Isolate the PythonInterpreter Deno cache

[isaacbmiller]

Summary

• preserve the shared Deno cache so already-warm installations still start offline
• revoke the runner's cache read permission after Pyodide has loaded, preventing guest code from reading unrelated cache contents
• reject write mounts overlapping either the bundled runner or its Deno cache
• leave custom deno_command behavior unchanged

Scope

The production diff is 17 changed lines across python_interpreter.py and runner.js (14 additions, 3 deletions).

Verification

• uv run pytest tests/primitives/test_python_interpreter.py -q --deno — 102 passed
• focused live tests verify both that a cache canary is unreadable to guest code and that a warm shared cache starts under --cached-only
• ruff check --fix-only --diff --exit-non-zero-on-fix ... — clean
• git diff --check — clean

[greptile-apps]

Greptile Summary

PythonInterpreter now starts from the existing warmed Deno cache in offline environments and revokes generated code’s access to unrelated cache files after Pyodide initialization. The exercised offline startup path returned the expected result, and focused cache-access coverage passed.

Confidence Score: 5/5

Safe to merge: offline startup succeeds from a warmed shared cache while unrelated cache contents remain inaccessible to generated code.

No blocking failure remains.

T-Rex Logs

What T-Rex did

• The end-to-end Python validation ran to warm a fresh shared Deno cache, ensured no child cache existed, forced cached-only startup, and executed the default interpreter.
• The warm-cache command exited successfully and the offline interpreter evaluated 40 + 2 as 42, while an attempt to read an unrelated shared-cache canary was denied.
• All four PythonInterpreter cache tests passed, confirming offline-warmed startup and that cache access is revoked after initialization.
• The code-path validation notes that python_interpreter.py obtains the active Deno directory for initial runtime loading and forwards it as --dspy-deno-dir, while runner.js loads Pyodide and revokes read permission on the cache directory.
• The test-suite validation confirms which tests cover cache confidentiality and revocation (test_python_interpreter.py ranges 272–303 and 533–547) and shows the validation script exited successfully.

_{Ran code and verified through T-Rex}

_{Reviews (2): Last reviewed commit: "Revoke Deno cache access after startup" | Re-trigger Greptile}