From 990d54a9e406cc271ac267429859bec387cda686 Mon Sep 17 00:00:00 2001 From: Garry Tan Date: Thu, 13 Aug 2026 10:34:25 -0700 Subject: [PATCH] fix(test): hermetic-canary probes with ${VAR:-} so nounset shells can't fail success MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The probe echoed bare $CONDUCTOR_WORKSPACE_PATH — when scrubbing WORKS the var is unset, and under a nounset shell the echo errors, failing the canary exactly when isolation succeeds. Defaulted expansions assert identically under any shell. Fails identically on base; fixed here. Co-Authored-By: Claude Fable 5 --- test/skill-e2e-hermetic-canary.test.ts | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/test/skill-e2e-hermetic-canary.test.ts b/test/skill-e2e-hermetic-canary.test.ts index 1356b7dce..06f1dc302 100644 --- a/test/skill-e2e-hermetic-canary.test.ts +++ b/test/skill-e2e-hermetic-canary.test.ts @@ -84,9 +84,13 @@ describeIfSelected('hermetic isolation canaries', ['hermetic-canary', 'hermetic- try { const result = await runSkillTest({ + // ${VAR:-} expansion, not bare $VAR: when scrubbing WORKS the planted + // vars are unset, and under a nounset shell (set -u in the operator's + // shell snapshot) a bare expansion of an unset var errors the whole + // command — making the canary fail exactly when isolation succeeds. prompt: 'Run exactly this bash command and then stop: ' + - 'echo "CFG=$CLAUDE_CONFIG_DIR"; echo "GH=$GSTACK_HOME"; ' + - 'echo "CW=$CONDUCTOR_WORKSPACE_PATH"; echo "GP=$GBRAIN_POISON_PROBE"', + 'echo "CFG=${CLAUDE_CONFIG_DIR:-}"; echo "GH=${GSTACK_HOME:-}"; ' + + 'echo "CW=${CONDUCTOR_WORKSPACE_PATH:-}"; echo "GP=${GBRAIN_POISON_PROBE:-}"', workingDirectory: workDir, maxTurns: 3, allowedTools: ['Bash'],