feat(env): improve host command env injection and trust by roodboi · Pull Request #43 · hack-dance/hack

roodboi · 2026-04-03T15:17:02Z

Summary

add shared host-side Hack CA discovery and trust env helpers
wire local CA trust into hack env/host exec, session env injection, and lifecycle host processes
extend global trust/install flows and stabilize the macOS global command tests

Testing

bun test /Users/hack/dev/hack-dance/hack/tests/env-exec-command.test.ts /Users/hack/dev/hack-dance/hack/tests/session-env-command.test.ts /Users/hack/dev/hack-dance/hack/tests/project-lifecycle-processes.test.ts /Users/hack/dev/hack-dance/hack/tests/global-command.macos.test.ts
bun x ultracite check src/lib/local-ca.ts src/commands/env.ts src/commands/session.ts src/commands/project.ts src/commands/global.ts tests/env-exec-command.test.ts tests/session-env-command.test.ts tests/project-lifecycle-processes.test.ts tests/global-command.macos.test.ts

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bdab2bdd33

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-04-03T15:22:08Z

+  return {
+    ...env,
+    ...buildHackHostTrustEnvironment({
+      certPath,


Preserve existing TLS env vars when injecting Hack trust

appendHackHostTrustEnvironment currently spreads the generated trust variables after the caller-provided env, so any pre-set SSL_CERT_FILE, CURL_CA_BUNDLE, REQUESTS_CA_BUNDLE, GIT_SSL_CAINFO, or NODE_EXTRA_CA_CERTS values are silently overwritten. This affects all new host-injection paths (env exec, session, and lifecycle host commands) and can break projects that intentionally pin custom CA bundles for internal services, because the explicit project/runtime configuration no longer wins.

Useful? React with 👍 / 👎.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2ac7b51f6b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-04-03T15:47:59Z

+  await configureMacHostTlsTrust({
+    certPath,
+  });


Gate host TLS env setup on trust prompt acceptance

When ensureMacTrustCaddyLocalCa returns early because the user answered "no" to the trust prompt, this unconditional call still writes the host trust script and sets launchctl TLS variables, so hack global trust mutates host TLS behavior despite an explicit opt-out. This is a behavior regression from the prior flow (where declining the prompt performed no trust-side changes), and the same pattern appears in the install bootstrap path; return a boolean from ensureMacTrustCaddyLocalCa and only run host env configuration when trust was accepted/succeeded.

Useful? React with 👍 / 👎.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7cbd139fbd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-04-03T15:59:07Z

  if (input.target !== "host") {
-    return { ...input.env };
+    return Promise.resolve({ ...input.env });


Inject trust vars for compose-target host commands

adaptEnvForHostExecution skips appendHackHostTrustEnvironment whenever --target compose is selected, but hack env exec/hack host exec still run on the host in that mode. That means compose-target host commands miss the newly added Hack CA variables (NODE_EXTRA_CA_CERTS, bundle pointers, HACK_*) and can still fail TLS against local routed hosts, while the default host target succeeds.

Useful? React with 👍 / 👎.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7da28f50a6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-04-03T16:12:19Z

+  const certPath = await exportCaddyLocalCaCert();
+  if (!certPath) {
+    return 1;
+  }


Fall back to existing CA cert when Caddy isn't running

globalTrust now aborts as soon as exportCaddyLocalCaCert() fails, before it reaches the keychain fast-path in ensureMacTrustCaddyLocalCa. This is a regression for the common case where the Caddy stack is temporarily down but Caddy Local Authority is already trusted (or an exported cert already exists): hack global trust now exits with code 1 instead of succeeding/no-op, so users cannot refresh host trust setup unless global infra is running.

Useful? React with 👍 / 👎.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a8044ef439

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-04-03T17:59:47Z

+      ["security", "find-certificate", "-a", "-p", keychainPath],
+      {


Restrict host trust bundle to trusted root certificates

writeMacHostTrustBundle builds the CA file by running security find-certificate -a -p against system/login keychains; security(1) documents -a as “find all matching certificates,” so this exports every certificate in those keychains, not just trusted roots. Because this bundle is then assigned to SSL_CERT_FILE/CURL_CA_BUNDLE/REQUESTS_CA_BUNDLE/GIT_SSL_CAINFO, Bun/Node/curl/git can treat non-root or user-imported certificates as trust anchors, broadening TLS trust unexpectedly on developer machines. Please filter to trusted root CAs only (or avoid using raw find-certificate -a -p dumps as the CA bundle).

Useful? React with 👍 / 👎.

## 2.5.0 (2026-04-07) * test: add env matrix coverage and PR verification guardrails ([6d63ef1](6d63ef1)) * test(global): mock macOS trust roots in CI fixtures ([3550a2e](3550a2e)) * Merge branch 'main' into fix/host-runtime-ca-trust ([e4feec9](e4feec9)) * Merge branch 'main' into skill-progression-map ([b2e87c6](b2e87c6)) * Merge pull request #43 from hack-dance/fix/host-runtime-ca-trust ([be98476](be98476)), closes [#43](#43) * Merge pull request #44 from hack-dance/skill-progression-map ([031991c](031991c)), closes [#44](#44) * Merge pull request #45 from hack-dance/fix/host-runtime-ca-trust ([1e966f5](1e966f5)), closes [#45](#45) * Merge pull request #46 from hack-dance/fix/dns-helper-hardening ([e3fca8a](e3fca8a)), closes [#46](#46) * Merge pull request #47 from hack-dance/fix/dns-helper-preflight-order ([8850b5c](8850b5c)), closes [#47](#47) * fix(env): clarify host command env inspection ([3c10f3b](3c10f3b)) * fix(global): allow missing libexec during preflight ([dc2e15a](dc2e15a)) * fix(global): harden dns recovery helper authorization ([fa4bb7e](fa4bb7e)) * fix(global): invalidate sudo cache before verifying dns auth ([9eeca18](9eeca18)) * fix(global): limit host bundle to macos roots ([bd2c074](bd2c074)) * fix(global): preserve brew fallback around dns helper ([7e5044b](7e5044b)) * fix(global): refresh dns recovery sudoers rule ([6cfe755](6cfe755)) * fix(global): retry brew when dns helper is stale ([f63067f](f63067f)) * fix(global): retry brew when helper stop fails ([2c6fa83](2c6fa83)) * fix(global): skip host tls env when trust is declined ([7cbd139](7cbd139)) * fix(global): use a root-owned dns recovery helper ([d9abbb5](d9abbb5)) * fix(global): validate dns helper path before install ([ade0909](ade0909)) * fix(runtime): cover compose-target host trust fallback ([a8044ef](a8044ef)) * fix(runtime): preserve explicit host TLS env ([3f1c928](3f1c928)) * fix(runtime): tighten host trust env typing ([2ac7b51](2ac7b51)) * fix(runtime): trust local hack CA for host workflows ([bdab2bd](bdab2bd)) * feat(doctor): repair host tls trust drift ([7da28f5](7da28f5)) * feat(env): add shell mode for host env commands ([7337d59](7337d59))

roodboi added 2 commits April 3, 2026 11:16

fix(runtime): trust local hack CA for host workflows

bdab2bd

fix(env): clarify host command env inspection

3c10f3b

chatgpt-codex-connector Bot reviewed Apr 3, 2026

View reviewed changes

roodboi added 2 commits April 3, 2026 11:32

feat(env): add shell mode for host env commands

7337d59

fix(runtime): preserve explicit host TLS env

3f1c928

roodboi changed the title ~~fix(runtime): trust local hack CA for host workflows~~ feat(env): improve host command env injection and trust Apr 3, 2026

hack-dance deleted a comment from changeset-bot Bot Apr 3, 2026

fix(runtime): tighten host trust env typing

2ac7b51

chatgpt-codex-connector Bot reviewed Apr 3, 2026

View reviewed changes

fix(global): skip host tls env when trust is declined

7cbd139

chatgpt-codex-connector Bot reviewed Apr 3, 2026

View reviewed changes

feat(doctor): repair host tls trust drift

7da28f5

chatgpt-codex-connector Bot reviewed Apr 3, 2026

View reviewed changes

fix(runtime): cover compose-target host trust fallback

a8044ef

chatgpt-codex-connector Bot reviewed Apr 3, 2026

View reviewed changes

fix(global): limit host bundle to macos roots

bd2c074

roodboi merged commit be98476 into main Apr 3, 2026
3 checks passed

roodboi deleted the fix/host-runtime-ca-trust branch April 3, 2026 18:18

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(env): improve host command env injection and trust#43

feat(env): improve host command env injection and trust#43
roodboi merged 9 commits into
mainfrom
fix/host-runtime-ca-trust

roodboi commented Apr 3, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Apr 3, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Apr 3, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Apr 3, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Apr 3, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Apr 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

		["security", "find-certificate", "-a", "-p", keychainPath],
		{

Uh oh!

Conversation

roodboi commented Apr 3, 2026

Summary

Testing

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant