Fix sporadic nuclei test failures from stale template state / Nuclei Environment isolation

[liquidsec]

When nuclei -update-templates is killed mid-extract (scan abort, test timeout, OOM), it can leave its version marker on disk while the templates directory is empty. The next invocation reads the marker, reports No new updates found, and runs against a directory that doesn't contain the requested template path, producing zero findings and silently failing every TestNuclei* rerun.

Shield the update subprocess from outer cancels so it can't be torn mid-extract, and after the update verify the templates dir actually contains http/. If not, wipe both the marker (~/.config/nuclei/.templates-config.json) and the partial dir, then retry once before hard-failing setup.

[codecov]

Codecov Report

❌ Patch coverage is 89.47368% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 90%. Comparing base (e892c8c) to head (e6c9b9d).
⚠️ Report is 62 commits behind head on dev.

Files with missing lines	Patch %	Lines
bbot/modules/nuclei.py	84%	8 Missing ⚠️

Additional details and impacted files

@@          Coverage Diff          @@
##             dev   #3096   +/-   ##
=====================================
- Coverage     90%     90%   -0%     
=====================================
  Files        444     444           
  Lines      38338   38403   +65     
=====================================
+ Hits       34284   34334   +50     
- Misses      4054    4069   +15     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

📊 Performance Benchmark Report

Comparing dev (baseline) vs nuclei-template-update-race (current)

📈 Detailed Results (All Benchmarks)

📋 Complete results for all benchmarks - includes both significant and insignificant changes

🧪 Test Name	📏 Base	📏 Current	📈 Change	🎯 Status
Bloom Filter Dns Mutation Tracking Performance	4.23ms	3.88ms	-8.3% ⚪	✅
Bloom Filter Large Scale Dns Brute Force	19.22ms	18.61ms	-3.2% ⚪	✅
Large Closest Match Lookup	334.68ms	328.67ms	-1.8% ⚪	✅
Realistic Closest Match Workload	175.02ms	175.95ms	+0.5% ⚪	✅
Event Memory Medium Scan	1784 B/event	1784 B/event	+0.0% ⚪	✅
Event Memory Large Scan	1768 B/event	1768 B/event	+0.0% ⚪	✅
Event Validation Full Scan Startup Small Batch	369.70ms	370.82ms	+0.3% ⚪	✅
Event Validation Full Scan Startup Large Batch	522.10ms	521.55ms	-0.1% ⚪	✅
Make Event Autodetection Small	25.81ms	25.87ms	+0.2% ⚪	✅
Make Event Autodetection Large	264.20ms	266.00ms	+0.7% ⚪	✅
Make Event Explicit Types	11.38ms	11.53ms	+1.4% ⚪	✅
Excavate Single Thread Small	3.348s	3.364s	+0.5% ⚪	✅
Excavate Single Thread Large	9.119s	9.109s	-0.1% ⚪	✅
Excavate Parallel Tasks Small	3.587s	3.588s	+0.0% ⚪	✅
Excavate Parallel Tasks Large	6.223s	6.198s	-0.4% ⚪	✅
Is Ip Performance	2.90ms	2.94ms	+1.2% ⚪	✅
Make Ip Type Performance	10.56ms	10.73ms	+1.7% ⚪	✅
Mixed Ip Operations	4.16ms	4.17ms	+0.2% ⚪	✅
Memory Use Web Crawl	675.8 MB	640.8 MB	-5.2% ⚪	✅
Memory Use Subdomain Enum	33.3 MB	33.3 MB	+0.0% ⚪	✅
Memory Use Deep Chain	7.8 MB	7.8 MB	+0.0% ⚪	✅
Memory Use Parallel Chains	22.2 MB	19.0 MB	-14.4% 🟢🟢	🚀
Scan Throughput 100	3.350s	3.455s	+3.1% ⚪	✅
Scan Throughput 1000	26.356s	26.380s	+0.1% ⚪	✅
Typical Queue Shuffle	56.62µs	57.46µs	+1.5% ⚪	✅
Priority Queue Shuffle	620.13µs	621.78µs	+0.3% ⚪	✅

🎯 Performance Summary

+ 1 improvement 🚀
  25 unchanged ✅

🔍 Significant Changes (>10%)

• Memory Use Parallel Chains: 14.4% 🚀 less memory

---

🐍 Python Version 3.11.15

[liquidsec]

Pushed a follow-up after review feedback flagged that the os.environ.copy() in _nuclei_env() was leaking the user's environment into the pinned binary. Three issues confirmed against nuclei v3.8.0 source + Go stdlib:

1. XDG_CONFIG_HOME / XDG_CACHE_HOME: Go's os.UserConfigDir() checks XDG_CONFIG_HOME before $HOME (src/os/file.go), and pd-utils' AppConfigDirOrDefault calls straight through. With XDG vars set in the host env (common on Linux), the HOME redirect was silently bypassed — the original stale-marker bug could still recur.
2. PDCP_API_KEY (the bad one): pd-utils/auth/pdcp/creds.go reads it directly from env. A user with PDCP creds set for their own work would have BBOT's scan findings uploaded to ProjectDiscovery Cloud under their account, with no warning.
3. GITHUB_TOKEN / AWS_* / AZURE_* / NUCLEI_SIGNATURE_* / DISABLE_NUCLEI_TEMPLATES_*: internal/runner/options.go:446-490 reads all of these directly; any of them set in the user's shell would change BBOT's template sources or signature validation.

Fix is an allowlist (PATH, locale, TZ, proxy vars) with explicit HOME / USERPROFILE / APPDATA / LOCALAPPDATA + NUCLEI_CONFIG_DIR overrides. Allowlist beats blacklist because new env-driven nuclei features won't silently regress isolation.

New test TestNucleiEnvIsolation poisons the env with all the leakable vars before the scan, then asserts they don't reach _nuclei_env(). The base TestNucleiManual assertions piggyback as a regression check — nuclei still has to discover and run templates with DISABLE_NUCLEI_TEMPLATES_PUBLIC_DOWNLOAD=true and a bogus XDG_CONFIG_HOME in the host env.