OUT-4067: migrate to @assembly-js/node-sdk

[SandipBajracharya]

Summary

Migrates the app from the deprecated copilot-node-sdk to @assembly-js/node-sdk v4.2.2.

The new SDK's session tokens expire after 5 minutes, which breaks long-running Trigger.dev file-sync tasks. To avoid mid-sync expiry, the app now authenticates with a workspace-scoped API key (workspaceId/apiKey) and no token. CopilotAPI takes a workspaceId (callers pass user.portalId); the request token is decoded only at the auth boundary via a token-scoped SDK.

Commits

• feat: SDK migration — CopilotAPI/utils/User.model/base.service/types + all call sites (Sync.service, resync helper, processFileSync, workspace); removed unused SDK methods; dropped the copilot-node-sdk dependency.
• feat: server.env.ts now validates COPILOT_ENV/ASSEMBLY_ENV so a misconfigured runtime fails fast at boot instead of on the first API call.
• test: updated integration config (inline new SDK), MSW host (api.assembly.com) + createFile mock casing, and workspace tests for the decode-then-construct flow.

Tenant isolation

Reviewed for cross-portal leakage (multi-tenant: one portal = one Assembly workspace). Confirmed safe — every CopilotAPI is freshly scoped to a portalId/workspaceId from a decoded token or DB row; no module-level singleton/cache that could bleed across warm Vercel/Trigger.dev instances. The SDK isolates concurrent requests via AsyncLocalStorage and never mutates global config.

Verification

• pnpm typecheck — clean
• pnpm biome lint src test — clean
• Unit tests — 198/198
• Integration tests — 18/18 files, 131/131
• pnpm build — clean

⚠️ Deploy action required

server.env.ts fail-closes at import unless COPILOT_ENV (or ASSEMBLY_ENV) is local. Set COPILOT_ENV=local in Vercel (all envs) and Trigger.dev before/with merge, or every API route and sync task will crash on cold start.

🤖 Generated with Claude Code

[linear-code]

OUT-4067

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
dropbox-integration	Ready	Preview	Aug 19, 2026 2:36pm

[greptile-apps]

Greptile Summary

The PR migrates Assembly access from the deprecated Copilot SDK to @assembly-js/node-sdk, replacing expiring session-token use during synchronization with workspace-scoped API-key clients.

• Decodes request tokens only at authentication boundaries and constructs workspace-scoped clients for subsequent operations.
• Updates file synchronization, resynchronization, workspace lookup, SDK adapters, integration mocks, and tests.
• Adds fail-fast validation requiring a keyless Assembly environment mode at build and runtime.
• Removes obsolete SDK wrappers and dependency artifacts.

Confidence Score: 5/5

The PR appears safe to merge once the explicitly documented COPILOT_ENV or ASSEMBLY_ENV deployment configuration is applied.

The migrated call sites consistently derive workspace scope from decoded tokens or persisted users, no removed wrapper consumers remain, and the reviewed changes reveal no concrete blocking failure beyond the acknowledged deployment prerequisite.

Important Files Changed

Filename	Overview
src/lib/copilot/CopilotAPI.ts	Replaces the deprecated SDK adapter with lazy workspace-scoped Assembly clients and updates retained API operations to the new method shapes.
src/lib/copilot/utils.ts	Adds token-scoped payload decoding so request credentials are used only at the authentication boundary.
src/lib/copilot/models/User.model.ts	Authenticates by decoding the request token and initializes the long-lived API wrapper using the decoded workspace ID.
src/config/server.env.ts	Adds import-time validation for the SDK environment mode, with the required deployment configuration explicitly documented by the PR.
src/features/sync/lib/Sync.service.ts	Reuses the service's workspace-scoped API client instead of repeatedly constructing token-scoped clients.
src/trigger/processFileSync.ts	Scopes Assembly-to-Dropbox synchronization to the persisted user portal ID.
src/utils/workspace.ts	Decodes the request token before constructing a workspace-scoped client for workspace retrieval.
test/msw/write.ts	Updates the create-file mock to recognize the new SDK's channelID request field.
vitest.integration.config.ts	Inlines the replacement SDK to accommodate its internal ESM resolution behavior during integration tests.

Sequence Diagram

sequenceDiagram
    participant Request
    participant Auth as Token decoder
    participant App as Sync/workspace service
    participant SDK as Assembly SDK
    participant API as Assembly API
    Request->>Auth: Request token
    Auth->>SDK: assemblyApi(apiKey, token)
    SDK-->>Auth: workspaceId payload
    Auth->>App: Authenticated user/workspaceId
    App->>SDK: assemblyApi(workspaceId/API key)
    SDK->>API: Workspace-scoped operations
    API-->>App: Files/workspace data

Loading

_{Reviews (1): Last reviewed commit: "test(OUT-4067): update tests and msw har..." | Re-trigger Greptile}

[priosshrsth]

lgtm