sync

Author: Danverr

apps/agents-web/app/api/v1/agents/deploy/route.ts

@@ -117,7 +117,9 @@ type ProgressReporter = (message: string) => void
 
 const NDJSON_CONTENT_TYPE = "application/x-ndjson"
 
-export const maxDuration = 900
+// Vercel Pro caps serverless maxDuration at 800s — the previous value of 900
+// made every production deploy of agents-web fail at the patchBuild step.
+export const maxDuration = 800
 
 function encodeEvent(event: DeployEvent): Uint8Array {
   return new TextEncoder().encode(`${JSON.stringify(event)}\n`)

apps/agents-web/infra/README.md

@@ -13,6 +13,7 @@ Terraform for the current `agents-web` stack with an `EKS`-based sandbox plane.
 - one self-managed sandbox node autoscaling group
 - one encrypted `EFS` filesystem for persistent sandbox volumes
 - one private `ECR` repository for the OpenSandbox runtime image
+- one private `S3` bucket for workflow skill artifacts, readable through the stack S3 VPC endpoint
 - one private PostgreSQL `RDS` instance
 - one private Redis `ElastiCache` instance
 - one Elastic IP for the app VM
@@ -55,6 +56,7 @@ Terraform now prepares the AWS base for:
   - `opensandbox-image-builder` RBAC for deploy-time derived runtime image builds
   - `opensandbox-server-internal` service
 - ECR push permissions for sandbox worker nodes to publish derived OpenSandbox runtime images
+- a private workflow skill artifact bucket plus an S3 Gateway VPC Endpoint on the public route table used by current sandbox nodes
 - outputs for the future OpenSandbox server config
 
 Terraform does **not** yet:
@@ -95,6 +97,12 @@ the runtime repository and the cache repository. Without this, final derived
 image pushes still work, but cache layer pushes fail and every build re-runs
 expensive `apt` / `mise install` layers.
 
+Workflow skill archive URLs are normal S3 object URLs under
+`terraform output workflow_skill_artifacts_url_base`, but the bucket policy only
+allows `GetObject` through this stack's S3 Gateway VPC Endpoint. They are meant
+for OpenSandbox/EKS image builders inside this AWS contour, not for public
+internet downloads.
+
 ## Current OpenSandbox Runtime Base Image
 
 The base runtime image is built from `packages/agent-runtime/Dockerfile` and published to the private OpenSandbox runtime `ECR` repository. `relay` uses this image through `OPENSANDBOX_RUNTIME_IMAGE`; `agents-web` uses the same image as `OPENSANDBOX_BUILD_BASE_IMAGE` for derived sandbox images.

apps/agents-web/infra/main.tf

@@ -35,6 +35,29 @@ data "aws_iam_policy_document" "app_eks_access" {
   }
 }
 
+data "aws_iam_policy_document" "workflow_skill_artifacts_bucket" {
+  statement {
+    sid = "AllowClusterReadThroughS3Endpoint"
+
+    principals {
+      type        = "*"
+      identifiers = ["*"]
+    }
+
+    actions = ["s3:GetObject"]
+
+    resources = [
+      "${aws_s3_bucket.workflow_skill_artifacts.arn}/${var.workflow_skills_s3_prefix}/*",
+    ]
+
+    condition {
+      test     = "StringEquals"
+      variable = "aws:SourceVpce"
+      values   = [aws_vpc_endpoint.s3.id]
+    }
+  }
+}
+
 locals {
   azs = slice(data.aws_availability_zones.available.names, 0, 2)
 
@@ -363,6 +386,49 @@ resource "aws_route_table_association" "private" {
   route_table_id = aws_route_table.private.id
 }
 
+resource "aws_vpc_endpoint" "s3" {
+  vpc_id            = aws_vpc.this.id
+  service_name      = "com.amazonaws.${var.aws_region}.s3"
+  vpc_endpoint_type = "Gateway"
+  route_table_ids   = [aws_route_table.public.id]
+
+  tags = merge(local.tags, {
+    Name = "${var.name_prefix}-s3"
+  })
+}
+
+resource "aws_s3_bucket" "workflow_skill_artifacts" {
+  bucket = "${var.name_prefix}-workflow-skill-artifacts"
+
+  tags = merge(local.tags, {
+    Name = "${var.name_prefix}-workflow-skill-artifacts"
+  })
+}
+
+resource "aws_s3_bucket_public_access_block" "workflow_skill_artifacts" {
+  bucket = aws_s3_bucket.workflow_skill_artifacts.id
+
+  block_public_acls       = true
+  block_public_policy     = true
+  ignore_public_acls      = true
+  restrict_public_buckets = true
+}
+
+resource "aws_s3_bucket_server_side_encryption_configuration" "workflow_skill_artifacts" {
+  bucket = aws_s3_bucket.workflow_skill_artifacts.id
+
+  rule {
+    apply_server_side_encryption_by_default {
+      sse_algorithm = "AES256"
+    }
+  }
+}
+
+resource "aws_s3_bucket_policy" "workflow_skill_artifacts" {
+  bucket = aws_s3_bucket.workflow_skill_artifacts.id
+  policy = data.aws_iam_policy_document.workflow_skill_artifacts_bucket.json
+}
+
 resource "aws_security_group" "app" {
   name        = "${var.name_prefix}-app"
   description = "Public access for bare metal services"

apps/agents-web/infra/outputs.tf

@@ -35,6 +35,14 @@ output "opensandbox_runtime_cache_ecr_repository_name" {
   value = aws_ecr_repository.opensandbox_runtime_cache.name
 }
 
+output "workflow_skill_artifacts_bucket" {
+  value = aws_s3_bucket.workflow_skill_artifacts.bucket
+}
+
+output "workflow_skill_artifacts_url_base" {
+  value = "https://${aws_s3_bucket.workflow_skill_artifacts.bucket}.s3.${var.aws_region}.amazonaws.com"
+}
+
 output "opensandbox_runtime_image_example" {
   value = "${aws_ecr_repository.opensandbox_runtime.repository_url}:dev"
 }

apps/agents-web/infra/variables.tf

@@ -118,6 +118,11 @@ variable "opensandbox_runtime_ecr_repository_name" {
   default = "21st-agent-runtime-opensandbox"
 }
 
+variable "workflow_skills_s3_prefix" {
+  type    = string
+  default = "workflow-skills"
+}
+
 variable "sandbox_runtime_prepull_enabled" {
   type    = bool
   default = true

apps/agents-web/lib/server/agents/build-opensandbox-image.ts

@@ -46,6 +46,11 @@ type KubernetesToleration = {
   tolerationSeconds?: number
 }
 
+type KubernetesResourceRequirements = {
+  requests?: Record<string, string>
+  limits?: Record<string, string>
+}
+
 type ExternalTokenCache = {
   token: string
   expiresAtMs: number
@@ -68,7 +73,7 @@ const SERVICE_ACCOUNT_CA_PATH = "/var/run/secrets/kubernetes.io/serviceaccount/c
 const DEFAULT_NAMESPACE = "opensandbox"
 const DEFAULT_BUILDER_IMAGE = "gcr.io/kaniko-project/executor:v1.24.0"
 const DEFAULT_SERVICE_ACCOUNT = "opensandbox-image-builder"
-const DEFAULT_BUILD_TIMEOUT_MS = 15 * 60 * 1000
+const DEFAULT_BUILD_TIMEOUT_MS = 30 * 60 * 1000
 const DEFAULT_BUILD_NODE_SELECTOR: Record<string, string> = {
   workload: "sandbox",
 }
@@ -80,6 +85,16 @@ const DEFAULT_BUILD_TOLERATIONS: KubernetesToleration[] = [
     effect: "NoSchedule",
   },
 ]
+const DEFAULT_BUILD_RESOURCES: KubernetesResourceRequirements = {
+  requests: {
+    cpu: "500m",
+    memory: "1Gi",
+  },
+  limits: {
+    cpu: "2",
+    memory: "4Gi",
+  },
+}
 
 let cachedExternalToken: ExternalTokenCache = null
 
@@ -127,6 +142,13 @@ function getBuilderTolerations() {
   )
 }
 
+function getBuilderResources() {
+  return parseJsonEnv<KubernetesResourceRequirements>(
+    "OPENSANDBOX_BUILD_RESOURCES_JSON",
+    DEFAULT_BUILD_RESOURCES,
+  )
+}
+
 function getBaseImage() {
   const image =
     process.env.OPENSANDBOX_BUILD_BASE_IMAGE?.trim()
@@ -464,6 +486,7 @@ function buildJob(params: {
                   mountPath: "/workspace",
                 },
               ],
+              resources: getBuilderResources(),
             },
           ],
           volumes: [

apps/agents-web/prisma/schema.prisma

@@ -958,6 +958,7 @@ model UserFollow {
 model Team {
     id                           String                  @id @default(dbgenerated("gen_random_uuid()")) @db.Uuid
     name                         String
+    slug                         String?                 @unique
     description                  String?
     image_url                    String?
     website_url                  String?

apps/agents-web/server/api/routers/teams/router.ts

@@ -18,6 +18,7 @@ import {
   requireTeamOwnership,
   checkTeamAccess,
   getOrCreateInviteLink,
+  generateUniqueTeamSlug,
 } from "./utils"
 
 export const teamsRouter = createTRPCRouter({
@@ -159,9 +160,24 @@ export const teamsRouter = createTRPCRouter({
         })
       }
 
+      // Default personal teams are also created lazily through createTeam —
+      // keep the `<username>-team` handle convention for them, same as the
+      // apps/web Clerk webhook. Plain `slugify(name)` would collide into
+      // the ugly `personal-projects-NNN` space.
+      let slugSource = input.name
+      if (input.name === "Personal Projects") {
+        const owner = await prisma.user.findUnique({
+          where: { id: ctx.auth.userId },
+          select: { username: true },
+        })
+        if (owner?.username) slugSource = `${owner.username}-team`
+      }
+      const slug = await generateUniqueTeamSlug(slugSource)
+
       const team = await prisma.team.create({
         data: {
           name: input.name,
+          slug,
           description: input.description,
           image_url: input.image_url,
           website_url: input.website_url,

apps/agents-web/server/api/routers/teams/utils.ts

@@ -1,7 +1,45 @@
 import { prisma } from "@/lib/prisma"
 import { GitHubIntegration } from "@/lib/github"
 import { TRPCError } from "@trpc/server"
-import { nanoid } from "nanoid"
+import { randomUUID } from "node:crypto"
+import { customAlphabet, nanoid } from "nanoid"
+
+/** Fixed-length lowercase tail for slug collision fallback. */
+const slugTail = customAlphabet("abcdefghijklmnopqrstuvwxyz0123456789", 6)
+
+// Same slugify pattern the other routers keep file-local.
+function slugifyTeamHandle(text: string): string {
+  return text
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-|-$/g, "")
+}
+
+/**
+ * Picks a globally unique team slug: tries the slugified base, then
+ * `base-NNN` with random 3-digit suffixes, then random 6-char tails
+ * (degenerate bases like "personal-projects" have most numeric suffixes
+ * taken by the 2026-04-30 backfill). The partial unique index
+ * `teams_slug_unique` is the backstop for the tiny check-to-insert race.
+ */
+export async function generateUniqueTeamSlug(text: string): Promise<string> {
+  const base = slugifyTeamHandle(text) || "team"
+  let candidate = base
+  for (let attempt = 0; attempt < 6; attempt++) {
+    const taken = await prisma.team.findFirst({
+      where: { slug: candidate },
+      select: { id: true },
+    })
+    if (!taken) return candidate
+    candidate =
+      attempt < 3
+        ? `${base}-${Math.floor(100 + Math.random() * 900)}`
+        : `${base}-${slugTail()}`
+  }
+  // All checked candidates taken (astronomically unlikely) — fall back to a
+  // UUID tail: an ugly slug beats a failed team creation.
+  return `${base}-${randomUUID()}`
+}
 
 /**
  * Verifies team exists and user is the owner. Throws if not found or unauthorized.