fix(sandbox): enforce local runtime boundaries

[iamjr15]

Summary

• coordinate snapshot replacement around active agent-run leases so Computer-panel polling cannot fail a run during an upgrade
• prevent stale cleanup startup checks from marking an old snapshot as runtime-verified
• reject npm, npx, and yarn inside persistent projects with an explicit pnpm/local-runtime instruction
• make the general agent environment advertise pnpm as the JavaScript package manager

Production evidence

• Daytona sandbox is started on the exact active snapshot and has the expected persistent workspace mount
• the pre-fix DeepSeek run opened its sandbox lease in 3.4s, then ignored the prompt and spent roughly ten minutes using npm against the object-store mount
• generated dependency state was removed without touching project source, manifests, or lockfiles

Verification

• pnpm turbo typecheck lint build --force
• pnpm typecheck
• pnpm lint
• pnpm architecture:check
• pnpm deadcode
• git diff --check

Rollout QA

After merge and Cloudflare deployment, run a fresh production app-builder chat with DeepSeek V4 and verify the live preview through the Computer Browser tab.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
cheatcode	Skipped		Aug 3, 2026 1:18pm