feat(runtime): accept launcher TLS trust snapshots - #7943
shellz-n-stuff wants to merge 1 commit into
Conversation
| // Explicit Buzz-owned OAuth root for named demo builds. The agent may spawn | ||
| // auth-capable child tools after clearing its ambient environment. | ||
| "BUZZ_AGENT_CONFIG_DIR", | ||
| // Read-only launcher trust snapshot; do not forward the auth-broker capability. |
There was a problem hiding this comment.
So taking this path as an env var is the key security piece here. We could require/enforce a specific directory but I think that's explicitly easier to exploit than injecting an env var into what's running Buzz
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b640a332a0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| impl Llm { | ||
| pub fn new(cfg: &Config) -> Result<Self, AgentError> { | ||
| let http = Client::builder() | ||
| let http = crate::sandbox_runtime::http_builder()? |
There was a problem hiding this comment.
When BUZZ_SANDBOX_TLS_ROOTS contains the only CA trusted for a Databricks workspace and DATABRICKS_TOKEN is unset, the LLM client trusts the snapshot but build_token_source constructs PkceOAuthTokenSource with the unchanged Client::builder() in auth.rs. Its OIDC discovery, refresh, and token requests therefore reject the workspace certificate, preventing authentication and model discovery before any LLM request can run. Construct the PKCE HTTP client from the shared snapshot-aware builder as well.
Useful? React with 👍 / 👎.
| let bytes = std::fs::read(path).map_err(|_| fail())?; | ||
| if bytes.len() > 8 * 1024 * 1024 { |
There was a problem hiding this comment.
If the launcher supplies a very large file or a non-terminating device such as /dev/zero, std::fs::read consumes the entire input before the 8 MiB check executes, so malformed input can exhaust memory or hang startup instead of failing closed. Read through a limit of 8 MiB plus one byte, then reject overflow before parsing.
AGENTS.md reference: AGENTS.md:L240-L248
Useful? React with 👍 / 👎.
Signed-off-by: Alex Rosenzweig <arosenzweig@squareup.com>
1bb547c to
68c0058
Compare
b640a33 to
1815161
Compare
This branch has not been deployed
1 participant
Allow an external launcher to supply a certificate snapshot for agent and CLI HTTPS requests. Without the environment setting, normal platform trust remains unchanged. Invalid snapshots fail closed and hostname checks remain enabled.
Stack 2/3: base
codex/launcher-endpoints; next: credential broker.Validation: synthetic TLS tests (trusted certificate, wrong hostname, missing snapshot) and 12 CLI regressions pass. Tests are included in this slice. No credential broker or plugin dependency.
Review / merge order: #7942 → #7943 → #7944. Related: #5286. Replaces #7940.
Required push checks passed for this branch. Hosted CI is tracked on the PR.