From ca55a72ddf46f0703e94026b4dc64c0fe3ff3177 Mon Sep 17 00:00:00 2001 From: Carlos Villela Date: Sat, 27 Jun 2026 01:20:42 -0700 Subject: [PATCH 1/3] fix(e2e): avoid multiline Deep Agents secret probe Signed-off-by: Carlos Villela --- .../checks/08-deepagents-code-secret-boundary.sh | 12 +++--------- test/langchain-deepagents-code-image.test.ts | 2 ++ 2 files changed, 5 insertions(+), 9 deletions(-) diff --git a/test/e2e/e2e-cloud-experimental/checks/08-deepagents-code-secret-boundary.sh b/test/e2e/e2e-cloud-experimental/checks/08-deepagents-code-secret-boundary.sh index 16680908684..01852317cca 100755 --- a/test/e2e/e2e-cloud-experimental/checks/08-deepagents-code-secret-boundary.sh +++ b/test/e2e/e2e-cloud-experimental/checks/08-deepagents-code-secret-boundary.sh @@ -36,15 +36,9 @@ sandbox_exec() { dcode_secret_probe() { local command="$1" - sandbox_exec " -tmp=\$(mktemp /tmp/dcode-secret-boundary.XXXXXX) -${command} >\"\$tmp\" 2>&1 -status=\$? -cat \"\$tmp\" -rm -f \"\$tmp\" -printf 'DCODE_EXIT:%s\n' \"\$status\" -exit 0 -" + local remote_cmd + remote_cmd="tmp=\$(mktemp /tmp/dcode-secret-boundary.XXXXXX); ${command} >\"\$tmp\" 2>&1; status=\$?; cat \"\$tmp\"; rm -f \"\$tmp\"; printf 'DCODE_EXIT:%s\\n' \"\$status\"; exit 0" + sandbox_exec "$remote_cmd" } make_log_marker() { diff --git a/test/langchain-deepagents-code-image.test.ts b/test/langchain-deepagents-code-image.test.ts index 4fd3468d3ca..f5c483f7951 100644 --- a/test/langchain-deepagents-code-image.test.ts +++ b/test/langchain-deepagents-code-image.test.ts @@ -433,6 +433,8 @@ describe("LangChain Deep Agents Code image contracts", () => { expect(secretBoundaryCheck).toContain("Case: Deep Agents Code dcode secret boundary"); expect(secretBoundaryCheck).toContain("env OPENAI_API_KEY="); expect(secretBoundaryCheck).toContain("dcode -n 'Reply with the single word PING'"); + expect(secretBoundaryCheck).toContain("remote_cmd="); + expect(secretBoundaryCheck).toContain("DCODE_EXIT:%s\\\\n"); expect(secretBoundaryCheck).toContain("DCODE_EXIT:0"); expect(secretBoundaryCheck).toContain("refusing to start"); expect(secretBoundaryCheck).toContain("NETWORK_LOG_PATTERN="); From 8a63f8463f04a6e5ae02ccc86a5738bb1281078b Mon Sep 17 00:00:00 2001 From: Carlos Villela Date: Sat, 27 Jun 2026 01:31:13 -0700 Subject: [PATCH 2/3] test(e2e): cover Deep Agents secret probe shape Signed-off-by: Carlos Villela --- ...platform-parity-cloud-experimental.test.ts | 22 +++++++++++++++++++ .../08-deepagents-code-secret-boundary.sh | 21 ++++++++++++++++++ test/langchain-deepagents-code-image.test.ts | 3 +++ 3 files changed, 46 insertions(+) diff --git a/test/e2e-scenario/support-tests/platform-parity-cloud-experimental.test.ts b/test/e2e-scenario/support-tests/platform-parity-cloud-experimental.test.ts index 1a963632625..d9c61f87fd4 100644 --- a/test/e2e-scenario/support-tests/platform-parity-cloud-experimental.test.ts +++ b/test/e2e-scenario/support-tests/platform-parity-cloud-experimental.test.ts @@ -87,6 +87,28 @@ describe("P0-E cloud-experimental parity guardrails", () => { expect(result.stdout.trim()).toBe("NO_NEWLINE_IN_COMMAND"); }); + it("keeps Deep Agents secret-boundary probe command single-line for OpenShell exec", () => { + const result = spawnSync( + "bash", + [ + path.join( + process.cwd(), + "test/e2e/e2e-cloud-experimental/checks/08-deepagents-code-secret-boundary.sh", + ), + ], + { + encoding: "utf8", + env: { + NEMOCLAW_E2E_SECRET_BOUNDARY_SELF_TEST: "probe-command-shape", + PATH: process.env.PATH ?? "/usr/bin:/bin", + }, + }, + ); + + expect(result.status).toBe(0); + expect(result.stdout).toContain("NO_NEWLINE_IN_COMMAND"); + }); + it("registers executable Deep Agents cloud-experimental checks", () => { expect(DEEPAGENTS_CLOUD_EXPERIMENTAL_CHECKS).toEqual([ "test/e2e/e2e-cloud-experimental/checks/05-deepagents-code-landlock-readonly.sh", diff --git a/test/e2e/e2e-cloud-experimental/checks/08-deepagents-code-secret-boundary.sh b/test/e2e/e2e-cloud-experimental/checks/08-deepagents-code-secret-boundary.sh index 01852317cca..7cec426a683 100755 --- a/test/e2e/e2e-cloud-experimental/checks/08-deepagents-code-secret-boundary.sh +++ b/test/e2e/e2e-cloud-experimental/checks/08-deepagents-code-secret-boundary.sh @@ -37,6 +37,10 @@ sandbox_exec() { dcode_secret_probe() { local command="$1" local remote_cmd + # This helper is intentionally used only with hardcoded probe commands below; + # secret material is inserted by callers with Bash @Q quoting. Keep the + # remote command single-line because OpenShell rejects newline-bearing exec + # arguments. remote_cmd="tmp=\$(mktemp /tmp/dcode-secret-boundary.XXXXXX); ${command} >\"\$tmp\" 2>&1; status=\$?; cat \"\$tmp\"; rm -f \"\$tmp\"; printf 'DCODE_EXIT:%s\\n' \"\$status\"; exit 0" sandbox_exec "$remote_cmd" } @@ -185,6 +189,23 @@ assert_no_rejected_interval_audit_logs() { PASSED=0 FAILED=0 +if [ "${NEMOCLAW_E2E_SECRET_BOUNDARY_SELF_TEST:-}" = "probe-command-shape" ]; then + sandbox_exec() { + case "$1" in + *$'\n'*) + printf '%s\n' "NEWLINE_IN_COMMAND" + return 1 + ;; + *) + printf '%s\n' "NO_NEWLINE_IN_COMMAND" + return 0 + ;; + esac + } + dcode_secret_probe "env OPENAI_API_KEY=${FAKE_SECRET@Q} dcode -n 'Reply with the single word PING'" + exit 0 +fi + if ! sandbox_exec "test -d /sandbox/.deepagents && command -v dcode >/dev/null 2>&1" >/dev/null; then info "SKIP: sandbox '${SANDBOX_NAME}' is not a Deep Agents Code sandbox" exit 0 diff --git a/test/langchain-deepagents-code-image.test.ts b/test/langchain-deepagents-code-image.test.ts index f5c483f7951..3d150a5b224 100644 --- a/test/langchain-deepagents-code-image.test.ts +++ b/test/langchain-deepagents-code-image.test.ts @@ -434,6 +434,9 @@ describe("LangChain Deep Agents Code image contracts", () => { expect(secretBoundaryCheck).toContain("env OPENAI_API_KEY="); expect(secretBoundaryCheck).toContain("dcode -n 'Reply with the single word PING'"); expect(secretBoundaryCheck).toContain("remote_cmd="); + expect(secretBoundaryCheck).toContain("OpenShell rejects newline-bearing exec"); + expect(secretBoundaryCheck).toContain("NEMOCLAW_E2E_SECRET_BOUNDARY_SELF_TEST"); + expect(secretBoundaryCheck).toContain("NO_NEWLINE_IN_COMMAND"); expect(secretBoundaryCheck).toContain("DCODE_EXIT:%s\\\\n"); expect(secretBoundaryCheck).toContain("DCODE_EXIT:0"); expect(secretBoundaryCheck).toContain("refusing to start"); From b7bfba287cbc0fa2107564f02333692615c4ba0b Mon Sep 17 00:00:00 2001 From: Carlos Villela Date: Sat, 27 Jun 2026 01:41:57 -0700 Subject: [PATCH 3/3] test(e2e): narrow Deep Agents secret probes Signed-off-by: Carlos Villela --- .../08-deepagents-code-secret-boundary.sh | 22 ++++++++++--------- test/langchain-deepagents-code-image.test.ts | 2 ++ 2 files changed, 14 insertions(+), 10 deletions(-) diff --git a/test/e2e/e2e-cloud-experimental/checks/08-deepagents-code-secret-boundary.sh b/test/e2e/e2e-cloud-experimental/checks/08-deepagents-code-secret-boundary.sh index 7cec426a683..fa12be8e218 100755 --- a/test/e2e/e2e-cloud-experimental/checks/08-deepagents-code-secret-boundary.sh +++ b/test/e2e/e2e-cloud-experimental/checks/08-deepagents-code-secret-boundary.sh @@ -34,14 +34,16 @@ sandbox_exec() { openshell sandbox exec --name "$SANDBOX_NAME" -- bash -c "$1" 2>&1 } -dcode_secret_probe() { - local command="$1" +dcode_secret_probe_runtime_env() { + # Keep this probe single-line: OpenShell rejects newline-bearing exec arguments. local remote_cmd - # This helper is intentionally used only with hardcoded probe commands below; - # secret material is inserted by callers with Bash @Q quoting. Keep the - # remote command single-line because OpenShell rejects newline-bearing exec - # arguments. - remote_cmd="tmp=\$(mktemp /tmp/dcode-secret-boundary.XXXXXX); ${command} >\"\$tmp\" 2>&1; status=\$?; cat \"\$tmp\"; rm -f \"\$tmp\"; printf 'DCODE_EXIT:%s\\n' \"\$status\"; exit 0" + remote_cmd="tmp=\$(mktemp /tmp/dcode-secret-boundary.XXXXXX); env OPENAI_API_KEY=${FAKE_SECRET@Q} dcode -n 'Reply with the single word PING' >\"\$tmp\" 2>&1; status=\$?; cat \"\$tmp\"; rm -f \"\$tmp\"; printf 'DCODE_EXIT:%s\\n' \"\$status\"; exit 0" + sandbox_exec "$remote_cmd" +} + +dcode_secret_probe_env_file() { + local remote_cmd + remote_cmd="tmp=\$(mktemp /tmp/dcode-secret-boundary.XXXXXX); dcode -n 'Reply with the single word PING' >\"\$tmp\" 2>&1; status=\$?; cat \"\$tmp\"; rm -f \"\$tmp\"; printf 'DCODE_EXIT:%s\\n' \"\$status\"; exit 0" sandbox_exec "$remote_cmd" } @@ -202,7 +204,7 @@ if [ "${NEMOCLAW_E2E_SECRET_BOUNDARY_SELF_TEST:-}" = "probe-command-shape" ]; th ;; esac } - dcode_secret_probe "env OPENAI_API_KEY=${FAKE_SECRET@Q} dcode -n 'Reply with the single word PING'" + dcode_secret_probe_runtime_env exit 0 fi @@ -217,7 +219,7 @@ enable_openshell_audit_logs runtime_log_marker="$(make_log_marker runtime-env)" runtime_audit_start="$(($(date +%s) - 1))" mark_sandbox_logs "$runtime_log_marker" -runtime_output="$(dcode_secret_probe "env OPENAI_API_KEY=${FAKE_SECRET@Q} dcode -n 'Reply with the single word PING'" || true)" +runtime_output="$(dcode_secret_probe_runtime_env || true)" runtime_logs="$(sandbox_logs_since_marker "$runtime_log_marker" || true)" runtime_audit_logs="$(openshell_audit_logs_since_epoch "$runtime_audit_start" || true)" assert_secret_rejected "runtime environment injection" "$runtime_output" "OPENAI_API_KEY" @@ -235,7 +237,7 @@ env_before_hash="$(sandbox_exec "sha256sum ${DEEPAGENTS_ENV_FILE@Q} | awk '{prin env_log_marker="$(make_log_marker env-file)" env_audit_start="$(($(date +%s) - 1))" mark_sandbox_logs "$env_log_marker" -env_output="$(dcode_secret_probe "dcode -n 'Reply with the single word PING'" || true)" +env_output="$(dcode_secret_probe_env_file || true)" env_logs="$(sandbox_logs_since_marker "$env_log_marker" || true)" env_audit_logs="$(openshell_audit_logs_since_epoch "$env_audit_start" || true)" env_after_hash="$(sandbox_exec "sha256sum ${DEEPAGENTS_ENV_FILE@Q} | awk '{print \$1}'" || true)" diff --git a/test/langchain-deepagents-code-image.test.ts b/test/langchain-deepagents-code-image.test.ts index 3d150a5b224..50790ae0967 100644 --- a/test/langchain-deepagents-code-image.test.ts +++ b/test/langchain-deepagents-code-image.test.ts @@ -433,6 +433,8 @@ describe("LangChain Deep Agents Code image contracts", () => { expect(secretBoundaryCheck).toContain("Case: Deep Agents Code dcode secret boundary"); expect(secretBoundaryCheck).toContain("env OPENAI_API_KEY="); expect(secretBoundaryCheck).toContain("dcode -n 'Reply with the single word PING'"); + expect(secretBoundaryCheck).toContain("dcode_secret_probe_runtime_env"); + expect(secretBoundaryCheck).toContain("dcode_secret_probe_env_file"); expect(secretBoundaryCheck).toContain("remote_cmd="); expect(secretBoundaryCheck).toContain("OpenShell rejects newline-bearing exec"); expect(secretBoundaryCheck).toContain("NEMOCLAW_E2E_SECRET_BOUNDARY_SELF_TEST");