Module runner 

The process runner — the seam that actually launches the child (or mocks it).

The runner is a trait so the Wrapper’s orchestration (resolve → policy → confirm → allowlist → inject) is tested deterministically with MockRunner, while production uses SystemRunner. The injected values are SecretValues exposed only at the moment of spawning and placed into the child’s environment — never written to disk (I7).

Structs

Command

A fully-resolved command ready to launch: the program, its arguments, and the environment to inject into the child.

MockRunner

A test runner that records each invocation and returns a configured Output without launching anything.

Output

The captured result of a finished child process.

RecordedRun

A single recorded invocation, for test assertions. The exposed env values are captured only because this is a test double; production never copies a value out like this.

SystemRunner

The real runner: launches via std::process::Command, injecting the resolved environment into the child. Inherits the parent environment and overrides it with the injected variables. Nothing is written to disk (I7).

Traits

ProcessRunner

Launches a Command. The Wrapper depends on this trait, not on std::process, so its logic is testable with MockRunner.