chore(desktop,trpc,db): delete v1 cloud secrets surface and dead v1 cloud routers

Merged
SA
3mo ago
+6461-2039

Teardown Wave A, slice 1

Deletes dead v1 cloud code confirmed unused by telemetry (zero secrets.* / v1 project.* / workspace.* API calls in 90 days) and repo-wide caller audits.

Removed

  • Desktop cloud secrets/env settings tree (15 files) — URL-only reachable, flag-gated, not linked from settings nav
  • v1 project router incl. secrets sub-router + crypto/validation utils
  • v1 cloud workspace router (ensure/create/delete, zero callers since #2836 era)
  • host.ensureClient (write-only, zero callers)
  • secrets + sandbox_images tables (migration 0066, generated via drizzle-kit; no Electric shapes, no inbound FKs) + relations/zod/types
  • SECRETS_ENCRYPTION_KEY from trpc/api env schemas (only consumer deleted; deploy-workflow env refs left as a follow-up)
  • project/workspace entries from CLOUD_TRPC_ROUTER_ROOTS

Untouched by design (Wave B, adoption-gated): v1 workspaces table + enums/zod, v2_clients, device_presence, electric-proxy allowlist, cloud-access flag (reused for sandbox rollout).

Compat: old builds calling a deleted procedure get a clean tRPC NOT_FOUND on that call (dead settings page / retired background sync only) — no sync streams or crash paths involved.

Verification: lint clean · typecheck 38/38 (incl. desktop route-tree regen) · db 13/13, api 17/17, desktop renderer 1451/1451 tests.

Part of the Sandbox Workspaces cleanup track (see the Sandboxes Notion page for the plan set).

Summary by cubic

Removes the v1 cloud secrets UI and v1 cloud routers to reduce dead surface ahead of Sandbox Workspaces. Previously a URL-only settings page and project.*/workspace.*/secrets.* procedures were available; now they are deleted and any calls return tRPC NOT_FOUND without affecting other flows.

  • Drops secrets and sandbox_images tables via migration 0067 in packages/db; removes related schema, relations, and zod types.
  • Deletes v1 project and workspace routers and host.ensureClient in packages/trpc; prunes packages/trpc/src/root.ts; removes SECRETS_ENCRYPTION_KEY from env schemas in apps/api and packages/trpc.
  • Removes the desktop cloud secrets settings tree and search entry in apps/desktop; updates CLOUD_TRPC_ROUTER_ROOTS to drop project and workspace.

Rollout

  • Run migration 0067.
  • Remove SECRETS_ENCRYPTION_KEY from deploy environments once workflows are cleaned.
  • Monitor for NOT_FOUND errors from old builds that still call deleted procedures.

Summary by CodeRabbit

  • Removed Features
    • Removed project and workspace management APIs.
    • Removed project cloud settings and environment-variable management, including adding, editing, importing, searching, revealing, and deleting secrets.
    • Removed related settings search entries and cloud navigation routes.
    • Removed sandbox image and stored secret data from the database.
  • API Changes
    • Removed legacy project, workspace, and client-registration endpoints.
    • Removed secret encryption, decryption, and validation functionality.