From 968bd794d16f53192484a381477aa7c091ed9648 Mon Sep 17 00:00:00 2001 From: ogt Date: Tue, 14 Jul 2026 09:11:14 +0800 Subject: [PATCH] fix(agent): give ansible a blocking stdin boundary --- apps/api/src/services/awooop_ansible_check_mode_service.py | 1 + apps/api/tests/test_awooop_truth_chain_service.py | 1 + 2 files changed, 2 insertions(+) diff --git a/apps/api/src/services/awooop_ansible_check_mode_service.py b/apps/api/src/services/awooop_ansible_check_mode_service.py index 1fc48aa52..52ac2e8de 100644 --- a/apps/api/src/services/awooop_ansible_check_mode_service.py +++ b/apps/api/src/services/awooop_ansible_check_mode_service.py @@ -623,6 +623,7 @@ async def _run_ansible_command(spec: AnsibleCommandSpec, *, timeout_seconds: int *spec.command, cwd=str(spec.cwd), env=spec.env, + stdin=asyncio.subprocess.DEVNULL, stdout=asyncio.subprocess.PIPE, stderr=asyncio.subprocess.PIPE, ) diff --git a/apps/api/tests/test_awooop_truth_chain_service.py b/apps/api/tests/test_awooop_truth_chain_service.py index 314cd0824..5b7c1b149 100644 --- a/apps/api/tests/test_awooop_truth_chain_service.py +++ b/apps/api/tests/test_awooop_truth_chain_service.py @@ -2660,6 +2660,7 @@ async def test_controlled_apply_duplicate_never_runs_subprocess( def test_ansible_subprocess_is_terminated_when_worker_task_is_cancelled() -> None: source = inspect.getsource(_run_ansible_command) + assert "stdin=asyncio.subprocess.DEVNULL" in source assert "except asyncio.CancelledError" in source assert "process.kill()" in source assert "await process.communicate()" in source