Repository navigation
Explain workspace denials on delegated workstations - #32
Closed
nathan-thillairajah wants to merge 2 commits into
Closed
nathan-thillairajah wants to merge 2 commits into
nathan-thillairajah wants to merge 2 commits into
Conversation
A delegated workstation credential acts in the workspace its owner most recently selected in BuilderLab. When that selection changes, app requests return 403 workspace_mismatch, and the generic recovery pointed at `bl workspace switch`, which needs a local session a workstation does not have. Tell the agent to report the active workspace and ask the owner to switch in BuilderLab instead, and keep explicit server guidance for other denials. Co-authored-by: eggy <efcb1558faef42d4f7318ed532141edb57bcc52dbc8a92ae8c35637b8a5c3ff6@remote-agent-pilot.communities.buzz.xyz> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: eggy <efcb1558faef42d4f7318ed532141edb57bcc52dbc8a92ae8c35637b8a5c3ff6@remote-agent-pilot.communities.buzz.xyz> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
Author
|
🤖 Closing: accounts now belong to exactly one workspace and workspace switching is blocked, so delegated workstations shouldn't hit workspace_mismatch this way anymore. Companion skill PR squareup/builderbot-built-in-skills#22 is closed too. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
On a Blox workstation, a
403 workspace_mismatchnow tells the agent to ask the owner to switch workspaces, instead of passing through a server hint it can't act on.The delegated workstation credential acts in whatever workspace the owner most recently signed into or switched to in BuilderLab. If they move to another workspace somewhere else, the workstation's existing apps return
workspace_mismatch. The server'snext_actionsays "use a credential for the workspace that owns this app", and the generic 403 fallback suggestsbl workspace switch. Neither works on a workstation, because switch needs a local session and org config.Changes (proxy credentials only):
workspace_mismatch: runbl workspace list, ask the owner to switch to the app's workspace, don't create a replacement app.next_actionwhen there is one. The fallback no longer mentionsbl workspace switch.Session-authenticated behavior is unchanged.
Not covered here: a 401 on a workstation still suggests
bl auth logout/bl auth login, which has the same problem. I left that out to keep this small.Tested with a new process test covering mismatch, a generic 403, and
owner_requiredpassthrough.just checkpasses.🤖 Generated with Claude Code