Skip to content

Conversation

@Jackmin801
Copy link
Member

@Jackmin801 Jackmin801 commented Jan 26, 2026

Note

Adds secure pull/build/install flow and caching for private environments with comprehensive tests.

  • prime env install: For PRIVATE envs lacking simple_index_url/wheel_url, auto-downloads source (package_url), securely extracts (_safe_tar_extract), determines version from pyproject.toml, caches under ~/.prime/wheel_cache/{owner}/{name}/{version}, builds a wheel (prefers uv build), and installs from the cached wheel; honors --no-upgrade and logs cache reuse
  • New helpers: _safe_tar_extract (blocks symlinks, hardlinks, absolute paths, and traversal), _validate_path_component, _get_env_cache_dir, _get_version_from_pyproject, _pull_and_build_private_env (handles download, cache, build, metadata)
  • Tests: tests/test_private_env_install.py validates cache creation, environment loadability, cache reuse, path component validation, and tar extraction safety

Written by Cursor Bugbot for commit 4de6244. This will update automatically on new commits. Configure here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants