openc3 7.3.0 → 7.4.1

data/lib/openc3/utilities/python_venv.rb

@@ -0,0 +1,135 @@
+# encoding: ascii-8bit
+
+# Copyright 2026 OpenC3, Inc.
+# All Rights Reserved.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+# See LICENSE.md for more details.
+#
+# This file may also be used under the terms of a commercial license
+# if purchased from OpenC3, Inc.
+
+require 'open3'
+require 'openc3/models/target_model'
+require 'openc3/utilities/target_file'
+
+module OpenC3
+  module PythonVenv
+    PLUGIN_VENVS_DIR = '/gems/plugin_venvs'
+
+    # Shared user site-packages directory used by plugins that predate the
+    # per-plugin UV venvs. Every caller that falls back off a plugin venv points
+    # PYTHONUSERBASE here, so keep it in one place rather than repeating the
+    # literal in script.rb, running_script.rb, microservice_operator.rb and
+    # microservice_model.rb.
+    DEFAULT_PYTHONUSERBASE = '/gems/python_packages'
+
+    # Packages a plugin venv must never supply itself. The scripts and
+    # microservices that use a plugin venv still run the base venv's Python
+    # binary, and CPython searches every PYTHONPATH entry ahead of the running
+    # venv's own site-packages. A plugin that declares openc3 as a dependency
+    # would therefore shadow the system library with its own copy, silently
+    # swapping the API client the script talks to COSMOS with. Reordering
+    # PYTHONPATH cannot fix this - the whole variable outranks the base venv -
+    # so the copy is removed at install time instead.
+    RESERVED_PACKAGES = ['openc3'].freeze
+
+    # Resolve a script's plugin venv and expose its packages to a child process.
+    # Returns the venv path when configured, or nil when the system environment
+    # should be used.
+    def self.configure_for_script(environment, name:, scope:, python_venv: nil)
+      venv_dir = resolve_script_venv(name: name, scope: scope, python_venv: python_venv)
+      return nil unless venv_dir
+
+      configure_environment(environment, venv_dir)
+      venv_dir
+    end
+
+    def self.configure_environment(environment, venv_dir)
+      environment['VIRTUAL_ENV'] = venv_dir
+      environment['PATH'] = "#{venv_dir}/bin:#{ENV.fetch('PATH', '')}"
+      environment['PYTHONUSERBASE'] = venv_dir
+
+      site_packages = Dir.glob("#{venv_dir}/lib/python*/site-packages").first
+      # Prefer a PYTHONPATH the caller already seeded on `environment` over the
+      # ambient one. Script.process_suite sets it to ENV['PYTHONPATH'] || '.'
+      # before calling here, and reading ENV directly would drop that value.
+      existing_pythonpath = environment['PYTHONPATH'] || ENV.fetch('PYTHONPATH', '')
+      if site_packages
+        environment['PYTHONPATH'] = existing_pythonpath.empty? ? site_packages : "#{site_packages}:#{existing_pythonpath}"
+      else
+        environment['PYTHONPATH'] = existing_pythonpath.empty? ? nil : existing_pythonpath
+      end
+
+      environment
+    end
+
+    # Remove any RESERVED_PACKAGES a plugin installed into its own venv.
+    # Returns the names that were removed so callers can report them.
+    def self.purge_reserved_packages(venv_dir)
+      return [] if venv_dir.nil? || venv_dir.empty?
+
+      purged = []
+      RESERVED_PACKAGES.each do |package|
+        next unless package_installed?(venv_dir, package)
+
+        Logger.warn("Plugin venv #{venv_dir} declares '#{package}', which would shadow the " \
+                    "system library. Removing it; the plugin will use the system #{package}.")
+        _output, status = Open3.capture2e('uv', 'pip', 'uninstall', '--python', venv_dir, package)
+        if status.success?
+          purged << package
+        else
+          Logger.error("Failed to remove '#{package}' from plugin venv #{venv_dir}")
+        end
+      end
+      purged
+    rescue => e
+      Logger.error("Could not purge reserved packages from #{venv_dir}: #{e.message}")
+      []
+    end
+
+    def self.package_installed?(venv_dir, package)
+      _output, status = Open3.capture2e('uv', 'pip', 'show', '--python', venv_dir, package)
+      status.success?
+    end
+    private_class_method :package_installed?
+
+    def self.plugin_venv_path(scope:, plugin_name:)
+      sanitized_name = "#{scope}__#{plugin_name}".tr('^a-zA-Z0-9_-', '_')
+      candidate = File.join(PLUGIN_VENVS_DIR, sanitized_name, '.venv')
+      candidate if File.directory?(candidate)
+    end
+
+    def self.resolve_script_venv(name:, scope:, python_venv: nil)
+      target_name = name.split('/')[0].to_s.upcase
+      if target_name == TargetFile::TEMP_FOLDER && python_venv
+        # File.basename strips directory components; the tr() then whitelists the
+        # name down to the character set PluginModel.plugin_venv_name builds it
+        # from. That leaves no path separators and no glob metacharacters, so
+        # the value cannot escape PLUGIN_VENVS_DIR or widen the Dir.glob in
+        # configure_environment.
+        safe_name = File.basename(python_venv.to_s).tr('^a-zA-Z0-9_-', '_')
+        # The venv name is client-supplied, so it must also be confined to the
+        # caller's scope. Venv directories are named "<scope>__<plugin>" by
+        # PluginModel.plugin_venv_name; without this check a user in one scope
+        # could name another scope's venv and run against its packages.
+        return nil unless safe_name.start_with?("#{scope}__".tr('^a-zA-Z0-9_-', '_'))
+
+        candidate = File.join(PLUGIN_VENVS_DIR, safe_name, '.venv')
+        return candidate if File.directory?(candidate)
+      else
+        target_info = TargetModel.get(name: target_name, scope: scope)
+        if target_info && target_info['plugin']
+          return plugin_venv_path(scope: scope, plugin_name: target_info['plugin'])
+        end
+      end
+      nil
+    rescue => e
+      Logger.debug("Could not resolve plugin venv for script '#{name}': #{e.message}")
+      nil
+    end
+    private_class_method :resolve_script_venv
+  end
+end

data/lib/openc3/utilities/questdb_client.rb

@@ -928,6 +928,10 @@ module OpenC3
     # @return [Array, Hash] Array of [value, limits_state] pairs per row, or {} if no results.
     #   Single-row results return a flat array; multi-row results return array of arrays.
     def self.tsdb_lookup(items, start_time:, end_time: nil, scope: "DEFAULT")
+      # Every item is a placeholder for an item which doesn't exist, so there's
+      # nothing to query. Return a single row of nil values, one per item.
+      return Array.new(items.length) { [nil, nil] } if items.all? { |item| item[2].nil? }
+
       # Group items by db_shard number while preserving their original positions
       db_shard_groups = {} # db_shard => { positions: [], items: [] }
       items.each_with_index do |item, pos|
@@ -944,62 +948,36 @@ module OpenC3
         return tsdb_lookup_single_db_shard(group[:items], start_time: start_time, end_time: end_time, scope: scope, db_shard: db_shard)
       end
 
-      # Cross-db_shard: execute per-db_shard queries and merge results
-      db_shard_results = {} # db_shard => data
+      # Cross-db_shard: execute per-db_shard queries (as arrays of rows) and merge results
+      db_shard_rows = {} # db_shard => rows
       db_shard_groups.each do |db_shard, group|
-        result = tsdb_lookup_single_db_shard(group[:items], start_time: start_time, end_time: end_time, scope: scope, db_shard: db_shard)
-        db_shard_results[db_shard] = result
+        result = tsdb_lookup_single_db_shard(group[:items], start_time: start_time, end_time: end_time, scope: scope, db_shard: db_shard, flatten: false)
+        db_shard_rows[db_shard] = result.is_a?(Array) ? result : []
       end
 
-      # If all db_shards returned empty, return empty
-      return {} if db_shard_results.values.all? { |r| r == {} }
-
-      # Merge results positionally back into the original item order.
-      # For single-row results (no end_time), merge flat arrays.
-      # For multi-row results, each db_shard may have different row counts;
-      # use the maximum row count and fill missing positions with [nil, nil].
-      if !end_time
-        # Single-row mode: each db_shard returns a flat array of [value, limits] pairs.
-        # Merge them into the original item order.
-        merged = Array.new(items.length) { [nil, nil] }
-        db_shard_groups.each do |db_shard, group|
-          result = db_shard_results[db_shard]
-          next if result == {} || !result.is_a?(Array)
+      # Merge results positionally back into the original item order. Each db_shard
+      # may have different row counts so use the maximum row count and fill missing
+      # positions with [nil, nil]. If all db_shards returned empty, return empty.
+      max_rows = db_shard_rows.values.map(&:length).max
+      return {} if max_rows == 0
+
+      merged = Array.new(max_rows) { Array.new(items.length) { [nil, nil] } }
+      db_shard_groups.each do |db_shard, group|
+        db_shard_rows[db_shard].each_with_index do |row, row_num|
           group[:positions].each_with_index do |orig_pos, db_shard_idx|
-            merged[orig_pos] = result[db_shard_idx] if result[db_shard_idx]
+            merged[row_num][orig_pos] = row[db_shard_idx] if row[db_shard_idx]
           end
         end
-        merged
-      else
-        # Multi-row mode: find max row count across db_shards
-        max_rows = 0
-        db_shard_groups.each do |db_shard, _group|
-          result = db_shard_results[db_shard]
-          next if result == {}
-          count = result.is_a?(Array) ? result.length : 0
-          max_rows = count if count > max_rows
-        end
-        return {} if max_rows == 0
-
-        merged = Array.new(max_rows) { Array.new(items.length) { [nil, nil] } }
-        db_shard_groups.each do |db_shard, group|
-          result = db_shard_results[db_shard]
-          next if result == {}
-          rows = result.is_a?(Array) ? result : []
-          rows.each_with_index do |row, row_num|
-            next unless row.is_a?(Array)
-            group[:positions].each_with_index do |orig_pos, db_shard_idx|
-              merged[row_num][orig_pos] = row[db_shard_idx] if row[db_shard_idx]
-            end
-          end
-        end
-        merged
       end
+      # Match the single db_shard behavior of returning a flat array for a single row
+      return merged[0] if max_rows == 1
+      merged
     end
 
     # Execute a tsdb_lookup query against a single db_shard.
     # This contains the original ASOF JOIN logic for items all on the same QuestDB instance.
-    def self.tsdb_lookup_single_db_shard(items, start_time:, end_time: nil, scope: "DEFAULT", db_shard: 0)
+    # When flatten is true a single row result is returned as a flat array rather than an array of rows.
+    def self.tsdb_lookup_single_db_shard(items, start_time:, end_time: nil, scope: "DEFAULT", db_shard: 0, flatten: true)
       tables = {}
       names = []
       nil_count = 0
@@ -1060,6 +1038,11 @@ module OpenC3
         end
       end
 
+      # Every item in this db_shard is a placeholder so there's no table to query.
+      # Return no results and let tsdb_lookup fill these positions with [nil, nil]
+      # when it merges the db_shards (an all placeholder lookup returns before this)
+      return {} if tables.empty?
+
       # Add needed timestamp columns to the SELECT for calculated items
       needed_timestamps.each do |table_index, ts_columns|
         ts_columns.each do |ts_col|
@@ -1147,7 +1130,7 @@ module OpenC3
           data[row_num].insert(position, [calculated_value, nil])
         end
       end
-      if result.ntuples == 1
+      if flatten and result.ntuples == 1
         data = data[0]
       end
       data

data/lib/openc3/utilities/rubygems_url.rb

@@ -0,0 +1,39 @@
+# encoding: ascii-8bit
+
+# Copyright 2026 OpenC3, Inc.
+# All Rights Reserved.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+# See LICENSE.md for more details.
+#
+# This file may also be used under the terms of a commercial license
+# if purchased from OpenC3, Inc.
+
+require 'uri'
+require 'openc3/utilities/logger'
+
+module OpenC3
+  class RubygemsUrl
+    DEFAULT = 'https://rubygems.org'
+
+    # Validate that a resolved rubygems_url is an http(s) URL before it is used
+    # as a Gem source. The value can come from a user-writable setting or ENV, so
+    # a malformed or non-http value is rejected and replaced with the default
+    # rather than passed through to RubyGems.
+    #
+    # @param rubygems_url [String] the resolved rubygems source url to validate
+    # @return [String] the original url if valid, otherwise DEFAULT
+    def self.validate(rubygems_url)
+      uri = URI.parse(rubygems_url)
+      unless uri.is_a?(URI::HTTP) && !uri.host.to_s.empty?
+        raise URI::InvalidURIError, "not an http(s) URL"
+      end
+      rubygems_url
+    rescue URI::InvalidURIError => e
+      Logger.error("Invalid rubygems_url '#{rubygems_url}' (#{e.message}); falling back to #{DEFAULT}")
+      DEFAULT
+    end
+  end
+end

data/lib/openc3/utilities/running_script.rb

@@ -28,6 +28,7 @@ require 'openc3/utilities/script'
 require 'openc3/utilities/store'
 require 'openc3/utilities/store_queued'
 require 'openc3/utilities/bucket_require'
+require 'openc3/utilities/python_venv'
 require 'openc3/models/offline_access_model'
 require 'openc3/models/environment_model'
 require 'openc3/models/script_engine_model'
@@ -36,7 +37,7 @@ require 'fileutils'
 
 if not defined? RAILS_ROOT
   if ENV['RAILS_ROOT']
-    RAILS_ROOT = ENV['RAILS_ROOT']
+    RAILS_ROOT = ENV.fetch('RAILS_ROOT')
   elsif defined? Rails
     RAILS_ROOT = Rails.root
   else
@@ -436,7 +437,7 @@ class RunningScript
     extension = File.extname(name).to_s.downcase
     script_engine = nil
     if extension == '.py'
-      process_name = ENV['OPENC3_PYTHON_BIN'] || '/openc3/python/.venv/bin/python'
+      process_name = ENV.fetch('OPENC3_PYTHON_BIN', '/openc3/python/.venv/bin/python')
       runner_path = File.join(RAILS_ROOT, 'scripts', 'run_script.py')
     elsif extension == '.rb'
       process_name = 'ruby'
@@ -449,7 +450,7 @@ class RunningScript
       if script_engine_model
         script_engine = script_engine_model.filename
         if File.extname(script_engine).to_s.downcase == '.py'
-          process_name = ENV['OPENC3_PYTHON_BIN'] || '/openc3/python/.venv/bin/python'
+          process_name = ENV.fetch('OPENC3_PYTHON_BIN', '/openc3/python/.venv/bin/python')
           runner_path = File.join(RAILS_ROOT, 'scripts', 'run_script.py')
         else
           process_name = 'ruby'
@@ -521,17 +522,17 @@ class RunningScript
 
       # Set proper secrets for running script
       process.environment['SECRET_KEY_BASE'] = nil
-      process.environment['OPENC3_REDIS_USERNAME'] = ENV['OPENC3_SR_REDIS_USERNAME']
-      process.environment['OPENC3_REDIS_PASSWORD'] = ENV['OPENC3_SR_REDIS_PASSWORD']
-      process.environment['OPENC3_BUCKET_USERNAME'] = ENV['OPENC3_SR_BUCKET_USERNAME']
-      process.environment['OPENC3_BUCKET_PASSWORD'] = ENV['OPENC3_SR_BUCKET_PASSWORD']
+      process.environment['OPENC3_REDIS_USERNAME'] = ENV.fetch('OPENC3_SR_REDIS_USERNAME', nil)
+      process.environment['OPENC3_REDIS_PASSWORD'] = ENV.fetch('OPENC3_SR_REDIS_PASSWORD', nil)
+      process.environment['OPENC3_BUCKET_USERNAME'] = ENV.fetch('OPENC3_SR_BUCKET_USERNAME', nil)
+      process.environment['OPENC3_BUCKET_PASSWORD'] = ENV.fetch('OPENC3_SR_BUCKET_PASSWORD', nil)
       process.environment['OPENC3_SR_REDIS_USERNAME'] = nil
       process.environment['OPENC3_SR_REDIS_PASSWORD'] = nil
       process.environment['OPENC3_SR_BUCKET_USERNAME'] = nil
       process.environment['OPENC3_SR_BUCKET_PASSWORD'] = nil
-      process.environment['OPENC3_API_CLIENT'] = ENV['OPENC3_API_CLIENT']
+      process.environment['OPENC3_API_CLIENT'] = ENV.fetch('OPENC3_API_CLIENT', nil)
       if model and model.offline_access_token
-        auth = OpenC3::OpenC3KeycloakAuthentication.new(ENV['OPENC3_KEYCLOAK_URL'])
+        auth = OpenC3::OpenC3KeycloakAuthentication.new(ENV.fetch('OPENC3_KEYCLOAK_URL', nil))
         valid_token = auth.get_token_from_refresh_token(model.offline_access_token)
         if valid_token
           process.environment['OPENC3_API_TOKEN'] = model.offline_access_token
@@ -541,58 +542,26 @@ class RunningScript
           raise "offline_access token invalid for script"
         end
       else
-        process.environment['OPENC3_API_USER'] = ENV['OPENC3_API_USER']
+        process.environment['OPENC3_API_USER'] = ENV.fetch('OPENC3_API_USER', nil)
         if ENV['OPENC3_SERVICE_PASSWORD']
-          process.environment['OPENC3_API_PASSWORD'] = ENV['OPENC3_SERVICE_PASSWORD']
+          process.environment['OPENC3_API_PASSWORD'] = ENV.fetch('OPENC3_SERVICE_PASSWORD')
         else
           raise "No authentication available for script"
         end
       end
-      process.environment['GEM_HOME'] = ENV['GEM_HOME']
+      process.environment['GEM_HOME'] = ENV.fetch('GEM_HOME', nil)
 
-      # Resolve the per-plugin Python venv for this script. For saved scripts
-      # we look up which plugin owns the target and check whether that plugin
-      # has an isolated UV venv. For temp scripts the frontend can pass a
-      # python_venv name directly, skipping the target lookup entirely.
-      python_venv_dir = nil
-      begin
-        target_name = name.split('/')[0].to_s.upcase
-        if target_name == '__TEMP__' && python_venv
-          # File.basename prevents path traversal (strips directory components)
-          safe_name = File.basename(python_venv.to_s)
-          candidate = "/gems/plugin_venvs/#{safe_name}/.venv"
-          python_venv_dir = candidate if File.directory?(candidate)
-        else
-          target_info = OpenC3::TargetModel.get(name: target_name, scope: scope)
-          if target_info && target_info['plugin']
-            sanitized_name = "#{scope}__#{target_info['plugin']}".tr('^a-zA-Z0-9_-', '_')
-            candidate = "/gems/plugin_venvs/#{sanitized_name}/.venv"
-            python_venv_dir = candidate if File.directory?(candidate)
-          end
-        end
-      rescue => e
-        OpenC3::Logger.debug("Could not resolve plugin venv for script '#{name}': #{e.message}")
-      end
-
-      if python_venv_dir
-        process.environment['VIRTUAL_ENV'] = python_venv_dir
-        process.environment['PATH'] = "#{python_venv_dir}/bin:#{ENV.fetch('PATH', '')}"
-        process.environment['PYTHONUSERBASE'] = python_venv_dir
-        # Add plugin venv site-packages to PYTHONPATH so the base venv's Python
-        # binary can find plugin-specific packages. PYTHONPATH is always respected
-        # by CPython regardless of venv activation state.
-        site_packages = Dir.glob("#{python_venv_dir}/lib/python*/site-packages").first
-        existing_pythonpath = ENV.fetch('PYTHONPATH', '')
-        if site_packages
-          process.environment['PYTHONPATH'] = existing_pythonpath.empty? ? site_packages : "#{site_packages}:#{existing_pythonpath}"
-        else
-          process.environment['PYTHONPATH'] = existing_pythonpath.empty? ? nil : existing_pythonpath
-        end
-      else
-        system_venv = File.dirname(ENV['OPENC3_PYTHON_BIN'] || '/openc3/python/.venv/bin/python').chomp('/bin')
+      python_venv_dir = OpenC3::PythonVenv.configure_for_script(
+        process.environment, name: name, scope: scope, python_venv: python_venv
+      )
+      unless python_venv_dir
+        system_venv = File.dirname(ENV.fetch('OPENC3_PYTHON_BIN', '/openc3/python/.venv/bin/python')).chomp('/bin')
         process.environment['VIRTUAL_ENV'] = system_venv
-        process.environment['PYTHONUSERBASE'] = ENV['PYTHONUSERBASE']
-        process.environment['PYTHONPATH'] = ENV['PYTHONPATH']
+        process.environment['PYTHONUSERBASE'] = ENV.fetch('PYTHONUSERBASE', OpenC3::PythonVenv::DEFAULT_PYTHONUSERBASE)
+        # Deliberately nil when PYTHONPATH is unset rather than defaulting to
+        # something like '.', which would put the script's own working directory
+        # on the import path and let a local file shadow a real module.
+        process.environment['PYTHONPATH'] = ENV.fetch('PYTHONPATH', nil)
       end
 
       # Spawned process should not be controlled by same Bundler constraints as spawning process
@@ -1556,7 +1525,7 @@ class RunningScript
     $stdout = OpenC3::Stdout.instance
     $stderr = OpenC3::Stderr.instance
     OpenC3::Logger.stdout = true
-    OpenC3::Logger.level = OpenC3::Logger::INFO
+    OpenC3::Logger.level = OpenC3::Logger.default_level
   end
 
   def output_thread

data/lib/openc3/utilities/s3_autoload.rb

@@ -3,9 +3,9 @@ require 'aws-sdk-s3'
 if ENV['OPENC3_CLOUD'] == 'local'
   Aws.config.update(
     s3: {
-      endpoint: ENV['OPENC3_BUCKET_URL'] || (ENV['OPENC3_DEVEL'] ? 'http://127.0.0.1:9000' : 'http://openc3-buckets:9000'),
-      access_key_id: ENV['OPENC3_BUCKET_USERNAME'],
-      secret_access_key: ENV['OPENC3_BUCKET_PASSWORD'],
+      endpoint: ENV.fetch('OPENC3_BUCKET_URL', nil) || (ENV['OPENC3_DEVEL'] ? 'http://127.0.0.1:9000' : 'http://openc3-buckets:9000'),
+      access_key_id: ENV.fetch('OPENC3_BUCKET_USERNAME', nil),
+      secret_access_key: ENV.fetch('OPENC3_BUCKET_PASSWORD', nil),
       force_path_style: true,
       region: 'us-east-1',
       # Disable automatic checksum calculation for S3-compatible backends (versitygw)
@@ -20,9 +20,9 @@ if ENV['OPENC3_CLOUD'] == 'local'
 else # AWS
   Aws.config.update(
     s3: {
-      endpoint: "https://s3.#{ENV['AWS_REGION']}.amazonaws.com",
+      endpoint: "https://s3.#{ENV.fetch('AWS_REGION', nil)}.amazonaws.com",
       force_path_style: true,
-      region: ENV['AWS_REGION']
+      region: ENV.fetch('AWS_REGION', nil)
     }
   )
 end

data/lib/openc3/utilities/script.rb

@@ -17,6 +17,7 @@
 
 require 'tempfile'
 require 'openc3/utilities/target_file'
+require 'openc3/utilities/python_venv'
 require 'openc3/utilities/running_script'
 require 'openc3/script/suite'
 require 'openc3/script/suite_runner'
@@ -37,12 +38,6 @@ class Script < OpenC3::TargetFile
     super(scope, nil, target: target) # No path matchers
   end
 
-  # Split off the '*' that indicates a file is modified on the server
-  def self.strip_modified(name)
-    name.split('*')[0]
-  end
-  private_class_method :strip_modified
-
   def self.lock(scope, name, username)
     OpenC3::Store.hset("#{scope}__script-locks", strip_modified(name), username)
   end
@@ -88,7 +83,7 @@ class Script < OpenC3::TargetFile
                                  username: username, comment: comment)
   end
 
-  def self.process_suite(name, contents, new_process: true, username: nil, scope:)
+  def self.process_suite(name, contents, new_process: true, username: nil, scope:, python_venv: nil)
     python = false
     python = true if File.extname(name) == '.py'
 
@@ -155,10 +150,19 @@ class Script < OpenC3::TargetFile
         end
       end
       process.environment['GEM_HOME'] = ENV['GEM_HOME'] || '/gems'
-      process.environment['PYTHONUSERBASE'] = ENV['PYTHONUSERBASE'] || '/gems/python_packages'
+      process.environment['PYTHONUSERBASE'] = ENV['PYTHONUSERBASE'] || OpenC3::PythonVenv::DEFAULT_PYTHONUSERBASE
       # Preserve PYTHONPATH to ensure Python can find both UV venv and user packages
       process.environment['PYTHONPATH'] = ENV['PYTHONPATH'] || '.'
 
+      # Suite analysis executes Python in a separate process before the script
+      # itself is started. Give that process the same plugin venv visibility as
+      # RunningScript so imports used while defining a suite can be resolved.
+      if python
+        OpenC3::PythonVenv.configure_for_script(
+          process.environment, name: name, scope: scope, python_venv: python_venv
+        )
+      end
+
       # Spawned process should not be controlled by same Bundler constraints as spawning process
       ENV.each do |key, _value|
         if key =~ /^BUNDLE/

data/lib/openc3/utilities/secrets.rb

@@ -15,13 +15,58 @@ ENV['OPENC3_SECRET_BACKEND'] ||= 'redis'
 
 module OpenC3
   class Secrets
+    # Default base directory that FILE type secret paths must reside under.
+    # FILE type secrets are written by the operator (or mounted by Kubernetes)
+    # and then read back by the microservice, so the path is a destination we
+    # control, not an arbitrary file on the host.
+    DEFAULT_SECRET_FILE_DIR = '/tmp'
+
     def initialize
       @local_secrets = {}
     end
 
+    # Base directory that FILE type secret paths must reside under
+    def self.secret_file_dir
+      dir = ENV.fetch('OPENC3_SECRET_FILE_DIR', nil)
+      dir = DEFAULT_SECRET_FILE_DIR if dir.nil? or dir.empty?
+      dir
+    end
+
+    # Validates a FILE type secret path. The path must expand to a location
+    # strictly inside Secrets.secret_file_dir. This prevents a plugin
+    # configuration such as 'SECRET FILE KEY /root/.ssh/id_rsa' or
+    # 'SECRET FILE KEY /tmp/../etc/shadow' from reading or overwriting arbitrary
+    # files as the OpenC3 process user.
+    #
+    # @param path [String] Path from a SECRET FILE definition
+    # @return [String] The validated absolute path
+    def self.validate_file_path(path)
+      raise ArgumentError, "Secret file path must be a String but is a #{path.class}" unless path.is_a?(String)
+      raise ArgumentError, "Secret file path must not be blank" if path.strip.empty?
+      raise ArgumentError, "Secret file path must not contain a null byte" if path.include?("\x00")
+
+      # expand_path collapses '..' and '.', expands '~', and makes a relative path
+      # absolute, so the comparison below can't be walked out of. This is
+      # deliberately a purely lexical check: it does not touch the filesystem, so
+      # a path validates identically at plugin install time (cmd-tlm-api) and at
+      # write time (openc3-operator), which are separate containers. Symlinks are
+      # rejected by the operator when it writes the secret.
+      base = File.expand_path(secret_file_dir)
+      absolute = File.expand_path(path)
+      unless absolute.start_with?(base + File::SEPARATOR)
+        raise ArgumentError, "Secret file path '#{path}' must be under '#{base}'"
+      end
+      absolute
+    end
+
+    # @return true if path is inside base, or is base itself
+    def self.path_contained?(base, path)
+      path == base or path.start_with?(base.end_with?(File::SEPARATOR) ? base : base + File::SEPARATOR)
+    end
+
     def self.getClient
       raise 'OPENC3_SECRET_BACKEND environment variable is required' unless ENV['OPENC3_SECRET_BACKEND']
-      secrets_class = ENV['OPENC3_SECRET_BACKEND'].capitalize + 'Secrets'
+      secrets_class = ENV.fetch('OPENC3_SECRET_BACKEND').capitalize + 'Secrets'
       klass = OpenC3.require_class('openc3/utilities/' + secrets_class.class_name_to_filename)
       klass.new
     end
@@ -50,9 +95,9 @@ module OpenC3
         type, key, data, _secret_store = secret
         case type
         when 'ENV'
-          @local_secrets[key] = ENV[data]
+          @local_secrets[key] = ENV.fetch(data, nil)
         when 'FILE'
-          @local_secrets[key] = File.read(data)
+          @local_secrets[key] = File.read(Secrets.validate_file_path(data))
         else
           raise "Unknown secret type: #{type}"
         end

data/lib/openc3/utilities/store_autoload.rb

@@ -116,8 +116,8 @@ module OpenC3
     end
 
     def initialize(pool_size = 10, db_shard: 0)
-      @redis_username = ENV['OPENC3_REDIS_USERNAME']
-      @redis_key = ENV['OPENC3_REDIS_PASSWORD']
+      @redis_username = ENV.fetch('OPENC3_REDIS_USERNAME', nil)
+      @redis_key = ENV.fetch('OPENC3_REDIS_PASSWORD', nil)
       hostname = ENV['OPENC3_REDIS_HOSTNAME'].to_s.gsub("SHARDNUM", db_shard.to_s)
       @redis_url = "redis://#{hostname}:#{ENV.fetch('OPENC3_REDIS_PORT', 6379)}"
       @redis_pool = StoreConnectionPool.new(size: pool_size) { build_redis() }