## Description
Idle cleanup preserves recoverable files after checkpoint or workspace
discovery failures, including on unhealthy endpoints. Kubernetes
requires complete workspace-list output. Docker rejects failed or
incomplete snapshot probes.
Migration `45662b7b63a2` adds nullable `sandbox.cleanup_checkpoint`
JSONB storage. Cleanup commits proof after snapshots and final checks,
before deletion. The proof update requires the current provisioning
attempt and observed heartbeat.
Retry requires a confirmed absent runtime and matching attempt,
workspace storage identity, and heartbeat. Heartbeats and file mutations
invalidate old proof before files change. Successful sleep and new
provisioning clear the proof.
## How Has This Been Tested?
614 sandbox tests passed with two pytest workers. Tests cover partial
Docker deletion across workers, changed storage, stale attempts, resumed
activity, and failed checkpoint commits. Migration upgrade and downgrade
SQL generation passed. Pre-commit checks passed.
PostgreSQL persistence and heartbeat-race tests were added. Their local
run was blocked because PostgreSQL was unavailable. Live Docker services
were also unavailable locally.
## Known CI blocker
Preview deployment failed with an unauthorized deploy-token error after
one infrastructure retry. See the [failed preview
run](https://github.com/onyx-dot-app/onyx/actions/runs/39660940780).
Code, Craft, database, and type checks passed. Other CI jobs are still
running.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
<!-- coderabbit-ai-generated:v1 -->
## Summary by CodeRabbit
* **Bug Fixes**
* Idle sandboxes remain running when workspace discovery or snapshot
checks fail, preserving their files, runtime, and ports.
* Interrupted cleanup can resume when the sandbox state is unchanged.
Existing workspace storage is preserved when cleanup cannot be verified.
* Uploads and file deletions are coordinated with session activity,
preventing cleanup from interfering with active file changes.
* Cleanup checkpoints are cleared when sandbox activity or lifecycle
changes make them outdated.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Description
List static HTML outputs alongside registered apps in Craft's Apps tab.
Open these files without registering a webapp or starting a server.
Matching cards use aligned icons and left-aligned labels in a centered
column.
Serve relative pages, styles, scripts, images, and data through a
bounded, expiring folder capability. Each read checks the owner's
access. Isolated frames cannot access the parent application. Cached
assets speed repeat navigation; reload creates a fresh preview.
Apps reload refreshes both discovery and file inventory, with distinct
loading, incomplete, and error states. Uploaded HTML resets on explicit
reload even when its bytes are unchanged. Hidden frames retain
interactive state within the panel's bounded viewer cache.
Nginx preserves the incoming host and port for scoped preview policies.
Transient refresh failures retain the loaded frame. Mounted frames renew
their existing capability even when hidden, preserving page state. If
browser suspension lets it expire, the next fetch obtains a fresh grant.
Asset bytes are shared by tenant, session, path, and revision; access
checks remain per grant.
## How Has This Been Tested?
- Follow-up: 205 frontend tests, 26 backend tests, and CLI
deployment-file tests pass. Chromium verified mapped-port nginx data
fetches, modules, styles, navigation, and parent isolation.
- 66 panel, Apps, and file-preview tests passed; an additional HTML test
verifies scoped URLs and reload.
- Earlier static-preview verification passed 19 backend tests and
browser checks for relative assets, navigation, and parent isolation.
- Type checking, coverage, formatting, lint, and feature-map checks
passed.
## Additional Options
- [ ] [Optional] Please cherry-pick this PR to the latest release
version.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
<!-- coderabbit-ai-generated:v1 -->
## Summary by CodeRabbit
* **New Features**
* HTML and HTM files in Outputs now appear alongside web apps in Apps.
Select a file to open it in a preview tab, including pages that use
relative assets.
* Previews support refresh and automatically renew access. If a preview
can’t be loaded, you can retry or download the file.
* HTML previews run in a restricted viewer that limits access to other
content and blocks actions such as opening popups or submitting forms.
* **Bug Fixes**
* Proxy requests now preserve the incoming hostname and port.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Introducing permissioning, standardize onboarding for connectors, re-make the data model for connectors / credentials / index-attempts, making all environment variables optional, a bunch of small fixes + improvements.
Co-authored-by: Weves <chrisweaver101@gmail.com>
roshan