[quickbeard]

Problem

The bucket moved the sandbox images from codev-code/sandbox to codev/sandbox. #230 repointed SANDBOX_IMAGES_BASE_URL so downloads worked again, but script/publish-image.ts carried its own hardcoded copy of the prefix and was missed:

...files.map((name) => [join(outDir, name), `codev-code/sandbox/${version}/${name}`] as const),
[join(outDir, "manifest.json"), "codev-code/sandbox/manifest.json"] as const,

So a publish uploaded everything under a prefix that reads 403 and left the manifest.json clients actually fetch untouched — it printed published sandbox image <version> and changed nothing. Silent, and only visible by noticing that no client ever picked the new image up.

Fix

Derive the destinations from the manifest's own asset URLs and SANDBOX_MANIFEST_URL. sandboxStorageObjectKey (new, in src/const.ts) turns a client URL into an mc object key by dropping the first path segment — the bucket, which CODEV_STORAGE_TARGET already carries as alias/bucket.

That makes the publish destination and the client read path the same expression, so they cannot drift again. It is also strictly more correct than rebuilding the path from --version: the upload now goes exactly where the manifest advertises the artifacts, and the existing guard above already rejects a manifest whose imageVersion is not the version being published.

No behavior change beyond the path. Artifacts still upload before manifest.json.

Verification

• bun test in packages/codev-sandbox: 122 pass, 2 skip (the bwrap integration pair, which self-skips off Linux)
• bun typecheck: clean
• Ran the script against a synthetic out dir; printed commands now target the live prefix, manifest last:

mc cp .../bwrap-arm64.tar.gz <alias/bucket>/codev/sandbox/1.2.3/bwrap-arm64.tar.gz
mc cp .../vz-arm64.tar.gz    <alias/bucket>/codev/sandbox/1.2.3/vz-arm64.tar.gz
mc cp .../bwrap-x64.tar.gz   <alias/bucket>/codev/sandbox/1.2.3/bwrap-x64.tar.gz
mc cp .../vz-x64.tar.gz      <alias/bucket>/codev/sandbox/1.2.3/vz-x64.tar.gz
mc cp .../manifest.json      <alias/bucket>/codev/sandbox/manifest.json

src/const.test.ts pins the invariant as a suffix check against SANDBOX_MANIFEST_URL rather than the literal prefix, so a deliberate future bucket move stays a one-line change in const.ts.

Notes

• No DIVERGENCES.md row: packages/codev-sandbox is fork-only, and no upstream file is touched.
• No CHANGELOG.md entry: this is a release-tooling fix with no user-facing behavior change.
• Unrelated but worth knowing before the next publish: the release-version guard (publish-image.ts:41) only accepts x.y.z, so publishing an image versioned after the desktop app (e.g. 1.18.4-8) still needs --force.

🤖 Generated with Claude Code