af1495731e
hive-claude adds its variables on top of the parent's environment, so claude inherited the daemon's store identity paths, CREDENTIALS_DIRECTORY and queue coordinates. claude now starts as this same binary with SWARM_REVIEW_CLASSIFIER_EXEC_CLAUDE naming the real one; main execs it before the runtime starts, with the environment cleared down to the API key, PATH, HOME, CLAUDE_CONFIG_DIR and claude's telemetry settings. The exec keeps the pid, so hive-claude's cancel and idle timeout still reach it. An integration test runs the built binary as the trampoline and checks that a BAO_* variable does not reach the program it execs.
22 lines
981 B
Rust
22 lines
981 B
Rust
//! The trampoline through the real binary: a variable of the daemon's
|
|
//! environment does not reach the program it execs, the API key does.
|
|
|
|
use std::process::Command;
|
|
|
|
#[test]
|
|
fn the_daemons_store_identity_does_not_reach_claude() {
|
|
let out = Command::new(env!("CARGO_BIN_EXE_swarm-review-classifier"))
|
|
// Stands in for `claude`: prints what it was handed.
|
|
.env("SWARM_REVIEW_CLASSIFIER_EXEC_CLAUDE", "/bin/sh")
|
|
.env("BAO_CLIENT_KEY", "/run/credentials/x/review-classifier-bao-key")
|
|
.env("SWARM_REVIEW_CLASSIFIER_NATS_URL", "tls://nats.example:4222")
|
|
.env("ANTHROPIC_API_KEY", "k")
|
|
.args([
|
|
"-c",
|
|
r#"printf '%s|%s|%s' "${BAO_CLIENT_KEY-unset}" "${SWARM_REVIEW_CLASSIFIER_NATS_URL-unset}" "${ANTHROPIC_API_KEY-unset}""#,
|
|
])
|
|
.output()
|
|
.expect("the binary runs");
|
|
assert!(out.status.success(), "{out:?}");
|
|
assert_eq!(String::from_utf8_lossy(&out.stdout), "unset|unset|k");
|
|
}
|