titan/atlas-iac
3
0
Fork 0
Code Issues Pull Requests 9 Actions Packages Projects Releases Wiki Activity

hermes: preserve Vault CLI credentials for workers

Browse Source
This commit is contained in:
jenkins 2026-08-16 08:39:45 -03:00
parent 943fa71ac5
commit 3b003b850d
2 changed files with 18 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
services/hermes/scripts/cli_lane_runner.py
View File

@ -428,12 +428,15 @@ def _terminate_worker_process(process: subprocess.Popen[str]) -> None:
def _base_env() -> dict[str, str]:
"""Build a worker environment while preserving Vault-backed CLI homes."""
env = os.environ.copy()
env.update(
{
"HOME": str(DATA_ROOT / "home"),
"CODEX_HOME": str(DATA_ROOT / "home/.codex"),
"CLAUDE_CONFIG_DIR": str(DATA_ROOT / "home/.claude"),
"CODEX_HOME": os.environ.get("CODEX_HOME", "/runtime-access/codex"),
"CLAUDE_CONFIG_DIR": os.environ.get(
"CLAUDE_CONFIG_DIR", "/runtime-access/claude"
),
"GIT_TERMINAL_PROMPT": "0",
}
)

13
testing/tests/test_hermes_cli_lanes.py
View File

@ -151,6 +151,19 @@ def test_cross_provider_retry_passes_failed_provider_to_switchyard():
assert "codex provider failed or exhausted capacity" in content
def test_worker_environment_preserves_vault_backed_cli_homes(monkeypatch):
"""Kanban workers must not fall back to credential-free persistent homes."""
monkeypatch.setenv("CODEX_HOME", "/runtime-access/codex")
monkeypatch.setenv("CLAUDE_CONFIG_DIR", "/runtime-access/claude")
env = lanes._base_env()
assert env["HOME"] == str(lanes.DATA_ROOT / "home")
assert env["CODEX_HOME"] == "/runtime-access/codex"
assert env["CLAUDE_CONFIG_DIR"] == "/runtime-access/claude"
assert env["GIT_TERMINAL_PROMPT"] == "0"
def test_claude_session_is_reserved_before_first_process(tmp_path: Path, monkeypatch):
state: dict = {}
state_file = tmp_path / "state.json"