feat(sandbox): inherit account credentials#24
Conversation
Allow GitHub installation sandbox preferences to inherit the signed-in account's default Sandbox service credentials while preserving custom credentials as an override. Add atomic preference updates that clear stale scoped secrets when switching to inherited credentials, and update the user preferences UI to expose the lightweight inherit/custom flow.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces support for inheriting sandbox service preferences (e.g., from a parent account to a GitHub installation), updating the backend handlers, database store, and frontend UI to support an 'inherit' mode alongside the existing 'custom' mode. The code review feedback suggests removing an unused accountID parameter from the accountPreferencesResponse function signature and its call sites, as well as recording the SourceAccountID in the audit log when configuring the sandbox in inherit mode for better security monitoring.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
![fennoai[bot]](https://avatars.githubusercontent.com/in/1924301?s=60&v=4){kind=small}
This comment has been minimized.
This comment has been minimized.
|
Warning Gemini encountered an error creating the review. You can try again by commenting |
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
|
An internal error occurred. Please try again later. |
There was a problem hiding this comment.
Code Review
This pull request introduces support for inheriting sandbox service configurations from a parent account for GitHub installations. It updates the backend API handlers, database store, and tests to support "inherit" and "custom" modes, allowing installations to either use their own sandbox credentials or inherit them from the parent account. On the frontend, the UI is updated to allow users to toggle inheritance, select a sandbox region from a predefined list, and confirm API key removal via a dialog. A review comment identifies an issue in the frontend where custom API URLs not matching the predefined regions are cleared on load, and suggests falling back to the original value to prevent validation failures.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
Review CompleteSubmitted a non-blocking PR review with 1 inline finding. Verification
|
There was a problem hiding this comment.
Code Review
This pull request introduces a sandbox preference inheritance feature, allowing GitHub installation scopes to inherit sandbox service settings (API URL and API Key) from their parent accounts. It updates the backend handlers, database store, and frontend UI to support this new "inherit" mode, which includes a region selection dropdown and a toggle for using account default credentials. The reviewer identified a critical usability issue in the frontend where replacing the custom API URL text input with a region dropdown prevents users from entering or switching back to custom endpoints. They suggested always rendering the "Custom endpoint" option and conditionally displaying a text input field when it is selected.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
There was a problem hiding this comment.
Review found one functional issue in the account preferences UI.
Verification run:
go test -tags development ./internal/server -count=1passedgo test ./internal/state -count=1passedtask ui-lintcould not run becausetaskis not installed in this environment
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
Review CompleteSubmitted a non-blocking PR review with 1 inline finding. Verification
|
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
There was a problem hiding this comment.
Code Review
This pull request introduces the ability for GitHub installations to inherit sandbox service preferences and credentials from their parent account. It updates the backend database store, API handlers, and tests to support this 'inherit' mode (including deleting custom secrets when switching to inherit mode). Additionally, the frontend UI is updated to allow users to toggle this inheritance, select predefined sandbox regions, and confirm API key removal via a dialog. There are no review comments, so no feedback is provided.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
There was a problem hiding this comment.
Review found one remaining functional issue in the Sandbox preferences UI.
Verification run:
go test -tags development ./internal/server -count=1passedgo test ./internal/state -count=1passedtask ui-lintwas not run becausetaskis not installed in this environment
Review CompleteNo issues found in this review. Verification
Notes
Submitted PR review: #24 (review) |
There was a problem hiding this comment.
Code Review
This pull request introduces support for inheriting sandbox service preferences (such as API URL and API Key) from a parent account for GitHub installations. It updates the backend storage, handlers, and tests to support this inheritance mode (inherit vs custom), and updates the frontend UI to allow users to toggle inheritance, select pre-defined sandbox regions (or custom endpoints), and confirm API key removal. There are no review comments, so I have no feedback to provide.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
There was a problem hiding this comment.
No issues found in this review.
Verification run:
go test ./internal/state -count=1go test -tags development ./internal/server -count=1
Not run: task ui-lint because task is not installed in this environment; direct bun run lint was also unavailable because bun is not installed.
Preserve an organization's inherited credential owner unless another connected owner explicitly replaces it. Show the source in Preferences and reject inheritance from incomplete account defaults.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
Review CompletePublished one non-blocking PR review with 1 inline finding. Verification run:
Not completed locally:
|
There was a problem hiding this comment.
Code Review
This pull request introduces sandbox credential inheritance for GitHub organization installations, allowing them to inherit sandbox preferences and API keys from their connected personal accounts. The backend has been updated with new database store methods, API handlers, and comprehensive tests to support transactional preference updates and secret deletion. On the frontend, the UI now supports toggling between custom and inherited credentials, selecting predefined sandbox regions, and managing confirmation dialogs for key removal or credential replacement. There are no review comments, so I have no feedback to provide.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
There was a problem hiding this comment.
Review found one correctness issue in the inherited Sandbox preferences response.
Verification run:
go test -tags development ./internal/server -count=1go test ./internal/state -count=1
UI lint/build was not runnable in this environment: bun is not installed, and the local npm path had no ui/node_modules/.bin/eslint shim (npm --prefix ui run lint failed with eslint: Permission denied).
Align the Preferences response with runtime installation-link validation. Mark disconnected credential sources unavailable while keeping the replacement action visible to other owners.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
Review CompleteNo issues found in this review. Verification
Notes
|
There was a problem hiding this comment.
Code Review
This pull request introduces support for inheriting sandbox service preferences from a personal account to a GitHub organization installation. It updates the backend to resolve inherited preferences, adds database methods to manage preferences and delete secrets upon inheritance, and updates the frontend UI to allow toggling inheritance and selecting pre-configured sandbox regions. The review feedback suggests returning early in accountPreferencesResponse when preferences are not found to avoid a redundant database query.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
There was a problem hiding this comment.
No issues found in this review.
Verification run:
go test -tags development ./internal/server -count=1go test ./internal/state -count=1git diff --check origin/main...HEAD
Not run locally: UI lint/build, because this workspace does not have bun, task, or ui/node_modules installed.
Return the unconfigured Sandbox response immediately when no preference exists, avoiding a second query for the same missing record.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
Review CompleteNo issues found in this review. Verification
Notes
|
There was a problem hiding this comment.
Code Review
This pull request introduces sandbox preference inheritance, allowing GitHub organization installations to inherit sandbox credentials from their connected personal accounts. It updates the backend server and database store to support an 'inherit' mode, validate source account configurations, and atomically clean up custom secrets when inheritance is enabled. The UI is also updated with a new Region selector (supporting predefined regions and custom endpoints), a toggle to enable credential inheritance, and confirmation dialogs for key removal and credential replacement. No review comments were provided, so there is no additional feedback to address.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
There was a problem hiding this comment.
No issues found in this review.
Verification run:
go test -tags development ./internal/server -count=1go test ./internal/state -count=1git diff --check origin/main...HEAD
Not run locally:
- UI lint/build:
npm --prefix ui run lintfailed witheslint: Permission denied, andnpm --prefix ui run buildfailed withtsc: Permission deniedin this workspace.
1 participant
Summary
Validation