pinokiod 8.0.30 → 8.0.31

package/kernel/bin/conda-meta.js

@@ -1,6 +1,7 @@
 const fs = require('fs')
 const path = require('path')
 const { execFile } = require('child_process')
+const { managedPythonEnv } = require('../python_env')
 
 async function buildCondaListFromMeta(minicondaPath, useCondaList) {
   if (!useCondaList) {
@@ -59,7 +60,10 @@ async function runCondaList(minicondaPath) {
     return { response: '', source: 'conda-list' }
   }
   return await new Promise((resolve) => {
-    execFile(condaBinary, ['list'], { windowsHide: true }, (err, stdout) => {
+    execFile(condaBinary, ['list'], {
+      env: managedPythonEnv(),
+      windowsHide: true,
+    }, (err, stdout) => {
       if (err) {
         resolve({ response: '', source: 'conda-list' })
       } else {
@@ -75,7 +79,11 @@ async function managedCondaRuns(minicondaPath, platform = process.platform) {
     return false
   }
   return await new Promise((resolve) => {
-    execFile(condaBinary, ['--version'], { windowsHide: true, timeout: 15000 }, (err) => {
+    execFile(condaBinary, ['--version'], {
+      env: managedPythonEnv(),
+      windowsHide: true,
+      timeout: 15000,
+    }, (err) => {
       resolve(!err)
     })
   })

package/kernel/connect/providers/huggingface/index.js

@@ -3,6 +3,7 @@ const fs = require('fs')
 const path = require('path')
 const fetch = require('cross-fetch')
 const Environment = require('../../../environment')
+const { managedPythonEnv } = require('../../../python_env')
 
 const stripAnsi = (value) => String(value || "").replace(/\x1B\[[0-?]*[ -/]*[@-~]/g, "")
 
@@ -56,6 +57,7 @@ class Huggingface {
     if (context.env && typeof context.env === "object") {
       env = Object.assign(env, context.env)
     }
+    env = managedPythonEnv(env)
     if (!env.HF_TOKEN_PATH) {
       env.HF_TOKEN_PATH = this.defaultTokenPath()
     } else if (!path.isAbsolute(env.HF_TOKEN_PATH)) {

package/kernel/python_env.js

@@ -0,0 +1,14 @@
+function managedPythonEnv(source = process.env) {
+  const env = { ...(source || {}) }
+  for (const key of Object.keys(env)) {
+    if (["PYTHONNOUSERSITE", "PYTHONPATH"].includes(key.toUpperCase())) {
+      delete env[key]
+    }
+  }
+  env.PYTHONNOUSERSITE = "1"
+  return env
+}
+
+module.exports = {
+  managedPythonEnv,
+}

package/kernel/util.js

@@ -13,6 +13,7 @@ const child_process = require('node:child_process');
 const {auto: normalizeEOL} = require("eol");
 const {EOL} = require("os");
 const { randomUUID } = require('crypto');
+const { managedPythonEnv } = require('./python_env')
 const fsp = fs.promises;
 const breakPattern = /\n/g;
 const breakReplacement = "\\n";
@@ -203,7 +204,9 @@ const filepicker = async(req, ondata, kernel) => {
     } else {
       python = kernel.path("bin/miniforge/bin/python")
     }
-    const proc = spawn(python, [picker_path])
+    const proc = spawn(python, [picker_path], {
+      env: managedPythonEnv(),
+    })
 
     let output = "";
     proc.stdout.on("data", (chunk) => output += chunk);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pinokiod",
-  "version": "8.0.30",
+  "version": "8.0.31",
   "description": "",
   "main": "index.js",
   "scripts": {

package/test/conda-bin.test.js

@@ -1,4 +1,5 @@
 const assert = require('node:assert/strict')
+const childProcess = require('node:child_process')
 const fsModule = require('node:fs')
 const fs = require('node:fs/promises')
 const os = require('node:os')
@@ -75,6 +76,14 @@ async function createLegacyMiniconda(root) {
   return createCondaRoot(root, 'miniconda')
 }
 
+function restoreEnv(name, value) {
+  if (typeof value === 'undefined') {
+    delete process.env[name]
+  } else {
+    process.env[name] = value
+  }
+}
+
 function createConda(kernel) {
   const conda = new Conda()
   conda.kernel = kernel
@@ -94,6 +103,58 @@ function createBin(root, platform = 'win32') {
   return bin
 }
 
+test('managed Conda subprocesses ignore external Python packages', async (t) => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-python-env-'))
+  const platform = process.platform === 'win32' ? 'win32' : process.platform
+  const miniforge = path.join(root, 'bin', 'miniforge')
+  const versionCapture = path.join(root, 'version-env.json')
+  const listCapture = path.join(root, 'list-env.json')
+  const oldCapturePath = process.env.PINOKIO_TEST_ENV_CAPTURE
+  const oldNoUserSite = process.env.PYTHONNOUSERSITE
+  const oldPythonPath = process.env.PYTHONPATH
+
+  await writeFakeManagedConda(root, platform)
+  const condaMetaPath = require.resolve('../kernel/bin/conda-meta')
+  const realExecFile = childProcess.execFile.bind(childProcess)
+  delete require.cache[condaMetaPath]
+  t.mock.method(childProcess, 'execFile', (_binary, _args, options, done) => {
+    return realExecFile(process.execPath, [
+      '-e',
+      `require('node:fs').writeFileSync(process.env.PINOKIO_TEST_ENV_CAPTURE, JSON.stringify({
+        pythonNoUserSite: process.env.PYTHONNOUSERSITE,
+        pythonPath: process.env.PYTHONPATH || null
+      }))`,
+    ], options, done)
+  })
+  t.after(() => {
+    delete require.cache[condaMetaPath]
+  })
+  const { buildCondaListFromMeta, managedCondaRuns } = require('../kernel/bin/conda-meta')
+
+  process.env.PYTHONNOUSERSITE = '0'
+  process.env.PYTHONPATH = 'external-packages'
+  try {
+    process.env.PINOKIO_TEST_ENV_CAPTURE = versionCapture
+    assert.equal(await managedCondaRuns(miniforge, platform), true)
+    assert.deepEqual(JSON.parse(await fs.readFile(versionCapture, 'utf8')), {
+      pythonNoUserSite: '1',
+      pythonPath: null,
+    })
+
+    process.env.PINOKIO_TEST_ENV_CAPTURE = listCapture
+    await buildCondaListFromMeta(miniforge, true)
+    assert.deepEqual(JSON.parse(await fs.readFile(listCapture, 'utf8')), {
+      pythonNoUserSite: '1',
+      pythonPath: null,
+    })
+  } finally {
+    restoreEnv('PINOKIO_TEST_ENV_CAPTURE', oldCapturePath)
+    restoreEnv('PYTHONNOUSERSITE', oldNoUserSite)
+    restoreEnv('PYTHONPATH', oldPythonPath)
+    await fs.rm(root, { recursive: true, force: true })
+  }
+})
+
 test('Conda uses Miniforge assets and writes conda-forge-only config', async () => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-conda-miniforge-config-'))
   const conda = createConda(createKernel(root))

package/test/filepicker-python-env.test.js

@@ -0,0 +1,55 @@
+const assert = require('node:assert/strict')
+const fs = require('node:fs/promises')
+const os = require('node:os')
+const path = require('node:path')
+const test = require('node:test')
+
+const Util = require('../kernel/util')
+
+function restoreEnv(name, value) {
+  if (typeof value === 'undefined') {
+    delete process.env[name]
+  } else {
+    process.env[name] = value
+  }
+}
+
+test('file picker isolates its managed Python from external packages', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-filepicker-python-env-'))
+  const pickerPath = path.join(root, 'picker.js')
+  const oldNoUserSite = process.env.PYTHONNOUSERSITE
+  const oldPythonPath = process.env.PYTHONPATH
+  await fs.writeFile(pickerPath, `
+let input = ''
+process.stdin.setEncoding('utf8')
+process.stdin.on('data', (chunk) => { input += chunk })
+process.stdin.on('end', () => {
+  JSON.parse(input)
+  process.stdout.write(JSON.stringify({
+    paths: [process.env.PYTHONNOUSERSITE, process.env.PYTHONPATH || null]
+  }))
+})
+`)
+
+  process.env.PYTHONNOUSERSITE = '0'
+  process.env.PYTHONPATH = 'external-packages'
+  try {
+    const kernel = {
+      platform: 'linux',
+      path: (target) => {
+        if (target === 'bin/py/picker.py') return pickerPath
+        if (target === 'bin/miniforge/bin/python') return process.execPath
+        throw new Error(`Unexpected path: ${target}`)
+      },
+    }
+    const result = await Util.filepicker({ params: {} }, () => {}, kernel)
+
+    assert.deepEqual(result, {
+      paths: ['1', null],
+    })
+  } finally {
+    restoreEnv('PYTHONNOUSERSITE', oldNoUserSite)
+    restoreEnv('PYTHONPATH', oldPythonPath)
+    await fs.rm(root, { recursive: true, force: true })
+  }
+})

package/test/huggingface-connect.test.js

@@ -79,6 +79,41 @@ test('Hugging Face connect preserves configured HF paths and ignores ambient HF_
   }
 })
 
+test('Hugging Face connect isolates its managed Python from external packages', async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-hf-connect-python-env-'))
+  const childEnvPath = path.join(root, 'child-env.json')
+  await fs.writeFile(
+    path.join(root, 'ENVIRONMENT'),
+    'PYTHONNOUSERSITE=0\nPYTHONPATH=system-packages\n'
+  )
+  try {
+    const provider = new HuggingfaceConnect(createKernel(root), {})
+    provider.hfPath = () => process.execPath
+    const { env } = await provider.runHf([
+      '-e',
+      'require("node:fs").writeFileSync(process.argv[1], JSON.stringify({ pythonNoUserSite: process.env.PYTHONNOUSERSITE, pythonPath: process.env.PYTHONPATH || null }))',
+      childEnvPath
+    ], {}, {
+      env: {
+        PythonNoUserSite: '0',
+        PythonPath: 'command-packages'
+      }
+    })
+    const childEnv = JSON.parse(await fs.readFile(childEnvPath, 'utf8'))
+
+    assert.equal(env.PYTHONNOUSERSITE, '1')
+    assert.equal(env.PYTHONPATH, undefined)
+    assert.equal(env.PythonNoUserSite, undefined)
+    assert.equal(env.PythonPath, undefined)
+    assert.deepEqual(childEnv, {
+      pythonNoUserSite: '1',
+      pythonPath: null
+    })
+  } finally {
+    await fs.rm(root, { recursive: true, force: true })
+  }
+})
+
 test('Hugging Face connect uses the app token path for its managed CLI', async () => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'pinokio-hf-connect-app-env-'))
   const appDir = path.join(root, 'api', 'demo')