puter/paseo
1
0
Fork 0
mirror of https://github.com/getpaseo/paseo.git synced 2026-08-14 12:23:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

[codex] Centralize subprocess env boundaries (#585)

Browse Source 
* Centralize subprocess env boundaries

* Remove env boundary static audit test

* Tighten env boundary process launches

* Fix Windows native process launches

* Inline provider env pass-throughs
This commit is contained in:
Mohamed Boudra
2026-04-27 13:24:16 +08:00
committed by GitHub
parent 90032570ec
commit 15df680a64
40 changed files with 760 additions and 304 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
packages/desktop/bin/paseo
View File

@@ -38,4 +38,4 @@ fi
RUNNER_PATH="${RESOURCES_DIR}/app.asar.unpacked/dist/daemon/node-entrypoint-runner.js"
CLI_ENTRYPOINT="${RESOURCES_DIR}/app.asar/node_modules/@getpaseo/cli/dist/index.js"
exec env ELECTRON_RUN_AS_NODE=1 "${APP_EXECUTABLE}" --disable-warning=DEP0040 "${RUNNER_PATH}" node-script "${CLI_ENTRYPOINT}" "$@"
exec env ELECTRON_RUN_AS_NODE=1 PASEO_NODE_ENV=production "${APP_EXECUTABLE}" --disable-warning=DEP0040 "${RUNNER_PATH}" node-script "${CLI_ENTRYPOINT}" "$@"

1
packages/desktop/bin/paseo.cmd
View File

@@ -10,5 +10,6 @@ if not exist "%APP_EXECUTABLE%" (
)
set "ELECTRON_RUN_AS_NODE=1"
set "PASEO_NODE_ENV=production"
"%APP_EXECUTABLE%" --disable-warning=DEP0040 "%RESOURCES_DIR%\app.asar.unpacked\dist\daemon\node-entrypoint-runner.js" node-script "%RESOURCES_DIR%\app.asar\node_modules\@getpaseo\cli\dist\index.js" %*
exit /b %errorlevel%

4
packages/desktop/src/daemon/daemon-manager.ts
View File

@@ -359,7 +359,9 @@ async function startDaemon(): Promise<DesktopDaemonStatus> {
const child: ChildProcess = spawnProcess(invocation.command, invocation.args, {
detached: true,
env: { ...invocation.env, PASEO_DESKTOP_MANAGED: "1" },
envMode: "internal",
env: invocation.env,
envOverlay: { PASEO_DESKTOP_MANAGED: "1" },
stdio: ["ignore", "pipe", "pipe"],
});

7
packages/desktop/src/daemon/node-entrypoint-launcher.test.ts
View File

@@ -109,7 +109,7 @@ describe("node-entrypoint-launcher", () => {
env: {
PATH: "/usr/bin",
ELECTRON_RUN_AS_NODE: "1",
NODE_ENV: "production",
PASEO_NODE_ENV: "production",
},
});
});
@@ -150,7 +150,8 @@ describe("node-entrypoint-launcher", () => {
).toMatchObject({
PATH: "/usr/bin",
ELECTRON_RUN_AS_NODE: "1",
NODE_ENV: "production",
NODE_ENV: "development",
PASEO_NODE_ENV: "production",
});
});
@@ -178,7 +179,7 @@ describe("node-entrypoint-launcher", () => {
env: {
PATH: "/usr/bin",
ELECTRON_RUN_AS_NODE: "1",
NODE_ENV: "production",
PASEO_NODE_ENV: "production",
},
});
});

3
packages/desktop/src/daemon/node-entrypoint-launcher.ts
View File

@@ -1,6 +1,7 @@
const IGNORED_ARG_PREFIXES = ["-psn_", "--no-sandbox"];
export const DESKTOP_CLI_ENV = "PASEO_DESKTOP_CLI";
const PASEO_NODE_ENV = "PASEO_NODE_ENV";
export interface NodeEntrypointSpec {
entryPath: string;
@@ -38,7 +39,7 @@ export function createElectronNodeEnv(
return {
...baseEnv,
ELECTRON_RUN_AS_NODE: "1",
...(options?.isPackaged === true ? { NODE_ENV: "production" } : {}),
...(options?.isPackaged === true ? { [PASEO_NODE_ENV]: "production" } : {}),
};
}

1
packages/desktop/src/daemon/runtime-paths.ts
View File

@@ -257,6 +257,7 @@ function spawnAsync(
): Promise<{ stdout: string; stderr: string; exitCode: number | null }> {
return new Promise((resolve, reject) => {
const child = spawnProcess(command, args, {
envMode: "internal",
env: options.env,
stdio: ["ignore", "pipe", "pipe"],
});

7
packages/desktop/src/login-shell-env.ts
View File

@@ -54,11 +54,16 @@ function resolveShellEnv(): Record<string, string> | undefined {
}
}
const shellEnv = { ...process.env };
delete shellEnv.PASEO_NODE_ENV;
delete shellEnv.PASEO_DESKTOP_MANAGED;
delete shellEnv.PASEO_SUPERVISED;
const result = spawnSync(shell, [...shellArgs, command], {
encoding: "utf8",
timeout: RESOLVE_TIMEOUT_MS,
env: {
...process.env,
...shellEnv,
ELECTRON_RUN_AS_NODE: "1",
ELECTRON_NO_ATTACH_CONSOLE: "1",
},