[mldangelo-oai]

Summary

An SDK process running under a numeric Linux UID can have neither a passwd entry nor a home directory. In that environment, scan preflight and interpreter discovery called os.homedir() even with explicit absolute storage and cache paths. Node threw uv_os_homedir returned ENOENT before the SDK could use those paths.

Changes

Look up the home directory when expanding a tilde path or constructing the default Python cache path. An explicit managed runtime list, XDG cache, or ordinary absolute path can now be used directly.

Testing

• Both focused regressions failed before the change and passed afterward. SDK build, plugin build, type checks, and formatting passed.
• Ran public SDK preflight in Debian/glibc and Alpine/musl as a numeric UID absent from the container's passwd file, with HOME and USERPROFILE unset. Both returned the intended one-file scope.
• On Debian, the SDK selected the actual Python 3.11 interpreter and completed an offline mock scan through the normal reporting and history path. The resulting report contained the expected 12 synthetic findings.

Risk and rollout

Tilde expansion and the default cache still use the platform home. The standalone CLI's command parser also looks up a home during import. CLI users running without a passwd entry can set HOME to a private directory.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-09T20:36:42.861144Z	cced263	PR opened
🔒 Security Review	✅ Completed 2026-11-09T20:37:23.008672Z	cced263	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[alandelong-oai]

Thanks for fixing this. No blocking findings in this merge-safety review. Deferring home lookup preserves tilde/default-cache behavior while allowing explicitly configured paths and runtimes to work without an account home.

Both focused no-home regressions passed, along with TypeScript and changed-file formatting. This verifies the throwing-home scenario through SDK preflight and Python discovery; a native numeric-UID container scan and the full SDK suite were not independently run.

A built public SDK smoke also passed with HOME/USERPROFILE unset and homedir forced to throw, with zero home lookups during preflight; five path controls passed.