Repository navigation
fix: approve current Claude --settings recipes (drift guard) + un-retire test/integration/server - #846
Merged
Conversation
…pin them with a drift guard 0908a46 rewrote the Claude bell commands in freshell-platform without updating this crate's approved --settings digests, so every managed Claude launch was rejected ("managed provider arguments must use an approved non-secret recipe") for 10 days. The cloud vitest lanes never run test/integration/server, which masked it. - Add the current Unix/Windows recipe digests; keep the superseded ones so durable argv persisted under them keeps validating. - Extract APPROVED_CLAUDE_SETTINGS_DIGESTS. - Add a dev-dep on freshell-platform and a drift-guard test that validates the CURRENT recipes through validate_managed_terminal_args, so recipe drift fails rust-gate instead of production.
…exclusion The directory was re-added 2026-09-28 as the live managed-provider parity suites but stayed on retiredNodeBackendPaths (failing every LOCAL architecture run since Oct 3) and kept its stale 'retired roots' comment in .dockerignore. Remove the stale list entry; document that the cloud-image exclusion is deliberate — the parity suites need a locally built Rust server binary and a Docker daemon, so local lanes cover them.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Two defects made every LOCAL full-suite run on main red since ~Oct 3, masked because cloud vitest lanes never run
test/integration/server(excluded from the image).1. Real regression: every managed Claude launch was rejected (fix)
0908a4624(Oct 4) rewrote the Claude bell commands infreshell-platform, but the SHA-256 allow-list that approves the--settingspayload infreshell-runtime-protocolwas never updated — sovalidate_managed_terminal_argsrejected the recipe every managed Claude launch built, withmanaged provider arguments must use an approved non-secret recipe. Not user-facing today (managed Claude is not yet enabled inruntime-provider-capabilities.json), but it would have broken the moment Claude went managed.APPROVED_CLAUDE_SETTINGS_DIGESTS.freshell-platformplus a drift-guard test that runs the CURRENT recipes throughvalidate_managed_terminal_args— recipe drift now fails rust-gate instead of production.2. Test-infra:
test/integration/serverre-added but still "retired" (test)The directory was re-added 2026-09-28 as the live managed-provider parity suites but stayed on
retiredNodeBackendPaths, so the "retired roots stay absent" architecture test failed on every local run, and.dockerignorestill carried the stale "retired roots" comment..dockerignorethat the cloud-image exclusion is deliberate: the parity suites need a locally built Rust server binary and a Docker daemon, so local lanes cover them.Validation
cargo test -p freshell-runtime-protocol: 33 passed, including the new drift guard (which failed RED with the exact drift before the fix).managed-provider-parity.test.ts,provider-parity-contract.test.ts,fresh-agent-only-runtime.test.ts— all green.