tju-yxq opened a new pull request, #2207: URL: https://github.com/apache/rocketmq-dashboard/pull/2207
Closes #2206 ## What changed CLI-backed AI providers no longer inherit the complete RocketMQ Studio process environment. - Added `CliProcessEnvironment`, a shared policy that builds a fresh child environment from an immutable runtime allowlist. - Preserved the variables needed for executable lookup, user-scoped Claude/Qoder state, temporary files, locale selection, proxy routing, and custom CA bundles. - Applied provider-specific variables such as `ANTHROPIC_AUTH_TOKEN` and `ANTHROPIC_BASE_URL` after isolation so the selected request configuration wins over an allowed parent value. - Applied the policy to all current subprocess boundaries: the CLI availability probe, non-streaming completion, and Claude streaming. - Added `RMQ_LLM_CLI_ALLOWED_ENVIRONMENT` for deployments that need to opt in additional variable names. The setting accepts a comma-separated list and is wired through the Docker Compose environment example. Variables unrelated to running the selected CLI, including datasource/auth passwords, arbitrary cloud keys, `NODE_OPTIONS`, and other container configuration, are not copied by default. Environment values are never logged. ## Compatibility The default allowlist retains `HOME`/`USERPROFILE` and XDG directories for user-scoped CLI login state, `PATH` for executable lookup, common temporary-directory and locale variables, and standard proxy/CA variables for outbound provider access. Operators with a non-standard CLI installation can add names explicitly without restoring inheritance of the entire server environment. This PR does not change CLI commands, response parsing, timeouts, or output-size limits. PR #2042 also edits `ClaudeCodeAgentProvider`; the functional overlap here is limited to the line that prepares the streaming subprocess environment. ## Verification Run from `server` on commit `39248f2c`: ```text mvn -DskipTests=false "-Dtest=CliProcessEnvironmentTest,CliAgentProviderTest,ClaudeCodeAgentProviderTest" test Tests run: 13, Failures: 0, Errors: 0, Skipped: 0 BUILD SUCCESS mvn -DskipTests=false test Tests run: 1205, Failures: 0, Errors: 0, Skipped: 0 BUILD SUCCESS ``` Additional checks: ```text Checkstyle violations: 0 git diff --check: passed docker compose -f deploy/docker-compose.yml config --quiet: passed ``` The focused tests cover default filtering, configurable names, provider overrides, invalid names, Spring binding of the comma-separated setting, and integration with availability/completion/streaming launch paths. No live Claude, Qoder, provider account, or deployed container was used. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
