From 59c4ec2c565eac257f173304391d2f06fd3c1226 Mon Sep 17 00:00:00 2001 From: Adam Moussa Date: Thu, 9 Jul 2026 15:56:34 -0400 Subject: [PATCH] fix: log SECURITY error when workflow-token downscope fails The elevate->push->downscope finally block was silent on failure. If both refresh_proxy_token calls fail, the sandbox retains workflows:write for the rest of the run with no signal. Log a SECURITY error on the partial and full downscope-failure paths so the retention is observable. Addresses the GPT-4.1 cross-family review of the token-scope remediation. --- agent/middleware/workflow_push_guard.py | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/agent/middleware/workflow_push_guard.py b/agent/middleware/workflow_push_guard.py index bc794610..c0124b83 100644 --- a/agent/middleware/workflow_push_guard.py +++ b/agent/middleware/workflow_push_guard.py @@ -896,7 +896,19 @@ async def _run_with_workflow_token( finally: restored = await refresh_proxy_token(thread_id, permissions=RUNTIME_PROXY_TOKEN_PERMISSIONS) if not restored: - await refresh_proxy_token(thread_id, permissions=BASE_RUNTIME_PROXY_TOKEN_PERMISSIONS) + logger.error( + "SECURITY: failed to downscope proxy token for thread %s after an approved " + "workflow push; retrying without actions:read.", + thread_id, + ) + if not await refresh_proxy_token( + thread_id, permissions=BASE_RUNTIME_PROXY_TOKEN_PERMISSIONS + ): + logger.error( + "SECURITY: proxy token downscope fully failed for thread %s; the sandbox " + "may retain workflows:write for the remainder of this run.", + thread_id, + ) class WorkflowPushGuardMiddleware(AgentMiddleware):