Visitar URL original
Add failure mode for socket connection failure by pburkholder · Pull Request #613 · GSA-TTS/agentic-coding-quickstart · GitHub
Skip to content

Add failure mode for socket connection failure - #613

Open
pburkholder wants to merge 1 commit into
mainfrom
fix/socket-connection
Open

pburkholder wants to merge 1 commit into
mainfrom
fix/socket-connection

Conversation

@pburkholder

@pburkholder pburkholder commented Oct 22, 2026 •

Copy link
Copy Markdown
Contributor

Summary

Add failure mode for socket connection failure.

No agent assisted with this commit.

Related Issues

none

Type of Change

  • Bug fix (non-breaking change that fixes an issue)
  • New feature (non-breaking change that adds functionality)
  • Documentation update
  • Breaking change (fix or feature that would cause existing functionality to change)

Checklist

  • I have read CONTRIBUTING.md
  • My commits follow the Conventional Commits format (e.g., feat:, fix:, docs:)
  • I have tested my changes locally
  • I have updated documentation as needed
  • I have not included any secrets, API keys, or sensitive information

Test Results

Yes. See Slack at https://gsa-tts.slack.com/archives/C0B44531QLE/p1792600682137159

Additional Notes

@pburkholder
pburkholder requested a review from a team as a code owner October 22, 2026 15:43

@mogul mogul left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I appreciate all the markdown fixes, thanks.


### Fix

Look at the action the agent was taking that might have included potentially suspect output, then take action to squash such output

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Advise people about how to "undo" to back before the triggering request was made, and prompt the bot in such a way as to avoid hitting this tripwire again.


### Root cause

Work the agent was doing is emitted results that contained potential credentials. E.g. a script may be running `env` and the output includes API tokens. The USAi guardrails are set to reject such potential secrets, so it closes the connection.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

USAi isn't what does this... It's a feature of msb, when it sees its own proxy credentials going outbound in a request.

@mogul

mogul commented Oct 22, 2026

Copy link
Copy Markdown
Contributor

You also need to fix the conventional-commit check failure.

@basiliskus

Copy link
Copy Markdown
Contributor

On msb, this signature also comes from the sandbox's secret proxy, with no USAi guardrail involved: when a transcript contains a secret placeholder scoped to a different host (e.g. $MSB_GITLAB_TOKEN bound for api.gsa.usai.gov), msb fails closed and drops the connection with no HTTP status. A minimal repro is a chat-completions POST whose body contains $GITLAB_TOKEN: it fails with curl: (56) while a plain /models GET returns 200. Since the transcript is stored and replayed, every retry fails the same way; redacting the placeholder or starting a new session clears it. On msb 0.7.9 (superradcompany/microsandbox#1825) this may surface as a JSON 403 instead.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants