Skip to content
This repository was archived by the owner on Aug 6, 2026. It is now read-only.

fix(cloud-agent): use refreshed token for signed commits #3652

Merged
trunk-io merged 2 commits into from
Jul 21, 2026
Merged

fix(cloud-agent): use refreshed token for signed commits #3652

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
fd18ee2
fix(cloud-agent): use refreshed token for signed commits
tatoalo Jul 21, 2026
b593418
chore(cloud-agent): organize imports
tatoalo Jul 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion packages/agent/src/signed-commit-artefacts.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,8 @@
import { readFileSync } from "node:fs";
import type { SignedCommitResult } from "@posthog/git/signed-commit";
import { PostHogAPIClient } from "./posthog-api";
import { SANDBOX_ENV_FILE } from "./utils/github-token";

const SANDBOX_ENV_FILE = "/tmp/agent-env";

/**
* Best-effort "commit hook": after a successful signed-commit push, record one `commit`
Expand Down
10 changes: 5 additions & 5 deletions packages/agent/src/utils/github-token.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,15 +2,15 @@ import { readFileSync } from "node:fs";
import { readGithubTokenFromEnv } from "@posthog/git/signed-commit";

// helpers for resolving the in-sandbox GitHub token
// agentsh env file (NUL-delimited `key=value` pairs) that the PostHog backend
// rewrites in place when it refreshes the sandbox's GitHub credentials
// Dedicated agentsh credential file (NUL-delimited `key=value` pairs) that the
// PostHog backend rewrites in place when it refreshes GitHub credentials
// mid-session. The agent-server process env is frozen at launch, so reading
// this live file is how in-process tools pick up a refreshed token without a
// process restart.
export const SANDBOX_ENV_FILE = "/tmp/agent-env";
const SANDBOX_GITHUB_ENV_FILE = "/tmp/agent-github-env";

@greptile-apps greptile-apps Bot Jul 21, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 security Missing Live File Reuses Stale Token

When a sandbox deployment still writes refreshed credentials only to /tmp/agent-env, this new default misses the live file and silently falls back to the process-start token. After credentials rotate or the GitHub actor changes, signed commits can use the expired or previous actor's token instead of the refreshed credential.

Prompt To Fix With AI 
This is a comment left during a code review.
Path: packages/agent/src/utils/github-token.ts
Line: 10

Comment:
**Missing Live File Reuses Stale Token**

When a sandbox deployment still writes refreshed credentials only to `/tmp/agent-env`, this new default misses the live file and silently falls back to the process-start token. After credentials rotate or the GitHub actor changes, signed commits can use the expired or previous actor's token instead of the refreshed credential.

How can I resolve this? If you propose a fix, please make it concise.


export function readGithubTokenFromSandboxEnvFile(
envFilePath: string = SANDBOX_ENV_FILE,
envFilePath: string = SANDBOX_GITHUB_ENV_FILE,
): string | undefined {
try {
const raw = readFileSync(envFilePath, "utf8");
Expand All @@ -36,7 +36,7 @@ export function readGithubTokenFromSandboxEnvFile(
* signed-commit tool — pick up a refreshed token without a restart.
*/
export function resolveGithubToken(
envFilePath: string = SANDBOX_ENV_FILE,
envFilePath: string = SANDBOX_GITHUB_ENV_FILE,
): string | undefined {
return (
readGithubTokenFromSandboxEnvFile(envFilePath) ?? readGithubTokenFromEnv()
Expand Down
Loading