feat(sandboxes): add application operations, v2 API, and CLI commands - #7442
feat(sandboxes): add application operations, v2 API, and CLI commands#7442icecrasher321 wants to merge 7 commits into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
@cubic-dev-ai review this PR |
Greptile SummaryThis PR moves sandbox management behind shared application operations and adds internal, V2 API, CLI, permission-group, audit, build-admission, and execution-entitlement support.
Confidence Score: 5/5The PR appears safe to merge because no blocking failure remains within the eligible follow-up-review scope. No blocking failure remains.
|
| Filename | Overview |
|---|---|
| apps/sim/lib/sandboxes/application/use-cases.ts | Defines the shared authorized sandbox operations, plan checks, build admission, and semantic audit projections. |
| apps/sim/lib/execution/remote-sandbox/workspace-sandboxes.ts | Adds sorted cursor pagination, orchestration error classification, and write-admission hooks to sandbox persistence. |
| apps/sim/lib/execution/remote-sandbox/resolve.ts | Enforces cached terminal-plan retention eligibility before resolving a selected workspace sandbox. |
| apps/sim/app/api/v2/sandboxes/route.ts | Adds contracted V2 list and create adapters with cursor binding, authorization, and error policies. |
| apps/sim/app/api/v2/sandboxes/[sandboxId]/route.ts | Adds contracted V2 get, update, and delete adapters with workspace-scoped application operations. |
| packages/sim-cli/src/runtime/request.ts | Extends list argument coercion to support manifest files containing blank lines and comments. |
Sequence Diagram
sequenceDiagram
participant Client as Settings / V2 API / Copilot
participant Route as Route Adapter
participant UseCase as Authorized Sandbox Use Case
participant Auth as Workspace Authorization
participant Plan as Plan and Build Admission
participant Store as Sandbox Store
Client->>Route: list/read/create/update/delete
Route->>UseCase: validated input and principal
UseCase->>Auth: verify workspace role and capability
Auth-->>UseCase: authorized context
alt create, update, or delete
UseCase->>Plan: enforce plan entitlement
end
alt create or update
UseCase->>Plan: consume workspace build admission
end
UseCase->>Store: perform sandbox operation
Store-->>UseCase: sandbox result
UseCase-->>Route: result and semantic audit projection
Route-->>Client: contracted response
Reviews (7): Last reviewed commit: "fix(cli): state inline list semantics be..." | Re-trigger Greptile
@icecrasher321 I have started the AI code review. It will take a few minutes to complete. |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed across 60 files
Not reviewed (too large): apps/docs/openapi-v2-resources.json (~1,834 lines) - if these are generated or fixture files, add them to ignored paths to exclude them from future reviews.
Reply with feedback, questions, or to request a fix.
Fix all with cubic | Re-trigger cubic
868c87a to
116924a
Compare
|
@cubic-dev-ai review this PR |
@icecrasher321 I have started the AI code review. It will take a few minutes to complete. |
There was a problem hiding this comment.
All reported issues were addressed across 65 files
Not reviewed (too large): apps/docs/openapi-v2-resources.json (~1,834 lines) - if these are generated or fixture files, add them to ignored paths to exclude them from future reviews.
Reply with feedback, questions, or to request a fix.
Fix all with cubic | Re-trigger cubic
116924a to
45c2beb
Compare
|
@cubic-dev-ai review this PR |
@icecrasher321 I have started the AI code review. It will take a few minutes to complete. |
There was a problem hiding this comment.
All reported issues were addressed across 65 files
Not reviewed (too large): apps/docs/openapi-v2-resources.json (~1,834 lines) - if these are generated or fixture files, add them to ignored paths to exclude them from future reviews.
Reply with feedback, questions, or to request a fix.
Fix all with cubic | Re-trigger cubic
45c2beb to
9d0bb69
Compare
|
@cubic-dev-ai review this PR |
@icecrasher321 I have started the AI code review. It will take a few minutes to complete. |
There was a problem hiding this comment.
All reported issues were addressed across 65 files
Not reviewed (too large): apps/docs/openapi-v2-resources.json (~1,836 lines) - if these are generated or fixture files, add them to ignored paths to exclude them from future reviews.
You've manually re-run cubic several times on this PR. Each manual re-review checks the full PR again and counts toward your usage quota. To preserve your usage limits, we recommend letting cubic automatically review new commits.
Fix all with cubic | Re-trigger cubic
9d0bb69 to
8cbef13
Compare
|
@cubic-dev-ai review this PR |
@icecrasher321 I have started the AI code review. It will take a few minutes to complete. |
There was a problem hiding this comment.
All reported issues were addressed across 65 files
Not reviewed (too large): apps/docs/openapi-v2-resources.json (~1,836 lines) - if these are generated or fixture files, add them to ignored paths to exclude them from future reviews.
You've manually re-run cubic several times on this PR. Each manual re-review checks the full PR again and counts toward your usage quota. To preserve your usage limits, we recommend letting cubic automatically review new commits.
Fix all with cubic | Re-trigger cubic
…space ids on item routes, read manifest files in the CLI
…ng runtime installs as images
…urces document a name-collision conflict example
… shared conflict example generic
8cbef13 to
9033345
Compare
|
@cubic-dev-ai review this PR |
@icecrasher321 I have started the AI code review. It will take a few minutes to complete. |
There was a problem hiding this comment.
No issues found across 65 files
Confidence score: 5/5
- Automated review surfaced no issues in the provided summaries.
- No files require special attention.
Not reviewed (too large): apps/docs/openapi-v2-resources.json (~1,836 lines) - if these are generated or fixture files, add them to ignored paths to exclude them from future reviews.
You've manually re-run cubic several times on this PR. Each manual re-review checks the full PR again and counts toward your usage quota. To preserve your usage limits, we recommend letting cubic automatically review new commits.
Re-trigger cubic
1 participant
Summary
sandboxes.list|read|create|update|deletewith authorized use cases, the Max-plan gate and the per-workspace build budget as domain admission, and semantic audit entriesdefineInternalJsonRouteand delete the route-local authorizer; wire themanage_sandboxtool throughcreateCopilotApplicationAdapter/api/v2/sandboxes(list, create, get, update, delete) with contracts and OpenAPI docs, which generates thesim sandboxesCLI commandssandboxes.usepermission-group capability (hideSandboxesTab), declared on every operation, with the settings tab hidden for restricted cohortspast_duekeeps running; the check is cached per worker and fails open on a billing outageBehavior changes:
manage_sandboxlist runs at read role, is not plan-gated, and reportsentitledType of Change
Testing
bunx turbo run type-check(all workspaces),bun run lint,bun run check:audits(45 audits, includingcheck:openapi,check:api-validation:strict,check:permission-group-enforcement,check:cli-api,check:cli-docs),docs-manifest:check,check:migrations origin/stagingChecklist