weichenandCursor
b85a1e1ca3
Why: The sandbox hides the host home directory and has no network, so pip install --user cannot supply python-docx, and the service PATH resolved python3 to a linuxbrew path that does not exist inside the sandbox. Evidence: SELF go test of execenv, tools, store, app, server, runmgr, config, and cmd/agent-system on this worktree. CI has not run. Impact: Sessions inherit a read-only base layer. Extra packages are requested through python_env, auto-approved only from the allowlist, and mounted per conversation. Schema 35 adds the request and binding tables. Refs: .task/feature-layered-python-env.md Co-authored-by: Cursor <cursoragent@cursor.com>
23 lines
470 B
Go
23 lines
470 B
Go
package execenv
|
||
|
||
import (
|
||
"os"
|
||
"path/filepath"
|
||
)
|
||
|
||
const pipShim = `#!/bin/sh
|
||
echo "沙箱不联网安装。请使用 python_env 工具申请扩展包：python_env request，packages 写包名，reason 写用途。" >&2
|
||
exit 1
|
||
`
|
||
|
||
func writePipShim(dir string) error {
|
||
body := []byte(pipShim)
|
||
for _, name := range []string{"pip", "pip3"} {
|
||
path := filepath.Join(dir, name)
|
||
if err := os.WriteFile(path, body, 0o755); err != nil {
|
||
return err
|
||
}
|
||
}
|
||
return nil
|
||
}
|