revert(sandbox): remove shared agent sandboxes and the staging default

[tlgimenes]

Summary

Reverts #5112 (share agent sandboxes by branch), #5116 (always share agent sandboxes) and #5132 (use shared staging branch), restoring the pre-#5112 behaviour: hosted agent sandboxes are per-user again, and a new GitHub-backed thread gets a generated branch instead of staging.

This is R1 (code only). The two tables stay in place — see Migrations and Deploy order. It must not ship before the drain (below).

Why it isn't a git revert

None of the three commits reverse-apply. Measured against origin/main: reverting #5112 alone produces 33 conflicted paths, and resurrects three files at the dead apps/mesh/ path.

• refactor(studio): split API and web workspaces #5120 split apps/mesh into apps/api + apps/web, and also hoisted branch-name.ts, runtime-defaults.ts and thread/schema.ts into packages/shared — which is where DEFAULT_WORKSPACE_BRANCH = "staging" lives, i.e. the whole point of feat(sandbox): use shared staging branch #5132.
• refactor(api): remove dead legacy /api/vm-events route #5174 deleted vm-events.ts outright, so feat(sandbox): share agent sandboxes by branch #5112's largest single-file hunk (+180) has no target.

So each file was reconstructed against its current path, using git show 5b0d71784:<old-path> as the specification, then diffed back against that baseline to prove convergence.

The load-bearing change

SandboxId returns to a flat { userId, projectRef } and sandboxIdKey to `${userId}:${projectRef}`. The claim handle is slugify(branch)-sha256(idKey).slice(0,16), so every live shared claim gets a different address the moment this deploys.

• t=0 — split brain, not an outage: the old hostname still resolves and serves the old shared pod, while each user's next start provisions a second per-user pod on the same git branch. ~2× pod count.
• t≈+15min — the operator's idle TTL reaps the orphaned claim + Service. Its HTTPRoute has no ownerReferences and is only removed by deleteHttpRouteIfManaged, whose call path this PR deletes → the Route leaks and 502s.

Uncommitted work is mostly safe: the daemon registers SIGTERM → shutdown() → publish(...) (packages/sandbox/daemon/entry.ts:919-960, covered by daemon.git.e2e.test.ts:174), and the operator's teardown is an ordinary Delete → SIGTERM within the grace period.

Required before deploy

1. Quiesce new starts, then wait for every provisioning row to reach ready so it has a handle.
2. Drain every agent_sandbox_sessions row on the current code (the teardown paths are deleted by this PR). Note SANDBOX_DELETE marks rows terminal even when it deleted nothing — a NULL-handle row skips runner.delete, and a rejection is swallowed. "Zero non-terminal rows" is not a completion signal; only the kubectl check is.
3. Sweep leaked routes: kubectl -n <ns> delete httproute -l 'studio.decocms.com/role=claimed,studio.decocms.com/org-id,!studio.decocms.com/user-id' (the org-id term matters — !user-id alone also matches tenant-less internal sandboxes).
4. Sweep stale sandboxMap entries. fix(sandbox): stop trusting legacy agent-sandbox entries on the agent row #5225's message records ~1789 leftover agent-sandbox cells on agent rows. They're inert today; after this PR they are authoritative again and point at long-reaped claims. Strip the agent-sandbox and legacy cluster keys from each branch cell (keep user-desktop) on the old code, where it's behaviourally a no-op.

Migrations

Both migrations are pure CREATE TABLE — neither alters a pre-existing table, so nothing is lossy. They are kept, byte-identical, along with their index.ts entries.

Deleting them would crash-loop every pod. In kysely@0.28's migrator.js, #ensureNoMissingMigrations runs at :447 — unconditionally, outside the allowUnorderedMigrations gate at :448 — and throws corrupted migrations: previously executed migration ... is missing at :495. So allowUnorderedMigrations: true would not help. Migrations run on boot (settings/pipeline.ts:50); nothing under deploy/ or selfhost/ sets --skip-migrations.

CI would not catch it: storage-integration.yml migrates a fresh Postgres from an empty ledger, and migrations/index.test.ts only checks file↔registration parity, so deleting file and entry together passes both.

The tables are dropped by a follow-up forward migration 145-drop-agent-sandbox-tables.ts in R2, after R1 has fully rolled out. Worth doing rather than leaving them dormant: agent_sandbox_runner_state.state holds plaintext credentials (an x-access-token:ghs_… clone URL, submodule tokens, the env bag) and has no organization FK, so nothing ever GCs it.

Deploy order

R1 = this PR (tables left in place, harmless — nothing reads them). R2 = migration 145. Same-release drops mean an old pod hits relation "agent_sandbox_sessions" does not exist on every SANDBOX_START; the chart runs migrations from the app CMD, so there's no natural barrier. Two releases also buy a rollback window.

Also reverted

These exist only inside the shared model:

PR	Note
#5225	The dangerous one. withoutLegacyAgentSandboxEntries strips exactly the agent-sandbox sandboxMap entries the reverted server writes back, while the session graft that compensated is gone — vmEntry permanently null → shouldAutoStart permanently true → SANDBOX_START on every mount and branch switch. It compiles fine; nothing but a deliberate decision catches it.
#5219	resolveSharedThreadVm + the shared-scope branch. Its hoist of the unconditional thread-map cleanup is kept — that bug is scope-independent and pre-dates sharing.
#5183	Stale-provisioning reset; lived inside the deleted storage class.

Deliberately preserved

• fix(sandbox): serialize publish/rebase per claim to stop shared-sandbox races #5114/fix(sandbox): serialize git/discard on the same claim lock as publish/rebase #5118 withClaimGitLock, fix(virtual-mcp): require org context for id-scoped legacy MCP requests #5126 org-context guard, fix(threads): skip chat_started analytics on an id-collision replay #5143 analytics gate, fix(chat): refresh read-only teammate thread metadata so preview finds the repo #5171 owner-keyed thread graft, fix(sandbox): auto-retry transient SANDBOX_START failures without a refresh #5195/fix(sandbox): surface terminal claim failure so preview stops spinning forever #5207/fix(sandbox): auto-retry transient claim failures before showing errored #5210/fix(sandbox): scope the claim auto-retry budget to the active branch #5221 client auto-retry, the daemon status-code train (fix(sandbox): return 409 instead of 500 for publish refusals on detached HEAD/protected branch #5109/fix(sandbox): stop discard from deleting renamed files with no recovery #5124/fix(sandbox): return 409 instead of 500 for a blocked rebase #5134/fix(sandbox): return 400 instead of 500 when the diff base branch isn't on origin #5142/fix(sandbox): return 400 instead of 500 when the rebase base branch isn't on origin #5144/fix(sandbox): return 400 instead of 500 for non-string entries in git/discard filepaths #5150/fix(sandbox): reject empty base string in git/diff POST endpoint #5175/fix(sandbox): return 400 instead of 500 for empty-string entries in git/discard filepaths #5189/fix(sandbox): return 409 instead of 500 for tokenless GitHub publish #5211), the settings-validation train.
• feat(sandbox): share agent sandboxes by branch #5112's incidental hardening: the org-fs mount key stays narrowed to { self: ["ORG_FS_READ", "ORG_FS_WRITE"] } (reverting would re-bake a full-management key into every sandbox pod), and sandboxProviderKind stays in the start dedup key.
• refactor(sandbox): always share agent sandboxes #5116's squashed queue-tray pluralization (en + pt-br).
• The remote-branch-name validations feat(sandbox): use shared staging branch #5132 deleted (isValidRemoteBranchName in clone.ts, assertValidRemoteBranchName in checkout-branch.ts). feat(sandbox): use shared staging branch #5132 removed them as dead once the base was a constant; this PR restores the dynamic, remote-controlled origin/HEAD lookup, so they are load-bearing again. This is the one place a naive revert silently drops hardening.

Testing

• bun run check, bun run lint (0 errors), bun run fmt — clean.
• Sandbox unit tests: 499 pass, 0 fail.
• apps/web: 23 failures — the identical set as origin/main (pre-existing); the 6-test delta is exactly the deleted agent-sandbox-map.test.ts.
• apps/api + packages: 245 pre-existing failures on both branches (integration tests needing Postgres/NATS). 0 new; 1 gone — the deleted shared-sandbox integration test.
• Convergence: every reconstructed file diffed against its 5b0d71784 blob. Residuals are only refactor(studio): split API and web workspaces #5120 specifier rewrites plus the preserved work listed above.
• Tests inverted rather than appended, per the repo checklist: start.test.ts asserts { userId, projectRef } again, handle.test.ts drops the shared/user isolation cases, runtime-defaults.test.ts drops the staging/main assertions, and chat-locked-thread.spec.ts is back to the pickWarmBranchFromSandboxMap → generateBranchName() wording.

Not run locally: real-Postgres integration tests and the Playwright e2e suite — CI covers both.

Open items

1. Threads pinned to branch = 'staging' (persisted column, storage/types.ts:945/:1032). Post-revert two members get separate pods on the same branch, and the second non-force git push -u origin staging is rejected non-fast-forward — a failure mode that didn't exist pre-feat(sandbox): use shared staging branch #5132, when every thread had a unique generated branch. Do not null the column (that orphans the origin/staging work and breaks existingThread?.branch ?? input.branch). Either accept with a release note, or rewrite to per-thread names after pushing each staging workspace. Needs a decision + the row counts.
2. Are fix(sandbox): force-reprovision a provisioning session orphaned by a crashed start #5183/fix(sandbox): emit gone for orphaned thread sandboxes on shared scope #5219/fix(sandbox): stop trusting legacy agent-sandbox entries on the agent row #5225 intentionally lost? They fixed real symptoms ("preview stuck on Reserving sandbox", "works for me, stuck for you"). Confirm they can't recur in the per-user model.
3. 404 grace: useAgentSandboxSession polled /api/:org/agent-sandbox-sessions/:vmid every 5s. Already-loaded tabs will 404 until reload. Optionally leave the route mounted returning an empty list for one release.
4. Colliding open PRs on the branch-selection surface: fix(chat): New chat always creates, on the current branch #5231, feat(cms): fast preview via preview server + branch-aware new chat #5215, feat(header): branch label, truncation priority, and icon-only actions below lg #5230, feat(web): move branch selector into the toolbar breadcrumb #4556.
5. Branch protection on staging? The daemon's protectedBranches() is {main, master, origin/HEAD default}, so staging was freely pushable — if a customer has since protected it, post-revert publishes fail differently.

🤖 Generated with Claude Code

---

Summary by cubic

Reverts shared agent sandboxes and the staging default. Sandboxes are per-user again, and new GitHub-backed threads pick a warm branch or get a generated name.

• Refactors

  • Restores per-user identity: SandboxId is { userId, projectRef } and sandboxIdKey is userId:projectRef. computeClaimHandle now hashes userId:projectRef, so existing shared handles will change.
  • Removes the shared session model: deletes the agent-sandbox-sessions API/routes/storage and related client hooks; provider resolution no longer looks up shared sessions and uses the acting user’s sandboxMap instead.
  • Branch defaults: thread creation now picks the most-recently-touched branch from the user’s sandboxMap, falling back to generateBranchName; the fixed staging/main defaults are removed; daemon base-branch logic reads origin/HEAD and validates remote ref names.
  • Tooling and UI: drops shared-only secret restrictions; dev-connection resolves only to the acting user’s sandbox; branch picker/use-branches no longer depend on shared sessions; adds readCachedTaskBranch to carry the active task’s branch into new threads; keeps fix(chat): New chat always creates, on the current branch #5231’s caller-passed branch param path; generates a branch on publish when missing.

• Migration

  • Keep the shared-session tables and migration entries in place for now to avoid migrator errors; a follow-up migration will drop them.
  • Before deploy, drain existing shared agent sandboxes so leaked routes and double provisioning don’t occur; sweep any orphaned HTTP routes after the drain.
  • Expect claim handles to change on first start post-deploy, provisioning per-user pods on the same branch.

^{Written for commit d0c070b. Summary will update on new commits.}