Conversation
🦋 Changeset detectedLatest commit: b6eef3c The changes in this PR will be included in the next version bump. This PR includes changesets to release 2 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit b6eef3c. Configure here.
| ): Promise<SandboxEnvironmentRecord | undefined>; | ||
| deleteSandboxEnvironment(input: DeleteSandboxEnvironmentInput, transaction?: TTransaction): Promise<boolean>; | ||
| getOwnedIds(input: GetOwnedIdsInput, transaction?: TTransaction): Promise<readonly string[]>; | ||
| } |
There was a problem hiding this comment.
Missing dual-backend store contract tests
Medium Severity
ISandboxEnvironmentStore has both Postgres and SQLite implementations, but there is no shared contract suite covering uniqueness, creator-scoped list, get-by-id/name, description patching, or delete. IAgentStore.listAgentIdsUsingSandboxEnvironment is also new and uses dialect-specific JSON lookups with no contract coverage, so Postgres/SQLite drift can ship untested.
Additional Locations (1)
Triggered by learned rule: Dual-backend stores and dispatch need contract tests
Reviewed by Cursor Bugbot for commit b6eef3c. Configure here.
| message: 'Daytona denied access while verifying the snapshot', | ||
| cause: error, | ||
| }); | ||
| } |
There was a problem hiding this comment.
Daytona 403 mapped to 422
Medium Severity
isDaytonaPermissionError (Daytona HTTP 403) is turned into HTTPException(422) when verifying snapshots and organization secrets. Invalid API keys correctly become 422, but an authenticated key missing grants is supposed to stay 403 so operators can distinguish credential failure from missing write:sandboxes / write:snapshots permissions.
Additional Locations (1)
Triggered by learned rule: HTTP 401 is platform-auth only; split Daytona 401/403
Reviewed by Cursor Bugbot for commit b6eef3c. Configure here.
1 participant
Summary
Closes AGE-2287
Changes
How was this tested?
NA, next PR will be tested
Checklist
pnpm build,pnpm test,pnpm typecheck,pnpm lint:ci, andpnpm format:checkpass locallypackages/trueforge-sdk,python/trueforge_sdk,.github/fern/openapi/openapi.json,docs/openapi.json) — fork PRs omit SDK regen; maintainers regenerate after merge.env.exampleupdated if configuration or behavior changedNote
Medium Risk
New sandbox provisioning paths and agent spec wiring affect runtime isolation and outbound network/secrets config, with external Daytona validation on write.
Overview
Adds caller-owned Daytona sandbox environments with full CRUD at
/api/v1/sandbox-environments, plus OpenAPI and SDK surface (client.sandboxEnvironments).Each environment is stored with a Daytona manifest (image variants, lifecycle, networking, resources, org secrets) and is scoped to the creating subject on list/get/update/delete. Create/update validate against the tenant sandbox provider (snapshot existence, secret names,
trueforge-defaultwhen the provider is ready). Delete returns 409 if any agent still references the environment by name.AgentSpec gains optional
config.sandbox.environmentso agents can pin a named environment instead of tenant defaults; agent and session flows now validate that the name exists, is owned by the caller, and matches the configured provider. Tenant permissions exposesandbox-environment→ CREATE alongside agents.Minor version bumps in the changeset for
@truefoundry/trueforgeand@truefoundry/trueforge-core.Reviewed by Cursor Bugbot for commit b6eef3c. Bugbot is set up for automated code reviews on this repo. Configure here.