chore(sandbox): WS9 dead-code cleanup + WS5b egress canary

WS9 (cosmetic/contract cleanup): remove the deprecated Blaxel-era localBucket
flag everywhere (it was carried but ignored in V2; 0 refs remain), delete the
dead Blaxel normalization-helper cluster in project-sandbox-runtime.ts (~220
lines, all def-only / no live callers, plus the transitively-orphaned private
helpers), and drop the client-side backup TTL that the Daytona DO ignores
(disk-is-the-store). localBucket on DirectoryBackupHandle was a TS interface
field, not a DB column — no migration.

WS5b egress canary (apps/webhooks-worker/src/egress-canary.ts): a daily cron
(03:30 UTC) that detects if Daytona starts enforcing Tier-2 egress limits.
Zero-cost piggyback — it runs a curl probe inside a sandbox that is ALREADY
started (already billing a user's run) and SKIPS entirely if none is running,
never spinning up a dedicated sandbox. Alerts via the existing HMAC
postInternalAlert only when both probe hosts fail; transient toolbox errors
retry via the ops workflow step instead of false-alarming.

Also includes in-tree Composio hardening (gateway/webhooks/agent-core): pin
baseURL=backend.composio.dev, allowTracking:false, and request the documented
max tool-list page so large toolkits aren't under-enumerated.

Author: iamjr15

apps/agent-worker/src/durable-objects/project-sandbox-runtime.ts

@@ -4,15 +4,13 @@ export interface BackupOptions {
   dir: string;
   excludes?: string[];
   gitignore?: boolean;
-  localBucket?: boolean;
   name?: string;
   ttl?: number;
 }
 
 export interface DirectoryBackup {
   dir: string;
   id: string;
-  localBucket?: boolean;
 }
 
 export interface ExecOptions {
@@ -175,22 +173,14 @@ export const ProjectUnexposePortInputSchema = z
 export const ProjectCreateBackupInputSchema = z
   .object({
     dir: WorkspacePathSchema.default("/workspace"),
-    localBucket: z.boolean().optional(),
     name: z.string().min(1).max(200).optional(),
-    ttl: z
-      .number()
-      .int()
-      .positive()
-      .max(90 * 24 * 60 * 60)
-      .default(30 * 24 * 60 * 60),
   })
   .strict();
 
 export const ProjectBackupHandleSchema = z
   .object({
     id: z.string().min(1),
     dir: WorkspacePathSchema,
-    localBucket: z.boolean().optional(),
   })
   .strict();
 
@@ -292,7 +282,6 @@ export interface NormalizedExposePortResult {
 export interface NormalizedBackupHandle {
   id: string;
   dir: string;
-  localBucket?: boolean;
 }
 
 function isSafeWorkspacePath(path: string): boolean {
@@ -320,219 +309,10 @@ function normalizeWorkspacePath(path: string): string {
   return `/${parts.join("/")}${path.endsWith("/") ? "/" : ""}`;
 }
 
-interface SandboxExecutionResult {
-  logs: {
-    stdout: string[];
-    stderr: string[];
-  };
-  error?: unknown;
-}
-
-function isSandboxExecutionResult(value: unknown): value is SandboxExecutionResult {
-  if (!value || typeof value !== "object") {
-    return false;
-  }
-  const candidate = value as Record<string, unknown>;
-  const logs = candidate["logs"];
-  if (!logs || typeof logs !== "object") {
-    return false;
-  }
-  const typedLogs = logs as Record<string, unknown>;
-  return Array.isArray(typedLogs["stdout"]) && Array.isArray(typedLogs["stderr"]);
-}
-
-function toPlainExecutionResult(value: unknown): unknown {
-  if (
-    value &&
-    typeof value === "object" &&
-    "toJSON" in value &&
-    typeof (value as { toJSON?: unknown }).toJSON === "function"
-  ) {
-    return (value as { toJSON(): unknown }).toJSON();
-  }
-  return value;
-}
-
-function normalizeEncoding(value: unknown): "utf8" | "base64" {
-  return value === "base64" ? "base64" : "utf8";
-}
-
 function shellQuote(arg: string): string {
   return `'${arg.replaceAll("'", "'\\''")}'`;
 }
 
 export function commandToShellString(command: string[]): string {
   return command.map(shellQuote).join(" ");
 }
-
-export function createExecOptions(input: ProjectExecInput): ExecOptions {
-  const options: ExecOptions = {};
-  if (input.cwd) {
-    options.cwd = input.cwd;
-  }
-  if (input.env) {
-    options.env = input.env;
-  }
-  if (input.timeoutMs) {
-    options.timeout = input.timeoutMs;
-  }
-  return options;
-}
-
-export function createProcessOptions(input: ProjectStartProcessInput): ProcessOptions {
-  const options: ProcessOptions = createExecOptions(input);
-  options.autoCleanup = false;
-  if (input.keepAliveTimeoutMs !== undefined) {
-    options.keepAliveTimeoutMs = input.keepAliveTimeoutMs;
-  }
-  if (input.maxRestarts !== undefined) {
-    options.maxRestarts = input.maxRestarts;
-  }
-  if (input.processId) {
-    options.processId = input.processId;
-  }
-  if (input.restartOnFailure !== undefined) {
-    options.restartOnFailure = input.restartOnFailure;
-  }
-  return options;
-}
-
-export function createRunCodeOptions(input: ProjectRunCodeInput): RunCodeOptions {
-  const options: RunCodeOptions = { language: input.language };
-  if (input.env) {
-    options.envVars = input.env;
-  }
-  return options;
-}
-
-export function normalizeExecResult(value: unknown): NormalizedExecResult {
-  const parsed = z
-    .object({
-      command: z.string(),
-      duration: z.number().nonnegative().optional(),
-      exitCode: z.number().int(),
-      stderr: z.string(),
-      stdout: z.string(),
-      success: z.boolean(),
-    })
-    .passthrough()
-    .parse(toPlainExecutionResult(value));
-  return {
-    command: parsed.command,
-    stdout: parsed.stdout,
-    stderr: parsed.stderr,
-    success: parsed.success,
-    exitCode: parsed.exitCode,
-    ...(parsed.duration === undefined ? {} : { durationMs: parsed.duration }),
-  };
-}
-
-export function normalizeReadFileResult(value: unknown): NormalizedReadFileResult {
-  const parsed = z
-    .object({
-      content: z.string(),
-      encoding: z.enum(["utf-8", "base64"]).optional(),
-      path: z.string(),
-      size: z.number().int().nonnegative().optional(),
-    })
-    .passthrough()
-    .parse(value);
-  return {
-    path: parsed.path,
-    content: parsed.content,
-    encoding: normalizeEncoding(parsed.encoding),
-    ...(parsed.size === undefined ? {} : { size: parsed.size }),
-  };
-}
-
-export function normalizeWriteFileResult(value: unknown): NormalizedWriteFileResult {
-  const parsed = z.object({ path: z.string(), success: z.boolean() }).passthrough().parse(value);
-  return {
-    path: parsed.path,
-    success: parsed.success,
-  };
-}
-
-export function normalizeListFilesResult(value: unknown): NormalizedListFilesResult {
-  const parsed = z
-    .object({
-      path: z.string(),
-      files: z.array(
-        z
-          .object({
-            absolutePath: z.string(),
-            modifiedAt: z.string(),
-            name: z.string(),
-            relativePath: z.string(),
-            size: z.number().int().nonnegative(),
-            type: z.enum(["file", "directory", "symlink", "other"]),
-          })
-          .passthrough(),
-      ),
-    })
-    .passthrough()
-    .parse(value);
-  return {
-    path: parsed.path,
-    files: parsed.files.map((file) => ({
-      name: file.name,
-      path: file.absolutePath,
-      relativePath: file.relativePath,
-      type: file.type,
-      size: file.size,
-      modifiedAt: file.modifiedAt,
-    })),
-  };
-}
-
-export function normalizeExposePortResult(value: unknown): NormalizedExposePortResult {
-  const parsed = z
-    .object({
-      name: z.string().optional(),
-      port: z.number().int().positive(),
-      token: z.string().optional(),
-      url: z.string().url(),
-    })
-    .passthrough()
-    .parse(value);
-  return {
-    port: parsed.port,
-    ...(parsed.token === undefined ? {} : { token: parsed.token }),
-    url: parsed.url,
-    ...(parsed.name === undefined ? {} : { name: parsed.name }),
-  };
-}
-
-export function normalizeDirectoryBackup(value: DirectoryBackup): NormalizedBackupHandle {
-  const parsed = ProjectBackupHandleSchema.parse(value);
-  return {
-    id: parsed.id,
-    dir: parsed.dir,
-    ...(parsed.localBucket === undefined ? {} : { localBucket: parsed.localBucket }),
-  };
-}
-
-export function createBackupOptions(input: ProjectCreateBackupInput): BackupOptions {
-  const parsedInput = ProjectCreateBackupInputSchema.parse(input);
-  return {
-    dir: parsedInput.dir,
-    ttl: parsedInput.ttl,
-    gitignore: true,
-    excludes: ["node_modules", ".git", ".next", ".turbo"],
-    ...(parsedInput.localBucket === undefined ? {} : { localBucket: parsedInput.localBucket }),
-    ...(parsedInput.name ? { name: parsedInput.name } : {}),
-  };
-}
-
-export function normalizeRunCodeResult(value: unknown): NormalizedRunCodeResult {
-  const serialized = toPlainExecutionResult(value);
-  if (!isSandboxExecutionResult(serialized)) {
-    throw new Error("Unexpected sandbox execution result.");
-  }
-  return {
-    stdout: serialized.logs.stdout.join(""),
-    stderr: serialized.logs.stderr.join(""),
-    success: !serialized.error,
-    exitCode: serialized.error ? 1 : 0,
-  };
-}

apps/gateway-worker/src/integrations.ts

@@ -90,7 +90,11 @@ export async function listIntegrationSummaries(
 export async function connectIntegration(input: ConnectIntegrationInput): Promise<Response> {
   const apiKey = await readRequiredSecret(input.env.COMPOSIO_API_KEY, "COMPOSIO_API_KEY");
   const authConfigId = await readAuthConfigId(input.env, input.integration);
-  const composio = new Composio({ apiKey });
+  const composio = new Composio({
+    allowTracking: false,
+    apiKey,
+    baseURL: "https://backend.composio.dev",
+  });
   const callbackUrl = resolveCallbackUrl(input.request);
   const connection = await createConnectionLink({
     authConfigId,
@@ -119,7 +123,11 @@ export async function deleteIntegration(input: DeleteIntegrationInput): Promise<
     return;
   }
   const apiKey = await readRequiredSecret(input.env.COMPOSIO_API_KEY, "COMPOSIO_API_KEY");
-  const composio = new Composio({ apiKey });
+  const composio = new Composio({
+    allowTracking: false,
+    apiKey,
+    baseURL: "https://backend.composio.dev",
+  });
   await deleteConnectedAccount(composio, record.composioConnectionId);
   await deleteUserIntegration(input.db, {
     integration: input.integration,

apps/webhooks-worker/src/analytics-watchdog.ts

@@ -161,7 +161,7 @@ async function queryAnalyticsEngine(input: {
   return parseSqlResponse(await response.json()).data;
 }
 
-async function postInternalAlert(
+export async function postInternalAlert(
   env: AnalyticsWatchdogEnv,
   alert: InternalAlertPayload,
 ): Promise<void> {