Replace the Chat sandbox when its pasted key entries change

Author: czpython

backend/druks/agents.py

@@ -82,14 +82,15 @@ async def _runner(
             await set_run_phase("provisioning_vm")
         # A box that fetches gets its own identity, and the key names it. A
         # replay finds the box through the identity, above.
-        identity, entries, key = None, {}, config.secrets_id
+        identity, entries, key = None, {}, config.secrets_hash
         if refs:
             identity, entries = await SandboxIdentity.create(
                 session,
                 account_id=workflow.account_id,
                 run_id=workflow_id,
                 scoped_to=step,
                 secret_refs=refs,
+                secrets_hash=config.secrets_hash,
             )
             key = identity.id
         vm = sandbox_client.ephemeral(

backend/druks/chat/service.py

@@ -128,7 +128,12 @@ async def get_sandbox(
     await session.commit()
     async with lock(f"chat:account:{account_id}"):
         identity = await SandboxIdentity.lookup(
-            session, account_id=account_id, run_id=None, scoped_to="chat", secret_refs=refs
+            session,
+            account_id=account_id,
+            run_id=None,
+            scoped_to="chat",
+            secret_refs=refs,
+            secrets_hash=config.secrets_hash,
         )
         if identity:
             with suppress(ChatSandboxGone):
@@ -140,7 +145,12 @@ async def get_sandbox(
             await sandbox_client.release(host_id=previous.host_id)
         template = await get_template_id(CHAT_SANDBOX)
         identity, entries = await SandboxIdentity.create(
-            session, account_id=account_id, run_id=None, scoped_to="chat", secret_refs=refs
+            session,
+            account_id=account_id,
+            run_id=None,
+            scoped_to="chat",
+            secret_refs=refs,
+            secrets_hash=config.secrets_hash,
         )
         host = await sandbox_client.provision(
             idempotency_key=f"chat:{account_id}:{identity.id}",

backend/druks/harnesses/config.py

@@ -48,17 +48,19 @@ def model_id(self) -> str:
         return self.model.partition("/")[2]
 
     @property
-    def secrets_id(self) -> str:
-        """What a box created for this config holds: a digest of the pasted key's version
+    def secrets_hash(self) -> str:
+        """A digest of what a box created for this config holds: the pasted key's version
         and its entries without the value, or the subscriptions it fetches."""
         if self.secrets:
             # Harnesses can read one key from different variables, and a box keeps the
             # entries it was created with.
             version = f"{self.api_key.audience_name}.{self.api_key.updated_at:%Y%m%dT%H%M%S}"
             entries = {name: entry.get_service() for name, entry in self.secrets.items()}
-            canonical = json.dumps([version, entries], sort_keys=True)
-            return hashlib.sha256(canonical.encode()).hexdigest()
-        return ".".join(ref.secret_id for ref in self.secret_refs)
+            contents = [version, entries]
+        else:
+            contents = [ref.secret_id for ref in self.secret_refs]
+        canonical = json.dumps(contents, sort_keys=True)
+        return hashlib.sha256(canonical.encode()).hexdigest()
 
     @property
     def charged_account_id(self) -> str | None:

backend/druks/sandbox/models.py

@@ -81,6 +81,9 @@ class SandboxIdentity(Base, Uuid7Pk):
     secret_refs: Mapped[list[SecretRef]] = relationship(
         back_populates="identity", cascade="all, delete-orphan", lazy="selectin"
     )
+    # The secrets hash of the agent config that created the box. Drukbox binds a pasted
+    # key's entries at creation, so another hash needs another box.
+    secrets_hash: Mapped[str]
 
     @classmethod
     async def create(
@@ -91,6 +94,7 @@ async def create(
         run_id: str | None,
         scoped_to: str,
         secret_refs: list[SecretRef],
+        secrets_hash: str,
     ) -> tuple["SandboxIdentity", dict[str, Issuer]]:
         """The committed identity and the issuer entries for its box. Committed
         before the box exists: Drukbox fetches an issuer during provisioning."""
@@ -109,6 +113,7 @@ async def create(
                 )
                 for ref in secret_refs
             ],
+            secrets_hash=secrets_hash,
             token_hash=hashlib.sha256(bearer.encode()).digest(),
             created_at=now,
             # The box lease bounds the identity: a box never outlives it.
@@ -149,10 +154,11 @@ async def lookup(
         run_id: str | None,
         scoped_to: str,
         secret_refs: list[SecretRef] | None = None,
+        secrets_hash: str | None = None,
     ) -> "SandboxIdentity | None":
         """Find a live box for this account, run, and scope.
 
-        Omit secret_refs to accept the box's current secrets.
+        Omit secret_refs and secrets_hash to accept the box's current secrets.
         """
         rows = await session.scalars(
             select(cls)
@@ -174,6 +180,7 @@ async def lookup(
                 if row.is_live
                 and (not row.run or row.run.is_active)
                 and (wanted is None or {ref.key for ref in row.secret_refs} == wanted)
+                and (secrets_hash is None or row.secrets_hash == secrets_hash)
             ),
             None,
         )

backend/druks/workflows.py

@@ -854,7 +854,7 @@ def __init__(self) -> None:
         # The run's warm VM, provisioned lazily and reaped at segment boundaries;
         # its lease expiry decides when it must rotate.
         self._host: Host | None = None
-        self._host_secrets_id = ""
+        self._host_secrets_hash = ""
 
     async def announce(self, topic: str, **facts: Any) -> None:
         """Record a domain fact, then notify subscribers in a separate checkpoint."""
@@ -939,15 +939,15 @@ async def _lease_host(
             )
             if identity:
                 self._host = await sandbox_client.reattach(host_id=identity.host_id)
-                self._host_secrets_id = config.secrets_id
+                self._host_secrets_hash = config.secrets_hash
         if self._host and self._host.expires_at:
             remaining = (self._host.expires_at - datetime.now(UTC)).total_seconds()
             if remaining < SANDBOX_HOST_ROTATE_BEFORE_SECONDS:
                 # The lease can't cover another worst-case call; rotate to a fresh
                 # host. Safe because each call rebuilds its workspace on whatever
                 # host it lands on (state lives in git), so a bare VM is fine.
                 await self._reap_run()
-        if self._host and self._host_secrets_id != config.secrets_id:
+        if self._host and self._host_secrets_hash != config.secrets_hash:
             # Drukbox binds entries at creation.
             await self._reap_run()
         if not self._host:
@@ -958,14 +958,15 @@ async def _lease_host(
             # The key names the pasted key the VM holds, so a replay finds its VM.
             # A box that fetches gets its own identity, and the key names that
             # instead. A replay finds the box through the identity, above.
-            identity, entries, key = None, {}, config.secrets_id
+            identity, entries, key = None, {}, config.secrets_hash
             if refs:
                 identity, entries = await SandboxIdentity.create(
                     session,
                     account_id=self.account_id,
                     run_id=self._workflow_id,
                     scoped_to="workflow",
                     secret_refs=refs,
+                    secrets_hash=config.secrets_hash,
                 )
                 key = identity.id
             self._host = await sandbox_client.provision(
@@ -974,7 +975,7 @@ async def _lease_host(
                 template=template,
                 identity=identity,
             )
-            self._host_secrets_id = config.secrets_id
+            self._host_secrets_hash = config.secrets_hash
         return self._host.id
 
     async def _reap_run(self) -> None:

backend/migrations/versions/3b8e1f6c9d24_record_a_sandbox_identity_secrets_hash.py

@@ -0,0 +1,27 @@
+"""Record the secrets hash of the config that created a sandbox.
+
+Revision ID: 3b8e1f6c9d24
+Revises: 9e47b68530e2
+Create Date: 2026-10-03
+"""
+
+from collections.abc import Sequence
+
+import sqlalchemy as sa
+from alembic import op
+
+revision: str = "3b8e1f6c9d24"
+down_revision: str | Sequence[str] | None = "9e47b68530e2"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def upgrade() -> None:
+    op.add_column(
+        "sandbox_identities",
+        sa.Column("secrets_hash", sa.String(), nullable=False, server_default=""),
+    )
+
+
+def downgrade() -> None:
+    op.drop_column("sandbox_identities", "secrets_hash")

backend/tests/test_agent_config.py

@@ -149,7 +149,7 @@ async def test_a_subscription_agent_runs_as_its_actor_or_the_default_account(dru
     assert as_actor.charged_account_id == actor.account_id
     assert unattended.subscription.id == default_subscription.id
     assert as_actor.identity == {"email": "b@example.com"}
-    assert (as_actor.secrets, as_actor.secrets_id) == ({}, actor.id)
+    assert not as_actor.secrets
     [secret] = as_actor.secret_refs
     assert secret.key == ("anthropic", actor.id, "", "")
     assert as_actor.harness_class is ClaudeHarness
@@ -191,7 +191,6 @@ async def test_a_codex_subscription_config_carries_its_login_facts_and_its_ref(d
     assert config.identity == {"email": "a@example.com", "account_id": "acc-1", "plan": "pro"}
     [ref] = config.secret_refs
     assert ref.key == ("codex_subscription_token", subscription.id, "", "chatgpt.com")
-    assert config.secrets_id == subscription.id
 
 
 async def test_a_subscription_agent_refuses_without_the_actors_own_subscription(druks_db):
@@ -216,7 +215,7 @@ async def test_a_key_agent_runs_on_the_installations_key_for_anyone(druks_db):
     assert (as_actor.secrets, as_actor.subscription) == ({"anthropic": _SHARED_ENTRY}, None)
     assert (unattended.secrets, unattended.identity) == ({"anthropic": _SHARED_ENTRY}, {})
     # The entries' identity is the pasted key, with no secret material.
-    assert "sk-shared" not in as_actor.secrets_id
+    assert "sk-shared" not in as_actor.secrets_hash
     # The key is nobody's, so its calls are charged to the installation.
     assert as_actor.charged_account_id is None
 
@@ -245,7 +244,7 @@ def test_a_key_box_serves_another_harness_only_when_it_reads_the_same_variable(
             effort="high",
             timeout=60,
             fast_mode=False,
-        ).secrets_id
+        ).secrets_hash
         for harness in (first, second)
     )
     assert (first_id == second_id) is is_shared

backend/tests/test_agents.py

@@ -890,7 +890,7 @@ async def fake_provision(self, *, idempotency_key=None, **_kwargs):
 
     monkeypatch.setattr("druks.sandbox.client.Client.provision", fake_provision)
 
-    config = SimpleNamespace(secrets={}, secret_refs=[], secrets_id="")
+    config = SimpleNamespace(secrets={}, secret_refs=[], secrets_hash="")
     with pytest.raises(HarnessSandboxProvisioningError):
         await current_run._lease_host(db_session(), config, [])
     host_id = await current_run._lease_host(db_session(), config, [])
@@ -966,7 +966,7 @@ async def fake_ephemeral(self, *, idempotency_key, secrets, **_kwargs):
     ]
     config = sandbox.run_agent.await_args.kwargs["config"]
     # The VM's key names the pasted key, never its value.
-    assert keys == [f"wf-9:dummy:{config.secrets_id}"]
+    assert keys == [f"wf-9:dummy:{config.secrets_hash}"]
     assert (config.billing, config.subscription) == ("api_key", None)
     [call] = await AgentCall.list_for_run(db_session(), "wf-9")
     assert (call.subscription_id, call.api_key.audience_name) == (None, "anthropic")
@@ -1061,6 +1061,7 @@ async def test_a_replay_resumes_the_ephemeral_box_through_its_identity(
         run_id="wf-9",
         scoped_to="dummy",
         secret_refs=[SecretRef(name="anthropic", secret_id=subscription.id)],
+        secrets_hash="",
     )
     await identity.bind("host-crashed")
     resumed: list[str] = []

backend/tests/test_chat.py

@@ -4,7 +4,7 @@
 from contextlib import asynccontextmanager
 from datetime import timedelta
 from types import SimpleNamespace
-from unittest.mock import AsyncMock, MagicMock
+from unittest.mock import AsyncMock, MagicMock, call
 from uuid import uuid4
 
 import asyncssh
@@ -72,7 +72,12 @@ async def list_messages(session, conversation):
 @pytest.fixture
 async def sandbox(druks_db, conversation, monkeypatch):
     identity, _ = await SandboxIdentity.create(
-        druks_db, account_id=conversation.account_id, run_id=None, scoped_to="chat", secret_refs=[]
+        druks_db,
+        account_id=conversation.account_id,
+        run_id=None,
+        scoped_to="chat",
+        secret_refs=[],
+        secrets_hash="",
     )
     await identity.bind("chat-sandbox")
     host = SimpleNamespace(
@@ -157,6 +162,7 @@ async def test_chat_identity_authenticates_until_lease_expiry_and_is_not_an_orph
         secret_refs=[
             SecretRef(name="mcp_druks_token", secret_id=token.id, host="hooks.example.com")
         ],
+        secrets_hash="",
     )
     await identity.bind("chat-sandbox")
     bearer = entries["mcp_druks_token"].headers["Authorization"].removeprefix("Bearer ")
@@ -200,7 +206,7 @@ async def attach(*, host_id):
     second = await Conversation.create(
         druks_db, account_id=conversation.account_id, body="another conversation"
     )
-    config = SimpleNamespace(secret_refs=[], secrets={})
+    config = SimpleNamespace(secret_refs=[], secrets={}, secrets_hash="key-one")
     first_host, _identity = await service.get_sandbox(
         druks_db,
         conversation.account_id,
@@ -217,7 +223,9 @@ async def attach(*, host_id):
     )
     login = await get_druks_account_token(druks_db, conversation.account_id, (), name="login")
     moved = SimpleNamespace(
-        secret_refs=[SecretRef(name="claude_token", secret_id=login.id)], secrets={}
+        secret_refs=[SecretRef(name="claude_token", secret_id=login.id)],
+        secrets={},
+        secrets_hash=login.id,
     )
     moved_host, _identity = await service.get_sandbox(
         druks_db,
@@ -226,10 +234,19 @@ async def attach(*, host_id):
         allowed_tools=Toolkit.ALL,
         secret_refs=[],
     )
+    # A pasted key's entries are bound when the box is created, so another key needs a new box.
+    rekeyed_host, _identity = await service.get_sandbox(
+        druks_db,
+        second.account_id,
+        config=SimpleNamespace(secret_refs=moved.secret_refs, secrets={}, secrets_hash="key-two"),
+        allowed_tools=Toolkit.ALL,
+        secret_refs=[],
+    )
 
     assert first_host.id == second_host.id
     assert moved_host.id != first_host.id
-    release.assert_awaited_once_with(host_id=first_host.id)
+    assert rekeyed_host.id != moved_host.id
+    assert release.await_args_list == [call(host_id=first_host.id), call(host_id=moved_host.id)]
 
 
 async def test_delivered_turn_is_sent_again_when_the_bridge_never_got_the_prompt(

backend/tests/test_declared_sandboxes.py

@@ -240,7 +240,7 @@ async def test_warm_lease_uses_workflow_template(monkeypatch):
 
     assert (
         await workflow._lease_host(
-            db_session(), SimpleNamespace(secrets={}, secret_refs=[], secrets_id=""), []
+            db_session(), SimpleNamespace(secrets={}, secret_refs=[], secrets_hash=""), []
         )
         == "host-1"
     )
@@ -275,7 +275,7 @@ async def ephemeral(**kwargs):
     )
     monkeypatch.setattr(agent_module, "get_template_id", resolve)
 
-    config = SimpleNamespace(secrets={}, secret_refs=[], secrets_id="")
+    config = SimpleNamespace(secrets={}, secret_refs=[], secrets_hash="")
     async with agent_module._runner(
         db_session(), workflow, None, "run-1", "summarize", config, []
     ) as runner: