fix(agent): make upload rehydration mount-safe

[iamjr15]

Why

Production recovery QA deliberately removed a disposable uploaded-file workspace cache while retaining its authoritative R2 version. The first rehydration implementation failed the run because Daytona's toolbox file plane and container mount can expose a write at slightly different times; permission hardening was treated as fatal. The same ordering kept the runtime manifest from publishing.

What changed

• wait for uploaded bytes to become readable through Daytona, with bounded retry
• reuse the existing recoverable mount restart path for initial materialization and R2 restoration
• verify the reconstructed workspace bytes against the stored size and SHA-256
• poll container visibility before applying read-only modes
• keep Unix modes as defense-in-depth so a lag cannot fail the agent run; R2, file-tool authorization, and run-boundary repair remain authoritative
• stage the runtime manifest in writable /workspace before atomic publication into its protected directory
• emit a structured warning if secondary filesystem protection cannot be applied

Verification

• reproduced the failure directly in production by deleting only the disposable workspace copy; R2 remained intact
• confirmed Agent Worker logs reported the sandbox write-boundary failure on both pre-run and cleanup restore
• pnpm turbo lint typecheck build — 76/76 tasks passed on Node 24.18.0
• targeted Biome and git diff --check passed
• no database change; the repository still has exactly one migration

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
cheatcode	Skipped		Jul 27, 2026 3:04pm