begin-testbox: send installation_model_id as json integer in phone-home

[aayushshah15]

Summary

• Send installation_model_id as a JSON integer (2) instead of a JSON string ("2") in the phone-home request
• Fixes 401 auth failure caused by PHP strict comparison (!==) between int and string types in the backend

Made with Cursor

---

[devin-ai-integration]

Devin Review found 1 potential issue.

View 3 additional findings in Devin Review.

[devin-ai-integration]

🔴 Unvalidated metadata value interpolated as raw JSON number risks malformed JSON

The INSTALLATION_MODEL_ID variable (fetched from the metadata service via curl) is now interpolated directly into the JSON body without quotes and without any validation that it is actually a numeric value. If the metadata service returns anything non-numeric (e.g., an error message, HTML, or a value with a trailing carriage return \r from HTTP \r\n line endings), the resulting JSON will be syntactically invalid, causing the phone-home request to fail silently.

Detailed Explanation

On line 40, the value is fetched:

INSTALLATION_MODEL_ID=$(curl -s --connect-timeout 2 --max-time 5 "http://${METADATA_ADDR}/installationModelID")

Bash $(...) strips trailing newlines but not trailing carriage returns (\r). If the HTTP response uses \r\n line endings (common in HTTP), the variable could contain 2\r. When interpolated unquoted on line 66:

"installation_model_id": 2\r,

This is invalid JSON. The curl -f flag on line 61 would cause the request to fail, entering degraded mode silently.

Previously, when the value was quoted as a JSON string ("${INSTALLATION_MODEL_ID}"), stray characters would at least produce valid JSON (a string), even if the type was wrong. Now, any non-numeric content produces completely invalid JSON.

A simple numeric validation before the curl POST (e.g., if ! [[ "$INSTALLATION_MODEL_ID" =~ ^[0-9]+$ ]]) would make this robust.

Impact: If the metadata service response contains any unexpected characters, the phone-home request produces malformed JSON and fails silently, with no indication of the root cause.

Prompt for agents

In action.yml, after fetching INSTALLATION_MODEL_ID on line 40 and before the empty-check on line 49, add a numeric validation step. For example, after line 40 add:

  INSTALLATION_MODEL_ID=$(echo "$INSTALLATION_MODEL_ID" | tr -d '\r')

And after line 49's check block (after line 52), add:

  if ! [[ "$INSTALLATION_MODEL_ID" =~ ^[0-9]+$ ]]; then
    echo "Warning: installationModelID is not numeric: ${INSTALLATION_MODEL_ID}"
    exit 0
  fi

This ensures the value is sanitized (carriage returns removed) and validated as numeric before being interpolated unquoted into the JSON body on line 66.

---

Was this helpful? React with 👍 or 👎 to provide feedback.