data-query-agent/tests/test_security.py

from dataclasses import replace

from data_query_agent.codex_runtime import CodexRuntime
from data_query_agent.config import Settings


def test_codex_child_environment_excludes_data_credentials(tmp_path) -> None:
    settings = replace(Settings.load(), runtime_dir=tmp_path)
    env = CodexRuntime(settings)._child_env()
    assert "ODPS_ACCESS_ID" not in env
    assert "ODPS_ACCESS_KEY" not in env
    assert "FEISHU_APP_SECRET" not in env
    assert ("OPENROUTER_API_KEY" in env) != ("OPENAI_API_KEY" in env)