fix(artifacts): use file-backed sandbox transport

[iamjr15]

Why

Real research reports can produce document binaries large enough to make stdout an unreliable artifact transport. The sandbox renderer previously base64-encoded the entire binary into stdout and the host reparsed that stream as JSON, which caused production research PDF generation to fail with invalid artifact metadata.

What changed

• write generated document bytes to a bounded project-local staging file
• emit only a small, marker-delimited metadata record over stdout
• require the reported path to exactly match the host-selected staging path
• read artifact bytes through the sandbox file API before workspace and R2 persistence
• delete both staged input and output in finally
• remove the old stdout/base64 compatibility path entirely
• document the file-backed renderer protocol

Architecture / migration effects

• No database or migration changes
• No new dependency or deployment configuration
• The document renderer control channel and binary data channel are now separated

Verification

• pnpm lint
• pnpm typecheck
• pnpm turbo build --force
• pnpm deadcode (passes; four existing Knip configuration hints remain)
• pnpm architecture:check
• pnpm turbo skills:build
• Live Daytona sandbox: rendered a 16-page research-style Markdown PDF (77,026 bytes)
• Live Daytona sandbox: rendered and identified DOCX, PDF, PPTX, and XLSX outputs
• Confirmed renderer stdout contains only path-bound metadata
• Confirmed exact input and output staging files are deleted after rendering

Local verification used Node 26.4.0 while the repository pins Node 24.18.0; pnpm emitted the existing engine warning, and all checks passed.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
cheatcode	Skipped		Aug 5, 2026 10:49am