* Narrow the modern-python shims to the commands uv run replaces
Closes#207.
The shims sit on PATH, so they intercept every subprocess any tool
spawns, not just what Claude types. Two of the intercepted invocations
were not package management at all, and blocking them broke real tooling.
`uv pip` now passes through when it carries --project, --directory or
--target. Those say a tool is building an environment it owns, where
`uv add` is not the available advice: prek installs every hook with
`uv pip install --project / --directory <cache>`, so the refusal made
`git commit` fail in any repo whose hooks need a Python environment.
A bare `uv pip install requests` is still refused.
`python -c`, `python -m <module>` and `python -` now reach the real
interpreter. None of them resolves a script against a project's
dependencies, which is what `uv run` exists to do, and `uv run python3 -`
is not a drop-in replacement inside a pipeline. `python -m pip` stays
intercepted, as do bare `python` and `python script.py`.
Passing anything through is new for the python shim, which previously
ended every branch in exit 1, so it gains the same skip-my-own-dir PATH
walk the uv shim already had. That walk now uses parameter expansion
rather than basename, because the one case where it must report failure
is a PATH holding nothing but the shim, where shelling out to coreutils
fails first with a confusing error.
Verified by A/B on the two symptoms #207 reports, running each suite
against the old shim and the new one:
- zeroize-audit's rust-regression smoke test: FAILED at line 72 before,
"Rust regression smoke checks passed." after.
- prek hook installation from a cold cache: refused before, "check json
Passed" after.
bats goes from 19 cases to 38. Five python cases inverted rather than
being deleted: the ones asserting that -c and -m are refused now assert
they run. AGENTS.md's note on `make shell-suites` is corrected rather
than removed — the #207 interceptions are gone, but the target still
fails because variant-analysis invokes `python3 <script>.py`, which the
shim intercepts by design. That one belongs to variant-analysis.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Decide on the mode selector, not on argument position
Two gaps in the narrowing, both from review.
`uv pip install --help` documents `-t, --target <TARGET>`, so the short
form has to be exempt alongside the long one. Without it the same
tool-managed install was allowed or refused depending on spelling.
The python shim read only $1 to find the mode selector, so `python -u -c
'code'` was refused while `python -c 'code'` ran, even though they are
the same invocation. It now steps over interpreter flags to find the
selector, giving `-W`, `-X` and `--check-hash-based-pycs` the two slots
they take. `-u -m pip` is still refused, and so is `-u script.py`: a
script path is what `uv run` replaces regardless of what precedes it.
bats 38 -> 43. Both #207 regressions re-verified after the restructure:
zeroize-audit's smoke test passes and prek installs hooks from a cold
cache.
Not fixed here, deliberately: `uv --no-progress pip install requests`
still slips past the refusal, because the subcommand check reads $1 as
well. Parsing that correctly means knowing which uv global flags take a
value, and getting it wrong would refuse a command that works today. The
failure mode is a missed nudge rather than a breakage — the real uv runs
and behaves correctly — so it does not belong in a change whose purpose
is to refuse less.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(modern-python): suggest exact `uv run python` so the advice works outside projects
The python/python3 shim suggested `uv run $cmd ...`, echoing back whichever
name was invoked. For `python3` that advice is self-defeating on machines
with no uv-managed interpreters: uv resolves the `python3` command through
an ordinary PATH lookup, which hits the shim again and fails with the same
suggestion. uv special-cases the exact command name `python` (uv >= 0.4.0)
and executes its resolved interpreter directly, so always suggesting
`uv run python ...` works everywhere.
Reproduced on stock Debian + uv 0.11.27 (apt python3, zero managed
pythons, no project): `uv run python3 script.py` fails via the shim while
`uv run python script.py` succeeds, across script/-c/-m/REPL forms.
Reported in #195.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(modern-python): satisfy shellcheck SC2016 in new bats assertions
Escaped backticks in double quotes instead of literal backticks in
single quotes, which shellcheck flags as a possible unintended
non-expansion.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(modern-python): requote shim suggestions and carry all arguments through
Review findings on #196: the -m branch interpolated only the module name,
so `python -m http.server 8000` suggested a command missing the port, and
`${*}` flattened arguments without quoting, so `python -c 'print(1+1)'`
suggested a command that is a bash syntax error if run verbatim (plus a
trailing space inside the backticks for bare invocations). Both branches
now build the suggestion from %q-requoted arguments, with regression tests
for each case.
Also consolidates the exact-`python` rationale into a single canonical
copy in the shim's header comment; README, setup-shims.sh, and the bats
file now point there instead of paraphrasing it.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* use PATH shim override technique instead of hooking every pre tool usage
* remove unecessary check
* fix: resolve code review findings for PR #89
P1 fixes:
- setup-shims.sh: Add CLAUDE_ENV_FILE guard to prevent opaque
'unbound variable' crash when env var is unset (matches
gh-cli plugin pattern)
P2 fixes:
- setup-shims.sh: Guard shims_dir resolution failure to prevent
empty PATH prefix on partial installs
- shims/uv: Fix shfmt formatting (here-string spacing)
- shims/uv: Resolve PATH entries before comparison to prevent
exec loop with symlinked/unnormalized paths
- shims/uv: Use ${PATH:-} to handle unset PATH defensively
- setup-shims.bats: Add test for unset CLAUDE_ENV_FILE
- uv-shim.bats: Add test for 'real uv not found' error path
P3 dismissed:
- CI linting gap for extensionless shim scripts: accepted as-is
since shims must masquerade as real binaries (no .sh extension);
manual review covers these files
- Unset PATH in uv shim: addressed by ${PATH:-} fix above
All 27 bats tests pass. shellcheck and shfmt clean.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Dan Guido <dan@trailofbits.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Dan Guido