feat(tasks): rebind or log out sandbox GitHub identity on actor transitions

Follow-ups are gated per-actor for MCP; do the same for GitHub. On an actor
transition, re-inject the new actor's GitHub token if they have usable access,
otherwise log the sandbox out (strip the token from the git remote and env) so
the previous actor's GitHub identity can't be used by a follow-up actor who
lacks it. Reauthorization for that actor is surfaced by the existing
credential-refresh path, unchanged. Fail closed only when the sandbox can be
neither rebound nor cleared. Only USER-authored runs carry per-actor identity;
BOT runs share one installation token.

Author: VojtechBartos

products/tasks/backend/temporal/process_task/activities/send_followup_to_sandbox.py

@@ -9,6 +9,7 @@
 from temporalio import activity
 from temporalio.exceptions import ApplicationError
 
+from posthog.models.user_integration import ReauthorizationRequired
 from posthog.temporal.common.utils import close_db_connections
 from posthog.temporal.oauth import PosthogMcpScopes
 
@@ -26,14 +27,23 @@
 from products.tasks.backend.models import TaskRun
 from products.tasks.backend.redis import get_tasks_stream_redis_sync, run_uses_dedicated_stream
 from products.tasks.backend.temporal.oauth import create_oauth_access_token_for_run
+from products.tasks.backend.temporal.process_task.sandbox_credentials import (
+    apply_github_credentials_to_sandbox,
+    clear_github_credentials_from_sandbox,
+)
 from products.tasks.backend.temporal.process_task.utils import (
+    PrAuthorshipMode,
     get_actor_distinct_id,
     get_imported_mcp_server_configs,
+    get_pr_authorship_mode,
+    get_sandbox_github_identity_user,
+    get_sandbox_github_token,
     get_sandbox_mcp_session_user,
     get_sandbox_ph_mcp_configs,
     get_task_run_credential_user,
     get_user_mcp_server_configs,
     is_slack_interaction_state,
+    mark_sandbox_github_identity,
     mark_sandbox_mcp_session,
     record_message_actor,
     sandbox_identity_scope,
@@ -166,6 +176,13 @@ def _deliver_followup(input: SendFollowupToSandboxInput) -> None:
     if not _refresh_sandbox_mcp(task_run, input.posthog_mcp_scopes, auth_token, actor_user=actor_user, state=state):
         error_msg = "Could not rebind sandbox MCP credentials for the follow-up actor"
         raise RuntimeError(f"send_followup failed: {error_msg}")
+
+    # Bind the sandbox's GitHub credentials to this actor: rebind if they have
+    # access, otherwise log out so the previous actor's identity can't be used.
+    # Fail closed only if we can't even clear the prior credentials.
+    if not _refresh_sandbox_github(task_run, actor_user, state):
+        error_msg = "Could not rebind or clear sandbox GitHub credentials for the follow-up actor"
+        raise RuntimeError(f"send_followup failed: {error_msg}")
     artifacts = None
     artifact_ids = input.artifact_ids or []
     if artifact_ids:
@@ -378,6 +395,96 @@ def _refresh_sandbox_mcp(
     return False  # rebind never confirmed → fail closed (unknown binding may hide a live session)
 
 
+def _resolve_live_sandbox(state: dict[str, Any] | None) -> Any:
+    """The running Sandbox handle for a run's state, or None when unavailable.
+
+    GitHub credentials are written into the sandbox directly (git remote + env
+    file), so the gate needs the handle. Absent/dead sandbox → None; the
+    periodic credential-refresh loop reconciles identity in that case.
+    """
+    sandbox_id = (state or {}).get("sandbox_id")
+    if not sandbox_id:
+        return None
+    from products.tasks.backend.logic.services.sandbox import (
+        Sandbox,  # noqa: PLC0415 — keep the sandbox service off the import path
+    )
+
+    try:
+        sandbox = Sandbox.get_by_id(sandbox_id)
+        return sandbox if sandbox.is_running() else None
+    except Exception:
+        return None
+
+
+def _refresh_sandbox_github(task_run: TaskRun, actor_user: Any, state: dict[str, Any] | None) -> bool:
+    """Bind the sandbox's in-place GitHub credentials to this message's actor.
+
+    On an actor transition: re-inject the new actor's token if they have usable
+    access, otherwise log the sandbox out (strip the token from the git remote
+    and env) so the previous actor's GitHub identity can never be used by a
+    follow-up actor who lacks access. Reauthorization for that actor is surfaced
+    by the existing credential-refresh path, unchanged.
+
+    Only USER-authored runs carry per-actor identity — BOT runs share one
+    installation token, so every actor is already the same identity. This
+    enforces the transition boundary; the periodic credential-refresh loop
+    keeps a continuous actor's token rotated between transitions.
+
+    Returns ``True`` when the sandbox safely reflects this actor (rebound, logged
+    out, or nothing to do) and ``False`` only when we could neither rebind nor
+    even clear — the previous actor's credentials may still be live, so the
+    caller fails the follow-up closed.
+    """
+    if actor_user is None:
+        return True
+
+    run_id = str(task_run.id)
+    scope = sandbox_identity_scope(run_id, state)
+    if get_sandbox_github_identity_user(scope) == actor_user.id:
+        return True  # sandbox already reflects this actor — cheapest check first
+
+    task = task_run.task
+    if get_pr_authorship_mode(task, state) != PrAuthorshipMode.USER:
+        return True
+
+    sandbox = _resolve_live_sandbox(state)
+    if sandbox is None:
+        return True  # no live handle; the periodic refresh loop reconciles identity
+
+    repository = task.repository
+    token: str | None = None
+    try:
+        token = get_sandbox_github_token(
+            task.github_integration_id,
+            run_id=run_id,
+            state=state,
+            task=task,
+            actor_user=actor_user,
+            repository=repository,
+        )
+    except ReauthorizationRequired:
+        token = None  # new actor lacks usable access → log out (reauth surfaced elsewhere)
+
+    if token:
+        try:
+            apply_github_credentials_to_sandbox(sandbox, repository, token)
+        except Exception:
+            logger.warning("refresh_github_apply_failed", run_id=run_id, exc_info=True)
+        else:
+            mark_sandbox_github_identity(scope, actor_user.id)
+            logger.info("refresh_github_rebound", run_id=run_id, user_id=actor_user.id)
+            return True
+
+    # No usable rebind: log the sandbox out. Fail closed only if even the clear
+    # can't be confirmed — the previous actor's credentials might still be live.
+    if clear_github_credentials_from_sandbox(sandbox, repository):
+        mark_sandbox_github_identity(scope, actor_user.id)
+        logger.info("refresh_github_logged_out", run_id=run_id, user_id=actor_user.id)
+        return True
+    logger.warning("refresh_github_logout_failed", run_id=run_id, user_id=actor_user.id)
+    return False
+
+
 def _get_stop_reason(result_data: dict[str, Any] | None) -> str:
     if not isinstance(result_data, dict):
         return STOP_REASON_END_TURN

products/tasks/backend/temporal/process_task/sandbox_credentials.py

@@ -51,27 +51,29 @@ def github_refresh_interval_seconds(token: str) -> float:
     return DEFAULT_REFRESH_INTERVAL_SECONDS
 
 
-def set_git_remote_token(sandbox: "SandboxBase", repository: str, github_token: str) -> bool:
-    """Rewrite ``origin``'s remote URL with a fresh ``x-access-token``; git re-reads it on every op. No-ops pre-clone."""
+def _set_origin_remote(sandbox: "SandboxBase", repository: str, remote_url: str, failure_msg: str) -> bool:
+    """Point ``origin`` at ``remote_url`` inside the cloned repo; git re-reads it on every op. No-ops pre-clone."""
     org, repo = repository.lower().split("/")
     repo_path = f"/tmp/workspace/repos/{org}/{repo}"
-    update_remote = (
+    command = (
         f"if [ -d {shlex.quote(repo_path + '/.git')} ]; then "
         f"cd {shlex.quote(repo_path)} && "
-        f"git remote set-url origin "
-        f"https://x-access-token:{shlex.quote(github_token)}@github.com/{shlex.quote(repository)}.git; "
+        f"git remote set-url origin {remote_url}; "
         f"fi"
     )
-    result = sandbox.execute(update_remote, timeout_seconds=30)
+    result = sandbox.execute(command, timeout_seconds=30)
     if result.exit_code != 0:
-        logger.warning(
-            "Failed to refresh git remote URL",
-            extra={"sandbox_id": sandbox.id, "repository": repository, "stderr": result.stderr},
-        )
+        logger.warning(failure_msg, extra={"sandbox_id": sandbox.id, "repository": repository, "stderr": result.stderr})
         return False
     return True
 
 
+def set_git_remote_token(sandbox: "SandboxBase", repository: str, github_token: str) -> bool:
+    """Rewrite ``origin``'s remote URL with a fresh ``x-access-token``; git re-reads it on every op. No-ops pre-clone."""
+    remote_url = f"https://x-access-token:{shlex.quote(github_token)}@github.com/{shlex.quote(repository)}.git"
+    return _set_origin_remote(sandbox, repository, remote_url, "Failed to refresh git remote URL")
+
+
 def update_sandbox_env_file(sandbox: "SandboxBase", updates: dict[str, str]) -> bool:
     """Replace specific keys in the NUL-delimited agentsh env file, preserving all other entries.
 
@@ -124,6 +126,21 @@ def apply_github_credentials_to_sandbox(sandbox: "SandboxBase", repository: str
     update_sandbox_env_file(sandbox, dict.fromkeys(GITHUB_ENV_KEYS, github_token))
 
 
+def clear_git_remote_token(sandbox: "SandboxBase", repository: str) -> bool:
+    """Rewrite ``origin`` to a token-less URL so git can no longer authenticate. No-ops pre-clone."""
+    remote_url = f"https://github.com/{shlex.quote(repository)}.git"
+    return _set_origin_remote(sandbox, repository, remote_url, "Failed to clear git remote URL")
+
+
+def clear_github_credentials_from_sandbox(sandbox: "SandboxBase", repository: str | None) -> bool:
+    """Log the sandbox out of GitHub: strip the token from the git remote and blank the env
+    keys, so the previous actor's identity can't be used by a follow-up actor who lacks access.
+    Returns ``True`` only when both places were cleared."""
+    remote_cleared = clear_git_remote_token(sandbox, repository) if repository else True
+    env_cleared = update_sandbox_env_file(sandbox, dict.fromkeys(GITHUB_ENV_KEYS, ""))
+    return remote_cleared and env_cleared
+
+
 USER_TOKEN_REFRESH_INTERVAL_SECONDS: float = _GITHUB_REFRESH_INTERVAL_BY_PREFIX["ghu_"]
 # TTL covers a slow mint + propagation; wait stays under the refresh activity's 2 min timeout.
 _ROTATION_LOCK_TTL_SECONDS = 120

products/tasks/backend/temporal/process_task/tests/test_send_followup_to_sandbox.py

@@ -5,18 +5,24 @@
 
 from temporalio.exceptions import ApplicationError
 
+from posthog.models.user_integration import ReauthorizationRequired
+
 from products.tasks.backend.logic.services.agent_command import CommandResult
 from products.tasks.backend.temporal.process_task.activities.send_followup_to_sandbox import (
     REFRESH_RETRY_DELAY_SECONDS,
     SEND_FOLLOWUP_MAX_ATTEMPTS,
     SendFollowupToSandboxInput,
+    _refresh_sandbox_github,
     _refresh_sandbox_mcp,
     send_followup_to_sandbox,
 )
 from products.tasks.backend.temporal.process_task.utils import (
     McpServerConfig,
+    PrAuthorshipMode,
     _sandbox_mcp_session_cache_key,
+    get_sandbox_github_identity_user,
     get_sandbox_mcp_session_user,
+    mark_sandbox_github_identity,
     mark_sandbox_mcp_session,
 )
 
@@ -331,6 +337,95 @@ def test_transition_with_no_configs_leaves_previous_binding(
         assert get_sandbox_mcp_session_user("run-1") == 99  # binding unchanged
 
 
+_GH_MODULE = "products.tasks.backend.temporal.process_task.activities.send_followup_to_sandbox"
+
+
+@patch(f"{_GH_MODULE}.clear_github_credentials_from_sandbox")
+@patch(f"{_GH_MODULE}.apply_github_credentials_to_sandbox")
+@patch(f"{_GH_MODULE}.get_sandbox_github_token")
+@patch(f"{_GH_MODULE}._resolve_live_sandbox")
+@patch(f"{_GH_MODULE}.get_pr_authorship_mode")
+class TestSandboxGithubIdentityGate:
+    """On an actor transition the sandbox's GitHub credentials rebind to the new
+    actor when they have access, otherwise the sandbox is logged out so the
+    previous actor's identity can't be used."""
+
+    def test_same_actor_skips(self, mock_authorship, mock_resolve, mock_get_token, mock_apply, mock_clear):
+        mock_authorship.return_value = PrAuthorshipMode.USER
+        mark_sandbox_github_identity("run-1", 42)
+
+        assert _refresh_sandbox_github(_make_task_run_mock(), MagicMock(id=42), None) is True
+        mock_resolve.assert_not_called()
+        mock_get_token.assert_not_called()
+        mock_apply.assert_not_called()
+        mock_clear.assert_not_called()
+
+    def test_bot_authorship_skips(self, mock_authorship, mock_resolve, mock_get_token, mock_apply, mock_clear):
+        # BOT runs share a single installation token, so every actor is already
+        # the same GitHub identity — nothing to rebind.
+        mock_authorship.return_value = PrAuthorshipMode.BOT
+        mark_sandbox_github_identity("run-1", 99)
+
+        assert _refresh_sandbox_github(_make_task_run_mock(), MagicMock(id=42), None) is True
+        mock_get_token.assert_not_called()
+        mock_apply.assert_not_called()
+        mock_clear.assert_not_called()
+
+    def test_transition_with_access_rebinds(
+        self, mock_authorship, mock_resolve, mock_get_token, mock_apply, mock_clear
+    ):
+        mock_authorship.return_value = PrAuthorshipMode.USER
+        mock_resolve.return_value = MagicMock()
+        mock_get_token.return_value = "ghu_newtoken"
+        mark_sandbox_github_identity("run-1", 99)
+
+        assert _refresh_sandbox_github(_make_task_run_mock(), MagicMock(id=42), None) is True
+        mock_apply.assert_called_once()
+        assert mock_apply.call_args.args[2] == "ghu_newtoken"
+        mock_clear.assert_not_called()
+        assert get_sandbox_github_identity_user("run-1") == 42
+
+    def test_transition_without_access_logs_out(
+        self, mock_authorship, mock_resolve, mock_get_token, mock_apply, mock_clear
+    ):
+        mock_authorship.return_value = PrAuthorshipMode.USER
+        mock_resolve.return_value = MagicMock()
+        mock_get_token.side_effect = ReauthorizationRequired("no repo access")
+        mock_clear.return_value = True
+        mark_sandbox_github_identity("run-1", 99)
+
+        assert _refresh_sandbox_github(_make_task_run_mock(), MagicMock(id=42), None) is True
+        mock_apply.assert_not_called()
+        mock_clear.assert_called_once()
+        assert get_sandbox_github_identity_user("run-1") == 42
+
+    def test_apply_failure_falls_back_to_logout(
+        self, mock_authorship, mock_resolve, mock_get_token, mock_apply, mock_clear
+    ):
+        mock_authorship.return_value = PrAuthorshipMode.USER
+        mock_resolve.return_value = MagicMock()
+        mock_get_token.return_value = "ghu_newtoken"
+        mock_apply.side_effect = RuntimeError("write failed")
+        mock_clear.return_value = True
+        mark_sandbox_github_identity("run-1", 99)
+
+        assert _refresh_sandbox_github(_make_task_run_mock(), MagicMock(id=42), None) is True
+        mock_apply.assert_called_once()
+        mock_clear.assert_called_once()  # fell through to logout so no stale creds remain
+
+    def test_logout_failure_fails_closed(self, mock_authorship, mock_resolve, mock_get_token, mock_apply, mock_clear):
+        # New actor has no access and the sandbox can't even be cleared — the
+        # previous actor's creds may still be live, so fail closed.
+        mock_authorship.return_value = PrAuthorshipMode.USER
+        mock_resolve.return_value = MagicMock()
+        mock_get_token.side_effect = ReauthorizationRequired("no repo access")
+        mock_clear.return_value = False
+        mark_sandbox_github_identity("run-1", 99)
+
+        assert _refresh_sandbox_github(_make_task_run_mock(), MagicMock(id=42), None) is False
+        assert get_sandbox_github_identity_user("run-1") == 99  # binding unchanged
+
+
 class TestSendFollowupActivityRefreshOrdering:
     """Refresh call must precede user_message, and the activity must succeed
     when refresh fails (non-fatal) as long as user_message succeeds."""

products/tasks/backend/temporal/process_task/utils.py

@@ -390,6 +390,30 @@ def get_sandbox_mcp_session_user(scope: str) -> int | None:
     return get_tasks_cache().get(_sandbox_mcp_session_cache_key(scope))
 
 
+def _sandbox_github_identity_cache_key(scope: str) -> str:
+    return f"tasks:sandbox-github-identity:{scope}"
+
+
+def mark_sandbox_github_identity(scope: str, user_id: int) -> None:
+    """Record which actor the sandbox's in-place GitHub credentials reflect.
+
+    The value is the actor whose token was applied, or who was logged out (no
+    usable access) — either way the sandbox no longer carries a *different*
+    actor's identity. Self-expires after MCP_TOKEN_REFRESH_INTERVAL_SECONDS; an
+    absent entry reads as "must re-establish", which is always safe because
+    re-establishing re-applies or clears rather than trusting stale creds.
+    """
+    get_tasks_cache().set(
+        _sandbox_github_identity_cache_key(scope), user_id, timeout=MCP_TOKEN_REFRESH_INTERVAL_SECONDS
+    )
+
+
+def get_sandbox_github_identity_user(scope: str) -> int | None:
+    """Actor id the sandbox's GitHub credentials were last bound to (or logged
+    out for) within the freshness window, or None when unknown."""
+    return get_tasks_cache().get(_sandbox_github_identity_cache_key(scope))
+
+
 @dataclass(frozen=True)
 class McpServerConfig:
     """Configuration for a remote MCP server matching the ACP McpServer schema.