go needs no
 // header, and we re-mint on every dev-server (re)start so it never serves an expired manifest URL.
@@ -69,9 +71,12 @@ async function allocateAppPort(
   mobile: boolean,
   logger: AgentRunLogger,
 ): Promise<number> {
+  // Per-user sandbox: never fall back to a fixed shared port — two projects on the same fixed port
+  // would fight over it (a rebuild's deleteProcessesOnPort would kill the other's dev server). If
+  // the allocator is unavailable, fail the dev-server start loudly instead of sharing a port.
   if (!sandbox.allocateProjectPort) {
-    logger.warn("app_port_alloc_missing_method", { slug });
-    return mobile ? DEFAULT_MOBILE_PORT : DEFAULT_WEB_PORT;
+    logger.error("app_port_alloc_missing_method", { slug });
+    throw appPortAllocationError(slug);
   }
   try {
     const port = await sandbox.allocateProjectPort({
@@ -81,14 +86,27 @@ async function allocateAppPort(
     logger.info("app_port_allocated", { mobile, port, slug });
     return port;
   } catch (error) {
-    logger.warn("app_port_alloc_failed", {
+    logger.error("app_port_alloc_failed", {
       error: error instanceof Error ? error.message : String(error),
       slug,
     });
-    return mobile ? DEFAULT_MOBILE_PORT : DEFAULT_WEB_PORT;
+    throw appPortAllocationError(slug);
   }
 }
 
+function appPortAllocationError(slug: string): APIError {
+  return new APIError(
+    502,
+    "sandbox_failed_to_start",
+    "Could not allocate a per-project dev-server port.",
+    {
+      details: { slug },
+      hint: "Retry the run. If it persists, the project sandbox port allocator is unavailable.",
+      retriable: true,
+    },
+  );
+}
+
 async function resolveAppWorkspace(
   sandbox: ProjectSandboxStub,
   input: AgentRunAppBuilderInput,

apps/agent-worker/src/durable-objects/mastra-stream-chunks.ts

@@ -22,10 +22,6 @@ const SANDBOX_TOOL_NAMES = new Set([
   "git_push",
   "git_status",
   "runCode",
-  "sandbox_create",
-  "sandbox_destroy",
-  "sandbox_restore",
-  "sandbox_snapshot",
   "shell_exec",
   "shell_kill_process",
   "shell_start_process",

apps/agent-worker/src/durable-objects/project-sandbox-runtime.ts

@@ -203,6 +203,15 @@ export const ProjectWakePreviewInputSchema = z
   })
   .strict();
 
+// Read-only preview liveness for the status panel. Names which project's dev server to check —
+// its ProcessRecord slot is keyed by workspaceSlug (matching start_dev_server + wakePreview).
+// Absent/normalized to "app" for legacy slug-less projects; a project-less chat never calls this.
+export const ProjectPreviewStatusInputSchema = z
+  .object({
+    workspaceSlug: z.string().min(1).max(200).optional(),
+  })
+  .strict();
+
 export const ProjectSignedPreviewUrlInputSchema = z
   .object({
     port: z.number().int().positive().max(65_535),
@@ -257,6 +266,7 @@ export type ProjectAllocatePortInput = z.input<typeof ProjectAllocatePortInputSc
 export type ProjectCodeServerInput = z.input<typeof ProjectCodeServerInputSchema>;
 export type ProjectUnexposePortInput = z.input<typeof ProjectUnexposePortInputSchema>;
 export type ProjectWakePreviewInput = z.input<typeof ProjectWakePreviewInputSchema>;
+export type ProjectPreviewStatusInput = z.input<typeof ProjectPreviewStatusInputSchema>;
 export type ProjectSignedPreviewUrlInput = z.input<typeof ProjectSignedPreviewUrlInputSchema>;
 
 /** Result of waking a preview: the (possibly restarted) dev-server preview URL + liveness. */

apps/agent-worker/src/durable-objects/project-sandbox.ts

@@ -54,6 +54,8 @@ import {
   ProjectListFilesInputSchema,
   type ProjectPreviewFileInput,
   ProjectPreviewFileInputSchema,
+  type ProjectPreviewStatusInput,
+  ProjectPreviewStatusInputSchema,
   type ProjectReadDevServerLogsInput,
   ProjectReadDevServerLogsInputSchema,
   type ProjectReadFileInput,
@@ -112,9 +114,15 @@ const APP_PREVIEW_TTL_MS = 24 * 60 * 60 * 1000;
 // Daytona's signed preview URL (token in the subdomain) TTL — 24h is Daytona's max. Regenerated on
 // every mobile dev-server (re)start so Expo Go always has an unexpired, header-free manifest URL.
 const SIGNED_PREVIEW_TTL_SECONDS = 24 * 60 * 60;
-// Per-project dev-server slot prefix. Each project's dev server occupies proc:app-preview:<projectId>
+// Per-project dev-server slot prefix. Each project's dev server occupies proc:app-preview:<workspaceSlug>
 // so multiple projects' servers persist side by side in the one per-user sandbox (bud parity).
 const APP_PREVIEW_SLOT_PREFIX = "app-preview:";
+// Legacy slug-less projects were built into /workspace/app with the slot "app-preview:app" (the
+// app-builder's basename fallback). The status/console/wake routes normalize a null workspaceSlug to
+// this so all of them address the same slot instead of the bare "app-preview" default.
+const LEGACY_APP_SLUG = "app";
+// Single short liveness probe budget for the read-only preview status check (no VM boot).
+const PREVIEW_STATUS_PROBE_TIMEOUT_MS = 3_000;
 // Per-project dev-server port pools. Web previews start at 5173, mobile (Expo Metro) at 8081, each
 // incrementing per new project, unique within the sandbox — the port is per-project, not fixed.
 const WEB_PORT_BASE = 5173;
@@ -363,10 +371,20 @@ export class ProjectSandbox extends DurableObject<ProjectSandboxEnv> {
 
   public async startProcess(input: ProjectStartProcessInput): Promise<SandboxProcessResult> {
     const parsed = ProjectStartProcessInputSchema.parse(input);
+    // A port-bound process must carry an explicit processId (its dev-server slot). Without one it
+    // would land in the shared bare "app-preview" slot and could clobber another project's dev
+    // server in the per-user sandbox, so refuse it loudly instead of silently sharing a slot.
+    if (parsed.waitForPort && !parsed.processId) {
+      throw new APIError(
+        400,
+        "invalid_request_body",
+        "A port-bound sandbox process requires an explicit processId.",
+        { retriable: false },
+      );
+    }
     const id = await this.ensureSandbox();
     const client = this.client();
-    const name =
-      parsed.processId ?? (parsed.waitForPort ? "app-preview" : `process-${crypto.randomUUID()}`);
+    const name = parsed.processId ?? `process-${crypto.randomUUID()}`;
     const sessionId = `cc-${name}`;
     if (parsed.processId || parsed.waitForPort) {
       await this.deleteProcessRecord(id, name);
@@ -688,6 +706,36 @@ export class ProjectSandbox extends DurableObject<ProjectSandboxEnv> {
     return { sandboxId: existing, state: sandbox?.state ?? "unknown" };
   }
 
+  // Read-only preview liveness for the status panel: resolve the shared sandbox's lifecycle state
+  // WITHOUT booting it (no ensureSandbox), then — only when the VM is started — probe THIS project's
+  // own dev-server port so a dead dev server reads as not-running even while the sandbox is up (an
+  // idle-stop can kill the dev-server process without stopping the VM). The slot is keyed by
+  // workspaceSlug (defaulting to "app" for legacy slug-less projects), matching start_dev_server +
+  // wakePreview, so each project reports on its own server rather than the shared sandbox state.
+  public async projectPreviewStatus(
+    input: ProjectPreviewStatusInput,
+  ): Promise<{ running: boolean; state: string }> {
+    const parsed = ProjectPreviewStatusInputSchema.parse(input);
+    const runtime = await this.sandboxRuntimeState();
+    if (runtime.state !== "started" || !runtime.sandboxId) {
+      return { running: false, state: runtime.state };
+    }
+    const slug = parsed.workspaceSlug ?? LEGACY_APP_SLUG;
+    const record = await this.processRecord(`${APP_PREVIEW_SLOT_PREFIX}${slug}`);
+    if (!record?.port) {
+      // Sandbox is up but this project has no tracked dev server (a docs/data project, or one not
+      // started yet) — nothing is serving a preview.
+      return { running: false, state: runtime.state };
+    }
+    const running = await this.httpPortReady(
+      runtime.sandboxId,
+      record.port,
+      "/",
+      PREVIEW_STATUS_PROBE_TIMEOUT_MS,
+    );
+    return { running, state: runtime.state };
+  }
+
   public async unexposePort(input: ProjectUnexposePortInput): Promise<void> {
     ProjectUnexposePortInputSchema.parse(input);
     // Daytona has no per-port preview object to delete; tokens expire on TTL.

apps/agent-worker/src/index.ts

@@ -650,7 +650,9 @@ agentApp.post("/v1/threads/:threadId/sandbox/preview/wake", async (c) => {
   // this project's dev server among the sandbox's per-project ones (slot keyed by slug).
   const result = await sandbox.wakePreview({
     hostname: resolvePreviewHostname(c.env),
-    ...(project?.workspaceSlug ? { workspaceSlug: project.workspaceSlug } : {}),
+    // A project chat wakes its own dev server (slot keyed by slug, normalized to "app" for legacy
+    // slug-less projects); a project-less chat has no dev server to revive, so omit the slug.
+    ...(project ? { workspaceSlug: previewWorkspaceSlug(project.workspaceSlug) } : {}),
   });
   return c.json(SandboxPreviewWakeSchema.parse(result));
 });
@@ -665,8 +667,19 @@ agentApp.get("/v1/threads/:threadId/sandbox/preview/status", async (c) => {
   const sandbox = project
     ? await sandboxForProject(c.env, userId, project.id)
     : await sandboxForThread(c.env, userId, threadId);
-  // Prefer the webhook-fed cache (Daytona sandbox.state.updated) keyed by the sandbox UUID —
-  // no Daytona API call. Fall back to a live read when the cache is cold.
+  if (project) {
+    // Per-project liveness: the shared per-user sandbox can be "started" while THIS project's dev
+    // server is dead (idle-stop killed its process), so probe the project's own dev-server port
+    // instead of reading only the sandbox state — otherwise the web wake guard never fires and the
+    // preview stays blank. The slot defaults to "app" for legacy slug-less projects (GAP 4).
+    const status = await sandbox.projectPreviewStatus({
+      workspaceSlug: previewWorkspaceSlug(project.workspaceSlug),
+    });
+    return c.json(SandboxPreviewStatusSchema.parse(status));
+  }
+  // Project-less chat: no dev server to probe — report the raw sandbox lifecycle state, preferring
+  // the webhook-fed cache (Daytona sandbox.state.updated) keyed by the sandbox UUID (no Daytona API
+  // call), falling back to a live read when the cache is cold.
   const daytonaId = await sandbox.existingDaytonaId();
   const cached = daytonaId ? await readSandboxStateCache(c.env, daytonaId) : null;
   const runtime = cached ?? (await sandbox.sandboxRuntimeState());
@@ -812,7 +825,9 @@ agentApp.get("/v1/threads/:threadId/sandbox/console", async (c) => {
     ? await sandboxForProject(c.env, userId, project.id)
     : await sandboxForThread(c.env, userId, threadId);
   const snapshot = await sandbox.readDevServerLogs(
-    project ? { ...query, processId: `app-preview:${project.id}` } : query,
+    project
+      ? { ...query, processId: `app-preview:${previewWorkspaceSlug(project.workspaceSlug)}` }
+      : query,
   );
   return c.json(SandboxConsoleSnapshotSchema.parse(snapshot));
 });
@@ -835,6 +850,13 @@ function takeoverEmbedUrl(previewUrl: string, password: string): string {
   return url.toString();
 }
 
+// Legacy slug-less projects were built into /workspace/app with the dev-server slot "app-preview:app"
+// (the app-builder's basename fallback). Normalize a null workspaceSlug to "app" so the wake, status,
+// and console routes all address that same slot — otherwise they'd miss it and fall back wrongly.
+function previewWorkspaceSlug(workspaceSlug: string | null): string {
+  return workspaceSlug ?? "app";
+}
+
 async function terminalProjectForThread(
   env: AgentEnv,
   userId: string,

apps/gateway-worker/src/metadata-routes.ts

@@ -15,10 +15,6 @@ const TOOL_SUMMARIES = [
   tool("code", "git_clone", "Clone a git repository into the sandbox."),
   tool("code", "git_commit", "Commit sandbox repository changes."),
   tool("code", "git_push", "Push sandbox repository changes."),
-  tool("sandbox", "sandbox_create", "Create or wake the project sandbox."),
-  tool("sandbox", "sandbox_destroy", "Delete the project sandbox."),
-  tool("sandbox", "sandbox_snapshot", "Return the project workspace volume handle."),
-  tool("sandbox", "sandbox_restore", "Reconnect the project workspace volume handle."),
   tool("sandbox", "start_dev_server", "Start and expose a sandbox preview server."),
   tool("browser", "browser_open", "Open a URL in the sandbox browser."),
   tool("browser", "browser_act", "Perform a Stagehand browser action."),

apps/web/src/components/chat/message-parts.tsx

@@ -461,10 +461,6 @@ const TOOL_VERBS: Record<string, ToolVerbSpec> = {
   research_fanout: { verb: "Researched", argKeys: ["query", "topic"] },
   composio_execute: { verb: "Ran an app action", argKeys: ["tool", "action", "slug"] },
   composio_list_tools: { verb: "Listed app actions" },
-  sandbox_create: { verb: "Created the sandbox" },
-  sandbox_destroy: { verb: "Tore down the sandbox" },
-  sandbox_snapshot: { verb: "Snapshotted the sandbox" },
-  sandbox_restore: { verb: "Restored the sandbox" },
   skill_create: { verb: "Created a skill", argKeys: ["name", "slug"] },
   skill_invoke: { verb: "Used skill", argKeys: ["skillName", "name", "slug", "skill"] },
   skill_read_reference: { verb: "Read a skill reference", argKeys: ["path", "name"] },

packages/agent-core/src/mastra/tools/registry.ts

@@ -10,18 +10,14 @@ import {
   CodeRuntimeContextSchema,
   DeleteFileInputSchema,
   DeleteFileOutputSchema,
-  executeCreateSnapshot,
   executeDeleteFile,
   executeGitClone,
   executeGitCommit,
   executeGitPush,
   executeGitStatus,
   executeListFiles,
   executeReadFile,
-  executeRestoreSnapshot,
   executeRunCode,
-  executeSandboxCreate,
-  executeSandboxDestroy,
   executeSearchFiles,
   executeShellExec,
   executeShellKillProcess,
@@ -32,13 +28,8 @@ import {
   GitCloneInputSchema,
   GitPushInputSchema,
   GitStatusInputSchema,
-  RestoreSnapshotInputSchema,
   RunCodeInputSchema,
   RunCodeOutputSchema,
-  SandboxCreateInputSchema,
-  SandboxCreateOutputSchema,
-  SandboxDestroyInputSchema,
-  SandboxDestroyOutputSchema,
   SearchFilesInputSchema,
   SearchFilesOutputSchema,
   ShellExecOutputSchema,
@@ -111,7 +102,6 @@ import {
   browserObserveInputSchema,
   browserOpenInputSchema,
   browserScreenshotInputSchema,
-  createSnapshotInputSchema,
   gitCloneInputSchema,
   gitCommitInputSchema,
   gitPushInputSchema,
@@ -120,8 +110,6 @@ import {
   listFilesOutputSchema,
   readFileInputSchema,
   readFileOutputSchema,
-  restoreSnapshotInputSchema,
-  restoreSnapshotOutputSchema,
   runCodeInputSchema,
   runCodeOutputSchema,
   shellExecInputSchema,
@@ -132,7 +120,6 @@ import {
   skillInvokeOutputSchema,
   skillReadReferenceInputSchema,
   skillReadReferenceOutputSchema,
-  snapshotHandleSchema,
   startDevServerInputSchema,
   startDevServerOutputSchema,
   workflowResultSchema,
@@ -473,42 +460,6 @@ export const mastraStartDevServer = createTool({
   execute: async (input, context) => executeStartDevServer(input, codeRuntimeFromContext(context)),
 });
 
-export const mastraSandboxCreate = createTool({
-  id: "sandbox_create",
-  description: "Create or wake the project sandbox and return readiness status.",
-  inputSchema: SandboxCreateInputSchema,
-  outputSchema: SandboxCreateOutputSchema,
-  execute: async (input, context) => executeSandboxCreate(input, codeRuntimeFromContext(context)),
-});
-
-export const mastraSandboxDestroy = createTool({
-  id: "sandbox_destroy",
-  description: "Delete the project sandbox for explicit project cleanup.",
-  inputSchema: SandboxDestroyInputSchema,
-  outputSchema: SandboxDestroyOutputSchema,
-  execute: async (input, context) => executeSandboxDestroy(input, codeRuntimeFromContext(context)),
-});
-
-export const mastraSandboxSnapshot = createTool({
-  id: "sandbox_snapshot",
-  description: "Return the current project's persistent Daytona sandbox handle.",
-  inputSchema: createSnapshotInputSchema,
-  outputSchema: snapshotHandleSchema,
-  execute: async (input, context) => executeCreateSnapshot(input, codeRuntimeFromContext(context)),
-});
-
-export const mastraSandboxRestore = createTool({
-  id: "sandbox_restore",
-  description: "Reconnect the sandbox to a previously returned Daytona sandbox handle.",
-  inputSchema: restoreSnapshotInputSchema,
-  outputSchema: restoreSnapshotOutputSchema,
-  execute: async (input, context) =>
-    executeRestoreSnapshot(
-      RestoreSnapshotInputSchema.parse(input),
-      codeRuntimeFromContext(context),
-    ),
-});
-
 export const mastraBrowserOpen = createTool({
   id: "browser_open",
   description: