From 04d50426925ac9821b36a038da95812f50fbc6c2 Mon Sep 17 00:00:00 2001 From: Max Date: Wed, 12 Aug 2026 17:09:28 +0900 Subject: [PATCH] Enable approved tasks for protected agent Ping --- builder/dashboard-server-m4.py | 1 + builder/tests/test_agent_ping_auto_run.py | 55 +++++++++++++++++++++++ 2 files changed, 56 insertions(+) diff --git a/builder/dashboard-server-m4.py b/builder/dashboard-server-m4.py index e41f8e3..cd59c76 100644 --- a/builder/dashboard-server-m4.py +++ b/builder/dashboard-server-m4.py @@ -1960,6 +1960,7 @@ def _handle_jarvis_pipeline_ping(self): "JARVIS_AGENT_BUDGET": "cheap", "JARVIS_AGENT_SELF_HEAL_MAX_RETRIES": "0", "JARVIS_AGENT_PING_ROLE": role, + "JARVIS_GITHUB_TASKS_ENABLED": "1", } ) log_file = None diff --git a/builder/tests/test_agent_ping_auto_run.py b/builder/tests/test_agent_ping_auto_run.py index 1e7193c..fd81813 100644 --- a/builder/tests/test_agent_ping_auto_run.py +++ b/builder/tests/test_agent_ping_auto_run.py @@ -504,6 +504,61 @@ def test_ac5_existing_geometry_focus_motion_and_history_contracts_remain(self): class AgentPingBoundaryRegressionTests(unittest.TestCase): + def test_bug_authorized_ping_enables_approved_tasks_only_in_its_subprocess(self): + server = _load_server() + with tempfile.TemporaryDirectory() as tmp: + root = Path(tmp) + project_dir = root / "jarvis" + report_dir = root / "reports" + log_file = root / "logs" / "pipeline.log" + pipeline_script = root / "jarvis-agent-pipeline" + project_dir.mkdir() + pipeline_script.write_text("#!/bin/sh\n", encoding="utf-8") + pipeline_script.chmod(0o700) + + handler = server.Handler.__new__(server.Handler) + handler._require_dashboard_run_auth = MagicMock(return_value=True) + handler._read_json_body = MagicMock(return_value={"role": "coordinator"}) + response: dict[str, object] = {} + handler._json_response = lambda status, payload: response.update( + http_status=status, payload=payload + ) + process = MagicMock() + process.poll.return_value = None + + with ( + patch.dict( + os.environ, + {"JARVIS_GITHUB_TASKS_ENABLED": "0"}, + clear=False, + ), + patch.object(server, "JARVIS_PROJECTS", {"jarvis": project_dir}), + patch.object(server, "JARVIS_PIPELINE_SCRIPT", pipeline_script), + patch.object(server, "JARVIS_PIPELINE_REPORT_DIR", report_dir), + patch.object(server, "JARVIS_PIPELINE_LOG_FILE", log_file), + patch.object(server, "_JARVIS_PING_PROCESS", None), + patch.object(server.subprocess, "Popen", return_value=process) as popen, + ): + handler._handle_jarvis_pipeline_ping() + self.assertEqual( + os.environ["JARVIS_GITHUB_TASKS_ENABLED"], + "0", + "Ping must not enable GitHub tasks process-wide", + ) + + self.assertEqual(response["http_status"], 202) + popen.assert_called_once() + args, kwargs = popen.call_args + self.assertEqual( + args[0], [str(pipeline_script), server.JARVIS_PING_TASK] + ) + self.assertEqual(kwargs["cwd"], str(project_dir)) + self.assertEqual(kwargs["env"]["JARVIS_AGENT_PING_ROLE"], "coordinator") + self.assertEqual( + kwargs["env"]["JARVIS_GITHUB_TASKS_ENABLED"], + "1", + "the protected Ping subprocess must opt into approved GitHub tasks", + ) def test_ac1_exact_roles_auth_first_busy_lock_and_512_byte_cap_remain(self): server = _load_server() self.assertEqual(set(server.JARVIS_PING_ROLES), set(CANONICAL_ROLES))