[#1811] Trim path env vars before resolving venv directories

[FekyBaz]

Hi, following up on #1811. I located the vulnerable path handling, implemented the proposed getEnvPath utility, and have a minimal patch ready. Per CONTRIBUTING.md I'm posting here first instead of opening a PR, and would like an implementation invite if the approach looks good.

Where the bug bites

packages/coding-agent/src/core/kernel/bootstrap.ts:

• getKernelVenvDir: if (override) is truthy for " ", so PRIME_AGENT_KERNEL_VENV=" " resolves to a bogus cwd-relative directory instead of falling back to ~/.prime/agent/kernel-venv.
• getXdgKernelVenvDir: same shape with XDG_DATA_HOME — a whitespace value skips the ~/.local/share fallback.

Both matter most in Docker/container environments where vars are often present-but-blank.

Fix

Added an exported getEnvPath(name) helper that returns the trimmed value, or undefined when missing, empty, or whitespace-only. Both venv-dir functions now consume it; since callers still pass the result through expandHome/path.resolve, the returned path is always absolute. No behavior change for well-formed values (including ~-prefixed ones).

Validation

New tests in packages/coding-agent/test/kernel-bootstrap.test.ts:

• empty/whitespace PRIME_AGENT_KERNEL_VENV → falls back to the default dir;
• getEnvPath unit cases: missing/empty/whitespace → undefined, padded value → trimmed, and the trimmed override still wins in getKernelVenvDir.

Both new tests fail on unfixed main and pass with the patch. Also verified: biome check clean, tsgo --noEmit clean. (Note: most other tests in kernel-bootstrap.test.ts fail on Windows because they shell out to uv with POSIX venv paths — pre-existing environment issue, unrelated to this change.)

Plus the required changelog fragment packages/coding-agent/.changes/1811-env-path-trim.md.

Patch branch (on my fork, not a PR): FekyBaz/prime-agent@fix/env-path-trim-1811 — 3 files, +47/−6.

One scoping note: getHomeDir in package-manager.ts (process.env.HOME || homedir()) and the HOME/USERPROFILE fallback in tree-selector.ts have the same whitespace-truthy shape. I left them out to keep this change focused, but happy to extend the helper there too if you'd like. Thanks!

[awhite0030]

Investigated this report and produced a candidate fix, validated on a fork of this repository.

Root cause, fix and validation from the working notes:

Root cause: getKernelVenvDir and getXdgKernelVenvDir incorrectly bypassed their default directory fallbacks when PRIME_AGENT_KERNEL_VENV and XDG_DATA_HOME environment variables contained whitespace-only strings.
Fix: Added a getEnvPath helper function to trim environment variables before evaluation, returning undefined for missing, empty, or whitespace-only values. Updated getKernelVenvDir and getXdgKernelVenvDir to use this new helper.
Validation: Ran npx tsx ../../node_modules/vitest/dist/cli.js --run test/suite/regressions/1811-env-path-trim.test.ts from packages/coding-agent (passed), npx tsx ../../node_modules/vitest/dist/cli.js --run test/kernel-bootstrap.test.ts from packages/coding-agent (passed), and npm run check from the repository root (passed).
Upstream discussion: #2012

Diff: awhite0030/prime-agent@main...fix/env-path-trim-1811-5450901552170605134
Full pull request: awhite0030#51

The change passes npm run check and the focused regression tests against current main. If a fix for this is still wanted, I can open a pull request.

[FekyBaz]

@awhite0030 Thanks for picking this up — and yes, please open the upstream PR.

I reviewed the diff on your fork: the getEnvPath helper plus both call sites is exactly the minimal shape this needs, the regression tests cover missing/empty/whitespace/valid-trimmed plus both fallback paths, and the changelog fragment follows the repo convention. One tiny note: the rewrapped getXdgKernelVenvDir line is long — if npm run check (biome) flags it, a two-line format keeps it clean.

Once the PR is up against the branch CONTRIBUTING.md prescribes, happy to verify it there.