kernel: don't let the workspace shadow the stdlib

Found by running the real binary for the first time. The run happened to
be in /tmp, which contained a stray inspect.py, and the kernel never
booted — 'python -m' prepends the cwd to sys.path, so that file shadowed
the stdlib module that dataclasses imports.

This is not an edge case for a coding agent. It works inside other
people's repositories, and those are full of files called types.py,
token.py, code.py and parser.py. Any one of them would have taken the
kernel down on that repo and nowhere else.

Two changes: the kernel now starts in the workspace via current_dir, so
relative paths in a cell mean what the model expects; and PYTHONSAFEPATH
keeps that directory off sys.path.

The regression test plants inspect.py, types.py and token.py in the
workspace. It fails without the fix — verified, not assumed.

Worth noting the model diagnosed this correctly and unaided from the
traceback we surface, named the shadowing file, and offered three fixes.
The error path works.

Author: Florian Standhartinger

codex-rs/chutes-rlm/src/kernel.rs

@@ -140,7 +140,20 @@ impl RlmKernel {
             .stdout(Stdio::piped())
             .stderr(Stdio::piped())
             .kill_on_drop(true)
+            // Start in the workspace rather than inheriting the agent's cwd,
+            // so relative paths in a cell mean what the model expects.
+            .current_dir(&config.cwd)
             .env("PYTHONUNBUFFERED", "1")
+            // ...but do NOT put that directory on sys.path.
+            //
+            // `python -m` prepends the cwd, so any file in the user's repo named
+            // like a stdlib module shadows it and the kernel dies before it
+            // boots. Not hypothetical: the first run of the real binary happened
+            // to be in /tmp, which contained a stray `inspect.py`, and the kernel
+            // never came up. A coding agent works inside other people's
+            // repositories, and those are full of `types.py`, `token.py`,
+            // `code.py` and `parser.py`.
+            .env("PYTHONSAFEPATH", "1")
             .env(
                 "CHUTESCODER_RLM_MAX_REPR",
                 config.max_repr_bytes.to_string(),

codex-rs/chutes-rlm/src/kernel_tests.rs

@@ -426,3 +426,33 @@ async fn a_kernel_that_ignores_its_deadline_still_only_costs_one_turn() {
     );
     kernel.shutdown().await;
 }
+
+#[tokio::test(flavor = "multi_thread")]
+async fn a_stdlib_shadowing_file_in_the_workspace_does_not_kill_the_kernel() {
+    require_python!();
+    // A coding agent works inside other people's repositories, and those are
+    // full of files named like stdlib modules. `python -m` prepends the CWD to
+    // sys.path, so without PYTHONSAFEPATH a stray `inspect.py` takes the kernel
+    // down before it boots. Found by running the real binary in /tmp.
+    let dir = tempfile::tempdir().expect("tempdir");
+    for shadow in ["inspect.py", "types.py", "token.py"] {
+        std::fs::write(dir.path().join(shadow), "raise RuntimeError('shadowed')\n")
+            .expect("write shadow module");
+    }
+
+    let config = KernelConfig {
+        package_path: Some(package_path()),
+        cwd: dir.path().to_string_lossy().to_string(),
+        ..Default::default()
+    };
+    let (dispatch, _) = StubDispatch::new();
+    // The kernel now starts *in* config.cwd, so this really does put the
+    // shadowing files where `python -m` would otherwise find them first.
+    let kernel = RlmKernel::start(config, dispatch, None)
+        .await
+        .expect("the kernel must boot even next to stdlib-shadowing files");
+
+    let res = kernel.execute("import inspect, types, token\n'ok'", None).await.expect("cell runs");
+    assert_eq!(res.repr.as_deref(), Some("ok"), "{res:?}");
+    kernel.shutdown().await;
+}