From 346dba6e50bf564a7422943a868d9ec76a1132f7 Mon Sep 17 00:00:00 2001 From: Bryan Helmkamp Date: Fri, 11 Sep 2026 09:50:18 -0600 Subject: [PATCH] Pin sandbox-driver at the ambient credentials facet The driver branch adds `Git::set_ambient_credentials`, classifies a missing `git` executable as `GitFailureKind::GitUnavailable`, and runs Daytona's pinned clones through the derived clone after a new conformance check caught the toolbox pin failing. The project notes follow the last change. Co-Authored-By: Claude Fable 5.1 --- AGENTS.md | 11 ++++++----- Cargo.lock | 16 ++++++++-------- Cargo.toml | 18 +++++++++--------- .../{push_credentials.rs => credentials.rs} | 0 lib/components/fabro-sandbox/src/redact.rs | 6 ------ 5 files changed, 23 insertions(+), 28 deletions(-) rename lib/components/fabro-sandbox/src/{push_credentials.rs => credentials.rs} (100%) delete mode 100644 lib/components/fabro-sandbox/src/redact.rs diff --git a/AGENTS.md b/AGENTS.md index cfc5853c3..23f7bfd56 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -33,11 +33,12 @@ macOS note: if `cargo nextest run` fails with `Too many open files (os error 24) - Docker and Daytona are clone-based providers. When a run manifest has a GitHub origin, they clone it into the provider workspace. Present non-GitHub origins fail unless the provider has `skip_clone = true`; absent origins or `skip_clone = true` create an empty workspace without repository files. For an exact commit, the submitted branch names the working branch and the syntactically valid SHA is requested directly. No layer proves branch/SHA ancestry: a fetchable commit is checked out, an unavailable commit fails setup, and branch HEAD is never substituted. - The sandbox layer also accepts an optional exact commit for future admitted runs. An exact commit always requires a non-empty branch. The sandbox driver - performs the pin: Docker initializes an empty repository, fetches the SHA - directly at the requested depth, and attaches the admitted branch to it; - Daytona uses its official SDK clone with both `branch` and `commit_id` and - attaches the branch the same way, so the workspace reports the admitted - branch name. A successful clone has the pin checked out; the driver's + performs the pin the same way on every provider: it initializes an empty + repository, fetches the SHA directly at the requested depth, and attaches + the admitted branch to it, so the workspace reports the admitted branch + name. Daytona's native toolbox clone serves plain branch clones only; its + commit pin checks the branch head out first, so the driver does not use + it. A successful clone has the pin checked out; the driver's conformance suite verifies that on every provider, and fabro does not re-verify HEAD. Never fall back to a newer branch HEAD, and do not wire this capability directly from legacy `GitContext.sha`. The sandbox layer diff --git a/Cargo.lock b/Cargo.lock index 749b34e4f..ce55f4416 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -6994,7 +6994,7 @@ dependencies = [ [[package]] name = "sandbox-driver" version = "0.1.0" -source = "git+https://github.com/lithoscomputer/sandbox-driver?rev=23062b6ad62ff4665cbbcb7dce037ec9c4c34318#23062b6ad62ff4665cbbcb7dce037ec9c4c34318" +source = "git+https://github.com/lithoscomputer/sandbox-driver?rev=7fc225afc56710d629b6f0f81392068767a1b6f1#7fc225afc56710d629b6f0f81392068767a1b6f1" dependencies = [ "async-trait", "globset", @@ -7010,7 +7010,7 @@ dependencies = [ [[package]] name = "sandbox-driver-daytona" version = "0.1.0" -source = "git+https://github.com/lithoscomputer/sandbox-driver?rev=23062b6ad62ff4665cbbcb7dce037ec9c4c34318#23062b6ad62ff4665cbbcb7dce037ec9c4c34318" +source = "git+https://github.com/lithoscomputer/sandbox-driver?rev=7fc225afc56710d629b6f0f81392068767a1b6f1#7fc225afc56710d629b6f0f81392068767a1b6f1" dependencies = [ "anyhow", "async-trait", @@ -7035,7 +7035,7 @@ dependencies = [ [[package]] name = "sandbox-driver-daytona-config" version = "0.1.0" -source = "git+https://github.com/lithoscomputer/sandbox-driver?rev=23062b6ad62ff4665cbbcb7dce037ec9c4c34318#23062b6ad62ff4665cbbcb7dce037ec9c4c34318" +source = "git+https://github.com/lithoscomputer/sandbox-driver?rev=7fc225afc56710d629b6f0f81392068767a1b6f1#7fc225afc56710d629b6f0f81392068767a1b6f1" dependencies = [ "sandbox-driver-docker-config", "serde", @@ -7045,7 +7045,7 @@ dependencies = [ [[package]] name = "sandbox-driver-docker" version = "0.1.0" -source = "git+https://github.com/lithoscomputer/sandbox-driver?rev=23062b6ad62ff4665cbbcb7dce037ec9c4c34318#23062b6ad62ff4665cbbcb7dce037ec9c4c34318" +source = "git+https://github.com/lithoscomputer/sandbox-driver?rev=7fc225afc56710d629b6f0f81392068767a1b6f1#7fc225afc56710d629b6f0f81392068767a1b6f1" dependencies = [ "anyhow", "async-trait", @@ -7066,7 +7066,7 @@ dependencies = [ [[package]] name = "sandbox-driver-docker-config" version = "0.1.0" -source = "git+https://github.com/lithoscomputer/sandbox-driver?rev=23062b6ad62ff4665cbbcb7dce037ec9c4c34318#23062b6ad62ff4665cbbcb7dce037ec9c4c34318" +source = "git+https://github.com/lithoscomputer/sandbox-driver?rev=7fc225afc56710d629b6f0f81392068767a1b6f1#7fc225afc56710d629b6f0f81392068767a1b6f1" dependencies = [ "serde", "serde_json", @@ -7075,7 +7075,7 @@ dependencies = [ [[package]] name = "sandbox-driver-host" version = "0.1.0" -source = "git+https://github.com/lithoscomputer/sandbox-driver?rev=23062b6ad62ff4665cbbcb7dce037ec9c4c34318#23062b6ad62ff4665cbbcb7dce037ec9c4c34318" +source = "git+https://github.com/lithoscomputer/sandbox-driver?rev=7fc225afc56710d629b6f0f81392068767a1b6f1#7fc225afc56710d629b6f0f81392068767a1b6f1" dependencies = [ "anyhow", "async-trait", @@ -7093,7 +7093,7 @@ dependencies = [ [[package]] name = "sandbox-driver-protocol" version = "0.1.0" -source = "git+https://github.com/lithoscomputer/sandbox-driver?rev=23062b6ad62ff4665cbbcb7dce037ec9c4c34318#23062b6ad62ff4665cbbcb7dce037ec9c4c34318" +source = "git+https://github.com/lithoscomputer/sandbox-driver?rev=7fc225afc56710d629b6f0f81392068767a1b6f1#7fc225afc56710d629b6f0f81392068767a1b6f1" dependencies = [ "async-trait", "base64", @@ -7110,7 +7110,7 @@ dependencies = [ [[package]] name = "sandbox-driver-testing" version = "0.1.0" -source = "git+https://github.com/lithoscomputer/sandbox-driver?rev=23062b6ad62ff4665cbbcb7dce037ec9c4c34318#23062b6ad62ff4665cbbcb7dce037ec9c4c34318" +source = "git+https://github.com/lithoscomputer/sandbox-driver?rev=7fc225afc56710d629b6f0f81392068767a1b6f1#7fc225afc56710d629b6f0f81392068767a1b6f1" dependencies = [ "async-trait", "sandbox-driver", diff --git a/Cargo.toml b/Cargo.toml index fb11c0e96..404f6b4a4 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -102,18 +102,18 @@ futures-util = "0.3" # sandbox-driver: the sandbox provider layer. Bundled Host, Docker, and # Daytona providers link in-process; third-party providers run as stdio # plugins through sandbox-driver-protocol. Pinned by rev; currently the head of -# the sandbox-driver PR stack #9-#15 (configured plugin kind, tag pins, classified +# the sandbox-driver `git-ambient-credentials` branch (ambient git credentials, # git failures, stop grace, snapshot ensure, ownership scope, testing doubles), to # move to main on merge. The CI plugin job installs the driver executables at the # same rev, read from this file. -sandbox-driver = { git = "https://github.com/lithoscomputer/sandbox-driver", rev = "23062b6ad62ff4665cbbcb7dce037ec9c4c34318" } -sandbox-driver-protocol = { git = "https://github.com/lithoscomputer/sandbox-driver", rev = "23062b6ad62ff4665cbbcb7dce037ec9c4c34318" } -sandbox-driver-host = { git = "https://github.com/lithoscomputer/sandbox-driver", rev = "23062b6ad62ff4665cbbcb7dce037ec9c4c34318" } -sandbox-driver-docker = { git = "https://github.com/lithoscomputer/sandbox-driver", rev = "23062b6ad62ff4665cbbcb7dce037ec9c4c34318" } -sandbox-driver-docker-config = { git = "https://github.com/lithoscomputer/sandbox-driver", rev = "23062b6ad62ff4665cbbcb7dce037ec9c4c34318" } -sandbox-driver-daytona = { git = "https://github.com/lithoscomputer/sandbox-driver", rev = "23062b6ad62ff4665cbbcb7dce037ec9c4c34318" } -sandbox-driver-daytona-config = { git = "https://github.com/lithoscomputer/sandbox-driver", rev = "23062b6ad62ff4665cbbcb7dce037ec9c4c34318" } -sandbox-driver-testing = { git = "https://github.com/lithoscomputer/sandbox-driver", rev = "23062b6ad62ff4665cbbcb7dce037ec9c4c34318" } +sandbox-driver = { git = "https://github.com/lithoscomputer/sandbox-driver", rev = "7fc225afc56710d629b6f0f81392068767a1b6f1" } +sandbox-driver-protocol = { git = "https://github.com/lithoscomputer/sandbox-driver", rev = "7fc225afc56710d629b6f0f81392068767a1b6f1" } +sandbox-driver-host = { git = "https://github.com/lithoscomputer/sandbox-driver", rev = "7fc225afc56710d629b6f0f81392068767a1b6f1" } +sandbox-driver-docker = { git = "https://github.com/lithoscomputer/sandbox-driver", rev = "7fc225afc56710d629b6f0f81392068767a1b6f1" } +sandbox-driver-docker-config = { git = "https://github.com/lithoscomputer/sandbox-driver", rev = "7fc225afc56710d629b6f0f81392068767a1b6f1" } +sandbox-driver-daytona = { git = "https://github.com/lithoscomputer/sandbox-driver", rev = "7fc225afc56710d629b6f0f81392068767a1b6f1" } +sandbox-driver-daytona-config = { git = "https://github.com/lithoscomputer/sandbox-driver", rev = "7fc225afc56710d629b6f0f81392068767a1b6f1" } +sandbox-driver-testing = { git = "https://github.com/lithoscomputer/sandbox-driver", rev = "7fc225afc56710d629b6f0f81392068767a1b6f1" } sentry = { version = "0.35", default-features = false, features = ["backtrace", "contexts", "ureq", "rustls"] } fork = "0.2" exec = "0.3" diff --git a/lib/components/fabro-sandbox/src/push_credentials.rs b/lib/components/fabro-sandbox/src/credentials.rs similarity index 100% rename from lib/components/fabro-sandbox/src/push_credentials.rs rename to lib/components/fabro-sandbox/src/credentials.rs diff --git a/lib/components/fabro-sandbox/src/redact.rs b/lib/components/fabro-sandbox/src/redact.rs deleted file mode 100644 index 12afa2fd6..000000000 --- a/lib/components/fabro-sandbox/src/redact.rs +++ /dev/null @@ -1,6 +0,0 @@ -pub fn redact_auth_url(text: &str, auth_url: Option<&fabro_redact::DisplaySafeUrl>) -> String { - let Some(auth_url) = auth_url else { - return text.to_string(); - }; - text.replace(&auth_url.raw_string(), &auth_url.redacted_string()) -}