feat: harden project files and runtime capability boundaries

.env.example

@@ -14,12 +14,11 @@ CLERK_SECRET_KEY=sk_test_replace_me
 # Optional only when receiving Clerk webhooks in local development.
 CLERK_WEBHOOK_SIGNING_SECRET=
 
-# Local web routing. The real preview-proxy Worker is service-bound behind the
+# Browser-visible local routing configuration; these values are not secrets.
+# The real preview-proxy Worker is service-bound behind the
 # gateway and serves each sandbox on *.localhost:8787. No second preview domain
 # or cloud development deployment is required.
 NEXT_PUBLIC_GATEWAY_URL=http://127.0.0.1:8787
-NEXT_PUBLIC_PREVIEW_HOSTNAME=localhost
-NEXT_PUBLIC_VERCEL_GIT_COMMIT_SHA=development
 
 # Daytona development access.
 DAYTONA_API_KEY=
@@ -55,9 +54,4 @@ POLAR_PRODUCT_ID_MAX=
 DATABASE_CONTEXT_SIGNING_SECRET_AGENT=replace_with_a_distinct_32_byte_secret
 DATABASE_CONTEXT_SIGNING_SECRET_GATEWAY=replace_with_a_distinct_32_byte_secret
 DATABASE_CONTEXT_SIGNING_SECRET_WEBHOOKS=replace_with_a_distinct_32_byte_secret
-GATEWAY_TO_WEBHOOKS_RESOURCE_DELETION_SECRET=replace_with_a_distinct_32_byte_secret
-WEBHOOKS_TO_AGENT_LIFECYCLE_SECRET=replace_with_a_distinct_32_byte_secret
-INTERNAL_WEBHOOK_REPLAY_SECRET=replace_with_a_distinct_32_byte_secret
 OUTPUT_DOWNLOAD_SIGNING_SECRET=replace_with_a_distinct_32_byte_secret
-SKILL_RUNTIME_BASE_URL=https://gateway.trycheatcode.com/skill-runtime
-SKILL_RUNTIME_TOKEN_SECRET=replace_with_a_distinct_32_byte_secret

.github/dependabot.yml

@@ -1,21 +1,28 @@
 version: 2
 
+# Scheduled version updates stay deliberately low-volume. Dependabot security
+# updates remain enabled at repository level and are not constrained by these
+# version-update pull-request limits.
 updates:
   - package-ecosystem: npm
     directory: /
     schedule:
-      interval: weekly
-      day: monday
+      interval: monthly
       time: "04:00"
       timezone: Asia/Kolkata
-    open-pull-requests-limit: 10
+    open-pull-requests-limit: 2
     groups:
-      workspace-minor-and-patch:
+      workspace:
+        applies-to: version-updates
         patterns:
           - "*"
         update-types:
           - minor
           - patch
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - version-update:semver-major
 
   - package-ecosystem: npm
     directories:
@@ -27,46 +34,79 @@ updates:
       - /infra/containers/sandbox/extension-overrides/parquet-viewer
       - /infra/containers/sandbox/package-manager
     schedule:
-      interval: weekly
-      day: monday
+      interval: monthly
       time: "04:30"
       timezone: Asia/Kolkata
-    open-pull-requests-limit: 10
+    open-pull-requests-limit: 2
     groups:
-      sandbox-runtime-minor-and-patch:
+      sandbox:
+        applies-to: version-updates
         patterns:
           - "*"
         update-types:
           - minor
           - patch
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - version-update:semver-major
 
   - package-ecosystem: docker
     directory: /infra/containers/sandbox
     schedule:
-      interval: weekly
-      day: monday
+      interval: monthly
       time: "05:00"
       timezone: Asia/Kolkata
-    open-pull-requests-limit: 5
+    open-pull-requests-limit: 1
+    groups:
+      sandbox-image:
+        applies-to: version-updates
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - version-update:semver-major
 
   - package-ecosystem: pip
     directory: /infra/containers/sandbox
     schedule:
-      interval: weekly
-      day: monday
+      interval: monthly
       time: "05:15"
       timezone: Asia/Kolkata
-    open-pull-requests-limit: 5
+    open-pull-requests-limit: 1
+    groups:
+      python:
+        applies-to: version-updates
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - version-update:semver-major
 
   - package-ecosystem: github-actions
     directory: /
     schedule:
-      interval: weekly
-      day: monday
+      interval: monthly
       time: "05:30"
       timezone: Asia/Kolkata
-    open-pull-requests-limit: 5
+    open-pull-requests-limit: 1
     groups:
       actions:
+        applies-to: version-updates
         patterns:
           - "*"
+        update-types:
+          - minor
+          - patch
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - version-update:semver-major

.github/workflows/deploy-cloudflare.yml

@@ -8,14 +8,36 @@ concurrency:
   cancel-in-progress: false
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
   deploy:
     name: Deploy Workers
     runs-on: ubuntu-24.04
     timeout-minutes: 45
+    environment: Production
     steps:
+      - name: Require main
+        run: test "$GITHUB_REF" = "refs/heads/main"
+
+      - name: Require successful static checks for this commit
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          successful_runs="$(gh api --method GET \
+            "repos/${GITHUB_REPOSITORY}/actions/workflows/static-checks.yml/runs" \
+            --field branch=main \
+            --field event=push \
+            --field head_sha="$GITHUB_SHA" \
+            --field per_page=1 \
+            --field status=success \
+            --jq '.total_count')"
+          if [ "$successful_runs" -lt 1 ]; then
+            echo "Static Checks has not succeeded for $GITHUB_SHA on main." >&2
+            exit 1
+          fi
+
       - name: Checkout reviewed release
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
@@ -25,9 +47,6 @@ jobs:
         with:
           release-sha: ${{ github.sha }}
 
-      - name: Require main
-        run: test "$GITHUB_REF" = "refs/heads/main"
-
       - name: Build Worker release
         run: >-
           pnpm exec turbo run build

.github/workflows/static-checks.yml

@@ -226,10 +226,7 @@ jobs:
           CLERK_SECRET_KEY: sk_test_static_checks_do_not_authenticate
           NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: pk_test_c3RhdGljLWNoZWNrcy0wMC5jbGVyay5hY2NvdW50cy5kZXYk
           NEXT_PUBLIC_GATEWAY_URL: ${{ vars.NEXT_PUBLIC_GATEWAY_URL }}
-          NEXT_PUBLIC_PREVIEW_HOSTNAME: trycheatcode.com
-          NEXT_PUBLIC_VERCEL_GIT_COMMIT_SHA: ${{ github.sha }}
-          TURBO_TEAM: cheatcode
-          TURBO_TOKEN: ${{ github.event_name == 'push' && secrets.TURBO_TOKEN || '' }}
+          VERCEL_GIT_COMMIT_SHA: ${{ github.sha }}
         run: |
           set -Eeuo pipefail
           filters=()