docs: healer passive mode, syncing status in Manage UI, WorkOS sign-in update

[morfeusys]

What changed and why

Five documentation gaps found by auditing recent commits in shmastra, shmastra-cloud, and shmastra-widget against the current docs.

1. docs/cloud/day-2/healer-agent.md — passive mode

The old doc said the healer "stops to avoid infinite loops" after 3 failed attempts. That was incorrect: the healer now enters passive mode — it keeps health-polling every 20 s but skips agent invocations, and exits passive mode automatically when health recovers.

Changes:

• Updated the "Outcome" entry in "How the heal works" to describe passive mode
• Added a dedicated Passive mode section explaining the behavior and rationale (prevents token burn while still detecting self-recovery)
• Updated the Status transitions diagram to show the broken + passive mode → ready path
• Updated "What to do when a sandbox is broken" to reflect that the sandbox may self-recover

Source commit: 5e7274e (Add passive mode to healer after max failed heal attempts) in shmastra-cloud.

2. docs/cloud/manage-ui/sandbox-table.md — syncing status + GitLab repo icon

Two things were missing from the sandbox table reference:

• The syncing status (added when GitLab auto-sync was introduced) was absent from both the Columns status list and the Status meanings table
• The GitLab repo icon that appears next to the email when auto-sync is enabled was not mentioned

Changes:

• Added syncing to the Status column description and the Status meanings table (with a link to Project persistence)
• Updated the broken description to mention passive mode (consistent with healer-agent.md)
• Added a note about the repo icon in the Email column description
• Updated the data source note to include the projects table

Source commit: 94bf5c4 (rework PR #9) in shmastra-cloud.

3. docs/cloud/setup/workos.md — magic-code sign-in flow

The setup page described sign-in as "users see a hosted sign-in page" (WorkOS's hosted UI). This was replaced by an internal magic-code form: the user enters their email on Shmastra Cloud's own page, WorkOS delivers a one-time code, and after entering it the user is returned to the page they were trying to reach via the returnTo parameter.

Changes:

• Updated the intro paragraph to describe the magic-code flow
• Clarified in Step 2 that Magic Auth is the required authentication method
• Added a note to Step 3 explaining what the /callback redirect URI is used for

Source commit: f6946b7 (Add returnTo flow for magic-code sign-in) in shmastra-cloud.

4. docs/cloud/architecture.md — sandbox scripts list

The Key files section listed only ecosystem.config.cjs, start.sh, and healer.mts under scripts/sandbox/. Two scripts added as part of the GitLab project auto-sync feature were missing:

• project-watcher.sh — inotifywait-driven git auto-commit/push daemon (runs only when GitLab is configured)
• sync.sh — force-pull script triggered by the git proxy on external pushes

Also updated the description to note that these files are now shipped via three paths (E2B template build, provision-time overlay via lib/bootstrap-files.ts, and the update pipeline) rather than only baked into the template.

Source commits: 94bf5c4 (PR #9) in shmastra-cloud.

5. docs/.vitepress/config.ts — remove duplicate nav entry

Both /cloud/sharing-apps and /cloud/app-sharing were listed under "Running Cloud" in the sidebar. app-sharing.md is the comprehensive, up-to-date page added when app sharing shipped; sharing-apps.md is the earlier stub. Removed the stale sharing-apps entry so users see a single link.