Skip to content

fix(cli): guard init database_string from Typer OptionInfo leakage#5064

Open
SergioChan wants to merge 3 commits intoSkyvern-AI:mainfrom
SergioChan:fix/init-database-string-optioninfo-4666
Open

fix(cli): guard init database_string from Typer OptionInfo leakage#5064
SergioChan wants to merge 3 commits intoSkyvern-AI:mainfrom
SergioChan:fix/init-database-string-optioninfo-4666

Conversation

@SergioChan
Copy link
Copy Markdown

Summary

  • guard init_env() against non-string database_string values
  • treat leaked Typer OptionInfo defaults as empty strings and fall back to standard PostgreSQL setup
  • add unit coverage for database string normalization and the two init paths (custom DSN vs fallback)

Why

Issue #4666 reports a Windows blocker where skyvern init can pass an OptionInfo object through to env writing (set_key), causing:
AttributeError: 'OptionInfo' object has no attribute 'replace'.

This patch hardens the init flow so non-string inputs do not get written as DATABASE_STRING.

Scope

This PR addresses the OptionInfo blocker portion of #4666.
It does not change the separate Windows migration/event-loop behavior discussed in that issue.

Validation

  • python -m compileall skyvern/cli/init_command.py tests/unit/test_init_command.py
  • runtime check of _normalize_database_string via Python AST extraction (string input preserved; Typer OptionInfo coerced to empty string)

Copy link
Copy Markdown
Contributor

@AronPerez AronPerez left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Auto-Review: PR #5064

Build Status

  • No CI checks reported on this branch.

Findings Summary

  • 1 suggestion (see inline comment on _normalize_database_string)
  • The fix is correct — _normalize_database_string() properly guards against Typer's OptionInfo leaking through. Both init_command.py and quickstart.py are patched. Test coverage is good.

Agreement with Claude's Review

  • No Claude review found.

Reviewed by AronPerez's auto-reviewer

Comment thread skyvern/cli/init_command.py
Address review feedback on Skyvern-AI#5064 by normalizing non-string database_string values at the top of quickstart so OptionInfo leakage cannot bypass docker gating. Add focused unit coverage for non-string and string paths.
@SergioChan
Copy link
Copy Markdown
Author

Thanks for the review — great catch on quickstart().

I pushed a follow-up commit to this branch: b1a33bf7.

What changed

  • Normalized database_string at the top of quickstart() using _normalize_database_string(...).
    • This prevents OptionInfo leakage from bypassing the Docker gating / compose-choice logic.
  • Added focused unit coverage in tests/unit/test_quickstart_database_string.py:
    • test_quickstart_non_string_database_string_still_requires_docker
    • test_quickstart_string_database_string_skips_docker_requirement

Validation

  • python -m compileall skyvern/cli/quickstart.py tests/unit/test_quickstart_database_string.py

I also tried running pytest for the touched tests, but this environment is missing optional test dependency anthropic, which prevents importing the suite-level test fixtures.

@SergioChan
Copy link
Copy Markdown
Author

Thanks for the suggestion — agreed this was worth making explicit.

I pushed commit 2b84d71 to this PR branch adding an inline note next to _normalize_database_string clarifying why the helper intentionally accepts object (Typer can pass OptionInfo instead of str).

Validation run:

  • python -m pytest tests/unit/test_init_command.py tests/unit/test_quickstart_database_string.py (fails locally in this environment due to missing anthropic dependency)
  • python -m compileall skyvern/cli/init_command.py (passes)

Copy link
Copy Markdown
Contributor

@AronPerez AronPerez left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good, just 2 q's

from .mcp import setup_local_organization, setup_mcp


def _normalize_database_string(database_string: object) -> str:
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: _normalize_database_string is prefixed with _* as if it's private but it's exported. Make it public (normalize_database_string) or keep it private

Comment thread skyvern/cli/quickstart.py
) -> None:
"""Quickstart command to set up and run Skyvern with one command."""
# Typer OptionInfo can leak through when quickstart is called programmatically.
database_string = _normalize_database_string(database_string)
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

quickstart() normalizes database_string, then passes it to init_env() which normalizes it again. Why not normalize once here or init_env()?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants