fix(daytona): accept newer permission scopes

[brynary]

Summary

• update the Daytona SDK pin to fix(api): accept unknown permission scopes brynary/daytona-sdk-rust#4
• allow Daytona API responses to include permission scopes added after the generated client
• cover the current manage:secrets, read:limits, and manage:sso scopes in Fabro credential validation

Fabro still checks for all four required snapshot and sandbox scopes. Request-side permission parsing remains strict.

Dependency

• fix(api): accept unknown permission scopes brynary/daytona-sdk-rust#4
• pinned SDK commit: 73c9c458dd1a1d096afd3521175637af82afd8d8

Tests

• cargo +nightly-2026-04-14 fmt --check --all
• cargo test --locked -p fabro-sandbox --all-features check_daytona_api_key_with_accepts_full_scopes_and_new_scopes
• cargo +nightly-2026-04-14 clippy --locked --workspace --all-targets -- -D warnings
• cargo nextest run --locked --workspace --status-level slow --profile ci (7,676 passed; 203 skipped)

Security review

No findings. Unknown response scopes cannot satisfy any required Fabro permission check.

[Copilot]

Pull request overview

Updates Fabro’s Daytona integration to tolerate new permission scopes returned by the Daytona API by pinning to an updated daytona-sdk-rust revision, and expands the existing credential-probe test to include currently observed “new” scopes while still enforcing Fabro’s required snapshot/sandbox scopes.

Changes:

• Bump daytona-sdk / daytona-api-client git revisions to 73c9c458dd1a1d096afd3521175637af82afd8d8.
• Extend the Daytona API key validation test to include additional non-required scopes (manage:secrets, read:limits, manage:sso) in the mocked API response.
• Update Cargo.lock to reflect the new git sources for the Daytona crates.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.

File	Description
lib/components/fabro-sandbox/src/daytona/mod.rs	Updates the API-key scope validation test to ensure extra/new scopes in the response don’t break Fabro’s required-scope checks.
Cargo.toml	Pins Daytona SDK/client dependencies to the updated upstream commit.
Cargo.lock	Locks the updated Daytona dependency sources to the new git revision.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.