// What environment does a stdio MCP server actually receive?//// This spawns a real subprocess through the real transport and reads back the// environment that process was handed. Asserting on the arguments we pass to// the SDK would not answer the question — the SDK merges its own safe-list// underneath ours, so the only honest answer comes from the child itself.//// The child is a plain node script rather than an MCP server: it is spawned by// the same code path either way, and speaking the protocol would add nothing// to what is being measured. It never completes a handshake, so the transport// is closed once the file has been written.//// The child reports only the keys a test names. Dumping the whole environment// would write the runner's own secrets to a temp file to answer a question// about a handful of variables. import { mkdtempSync, readFileSync, rmSync, existsSync } from "node:fs";import { tmpdir } from "node:os";import { join } from "node:path";import { afterEach, describe, expect, it } from "@effect/vitest"; import { createStdioTransport } from "./stdio-connector"; /** A variable only this test sets, standing in for a real one like *  `EXECUTOR_SECRET_KEY`. Using a fake keeps the test honest on a machine *  where the real one happens not to be set. */const HOST_ONLY_SECRET = "EXECUTOR_TEST_HOST_ONLY_SECRET";const HOST_ONLY_VALUE = "host-secret-that-must-not-reach-a-child"; const dirs: string[] = [];/** Host variables a test set, restored rather than deleted: the machine *  running this may legitimately be behind a proxy. */const restore = new Map<string, string | undefined>(); const setHostEnv = (key: string, value: string): void => {  if (!restore.has(key)) restore.set(key, process.env[key]);  process.env[key] = value;}; afterEach(() => {  for (const [key, value] of restore) {    if (value === undefined) delete process.env[key];    else process.env[key] = value;  }  restore.clear();  for (const dir of dirs.splice(0)) rmSync(dir, { recursive: true, force: true });}); /** * Spawn a child through the transport and return which of `probe` it saw. * Keys the child did not receive are absent from the result. */const envSeenByChild = async (  declared: Record<string, string> | undefined,  probe: ReadonlyArray<string>,): Promise<Record<string, string>> => {  const dir = mkdtempSync(join(tmpdir(), "executor-stdio-env-"));  dirs.push(dir);  const out = join(dir, "env.json");   const transport = createStdioTransport({    command: process.execPath,    args: [      "-e",      "const [out, ...keys] = process.argv.slice(1);" +        "require('node:fs').writeFileSync(out, JSON.stringify(Object.fromEntries(" +        "keys.flatMap((k) => (process.env[k] === undefined ? [] : [[k, process.env[k]]]))" +        ")))",      out,      ...probe,    ],    env: declared,  });   await transport.start();  // The child writes and exits; poll briefly rather than assuming timing.  for (let i = 0; i < 100 && !existsSync(out); i++) {    await new Promise((resolve) => setTimeout(resolve, 20));  }  await transport.close();   // oxlint-disable-next-line executor/no-json-parse -- boundary: reading back the raw env dump this test's own child process just wrote; the value is only key-checked, never decoded into domain types  return JSON.parse(readFileSync(out, "utf8")) as Record<string, string>;}; describe("environment handed to a stdio MCP subprocess", () => {  it("does not leak a host secret to a server that declares its own env", async () => {    // The declared-env branch is the one that matters: it is the branch a    // credential-bearing integration takes, and it was the leaking one.    setHostEnv(HOST_ONLY_SECRET, HOST_ONLY_VALUE);     const childEnv = await envSeenByChild({ DECLARED_TOKEN: "declared-value" }, [      HOST_ONLY_SECRET,      "DECLARED_TOKEN",    ]);     expect(childEnv[HOST_ONLY_SECRET]).toBeUndefined();    // ...and the thing the integration actually asked for still arrives.    expect(childEnv.DECLARED_TOKEN).toBe("declared-value");  });   it("does not leak a host secret to a server that declares no env", async () => {    setHostEnv(HOST_ONLY_SECRET, HOST_ONLY_VALUE);     const childEnv = await envSeenByChild(undefined, [HOST_ONLY_SECRET]);     expect(childEnv[HOST_ONLY_SECRET]).toBeUndefined();  });   it("still provides the SDK's safe-list, so servers keep working", async () => {    // The fix must not strand servers that legitimately need PATH to find    // their own interpreter. The SDK's list is what supplies it.    const childEnv = await envSeenByChild({ DECLARED_TOKEN: "declared-value" }, ["PATH", "HOME"]);     expect(childEnv.PATH).toBeDefined();    expect(childEnv.HOME).toBeDefined();  });   it("passes the host's proxy and CA configuration through, but nothing beside it", async () => {    // A server behind a corporate proxy or an intercepting CA cannot reach    // anything without these, and no source config declares them. Inheriting    // this short list is the whole difference between the fix landing and the    // fix breaking every install on such a network.    setHostEnv("HTTPS_PROXY", "http://proxy.invalid:3128");    setHostEnv("no_proxy", "localhost,127.0.0.1");    setHostEnv("NODE_EXTRA_CA_CERTS", "/etc/ssl/certs/corporate.pem");    setHostEnv(HOST_ONLY_SECRET, HOST_ONLY_VALUE);     const childEnv = await envSeenByChild(undefined, [      "HTTPS_PROXY",      "no_proxy",      "NODE_EXTRA_CA_CERTS",      HOST_ONLY_SECRET,    ]);     expect(childEnv.HTTPS_PROXY).toBe("http://proxy.invalid:3128");    expect(childEnv.no_proxy).toBe("localhost,127.0.0.1");    expect(childEnv.NODE_EXTRA_CA_CERTS).toBe("/etc/ssl/certs/corporate.pem");    // The allowlist is an allowlist: a secret sitting beside those in the same    // environment still does not travel.    expect(childEnv[HOST_ONLY_SECRET]).toBeUndefined();  });   it("lets the source config override an inherited proxy value", async () => {    // The allowlist is merged underneath the declared env, so a source that    // needs its own egress route is not overruled by the host's.    setHostEnv("HTTPS_PROXY", "http://host-proxy.invalid:3128");     const childEnv = await envSeenByChild({ HTTPS_PROXY: "http://declared-proxy.invalid:8080" }, [      "HTTPS_PROXY",    ]);     expect(childEnv.HTTPS_PROXY).toBe("http://declared-proxy.invalid:8080");  });   it("POSITIVE CONTROL: the child does report a variable when it is passed one", async () => {    // Proves the measurement works. Without this, a child that failed to    // write, or wrote an empty object, would satisfy every assertion above.    setHostEnv(HOST_ONLY_SECRET, HOST_ONLY_VALUE);     const childEnv = await envSeenByChild({ [HOST_ONLY_SECRET]: HOST_ONLY_VALUE }, [      HOST_ONLY_SECRET,    ]);     expect(childEnv[HOST_ONLY_SECRET]).toBe(HOST_ONLY_VALUE);  });});