fix(agent): treat an emptied sandbox env file as GitHub logout

resolveGithubToken prefers the live /tmp/agent-env file (which the backend
rewrites when the sandbox's actor changes mid-session) but fell back to the
process env whenever the file yielded no token. On an actor transition the
backend logs the sandbox out by emptying the token vars in that file, so the
fallback resurrected the previous actor's token — frozen in the agent-server's
launch-time process env — letting a follow-up actor push as the prior actor.

Distinguish a file that carries the token vars but empties them (an explicit
logout: return "") from a file that never had them (unmanaged: defer to the
process env). Only the latter falls back.

Author: VojtechBartos

packages/agent/src/utils/github-token.test.ts

@@ -53,6 +53,16 @@ describe("github-token", () => {
       const path = writeEnvFile("GH_TOKEN=\0GITHUB_TOKEN=ghs_real\0");
       expect(readGithubTokenFromSandboxEnvFile(path)).toBe("ghs_real");
     });
+
+    it("returns '' (explicit logout) when every token var is present but empty", () => {
+      const path = writeEnvFile("PATH=/usr/bin\0GH_TOKEN=\0GITHUB_TOKEN=\0");
+      expect(readGithubTokenFromSandboxEnvFile(path)).toBe("");
+    });
+
+    it("returns undefined when the file carries no token var at all", () => {
+      const path = writeEnvFile("PATH=/usr/bin\0HOME=/root\0");
+      expect(readGithubTokenFromSandboxEnvFile(path)).toBeUndefined();
+    });
   });
 
   describe("resolveGithubToken", () => {
@@ -72,5 +82,20 @@ describe("github-token", () => {
         "ghs_fromprocess",
       );
     });
+
+    it("does not resurrect the process-env token after a logout (emptied file)", () => {
+      // The backend logs the sandbox out by emptying the token vars in the file.
+      // The frozen launch-time process env still holds the previous actor's
+      // token; resolving must NOT fall back to it.
+      vi.stubEnv("GH_TOKEN", "ghs_previous_actor");
+      const path = writeEnvFile("GH_TOKEN=\0GITHUB_TOKEN=\0");
+      expect(resolveGithubToken(path)).toBe("");
+    });
+
+    it("falls back to the process env when the file carries no token var", () => {
+      vi.stubEnv("GH_TOKEN", "ghs_fromprocess");
+      const path = writeEnvFile("PATH=/usr/bin\0");
+      expect(resolveGithubToken(path)).toBe("ghs_fromprocess");
+    });
   });
 });

packages/agent/src/utils/github-token.ts

@@ -1,5 +1,8 @@
 import { readFileSync } from "node:fs";
-import { readGithubTokenFromEnv } from "@posthog/git/signed-commit";
+import {
+  GITHUB_TOKEN_ENV_VARS,
+  readGithubTokenFromEnv,
+} from "@posthog/git/signed-commit";
 
 // helpers for resolving the in-sandbox GitHub token
 // agentsh env file (NUL-delimited `key=value` pairs) that the PostHog backend
@@ -12,19 +15,33 @@ export const SANDBOX_ENV_FILE = "/tmp/agent-env";
 export function readGithubTokenFromSandboxEnvFile(
   envFilePath: string = SANDBOX_ENV_FILE,
 ): string | undefined {
+  let raw: string;
   try {
-    const raw = readFileSync(envFilePath, "utf8");
-    const env: Record<string, string> = {};
-    for (const entry of raw.split("\0")) {
-      const eq = entry.indexOf("=");
-      if (eq > 0) {
-        env[entry.slice(0, eq)] = entry.slice(eq + 1);
-      }
-    }
-    // Reuse the shared token-var allowlist + precedence instead of hardcoding.
-    return readGithubTokenFromEnv(env);
+    raw = readFileSync(envFilePath, "utf8");
   } catch {
-    // No env file (local/desktop or test) — fall back to the process env.
+    // No env file (local/desktop or test) — signal "unmanaged" so the caller
+    // falls back to the process env.
+    return undefined;
+  }
+  const env: Record<string, string> = {};
+  for (const entry of raw.split("\0")) {
+    const eq = entry.indexOf("=");
+    if (eq > 0) {
+      env[entry.slice(0, eq)] = entry.slice(eq + 1);
+    }
+  }
+  // A non-empty value wins by the shared token-var precedence.
+  const token = readGithubTokenFromEnv(env);
+  if (token) {
+    return token;
+  }
+  // The file is the backend's live credential channel. If it carries the token
+  // vars but they are emptied, that is an explicit logout on an actor
+  // transition — return "" so the caller does NOT resurrect the previous
+  // actor's token from the frozen launch-time process env. Only a file with no
+  // token vars at all is "unmanaged" and defers to the process env.
+  if (GITHUB_TOKEN_ENV_VARS.some((name) => name in env)) {
+    return "";
   }
   return undefined;
 }