feat(sandbox): serve the content protocol from the sandbox daemon

[tlgimenes]

What

In a sandbox session of a Blocks v8 project, the site editor now reads and saves content through the sandbox's own daemon. The daemon works on the sandbox's working tree, so content behaves the way it does on a developer's machine. It lives in .deco/blocks/*.json, is edited over the content protocol, and is committed and pushed with git like code. The sandbox never uses a CDN draft. Previews still show the sandbox's dev server.

Daemon (Go): 7d95845e4

• POST /_sandbox/rpc serves the content protocol: JSON-RPC 2.0 with describe, schema.get, blocks.list and blocks.apply. PUT /_sandbox/assets/<name> takes uploads, capped at assets.maxBytes. Both routes require the daemon token.
• It is a port of the TypeScript server in @decocms/blocks/protocol, with the same file layout, file-name rules, error codes and shapes, and plaintext-secret guard (including the legacy v7 secret-loader exemption). The bytes it writes match the TS server's exactly.
• Writes take the worktree lock and then .deco/.blocks.lock, and reuse the existing write hook. That keeps the v7 /_sandbox/decofile and its change events up to date. The lock file and transaction folders are added to .git/info/exclude. /health is not touched.
• CI: daemon-e2e runs the published conformance suite from @decocms/[email protected] (pinned) against the daemon, so any drift fails the build. Results: 79 pass, 0 fail.

Studio: 67123890d

• API. Two new routes, POST /api/:org/sandbox/:id/:branch/rpc and PUT …/assets/:name, proxy to the daemon. They use the same claim and auth as the other sandbox routes. A sandbox-less session gets 404.
• Editor. New content source sandbox, behind the site_editor_content_protocol org flag.
  • Once the working tree is ready, a probe asks the daemon for its schema. A schema with "blocksMajor": 8 switches the editor to the protocol. Anything else stays on the legacy path, as before: a v7 site, or an older sandbox image that lacks the route.
  • Asset uploads go to the daemon, and image thumbnails load from the sandbox's dev server.
  • Each save refreshes the git status in the header.
• v7 sites are unchanged, including /_sandbox/decofile.

Review fixes: c707d3dc9

• v7 unchanged in the editor. A sandbox session is legacy unless the flag is on and the daemon confirmed a v8 working tree; it is never pending, so a v7 sandbox's editor isn't unmounted while the flag or the probe loads. A daemon that answers 404 on /_sandbox/rpc (an older image) is read as v7 and not polled.
• No late writes. Protocol commits and uploads wait at most 10 s for the working-tree lock (a long publish, rebase or autosave), then answer Unavailable with retryAfterMs: 500. That is well under Studio's 30 s proxy timeout, so a write never lands after the editor reported it failed.
• Stays inside the tree. If .deco, .deco/blocks or public/assets resolve through symlinks outside the working tree, every method except describe answers NotFound, and uploads are refused.

Stack

#7796 (org_sites project link, base: main) → #7728 (blocks v8 support) → #7770 (this PR) → #7766 (hosted)

Based on feat/blocks-v8-support. Nothing here depends on the hosted branch: the daemon route, the proxy routes and the editor's sandbox source only need the content protocol client that #7728 already has. #7766 sits on top of this PR (it merged this branch).

Merged #7728 with #7796 in d59b05f5f. One conflict, in sandbox-proxy.ts: main renamed the suggest-commit body cap to JUDGE_REVIEW_MAX_BODY_BYTES (its /git/suggest-commit route is gone); this branch's content-protocol caps are kept. Then merged #7796's review fixes via #7728 in 300678c19 (no conflicts). Then merged #7796's PO decisions via #7728 in a39b13c80 (no conflicts), and its comment tidy-up in e1a9d31e4 (no conflicts).

OPEN

• While a v8 sandbox is booting, the editor shows the legacy path until the working tree is ready and the probe confirms v8, then switches to the protocol.
• Symlink containment is stricter than the TS fs storage, which follows symlinks.
• A busy-tree upload answers 500 (Internal), like any other failed upload in the TS handler.
• The CDN-draft bridge (fastPreviewHostedDraft, hosted/draft-git-compat.ts) lives on feat(site-editor): hosted Deco CMS v8 — publish to CDN, CDN drafts, releases, site tokens #7766 and is kept there pending a PO decision. It is only reached by sandbox-less (cms) sessions, never by a sandbox session.
• The daemon's describe reports the server version as "unknown".
• Two error messages differ in wording from the TS server: the message on an invalid-json diagnostic, and filesystem errors. The error codes are the same.

Tests

• go vet, go test -race, and the daemon conformance and parity e2e: green.
• After the review fixes: go test ./... green (new: busy tree refused with nothing landing later; symlinked storage refused); all daemon-e2e specs 303 pass, 1 skip, 0 fail (conformance + parity included); Studio bun run test 10480 pass, 0 fail; web typecheck, oxlint, biome format pass; e2e (one worker) content-protocol-deco-serve, sandbox-drawer-site-editor, site-editor-breadcrumbs: 11 passed.
• CI: sandbox-daemon.yml only triggers on PRs into main, so it was dispatched on this branch: https://github.com/decocms/studio/actions/runs/37640092180 (success: daemon-e2e, docker-smoke).
• api: sandbox-proxy.content.test.ts checks that the JSON body is forwarded, that the daemon's errors pass through, that asset bytes and content type are forwarded, and that a sandbox-less session gets 404.
• web: new cases in content-backend.test.ts and use-content-backend.test.ts.
• Typecheck, lint, format and knip pass.
• e2e, with one worker: content-protocol-deco-serve, content-protocol-github, sandbox-drawer-site-editor, site-editor-breadcrumbs, standalone-blocks-panel, tab-error-boundary-recovery, destination-routes and compact-page-layout. All pass except compact-page-layout, which fails the same way on feat/blocks-v8-support.

🤖 Generated with Claude Code

[tlgimenes]

Split into small PRs; same code — the top of the new stack equals this branch exactly (split/44-content-protocol-github-e2e has the same tree as feat/blocks-v8-hosted).

The new stack, all on #7796 (the org_sites ↔ project migration, reviewed and merged first):

• API track: refactor(api): extract gen-artifact + commit message from commit-coalescer #7800 → chore(api): depend on @decocms/blocks; run Studio CLI by path #7801 → feat(hosted): delivery bucket settings, store and CDN purge #7802 → feat(hosted): CDN draft store and draft-over-main content storage #7804 → feat(hosted): release objects and publishDraft #7806 → feat(hosted): site_editor_content_protocol flag; releases timeline, scope, draft publish status #7809 → feat(hosted): site tokens #7811 → feat(hosted): claim a project's site slug for its org on create #7821 → feat(hosted): admin backfill of site claims #7823 → feat(api): /rpc, v8 draft pointer and publish; hosted routes #7824 → feat(api): proxy /_sandbox/rpc and report draft publish status #7825
• Go daemon track: feat(daemon): JS-exact JSON for the content protocol #7812 → feat(daemon): block keys/file names and protocol errors #7813 → feat(daemon): filesystem content store over the working tree #7814 → feat(daemon): secret guard and ciphertext checks #7815 → feat(daemon): content-protocol RPC router and read methods #7847 → feat(daemon): content-protocol blocks.apply and write paths #7817 → feat(daemon): asset uploads + handler tests #7818 → feat(daemon): mount /_sandbox/rpc and /assets; bounded tree-lock wait #7819 → test(daemon-e2e): content protocol conformance against the daemon #7820
• Web track: feat(web): deco serve connection model + copy #7803 → feat(web): content backend selection (pure) #7805 → feat(web): v8 schema shapes #7807 → feat(web): flat redirects keep unknown fields; pages by manifest #7808 → feat(web): schemaless model #7810 → feat(web): useContentBackend (probe GitHub, sandbox, deco serve) #7816 → feat(web): content-protocol client API; editor hooks use it #7822 → feat(web): protocol fields: browser-encrypted secrets, asset uploads #7826 → feat(web): v8 sites always get the new blocks editor; no async rendering on v8 #7827 → feat(web): deco serve notices #7828 → feat(web): discover a running deco serve on localhost #7829 → feat(web): schemaless content editor #7830 → feat(web): CMS settings model #7831 → feat(web): v8 variant previews through the draft pointer #7832 → feat(web): sections editor and Preview switch on the content backend #7833 → feat(web): Content tab switches on the content backend #7834 → feat(web): the Local draft option connects deco serve #7835 → feat(web): first-run guide for deco serve #7836 → feat(web): account-less /site-editor over deco serve #7837 → feat(web): /site-editor on the org rail #7838 → feat(web): Releases tab for hosted v8 projects #7839 → feat(web): hosted Publish and site tokens #7840
• E2E (merge after the three tracks): test(e2e): delivery CDN stub server #7841 → test(e2e): site editor over a deco serve connect link #7842 → test(e2e): content protocol, drafts and publish over GitHub #7843

This branch is kept for reference.