feat(chat): migrate POST /api/sandbox/upload to api

[arpitgupta1214]

Summary

Cutover for the sandbox upload token handshake. lib/sandboxes/uploadSandboxFiles.ts now points handleUploadUrl at \${getClientApiBaseUrl()}/api/sandboxes/staged-files (the new api route from api#541) and the local /api/sandbox/upload route is deleted. The downstream commit step (POST /api/sandboxes/files) is unchanged.

Closes Group 6 of the chat→api migration. Merge order: api → docs → chat.

Test plan

• On a preview where api is on the matching branch, drop a file into the sandbox file picker; confirm the Vercel Blob handshake hits api (not chat) and the file commits to the sandbox repo
• Verify the OPTIONS preflight succeeds from chat.recoupable.com against api.recoupable.com

---

Summary by cubic

Moves the sandbox upload handshake from chat to api and removes the local /api/sandbox/upload route. Points handleUploadUrl to ${getClientApiBaseUrl()}/api/sandboxes/staged-file and sends auth via Authorization: Bearer; the commit step (POST /api/sandboxes/files) is unchanged.

• Migration
  • Merge order: api → docs → chat; requires POST /api/sandboxes/staged-file.
  • Verify uploads hit api and commit, CORS preflight succeeds, and the Authorization header is accepted.

^{Written for commit 6982d75. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
chat	Ready	Preview	May 9, 2026 5:37pm

[coderabbitai]

Warning

Rate limit exceeded

@arpitgupta1214 has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 15 minutes and 6 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 701bd4b4-e77f-4f6a-a010-b8968f0808a2

📥 Commits

Reviewing files that changed from the base of the PR and between 9e94db1 and 6982d75.

📒 Files selected for processing (2)

• app/api/sandbox/upload/route.ts
• lib/sandboxes/uploadSandboxFiles.ts

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/sandbox-staged-files-cutover

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cubic-dev-ai]

No issues found across 2 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Requires human review: Migrates upload token handshake from chat to api, altering critical path for file uploads. Requires human review to verify API endpoint, CORS, and migration order.}

[cubic-dev-ai]

1 issue found across 1 file (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="lib/sandboxes/uploadSandboxFiles.ts">

<violation number="1" location="lib/sandboxes/uploadSandboxFiles.ts:43">
P1: The upload handshake endpoint path was changed to `/api/sandboxes/stage-files`, but the migrated API route is `/api/sandboxes/staged-files`. This typo will break sandbox file uploads.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P1: The upload handshake endpoint path was changed to /api/sandboxes/stage-files, but the migrated API route is /api/sandboxes/staged-files. This typo will break sandbox file uploads.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At lib/sandboxes/uploadSandboxFiles.ts, line 43:

<comment>The upload handshake endpoint path was changed to `/api/sandboxes/stage-files`, but the migrated API route is `/api/sandboxes/staged-files`. This typo will break sandbox file uploads.</comment>

<file context>
@@ -40,7 +40,7 @@ export async function uploadSandboxFiles({
       const blob = await upload(file.name, file, {
         access: "public",
-        handleUploadUrl: `${getClientApiBaseUrl()}/api/sandboxes/staged-files`,
+        handleUploadUrl: `${getClientApiBaseUrl()}/api/sandboxes/stage-files`,
         clientPayload: JSON.stringify({ token: accessToken }),
       });
</file context>

Suggested change

	handleUploadUrl: `${getClientApiBaseUrl()}/api/sandboxes/stage-files`,
	handleUploadUrl: `${getClientApiBaseUrl()}/api/sandboxes/staged-files`,

[cubic-dev-ai]

0 issues found across 1 file (changes from recent commits).

_{Requires human review: Auto-approval blocked by 1 unresolved issue from previous reviews.}

[cubic-dev-ai]

0 issues found across 1 file (changes from recent commits).

_{Requires human review: Auto-approval blocked by 1 unresolved issue from previous reviews.}