feat: inject RECOUP_ORG_ID into sandbox + auto-install artist-workspace skill#16
Conversation
Two related changes fix "what artists do I have" returning a
cross-org list instead of the sandbox's artists:
1. Make the sandbox's Recoupable org available to the agent as
RECOUP_ORG_ID. Org UUIDs are the trailing 36 chars of the repo
name (org-<slug>-<uuid-v4>), so derive server-side from
sessionRecord.cloneUrl — no schema column or migration needed.
Thread recoupOrgId through experimental_context alongside the
per-prompt recoupAccessToken and inject it into exec env via
buildRecoupExecEnv so curl/CLI calls can scope to
/api/organizations/$RECOUP_ORG_ID/... instead of hitting the
user-scoped unscoped list endpoints.
2. Auto-install artist-workspace in every sandbox. It already
describes the orgs/{org-slug}/artists/{artist-slug}/RECOUP.md
tree seeded by setup-sandbox, but it wasn't in
DEFAULT_GLOBAL_SKILL_REFS so the agent never loaded it and fell
through to API calls for inventory questions.
The always-on prompt nudge is rewritten to pick the right tool by
intent — artist-workspace for sandbox inventory, recoup-api (with
RECOUP_ORG_ID scoping) for live data not already in the tree.
Depends on recoupable/skills#15, which expands the artist-workspace
description to cover inventory phrasings and documents RECOUP_ORG_ID
in recoup-api.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 6 minutes and 50 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (11)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 11 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="apps/web/app/api/chat/route.ts">
<violation number="1" location="apps/web/app/api/chat/route.ts:214">
P2: The `repoName` fallback can mis-detect recoupOrgId for non-recoupable repositories when a bare repo name ends with a UUID; repoName should be validated (owner/prefix) before calling extractOrgId.</violation>
</file>
You're on the cubic free plan with 13 free PR reviews remaining this month. Upgrade for unlimited reviews.
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
| // tampering and needs no schema column. | ||
| const recoupOrgId = | ||
| (sessionRecord.cloneUrl && extractOrgId(sessionRecord.cloneUrl)) || | ||
| (sessionRecord.repoName && extractOrgId(sessionRecord.repoName)) || |
There was a problem hiding this comment.
P2: The repoName fallback can mis-detect recoupOrgId for non-recoupable repositories when a bare repo name ends with a UUID; repoName should be validated (owner/prefix) before calling extractOrgId.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At apps/web/app/api/chat/route.ts, line 214:
<comment>The `repoName` fallback can mis-detect recoupOrgId for non-recoupable repositories when a bare repo name ends with a UUID; repoName should be validated (owner/prefix) before calling extractOrgId.</comment>
<file context>
@@ -204,6 +205,15 @@ export async function POST(req: Request) {
+ // tampering and needs no schema column.
+ const recoupOrgId =
+ (sessionRecord.cloneUrl && extractOrgId(sessionRecord.cloneUrl)) ||
+ (sessionRecord.repoName && extractOrgId(sessionRecord.repoName)) ||
+ undefined;
+
</file context>
1 participant
Summary
Fixes the "artists" half of the sandbox-context work so a user opening a sandbox for a specific org gets the sandbox's artists back — not their personal cross-org list — when they ask "what artists do I have".
Companion to recoupable/skills#15, which expanded `artist-workspace` to cover inventory phrasings and documented `RECOUP_ORG_ID` in `recoup-api`.
Background — what the user hit
In an open-agents sandbox opened for a specific org, the user asked "what artists do I have?". The agent did `GET /api/artists` on the user-scoped Privy token and returned the user's artists across every org they belong to — a completely different set than what the sandbox tree (`orgs/{org-slug}/artists/{artist-slug}/RECOUP.md`, seeded by `setup-sandbox` during provisioning) actually contains.
Two root causes in open-agents:
Changes
New extractor (deriving org ID from the clone URL)
Plumbing (mirrors the `recoupAccessToken` path added in #13)
Skills
Tests
Why this shape
Test plan
Known unrelated failure
`apps/web/app/api/pr/route.test.ts` fails with `server-only` import + 403 on unmodified `main` — pre-existing (reproduced on the prior PR #15 too), not caused by this change.
🤖 Generated with Claude Code
Summary by cubic
Injects the sandbox’s Recoup org ID and auto-installs
artist-workspaceso inventory questions return the sandbox’s artists, not the user’s cross-org list. We derive the org UUID from the sandbox repo and expose it asRECOUP_ORG_IDfor scoped API calls.recoupOrgId; expose to tools asRECOUP_ORG_IDfor scoping list endpoints.artist-workspacealongsiderecoup-apiso inventory uses the sandbox filesystem; keep API for live data.artist-workspaceand scoperecoup-apicalls to/api/organizations/$RECOUP_ORG_ID/...when set.extractOrgIdhelper and tests; extend tool and skill-install tests to coverRECOUP_ORG_IDand the new default skill.Written for commit 77f17a0. Summary will update on new commits.