list features page#512
Conversation
Keep the discovery credential on the dashboard server and inject only the scoped machine token into idempotently launched worker sandboxes. Sanitize tRPC inputs in server and browser telemetry so connection credentials do not reach logs.
Persist scoped connection state inside the prepared worker sandbox and serialize callbacks so one-time Devin codes can recover without exposing credentials to browser state. Keep partner OAuth opt-in per deployment and retain the manual scoped-token fallback.
Defer sandbox creation until Devin returns the scoped Outposts credential, and make consumed-code failures restart with fresh PKCE state. Add explicit running/paused worker disconnect while keeping provider-side service-user revocation an admin operation.
Use the current Ory session secret and team flag boundary, preserve the enterprise OAuth host split, and match worker launch lifetime and payloads to the infra API. Recover ambiguous creates and prevent in-flight UI retries from duplicating launches.
Use the canonical dashboard origin for provider redirects while preserving the localhost callback proxy. Give the callback enough runtime for worker startup and keep provider routing server-side.
Keep manual scoped-credential setup while the provider flow is unavailable. Remove callback state, routes, and OAuth-only recovery behavior.
Only clean up sandboxes created by the current request, and poll briefly for metadata after an ambiguous create response. This prevents retries from deleting existing workers or immediately stranding delayed creations.
Bind retries to a digest of the exact launch target, serialize discovery, launch, and disconnect actions, and ignore late results after navigation. Credentials remain out of mutation caches and retry state.
Remove the unused organization lookup, make sanitizer ownership explicit, and test the actual browser/server logging and team-scoped disconnect boundaries.
Track inspection and cleanup independently so delayed create recovery can reuse a running worker, preserve pre-existing workers, and remove a recovered stopped sandbox when setup fails.
Keep the Crypto receiver intact when generating launch operation IDs, and cover the default browser path with a brand-checking implementation.
Use one sanitized console adapter in the real logger link and assert both browser console methods plus the server failure sink keep Devin credentials out of logs.
Route inspection failures through ownership-aware cleanup for sandboxes recovered from an ambiguous create, while continuing to preserve genuinely pre-existing workers.
Keep the service credential in page memory only, and reconcile ambiguous provider responses before allowing a retry.
Development can select a team-owned alias or tag while production keeps the public template default.
PR SummaryHigh Risk Overview Switching teams while on Reviewed by Cursor Bugbot for commit 5639026. Bugbot is set up for automated code reviews on this repo. Configure here. |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 5639026. Configure here.
| throw new DevinWorkerLaunchError() | ||
| } | ||
| return result.data | ||
| } |
There was a problem hiding this comment.
Paused workers invisible to finder
Medium Severity
findWorkerSandbox lists workers via deprecated GET /sandboxes, which only returns running sandboxes, while disconnect uses GET /v2/sandboxes with running and paused. A paused Devin worker (e.g. with autoPauseMemory) is not found on retry, so launch can create another sandbox for the same operationId instead of reusing the existing one.
Reviewed by Cursor Bugbot for commit 5639026. Configure here.
1 participant
tbd