Skip to content

Fix safe-path imports in review, hypothesis and uncertainty CLIs - #314

Closed
LassiL wants to merge 1 commit into
K-Dense-AI:mainfrom
LassiL:codex/fix-safe-path-sibling-imports
Closed

LassiL wants to merge 1 commit into
K-Dense-AI:mainfrom
LassiL:codex/fix-safe-path-sibling-imports

Conversation

@LassiL

@LassiL LassiL commented Oct 15, 2026

Copy link
Copy Markdown

When Python runs with -P or PYTHONSAFEPATH=1, all 20 CLI scripts in peer-review, hypothesis-generation, and uncertainty-and-units fail with ModuleNotFoundError: _common, including for --help. Python omits the automatically prepended script directory in this mode, so sibling imports cannot resolve.

Add the same explicit, resolved script-directory bootstrap already used by paper-lookup, before importing any sibling helper. Bump the three skill versions. These standalone commands can now load their own helpers without a PYTHONPATH workaround.

Regression tests cover every CLI using both safe-path mechanisms, copied skill folders with spaces, an unrelated working directory, and a conflicting helper on an explicit import path. Representative inputs also preserve JSON output and exit status, including the peer-review intake refusal. The 16 new peer-review cases failed before the fix and pass afterward.

Validation on Python 3.14.0, with each skill suite run in its own process and dependencies installed only in a temporary virtual environment:

  • python -B -m pytest -q -p no:cacheprovider tests/peer-review: 46 passed, 7 subtests passed.
  • python -B -m pytest -q -p no:cacheprovider tests/hypothesis-generation: 47 passed, 14 subtests passed.
  • python -B -m pytest -q -p no:cacheprovider tests/uncertainty-and-units: 127 passed, 107 subtests passed, no skips; numeric packages match tests/skill-requirements.toml.
  • python -B -m pytest -q -p no:cacheprovider tests/_meta: 18 passed, 4224 subtests passed.
  • skills-ref validate for all three changed skills and git diff --check: pass.
  • Independent read-only review: no blocking findings.

The separate requirement to install uncertainties for numerical propagation is unchanged. Cross-skill imports into a shared Python process remain outside this standalone-CLI fix. No Python 3.11/3.12 run or local security-scanner run was performed; the bootstrap uses the existing upstream pattern and only standard-library APIs.

Python behavior: https://docs.python.org/3/using/cmdline.html#cmdoption-P

@LassiL
LassiL marked this pull request as ready for review October 15, 2026 12:45
@LassiL LassiL closed this Oct 15, 2026
@LassiL
LassiL deleted the codex/fix-safe-path-sibling-imports branch October 15, 2026 12:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant