fix(sandbox): bump @vercel/sandbox to v2 — production incident

[sweetmantech]

🚨 Production incident fix

Sandboxes are failing in production with `Status code 404 is not ok`. This PR fixes the cross-repo dep mismatch that caused it.

Failing run for reference: https://cloud.trigger.dev/orgs/recoup-8a7d/projects/recoup-chat-bQni/env/prod/runs/run_cmorfev4q72dv0olrfwo1ysgc

Root cause

`tasks/` was on `@vercel/sandbox: ^1.8.0`. After api PR #503 bumped api to `2.0.0-beta.11` (merged 2026-05-02), api started creating sandboxes with v2-style names (`gray-common-whale-eGd9JS` instead of `sbx_xxx`). The v1 SDK in tasks couldn't resolve those names — `Sandbox.get({ sandboxId })` returned 404.

Stack trace from the failing run:

Status code 404 is not ok
  at parse (.../@vercel+sandbox@1.8.0/...base-client.ts:136)
  at Function.get (.../@vercel/sandbox/src/sandbox.ts:324)
  at run (file:///src/tasks/runSandboxCommandTask.ts:46)

Fix

Mirrors api's PR #503: dep bump + minimum v1 → v2 SDK surface fixes.

Change	Files
Bump `@vercel/sandbox` 1.8.0 → 2.0.0-beta.11	`package.json`, `pnpm-lock.yaml`
`Sandbox.get({ sandboxId, ... })` → `Sandbox.get({ name: sandboxId, ... })`	`sandboxes/getOrCreateSandbox.ts`, `tasks/runSandboxCommandTask.ts`
`sandbox.sandboxId` → `sandbox.name` (log fields only)	`tasks/codingAgentTask.ts` (×1), `tasks/setupSandboxTask.ts` (×2), `tasks/updatePRTask.ts` (×2)
Test mocks use `{ name }` instead of `{ sandboxId }` for Sandbox instances	`sandboxes/tests/getOrCreateSandbox.test.ts`

api's vocabulary preserved: HTTP response shape from `createAccountSandbox` still uses `sandboxId` (per the api migration's design decision). Translation to `name` only at the v2 SDK boundary.

Verification

Check	Result
`pnpm install`	✅ clean
`pnpm test`	✅ 356/356 pass
SDK-related typecheck errors	✅ 0 (pre-existing unrelated typecheck failures in this repo are out of scope and predate this fix)

What this fixes (real-world impact)

• `run-sandbox-command` Trigger task — used by chat for openclaw agent runs ✅
• `coding-agent` Trigger task — sandbox stop log accuracy ✅
• `setup-sandbox` Trigger task — sandbox setup logs ✅
• `update-pr` Trigger task — PR-update sandbox lifecycle logs ✅

Cross-repo dependency note

After this lands, the version pin chain is consistent:

• `api`: `@vercel/sandbox: 2.0.0-beta.11` ✓ (since PR #503)
• `tasks`: `@vercel/sandbox: 2.0.0-beta.11` ✓ (this PR)
• `chat`: still uses api over HTTP — not affected by SDK version

🤖 Generated with Claude Code

---

Summary by cubic

Bumps @vercel/sandbox to v2 and updates call sites to fix production 404s when reconnecting to v2-named sandboxes. Aligns tasks with API-created sandboxes so runs and logs work again.

• Bug Fixes
  • Upgrade @vercel/sandbox 1.8.0 → 2.0.0-beta.11.
  • Use Sandbox.get({ name }) instead of { sandboxId }; translate API sandboxId to name at the SDK boundary.
  • Replace sandbox.sandboxId with sandbox.name in log fields.
  • Update test mocks and expectations for the new shape.

^{Written for commit 5719f34. Summary will update on new commits.}

[coderabbitai]

Warning

Rate limit exceeded

@sweetmantech has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 43 minutes and 2 seconds before requesting another review.

To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 4f2504e7-a544-4abc-a0d1-f3a7d42ab3eb

📥 Commits

Reviewing files that changed from the base of the PR and between f9a0d2a and 5719f34.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (7)

• package.json
• src/sandboxes/__tests__/getOrCreateSandbox.test.ts
• src/sandboxes/getOrCreateSandbox.ts
• src/tasks/codingAgentTask.ts
• src/tasks/runSandboxCommandTask.ts
• src/tasks/setupSandboxTask.ts
• src/tasks/updatePRTask.ts

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/bump-vercel-sandbox-v2-prod-incident

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Review rate limit: 0/1 reviews remaining, refill in 43 minutes and 2 seconds.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cubic-dev-ai]

No issues found across 8 files