feat: use empty sandboxes and add migration commands to setup

Remove per-project template building — sandboxes are now created empty
and packages are installed at runtime. Setup configuration focuses on
env vars, startup commands, and migration commands (auto-detected).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: hkirat

apps/server/prisma/schema.prisma

@@ -111,6 +111,7 @@ model Project {
   envVarsIv             String?
   contextInstructions   String?        @db.Text
   startupCommands       String[]
+  migrationCommands     String[]
   requiredServices      String[]
   allowedFilePatterns   String[]
   devServerPort         Int            @default(3000)

apps/server/src/routes/session.routes.ts

@@ -99,11 +99,11 @@ router.post("/", async (req: Request, res: Response) => {
         .json({ error: "Not a member of this organization" });
     }
 
-    // Verify project template is READY
+    // Verify project is configured
     if (project.templateStatus !== "READY") {
       return res
         .status(400)
-        .json({ error: `Project template is not ready. Current status: ${project.templateStatus}` });
+        .json({ error: `Project is not configured yet. Please complete setup first.` });
     }
 
     // Start the session via service

apps/server/src/services/sandbox.service.ts

@@ -18,8 +18,8 @@ export async function startSessionSandbox(
     include: { org: true },
   });
 
-  if (project.templateStatus !== "READY" || !project.e2bTemplateId) {
-    throw new Error("Project template is not ready");
+  if (project.templateStatus !== "READY") {
+    throw new Error("Project is not configured yet");
   }
 
   // Get user's GitHub token for repo cloning
@@ -34,8 +34,8 @@ export async function startSessionSandbox(
   const [ghEncrypted, ghIv] = githubAccount.accessToken.split("|");
   const githubToken = decrypt(ghEncrypted, ghIv);
 
-  // Create sandbox from the project's built template
-  const sandbox = await Sandbox.create(project.e2bTemplateId, {
+  // Create empty sandbox (no per-project template)
+  const sandbox = await Sandbox.create({
     timeoutMs: project.maxSessionDurationMin * 60 * 1000,
     cpuCount: 8,
     memoryMB: 8192,
@@ -55,12 +55,27 @@ export async function startSessionSandbox(
       { requestTimeoutMs: 5_000 }
     );
 
-    // Clone the repo (use env var for token to avoid leaking in process list)
-    const cloneResult = await sandbox.commands.run(
+    // Install required system packages
+    const servicePkgs: string[] = [];
+    for (const svc of project.requiredServices) {
+      if (svc === "postgres") servicePkgs.push("postgresql", "postgresql-client");
+      else if (svc === "redis") servicePkgs.push("redis-server");
+      else if (svc === "mysql") servicePkgs.push("mysql-server");
+    }
+    const allPkgs = ["git", "curl", "xvfb", "x11vnc", "python3-pip", "chromium", ...servicePkgs].join(" ");
+    await sandbox.commands.run(
+      `sudo apt-get update && sudo apt-get install -y ${allPkgs} && pip3 install websockify --break-system-packages && sudo apt-get clean`,
+      { requestTimeoutMs: 180_000 }
+    );
+
+    // Install global npm tools
+    await sandbox.commands.run("npm install -g bun @openai/codex", { requestTimeoutMs: 60_000 });
+
+    // Clone the repo
+    await sandbox.commands.run(
       `GIT_TOKEN="${githubToken}" git clone https://x-access-token:${githubToken}@github.com/${project.githubRepoFullName}.git /workspace 2>&1`,
       { requestTimeoutMs: 120_000 }
     ).catch((e: any) => {
-      // CommandExitError has .result with stdout/stderr
       throw new Error(`Git clone failed: ${e.result?.stdout || e.message}`);
     });
 
@@ -80,20 +95,29 @@ export async function startSessionSandbox(
       await sandbox.files.write("/workspace/.env", envContent);
     }
 
-    // Start services that are baked into the template
+    // Start required services
     for (const service of project.requiredServices) {
       try {
         if (service === "postgres") {
-          await sandbox.commands.run("sudo service postgresql start 2>/dev/null || service postgresql start 2>/dev/null || true", {
+          await sandbox.commands.run("sudo service postgresql start 2>/dev/null || true", {
             requestTimeoutMs: 30_000,
           });
         } else if (service === "redis") {
-          await sandbox.commands.run("redis-server --daemonize yes 2>/dev/null || sudo service redis-server start 2>/dev/null || true", {
+          await sandbox.commands.run("redis-server --daemonize yes 2>/dev/null || true", {
             requestTimeoutMs: 10_000,
           });
         }
       } catch {
-        // Services may already be running from template init
+        // Best-effort service start
+      }
+    }
+
+    // Run migration commands
+    for (const cmd of project.migrationCommands) {
+      try {
+        await sandbox.commands.run(`cd /workspace && ${cmd}`, { requestTimeoutMs: 60_000 });
+      } catch {
+        // Migration may fail if deps aren't installed yet — agent will handle it
       }
     }
 

apps/server/src/services/session.service.ts

@@ -10,7 +10,7 @@ export async function startSession(projectId: string, userId: string) {
   });
 
   if (project.templateStatus !== "READY") {
-    throw new Error("Project template is not ready");
+    throw new Error("Project is not configured yet");
   }
 
   // Check for active sessions (conflict detection)
@@ -131,6 +131,7 @@ function buildSystemPrompt(project: {
   allowedFilePatterns: string[];
   contextInstructions: string | null;
   startupCommands: string[];
+  migrationCommands: string[];
   requiredServices: string[];
   devServerPort: number;
 }): string {
@@ -143,6 +144,7 @@ function buildSystemPrompt(project: {
     `- Dev server port: ${project.devServerPort}`,
     `- Required services: ${project.requiredServices.length > 0 ? project.requiredServices.join(", ") : "none"}`,
     `- Startup commands: ${project.startupCommands.length > 0 ? project.startupCommands.join(" && ") : "check package.json"}`,
+    `- Migration commands: ${project.migrationCommands.length > 0 ? project.migrationCommands.join(" && ") : "none"}`,
     "- You have FULL SYSTEM ACCESS including sudo. Use it freely to:",
     "  - Start/stop/restart services (PostgreSQL, Redis, MySQL, etc.)",
     "  - Install system packages with apt-get",

apps/server/src/services/setup.service.ts

@@ -3,7 +3,6 @@ import { Prisma } from "@prisma/client";
 import { prisma } from "../lib/prisma";
 import { decrypt, encrypt } from "../lib/crypto";
 import { env } from "../config/env";
-import { buildProjectTemplate } from "./template.service";
 
 function getLLMConfig() {
   if (env.LLM_PROVIDER === "vercel") {
@@ -70,19 +69,22 @@ async function getSandbox(projectId: string): Promise<Sandbox> {
   return sandbox;
 }
 
-const SETUP_SYSTEM_PROMPT = `You are a project setup assistant for Vendi. Your job is to analyze a project's codebase and automatically configure it for running in a sandbox environment.
+const SETUP_SYSTEM_PROMPT = `You are a project setup assistant for Vendi. Your job is to analyze a project's codebase and detect the configuration needed to run it.
 
 The project is cloned at /workspace. ALWAYS use absolute paths starting with /workspace/ when reading files (e.g. /workspace/package.json, /workspace/docker-compose.yml).
 
 YOUR GOAL:
-Automatically detect the project configuration by reading files. Then ask the developer ONLY for their environment variable values (the .env file contents). Do NOT ask about code changes, architecture decisions, or how the project should be modified.
-
-WHAT TO AUTO-DETECT (do NOT ask the user about these — figure them out yourself):
-1. Required services (PostgreSQL, Redis, MySQL, etc.) — detect from docker-compose.yml, package.json dependencies, prisma/schema.prisma, etc.
-2. Startup commands — detect from package.json scripts (look for "dev" script), Makefile, README instructions
-3. Dev server port — detect from vite.config.ts, next.config.js, .env.example, or package.json scripts
-4. Allowed file patterns — infer from project structure (e.g. src/**, app/**, pages/**)
-5. Context instructions — write a brief description of the project based on what you find
+1. Auto-detect startup commands and database migration commands from the codebase.
+2. Ask the developer ONLY for their environment variable values (.env file contents).
+3. Output the configuration.
+
+WHAT TO AUTO-DETECT (do NOT ask the user — figure them out yourself):
+1. Startup commands — from package.json scripts (look for "dev" script), Makefile, README instructions
+2. Migration commands — from prisma (npx prisma migrate deploy / npx prisma db push), drizzle, knex, sequelize, TypeORM, or whatever ORM/migration tool the project uses. If none found, leave empty.
+3. Required services (PostgreSQL, Redis, MySQL, etc.) — from docker-compose.yml, package.json deps, prisma/schema.prisma, etc.
+4. Dev server port — from vite.config.ts, next.config.js, .env.example, or package.json scripts
+5. Allowed file patterns — infer from project structure (e.g. src/**, app/**, pages/**)
+6. Context instructions — a brief description of the project
 
 WHAT TO ASK THE USER:
 - Their .env file contents (environment variables). Reassure them values will be stored encrypted.
@@ -91,17 +93,18 @@ WHAT TO ASK THE USER:
 HOW TO WORK:
 1. Use your tools to read: package.json, .env.example or .env.sample, docker-compose.yml, README.md, prisma/schema.prisma, vite.config.ts or next.config.js, turbo.json or pnpm-workspace.yaml — read as many as exist
 2. Auto-detect ALL configuration from what you find
-3. Present a SHORT summary of what you detected (services, startup commands, port)
+3. Present a SHORT summary of what you detected (startup commands, migration commands, services)
 4. Ask the user to paste their .env file (or the values for the variables you found in .env.example)
 5. Once you have the .env values, IMMEDIATELY output the [SETUP_COMPLETE] block
 
 OUTPUT FORMAT — when you have everything:
 
 [SETUP_COMPLETE]
 {
-  "requiredServices": ["postgres"],
   "startupCommands": ["npm install", "npm run dev"],
+  "migrationCommands": ["npx prisma migrate deploy"],
   "envVars": {"DATABASE_URL": "postgresql://...", "PORT": "3000"},
+  "requiredServices": ["postgres"],
   "devServerPort": 3000,
   "allowedFilePatterns": ["src/**", "public/**"],
   "contextInstructions": "Brief description of the project..."
@@ -111,13 +114,14 @@ OUTPUT FORMAT — when you have everything:
 RULES:
 - IMPORTANT: Batch multiple tool calls in a single response whenever possible. For example, read package.json, .env.example, and docker-compose.yml all in one response instead of one at a time. This saves time and cost.
 - ALWAYS read the codebase FIRST before saying anything to the user
-- Do NOT ask the user about services, ports, startup commands, or file patterns — detect them yourself
+- Do NOT ask the user about services, ports, startup commands, migration commands, or file patterns — detect them yourself
 - Do NOT ask about or suggest code changes — this is setup, not development
 - Parse the .env content the developer pastes and include ALL variables in envVars
 - Keep messages short — one message to summarize findings, one to ask for .env values
 - Do NOT output [SETUP_COMPLETE] until you have the env vars from the user
 - Keep the [SETUP_COMPLETE] JSON compact — no extra whitespace or commentary inside the block
 - Do NOT echo back or summarize all the env vars before the [SETUP_COMPLETE] block — go straight to the JSON output
+- If no migration commands are detected, set "migrationCommands" to an empty array []
 `;
 
 const tools = [
@@ -496,7 +500,7 @@ async function handlePossibleCompletion(projectId: string, chatMessages: ChatMsg
     chatMessages.push({
       id: crypto.randomUUID(),
       role: "SYSTEM",
-      content: "Project configured successfully! Building template...",
+      content: "Project configured successfully! You can now start sessions.",
       createdAt: new Date().toISOString(),
     });
     await cleanupSandbox(projectId);
@@ -551,6 +555,7 @@ export async function resetSetup(projectId: string): Promise<void> {
       envVarsIv: null,
       contextInstructions: null,
       startupCommands: [],
+      migrationCommands: [],
       requiredServices: [],
       allowedFilePatterns: [],
       devServerPort: 3000,
@@ -562,9 +567,10 @@ export async function resetSetup(projectId: string): Promise<void> {
 }
 
 async function applySetupConfig(projectId: string, config: any) {
-  const data: any = {};
+  const data: any = { templateStatus: "READY" };
   if (config.requiredServices) data.requiredServices = config.requiredServices;
   if (config.startupCommands) data.startupCommands = config.startupCommands;
+  if (config.migrationCommands) data.migrationCommands = config.migrationCommands;
   if (config.devServerPort) data.devServerPort = config.devServerPort;
   if (config.allowedFilePatterns) data.allowedFilePatterns = config.allowedFilePatterns;
   if (config.contextInstructions) data.contextInstructions = config.contextInstructions;
@@ -576,7 +582,6 @@ async function applySetupConfig(projectId: string, config: any) {
     data.envVarsIv = iv;
   }
   await prisma.project.update({ where: { id: projectId }, data });
-  buildProjectTemplate(projectId).catch(console.error);
 }
 
 async function cleanupSandbox(projectId: string) {

apps/web/src/pages/dashboard/Dashboard.tsx

@@ -22,15 +22,14 @@ import {
 
 function TemplateStatusBadge({ status }: { status: Project["templateStatus"] }) {
   const config = {
-    PENDING: { label: "Pending", className: "bg-gray-100 text-gray-600" },
-    BUILDING: { label: "Building", className: "bg-yellow-100 text-yellow-700" },
-    READY: { label: "Ready", className: "bg-green-100 text-green-700" },
-    FAILED: { label: "Failed", className: "bg-red-100 text-red-700" },
+    PENDING: { label: "Not Configured", className: "bg-gray-100 text-gray-600" },
+    BUILDING: { label: "Not Configured", className: "bg-gray-100 text-gray-600" },
+    READY: { label: "Configured", className: "bg-green-100 text-green-700" },
+    FAILED: { label: "Not Configured", className: "bg-gray-100 text-gray-600" },
   };
   const { label, className } = config[status];
   return (
     <span className={cn("inline-flex items-center rounded-full px-2 py-0.5 text-xs font-medium", className)}>
-      {status === "BUILDING" && <Loader2 className="mr-1 h-3 w-3 animate-spin" />}
       {label}
     </span>
   );

apps/web/src/pages/project/ProjectSetup.tsx

@@ -200,8 +200,6 @@ export function ProjectSetup() {
     }
   }, [orgId, projectId]);
 
-  const templateStatus = project?.templateStatus;
-
   return (
     <div className="flex h-[calc(100vh-3rem)] flex-col max-w-3xl mx-auto">
       {/* Header */}
@@ -344,35 +342,19 @@ export function ProjectSetup() {
         <div ref={messagesEndRef} />
       </div>
 
-      {/* Template build status */}
-      {setupComplete && templateStatus && (
-        <div className={cn(
-          "px-4 py-2 text-sm border-t",
-          templateStatus === "BUILDING" && "bg-yellow-50 text-yellow-800 border-yellow-200",
-          templateStatus === "READY" && "bg-green-50 text-green-800 border-green-200",
-          templateStatus === "FAILED" && "bg-red-50 text-red-800 border-red-200"
-        )}>
-          {templateStatus === "BUILDING" && (
-            <span className="flex items-center gap-2">
-              <Loader2 className="h-4 w-4 animate-spin" />
-              Building template... This may take a few minutes.
-            </span>
-          )}
-          {templateStatus === "READY" && (
-            <span className="flex items-center gap-2">
-              <CheckCircle2 className="h-4 w-4" />
-              Template ready! You can now start sessions.
-              <button
-                onClick={() => navigate(`/orgs/${orgId}`)}
-                className="ml-auto rounded-lg bg-green-700 px-3 py-1 text-xs font-medium text-white hover:bg-green-800"
-              >
-                Go to Dashboard
-              </button>
-            </span>
-          )}
-          {templateStatus === "FAILED" && (
-            <span>Template build failed. Check the build log.</span>
-          )}
+      {/* Setup complete status */}
+      {setupComplete && (
+        <div className="px-4 py-2 text-sm border-t bg-green-50 text-green-800 border-green-200">
+          <span className="flex items-center gap-2">
+            <CheckCircle2 className="h-4 w-4" />
+            Project configured! You can now start sessions.
+            <button
+              onClick={() => navigate(`/orgs/${orgId}`)}
+              className="ml-auto rounded-lg bg-green-700 px-3 py-1 text-xs font-medium text-white hover:bg-green-800"
+            >
+              Go to Dashboard
+            </button>
+          </span>
         </div>
       )}
 

packages/shared/src/types/project.ts

@@ -9,6 +9,7 @@ export interface Project {
   defaultBranch: string;
   contextInstructions: string | null;
   startupCommands: string[];
+  migrationCommands: string[];
   requiredServices: string[];
   allowedFilePatterns: string[];
   devServerPort: number;