From d71c2ace89dc176bb0fcfca4bc62cdc08b799280 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Roland=20Hu=C3=9F?= <rhuss@redhat.com>
Date: Tue, 28 Jul 2026 17:59:55 +0200
Subject: [PATCH] fix(cli): isolate subprocess tests from host OPENSHELL_ env
 vars
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The subprocess-based integration tests inherit the full parent
environment. If the developer has OPENSHELL_GATEWAY_INSECURE=true
set in their shell, it leaks into the spawned CLI process and causes
it to connect with .with_no_client_auth(), skipping the mTLS client
certificate. The test server requires mTLS, so it responds with
CertificateRequired and the test fails.

Strip OPENSHELL_GATEWAY_INSECURE, OPENSHELL_GATEWAY,
OPENSHELL_GATEWAY_ENDPOINT, and OPENSHELL_WORKSPACE from the
subprocess environment. The test already sets --gateway and
--gateway-endpoint explicitly via CLI args, so these env vars
should not influence the subprocess behavior.

Reported-by: Seth Jennings

Signed-off-by: Roland Huß <rhuss@redhat.com>
---
 .../sandbox_create_lifecycle_integration.rs   | 43 ++++++++++---------
 1 file changed, 23 insertions(+), 20 deletions(-)

diff --git a/crates/openshell-cli/tests/sandbox_create_lifecycle_integration.rs b/crates/openshell-cli/tests/sandbox_create_lifecycle_integration.rs
index 7ed148304..9bac31da4 100644
--- a/crates/openshell-cli/tests/sandbox_create_lifecycle_integration.rs
+++ b/crates/openshell-cli/tests/sandbox_create_lifecycle_integration.rs
@@ -1921,26 +1921,29 @@ async fn run_cli_sandbox_create(
         fs::copy(server.dir.path().join(filename), tls_dir.join(filename)).unwrap();
     }
 
-    tokio::process::Command::new(env!("CARGO_BIN_EXE_openshell"))
-        .args([
-            "--gateway",
-            "openshell",
-            "--gateway-endpoint",
-            &server.endpoint,
-            "sandbox",
-            "create",
-            "--name",
-            name,
-            "--no-tty",
-            "--no-auto-providers",
-        ])
-        .args(extra_args)
-        .env("XDG_CONFIG_HOME", xdg_dir.path())
-        .env("HOME", xdg_dir.path())
-        .env("OPENSHELL_PROVISION_TIMEOUT", "5")
-        .output()
-        .await
-        .unwrap()
+    let mut cmd = tokio::process::Command::new(env!("CARGO_BIN_EXE_openshell"));
+    for (key, _) in std::env::vars().filter(|(k, _)| k.starts_with("OPENSHELL_")) {
+        cmd.env_remove(&key);
+    }
+    cmd.args([
+        "--gateway",
+        "openshell",
+        "--gateway-endpoint",
+        &server.endpoint,
+        "sandbox",
+        "create",
+        "--name",
+        name,
+        "--no-tty",
+        "--no-auto-providers",
+    ])
+    .args(extra_args)
+    .env("XDG_CONFIG_HOME", xdg_dir.path())
+    .env("HOME", xdg_dir.path())
+    .env("OPENSHELL_PROVISION_TIMEOUT", "5")
+    .output()
+    .await
+    .unwrap()
 }
 
 #[tokio::test]