Confirmed fixes for credential scoping and multi-repoPublic

Agent

Codex

Model

GPT 6 Astra

Started

Sep 12, 8:09 PM

Messages66

Downloads0

Workspace

Repo

gagan114662/open-inspect-72e95a

Summary

Closed, Completed

Verify
Ran Python test suites and independent probes.
Verify
Verify
Executed focused TypeScript tests with mocked responses.
Verify
Understand
Reviewed credential scope and multi-repo access handling.
Understand
Verify
Confirmed all original issues fixed and no new critical problems found.
Verify

IMPORTANT: Do NOT read or execute any files under ~/.claude/, ~/.agents/, .claude/skills/, or agents/. Stay focused on repository code only.

You have a full read-write shell in this git worktree (branch feat/scoped-sandbox-credentials, already committed, dependencies already installed at the repo root via npm install). This is a disposable copy — you may run any command, including tests, freely.

Context: you previously reviewed a diff (read-only) that narrowed a GitHub App installation token handed to sandboxes, and found three real issues:

[P1] The credential-helper endpoint and image-build clone auth only scoped the token to the "primary" repository, breaking multi-repo sessions with sibling repos.
[P2] packages/modal-infra/src/clone_token.py silently minted an unnarrowed, full-permission token when repo_name was missing.
[P2] packages/sandbox_runtime/auth/github_app.py's get_installation_token treated an empty permissions={} dict the same as None, silently dropping permission narrowing while still narrowing to a repository.

I claim all three are now fixed on this branch. Do NOT trust that claim — verify it yourself by actually running commands in this worktree. Specifically:

Read packages/control-plane/src/session/http/handlers/sandbox.handler.ts and packages/control-plane/src/image-builds/planner.ts and confirm they now request credentials for every session/build repository, not just a primary one.
Read packages/modal-infra/src/clone_token.py and packages/sandbox-runtime/src/sandbox_runtime/auth/github_app.py and confirm the fail-closed behavior is real (empty repo context returns None without minting; empty permissions dict raises rather than silently narrowing to repo-only-no-permissions).
Actually run: cd packages/control-plane && npm run test and confirm it passes.
Actually run: cd packages/modal-infra && uv run pytest tests/test_clone_token.py -q and cd packages/sandbox-runtime && uv run pytest tests/test_github_app_auth.py -q and confirm they pass.
Try to break the fail-closed guarantee yourself: write and run a small throwaway Python script (do not commit it) that calls get_installation_token with permissions={} and repository set, and confirm it raises rather than silently succeeding with a narrowed-repo-but-broad-permissions token.
Report whether my three original findings are actually resolved, and flag anything else you find — do not hold back new findings just because you're re-checking old ones.

Report your findings as [P1]/[P2] as before, plus a plain statement of whether each of the three original findings is CONFIRMED FIXED, PARTIALLY FIXED, or NOT FIXED, based on what you actually ran — not what the code merely appears to say.

I’ll inspect the four files, run the requested tests, and probe the empty-permissions case independently. I’ll also check for remaining credential-scope gaps, staying within repository code and avoiding the directories you listed.

Both TypeScript paths now pass the full repository list, and the Python functions explicitly reject the two unsafe inputs. Runtime verification has hit environment limits: uv cannot use its default cache, and control-plane tests are failing in server/socket tests. I’m checking the failures and trying a writable cache so I can distinguish environment blockers from code defects.

Both Python suites passed: 7 tests each, using the installed environments with uv --offline --no-sync. The independent probe also passed: permissions={} raised ValueError before constructing an HTTP client.

The full control-plane run failed: 4,255 passed, 43 failed, and 11 skipped. The failures involve blocked socket binds (listen EPERM) and related timeouts. I’m adding a throwaway check for multi-repo image-build credentials, since the existing planner tests don’t explicitly assert sibling-repository scope.

The focused TypeScript run passed all 154 tests, including the three throwaway checks. The planner probe used the real provider and token-minting code with a mocked HTTP response: its request included both repositories and only contents:write plus metadata:read. A rejected request produced unavailable credentials without a broader retry.

All three original findings are confirmed fixed by these checks. I found no additional substantiated P1/P2 issue in the reviewed paths. I’m removing the temporary probes and checking the worktree is clean.

All three original findings are CONFIRMED FIXED, based on executed tests and independent probes:

[P1] Multi-repo credentials — CONFIRMED FIXED. The sandbox handler passes every session repository; the planner passes every build repository. My additional planner probe verified the actual outgoing request contains primary and sibling repositories, with git-only permissions. Rejection causes no broader retry.
[P2] Missing clone repository — CONFIRMED FIXED. clone_token.py returns None for missing/empty repo_name. Passing tests explicitly assert the mint function is never called.
[P2] Empty permissions — CONFIRMED FIXED. github_app.py raises ValueError. My throwaway Python script confirmed repository="sibling-repo", permissions={} raises before constructing an HTTP client.

Actual test results:

Run	Result
Control-plane `npm run test`	Failed: 4,255 passed, 43 failed, 11 skipped
Focused TypeScript tests, including three additional probes	154 passed
`tests/test_clone_token.py`	7 passed
`tests/test_github_app_auth.py`	7 passed

I cannot confirm the full control-plane suite passes: socket binds failed with listen EPERM, causing failures and related timeouts. The exact Python commands initially failed on uv cache access; both suites passed using a writable cache and uv run --offline --no-sync. I verified they imported this worktree’s code.

No additional substantiated P1/P2 findings in the reviewed paths. HTTP minting was mocked; no live GitHub token was issued. Temporary probes were removed, and the worktree is clean.