From abfcdd481a503fea8248d25a036d82a4d51c5917 Mon Sep 17 00:00:00 2001 From: Xubin Ren <52506698+Re-bin@users.noreply.github.com> Date: Wed, 12 Aug 2026 00:12:46 +0900 Subject: [PATCH] fix(cli): validate Windows subprocess environment --- nanobot/apps/cli/service.py | 2 +- tests/apps/test_cli_subprocess_env.py | 15 +++++++++++++++ 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/nanobot/apps/cli/service.py b/nanobot/apps/cli/service.py index 165a8476a..4872207de 100644 --- a/nanobot/apps/cli/service.py +++ b/nanobot/apps/cli/service.py @@ -1010,7 +1010,7 @@ class CliAppManager: "PATH": os.environ.get("PATH", f"{sr}\\system32;{sr}"), "PYTHONUNBUFFERED": "1", } - return {k: v for k, v in env.items() if v is not None} + return env return { "HOME": os.environ.get("HOME", "/tmp"), "LANG": os.environ.get("LANG", "C.UTF-8"), diff --git a/tests/apps/test_cli_subprocess_env.py b/tests/apps/test_cli_subprocess_env.py index 998eb27bc..b444ebd3b 100644 --- a/tests/apps/test_cli_subprocess_env.py +++ b/tests/apps/test_cli_subprocess_env.py @@ -20,6 +20,21 @@ def test_subprocess_env_excludes_api_keys(monkeypatch, tmp_path) -> None: assert "PATH" in env +def test_subprocess_env_excludes_api_keys_on_windows(monkeypatch, tmp_path) -> None: + monkeypatch.setattr("nanobot.apps.cli.service.sys.platform", "win32") + monkeypatch.setenv("OPENAI_API_KEY", "sk-should-not-leak") + monkeypatch.setenv("ANTHROPIC_API_KEY", "sk-ant-leak") + + manager = CliAppManager(workspace=tmp_path, data_dir=tmp_path / "cli-apps") + env = manager._subprocess_env() + + assert "OPENAI_API_KEY" not in env + assert "ANTHROPIC_API_KEY" not in env + assert env["PYTHONUNBUFFERED"] == "1" + assert env["SYSTEMROOT"] + assert all(isinstance(value, str) for value in env.values()) + + def test_run_passes_filtered_env(monkeypatch, tmp_path) -> None: monkeypatch.setenv("OPENAI_API_KEY", "sk-should-not-leak") manager = CliAppManager(workspace=tmp_path, data_dir=tmp_path / "cli-apps")