feat(cloud-agent-next): add organization sandbox selection

[eshurakov]

Summary

• Add an organization-scoped Run on picker for Default, Cloudflare Single/Shared, and Vercel Small/Large.
• Share structured provider/account/instance contracts and Worker capabilities across the web app and trigger authorization.
• Persist sandbox allocation and Vercel resources through creation, retries, recovery, and worktree inheritance while preserving omitted/default routing.
• Allow additional chats in an existing worktree after temporary rollout flags are disabled; they retain the same sandbox and cannot override its allocation.

Verification

No new manual/browser or live-provider runs were performed during this PR preparation. Earlier branch verification covered destination selection, Default reset, disabled/dev-container states, keyboard navigation, and responsive layouts, plus live Vercel Small/Large sizing and lifecycle checks. Those provider checks were not full Cloud Agent chat E2E; model-backed local chat/shared-session/terminal coverage remains incomplete because of the previously observed local model-catalog failure.

Visual Changes

Before	After
New sessions use automatic sandbox routing without a destination picker.	Eligible organizations get a compact Run on picker grouped by account, provider, and instance, with resource labels and unavailable-state feedback.

Screenshots are not attached. Existing local captures and scratch plans were intentionally excluded from the commit.

Reviewer Notes

• SANDBOX_SELECTION_ORG_IDS is empty by default. Explicit allocations require current organization membership and enrollment; personal explicit allocations are rejected, including new Dedicated Standard trigger executions.
• Cloudflare choices retain owner plane routing. Explicit Vercel choices force control-plane sessions and are unavailable without runtime configuration or with enforced compute billing.
• Sandbox choice is made when creating a worktree. Sibling chats reuse its persisted sandbox/provider/allocation; ownership, membership, and metadata validation remain in place.
• Legacy allocation strings remain accepted at ingress. Unsupported BYOC destinations fail closed; this PR does not enable BYOC runtime integration.
• No new production dependencies or PostgreSQL migrations. No deployment or live allocation was performed in this preparation pass.

Automated checks

• Full Cloud Agent Worker unit suite: 5,525 passed, 3 skipped.
• Workers-runtime sandbox-control integration suite: 270 passed, with simulated provider operations.
• Shared allocation contract suite: 42 passed.
• Eight focused web suites: 483 passed using the existing config-only harness without database/global setup.
• Lint and typecheck passed for web, Cloud Agent Worker/wrapper, and worker-utils; web API declarations were rebuilt.
• Scoped pnpm format and git diff --check passed.
• Six sibling-chat enrollment/inheritance/replay regressions failed against the old gate and passed after its removal.
• Rebase verification at c23374744 on 8cd53ede4: 6,320 tests passed, 3 skipped. The wrapper timeout passed in isolation and on the full lower-concurrency rerun. Web declaration generation passed; after the combined command timed out, a standalone non-incremental web typecheck passed. Generated Worker bindings were regenerated and checked without loading local secrets.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (48 files)

• apps/web/src/components/cloud-agent-next/NewSessionPanel.tsx
• apps/web/src/components/cloud-agent-next/sandbox-selection.test.ts
• apps/web/src/components/cloud-agent-next/sandbox-selection.ts
• apps/web/src/components/webhook-triggers/TriggerForm.tsx
• apps/web/src/lib/cloud-agent-next/cloud-agent-client.test.ts
• apps/web/src/lib/cloud-agent-next/cloud-agent-client.ts
• apps/web/src/routers/cloud-agent-next-schemas.test.ts
• apps/web/src/routers/cloud-agent-next-schemas.ts
• apps/web/src/routers/organizations/organization-cloud-agent-next-router.test.ts
• apps/web/src/routers/organizations/organization-cloud-agent-next-router.ts
• apps/web/src/routers/webhook-triggers-router.schema.test.ts
• apps/web/src/routers/webhook-triggers-router.ts
• packages/worker-utils/package.json
• packages/worker-utils/src/sandbox-allocation.test.ts
• packages/worker-utils/src/sandbox-allocation.ts
• services/cloud-agent-next/src/agent-sandbox/vercel/vercel-runtime-config.test.ts
• services/cloud-agent-next/src/agent-sandbox/vercel/vercel-runtime-config.ts
• services/cloud-agent-next/src/agent-sandbox/vercel/vercel-sandbox-rest-client.test.ts
• services/cloud-agent-next/src/agent-sandbox/vercel/vercel-sandbox-rest-client.ts
• services/cloud-agent-next/src/persistence/SandboxControl.ts
• services/cloud-agent-next/src/persistence/session-metadata.test.ts
• services/cloud-agent-next/src/persistence/session-metadata.ts
• services/cloud-agent-next/src/router.ts
• services/cloud-agent-next/src/router/handlers/sandbox-selection.ts
• services/cloud-agent-next/src/router/handlers/session-start.ts
• services/cloud-agent-next/src/router/handlers/session-worktree.test.ts
• services/cloud-agent-next/src/router/handlers/session-worktree.ts
• services/cloud-agent-next/src/router/schemas.test.ts
• services/cloud-agent-next/src/router/schemas.ts
• services/cloud-agent-next/src/sandbox-control/lifecycle.test.ts
• services/cloud-agent-next/src/sandbox-control/physical-lifecycle.ts
• services/cloud-agent-next/src/sandbox-control/vercel-provider.test.ts
• services/cloud-agent-next/src/sandbox-control/vercel-provider.ts
• services/cloud-agent-next/src/sandbox-id.test.ts
• services/cloud-agent-next/src/sandbox-id.ts
• services/cloud-agent-next/src/sandbox-selection.test.ts
• services/cloud-agent-next/src/sandbox-selection.ts
• services/cloud-agent-next/src/sandbox-session/SandboxSession.ts
• services/cloud-agent-next/src/sandbox-session/control-rpc.ts
• services/cloud-agent-next/src/sandbox-session/session-message-queue.test.ts
• services/cloud-agent-next/src/session-prepare.test.ts
• services/cloud-agent-next/src/session/session-prepare.test.ts
• services/cloud-agent-next/src/session/session-registration.ts
• services/cloud-agent-next/src/session/session-requests.ts
• services/cloud-agent-next/src/types.ts
• services/cloud-agent-next/test/integration/sandbox-control.test.ts
• services/cloud-agent-next/worker-configuration.d.ts
• services/cloud-agent-next/wrangler.jsonc

---

_{Reviewed by grok-4.6 · Input: 282.7K · Output: 21.5K · Cached: 1.4M}

_{Review guidance: REVIEW.md from base branch main}