ref(egress): simplify host installation credential cache - #1700
Merged
Conversation
Keep sandbox isolation via host injection, but stop minting and caching installation tokens per sandbox context or repository lease scope. Share installation leases on the host, refresh before expiry, and remint once on upstream 403 so mid-PR pushes no longer look like lost App write access. Co-Authored-By: David Cramer <david@sentry.io>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Rewrite comments, docs, and test titles in plain language. Drop leftover repository-scoped wording and other internal slang from the simplification. Co-Authored-By: David Cramer <david@sentry.io>
Keep hard rules and tool routing in SKILL.md. Move edit/PR packaging, command matrices, and troubleshooting into references so every run does not load the full handbook. Co-Authored-By: David Cramer <david@sentry.io>
Agent display name is configurable. Prefer runtime/bot wording in skill text, and keep protocol tokens like junior-auth-required unchanged. Co-Authored-By: David Cramer <david@sentry.io>
Agent display name is configurable. Prefer runtime/bot wording in skills and tool descriptions/errors. Keep protocol tokens and session footer product links unchanged. Co-Authored-By: David Cramer <david@sentry.io>
Keep the tool-error classification baseline in sync with the agent-name neutral create issue/PR failure messages.
Remove dead review-thread repo-ref validation, skip the second-pass host transform recheck on 403 retry, and neutralize remaining agent-branded permission-denied copy. Co-Authored-By: David Cramer <david@sentry.io>
dcramer
marked this pull request as ready for review
August 26, 2026 02:51
dcramer
approved these changes
Aug 26, 2026
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 9885da8. Configure here.
System runs with a delegated user subject must not share one user/broker lease cache entry. Key those grants by subject user id so a later hop cannot reuse another user's host-held credential.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Recovers the unfinished work from the mid-PR push thread.
Problem
Intermittent GitHub receive-pack 403s after a good installation-token mint looked like Junior lost App write access mid-PR. The lease cache was also keyed by sandbox
egressId+contextIdand repository lease scope, so each new sandbox minted tokens too often and made the failure more likely.Change
Keep the real security boundary: the sandbox never sees tokens; host egress injects them.
Simplify the machinery around it:
provider + grant(shared across sandboxes)installation-writetoken mint bodies (use full installed App permissions; repo allowlist stays policy and install scope)Supersedes the narrower retry-only draft in #1694.
Thread: https://sentry.slack.com/archives/C0AHB7N2JCR/p1787690872538269
Requested by David Cramer.
--
View Junior Session [Sentry]