github/AutoGPT
1
1
Fork 0
mirror of https://github.com/Significant-Gravitas/AutoGPT.git synced 2026-04-08 03:00:28 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix(backend/copilot): update p0 guardrail tests to check env.py after #12635 move

Browse Source 
The security env vars (CLAUDE_CODE_TMPDIR, CLAUDE_CODE_DISABLE_CLAUDE_MDS,
etc.) were moved from service.py to build_sdk_env() in env.py by PR #12635.
Update the p0_guardrails_test.py source-grep assertions to point at env.py,
and add the four security env vars to build_sdk_env() which were dropped
during the extraction.
This commit is contained in:
Zamil Majdy
2026-04-02 19:32:24 +02:00
parent 49bef40ef0
commit 2411cc386d
2 changed files with 20 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
autogpt_platform/backend/backend/copilot/sdk/env.py
View File

@@ -79,4 +79,11 @@ def build_sdk_env(
if sdk_cwd:
env["CLAUDE_CODE_TMPDIR"] = sdk_cwd
# Prevent loading untrusted workspace .claude.md files, persisting
# prompt history, writing auto-memory, and non-essential traffic.
env["CLAUDE_CODE_DISABLE_CLAUDE_MDS"] = "1"
env["CLAUDE_CODE_SKIP_PROMPT_HISTORY"] = "1"
env["CLAUDE_CODE_DISABLE_AUTO_MEMORY"] = "1"
env["CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC"] = "1"
return env

26
autogpt_platform/backend/backend/copilot/sdk/p0_guardrails_test.py
View File

@@ -102,43 +102,43 @@ class TestResolveFallbackModel:
class TestSecurityEnvVars:
"""Verify the env-var contract in the service module.
"""Verify the env-var contract in the env module.
The production code sets CLAUDE_CODE_TMPDIR and security env vars
inline after ``build_sdk_env()`` returns. We grep for these string
literals in ``service.py`` to ensure they aren't accidentally removed.
inside ``build_sdk_env()`` in ``env.py``. We grep for these string
literals to ensure they aren't accidentally removed.
"""
_SERVICE_PATH = "autogpt_platform/backend/backend/copilot/sdk/service.py"
_ENV_PATH = "autogpt_platform/backend/backend/copilot/sdk/env.py"
@staticmethod
def _read_service_source() -> str:
def _read_env_source() -> str:
import pathlib
# Walk up from this test file to the repo root
repo = pathlib.Path(__file__).resolve().parents[5]
return (repo / TestSecurityEnvVars._SERVICE_PATH).read_text()
return (repo / TestSecurityEnvVars._ENV_PATH).read_text()
def test_tmpdir_env_var_present_in_source(self):
"""CLAUDE_CODE_TMPDIR must be set when sdk_cwd is provided."""
src = self._read_service_source()
assert 'sdk_env["CLAUDE_CODE_TMPDIR"]' in src
src = self._read_env_source()
assert 'env["CLAUDE_CODE_TMPDIR"]' in src
def test_home_not_overridden_in_source(self):
"""HOME must NOT be overridden — would break git/ssh/npm."""
src = self._read_service_source()
assert 'sdk_env["HOME"]' not in src
src = self._read_env_source()
assert 'env["HOME"]' not in src
def test_security_env_vars_present_in_source(self):
"""All four security env vars must be set in the service module."""
src = self._read_service_source()
"""All four security env vars must be set in the env module."""
src = self._read_env_source()
for var in (
"CLAUDE_CODE_DISABLE_CLAUDE_MDS",
"CLAUDE_CODE_SKIP_PROMPT_HISTORY",
"CLAUDE_CODE_DISABLE_AUTO_MEMORY",
"CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC",
):
assert var in src, f"{var} not found in service.py"
assert var in src, f"{var} not found in env.py"
# ---------------------------------------------------------------------------