fix(cloud): probe with a minimal subprocess env#51
Merged
sourcehawk merged 1 commit intoMay 30, 2026
Merged
Conversation
… the parent Probe built its RunFunc with a nil cmd.Env, which makes the gcloud/aws whoami subprocess inherit the entire launcher environment — leaking ambient secrets into the identity probe used by session_status, preflight, and connections. This contradicted the spec's "explicit minimal cmd.Env" requirement and diverged from Server.run, which already filters the env. Extract a package-level minimalEnv helper (os.Environ filtered to the base passthrough plus the provider-declared names) so both the run_cli harness and the probe build their subprocess env through one home. Server.subprocessEnv now delegates to it, and Probe forwards minimalEnv(p.EnvPassthrough()) instead of nil — the whoami still gets the credential/impersonation env it needs, nothing more. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
sourcehawk
added a commit
that referenced
this pull request
May 30, 2026
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Towards #44
The cloud identity probe built its
RunFuncwith anilcmd.Env, which in Go makes thegcloud/awswhoami subprocess inherit the entire launcher environment — leaking the launcher's ambient secrets into the probe used bysession_status, preflight, and the connections panel. This contradicted the spec's "explicit minimalcmd.Env" requirement (Security model → "Pinned binary and minimal env") and diverged fromServer.run, which already filtered the subprocess env. This PR closes that gap.Changes
minimalEnv(passthrough []string)helper:os.Environ()filtered to the base passthrough (PATH,HOME) plus the provider-declared names, everything else dropped. Both therun_cliharness and the probe now build their subprocess env through this one home.ProbeforwardsminimalEnv(p.EnvPassthrough())toexecCLIinstead ofnil, so the whoami still receives the credential/impersonation env it needs and nothing more.Server.subprocessEnv()delegates tominimalEnv(s.provider.EnvPassthrough())rather than re-implementing the filter inline.Testing
New failing-first
TestProbeUsesMinimalSubprocessEnvdrives the probe through a real subprocess (/usr/bin/env, which prints the env it was handed) via a fake provider, then asserts at.Setenvparent canary never crosses the process boundary while a declared-passthrough var survives. Confirmed RED before the fix, GREEN after. The existingTestSubprocessEnvDropsParentSecretsKeepsPassthroughstill passes against the refactored helper.make test-gois race-clean and green;make lintreports 0 issues.frontend/untouched.🤖 Generated with Claude Code