Skip to content

Commit 41c518f

Browse files
TaylorMutchTaylorMutch
authored
fix(agents): validate sandbox names before Gator launch setup (#4660)
* fix(agents): validate sandbox names before Gator launch setup Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * chore(agents): remove standalone launcher test script Signed-off-by: Taylor Mutch <taylormutch@gmail.com> --------- Signed-off-by: Taylor Mutch <taylormutch@gmail.com>
1 parent 35a3390 commit 41c518f

3 files changed

Lines changed: 35 additions & 19 deletions

File tree

‎.agents/skills/launch-openshell-gator/SKILL.md‎

Lines changed: 23 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,7 @@ gateway_name="<selected-gateway-name>"
109109
openshell --gateway "$gateway_name" sandbox list
110110
```
111111

112-
Look for names like `gator-pr-<number>-supervised`. If one exists, inspect its log before deleting or relaunching.
112+
Look for names like `gtr-pr-<number>-watch`. If one exists, inspect its log before deleting or relaunching.
113113

114114
## Input Normalization
115115

@@ -129,11 +129,14 @@ pr_number="<digits-only>"
129129
[[ "$pr_number" =~ ^[0-9]+$ ]] || { echo "invalid PR number" >&2; exit 1; }
130130
```
131131

132-
Use the portable Kubernetes DNS-1123 sandbox-name format even when the selected gateway currently uses another driver:
132+
Sandbox names must be DNS-1123 labels of at most **19 characters**, including
133+
any suffix. The gateway reserves room for workspace, sandbox, and service
134+
segments in one DNS label; this limit applies to every compute driver. Use
135+
short names and validate them before launching:
133136

134137
```bash
135-
sandbox_name="gator-pr-${pr_number}-supervised"
136-
[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
138+
sandbox_name="gtr-pr-${pr_number}-watch"
139+
[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,17}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
137140
```
138141

139142
For local image contexts passed to `--from`, use an agent-created path such as `mktemp -d`; do not pass raw user-supplied paths without validating that they are expected local Dockerfile contexts.
@@ -149,8 +152,8 @@ gateway_name="<selected-gateway-name>"
149152
pr_number="<digits-only>"
150153
[[ "$gateway_name" =~ ^[A-Za-z0-9_.-]+$ ]] || { echo "invalid gateway name" >&2; exit 1; }
151154
[[ "$pr_number" =~ ^[0-9]+$ ]] || { echo "invalid PR number" >&2; exit 1; }
152-
sandbox_name="gator-pr-${pr_number}-supervised"
153-
[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
155+
sandbox_name="gtr-pr-${pr_number}-watch"
156+
[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,17}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
154157

155158
./scripts/agents/run.sh \
156159
--agent gator \
@@ -171,8 +174,8 @@ gateway_name="<selected-gateway-name>"
171174
issue_number="<digits-only>"
172175
[[ "$gateway_name" =~ ^[A-Za-z0-9_.-]+$ ]] || { echo "invalid gateway name" >&2; exit 1; }
173176
[[ "$issue_number" =~ ^[0-9]+$ ]] || { echo "invalid issue number" >&2; exit 1; }
174-
sandbox_name="gator-issue-${issue_number}-supervised"
175-
[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
177+
sandbox_name="gtr-i-${issue_number}-watch"
178+
[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,17}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
176179

177180
./scripts/agents/run.sh \
178181
--agent gator \
@@ -191,8 +194,8 @@ issue_number="<digits-only>"
191194
[[ "$gateway_name" =~ ^[A-Za-z0-9_.-]+$ ]] || { echo "invalid gateway name" >&2; exit 1; }
192195
[[ "$pr_number" =~ ^[0-9]+$ ]] || { echo "invalid PR number" >&2; exit 1; }
193196
[[ "$issue_number" =~ ^[0-9]+$ ]] || { echo "invalid issue number" >&2; exit 1; }
194-
sandbox_name="gator-pr-${pr_number}-supervised"
195-
[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
197+
sandbox_name="gtr-pr-${pr_number}-watch"
198+
[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,17}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
196199

197200
./scripts/agents/run.sh \
198201
--agent gator \
@@ -211,8 +214,8 @@ gateway_name="<selected-gateway-name>"
211214
pr_number="<digits-only>"
212215
[[ "$gateway_name" =~ ^[A-Za-z0-9_.-]+$ ]] || { echo "invalid gateway name" >&2; exit 1; }
213216
[[ "$pr_number" =~ ^[0-9]+$ ]] || { echo "invalid PR number" >&2; exit 1; }
214-
sandbox_name="gator-pr-${pr_number}-supervised"
215-
[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
217+
sandbox_name="gtr-pr-${pr_number}-watch"
218+
[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,17}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
216219

217220
./scripts/agents/run.sh \
218221
--agent gator \
@@ -231,8 +234,8 @@ gateway_name="<selected-gateway-name>"
231234
pr_number="<digits-only>"
232235
[[ "$gateway_name" =~ ^[A-Za-z0-9_.-]+$ ]] || { echo "invalid gateway name" >&2; exit 1; }
233236
[[ "$pr_number" =~ ^[0-9]+$ ]] || { echo "invalid PR number" >&2; exit 1; }
234-
sandbox_name="gator-pr-${pr_number}-gpt56sol-supervised"
235-
[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
237+
sandbox_name="gtr-pr-${pr_number}-exp"
238+
[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,17}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
236239

237240
CODEX_MODEL=gpt-5.6-sol \
238241
./scripts/agents/run.sh \
@@ -244,6 +247,8 @@ CODEX_MODEL=gpt-5.6-sol \
244247
```
245248

246249
If the installed Codex CLI is too old for a model, create a temporary copy of `scripts/agents/gator/`, adjust only that temporary Dockerfile, and launch with that generated context. Keep the repo Dockerfile unchanged unless the version bump is the intended code change.
250+
The short `-exp` suffix below identifies an experimental watcher; keep its full
251+
name within 19 characters.
247252

248253
Example shape:
249254

@@ -252,8 +257,8 @@ gateway_name="<selected-gateway-name>"
252257
pr_number="<digits-only>"
253258
[[ "$gateway_name" =~ ^[A-Za-z0-9_.-]+$ ]] || { echo "invalid gateway name" >&2; exit 1; }
254259
[[ "$pr_number" =~ ^[0-9]+$ ]] || { echo "invalid PR number" >&2; exit 1; }
255-
sandbox_name="gator-pr-${pr_number}-gpt56sol-supervised"
256-
[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
260+
sandbox_name="gtr-pr-${pr_number}-exp"
261+
[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,17}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
257262
tmp_context="$(mktemp -d "${TMPDIR:-/tmp}/gator-codex-XXXXXX")"
258263
cp -R scripts/agents/gator/. "$tmp_context"/
259264

@@ -298,7 +303,7 @@ The launcher streams image-build and provisioning output to the terminal. Import
298303
gateway_name="<selected-gateway-name>"
299304
sandbox_name="<safe-sandbox-name>"
300305
[[ "$gateway_name" =~ ^[A-Za-z0-9_.-]+$ ]] || { echo "invalid gateway name" >&2; exit 1; }
301-
[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
306+
[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,17}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
302307

303308
openshell --gateway "$gateway_name" sandbox list
304309
openshell --gateway "$gateway_name" sandbox get "$sandbox_name"
@@ -338,7 +343,7 @@ Before deleting, check that the sandbox is truly stale or that the operator aske
338343
gateway_name="<selected-gateway-name>"
339344
sandbox_name="<safe-sandbox-name>"
340345
[[ "$gateway_name" =~ ^[A-Za-z0-9_.-]+$ ]] || { echo "invalid gateway name" >&2; exit 1; }
341-
[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
346+
[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,17}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
342347

343348
openshell --gateway "$gateway_name" sandbox delete "$sandbox_name"
344349
./scripts/agents/run.sh \

‎scripts/agents/README.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,13 @@ prompt templates, provider profiles, policies, and references to skills or
2828
subagents. They should not contain `harnesses/codex`, `harnesses/opencode`, or
2929
similar runtime code.
3030

31+
Sandbox names supplied through `--name`, `GATOR_SANDBOX_NAME`, or generated
32+
from the manifest prefix must be DNS-1123 labels of at most 19 characters.
33+
The launcher validates them before building images or changing gateway state.
34+
For example, use `gtr-pr-4633-watch` for a supervised Gator watcher. Generated
35+
names append a hyphen and a 14-digit timestamp, leaving four characters for
36+
the manifest's name prefix.
37+
3138
## Agent Manifest
3239

3340
Each agent has an `agent.yaml` manifest. The launcher currently reads these

‎scripts/agents/run.sh‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ usage() {
3232
Options:
3333
--agent NAME|PATH Agent manifest directory or name under scripts/agents/
3434
--gateway NAME Gateway name to use
35-
--name NAME Sandbox name
35+
--name NAME Sandbox name (DNS-1123 label, at most 19 characters)
3636
--from DOCKERFILE|DIR Local Dockerfile source for the sandbox image
3737
--harness NAME Agent harness to run
3838
--github-provider NAME Override the github-gator provider instance name
@@ -513,6 +513,10 @@ configure_provider_refresh() {
513513

514514
GATEWAY="${GATEWAY_OVERRIDE:-${GATOR_GATEWAY:-$GATEWAY_DEFAULT}}"
515515
SANDBOX_NAME="${SANDBOX_NAME_OVERRIDE:-${GATOR_SANDBOX_NAME:-$SANDBOX_NAME_PREFIX-$(date +%Y%m%d%H%M%S)}}"
516+
# Match the gateway's MAX_ROUTABLE_NAME_LEN: workspace, sandbox, and service
517+
# segments must fit together in one DNS label. Check before any build or writes.
518+
[[ ${#SANDBOX_NAME} -le 19 ]] || fail "invalid sandbox name '$SANDBOX_NAME': maximum length is 19 characters"
519+
[[ "$SANDBOX_NAME" =~ ^[a-z0-9]([a-z0-9-]*[a-z0-9])?$ ]] || fail "invalid sandbox name '$SANDBOX_NAME': expected a DNS-1123 label (lowercase letters, digits, internal hyphens)"
516520
SANDBOX_FROM="${SANDBOX_FROM_OVERRIDE:-${GATOR_SANDBOX_FROM:-$(resolve_manifest_path "$SANDBOX_FROM_DEFAULT")}}"
517521
RUN_MODE="${RUN_MODE_OVERRIDE:-$RUNTIME_MODE}"
518522
POLL_INTERVAL_SECONDS="${POLL_INTERVAL_OVERRIDE:-$RUNTIME_POLL_INTERVAL_SECONDS}"

0 commit comments

Comments
 (0)