External/roboco
1
0
Fork 0
mirror of https://github.com/rennf93/roboco.git synced 2026-08-03 07:23:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

[bug] agent image: stop baking VIRTUAL_ENV=/app/.venv (silences uv run warning)

Browse Source 
The agent-base image baked VIRTUAL_ENV=/app/.venv globally (since 8e201901,
conventional venv-baking, no targeted rationale), so every bare uv run in a
workspace clone warned 'VIRTUAL_ENV=/app/.venv does not match project .venv
and will be ignored' on every gate run. uv used the workspace .venv correctly
(the warning was noise), but it flooded every agent transcript.

The load-bearing MCP/SDK pin is UV_PROJECT_ENVIRONMENT=/app/.venv + --no-sync
(added in #179, the actual startup-stall fix), NOT VIRTUAL_ENV — so removing
VIRTUAL_ENV does not regress #179. The gateway tools stay on PATH.

Verified by building the image (roboco-agent-base:venv-verify) and smoke-
testing in a real container: (1) VIRTUAL_ENV is empty, python resolves to
/app/.venv/bin/python via PATH; (2) bare uv run from /app imports a roboco
module with no warning; (3) the MCP-launch path — cwd with its OWN .venv —
UV_PROJECT_ENVIRONMENT=/app/.venv uv run --no-sync resolves to /app/.venv/
bin/python, overriding the cwd .venv (the exact MCP-server invariant), no
warning; (4) grep for 'does not match|will be ignored' across all output is
empty. bash-guard-tests.sh 64/0, ruff clean, test_workspace_uv_resolves_clone_venv 3/3.

Ships on next agent-image rebuild + redeploy.
This commit is contained in:
Renn F
2026-06-30 09:58:36 +02:00
parent 0051339915
commit 7be10057d0
4 changed files with 14 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker/scripts/tests/bash-guard-tests.sh
+3 -2
View File
@@ -100,8 +100,9 @@ run_case "deny rm -rf /etc" 2 "rm -rf /etc"
run_case "deny uv sync --project /app" 2 "uv sync --project /app"
run_case "deny uv pip install /app venv" 2 "uv pip install --python /app/.venv/bin/python foo"
run_case "deny cd /app && uv sync" 2 "cd /app && uv sync"
# uv run --active: in the agent VIRTUAL_ENV=/app/.venv is baked globally, so
# --active ALWAYS retargets onto /app/.venv → uv rebuilds it → bricked gateway.
# uv run --active: not the contract (bare `uv run` uses the workspace .venv).
# VIRTUAL_ENV is no longer image-baked, so --active has no active env and
# errors; the guard still denies it with a clear remediation message.
run_case "deny uv run --active" 2 "uv run --active pytest"
run_case "deny uv run --active ruff" 2 "uv run --active ruff check ."
run_case "deny env venv /app uv run active" 2 "VIRTUAL_ENV=/app/.venv uv run --active pytest"