feat: the shell step can run inside a Configure-authored environment (goal 0240 S4) - #520
Merged
Merged
Conversation
…(goal 0240 S4) process-shell-command gains an optional Execution environment reference (RefKind execenv) — empty keeps S1's documented posture (your real login shell and real environment, byte-for-byte); set, the block runs under that ExecEnv through the SAME machinery code-execution uses (shellArgv's clean/login flags, resolveDir's per-block temp-dir mint, explicit-only env with the minimal-PATH default), and block-referenced secrets upsert onto the environment's explicit env, never os.Environ. The Confirm screen names the environment (a secret-free preview seam — never the vault-resolving lookup, so previews can't trigger audit lines). New typedfield contract: OptionalRef marks a RefKind whose empty value is a deliberate posture, skipped by preflight's required-ref check. No new entity: ExecEnv already IS the profile the goal's session answer described. Coding-loop seed revision bumped (its node config grew the resolved default); contract schemas regenerated. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012im1JxQQV2ahnXzZDdVmZq
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
S4 of the coding loop (owner session answer #5: "PROFILE is the feature... shell selection is one field of it"). Measured before building: the profile ENTITY already exists —
ExecEnv(ADR-0026) carries exactly that list (shell, env vars with vault-refs, cwd, profile mode), so S4 is WIRING, never a parallel entity.process-shell-commandgains an optional Execution environment reference (RefKindexecenv). Empty keeps S1's documented posture — your real login shell and real environment, byte-for-byte. Set, the block runs under that ExecEnv through the SAME machinery code-execution uses:shellArgv's clean/login flags,resolveDir's per-BLOCK temp-dir mint, explicit-only env with the minimal-PATH default.os.Environ— the two postures cannot mix (test-pinned).OptionalRefmarks a RefKind whose empty value is a deliberate posture; graph preflight skips its required-ref check (the rule assumed every ref was required — true until this field).🤖 Generated with Claude Code
https://claude.ai/code/session_012im1JxQQV2ahnXzZDdVmZq