mirror of
https://github.com/stablyai/orca.git
synced 2026-09-24 00:02:24 +00:00
Brennan Benson
4c49989c2e
PR 9501 shipped real-home routing for the host system default, and the env override that could turn it back off was never a shipped control. The managed-account half of the shared runtime mirror has been unreachable since: every host account routes to its own self-contained CODEX_HOME before that code runs. Delete the flag module and its env plumbing plus the managed branch of syncForCurrentSelection and the six helpers only it called. The three lanes that still use the shared mirror -- Windows, a custom CODEX_HOME, and a hook-lane gate that reports unusable -- are untouched, as are every legacy migration and the WSL read-back helpers.
111 lines
3.4 KiB
TypeScript
111 lines
3.4 KiB
TypeScript
import { mkdirSync, realpathSync } from 'node:fs'
|
|
import os from 'node:os'
|
|
import path from 'node:path'
|
|
|
|
const RESTRICTED_ENV_KEYS = new Set([
|
|
'HOME',
|
|
'USERPROFILE',
|
|
'HOMEDRIVE',
|
|
'HOMEPATH',
|
|
'CODEX_HOME',
|
|
'ORCA_CODEX_HOME',
|
|
'ORCA_E2E_USER_DATA_DIR',
|
|
'ORCA_E2E_HOME_DIR',
|
|
'ZDOTDIR',
|
|
'ORCA_ORIG_ZDOTDIR',
|
|
'BASH_ENV',
|
|
'ENV'
|
|
])
|
|
|
|
type ElectronHomeIsolationOptions = {
|
|
inheritedEnv: NodeJS.ProcessEnv
|
|
launchEnv: NodeJS.ProcessEnv
|
|
extraEnv: Record<string, string>
|
|
userDataDir: string
|
|
realHome?: string
|
|
}
|
|
|
|
export type ElectronHomeIsolation = {
|
|
env: NodeJS.ProcessEnv
|
|
isolatedHome: string
|
|
realHome: string
|
|
}
|
|
|
|
function normalizeComparablePath(candidatePath: string, platform = process.platform): string {
|
|
const normalized = path.resolve(candidatePath)
|
|
return platform === 'win32' ? normalized.toLowerCase() : normalized
|
|
}
|
|
|
|
export function areSameHomePath(left: string, right: string, platform = process.platform): boolean {
|
|
return normalizeComparablePath(left, platform) === normalizeComparablePath(right, platform)
|
|
}
|
|
|
|
function assertOverlayDoesNotReplaceIsolation(
|
|
overlay: NodeJS.ProcessEnv | Record<string, string>,
|
|
overlayName: string
|
|
): void {
|
|
const restrictedKey = Object.keys(overlay).find((key) =>
|
|
RESTRICTED_ENV_KEYS.has(key.toUpperCase())
|
|
)
|
|
if (restrictedKey) {
|
|
throw new Error(`${overlayName}.${restrictedKey} cannot override the E2E home boundary`)
|
|
}
|
|
}
|
|
|
|
function stripAmbientHomeAndCodexEnv(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv {
|
|
return Object.fromEntries(
|
|
Object.entries(env).filter(([key]) => !RESTRICTED_ENV_KEYS.has(key.toUpperCase()))
|
|
)
|
|
}
|
|
|
|
export function createElectronHomeIsolation({
|
|
inheritedEnv,
|
|
launchEnv,
|
|
extraEnv,
|
|
userDataDir,
|
|
realHome = os.homedir()
|
|
}: ElectronHomeIsolationOptions): ElectronHomeIsolation {
|
|
assertOverlayDoesNotReplaceIsolation(launchEnv, 'launchEnv')
|
|
assertOverlayDoesNotReplaceIsolation(extraEnv, 'orcaAppExtraEnv')
|
|
|
|
const requestedIsolatedHome = path.join(userDataDir, 'home')
|
|
mkdirSync(requestedIsolatedHome, { recursive: true, mode: 0o700 })
|
|
// Why: tmpdir-rooted paths are aliases (macOS /var symlink, Windows 8.3
|
|
// short names). Git canonicalizes worktree paths, so a non-canonical HOME
|
|
// makes freshly created worktrees invisible to Orca's listing comparisons.
|
|
const isolatedHome = realpathSync.native(requestedIsolatedHome)
|
|
// Why: a bad fixture path must fail before Electron can resolve a real Codex
|
|
// home; userData isolation alone does not change app.getPath('home').
|
|
if (areSameHomePath(isolatedHome, realHome)) {
|
|
throw new Error('Refusing to launch E2E with the developer home as its isolated HOME')
|
|
}
|
|
|
|
return {
|
|
isolatedHome,
|
|
realHome,
|
|
env: {
|
|
...stripAmbientHomeAndCodexEnv(inheritedEnv),
|
|
...launchEnv,
|
|
...extraEnv,
|
|
HOME: isolatedHome,
|
|
USERPROFILE: isolatedHome,
|
|
ORCA_E2E_USER_DATA_DIR: userDataDir,
|
|
ORCA_E2E_HOME_DIR: isolatedHome
|
|
}
|
|
}
|
|
}
|
|
|
|
export function assertElectronResolvedIsolatedHome(
|
|
actualHome: string,
|
|
isolation: Pick<ElectronHomeIsolation, 'isolatedHome' | 'realHome'>
|
|
): void {
|
|
if (
|
|
!areSameHomePath(actualHome, isolation.isolatedHome) ||
|
|
areSameHomePath(actualHome, isolation.realHome)
|
|
) {
|
|
// Why: a failed safety assertion can land in shared CI artifacts; do not
|
|
// print a developer username or native home path while reporting it.
|
|
throw new Error('Electron E2E HOME escaped the disposable profile boundary')
|
|
}
|
|
}
|