AI-382: keep sandbox credentials out of workflow history - #1745
Draft
xumaple wants to merge 4 commits into
Draft
Conversation
xumaple
force-pushed
the
maplexu/AI-382-sandbox-secret-refs
branch
2 times, most recently
from
August 12, 2026 17:17
e7ac375 to
dcc4035
Compare
xumaple
marked this pull request as ready for review
August 12, 2026 18:33
A sandbox manifest's environment values are serialized into workflow history, which is durable, replayed, and visible in the Web UI. Because the manifest rides inside the session state passed to and returned from every sandbox activity, a literal credential is recorded repeatedly for the life of the session and survives rotation. Add SecretRef, an EnvValue subclass carrying a lookup key rather than a value. Upstream resolves it worker-side at the point the environment is needed and never rewrites the manifest, so only the reference persists. Two related fixes ride along. Host-path bindings in extra_path_grants were written to history in plaintext; they are now refused at the point the manifest crosses into a Temporal payload, which is the only place that sees grants added by a capability. And run_config accepts a dict upstream, which this plugin read attributes off directly, so a dict raised AttributeError before reaching sandbox validation. Requires openai-agents >= 0.19.2 for the EnvValue discriminator, capped below 0.20 where nine tests currently fail.
There was a problem hiding this comment.
Pull request overview
Adds durable sandbox secret references while blocking other sensitive manifest data from workflow history.
Changes:
- Adds
SecretRefwith worker-side environment resolution. - Rejects host-path grants and live sandbox sessions.
- Normalizes dictionary run configurations and expands tests/documentation.
Reviewed changes
Copilot reviewed 8 out of 10 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
.gitignore |
Ignores mypy cache files. |
pyproject.toml |
Updates OpenAI Agents dependency bounds. |
temporalio/contrib/openai_agents/__init__.py |
Exports SecretRef. |
temporalio/contrib/openai_agents/_openai_runner.py |
Normalizes run configuration and rejects live sessions. |
temporalio/contrib/openai_agents/README.md |
Documents secret handling and unsupported inputs. |
temporalio/contrib/openai_agents/sandbox/_secret_ref.py |
Implements worker-resolved secret references. |
temporalio/contrib/openai_agents/sandbox/_temporal_sandbox_client.py |
Rejects host-bound path grants. |
tests/contrib/openai_agents/test_openai_sandbox.py |
Adds workflow and activity boundary coverage. |
tests/contrib/openai_agents/test_openai_sandbox_secrets.py |
Tests serialization and secret resolution behavior. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
xumaple
force-pushed
the
maplexu/AI-382-sandbox-secret-refs
branch
from
August 12, 2026 19:15
dcc4035 to
80fd8cf
Compare
Covers the new SecretRef API and the host-path grant rejection, which is breaking for workflows already running against openai-agents 0.19.2 or later -- the release where SandboxPathGrant.host_path was added.
The class was framed as a secrets feature, which left the reader deciding which sandbox environment values were sensitive enough to wrap. It is better understood as this plugin's EnvValue: reach for it whenever a value should come from the worker's environment rather than being written into the manifest, and a secret is the case where that matters most. The discriminator becomes temporal.worker_env_value and the error type becomes TemporalWorkerEnvValueUnresolved. Nothing has shipped, so neither carries a compatibility constraint. Behaviour is unchanged: the worker reads the named variable when the sandbox environment is needed, and an unset or empty one fails non-retryably naming it.
tconley1428
marked this pull request as draft
August 13, 2026 20:03
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Environment variables given to a sandbox are written into workflow history, which is durable and visible in the Web UI. A literal credential is recorded again on every sandbox activity, and stays there after you rotate it.
SecretRefrecords the variable's name instead of its value. The worker reads the value from its own environment when the sandbox needs it, so it has to be set on every worker that runs sandbox activities.Note: two related leaks are fixed alongside. Host paths bound through
extra_path_grantswere also written to history in plaintext and are now refused, at the point the manifest crosses into an activity payload so that grants added by a capability are covered too. Separately,run_configaccepts a dict upstream while this plugin read attributes off it directly, so passing one raisedAttributeErrorbefore reaching sandbox validation.Requires
openai-agents >= 0.19.2for the discriminator that lets the reference survive serialization, capped below0.20where nine tests currently fail.