← back to Cli Printing Press
fix(cli): propagate PRINTING_PRESS_VERIFY=1 to browser-session-proof probe (#1458)
dbfc61186d17012579de116545ad884dc5fa5142 · 2026-05-15 10:29:20 -0700 · Trevin Chow
* fix(cli): propagate PRINTING_PRESS_VERIFY=1 to browser-session-proof probe
runBrowserSessionProofTest spawned doctor --json with subprocessEnv()
alone, leaving PRINTING_PRESS_VERIFY unset. cliutil.IsVerifyEnv() then
read false, doctor's synthetic browser-session-proof short-circuit
didn't fire, and every cookie/composed-auth CLI scored 0 on the probe.
Polish skill correctly flagged this as environmental but shipcheck
still returned a misleading FAIL verdict.
Append PRINTING_PRESS_VERIFY=1 to the probe's env so the synthetic
proof path runs without requiring the operator to export the var.
Closes #1389
* test(cli): fully unset PRINTING_PRESS_VERIFY before propagation test
Greptile noted that t.Setenv(key, "") sets the variable to an empty
string rather than removing it. On platforms where Go's exec syscall
takes the first env occurrence (some Linux configurations), the empty
PRINTING_PRESS_VERIFY= would shadow the probe's later
PRINTING_PRESS_VERIFY=1, making the test silently vacuous.
Switch to os.Unsetenv with a cleanup that restores the prior value so
the env entry is genuinely absent for the duration of the test.
Refs #1389
Files touched
M internal/pipeline/runtime.goM internal/pipeline/runtime_test.go
Diff
commit dbfc61186d17012579de116545ad884dc5fa5142
Author: Trevin Chow <trevin@trevinchow.com>
Date: Fri May 15 10:29:20 2026 -0700
fix(cli): propagate PRINTING_PRESS_VERIFY=1 to browser-session-proof probe (#1458)
* fix(cli): propagate PRINTING_PRESS_VERIFY=1 to browser-session-proof probe
runBrowserSessionProofTest spawned doctor --json with subprocessEnv()
alone, leaving PRINTING_PRESS_VERIFY unset. cliutil.IsVerifyEnv() then
read false, doctor's synthetic browser-session-proof short-circuit
didn't fire, and every cookie/composed-auth CLI scored 0 on the probe.
Polish skill correctly flagged this as environmental but shipcheck
still returned a misleading FAIL verdict.
Append PRINTING_PRESS_VERIFY=1 to the probe's env so the synthetic
proof path runs without requiring the operator to export the var.
Closes #1389
* test(cli): fully unset PRINTING_PRESS_VERIFY before propagation test
Greptile noted that t.Setenv(key, "") sets the variable to an empty
string rather than removing it. On platforms where Go's exec syscall
takes the first env occurrence (some Linux configurations), the empty
PRINTING_PRESS_VERIFY= would shadow the probe's later
PRINTING_PRESS_VERIFY=1, making the test silently vacuous.
Switch to os.Unsetenv with a cleanup that restores the prior value so
the env entry is genuinely absent for the duration of the test.
Refs #1389
---
internal/pipeline/runtime.go | 10 +++++-
internal/pipeline/runtime_test.go | 65 +++++++++++++++++++++++++++++++++++++++
2 files changed, 74 insertions(+), 1 deletion(-)
diff --git a/internal/pipeline/runtime.go b/internal/pipeline/runtime.go
index 9dcff7f6..44be836d 100644
--- a/internal/pipeline/runtime.go
+++ b/internal/pipeline/runtime.go
@@ -540,7 +540,15 @@ func runBrowserSessionProofTest(binary string, auth apispec.AuthConfig) CommandR
return result
}
- output, err := runCLIWithOutput(binary, []string{"doctor", "--json"}, subprocessEnv(), 20*time.Second)
+ // cliutil.IsVerifyEnv() drives doctor's synthetic browser-session
+ // proof short-circuit. Without PRINTING_PRESS_VERIFY=1 the probe
+ // asks the CLI to validate against a real session, which a clean
+ // shipcheck environment doesn't have — every cookie-auth CLI then
+ // scores 0 even when the synthetic proof would have passed. Match
+ // the env-augmentation buildEnv() uses for the other mock-mode
+ // probes so this probe is self-contained.
+ env := append(subprocessEnv(), "PRINTING_PRESS_VERIFY=1")
+ output, err := runCLIWithOutput(binary, []string{"doctor", "--json"}, env, 20*time.Second)
if err != nil {
result.Error = fmt.Sprintf("doctor --json failed: %v", err)
result.Score = 0
diff --git a/internal/pipeline/runtime_test.go b/internal/pipeline/runtime_test.go
index f4c13bbc..a543aad9 100644
--- a/internal/pipeline/runtime_test.go
+++ b/internal/pipeline/runtime_test.go
@@ -128,6 +128,36 @@ func TestRunBrowserSessionProofTestPassesValidDoctorProof(t *testing.T) {
assert.Empty(t, result.Error)
}
+// TestRunBrowserSessionProofTestPropagatesVerifyEnv guards the fix for
+// shipcheck FAIL-ing on cookie-auth CLIs: doctor must see
+// PRINTING_PRESS_VERIFY=1 so its synthetic browser-session proof
+// short-circuit fires. The stub binary returns a valid proof only when
+// the env var is set; without the probe's env augmentation it would
+// score 0.
+func TestRunBrowserSessionProofTestPropagatesVerifyEnv(t *testing.T) {
+ binary := buildVerifyEnvDoctorBinary(t)
+ // Fully unset PRINTING_PRESS_VERIFY for the duration of the test
+ // rather than t.Setenv(key, ""), which would leave PRINTING_PRESS_VERIFY=
+ // in os.Environ() and let it shadow the probe's later "=1" entry on
+ // platforms where the first env occurrence wins.
+ prev, had := os.LookupEnv("PRINTING_PRESS_VERIFY")
+ require.NoError(t, os.Unsetenv("PRINTING_PRESS_VERIFY"))
+ t.Cleanup(func() {
+ if had {
+ _ = os.Setenv("PRINTING_PRESS_VERIFY", prev)
+ }
+ })
+
+ result := runBrowserSessionProofTest(binary, apispec.AuthConfig{
+ RequiresBrowserSession: true,
+ BrowserSessionValidationPath: "/api/items",
+ })
+
+ assert.Equal(t, 3, result.Score)
+ assert.True(t, result.Execute)
+ assert.Empty(t, result.Error)
+}
+
func TestRunCommandTestsExecutesMockReadCommands(t *testing.T) {
binary := buildCommandProbeBinary(t)
cmd := discoveredCommand{Name: "items", Kind: "read"}
@@ -138,6 +168,41 @@ func TestRunCommandTestsExecutesMockReadCommands(t *testing.T) {
assert.False(t, result.Execute)
}
+// buildVerifyEnvDoctorBinary builds a stub printed-CLI binary whose
+// `doctor --json` returns a valid browser-session proof only when its
+// process sees PRINTING_PRESS_VERIFY=1; otherwise it reports the proof
+// as missing. Used to verify env propagation from the verify probe.
+func buildVerifyEnvDoctorBinary(t *testing.T) string {
+ t.Helper()
+
+ dir := t.TempDir()
+ mainFile := filepath.Join(dir, "main.go")
+ writeTestFile(t, mainFile, `package main
+
+import (
+ "fmt"
+ "os"
+)
+
+func main() {
+ if len(os.Args) >= 3 && os.Args[1] == "doctor" && os.Args[2] == "--json" {
+ if os.Getenv("PRINTING_PRESS_VERIFY") == "1" {
+ fmt.Println(`+"`"+`{"browser_session_proof":"valid","browser_session_proof_detail":"synthetic"}`+"`"+`)
+ return
+ }
+ fmt.Println(`+"`"+`{"browser_session_proof":"missing","browser_session_proof_detail":"PRINTING_PRESS_VERIFY not set"}`+"`"+`)
+ return
+ }
+ os.Exit(1)
+}
+`)
+ binaryPath := filepath.Join(dir, "test-cli")
+ buildCmd := exec.Command("go", "build", "-o", binaryPath, mainFile)
+ out, err := buildCmd.CombinedOutput()
+ require.NoError(t, err, "building test binary: %s", string(out))
+ return binaryPath
+}
+
func buildDoctorJSONBinary(t *testing.T, payload string) string {
t.Helper()
← e36050fb fix(cli): substitute server-URL variables from env vars at r
·
back to Cli Printing Press
·
fix(cli): force sync concurrency=1 under PRINTING_PRESS_VERI b8b1b6a4 →