Hide excluded sandbox providers during setup

apps/web/src/app/(onboarding)/setup/StepComputeProvider.tsx

@@ -30,11 +30,13 @@ export function StepComputeProvider({
   onBack?: () => void;
   disabled?: boolean;
 }) {
-  // All providers are offered. Hosted providers whose worker image is not yet
-  // available are still selectable: their config step collects a shared worker
-  // image (and can auto-derive or provision the provider artifact from it), so
-  // the operator is no longer dead-ended by missing infrastructure.
-  const availableProviders = computeSetup.providers;
+  // Hosted providers whose worker image is not yet available remain selectable:
+  // their config step can collect or provision the missing infrastructure.
+  // Explicit deployment exclusions are stronger and must not be offered.
+  const excludedProviders = new Set(computeSetup.excludedProviders ?? []);
+  const availableProviders = computeSetup.providers.filter(
+    (provider) => !excludedProviders.has(provider.provider),
+  );
 
   return (
     <div className="relative w-full max-w-2xl space-y-6 py-2 md:py-0">

apps/web/src/app/(onboarding)/setup/hooks.ts

@@ -337,6 +337,10 @@ export function useSetupFlow(
         status.setupNewState.authProvider ??
         status.authSetup.runtimeConfiguredProvider ??
         status.authSetup.selectedProvider;
+      const selectedComputeProvider = status.computeSetup.selectedProvider;
+      const hasStaleComputeProvider =
+        status.setupNewState.computeProvider !== null &&
+        selectedComputeProvider !== status.setupNewState.computeProvider;
 
       switch (candidate) {
         case 'welcome':
@@ -389,17 +393,15 @@ export function useSetupFlow(
           return activeQualificationBlock === null;
         case 'compute-provider':
           return (
-            status.computeSetup.setupSatisfied ||
-            status.setupNewState.computeProvider != null
+            !hasStaleComputeProvider &&
+            (status.computeSetup.setupSatisfied ||
+              selectedComputeProvider !== null)
           );
         case 'compute-config': {
-          if (status.computeSetup.setupSatisfied) {
+          if (hasStaleComputeProvider || status.computeSetup.setupSatisfied) {
             return true;
           }
 
-          const selectedComputeProvider =
-            status.setupNewState.computeProvider ?? null;
-
           if (!selectedComputeProvider) {
             return true;
           }

apps/web/src/trpc/commands/setup-new/index.ts

@@ -80,6 +80,7 @@ import {
   SETUP_COMPUTE_PROVISIONING_STATE_FIELDS,
   SHARED_WORKER_IMAGE_ENV_VAR,
   type SetupAuthProviderId,
+  type SetupComputeStatus,
   type SetupModelProviderId,
   type SetupProvisionableComputeProvider,
   type SourceControlProvider,
@@ -539,6 +540,19 @@ type SetupOnboardingComputeGate = {
   error: string | null;
 };
 
+function findAvailableSetupComputeProvider(
+  computeSetup: SetupComputeStatus,
+  provider: ComputeProvider,
+) {
+  if (computeSetup.excludedProviders?.includes(provider)) {
+    return undefined;
+  }
+
+  return computeSetup.providers.find(
+    (candidate) => candidate.provider === provider,
+  );
+}
+
 async function getSetupOnboardingComputeGate(
   setupNewState: PersistedSetupNewState,
   executor: DatabaseOrTransaction,
@@ -1537,8 +1551,9 @@ export async function saveSetupNewComputeProviderChoiceCommand(
       persistedComputeConfig: persistedRuntimeComputeConfig,
       selectedProvider: input.provider,
     });
-    const providerStatus = computeSetup.providers.find(
-      (candidate) => candidate.provider === input.provider,
+    const providerStatus = findAvailableSetupComputeProvider(
+      computeSetup,
+      input.provider,
     );
 
     if (!providerStatus) {
@@ -1602,12 +1617,6 @@ export async function saveSetupNewComputeConfigCommand(
         templateRef: string;
       } | null = null;
 
-      if (isSetupProvisionableComputeProvider(input.provider)) {
-        await acquireComputeProvisioningLock(input.provider, tx);
-      }
-
-      await purgeSavedDeploymentWorkerImage(tx);
-
       const [
         currentState,
         persistedRuntimeComputeConfig,
@@ -1635,14 +1644,21 @@ export async function saveSetupNewComputeConfigCommand(
         persistedComputeConfig: persistedRuntimeComputeConfig,
         selectedProvider: input.provider,
       });
-      const providerStatus = computeSetup.providers.find(
-        (candidate) => candidate.provider === input.provider,
+      const providerStatus = findAvailableSetupComputeProvider(
+        computeSetup,
+        input.provider,
       );
 
       if (!providerStatus) {
         throw new Error('Selected sandbox provider is unavailable.');
       }
 
+      if (isSetupProvisionableComputeProvider(input.provider)) {
+        await acquireComputeProvisioningLock(input.provider, tx);
+      }
+
+      await purgeSavedDeploymentWorkerImage(tx);
+
       // Derive MODAL_BASE_IMAGE_REF when not env-provided or already saved.
       // Form submissions are ignored (deployment-managed like E2B/Daytona
       // artifacts).
@@ -2266,6 +2282,22 @@ export async function startSetupNewOnboardingTaskCommand(
       };
     }
 
+    if (currentState.computeProvider) {
+      const persistedRuntimeComputeConfig =
+        await getPersistedRuntimeComputeConfig(tx);
+      const computeSetup = buildSetupComputeStatus({
+        runtimeEnv: process.env,
+        persistedComputeConfig: persistedRuntimeComputeConfig,
+        selectedProvider: currentState.computeProvider,
+      });
+
+      if (computeSetup.selectedProvider !== currentState.computeProvider) {
+        throw new Error(
+          'Selected sandbox provider is no longer available. Choose another provider before starting setup.',
+        );
+      }
+    }
+
     const { normalizedRepositoryIds, selectedRepositories } =
       await resolveSelectedRepositories(currentState.selectedRepositoryIds);
     await assertHasCommittedRepositorySelection(normalizedRepositoryIds);