@pulsehub/runner 0.1.7 → 0.1.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pulsehub/runner",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "Local, credential-safe Pulse Runner",
   "repository": {
     "type": "git",

package/src/process.js

@@ -57,7 +57,7 @@ export async function executable(name) { try { return (await command(resolveExec
 
 export function agentPermissionArgs(kind, mode) {
   if (mode === 'review') {
-    if (kind === 'codex') return ['--sandbox', 'read-only', '--ask-for-approval', 'never'];
+    if (kind === 'codex') return ['--sandbox', 'read-only'];
     if (kind === 'claude') return ['--permission-mode', 'plan'];
   }
   if (kind === 'codex') return ['--approve-for-me'];

package/src/qa-source.py

@@ -13,7 +13,7 @@ import zipfile
 def call(body):
     request = urllib.request.Request(os.environ['PULSE_QA_SOURCE_URL'],
         data=json.dumps(body).encode(), headers={
-            'Authorization': 'Bearer ' + os.environ['PULSE_QA_CREDENTIAL'],
+            'X-Pulse-QA-Credential': os.environ['PULSE_QA_CREDENTIAL'],
             'Content-Type': 'application/json'})
     try:
         with urllib.request.urlopen(request, timeout=540) as response:

package/test/process.test.js

@@ -3,7 +3,7 @@ import assert from 'node:assert/strict';
 import { agentPermissionArgs, mcpEndpoint } from '../src/process.js';
 
 test('QA Runner sessions use read-only filesystem permissions', () => {
-  assert.deepEqual(agentPermissionArgs('codex', 'review'), ['--sandbox', 'read-only', '--ask-for-approval', 'never']);
+  assert.deepEqual(agentPermissionArgs('codex', 'review'), ['--sandbox', 'read-only']);
   assert.deepEqual(agentPermissionArgs('claude', 'review'), ['--permission-mode', 'plan']);
 });
 

package/test/qa-source.test.js

@@ -34,6 +34,31 @@ with tempfile.TemporaryDirectory() as root:
   assert.equal(result.code, 0, result.output);
 });
 
+test('Runner sends its QA application credential outside the Authorization header', async () => {
+  const script = `
+import importlib.util,os
+from pathlib import Path
+spec=importlib.util.spec_from_file_location('qa_source',os.environ['QA_SCRIPT'])
+m=importlib.util.module_from_spec(spec);spec.loader.exec_module(m)
+seen=[]
+class Response:
+    def __enter__(self): return self
+    def __exit__(self,*args): pass
+    def read(self,size): return b'{}'
+def fake(request,timeout):
+    seen.append({k.lower():v for k,v in request.header_items()})
+    return Response()
+m.urllib.request.urlopen=fake
+os.environ['PULSE_QA_SOURCE_URL']='https://example.invalid/pulseQaSource'
+os.environ['PULSE_QA_CREDENTIAL']='fixture-only'
+m.call({'identifier':'TES-fixture'})
+assert seen[0]['x-pulse-qa-credential']=='fixture-only'
+assert 'authorization' not in seen[0]
+`;
+  const result = await command('python3', ['-c', script], { env: { ...process.env, PYTHONDONTWRITEBYTECODE: '1', QA_SCRIPT: fileURLToPath(new URL('../src/qa-source.py', import.meta.url)) } });
+  assert.equal(result.code, 0, result.output);
+});
+
 test('both local QA identities use provider readiness independently of global Git credentials', () => {
   for (const kind of ['codex','claude']) {
     const config = { identities: [{ agentId: kind, kind, role: 'qa' }] };