Skip to content

cli: make the codex-subagent end-to-end test pass the wrapper check - #314

Merged
thedancingdeveloper merged 1 commit into
mainfrom
wi-1138-codexsub-e2e
Oct 15, 2026
Merged

thedancingdeveloper merged 1 commit into
mainfrom
wi-1138-codexsub-e2e

Conversation

@thedancingdeveloper

Copy link
Copy Markdown
Contributor

Summary

  • TestCodexSubagentMCP drove klaudia mcp codex-subagent with a #!/bin/sh fake codex, so it could never pass: refuseWrapper (fdedc37) rejects every executable whose first bytes are #!, because a script can prepend --dangerously-bypass-approvals-and-sandbox and that flag does not conflict with the -s the server passes. The fixture is now a compiled Go helper the test builds itself (cmd/klaudia/testdata/fakecodex). refuseWrapper is unchanged, and TestRefuseWrapper still covers the script, --yolo and bypass-flag cases.
  • The README's environment-variables table gains rows for KLAUDIA_CODEXSUB_DEPTH (read and set by the codex-subagent server) and six older variables the same test reported: ANTHROPIC_BASE_URL, KLAUDIA_CURSOR_BLINK, KLAUDIA_DUMP_FAILED_REQUEST, KLAUDIA_MCP_CONNECT_TIMEOUT, KLAUDIA_MCP_TOOL_TIMEOUT, KLAUDIA_PROC_TAG. TestREADMEDocumentsEveryEnvVar is green.

Closes the two gaps in the WI-1138 close-out review. No promotion to the native core (WI-1134): the item says to do that only if the MCP tool proves insufficient.

Verification

make check exits 0, including go test ./internal/codexsub/, ./internal/cli/ and ./cmd/klaudia/.

TestCodexSubagentMCP drove the server with a #!/bin/sh fake codex, but
refuseWrapper (fdedc37) rejects every executable whose first bytes are
"#!": a script can prepend --dangerously-bypass-approvals-and-sandbox,
and that flag does not conflict with the -s the server passes, so the
child would run unsandboxed. The server therefore exited before
initialize and the one test that speaks MCP to the binary could never
pass. The fixture is now a compiled Go helper built by the test, which
is what the check accepts. refuseWrapper is unchanged and
TestRefuseWrapper still covers the script, --yolo and bypass-flag cases.

The README's environment-variables table was also behind the code.
KLAUDIA_CODEXSUB_DEPTH, which this server reads and sets, had no row,
and neither did six older variables the same test reports. Documenting
them turns TestREADMEDocumentsEveryEnvVar green.

Verified: make check (exit 0), including go test ./internal/codexsub/,
./internal/cli/ and ./cmd/klaudia/.

Co-Authored-By: Klaudia <noreply@greenthread.ai>
@thedancingdeveloper

Copy link
Copy Markdown
Contributor Author

no blockers (6aa52ac)

Reviewed against origin/main 7c45a7f. refuseWrapper is byte-identical to main and still refuses a #! script, a --yolo wrapper and a wrapper that prepends --dangerously-bypass-approvals-and-sandbox (TestRefuseWrapper, internal/cli/mcp_codexsub_test.go). The fixture is now a compiled helper (cmd/klaudia/testdata/fakecodex), which is the only way past that check, and the README rows match the variables the env-docs test reads.

make check exits 0 on this head (vet, CGO_ENABLED=0 build, race internal tests, hermetic, e2e). Not merged.

@thedancingdeveloper
thedancingdeveloper merged commit d518b50 into main Oct 15, 2026
3 checks passed
@thedancingdeveloper
thedancingdeveloper deleted the wi-1138-codexsub-e2e branch October 15, 2026 03:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant