refactor(sandbox): remove runtime file projection (#91)

## Summary

- remove the unconsumed `/workspace/.cheatcode/runtime.json` projection
- remove every best-effort provider write triggered by process start,
restart, reconciliation, kill, status, and sandbox reset
- keep Durable Object process records as the single lifecycle authority
- remove documentation for the non-portable file

## Why

Production QA proved Daytona's persistent-volume toolbox and process
views do not provide a coherent root-level file projection for this
path. The file has no runtime consumer and was explicitly
non-authoritative, so retaining repeated best-effort writes would add
provider calls and warnings without giving users a reliable artifact. A
clean implementation keeps the authoritative Durable Object state only.

## Verification

- `pnpm turbo lint typecheck build` — 76/76 tasks passed on Node 24.18.0
- affected architecture boundary check — passed, 103 modules / 194
dependencies
- affected Knip workspace — passed
- no remaining `runtime.json` or manifest-sync references
- `git diff --check` — passed
- exactly one Drizzle migration remains; no database changes

Author: iamjr15

apps/agent-worker/README.md

@@ -133,10 +133,6 @@ manifest avoids rewriting unchanged packages and limits cleanup to files previou
 managed by that package, preserving local dependencies and generated output. Curated
 default skills are immutable snapshot files under `/home/node/.cheatcode/default-skills/`.
 
-ProjectSandbox also writes `/workspace/.cheatcode/runtime.json` as a generated projection of
-managed app-preview processes through Daytona's filesystem API. The Durable Object process records
-remain authoritative; the file is only an inspectable runtime manifest.
-
 Managed processes use required stable IDs and a maximum of 32 live metadata slots per user
 sandbox. Reusing an ID atomically replaces that slot. At capacity, ProjectSandbox reconciles the
 bounded record set against Daytona, removes missing or completed sessions and their port state,

apps/agent-worker/src/durable-objects/project-sandbox-lifecycle.ts

@@ -47,7 +47,6 @@ import {
 } from "./project-sandbox-workspace-state";
 
 const ClearWorkspaceEvidenceSchema = z.object({ cleared: z.literal(true) }).strict();
-const RUNTIME_MANIFEST_PATH = "/workspace/.cheatcode/runtime.json";
 const RUNTIME_RESET_PENDING_KEY = "sandbox_runtime_reset_pending";
 const SKILL_RUNTIME_DIRECTORY = "/workspace/.cheatcode/runtime";
 
@@ -682,7 +681,6 @@ export abstract class ProjectSandboxLifecycle extends DurableObject<ProjectSandb
       return;
     }
     try {
-      await client.deleteFilePath(sandboxId, RUNTIME_MANIFEST_PATH, false);
       await client.deleteFilePath(sandboxId, SKILL_RUNTIME_DIRECTORY, true);
       await this.ctx.storage.delete(RUNTIME_RESET_PENDING_KEY);
     } catch (error) {

apps/agent-worker/src/durable-objects/project-sandbox-processes.ts

@@ -61,7 +61,6 @@ import {
   type ProjectStartProcessInput,
   ProjectStartProcessInputSchema,
 } from "./project-sandbox-runtime";
-import { writeSandboxRuntimeManifest } from "./project-sandbox-runtime-manifest";
 
 const DEFAULT_EXEC_TIMEOUT_MS = 60_000;
 
@@ -76,8 +75,6 @@ export abstract class ProjectSandboxProcesses extends ProjectSandboxLifecycle {
 
   public async ensureReady(): Promise<ProjectSandboxStatus> {
     const result = await this.runCode({ code: "print('ready')", language: "python" });
-    const id = await this.existingSandboxId();
-    if (id) await this.syncRuntimeManifestBestEffort(id);
     return {
       healthy: result.success,
       ping: result.stdout.trim(),
@@ -198,12 +195,10 @@ export abstract class ProjectSandboxProcesses extends ProjectSandboxLifecycle {
       );
     } catch (error) {
       await this.cleanupLaunchedProcess(id, sessionId, name);
-      await this.syncRuntimeManifestBestEffort(id);
       throw error;
     }
     const record = { ...provisionalRecord, cmdId: exec.cmdId ?? sessionId };
     await this.persistStartedProcess(id, name, record, parsed.waitForPort);
-    await this.syncRuntimeManifestBestEffort(id);
     await recordSandboxUsageBestEffort(await this.meteringContext());
     return { command: record.command, id: name, status: "running" };
   }
@@ -299,7 +294,6 @@ export abstract class ProjectSandboxProcesses extends ProjectSandboxLifecycle {
       await this.client().deleteFilePath(id, ENV_FILE_DIR, true);
     }
     await this.ctx.storage.delete(PROCESS_PORT_ALLOC_KEY);
-    if (id) await this.syncRuntimeManifestBestEffort(id);
     return killed;
   }
 
@@ -317,7 +311,6 @@ export abstract class ProjectSandboxProcesses extends ProjectSandboxLifecycle {
       await this.ctx.storage.delete(`${PROC_PREFIX}${processId}`);
       await this.releaseProcessPort(processId);
     }
-    if (id) await this.syncRuntimeManifestBestEffort(id);
     return { processId, status: "killed", success: true };
   }
 
@@ -335,7 +328,6 @@ export abstract class ProjectSandboxProcesses extends ProjectSandboxLifecycle {
         if (isMissingDaytonaProcessError(error)) {
           await this.ctx.storage.delete(`${PROC_PREFIX}${process.name}`);
           await this.releaseProcessPort(process.name);
-          await this.syncRuntimeManifestBestEffort(id);
           return null;
         }
         throw this.toUpstreamError(error, "Sandbox console read failed.");
@@ -379,10 +371,8 @@ export abstract class ProjectSandboxProcesses extends ProjectSandboxLifecycle {
         cmdId: exec.cmdId ?? sessionId,
         startedAtMs: Date.now(),
       } satisfies ProcessRecord);
-      await this.syncRuntimeManifestBestEffort(id);
     } catch (error) {
       await this.cleanupLaunchedProcess(id, sessionId, name);
-      await this.syncRuntimeManifestBestEffort(id);
       throw error;
     }
   }
@@ -687,16 +677,6 @@ cd ${shellQuote(cwd)} && ${rawCommand}`;
     await this.ctx.storage.delete(`${PROC_PREFIX}${name}`);
   }
 
-  private async syncRuntimeManifestBestEffort(id: string): Promise<void> {
-    const records = await this.ctx.storage.list({ prefix: PROC_PREFIX });
-    await writeSandboxRuntimeManifest(this.client(), id, records).catch((error: unknown) => {
-      createLogger().warn("sandbox_runtime_manifest_sync_failed", {
-        error,
-        sandboxId: this.sandboxName(),
-      });
-    });
-  }
-
   private async deleteSessionEnvironment(id: string, sessionId: string): Promise<void> {
     await this.client().deleteFilePath(id, `${ENV_FILE_DIR}/${sessionId}.env`, false);
   }

apps/agent-worker/src/durable-objects/project-sandbox-runtime-manifest.ts

@@ -154,10 +154,6 @@ is canonical in R2 and mirrored completely to
 source, schemas, references, templates, and common binary assets; dependency
 folders, virtual environments, caches, locks, and build output remain sandbox-local.
 
-`/workspace/.cheatcode/runtime.json` is generated from Durable Object-managed
-preview process state. It is a human-readable projection only; sandbox code
-must never treat it as the lifecycle authority.
-
 Cheatcode does not deploy or synchronize generated user apps. The curated
 catalog therefore has no deploy skill, deploy runtime, or app-side Composio
 bridge. Connected-app skills invoke the existing request-scoped Composio tools