bashkit 0.7.2__tar.gz → 0.8.0__tar.gz

{bashkit-0.7.2 → bashkit-0.8.0}/Cargo.lock

@@ -345,7 +345,7 @@ checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
 
 [[package]]
 name = "bashkit"
-version = "0.7.2"
+version = "0.8.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -398,7 +398,7 @@ dependencies = [
 
 [[package]]
 name = "bashkit-bench"
-version = "0.7.2"
+version = "0.8.0"
 dependencies = [
  "anyhow",
  "bashkit",
@@ -412,7 +412,7 @@ dependencies = [
 
 [[package]]
 name = "bashkit-cli"
-version = "0.7.2"
+version = "0.8.0"
 dependencies = [
  "anyhow",
  "bashkit",
@@ -426,7 +426,7 @@ dependencies = [
 
 [[package]]
 name = "bashkit-coreutils-port"
-version = "0.7.2"
+version = "0.8.0"
 dependencies = [
  "anyhow",
  "prettyplease",
@@ -440,7 +440,7 @@ dependencies = [
 
 [[package]]
 name = "bashkit-eval"
-version = "0.7.2"
+version = "0.8.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -457,7 +457,7 @@ dependencies = [
 
 [[package]]
 name = "bashkit-js"
-version = "0.7.2"
+version = "0.8.0"
 dependencies = [
  "bashkit",
  "napi",
@@ -469,7 +469,7 @@ dependencies = [
 
 [[package]]
 name = "bashkit-python"
-version = "0.7.2"
+version = "0.8.0"
 dependencies = [
  "bashkit",
  "num-bigint",
@@ -1745,9 +1745,9 @@ dependencies = [
 
 [[package]]
 name = "get-size-derive2"
-version = "0.7.4"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2b6d1e2f75c16bfbcd0f95d84f99858a6e2f885c2287d1f5c3a96e8444a34b4"
+checksum = "c9f8ab1b98a1284961d722ce994d9a0f3018ab1917618d4113824a72b9f71bc9"
 dependencies = [
  "attribute-derive",
  "quote",
@@ -1756,15 +1756,16 @@ dependencies = [
 
 [[package]]
 name = "get-size2"
-version = "0.7.4"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49cf31a6d70300cf81461098f7797571362387ef4bf85d32ac47eaa59b3a5a1a"
+checksum = "b0cd0777a1057362cab35a779e0d79dacecb8d73e2c733eaafeb7ea917b08f03"
 dependencies = [
  "compact_str",
  "get-size-derive2",
- "hashbrown 0.16.1",
+ "hashbrown 0.17.1",
  "ordermap",
  "smallvec",
+ "thin-vec",
 ]
 
 [[package]]
@@ -2442,9 +2443,9 @@ dependencies = [
 
 [[package]]
 name = "jiter"
-version = "0.13.0"
+version = "0.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "020ba671987d7444d251d3ee5340be1bf4606cd6c0b53e6f4066b5a1ee376b22"
+checksum = "7866f284df68dbc242796251ed9768bde2b58ebc4d7d32cc07cc7fd993e3ed6c"
 dependencies = [
  "ahash",
  "bitvec",
@@ -2811,10 +2812,9 @@ dependencies = [
 [[package]]
 name = "monty"
 version = "0.0.17"
-source = "git+https://github.com/pydantic/monty?rev=49faa4c#49faa4c8ae94490eae286e76259adcc35f64f0a5"
+source = "git+https://github.com/pydantic/monty?rev=9b5f478#9b5f478288e8c1c0198ec4af60049738f93652c1"
 dependencies = [
  "ahash",
- "bytemuck",
  "chrono",
  "fancy-regex 0.17.0",
  "hashbrown 0.16.1",
@@ -4200,7 +4200,7 @@ dependencies = [
 [[package]]
 name = "ruff_python_ast"
 version = "0.0.0"
-source = "git+https://github.com/astral-sh/ruff.git?rev=6ded4bed1651e30b34dd04cdaa50c763036abb0d#6ded4bed1651e30b34dd04cdaa50c763036abb0d"
+source = "git+https://github.com/samuelcolvin/ruff.git?rev=6aaa91ac2b269df1414954ccd5134f0e6f5c6d30#6aaa91ac2b269df1414954ccd5134f0e6f5c6d30"
 dependencies = [
  "aho-corasick",
  "bitflags",
@@ -4212,13 +4212,14 @@ dependencies = [
  "ruff_source_file",
  "ruff_text_size",
  "rustc-hash",
+ "thin-vec",
  "thiserror 2.0.18",
 ]
 
 [[package]]
 name = "ruff_python_parser"
 version = "0.0.0"
-source = "git+https://github.com/astral-sh/ruff.git?rev=6ded4bed1651e30b34dd04cdaa50c763036abb0d#6ded4bed1651e30b34dd04cdaa50c763036abb0d"
+source = "git+https://github.com/samuelcolvin/ruff.git?rev=6aaa91ac2b269df1414954ccd5134f0e6f5c6d30#6aaa91ac2b269df1414954ccd5134f0e6f5c6d30"
 dependencies = [
  "bitflags",
  "bstr",
@@ -4230,6 +4231,7 @@ dependencies = [
  "ruff_text_size",
  "rustc-hash",
  "static_assertions",
+ "thin-vec",
  "unicode-ident",
  "unicode-normalization",
  "unicode_names2",
@@ -4238,7 +4240,7 @@ dependencies = [
 [[package]]
 name = "ruff_python_stdlib"
 version = "0.0.0"
-source = "git+https://github.com/astral-sh/ruff.git?rev=6ded4bed1651e30b34dd04cdaa50c763036abb0d#6ded4bed1651e30b34dd04cdaa50c763036abb0d"
+source = "git+https://github.com/samuelcolvin/ruff.git?rev=6aaa91ac2b269df1414954ccd5134f0e6f5c6d30#6aaa91ac2b269df1414954ccd5134f0e6f5c6d30"
 dependencies = [
  "bitflags",
  "unicode-ident",
@@ -4247,7 +4249,7 @@ dependencies = [
 [[package]]
 name = "ruff_python_trivia"
 version = "0.0.0"
-source = "git+https://github.com/astral-sh/ruff.git?rev=6ded4bed1651e30b34dd04cdaa50c763036abb0d#6ded4bed1651e30b34dd04cdaa50c763036abb0d"
+source = "git+https://github.com/samuelcolvin/ruff.git?rev=6aaa91ac2b269df1414954ccd5134f0e6f5c6d30#6aaa91ac2b269df1414954ccd5134f0e6f5c6d30"
 dependencies = [
  "itertools 0.14.0",
  "ruff_source_file",
@@ -4258,7 +4260,7 @@ dependencies = [
 [[package]]
 name = "ruff_source_file"
 version = "0.0.0"
-source = "git+https://github.com/astral-sh/ruff.git?rev=6ded4bed1651e30b34dd04cdaa50c763036abb0d#6ded4bed1651e30b34dd04cdaa50c763036abb0d"
+source = "git+https://github.com/samuelcolvin/ruff.git?rev=6aaa91ac2b269df1414954ccd5134f0e6f5c6d30#6aaa91ac2b269df1414954ccd5134f0e6f5c6d30"
 dependencies = [
  "memchr",
  "ruff_text_size",
@@ -4267,7 +4269,7 @@ dependencies = [
 [[package]]
 name = "ruff_text_size"
 version = "0.0.0"
-source = "git+https://github.com/astral-sh/ruff.git?rev=6ded4bed1651e30b34dd04cdaa50c763036abb0d#6ded4bed1651e30b34dd04cdaa50c763036abb0d"
+source = "git+https://github.com/samuelcolvin/ruff.git?rev=6aaa91ac2b269df1414954ccd5134f0e6f5c6d30#6aaa91ac2b269df1414954ccd5134f0e6f5c6d30"
 dependencies = [
  "get-size2",
 ]
@@ -5226,6 +5228,12 @@ dependencies = [
  "unicode-width 0.2.2",
 ]
 
+[[package]]
+name = "thin-vec"
+version = "0.2.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b0f7e269b48f0a7dd0146680fa24b50cc67fc0373f086a5b2f99bd084639b482"
+
 [[package]]
 name = "thiserror"
 version = "1.0.69"

{bashkit-0.7.2 → bashkit-0.8.0}/Cargo.toml

@@ -7,7 +7,7 @@ resolver = "2"
 members = ["crates/*"]
 
 [workspace.package]
-version = "0.7.2"
+version = "0.8.0"
 edition = "2024"
 license = "MIT"
 authors = ["Everruns"]

{bashkit-0.7.2 → bashkit-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bashkit
-Version: 0.7.2
+Version: 0.8.0
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License

{bashkit-0.7.2 → bashkit-0.8.0}/crates/bashkit/Cargo.toml

@@ -98,7 +98,7 @@ unit-prefix = "0.5"
 os_display = "0.1.3"
 
 # Embedded Python interpreter (optional)
-monty = { git = "https://github.com/pydantic/monty", rev = "49faa4c", optional = true }
+monty = { git = "https://github.com/pydantic/monty", rev = "9b5f478", optional = true }
 
 # Embedded TypeScript interpreter (optional)
 zapcode-core = { version = "1.5", optional = true }

{bashkit-0.7.2 → bashkit-0.8.0}/crates/bashkit/README.md

@@ -341,17 +341,17 @@ bash.exec("python3 -c \"print(2 ** 10)\"").await?;
 // Script files from VFS
 bash.exec("python3 /tmp/script.py").await?;
 
-// VFS bridging: pathlib.Path operations work with the virtual filesystem
+// VFS bridging: open() and pathlib.Path work with the virtual filesystem
 bash.exec(r#"python3 -c "
-from pathlib import Path
-Path('/tmp/data.txt').write_text('hello from python')
+with open('/tmp/data.txt', 'w') as f:
+    f.write('hello from python')
 ""#).await?;
 bash.exec("cat /tmp/data.txt").await?; // "hello from python"
 ```
 
 Stdlib modules: `math`, `pathlib`, `os` (getenv/environ), `sys`, `typing`.
 Security note: `re` is intentionally disabled due to regex backtracking DoS risk.
-Limitations: no `open()` (use `pathlib.Path`), no network, no classes, no third-party imports.
+Limitations: file I/O is VFS-scoped, no network, no classes, no third-party imports.
 See [crates/bashkit/docs/python.md](crates/bashkit/docs/python.md) for the full guide.
 
 ## Experimental: TypeScript Support

{bashkit-0.7.2 → bashkit-0.8.0}/crates/bashkit/docs/hooks.md

@@ -243,7 +243,7 @@ boundary stays in bashkit — hooks cannot bypass the allowlist.
 
 ### `before_http` — Filter or Modify Requests
 
-```rust
+```rust,ignore
 use bashkit::{Bash, NetworkAllowlist, hooks::{HookAction, HttpRequestEvent}};
 
 # fn main() {
@@ -266,7 +266,7 @@ let bash = Bash::builder()
 
 ### `after_http` — Observe Responses
 
-```rust
+```rust,ignore
 use bashkit::{Bash, NetworkAllowlist, hooks::{HookAction, HttpResponseEvent}};
 use std::sync::{Arc, Mutex};
 

{bashkit-0.7.2 → bashkit-0.8.0}/crates/bashkit/docs/python.md

@@ -73,16 +73,15 @@ echo "print('piped')" | python3
 
 ## Virtual Filesystem (VFS) Bridging
 
-Python `pathlib.Path` operations are bridged to Bashkit's virtual filesystem.
-Files created by bash are readable from Python and vice versa.
+Python `open()` and `pathlib.Path` operations are bridged to Bashkit's virtual
+filesystem. Files created by bash are readable from Python and vice versa.
 
 ### Bash → Python
 
 ```bash
 echo "important data" > /tmp/shared.txt
 python3 -c "
-from pathlib import Path
-content = Path('/tmp/shared.txt').read_text()
+content = open('/tmp/shared.txt').read()
 print(f'Got: {content.strip()}')
 "
 ```
@@ -91,16 +90,20 @@ print(f'Got: {content.strip()}')
 
 ```bash
 python3 -c "
-from pathlib import Path
-_ = Path('/tmp/result.txt').write_text('computed by python\n')
+with open('/tmp/result.txt', 'w') as f:
+    _ = f.write('computed by python\n')
 "
 cat /tmp/result.txt
 ```
 
-### Supported Path Operations
+### Supported File Operations
 
 | Operation | Example |
 |-----------|---------|
+| Open/read | `open('f.txt').read()` |
+| Open/write | `open('f.txt', 'w').write('data')` |
+| Open/append | `open('f.txt', 'a').write('more')` |
+| Path open | `Path('f.txt').open('r')` |
 | Read text | `Path('f.txt').read_text()` |
 | Read bytes | `Path('f.txt').read_bytes()` |
 | Write text | `Path('f.txt').write_text('data')` |
@@ -117,7 +120,7 @@ cat /tmp/result.txt
 ### Architecture
 
 ```text
-Python code → Monty VM → OsCall(ReadText, path) → Bashkit VFS → resume
+Python code → Monty VM → OsCall(Open/ReadText, path) → Bashkit VFS → resume
 ```
 
 Monty pauses at filesystem operations, Bashkit bridges them to the VFS, then
@@ -169,19 +172,20 @@ let help = tool.help();  // Includes a Markdown Notes section with Python hints
 ```
 
 The builtin's `llm_hint()` is automatically included in the tool's documentation,
-so LLMs know not to generate code using `open()`, HTTP requests, or classes.
+so LLMs know file I/O is VFS-scoped and HTTP requests/classes are unavailable.
 
 ## Limitations
 
-**No `open()` builtin.** Monty does not implement Python's `open()`. Use `pathlib.Path` instead:
+**VFS-only file I/O.** `open()` and `pathlib.Path` read/write Bashkit's virtual
+filesystem, not the host filesystem:
 
 ```python
-# Won't work:
-# f = open('data.txt')
-
-# Use instead:
 from pathlib import Path
-content = Path('data.txt').read_text()
+
+with open('/tmp/data.txt', 'w') as f:
+    f.write('hello')
+
+content = Path('/tmp/data.txt').read_text()
 ```
 
 **No HTTP/network.** No `socket`, `urllib`, `requests`, or `http.client` modules.

{bashkit-0.7.2 → bashkit-0.8.0}/crates/bashkit/docs/threat-model.md

@@ -554,7 +554,7 @@ attacks:
 ### Python / Monty Security (TM-PY-*)
 
 The `python`/`python3` builtins embed the Monty Python interpreter with VFS bridging.
-Python `pathlib.Path` operations are bridged to Bashkit's virtual filesystem.
+Python `pathlib.Path` and `open()` operations are bridged to Bashkit's virtual filesystem.
 
 | Threat | Attack Example | Mitigation | Status |
 |--------|---------------|------------|--------|
@@ -562,7 +562,7 @@ Python `pathlib.Path` operations are bridged to Bashkit's virtual filesystem.
 | Memory exhaustion (TM-PY-002) | Large allocation | Monty max_memory (64MB) + max_allocations (1M) | MITIGATED |
 | Stack overflow (TM-PY-003) | Deep recursion | Monty max_recursion (200) | MITIGATED |
 | Shell escape (TM-PY-004) | `os.system()` | Monty has no os.system/subprocess | MITIGATED |
-| Real FS access (TM-PY-005) | `open()` | Monty has no open() builtin | MITIGATED |
+| Real FS access (TM-PY-005) | `open()` | VFS bridge opens only Bashkit VFS files | MITIGATED |
 | Error info leak (TM-PY-006) | Errors go to stdout | Errors go to stderr, not stdout | MITIGATED |
 | Real FS read (TM-PY-015) | `Path.read_text()` | VFS bridge reads only from Bashkit VFS | MITIGATED |
 | Real FS write (TM-PY-016) | `Path.write_text()` | VFS bridge writes only to Bashkit VFS | MITIGATED |

{bashkit-0.7.2 → bashkit-0.8.0}/crates/bashkit/src/builtins/python.rs

@@ -9,17 +9,21 @@
 //! # Overview
 //!
 //! Virtual Python execution with resource limits and VFS access.
-//! Python `pathlib.Path` operations are bridged to Bashkit's virtual filesystem
-//! via Monty's OsCall pause/resume mechanism. No real filesystem or network access.
+//! Python `pathlib.Path` operations and `open()` file handles are bridged to
+//! Bashkit's virtual filesystem via Monty's OsCall pause/resume mechanism.
+//! No real filesystem or network access.
+//!
+//! Decision: `open()` performs only VFS open-time effects and returns Monty's
+//! virtual file handle. Bashkit never holds host/native Python file handles.
 //!
 //! Supports: `python -c "code"`, `python script.py`, stdin piping.
 
 use async_trait::async_trait;
 use chrono::{Datelike, Timelike};
 use monty::{
-    ExcType, ExtFunctionResult, LimitedTracker, MontyDate, MontyDateTime, MontyException,
-    MontyObject, MontyRun, NameLookupResult, OsFunction, PrintWriter, ResourceLimits, RunProgress,
-    dir_stat, file_stat, symlink_stat,
+    ExcType, ExtFunctionResult, FileMode, LimitedTracker, MontyDate, MontyDateTime, MontyException,
+    MontyFileHandle, MontyObject, MontyRun, NameLookupResult, OsFunction, PrintWriter,
+    ResourceLimits, RunProgress, dir_stat, file_stat, symlink_stat,
 };
 use std::collections::HashMap;
 use std::future::Future;
@@ -181,8 +185,9 @@ impl std::fmt::Debug for PythonExternalFns {
 /// The python/python3 builtin command.
 ///
 /// Executes Python code using the embedded Monty interpreter (pydantic/monty).
-/// Python `pathlib.Path` operations are bridged to Bashkit's VFS — files
-/// created by bash (`cat > file`) are readable from Python, and vice versa.
+/// Python `pathlib.Path` and `open()` operations are bridged to Bashkit's VFS
+/// — files created by bash (`cat > file`) are readable from Python, and vice
+/// versa.
 ///
 /// # Usage
 ///
@@ -192,7 +197,7 @@ impl std::fmt::Debug for PythonExternalFns {
 /// echo "print('hello')" | python3
 /// python3 -c "2 + 2"              # expression result printed
 /// python3 --version
-/// python3 -c "from pathlib import Path; print(Path('/tmp/f.txt').read_text())"
+/// python3 -c "print(open('/tmp/f.txt').read())"
 /// ```
 pub struct Python {
     /// Resource limits for the Monty interpreter.
@@ -306,7 +311,7 @@ impl Builtin for Python {
         Some(
             "python/python3: Embedded Python (Monty). \
              Stdlib: math, pathlib, os.getenv, sys, typing. \
-             File I/O via pathlib.Path only (no open()). \
+             File I/O via pathlib.Path and open() against the VFS. \
              No HTTP/network. No classes. No third-party imports.",
         )
     }
@@ -631,6 +636,20 @@ async fn handle_os_call(
     };
 
     match function {
+        OsFunction::Open => {
+            let mode = match parse_open_mode(args) {
+                Ok(mode) => mode,
+                Err(err) => return err,
+            };
+            match open_vfs_file(&path, mode, fs).await {
+                Ok(()) => ExtFunctionResult::Return(MontyObject::FileHandle(MontyFileHandle {
+                    path: path.to_string_lossy().to_string(),
+                    mode,
+                    position: 0,
+                })),
+                Err(e) => map_vfs_error(e, &path),
+            }
+        }
         OsFunction::Exists => {
             let exists = fs.exists(&path).await.unwrap_or(false);
             ExtFunctionResult::Return(MontyObject::Bool(exists))
@@ -674,7 +693,10 @@ async fn handle_os_call(
                     ));
                 }
             };
-            let len = content.len();
+            let len = match args.get(1) {
+                Some(MontyObject::String(s)) => s.chars().count(),
+                _ => 0,
+            };
             match fs.write_file(&path, &content).await {
                 Ok(()) => ExtFunctionResult::Return(MontyObject::Int(len as i64)),
                 Err(e) => map_vfs_error(e, &path),
@@ -696,6 +718,41 @@ async fn handle_os_call(
                 Err(e) => map_vfs_error(e, &path),
             }
         }
+        OsFunction::AppendText => {
+            let content = match args.get(1) {
+                Some(MontyObject::String(s)) => s.as_bytes().to_vec(),
+                _ => {
+                    return ExtFunctionResult::Error(MontyException::new(
+                        ExcType::TypeError,
+                        Some("append_text() requires a string argument".into()),
+                    ));
+                }
+            };
+            let len = match args.get(1) {
+                Some(MontyObject::String(s)) => s.chars().count(),
+                _ => 0,
+            };
+            match append_vfs_file(&path, &content, fs).await {
+                Ok(()) => ExtFunctionResult::Return(MontyObject::Int(len as i64)),
+                Err(e) => map_vfs_error(e, &path),
+            }
+        }
+        OsFunction::AppendBytes => {
+            let content = match args.get(1) {
+                Some(MontyObject::Bytes(b)) => b.clone(),
+                _ => {
+                    return ExtFunctionResult::Error(MontyException::new(
+                        ExcType::TypeError,
+                        Some("append_bytes() requires a bytes argument".into()),
+                    ));
+                }
+            };
+            let len = content.len();
+            match append_vfs_file(&path, &content, fs).await {
+                Ok(()) => ExtFunctionResult::Return(MontyObject::Int(len as i64)),
+                Err(e) => map_vfs_error(e, &path),
+            }
+        }
         OsFunction::Mkdir => {
             let parents = get_bool_kwarg(kwargs, "parents").unwrap_or(false);
             let exist_ok = get_bool_kwarg(kwargs, "exist_ok").unwrap_or(false);
@@ -783,10 +840,64 @@ async fn handle_os_call(
 fn extract_path(args: &[MontyObject], cwd: &Path) -> Option<PathBuf> {
     match args.first()? {
         MontyObject::Path(s) | MontyObject::String(s) => Some(resolve_python_path(s, cwd)),
+        MontyObject::FileHandle(handle) => Some(resolve_python_path(&handle.path, cwd)),
         _ => None,
     }
 }
 
+fn parse_open_mode(args: &[MontyObject]) -> std::result::Result<FileMode, ExtFunctionResult> {
+    let Some(MontyObject::String(mode)) = args.get(1) else {
+        return Err(ExtFunctionResult::Error(MontyException::new(
+            ExcType::TypeError,
+            Some("open() missing mode argument".into()),
+        )));
+    };
+
+    mode.parse::<FileMode>().map_err(|msg| {
+        ExtFunctionResult::Error(MontyException::new(
+            ExcType::ValueError,
+            Some(msg.into_owned()),
+        ))
+    })
+}
+
+async fn open_vfs_file(path: &Path, mode: FileMode, fs: &Arc<dyn FileSystem>) -> Result<()> {
+    match mode {
+        FileMode::Read(_) | FileMode::ReadUpdate(_) => {
+            let meta = fs.stat(path).await?;
+            if meta.file_type.is_dir() {
+                return Err(std::io::Error::other("is a directory").into());
+            }
+        }
+        FileMode::Write(_) | FileMode::WriteUpdate(_) => {
+            fs.write_file(path, b"").await?;
+        }
+        FileMode::Append(_) | FileMode::AppendUpdate(_) => {
+            if fs.exists(path).await.unwrap_or(false) {
+                let meta = fs.stat(path).await?;
+                if meta.file_type.is_dir() {
+                    return Err(std::io::Error::other("is a directory").into());
+                }
+            } else {
+                fs.write_file(path, b"").await?;
+            }
+        }
+    }
+    Ok(())
+}
+
+async fn append_vfs_file(path: &Path, content: &[u8], fs: &Arc<dyn FileSystem>) -> Result<()> {
+    let mut existing = match fs.read_file(path).await {
+        Ok(bytes) => bytes,
+        Err(e) if e.to_string().contains("not found") || e.to_string().contains("No such file") => {
+            Vec::new()
+        }
+        Err(e) => return Err(e),
+    };
+    existing.extend_from_slice(content);
+    fs.write_file(path, &existing).await
+}
+
 /// Resolve a Python path string against cwd if relative.
 fn resolve_python_path(path_str: &str, cwd: &Path) -> PathBuf {
     let p = Path::new(path_str);