Isolate database credentials for agent tests

tests/test_agent.py

@@ -12,4 +12,27 @@ def test_aider_command_cannot_mutate_git_configuration_or_send_analytics() -> No
     assert "--no-analytics" in command
     assert "--no-auto-commits" in command
     assert command.count("/dev/null") == 2
-    assert command[-4:] == ["--edit-format", "diff", "--timeout", "60"]
+    assert command[-4:] == ["--edit-format", "diff", "--timeout", "60"]
+
+
+def test_aider_environment_does_not_include_database_credentials(tmp_path, monkeypatch) -> None:
+    config = settings(workspace_root=tmp_path)
+    workspace = tmp_path / "repo"
+    (workspace / ".git").mkdir(parents=True)
+    monkeypatch.setenv("TEST_DB_PASSWORD", "must-not-reach-aider")
+    captured = {}
+
+    def run(command, **kwargs):
+        captured.update(kwargs["env"])
+        return type("Result", (), {"returncode": 0, "stdout": "ok", "stderr": ""})()
+
+    monkeypatch.setattr("lai_automation.agent.subprocess.run", run)
+    monkeypatch.setattr("lai_automation.agent.os.chown", lambda *args, **kwargs: None)
+    monkeypatch.setattr("lai_automation.agent.pwd.getpwnam", lambda _: type(
+        "Account", (), {"pw_dir": str(tmp_path), "pw_uid": 10001, "pw_gid": 10001}
+    )())
+
+    AiderAgent(config).run(workspace, "fix it")
+
+    assert "TEST_DB_PASSWORD" not in captured
+    assert "DB_PASSWORD" not in captured

tests/test_config.py

@@ -25,6 +25,13 @@ def settings(**overrides) -> Settings:
         "agent_command": "aider",
         "agent_model": "mistral/test",
         "test_commands": ("php artisan test",),
+        "test_database_host": "test-db",
+        "test_database_port": 3306,
+        "test_database_name": "lai_agent_test",
+        "test_database_user": "test_runner",
+        "test_database_password": "test-secret",
+        "test_customer_database": "customer_agent_test",
+        "test_config_database": "cockpit_agent_test",
         "poll_seconds": 60,
         "max_changed_files": 12,
         "max_changed_lines": 800,

tests/test_worker.py

@@ -35,3 +35,20 @@ def test_stop_signal_interrupts_worker_wait() -> None:
     worker._stop(15, None)
 
     assert worker.stop_event.is_set()
+
+
+def test_database_credentials_are_only_passed_to_test_process() -> None:
+    worker = AutomationWorker(settings())
+    workspace = Mock()
+    workspace.run.return_value = Mock(returncode=0, stdout="ok", stderr="")
+
+    results = worker._run_tests(workspace)
+
+    assert results[0]["returncode"] == 0
+    environment = workspace.run.call_args.kwargs["extra_environment"]
+    assert environment["AGENT_TEST_DB_ENABLED"] == "true"
+    assert environment["TEST_DB_USER"] == "test_runner"
+    assert environment["TEST_DB_PASSWORD"] == "test-secret"
+    assert environment["DB_DATABASE"] == "lai_agent_test"
+    assert environment["ERP_DATABASE"] == "customer_agent_test"
+    assert environment["COCKPIT_CONFIG_DATABASE"] == "cockpit_agent_test"