fix: harden per-user migration — 9 audit-confirmed defects

Adversarial re-review of the shipped migration found 9 correctness bugs
(all in agent-worker + db + tools-docs). Fixes:

HIGH
- concurrency: free-tier users could not create a 2nd project — the shared
  per-user sandbox counted against maxConcurrentSandboxes. Reuse of an
  already-attached sandbox no longer consumes a concurrent slot.
- console: processRecordsForRead exact-only — no more sibling-project log leak.
- slug: reserve 'app' so a new 'app'-named project can't collide with the
  /workspace/app legacy sentinel (delete would rm -rf the shared folder).

MEDIUM
- db: partial unique index (user_id, workspace_slug) + createProject 23505
  retry; migration 0012 backfills legacy null slugs first (p-<id>).
- tools-docs: write the in-sandbox deliverable to runtimeContext.workspaceDir
  (was a name heuristic over the whole /workspace -> wrong project's folder).
- mobile: guard the post-build Metro restart (transient error no longer fails
  a successful build).

LOW / hygiene
- slug-less general/direct-code runs use /workspace/app (slot parity w/ wake).
- IDE file list scoped to the project's folder (was all of /workspace).
- account deletion also tears down pre-migration per-project sandboxes.

Gate: turbo lint typecheck build 64/64 green; migration 0012 verified locally.

Author: iamjr15

apps/agent-worker/src/durable-objects/agent-run-mastra-stream.ts

@@ -63,7 +63,11 @@ export async function runMastraStream(options: MastraStreamOptions): Promise<voi
           {
             artifacts: options.artifactRuntime,
             sandbox,
-            workspaceDir: input.workspaceSlug ? `/workspace/${input.workspaceSlug}` : "/workspace",
+            // Slug-less fallback is "/workspace/app" (not "/workspace") so deriveWorkspaceSlug
+            // yields "app", matching what wake/status/console normalize a null slug to.
+            workspaceDir: input.workspaceSlug
+              ? `/workspace/${input.workspaceSlug}`
+              : "/workspace/app",
           },
           {
             agentDisplayName: input.agentDisplayName,

apps/agent-worker/src/durable-objects/agent-run-run-code-fallback.ts

@@ -26,7 +26,8 @@ export async function runRunCodeFallback({
   setRunStage("Running Python in the sandbox after model timeout.");
   const result = await executeRunCodeTool(createSandboxReadinessRunCodeInput(input.messageText), {
     sandbox,
-    workspaceDir: input.workspaceSlug ? `/workspace/${input.workspaceSlug}` : "/workspace",
+    // Slug-less fallback is "/workspace/app" so the slot matches wake/status/console (null → "app").
+    workspaceDir: input.workspaceSlug ? `/workspace/${input.workspaceSlug}` : "/workspace/app",
   });
   await append({
     type: "text-delta",

apps/agent-worker/src/durable-objects/agent-run.ts

@@ -498,7 +498,10 @@ export class AgentRun extends DurableObject<AgentRunEnv> {
           logger,
           sandbox,
           setRunStage: (stage) => this.setRunStage(stage),
-          ...(input.workspaceSlug ? { workspaceDir: `/workspace/${input.workspaceSlug}` } : {}),
+          // Slug-less fallback is "/workspace/app" so the dev-server slot matches wake/status/console.
+          workspaceDir: input.workspaceSlug
+            ? `/workspace/${input.workspaceSlug}`
+            : "/workspace/app",
         },
         directRunCodeInput,
       );
@@ -588,14 +591,22 @@ export class AgentRun extends DurableObject<AgentRunEnv> {
     // stream is done to re-crawl the finished app onto the (unchanged) preview URL. Web/Next.js
     // hot-reloads via polling and needs no restart.
     if (input.projectMode === "app-builder-mobile") {
-      await restartMobilePreview({
-        append: (chunk) => this.append(chunk),
-        env: this.env,
-        input,
-        logger,
-        sandbox,
-        setRunStage: (stage) => this.setRunStage(stage),
-      });
+      // Best-effort: the answer already streamed and the preview URL is stable, so a transient
+      // Daytona control-plane error here must not flip an already-successful mobile run to failed.
+      try {
+        await restartMobilePreview({
+          append: (chunk) => this.append(chunk),
+          env: this.env,
+          input,
+          logger,
+          sandbox,
+          setRunStage: (stage) => this.setRunStage(stage),
+        });
+      } catch (error) {
+        logger.warn("mobile_preview_restart_failed", {
+          error: error instanceof Error ? error.message : String(error),
+        });
+      }
     }
     await snapshotAppBuilderWorkspace({
       env: this.env,

apps/agent-worker/src/durable-objects/project-sandbox.ts

@@ -1396,25 +1396,12 @@ export class ProjectSandbox extends DurableObject<ProjectSandboxEnv> {
     return parsed.success ? parsed.data : null;
   }
 
+  // Exact slot only: the console route always sends a fully-qualified `app-preview:<slug>` (null
+  // slugs normalized to `app-preview:app`), so any sibling-slot fallback would leak another
+  // project's dev-server logs into this project's Console. A missing record yields an empty snapshot.
   private async processRecordsForRead(name: string): Promise<NamedProcessRecord[]> {
     const exact = await this.processRecord(name);
-    const records = await this.ctx.storage.list({ prefix: PROC_PREFIX });
-    const fallback: NamedProcessRecord[] = [];
-    for (const [key, value] of records) {
-      const parsed = ProcessRecordSchema.safeParse(value);
-      if (!parsed.success) {
-        continue;
-      }
-      const candidate = { name: key.slice(PROC_PREFIX.length), record: parsed.data };
-      if (candidate.name === CODE_SERVER_PROCESS_ID) {
-        continue;
-      }
-      if (candidate.name !== name) {
-        fallback.push(candidate);
-      }
-    }
-    fallback.sort((left, right) => compareProcessRecords(left.record, right.record));
-    return exact ? [{ name, record: exact }, ...fallback] : fallback;
+    return exact ? [{ name, record: exact }] : [];
   }
 
   private async deleteProcessRecord(id: string, name: string): Promise<void> {
@@ -1499,10 +1486,6 @@ function isFailedState(state: string): boolean {
   return state === "error" || state === "build_failed";
 }
 
-function compareProcessRecords(left: ProcessRecord, right: ProcessRecord): number {
-  return (right.startedAtMs ?? 0) - (left.startedAtMs ?? 0);
-}
-
 function isMissingDaytonaProcessError(error: unknown): boolean {
   return error instanceof DaytonaApiError && (error.status === 404 || error.status === 410);
 }

apps/agent-worker/src/index.ts

@@ -12,6 +12,7 @@ import { AgentWorkerEnvSchema, type WorkerSecret } from "@cheatcode/env";
 import {
   type AnalyticsBindings,
   APIError,
+  createLogger,
   emitErrorEvent,
   emitPerformanceMetric,
   toAPIError,
@@ -77,6 +78,7 @@ import { parseCreateRunRequestBody } from "./run-request";
 import {
   GatewayUserIdSchema,
   isUuidRouteParam,
+  legacyProjectSandboxName,
   parseRunRouteParam,
   parseThreadRouteParam,
   readGatewayUserId,
@@ -303,6 +305,9 @@ agentApp.post("/internal/users/:userId/delete-state", async (c) => {
   if (body.scope === "account") {
     await sandbox.destroySandbox();
     await sandbox.deleteDurableState();
+    // Also reclaim any pre-migration per-project sandboxes (keyed by the old projectSandboxName)
+    // so a deleted user's code/files never persist on Daytona after the one-sandbox-per-user cutover.
+    await destroyLegacyProjectSandboxes(c.env, userId, body.projects);
     projectStatesDeleted = body.projects.length;
   } else {
     for (const project of body.projects) {
@@ -323,6 +328,29 @@ agentApp.post("/internal/users/:userId/delete-state", async (c) => {
   );
 });
 
+// Best-effort teardown of pre-migration per-project sandboxes on account deletion. Addressing a
+// legacy DO that never existed just yields a fresh idle stub whose destroy is a no-op; a missing
+// Daytona sandbox is tolerated so one failure can't block reclaiming the others.
+async function destroyLegacyProjectSandboxes(
+  env: AgentEnv,
+  userId: string,
+  deletedProjects: ReadonlyArray<{ id: string }>,
+): Promise<void> {
+  for (const project of deletedProjects) {
+    try {
+      const legacyName = await legacyProjectSandboxName(userId, project.id);
+      const legacy = env.PROJECT_SANDBOX.get(env.PROJECT_SANDBOX.idFromName(legacyName));
+      await legacy.destroySandbox();
+      await legacy.deleteDurableState();
+    } catch (error) {
+      createLogger().warn("legacy_project_sandbox_teardown_failed", {
+        error: error instanceof Error ? error.message : String(error),
+        projectId: project.id,
+      });
+    }
+  }
+}
+
 agentApp.get("/v1/outputs/:outputId/download", async (c) => {
   const parsedOutputId = OutputIdSchema.safeParse(c.req.param("outputId"));
   if (!parsedOutputId.success) {
@@ -609,16 +637,18 @@ agentApp.get("/v1/threads/:threadId/sandbox/ide", async (c) => {
   const sandbox = project
     ? await sandboxForProject(c.env, userId, project.id)
     : await sandboxForThread(c.env, userId, threadId);
-  const files = await sandbox.listFiles({
-    includeHidden: false,
-    path: SANDBOX_WORKSPACE_ROOT,
-    recursive: true,
-  });
   // Per-user "computer": a project chat opens its own folder (/workspace/<slug>, header = slug);
   // a project-less chat opens the whole computer root (/workspace, relabelled "COMPUTER").
   const workspacePath = project?.workspaceSlug
     ? workspacePathForSlug(project.workspaceSlug)
     : SANDBOX_WORKSPACE_ROOT;
+  // List only the opened project's folder — a recursive walk of the whole /workspace root would let
+  // a sibling project's node_modules exhaust the entry cap before reaching this project's source.
+  const files = await sandbox.listFiles({
+    includeHidden: false,
+    path: workspacePath,
+    recursive: true,
+  });
   const initialFilePath = project
     ? selectInitialCodeServerFile(files.files, workspacePath)
     : undefined;

apps/agent-worker/src/tenancy.ts

@@ -68,3 +68,13 @@ export async function userSandboxName(userId: string): Promise<string> {
   );
   return `${SANDBOX_ID_PREFIX}-${toHex(digest).slice(0, SANDBOX_ID_HEX_LENGTH)}`;
 }
+
+// Pre-migration per-PROJECT sandbox name (one sandbox per project). Retained solely so account
+// deletion can also tear down sandboxes provisioned before the one-sandbox-per-user migration.
+export async function legacyProjectSandboxName(userId: string, projectId: string): Promise<string> {
+  const digest = await crypto.subtle.digest(
+    "SHA-256",
+    textEncoder.encode(JSON.stringify(["project-sandbox", userId, projectId])),
+  );
+  return `${SANDBOX_ID_PREFIX}-${toHex(digest).slice(0, SANDBOX_ID_HEX_LENGTH)}`;
+}

apps/web/next-env.d.ts

@@ -1,6 +1,6 @@
 /// <reference types="next" />
 /// <reference types="next/image-types/global" />
-import "./.next/dev/types/routes.d.ts";
+import "./.next/types/routes.d.ts";
 
 // NOTE: This file should not be edited
 // see https://nextjs.org/docs/app/api-reference/config/typescript for more information.

packages/db/drizzle/0012_marvelous_vertigo.sql

@@ -0,0 +1,6 @@
+-- Backfill legacy null slugs FIRST so (a) the partial unique index can build and (b) pre-migration
+-- projects stop collapsing onto the shared /workspace/app sentinel. 'p-' + the row's own uuid (hex,
+-- dashless) is globally unique, so no per-user collision and no clash with name-derived slugs.
+UPDATE "v2_projects" SET "workspace_slug" = 'p-' || replace("id"::text, '-', '') WHERE "workspace_slug" IS NULL;
+--> statement-breakpoint
+CREATE UNIQUE INDEX "v2_projects_user_workspace_slug_uidx" ON "v2_projects" USING btree ("user_id","workspace_slug") WHERE workspace_slug is not null;