From ca65994feea2a9c24b31132e07a2a0a546935080 Mon Sep 17 00:00:00 2001
From: pedrofrxncx <pedro_vaz_franca@hotmail.com>
Date: Thu, 27 Aug 2026 22:21:39 -0300
Subject: [PATCH] fix(sandbox): add a kill switch for the daemon's autosave
 checkpoint loop

---
 packages/sandbox/daemon-go/main.go | 57 +++++++++++++++++-------------
 1 file changed, 32 insertions(+), 25 deletions(-)

diff --git a/packages/sandbox/daemon-go/main.go b/packages/sandbox/daemon-go/main.go
index 73e131ad66..9c4d82d99c 100644
--- a/packages/sandbox/daemon-go/main.go
+++ b/packages/sandbox/daemon-go/main.go
@@ -933,32 +933,39 @@ func main() {
 	// minutes. Without it, a pod killed with no grace period (OOM, node loss)
 	// loses everything the agent had not committed itself — the shutdown sync
 	// below only runs on SIGTERM.
-	d.autosave = gitx.NewAutosaver(gitx.AutosaveDeps{
-		Publish: gitx.PublishDeps{
-			RepoDir: repoDir,
-			GetCloneUrl: func() string {
-				if cfg := d.store.Read(); cfg != nil {
-					return cfg.CloneUrl()
-				}
-				return ""
+	//
+	// AUTOSAVE_DISABLED is the kill switch: this runs unattended on every
+	// sandbox's boot/dispatch path and pushes to the user's remote, so a
+	// surprise (e.g. GitHub rate-limiting the fleet, an unwanted branch
+	// history) needs to be turned off fleet-wide without a daemon redeploy.
+	if os.Getenv("AUTOSAVE_DISABLED") == "" {
+		d.autosave = gitx.NewAutosaver(gitx.AutosaveDeps{
+			Publish: gitx.PublishDeps{
+				RepoDir: repoDir,
+				GetCloneUrl: func() string {
+					if cfg := d.store.Read(); cfg != nil {
+						return cfg.CloneUrl()
+					}
+					return ""
+				},
+				GetOperator: d.operatorIdentity,
+				// Same disposition as the shutdown sync: one invalid block must not
+				// cost the user every other change in the checkpoint.
+				OnInvalidBlock: gitx.InvalidBlockSkip,
+				// Never force-push from a checkpoint. Losing one checkpoint beats
+				// clobbering a concurrent writer's commit.
+				ReconcileRemote: false,
 			},
-			GetOperator: d.operatorIdentity,
-			// Same disposition as the shutdown sync: one invalid block must not
-			// cost the user every other change in the checkpoint.
-			OnInvalidBlock: gitx.InvalidBlockSkip,
-			// Never force-push from a checkpoint. Losing one checkpoint beats
-			// clobbering a concurrent writer's commit.
-			ReconcileRemote: false,
-		},
-		Lock: &d.treeLock,
-		Configured: func() bool {
-			cfg := d.store.Read()
-			return cfg != nil && cfg.Branch() != ""
-		},
-		RunActive: func() bool { return d.dispatchReg.HasActiveRuns() },
-		Dirty:     func() bool { return gitx.IsDirty(repoDir) },
-	})
-	d.autosave.Start()
+			Lock: &d.treeLock,
+			Configured: func() bool {
+				cfg := d.store.Read()
+				return cfg != nil && cfg.Branch() != ""
+			},
+			RunActive: func() bool { return d.dispatchReg.HasActiveRuns() },
+			Dirty:     func() bool { return gitx.IsDirty(repoDir) },
+		})
+		d.autosave.Start()
+	}
 	d.dispatchDeps = dispatch.Deps{
 		DaemonToken:      d.getToken,
 		AppRoot:          appRoot,