fix: persist Daytona authentication failures

[Elioooon]

Summary

Persist Daytona 401/403 failures as a failed sandbox-provider status instead of returning an internal settings error or losing the typed error when sandbox execution converts it to a failed result.

Closes #516

Changes

• map Daytona authorization errors, including wrapped causes, to stable status_reason values
• persist the failure from snapshot refresh and runtime sandbox create/exec paths
• add focused coverage for settings refresh, sandbox creation, and existing-sandbox execution
• add patch changesets for trueforge and trueforge-core

How was this tested?

• pnpm --filter @truefoundry/trueforge-core test -- --runInBand tests/core/sandbox/daytonaSnapshotRegistration.test.ts
• pnpm --filter @truefoundry/trueforge test -- --runInBand tests/unit/sandbox/providerUtils.test.ts
• pnpm --filter @truefoundry/trueforge test:store:sqlite -- --runInBand tests/db/sqlite/sandbox-provider-store/contract.test.ts
• pnpm --filter @truefoundry/trueforge-core typecheck
• pnpm --filter @truefoundry/trueforge typecheck
• pnpm exec eslint packages/trueforge-core/src/core/sandbox/provider/DaytonaProvider.ts packages/trueforge/src/runtime/sessionResources.ts packages/trueforge/src/sandbox/providerUtils.ts
• git diff --check

Validation is intentionally scoped to the two changed packages and the Daytona failure paths; full workspace build/test and live Daytona credential revocation were not run locally. The callback is optional and database write failures are logged without replacing the original provider result. The SQLite store contract was run locally; the equivalent Postgres contract was not run because no local Postgres service was started.

Checklist

• I have read the contributing guidelines
• pnpm build, pnpm test, pnpm typecheck, pnpm lint:ci, and pnpm format:check pass locally
• Tests added/updated where it makes sense
• No hand-edits to generated code (packages/trueforge-sdk, .github/fern/openapi/openapi.json, docs/openapi.json) — fork PRs omit SDK regen; maintainers regenerate after merge
• Docs / .env.example updated if configuration or behavior changed (not applicable: no configuration or documented API change)

---

Note

Medium Risk
Changes runtime sandbox error handling and persisted tenant sandbox-provider status with optimistic manifest checks; credentials are not modified but failed-state writes affect how misconfiguration is shown and recovered.

Overview
When Daytona returns 401 or 403 (including wrapped Error.cause chains), the app now writes the tenant’s sandbox provider to failed with stable status_reason text instead of surfacing opaque settings errors or losing the signal when exec turns errors into { success: false }.

DaytonaSandboxProvider gains an optional onError hook invoked from createSandbox and non–SandboxNotAvailable exec failures; resolveSandboxProvider wires it to recordDaytonaAccessFailure. checkSnapshotStatus uses the same helper when snapshot refresh calls fail with auth/permission errors.

Status updates can pass expected_manifest so updateSandboxStatus only applies when the stored manifest still matches—avoiding stale failure writes after credentials or settings change. Snapshot refresh and failure recording both use that guard.

^{Reviewed by Cursor Bugbot for commit f056581. Bugbot is set up for automated code reviews on this repo. Configure here.}

[changeset-bot]

🦋 Changeset detected

Latest commit: f056581

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@truefoundry/trueforge	Patch
@truefoundry/trueforge-core	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0b05405. Configure here.}

[Elioooon]

Rebased onto the latest main (6848d71) and force-pushed. Revalidation after the rebase passed: Daytona provider tests (6/6), SQLite sandbox provider contract (7/7), provider utility unit test (1/1), and both @truefoundry/trueforge-core and @truefoundry/trueforge typechecks. The Postgres contract remains the documented local-environment boundary.

[Elioooon]

Rebased onto current main (d269b01) and resolved the sessionResources.ts conflict by preserving the upstream ReasoningEffort integration alongside this PR's Daytona failure callback. Force-pushed as f056581.

Post-rebase validation:

• pnpm --filter @truefoundry/trueforge-core test -- --runInBand tests/core/sandbox/daytonaSnapshotRegistration.test.ts — 6 passed
• pnpm --filter @truefoundry/trueforge test -- --runInBand tests/unit/sandbox/providerUtils.test.ts — 1 passed
• pnpm --filter @truefoundry/trueforge-core typecheck — passed
• pnpm --filter @truefoundry/trueforge typecheck — passed, including DB/unit test projects
• touched-file ESLint and Prettier checks — passed
• git diff --check — passed

The SQLite sandbox-provider contract could not execute on this host because the better-sqlite3@13.0.3 prebuild requires GLIBC 2.29 while the runner has an older glibc. Rebuilding locally is also blocked by the host's Python 3.7 being too old for node-gyp 11; this is an environment/toolchain boundary, not a test assertion failure. The same 7-test contract passed before the rebase, and CI remains the authoritative post-rebase SQLite run.