Skip to content

fix(session-tools-core): strip host python/uv cache vars from non-python runtime env - #1012

Open
agisota wants to merge 2 commits into
craft-ai-agents:mainfrom
agisota:fix/sandbox-env-strip
Open

fix(session-tools-core): strip host python/uv cache vars from non-python runtime env#1012
agisota wants to merge 2 commits into
craft-ai-agents:mainfrom
agisota:fix/sandbox-env-strip

Conversation

@agisota

@agisota agisota commented Aug 7, 2026

Copy link
Copy Markdown

createScriptRuntimeEnv spreads process.env and только перенаправлял UV_CACHE_DIR/XDG_CACHE_HOME/PYTHONPYCACHEPREFIX для python3. На хостах, где эти переменные экспорчены глобально, они утекали в env для non-python рантаймов (node и прочие) — именно такую стабильную нефлаки-поломку и показал тест does not add python-specific cache vars for node runtime.

Фикс: для non-python языков три python-кэш-переменные удаляются из env. wrapper заявляет про hermetic/deterministic subprocess env — его единственные вызовы (script-sandbox, transform-data) являются обёртками изоляции и контракт синхронизирован.

Верификация

  • packages/session-tools-core полный пакет bun test — 89 тестов, 0 fail.
  • Файл без правок === upstream файл (подтверждено git show upstream/main:... vs pre-fix).

agisota added 2 commits August 7, 2026 13:06
…: silence stale koffi warning; fix(shared): Windows-style path semantics by path style in isPathWithinDirectory

- oauth-callback-url.test.ts leaked a 404-everywhere fetch stub into
  every test file running after it in the shared bun:test process
  (top-level assignment, no restore) — wrap in beforeAll/afterAll.
- oauth-relay.test.ts replaced fetch in beforeEach without restore —
  capture original and restore in afterAll.
- build/common.ts: koffi is optional for current Pi SDK (>= 0.80.x
  vendors its own Windows VT helper); log instead of warn when absent.
- mode-manager: v0.7.0 symlink hardening resolved Windows-style paths
  (C:\..., UNC) with POSIX resolve() on POSIX hosts, folding backslashes
  into one literal component; the nearest-existing-ancestor realpath
  walk then escaped to cwd and every check returned false. Detect
  drive-letter/UNC paths and give them Windows semantics on any host;
  keep realpath hardening for native paths only.
…hon runtime env

createScriptRuntimeEnv spreads process.env and only redirected
UV_CACHE_DIR/XDG_CACHE_HOME/PYTHONPYCACHEPREFIX for python3, so a host
exporting UV_CACHE_DIR leaked it into node/python runtime envs. Hermetic
env is the stated purpose of the wrapper; strip the three vars for
non-python languages.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant