Skip to content

fix(agents): apply agent manifest settings per sandbox - #4888

Open
purp wants to merge 1 commit into
NVIDIA:mainfrom
purp:fix/3469-sandbox-scoped-agent-settings/purp
Open

purp wants to merge 1 commit into
NVIDIA:mainfrom
purp:fix/3469-sandbox-scoped-agent-settings/purp

Conversation

@purp

@purp purp commented Oct 23, 2026 •

Copy link
Copy Markdown
Collaborator

Summary

The agent launcher applied manifest settings with openshell settings set --global, so launching gator switched proposal_approval_mode to auto for every sandbox on the gateway. This applies manifest settings to the launched sandbox only.

Related Issue

Related to #3469. This PR doesn't close the issue; which PR closes it is still to be decided.

Changes

  • scripts/agents/run.sh: removes the gateway-global settings set --global loop. After the sandbox is created, runs openshell settings set <sandbox> <key> <value> for each manifest setting. If a gateway-global value already manages a key, it warns and leaves that value in effect. The launcher never writes global settings.
  • scripts/agents/README.md and scripts/agents/gator/README.md: describe settings as sandbox-scoped, with the updated launch order.

Release Notes

Testing

Checklist

  • Follows Conventional Commits
  • Commits are signed off (DCO)

The agent launcher applied manifest settings with `settings set --global`,
so every gator launch switched proposal_approval_mode to auto for the whole
gateway. Apply them to the launched sandbox after creation instead. If a
gateway-global value already manages a key, warn and leave it in effect.

Related to NVIDIA#3469.

Signed-off-by: Jim Meyer <jimeyer@nvidia.com>
@github-actions

Copy link
Copy Markdown

Compatibility review (advisory)

New or updated breaking changes; see the full report for all findings.

1. configuration — No explicit risk acceptance found

agent.yaml settings changed from required gateway-global writes before launch to best-effort sandbox-only writes after launch.

  • Impact: Existing manifests stop configuring other sandboxes, while Gator launched against global disabled/manual settings now continues without its requested policy advisor or automatic approval.
  • Action: Preserve existing global, pre-launch settings semantics in v0.1.6 and introduce sandbox-scoped settings through an explicit opt-in with migration guidance.
  • PR: fix(agents): apply agent manifest settings per sandbox #4888
Review details
  • Execution: complete
  • Candidate: PR #4888 (0d05378c22a1acf94b034600d513c8778dbbe77d)
  • Baseline: 92434dcb2b6248ac827df05c00551fe7a1fedf17 (92434dcb2b6248ac827df05c00551fe7a1fedf17)
  • Reviewed: rust-sdk, python-sdk, go-sdk, typescript-sdk, api-behavior, cli, configuration, policy, helm, state

Advisory review; publication gates are unchanged.

Branch check run

alshykhmoza-creator

This comment was marked as spam.

@purp
purp requested a review from johntmyers October 24, 2026 18:34

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants