Coder/deepseek-harness
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(subprocess): scrub ambient password variables

Browse Source
This commit is contained in:
ZiyaZhang
2026-07-28 02:02:35 -07:00
parent f63d2deecf
commit 6b7b2f8010
9 changed files with 25 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
packages/subprocess/subprocess-local/tests/spawn.spec.ts
View File

@@ -255,10 +255,10 @@ describe('stdin and extra env (set by in-process plugins)', () => {
})
it('an explicit extra env entry overrides the credential scrub', async () => {
// EXPLICIT_OVERRIDE_KEY matches the credential scrub pattern, yet an explicit
// EXPLICIT_OVERRIDE_PASSWORD matches the credential scrub pattern, yet an explicit
// entry is still honored — the scrub only drops AMBIENT process.env creds.
const result = await finish(spawnSubprocess(spec('echo "$EXPLICIT_OVERRIDE_KEY"', {
env: { EXPLICIT_OVERRIDE_KEY: 'explicit-wins' },
const result = await finish(spawnSubprocess(spec('echo "$EXPLICIT_OVERRIDE_PASSWORD"', {
env: { EXPLICIT_OVERRIDE_PASSWORD: 'explicit-wins' },
})))
expect(result.stdout.text).toBe('explicit-wins\n')
})
@@ -748,13 +748,17 @@ describe('environment and spill-file hardening', () => {
it('scrubs credential-shaped and ambient DSH env vars from child processes', async () => {
process.env.DSH_TEST_API_KEY = 'super-secret'
process.env.DSH_TEST_TOKEN = 'also-secret'
process.env.SUBPROCESS_TEST_PASSWORD = 'password-secret'
process.env.DSH_TEST_PLAIN = 'visible'
try {
const result = await finish(spawnSubprocess(spec('echo "[${DSH_TEST_API_KEY:-absent}|${DSH_TEST_TOKEN:-absent}|${DSH_TEST_PLAIN:-absent}]"')))
expect(result.stdout.text.trim()).toBe('[absent|absent|absent]')
const result = await finish(spawnSubprocess(spec(
'echo "[${DSH_TEST_API_KEY:-absent}|${DSH_TEST_TOKEN:-absent}|${SUBPROCESS_TEST_PASSWORD:-absent}|${DSH_TEST_PLAIN:-absent}]"',
)))
expect(result.stdout.text.trim()).toBe('[absent|absent|absent|absent]')
} finally {
delete process.env.DSH_TEST_API_KEY
delete process.env.DSH_TEST_TOKEN
delete process.env.SUBPROCESS_TEST_PASSWORD
delete process.env.DSH_TEST_PLAIN
}
})