From fd18ee214c7a838c9780056ff9220c3828dc4281 Mon Sep 17 00:00:00 2001 From: Alessandro Pogliaghi Date: Tue, 21 Jul 2026 19:27:53 +0100 Subject: [PATCH 1/2] fix(cloud-agent): use refreshed token for signed commits Generated-By: PostHog Code Task-Id: 5d51048c-d903-459e-a770-028ab37f9099 --- packages/agent/src/signed-commit-artefacts.ts | 2 +- packages/agent/src/utils/github-token.ts | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/packages/agent/src/signed-commit-artefacts.ts b/packages/agent/src/signed-commit-artefacts.ts index 0ce2441937..e5048da1a2 100644 --- a/packages/agent/src/signed-commit-artefacts.ts +++ b/packages/agent/src/signed-commit-artefacts.ts @@ -1,7 +1,7 @@ import { readFileSync } from "node:fs"; import type { SignedCommitResult } from "@posthog/git/signed-commit"; import { PostHogAPIClient } from "./posthog-api"; -import { SANDBOX_ENV_FILE } from "./utils/github-token"; +const SANDBOX_ENV_FILE = "/tmp/agent-env"; /** * Best-effort "commit hook": after a successful signed-commit push, record one `commit` diff --git a/packages/agent/src/utils/github-token.ts b/packages/agent/src/utils/github-token.ts index 33a8f15a5e..1e1ae73228 100644 --- a/packages/agent/src/utils/github-token.ts +++ b/packages/agent/src/utils/github-token.ts @@ -2,15 +2,15 @@ import { readFileSync } from "node:fs"; import { readGithubTokenFromEnv } from "@posthog/git/signed-commit"; // helpers for resolving the in-sandbox GitHub token -// agentsh env file (NUL-delimited `key=value` pairs) that the PostHog backend -// rewrites in place when it refreshes the sandbox's GitHub credentials +// Dedicated agentsh credential file (NUL-delimited `key=value` pairs) that the +// PostHog backend rewrites in place when it refreshes GitHub credentials // mid-session. The agent-server process env is frozen at launch, so reading // this live file is how in-process tools pick up a refreshed token without a // process restart. -export const SANDBOX_ENV_FILE = "/tmp/agent-env"; +const SANDBOX_GITHUB_ENV_FILE = "/tmp/agent-github-env"; export function readGithubTokenFromSandboxEnvFile( - envFilePath: string = SANDBOX_ENV_FILE, + envFilePath: string = SANDBOX_GITHUB_ENV_FILE, ): string | undefined { try { const raw = readFileSync(envFilePath, "utf8"); @@ -36,7 +36,7 @@ export function readGithubTokenFromSandboxEnvFile( * signed-commit tool — pick up a refreshed token without a restart. */ export function resolveGithubToken( - envFilePath: string = SANDBOX_ENV_FILE, + envFilePath: string = SANDBOX_GITHUB_ENV_FILE, ): string | undefined { return ( readGithubTokenFromSandboxEnvFile(envFilePath) ?? readGithubTokenFromEnv() From b5934185a75949dbf8cd07988f8d3663ee50f854 Mon Sep 17 00:00:00 2001 From: Alessandro Pogliaghi Date: Tue, 21 Jul 2026 19:31:01 +0100 Subject: [PATCH 2/2] chore(cloud-agent): organize imports Generated-By: PostHog Code Task-Id: 5d51048c-d903-459e-a770-028ab37f9099 --- packages/agent/src/signed-commit-artefacts.ts | 1 + 1 file changed, 1 insertion(+) diff --git a/packages/agent/src/signed-commit-artefacts.ts b/packages/agent/src/signed-commit-artefacts.ts index e5048da1a2..c0c5818b2f 100644 --- a/packages/agent/src/signed-commit-artefacts.ts +++ b/packages/agent/src/signed-commit-artefacts.ts @@ -1,6 +1,7 @@ import { readFileSync } from "node:fs"; import type { SignedCommitResult } from "@posthog/git/signed-commit"; import { PostHogAPIClient } from "./posthog-api"; + const SANDBOX_ENV_FILE = "/tmp/agent-env"; /**