Repository navigation
Conversation
…03 or a bare 404 With repository.openShell, the bundled OpenShell Credential Proxy's only registration is the request-phase Git service, which never advertises the execution profile. Creating a model credential source answered a generic 503, deploying an Agent without Git answered 503, and deploying one whose Gateway source predates the Proxy answered 404 with nothing logged. The Driver now refuses a non-Git profile on a registered Git-only service with CredentialProxyRepositoryOnlyError (409 naming repository.openShell). Static source admission checks the Proxy before reading the Secret. Deploy refuses a binding without live reads with CredentialSourceUnprotectedError (409) instead of a scope 404, and lets the Git-only refusal come first. Docs: protected OpenShell Git, the upgrade table and the egress flow.
|
🦞👀 Pull request received. I will update this pull request when review starts. ClawSweeper review completeClawSweeper finished reviewing this revision. The review result is being finalized. |
…fusal - Refuse with CredentialProxyRepositoryOnlyError only when the Git registration advertises no execution capability at all; a partial or malformed advertisement stays a 503 as before. The check now sits inside the existing refusal branch, leaving its condition unchanged. - Word both messages for what the code checks: every Proxy-owned source (static, prepared, credential-free metadata), and sources created or adopted under the Proxy plus the ready Gateway Harness source beside Git. - Pass both fixed messages through provisioning status. - Test: create only on the stock gateway (the refusal precedes the Secret read), and a missing registration still answers 503. - Docs: guide qualifier for fresh static registration; flow paragraph rewritten to fit the word cap.
clawsweeper
Bot
added
the
clawsweeper:intake:bug
clawsweeper
Bot
added
P2
|
Codex review: needs maintainer review before merge. What this changesThis PR returns descriptive 409 conflicts for Credential Proxy refusals previously reported as generic 503 or 404 errors. Example: Create an openai credential source with repository.openShell selecting the registered Git-only proxy.
Review scores
ProductKind: Bug fix · Worth it: Yes · Fix scope: Complete Merge readiness✅ Ready for maintainer review Keep open: this collaborator-authored PR provides a focused diagnostic repair that current main still lacks, with no actionable correctness or security findings identified. Priority: P2 Before mergeNone. FindingsNone. Tests
Agent review detailsHow this fits togetherOCC authorizes credential-source creation and Agent deployment, then asks the selected Credential Proxy to validate delivery; incompatible compositions return errors before source or revision creation. flowchart LR
Caller[API caller] --> API[Fastify API]
API --> OCC[OCC authorization and admission]
OCC --> Proxy[Credential Proxy Driver]
Proxy --> Gateway[OpenShell registration discovery]
Gateway --> Proxy
Proxy --> Refusal[Descriptive conflict response]
Refusal --> Caller
Technical reviewBest possible solution: Preserve the existing credential-delivery boundary and return these specific, actionable conflicts through admission and provisioning status. Do we have a high-confidence way to reproduce the issue? Current-main composition selects the same registration for repository and ordinary egress discovery, explaining the generic 503; unmatched ordinary source bindings take the existing scope-error path that produces 404. Is this the best way to solve the issue? The repair uses the existing Driver discovery and OCC admission owners, preserves accepted configurations, and distinguishes a permanent composition limit from an unavailable counterpart. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning medium; reviewed against ec9d42e175aa. Provenance checked
TestingProof path: in-process harness. SecurityNone. EvidenceWhat I checked:
LabelsLabel changes:
Label justifications:
Rank-up movesOptional improvements that raise the rating; they are not merge blockers.
Rating scale6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior. WorkflowClawSweeper edits this one comment on every review. Comment Reviewed October 24, 2026, 6:27 PM ET / 22:27 UTC. |
… and named 409s (#3550) #3514, #3516, #3517 and #3524 refuse at Agent save or admission what stored Agents may hold, and #3531 and #3534 turned 503 or bare 404 answers into named 409s, without breaking-change notices. This adds 2026-10-24 notices for them in the house format, and moves older 10-24 notices to a new archive page to keep the main page under its word cap. Docs only. Fixes board finding 2381.
…without a driver and git-only proxy probes (#3552) Mutant testing found repository refusal branches from #3524, #3531 and #3534 that no case could fail: installation-wide access beside another binding in any position, approval scopes with no repository Driver, and the Git-only Credential Proxy probes. repository-credentials-admission now pins them with table-driven cases. Test only.
Problem
With the documented protected OpenShell Git setup (
repository.openShell, Credential Proxy selected from the Sandbox's registration, HelmopenshellGit.mode: protected), no Agent could get a model credential, and the API did not say why. Seen on main3154820cfon a k3d install on a remote dogfood host:openaicredential source answered503 DEPENDENCY_UNAVAILABLEwith the generic message. The real cause was only in the API log: "The selected OpenShell counterpart has no negotiated protected egress authority."openaisource predates the switch answered404 NOT_FOUND, with nothing logged.Root cause:
openShellProxyConfigurationmakesrepository.registrationNameboth the Git and the egress registration, and the request-phase Git service advertises only the base contract, never the execution profile. So every non-Git check of the Proxy (static source admission, any deploy without Git) can never pass. That is a permanent configuration state, not an outage. The 404 came fromadmitProxyPlan, which refused a binding without live reads (here, a Gateway source made before the Proxy was selected) as aScopeViolationError.This matches the existing design (
docs/guides/credential-proxy.md, "Enroll prepared GitHub access": bundled v5/v6 Git uses an existing ordinary Gateway Harness source; fresh static registration under the Proxy is an egress source). What was missing was a refusal that says so, and the upgrade table read as if any retained Gatewayopenaisource keeps working once a Proxy is selected.Change
OpenShellCredentialProxyDriver.sourceControl.assertAvailable: inside the existing refusal branch (its condition is unchanged), when a non-Git profile is checked against therepository.openShellregistration and that registration is present but advertises no execution capability at all, it throws the newCredentialProxyRepositoryOnlyError(409RESOURCE_CONFLICT, namingrepository.openShellanddrivers.credential_proxy). A missing registration, or a partial or malformed execution advertisement, stays a 503.admitStaticEgressSourcechecks the Proxy before reading the Secret, so source creation gets that refusal. Prepared and credential-free metadata sources hit the same refusal through their own checks.admitProxyPlan: a binding without live reads (other than the Harness source beside Git) now raises the newCredentialSourceUnprotectedError(409, says to bind a source created or adopted for live reads) instead of a 404. For an Agent without Git, the Git-only refusal comes first, because replacing the source would not help there.ResourceStateConflictErrors, so provisioning records them asPROVISIONING_REJECTED).protected-openshell-git.mdsays this composition serves only Git and where a Git Agent's model source comes from. The upgrade table's staticopenairow adds the limit, and the guide qualifies "fresh static registration produces an egress source". The egress flow names the refusals; to stay under the word cap (2496 words), it drops the "in the accompanying …" ending from five older changelog entries.There are no new error codes, no API contract change and no change to what is admitted: each refusal that used to be a 503 or a 404 is now a 409 with a message.
Verification
A Git-only Credential Proxy names repository.openShell instead of a 503 or a bare 404(tests/integration/repository-credentials-admission.test.mjs) uses the bundled OpenShell Proxy and Gateway Drivers through the HTTP API, with stock 0.1.5 gateway info. On the unfixed code it fails with the reported 503 (source create) and 404 (deploy). It passes with the fix, including a control where the registration advertises the execution profile, a deploy with no source (previously 503), and a registration missing from gateway info (still 503). It also fails if the Proxy check inadmitStaticEgressSourceis moved back after the Secret checks.repository-credentials-admission.test.mjs: 36/36 locally. The new test pinned 20/20 at 2 CPUs on a remote test VM.tsc --build, eslint and prettier are clean on the touched files. Docs word counts were checked withcountMarkdownWords(the flow doc is at 2494).tests/helpers/postgres-worker-revision-fixture.mjsmatches the new binding refusal text.git merge-tree --name-onlygives no new conflicted file. Run Codex workspace requests and approved GitHub fetches in one protected Sandbox #3349 (draft, already conflicting with main) gains a conflict only indocs/flows/credential-source-egress.md, which it rewrites throughout.Risks
createon the source first.DEPENDENCY_UNAVAILABLE); as aScopeViolationErrorsubclass it also counts as an unrecoverable read for the refusal re-read. No new worker status code is added; a permanent code would be an API addition for a follow-up.