From aa475971e46edd097b3bb8013017204be1af197c Mon Sep 17 00:00:00 2001 From: Neil Date: Fri, 13 Nov 2026 01:44:21 -0800 Subject: [PATCH] fix(cloud): RS-2 any later 401 on a sign-in in question confirms it (no clock comparison) --- cloud/apps/sandbox-control/src/agent-credential-checks.ts | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/cloud/apps/sandbox-control/src/agent-credential-checks.ts b/cloud/apps/sandbox-control/src/agent-credential-checks.ts index 113c421be52..08f7d6cd50a 100644 --- a/cloud/apps/sandbox-control/src/agent-credential-checks.ts +++ b/cloud/apps/sandbox-control/src/agent-credential-checks.ts @@ -111,8 +111,10 @@ async function checkCredential( export async function handleAccountUnauthorized( ctx: CheckContext & { sandboxId: string; path: string } ): Promise { + // The 401 that triggered the failed check was consumed by that check, so any 401 seen here, with the + // sign-in already in question, is a different, later real request. const suspectAt = await agentCredentialSuspectAt(ctx.db, ctx.userId, ctx.provider.agent) - if (suspectAt !== null && ctx.now > suspectAt) { + if (suspectAt !== null) { await markAgentCredentialRevoked(ctx.db, ctx.userId, ctx.provider.agent, ctx.now) await audit(ctx.db, { userId: ctx.userId,