#602 release: forward Privy JWT as RECOUP_ACCESS_TOKEN (#601) — final cutover bundle

Summary

Final open-agents → api cutover bundle. The chat UI's recoupAccessToken body field (a short-lived Privy JWT) now flows end-to-end:

• validateChatWorkflow accepts recoupAccessToken: z.string().min(1).max(8192).optional()
• AgentContext gains recoupAccessToken?: string
• handleChatWorkflowStream conditionally forwards into agentContext
• buildRecoupExecEnv injects RECOUP_ACCESS_TOKEN into the sandbox exec env

With this released, sandbox.recoupable.com can switch from sandbox.recoupable.com/api/chat → recoup-api.vercel.app/api/chat/workflow without UI changes. The recoup-api skill's curl examples will authenticate as the user; GET /api/accounts/id returns 200 with the user's account_id.

Cutover roadmap — all 5 bundles landed

#	Bundle	Status
1	C per-message cost/usage	✅
2	B subagent live progress + transcript	✅
3	A.7 real cwd in system prompt	✅
4	A.6 Anthropic prompt cache control	✅
5	A.4 forward Privy JWT as recoupAccessToken	✅ this release

Test plan

• 5 new unit tests across validator + handler + env builder; full suite 3144/3144 pass
• E2E on preview verified: body recoupAccessToken → RECOUP_ACCESS_TOKEN byte-for-byte in sandbox env; absent in body → unset in env (security path)
• Cross-validated against open-agents production — same end-to-end behavior

🤖 Generated with Claude Code

---

Summary by cubic

Forwards the chat UI’s short‑lived Privy JWT (recoupAccessToken) end to end and exposes it in the sandbox as RECOUP_ACCESS_TOKEN, enabling the recoup-api skill to authenticate as the user. Completes the open‑agents → api cutover for auth-sensitive skills.

• New Features

  • Validator accepts optional recoupAccessToken in /api/chat/workflow body.
  • AgentContext adds recoupAccessToken?.
  • handleChatWorkflowStream forwards the token into agentContext when present.
  • buildRecoupExecEnv injects RECOUP_ACCESS_TOKEN (omitted when absent/empty).
  • Safety: long‑lived recoup_sk_… API keys are not forwarded.

• Migration

  • No UI changes. sandbox.recoupable.com can switch to recoup-api.vercel.app/api/chat/workflow.