Conversation
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1e0611c933
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
1e0611c to
07e4217
Compare
07e4217 to
da52509
Compare
`UV.execution_context()` currently copies the bundled `uv` executable next to the installed binary before running it. That only works if the install directory is writable, which is not guaranteed for system-managed or otherwise protected prefixes. Copy the executable into a fresh temporary directory instead and execute it from there. This keeps the existing "run a copy of uv" behavior, which avoids modifying the in-use binary on Windows, while removing the dependency on write access to uv's install location.
da52509 to
27868b9
Compare
This comment has been minimized.
This comment has been minimized.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 27868b9a44
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| try: | ||
| safe_name = path.with_stem(f"{path.stem}-{path.id}").name | ||
| with temp_directory() as temp_dir: |
There was a problem hiding this comment.
Avoid executing uv from default temp mount
execution_context now always runs uv from a file copied into temp_directory(), which uses the system temp location by default. In hardened Linux environments where that temp filesystem is mounted noexec, launching this copied binary fails with EACCES/permission denied, so all uv-backed commands break even though the installed uv is valid. The previous implementation executed from the original install filesystem, so this is a regression for those hosts; pick an exec-capable writable directory (or fallback strategy) instead of unconditionally using the default temp dir.
Useful? React with 👍 / 👎.
UV.execution_context()currently copies the bundleduvexecutable next to the installed binary before running it. That only works if the install directory is writable, which is not guaranteed for system-managed or otherwise protected prefixes.Copy the executable into a fresh temporary directory instead and execute it from there. This keeps the existing "run a copy of uv" behavior, which avoids modifying the in-use binary on Windows, while removing the dependency on write access to uv's install location.