docs: daily update 2026-08-03

[deco-cms]

Release v4.160.7 (previous: v4.160.6)

Range evaluated: v4.160.6...v4.160.7 (compare: v4.160.6...v4.160.7)

Depends on: #5574 (docs/auto-update-2026-08-02-release-4.160.2) — this PR branches from its HEAD and should be merged after it.

Commits covered

• 868fd3efb — chore: delete the dead auth-config.json tail and the stray EFS RFC (chore: delete the dead auth-config.json tail and the stray EFS RFC #5579) — 868fd3e — warranted a docs update: auth-config.json (file-based auth config) is dead code, nothing reads it anymore — auth is entirely AUTH_* environment variables (apps/api/src/auth/auth-env.ts). Two self-hosting docs still instructed users to configure auth via that file.

Commits skipped

• bc3217624 — [release]: bump changed workspace versions — bot release commit, version bump only.
• 88b68c5c0 — [chore]: bump homebrew cask to 4.160.6 — bot commit, Homebrew cask version bump only.

Changed doc files (English)

• studio/self-hosting/authentication.mdx — replaced the "load auth-config.json at startup" instructions with the real mechanism (AUTH_* env vars). Added a full env var reference table (email/password, social login, email providers, magic link, email OTP) sourced from apps/api/src/auth/auth-env.ts, since the doc previously deferred all of this to the now-deleted config file. Fixed the "Social login vs. SSO" section to stop mentioning auth-config.json.
• studio/self-hosting/deploy/docker-compose.mdx — replaced the "mount an auth-config.json" instructions with a pointer to the AUTH_* env vars and the Authentication page. Fixed the Security section's mention of a mounted auth-config.json.

pt-br counterparts were auto-translated and updated in the same set of files (technical terms, code blocks, URLs, and UI labels kept in English per convention).

Consistency notes

• deploy/helm/studio/README.md and deploy/helm/studio/examples/secrets-example.yaml were also fixed by the source commit to stop documenting a non-functional authConfig Helm value — but these live outside apps/docs/client/src/content/deco-studio/, so out of scope for this PR (no product docs page currently references Helm's authConfig values).
• Checked quickstart.mdx, concepts.mdx, and overview.mdx for related staleness — no auth-config.json or related mentions found; no changes needed.
• No other doc files reference auth-config.json, configmap-auth, the deleted efs-spec.md, or apps/api/spec — nothing else to fix.

Label: documentation

---

Summary by cubic

Refresh Studio docs for v4.160.7. Auth is now configured via AUTH_* env vars (no auth-config.json), desktop link/local runtime references are removed, Task Board is documented, and sandbox docs add OTLP telemetry and the Go-only sandbox image.

• New Features

  • Task Board docs: reviewers (QA Agent, Code Reviewer), auto-merge, and “Ship to production”.
  • Sandbox daemon OTLP metrics for self-hosted Kubernetes (telemetry.enabled, telemetry.otlp.ip/port).

• Refactors

  • Self-hosting auth: replaced auth-config.json with AUTH_* env vars; Docker Compose updated to set env vars.
  • Runtime/architecture docs: removed desktop link/local runtimes; architecture now two tiers with cloud-only sandboxes; agents page notes fork support and required GitHub App access; sandbox image documented as ghcr.io/decocms/studio/studio-sandbox-go.

^{Written for commit 399e770. Summary will update on new commits.}