acpmux tests: web_image_attachments runs hermetic, with node as its one host tool (base red)

Merged
LA
6d ago
+37-3

Summary

Base red (priority zero). On feat-cmux-next, acpmux hermetic_daemon_guard::every_test_binary_runs_in_the_hermetic_environment (tests/hermetic_daemon_guard.rs:116) fails: tests/web_image_attachments.rs does not include tests/support/daemon_env.rs and defines no HERMETIC (seen in job 78f9e8ec).

Cause: #26985 (5b7b36c6435) added web_image_attachments.rs without the hermetic include.

Fix:

  • web_image_attachments.rs includes support/daemon_env.rs and runs as Process::deny(): it runs only Node on a static page, no daemon and no agent.
  • The hermetic PATH has no node, so daemon_env gets Process::tools(&[...]): a process names the host tools it runs itself. enter() finds each one on the host's PATH before the hermetic re-start (as it already does for python3) and passes its path in ACPMUX_TEST_TOOL_<name>. tool_dir links it. The host's PATH itself is never kept.
  • The test runs node from tool_dir(&["node"]) (on Windows, which has no hermetic re-start, the host's node as before).

FYI @teamleaderleo: this is your #26985 test file.

Testing

scripts/ci/cmux-tui-rust-check.sh test <filter> on the fleet, at head d3dfb03dfee1 (e6419573ac6 plus a plain merge of feat cbc97bf79d74):

  • Red at the feat tip cbc97bf79d74, filter hermetic: every_test_binary_runs_in_the_hermetic_environment fails and names tests/web_image_attachments.rs. Step ad8dfa390323e912e8bc7943.
  • Green at head d3dfb03dfee1, filter hermetic: 2/2 passed. Step 275899fd216fd802b92ac68d.
  • Green at head d3dfb03dfee1, filter web_image_attachments (the Node test under the hermetic environment): 1/1 passed. Step 9d88cdf5a03a0870633b7b33.
  • Before the merge, at e6419573ac6: red at feat 5be39f0ce753 cfd117db5683c75a7c57777a, green cf6025ae67222a2dfa854b40, web_image_attachments a2c9788b46ce47b702fabbb6, clippy 576c3d1df2ab3048e8702ccf.

Second plain merge of feat 7c08b2980032 at head d398a939821 (patch-id unchanged): hermetic guard green, step fe6ac9c09448f091233cf3f6.

Red checks at d398a939821 are classified in https://github.com/manaflow-ai/cmux/pull/28150#issuecomment-6527735572 (base findings and a wrapper; all red at the feat tip 7c08b2980032 too). The earlier classification at d3dfb03dfee1: https://github.com/manaflow-ai/cmux/pull/28150#issuecomment-6527084830 (one unexplained red that passed 1 rerun, recorded in followups.md).

Observed / Not run

  • Observed: the three fleet step logs above (nextest PASS/FAIL lines); prepush-gate.py passes at d3dfb03dfee1; the CI check logs named in the classification comment.
  • Not run: no local build on this VM (fleet only). cmux-next daemon tests (same-tree) for d398a939821 is pending.

Changelog

none

View with [code]smith Autofix with [code]smith
Need help on this PR? Tag @codesmith-bot with what you need.

Summary by cubic

Fixes the hermetic test guard failure on feat-cmux-next by making web_image_attachments run in the hermetic environment, using Node as its single host tool.

  • The test now includes support/daemon_env.rs and runs as Process::deny(), since it starts no daemon or agent; it only runs Node on a static page.
  • daemon_env gains Process::tools, letting a process name the host tools it runs itself; enter() resolves each on the host PATH before the hermetic restart and passes its path via ACPMUX_TEST_TOOL_<name>, without ever keeping the host PATH.
  • On Unix the test runs node from tool_dir(&["node"]); on Windows, which has no hermetic restart, it uses the host node as before.