feat: harden project files and runtime capability boundaries

[iamjr15]

Summary

• Makes uploaded project files visibly attach in the composer and keeps them reusable through / after reload, while preserving @ for skills only.
• Replaces the deployment-wide skill runtime token secret with rotating, run/user/project/scope-bound opaque capabilities stored only as digests.
• Replaces shared internal HTTP secrets with named Cloudflare RPC service bindings and removes webhook replay and audit-archive machinery.
• Derives public preview configuration from deployment identity and reduces the required environment surface.

What's Included

Project file experience

• Shows a visible uploaded-file chip in the composer with an accessible status label.
• Keeps project files addressable through the slash command across chats and reloads.
• Removes the persistent “available in every chat” message.
• Improves project-picker and tooltip positioning, focus behavior, viewport handling, and reduced-motion behavior.

Skill runtime authorization

• Mints independent opaque capabilities for events, integrations, and skill read/write access.
• Stores SHA-256 digests plus run, user, project, scope, and expiry constraints on v2_agent_runs.
• Rotates capabilities every 10 minutes, expires them after 15 minutes, bounds retained digests, and clears them when a run reaches a terminal state.
• Uses a fixed production gateway callback from Daytona so local runs exercise the same backend path as production.
• Removes SKILL_RUNTIME_TOKEN_SECRET and SKILL_RUNTIME_BASE_URL.

Internal service boundaries

• Adds named Cloudflare RPC entrypoints for gateway → webhooks resource deletion and webhooks → agent lifecycle operations.
• Removes the corresponding shared-secret HTTP maintenance routes.
• Removes webhook replay completely, including its secret and operator surface.
• Removes audit-archive workflows, scripts, credentials, and partition-maintenance machinery while retaining the core audit log.

Configuration and schema

• Removes NEXT_PUBLIC_PREVIEW_HOSTNAME; the web app derives localhost locally and the production apex on Vercel.
• Retains the preview worker's server-side PREVIEW_HOSTNAME routing/audience contract.
• Regenerates the clean V2 database baseline and updates runtime-role grants, contracts, env schemas, deployment config, and package documentation.
• Removes unused Turbo remote-cache configuration.

Architecture

flowchart LR
  LocalAgent[Local agent run] -->|store scoped digests| DB[(Production Supabase)]
  LocalAgent -->|project raw capabilities| Daytona[Daytona sandbox]
  Daytona -->|fixed production gateway + capability| AgentWorker[Production agent worker]
  AgentWorker -->|RLS-scoped digest verification| DB

  Gateway[Gateway worker] -->|ResourceDeletionEntrypoint RPC| Webhooks[Webhooks worker]
  Webhooks -->|AgentLifecycleEntrypoint RPC| AgentWorker

Loading

Decisions Made

Decision	Rationale
Opaque per-run capabilities instead of a global signing secret	Compromise of one token cannot mint another token or cross run, user, project, or scope boundaries.
Shared production run state instead of local-only verifier state	Local Daytona sandboxes intentionally call the production gateway and need the same authorization path users exercise.
Named RPC entrypoints instead of internal bearer secrets	The Cloudflare service-binding topology expresses caller and capability boundaries without long-lived application secrets.
Derived public preview host instead of a browser env variable	The public host is deployment identity, not secret configuration.
Clean baseline regeneration instead of compatibility migrations	This is the clean V2 implementation and does not preserve removed replay/archive contracts.

Edge Cases Covered

• Expired, stale, wrong-scope, wrong-project, wrong-user, and inactive-run capabilities are rejected.
• Capability rotation allows bounded overlap without leaving terminal runs authorized.
• Uploaded-file discovery survives reload and preserves version listing.
• Slash file selection and at-sign skill selection remain separate.
• Tooltip geometry handles viewport edges, scroll/resize, keyboard focus, and reduced motion.

Rollout

The production database was checked read-only and does not yet contain the new skill_runtime_capabilities column. Deployment must coordinate:

1. Clean production database baseline/reprovision.
2. Updated Daytona sandbox snapshot.
3. Agent Worker and dependent Worker releases.

The new capability path should be smoke-tested immediately after those three pieces are live. This PR does not mutate production or deploy services by itself.

How to Review

1. Start with packages/db/src/skill-runtime-capabilities.ts and the skill-runtime auth/capability changes.
2. Review the new Cloudflare entrypoints and Worker service-binding configuration.
3. Review the composer upload status, slash-file behavior, and preview host derivation.
4. Confirm the clean database baseline, env surface, documentation, and intended deletions.

Verification

• pnpm typecheck
• pnpm lint
• pnpm build
• pnpm architecture:check
• pnpm deadcode
• Sandbox skill runtime TypeScript check
• Drizzle generation (No schema changes)
• Commit-time Biome staged check and commitlint
• Local Compose health on the pinned Node 22.22.2 runtime
• Direct authenticated browser QA: upload returned 201, file list returned 200, visible attachment status rendered, reload preserved / file discovery, and @ remained skills-only
• Browser console review showed no application errors
• Coordinated production capability smoke test after schema, snapshot, and Worker rollout

Release Workflow Hardening

• Runs the Cloudflare deploy job under the protected Production environment.
• Rejects non-main dispatches and requires a successful exact-SHA Static Checks push run before checkout or dependency installation.
• Removes unused GitHub audit, migration, health-check, and Vercel configuration left by deleted workflows; retains only the currently consumed Cloudflare, gateway, and Daytona settings.
• Leaves the Daytona snapshot lifecycle unchanged.

Additional verification:

• Actionlint with ShellCheck across every workflow
• Confirmed main is protected and the Production environment allows protected branches only
• Confirmed the final GitHub secret and variable inventories contain only currently consumed settings

Dependency Automation

• Keeps Dependabot security updates enabled and independent from scheduled version-update limits.
• Changes scheduled checks from weekly to monthly across npm, sandbox npm, Docker, Python, and GitHub Actions.
• Groups minor and patch updates under short names so generated PR titles satisfy the repository title gate.
• Suppresses scheduled major-version PRs; major migrations remain deliberate engineering work.
• Caps scheduled update PRs to one or two per ecosystem configuration.
• Closes the 19 existing scheduled-update PRs; none referenced a security advisory, and all eight vulnerability alerts remain open.

Additional verification:

• Parsed and asserted the complete Dependabot policy shape for all five ecosystems
• Confirmed Dependabot security updates remain enabled
• Confirmed only this feature PR remains open