modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 3

chore(scripts): accept a dynamic SetEnvironmentVariable argument as an override (#2146)

Browse source 
Copilot, ninth review: the .NET arm required a QUOTED second argument, so
`SetEnvironmentVariable("SMOKE_BROWSER", $engine)` — or a ${{ }} expression
there — set the environment with the guard silent. An engine the guard cannot
read is forbidden for the same reason `smoke:web:engine` is, so the arm now
accepts an unquoted value too. Bare values stop at `,` or `)`, so a third
argument ("Process") is not swallowed — pinned by an allowed three-argument
case beside the dynamic one.

Signed-off-by: Cliff Hall <cliff@futurescale.com>
Signed-off-by: cliffhall <cliff@futurescale.com>
This commit is contained in:
cliffhall 2026-08-27 02:18:01 -04:00
commit bc7abaea63
2 changed files with 23 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

7
scripts/lib/workflow-gate.mjs
View file

@ -185,9 +185,14 @@ const BROWSER_ASSIGNMENTS = [
value: 1,
},
// .NET, reachable from PowerShell: SetEnvironmentVariable("NAME", "value").
// The value arm accepts an UNQUOTED second argument as well — `$engine`, or a
// `${{ }}` expression — because that spelling sets the environment just the
// same, and an engine the guard cannot read is forbidden for the reason
// `smoke:web:engine` is (Copilot). Bare values stop at `,` or `)` so a third
// argument (`"Process"`) is not swallowed.
{
re: new RegExp(
String.raw`SetEnvironmentVariable\s*\(\s*["']${BROWSER_ENV_VAR}["']\s*,\s*["']([^"']*)["']`,
String.raw`SetEnvironmentVariable\s*\(\s*["']${BROWSER_ENV_VAR}["']\s*,\s*("[^"]*"|'[^']*'|[^,)]*)`,
"gi",
),
value: 1,

17
scripts/lib/workflow-gate.test.mjs
View file

@ -230,6 +230,23 @@ describe("findWorkflowViolations", () => {
),
rules: [VIOLATION.BROWSER_ENV],
},
{
// Copilot, ninth review: an unquoted second argument sets the environment
// just the same, and an engine the guard cannot read is forbidden for the
// reason `smoke:web:engine` is.
name: "flags a SetEnvironmentVariable call with a dynamic value",
text: workflow(
' - run: |\n [Environment]::SetEnvironmentVariable("SMOKE_BROWSER", $engine)\n npm run smoke',
),
rules: [VIOLATION.BROWSER_ENV],
},
{
name: "allows a SetEnvironmentVariable call pinning chromium",
text: workflow(
' - run: |\n [Environment]::SetEnvironmentVariable("SMOKE_BROWSER", "chromium", "Process")\n npm run smoke',
),
rules: [],
},
{
name: "flags a .NET SetEnvironmentVariable call",
text: workflow(