Files
Aperant/apps/backend/core/dependency_validator.py
T
StillKnotKnown 48bd4a9c07 fix(linux): ensure secretstorage is bundled in Linux binary (ACS-310) (#1211)
* fix(linux): add secretstorage to platform-critical packages (ACS-310)

Linux binary installations were missing the `secretstorage` package,
causing OAuth token storage via Freedesktop.org Secret Service to fail
silently. The build script cache was created before secretstorage was
added to requirements.txt (Jan 16, 2026), so the package was not being
validated during bundling.

Changes:
- Add platform-aware critical packages validation in download-python.cjs
- Add platform-aware critical packages validation in python-env-manager.ts
- Add Linux secretstorage warning in dependency_validator.py
- Add comprehensive tests for Linux secretstorage validation

The fix follows the same pattern as the Windows pywin32 fix (ACS-306):
- Platform-specific packages are only validated on their target platform
- Linux: secretstorage (OAuth token storage via keyring)
- Windows: pywintypes (MCP library dependency)
- macOS: No platform-specific packages

The Linux validation emits a warning (not blocking error) since the app
gracefully falls back to .env file storage when secretstorage is unavailable.

Refs: ACS-310

* fix(tests): mock pywintypes import in Windows/macOS secretstorage tests

The tests test_windows_skips_secretstorage_validation and
test_macos_skips_secretstorage_validation were failing on Windows CI
because they didn't mock the pywintypes import. When running on
actual Windows in CI, the pywin32 validation runs first and exits
because pywin32 isn't installed in the test environment.

The fix mocks pywintypes to succeed so we can properly test that
secretstorage validation is skipped on non-Linux platforms.

* fix(linux): address CodeRabbit review comments for ACS-310

Changes made based on CodeRabbit AI review:

Backend (dependency_validator.py):
- Rename _exit_with_secretstorage_warning to _warn_missing_secretstorage
  to accurately reflect that it doesn't exit (it only emits a warning)
- Add sys.stderr.flush() to ensure warning is immediately visible

Frontend (download-python.cjs):
- Fix critical __init__.py validation logic - packages are now only considered
  valid if directory+__init__.py exists OR single-file module exists

Frontend (python-env-manager.ts):
- Use platform abstraction (isWindows(), isLinux()) instead of process.platform
- Fix critical packages validation to match download-python.cjs logic

Tests (test_dependency_validator.py):
- Update function name to _warn_missing_secretstorage
- Add is_windows patches to Linux tests to prevent pywin32 validation
  from running on Windows CI

Refs: ACS-310

* fix(tests): mock requestAnimationFrame for xterm integration tests

* style: fix ruff formatting in test_dependency_validator.py

* fix: address CodeRabbit review comments for ACS-310

- Fix venv activation warning to only suggest sourcing activate script
  when it actually exists (not for system Python)
- Move secretstorage from critical to optional packages in frontend
  runtime check to avoid forcing venv creation on Linux (build script
  still validates it as critical)
- Update test_windows_skips_secretstorage_validation to properly
  exercise Windows path by mocking is_windows
- Add test for activation instruction omission when script doesn't exist

Refs: ACS-310

* fix: address Auto Claude PR review feedback (CRITICAL+HIGH+MEDIUM+LOW issues)

CRITICAL: Remove Python 3.12+ version check from Windows pywin32 validation
- pywin32 is required on ALL Python versions on Windows per ACS-306
- MCP library unconditionally imports win32api, not just on Python 3.12+
- Changed from `if is_windows() and sys.version_info >= (3, 12):` to `if is_windows():`

HIGH: Update tests to validate pywin32 on Python 3.10 and 3.11 on Windows
- Replaced `test_windows_python_311_skips_validation` with `test_windows_python_311_validates_pywin32`
- Replaced `test_windows_python_310_skips_validation` with `test_windows_python_310_validates_pywin32`
- Both tests now verify that validation RUNS on these Python versions

MEDIUM: Extract duplicated platformCriticalPackages to single constant
- Created PLATFORM_CRITICAL_PACKAGES constant at module scope in download-python.cjs
- Both validation locations now reference the same constant
- Added clarifying comment about intentional difference from python-env-manager.ts

LOW: Fix step numbering inconsistency in warning message
- When venv activate script doesn't exist, "Install secretstorage:" is shown (no step number)
- When activate script exists, "1. Activate... 2. Install..." is shown
- Matches the pattern used in _exit_with_pywin32_error()

LOW: Update comments to clarify build vs runtime package classification
- download-python.cjs treats secretstorage as critical (must be bundled)
- python-env-manager.ts treats secretstorage as optional (logs warning, doesn't block)
- Comments now explain this intentional difference

Refs: ACS-310, ACS-306

* fix(tests): mock is_windows/is_linux directly in graphiti import test

Fix Windows CI test failure by properly mocking platform detection functions
instead of just sys.platform. The test_validate_platform_dependencies_does_not_import_graphiti
test now patches core.dependency_validator.is_windows/is_linux to avoid pywin32
import issues on Windows CI.

Refs: ACS-310, ACS-253

* fix(tests): fix flawed assertion logic in activation omission test

Replace the faulty 'or' assertion with a proper check using all() to verify
that no line contains the 'source' substring when activation script doesn't exist.
The previous logic 'assert "source" not in message or "source" not in message.split("\n")'
was logically incorrect and could produce false positives.

Addressed CodeRabbit review comment.

Refs: ACS-310

* test: add assertion to verify warning not called when secretstorage installed

Update test_linux_with_secretstorage_installed_continues to patch and assert
that _warn_missing_secretstorage is NOT called when secretstorage is installed.
This ensures the test properly verifies that no warning is emitted in the
success case, matching the pattern used in other tests in this class.

Addressed CodeRabbit refactor suggestion.

Refs: ACS-310

---------

Co-authored-by: StillKnotKnown <stillknotknown@users.noreply.github.com>
2026-01-16 22:34:59 +01:00

135 lines
4.6 KiB
Python

"""
Dependency Validator
====================
Validates platform-specific dependencies are installed before running agents.
"""
import sys
from pathlib import Path
from core.platform import is_linux, is_windows
def validate_platform_dependencies() -> None:
"""
Validate that platform-specific dependencies are installed.
Raises:
SystemExit: If required platform-specific dependencies are missing,
with helpful installation instructions.
"""
# Check Windows-specific dependencies (all Python versions per ACS-306)
# pywin32 is required on all Python versions on Windows - MCP library unconditionally imports win32api
if is_windows():
try:
import pywintypes # noqa: F401
except ImportError:
_exit_with_pywin32_error()
# Check Linux-specific dependencies (ACS-310)
# Note: secretstorage is optional for app functionality (falls back to .env),
# but we validate it to ensure proper OAuth token storage via keyring
if is_linux():
try:
import secretstorage # noqa: F401
except ImportError:
_warn_missing_secretstorage()
def _exit_with_pywin32_error() -> None:
"""Exit with helpful error message for missing pywin32."""
# Use sys.prefix to detect the virtual environment path
# This works for venv and poetry environments
# Check for common Windows activation scripts (activate, activate.bat, Activate.ps1)
scripts_dir = Path(sys.prefix) / "Scripts"
activation_candidates = [
scripts_dir / "activate",
scripts_dir / "activate.bat",
scripts_dir / "Activate.ps1",
]
venv_activate = next((p for p in activation_candidates if p.exists()), None)
# Build activation step only if activate script exists
activation_step = ""
if venv_activate:
activation_step = (
"To fix this:\n"
"1. Activate your virtual environment:\n"
f" {venv_activate}\n"
"\n"
"2. Install pywin32:\n"
" pip install pywin32>=306\n"
"\n"
" Or reinstall all dependencies:\n"
" pip install -r requirements.txt\n"
)
else:
# For system Python or environments without activate script
activation_step = (
"To fix this:\n"
"Install pywin32:\n"
" pip install pywin32>=306\n"
"\n"
" Or reinstall all dependencies:\n"
" pip install -r requirements.txt\n"
)
sys.exit(
"Error: Required Windows dependency 'pywin32' is not installed.\n"
"\n"
"Auto Claude requires pywin32 on Windows for:\n"
" - MCP library (win32api, win32con, win32job modules)\n"
" - LadybugDB/Graphiti memory integration\n"
"\n"
f"{activation_step}"
"\n"
f"Current Python: {sys.executable}\n"
)
def _warn_missing_secretstorage() -> None:
"""Emit warning message for missing secretstorage.
Note: This is a warning, not a hard error - the app will fall back to .env
file storage for OAuth tokens. We warn users to ensure they understand the
security implications.
"""
# Use sys.prefix to detect the virtual environment path
venv_activate = Path(sys.prefix) / "bin" / "activate"
# Only include activation instruction if venv script actually exists
activation_prefix = (
f"1. Activate your virtual environment:\n source {venv_activate}\n\n"
if venv_activate.exists()
else ""
)
# Adjust step number based on whether activation step is included
install_step = (
"2. Install secretstorage:\n"
if activation_prefix
else "Install secretstorage:\n"
)
sys.stderr.write(
"Warning: Linux dependency 'secretstorage' is not installed.\n"
"\n"
"Auto Claude can use secretstorage for secure OAuth token storage via\n"
"the system keyring (gnome-keyring, kwallet, etc.). Without it, tokens\n"
"will be stored in plaintext in your .env file.\n"
"\n"
"To enable keyring integration:\n"
f"{activation_prefix}"
f"{install_step}"
" pip install 'secretstorage>=3.3.3'\n"
"\n"
" Or reinstall all dependencies:\n"
" pip install -r requirements.txt\n"
"\n"
"Note: The app will continue to work, but OAuth tokens will be stored\n"
"in your .env file instead of the system keyring.\n"
"\n"
f"Current Python: {sys.executable}\n"
)
sys.stderr.flush()
# Continue execution - this is a warning, not a blocking error