fix: verify sandbox git remote matches expected repo

src/sandboxes/ensureGithubRepo.ts

@@ -67,6 +67,32 @@ export async function ensureGithubRepo(
   });
 
   if (gitCheck.exitCode === 0) {
+    // Verify the remote matches the expected repo — snapshots may carry
+    // a stale remote from a different account's sandbox.
+    const remoteResult = await sandbox.runCommand({
+      cmd: "git",
+      args: ["remote", "get-url", "origin"],
+    });
+    const currentRemote = ((await remoteResult.stdout()) || "").trim();
+    // Strip auth prefix for comparison (remote may include x-access-token)
+    const normalizedRemote = currentRemote.replace(
+      /https:\/\/x-access-token:[^@]+@github\.com\//,
+      "https://github.com/"
+    );
+
+    if (normalizedRemote !== githubRepo) {
+      logger.log("Sandbox remote mismatch, updating origin", {
+        expected: githubRepo,
+        actual: normalizedRemote,
+      });
+      const repoUrl = githubRepo.replace("https://github.com/", authPrefix);
+      await runGitCommand(
+        sandbox,
+        ["remote", "set-url", "origin", repoUrl],
+        "update remote to correct repo"
+      );
+    }
+
     logger.log("GitHub repo already cloned in sandbox", { githubRepo });
     return githubRepo;
   }

src/sandboxes/pushSandboxToGithub.ts

@@ -18,7 +18,13 @@ import { pushOrgRepos } from "./git/pushOrgRepos";
 export async function pushSandboxToGithub(
   sandbox: Sandbox
 ): Promise<boolean> {
-  logger.log("Pushing sandbox files to GitHub");
+  // Log which repo we're pushing to by reading the current remote
+  const remoteCheck = await sandbox.runCommand({
+    cmd: "git",
+    args: ["remote", "get-url", "origin"],
+  });
+  const remoteUrl = ((await remoteCheck.stdout()) || "").trim();
+  logger.log("Pushing sandbox files to GitHub", { remoteUrl });
 
   // Configure git user for commits
   if (
@@ -91,6 +97,6 @@ export async function pushSandboxToGithub(
     return false;
   }
 
-  logger.log("Sandbox files pushed to GitHub successfully");
+  logger.log("Sandbox files pushed to GitHub successfully", { remoteUrl });
   return true;
 }