PYTHONSAFEPATH is not respected

[siddharthab]

Applies To

• Notebooks (.ipynb files)
• Interactive Window and/or Cell Scripts (.py files with #%% markers)

What happened?

In workspace .env file:

PYTHONSAFEPATH=1

A test file (can be either .ipynb cell or a %% block in a .py file):

import sys
print(sys.flags.safe_path)
print(sys.path)

When the cell is run with the Jupyter extension, the output is:

True
['/home/user/Workspaces/main/python', '/home/user/.mamba/lib/python311.zip', '/home/user/.mamba/lib/python3.11', '/home/user/.mamba/lib/python3.11/lib-dynload', '', '/home/user/.mamba/lib/python3.11/site-packages', '/home/user/.mamba/lib/python3.11/site-packages/setuptools/_vendor']

When run with the Python extension as a Python script, the output is:

True
['/home/user/Workspaces/main/python', '/home/user/.mamba/lib/python311.zip', '/home/user/.mamba/lib/python3.11', '/home/user/.mamba/lib/python3.11/lib-dynload', '/home/user/.mamba/lib/python3.11/site-packages', '/home/user/.mamba/lib/python3.11/site-packages/setuptools/_vendor']

Notice the empty string right before the site-packages directory when run with Jupyter. When sys.flags.safe_path is set (in this case through the PYTHONSAFEPATH=1 env var), this empty string should not be present.

VS Code Version

Version: 1.89.1-cde Commit: 982664f21043ab3f264d1705f0887679853d6af9 Date: 2024-10-30T00:53:56.119Z (2 wks ago) Browser: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Jupyter Extension Version

v2024.4.0

Jupyter logs

Code OSS for Cloud Workstations (1.89.1-cde, 80-sidb.cluster-2pt3hubcdrgtkwmwq6q2s55636.cloudworkstations.dev, desktop)
Jupyter Extension Version: 2024.4.0.
Python Extension Version: 2024.12.3.
Pylance Extension not installed.
Platform: linux (x64).
Workspace folder ~/Workspaces/main, Home = /home/user
18:34:08.995 [info] Process Execution: ~/.mamba/bin/python -m pip list
...[snipped]...
18:46:28.024 [info] Starting interactive window for resource '~/Workspaces/main/a.py' with controller '.jvsc74a57bd00a8a2dede04a01d79e22df88f0be047c97e484973fe05a0227d48a9c31c4bbbe./home/~/.mamba/python./home/~/.mamba/python.-m#ipykernel_launcher (Interactive)'
18:46:28.282 [info] Starting Kernel startUsingPythonInterpreter, .jvsc74a57bd00a8a2dede04a01d79e22df88f0be047c97e484973fe05a0227d48a9c31c4bbbe./home/~/.mamba/python./home/~/.mamba/python.-m#ipykernel_launcher  (Python Path: ~/.mamba/bin/python, Conda, base (Python 3.11.9), 3.11.9) for '/Interactive-1.interactive' (disableUI=false)
18:46:32.838 [info] Process Execution: ~/.mamba/bin/python -c "import ipykernel; print(ipykernel.__version__); print("5dc3a68c-e34e-4080-9c3e-2a532b2ccb4d"); print(ipykernel.__file__)"
18:46:32.872 [info] Process Execution: ~/.mamba/bin/python -m ipykernel_launcher --f=/home/~/.local/share/jupyter/runtime/kernel-v2-68139hamC8RXJPygd.json
    > cwd: ~/Workspaces/main
18:46:33.538 [info] Generated code for 1 = <ipython-input-1-fa9c31eb629c> with 4 lines
18:46:33.603 [info] Cell 1 completed in 0.002s (start: 1732041993601, end: 1732041993603)

Coding Language and Runtime Version

Python v3.11.9

Language Extension Version (if applicable)

Python v2024.12.3

Anaconda Version (if applicable)

micromamba 2.0.2

Running Jupyter locally or remotely?

Local

[siddharthab]

A workaround could be to have this in your User settings.json (other settings scopes do not have this setting).

    "jupyter.runStartupCommands": [
        "import sys",
        "sys.path = [p for p in sys.path if p != '']"
    ]

[DonJayamanne]

Please could you enable logging as follows:

• Open settings & go into Jupyter->Logging
• Change the value to trace
• Reload VS Code,
• Attempt to repro the issue & then copy the output from the Jupyter output panel (use the command Jupyter: Show Output to get to the logs).

[siddharthab]

Thank you @DonJayamanne for your interest. Complete trace output from a new session:

Visual Studio Code (1.94.2, undefined, desktop)
Jupyter Extension Version: 2024.9.1.
Python Extension Version: 2024.22.0.
Pylance Extension Version: 2024.12.1.
Platform: darwin (arm64).
Temp Storage folder ~/Library/Application Support/Code/User/globalStorage/ms-toolsai.jupyter/version-2024.9.1
Workspace folder ~/Workspaces/demo, Home = /Users/sidb
17:03:32.904 [debug] Start refreshing Kernel Picker (1734397412904)
17:03:33.127 [trace] Search for KernelSpecs in Interpreter /usr/bin/python3
17:03:33.128 [trace] Search for KernelSpecs in Interpreter /opt/homebrew/bin/python3.12
17:03:33.128 [trace] Search for KernelSpecs in Interpreter /opt/homebrew/bin/python3
17:03:33.128 [trace] Search for KernelSpecs in Interpreter ~/Workspaces/demo/.venv/bin/python
17:03:33.129 [trace] Search for KernelSpecs in Interpreter /opt/homebrew/anaconda3/bin/python
17:03:33.129 [debug] Get Custom Env Variables, Class name = Cm, completed in 225ms, has a truthy return value, Arg 1: undefined, Arg 2: "RunPythonCode"
17:03:33.129 [debug] Jupyter Paths /kernels: 
17:03:33.129 [debug] Kernel Spec Root Paths, /usr/share/jupyter/kernels, /usr/local/share/jupyter/kernels, ~/Library/Jupyter/kernels
17:03:33.327 [debug] KernelProvider switched kernel to id = .jvsc74a57bd010d6d58631b164f0ea2f302513310b4ca098cd9cb50027f0f20dc42988ab871b./Users/~/Workspaces/demo/.venv/python./Users/~/Workspaces/demo/.venv/python.-m#ipykernel_launcher
17:03:33.328 [debug] start the kernel, options.disableUI=true for ~/Workspaces/demo/demo.ipynb
17:03:33.328 [debug] Controller selection change completed
17:03:33.333 [debug] Get Custom Env Variables, Class name = Cm, completed in 0ms, has a truthy return value, Arg 1: "~/Workspaces/demo", Arg 2: "RunPythonCode"
17:03:33.333 [info] Starting Kernel (Python Path: ~/Workspaces/demo/.venv/bin/python, Venv, 3.13.1) for '~/Workspaces/demo/demo.ipynb' (disableUI=true)
17:03:33.334 [trace] Creating raw notebook for resource '~/Workspaces/demo/demo.ipynb'
17:03:33.340 [debug] Get Custom Env Variables, Class name = Cm, completed in 0ms, has a truthy return value, Arg 1: "~/Workspaces/demo/demo.ipynb", Arg 2: "RunPythonCode"
17:03:33.346 [trace] Hiding default KernelSpec /python for interpreter ~/Workspaces/demo/.venv/bin/python (KernelSpec file ~/Workspaces/demo/.venv/share/jupyter/kernels/python3/kernel.json)
17:03:33.346 [trace] Hiding default KernelSpec /opt/homebrew/anaconda3/bin/python for interpreter /opt/homebrew/anaconda3/bin/python (KernelSpec file /opt/homebrew/anaconda3/share/jupyter/kernels/python3/kernel.json)
17:03:33.347 [debug] End refreshing Kernel Picker (1734397412904)
17:03:33.429 [debug] Launching kernel .jvsc74a57bd010d6d58631b164f0ea2f302513310b4ca098cd9cb50027f0f20dc42988ab871b./Users/~/Workspaces/demo/.venv/python./Users/~/Workspaces/demo/.venv/python.-m#ipykernel_launcher for ~/Workspaces/demo/demo.ipynb in //Users/~/Workspaces/demo with ports 9001, 9000, 9004, 9002, 9003
17:03:33.592 [debug] Got env vars from Python Ext in 252ms for ~/Workspaces/demo/.venv/bin/python, with env var count 45.
17:03:33.592 [trace] Prepend PATH with python bin for ~/Workspaces/demo/.venv/bin/python
17:03:33.592 [debug] Getting activated env variables, Class name = gd, completed in 252ms, has a truthy return value, Arg 1: "~/Workspaces/demo/demo.ipynb", Arg 2: "~/Workspaces/demo/.venv/bin/python", Arg 3: undefined
17:03:33.593 [info] Process Execution: ~/Workspaces/demo/.venv/bin/python -c "import ipykernel; print(ipykernel.__version__); print("5dc3a68c-e34e-4080-9c3e-2a532b2ccb4d"); print(ipykernel.__file__)"
17:03:33.594 [info] Process Execution: ~/Workspaces/demo/.venv/bin/python -m ipykernel_launcher --f=/Users/~/Library/Jupyter/runtime/kernel-v37f5c325dc9c7ac6115f3ec6d7bfb79016e7c3796.json
    > cwd: //Users/~/Workspaces/demo
17:03:33.594 [debug] Kernel process 68906.
17:03:33.605 [debug] Got env vars from Python Ext in 272ms for ~/Workspaces/demo/.venv/bin/python, with env var count 45.
17:03:33.605 [trace] Prepend PATH with python bin for ~/Workspaces/demo/.venv/bin/python
17:03:33.605 [debug] Getting activated env variables, Class name = gd, completed in 272ms, has a truthy return value, Arg 1: "~/Workspaces/demo", Arg 2: "~/Workspaces/demo/.venv/bin/python", Arg 3: undefined
17:03:33.606 [info] Process Execution: ~/Workspaces/demo/.venv/bin/python -m pip list
17:03:33.729 [trace] ipykernel version & path 6.29.5, ~/Workspaces/demo/.venv/lib/python3.13/site-packages/ipykernel/__init__.py for ~/Workspaces/demo/.venv/bin/python
17:03:33.905 [debug] Kernel output 68906: To connect another client to this kernel, use:
--existing kernel-v37f5c325dc9c7ac6115f3ec6d7bfb79016e7c3796.json
17:03:34.027 [debug] Waiting for Raw Session to be ready in postStartRawSession
17:03:34.027 [debug] Waiting for Raw session to be ready, status: connected
17:03:34.027 [trace] Raw session connected
17:03:34.027 [debug] Waited for Raw session to be ready & got status: connected
17:03:34.027 [debug] Successfully waited for Raw Session to be ready in postStartRawSession
17:03:34.027 [debug] Kernel status is 'unknown' before requesting kernel info and after ready
17:03:34.027 [debug] Sending request for kernelInfo
17:03:34.032 [trace] Got response for requestKernelInfo
17:03:34.032 [debug] Successfully completed postStartRawSession after 1 attempt(s) in 5ms
17:03:34.033 [trace] Executing silently Code (idle) = import sys as _VSCODE_sys\nprint(_VSCODE_sys.executable); del _VSCODE_sys
17:03:34.044 [trace] Executing silently Code (completed) = import sys as _VSCODE_sys\nprint(_VSCODE_sys.executable); del _VSCODE_sys with 1 output(s)
17:03:34.044 [trace] Started running kernel initialization for ~/Workspaces/demo/demo.ipynb
17:03:34.044 [trace] Executing silently Code (idle) = try:\nimport ipywidgets as _VSCODE_ipywidgets\nprint("e976ee50-99ed-4aba-9b6b-9dcd5634d07d:IPy
17:03:34.048 [trace] Executing silently Code (completed) = try:\nimport ipywidgets as _VSCODE_ipywidgets\nprint("e976ee50-99ed-4aba-9b6b-9dcd5634d07d:IPy with 0 output(s)
17:03:34.048 [trace] Determined IPyWidgets Version as undefined
17:03:34.049 [trace] Executing silently Code (idle) = def __VSCODE_inject_module():\ndef __VSCODE_call_function(function, callback, data=None):
17:03:34.056 [trace] Executing silently Code (completed) = def __VSCODE_inject_module():\ndef __VSCODE_call_function(function, callback, data=None): with 0 output(s)
17:03:34.056 [debug] Requesting Kernel info
17:03:34.056 [trace] Got Kernel info
17:03:34.056 [trace] End running kernel initialization, now waiting for idle
17:03:34.056 [trace] Waiting for idle on (kernel): db226cc0-3cde-4d72-9f1f-6708fa2089d4 -> idle
17:03:34.056 [trace] Finished waiting for idle on (kernel): db226cc0-3cde-4d72-9f1f-6708fa2089d4 -> idle
17:03:34.056 [trace] End running kernel initialization, session is idle
17:03:34.057 [trace] Registering Kernel Completion Provider from kernel .venv (Python 3.13.1) for language python
17:03:34.057 [info] Kernel successfully started
17:03:34.245 [debug] Interpreter for Pylance for Notebook URI "~/Workspaces/demo/demo.ipynb" is ~/Workspaces/demo/.venv/bin/python
17:03:35.311 [trace] Conda file is /opt/homebrew/anaconda3/bin/conda
17:03:36.508 [trace] IPyWidgetScriptSource.initialize
17:03:36.509 [trace] Registering commtarget jupyter.widget
17:03:36.509 [debug] Start refreshing Interpreter Kernel Picker
17:03:36.510 [debug] Start refreshing Kernel Picker (1734397416510)
17:03:36.512 [debug] getDataDirsImpl, Class name = Mr (started execution), Arg 1: "~/Workspaces/demo/demo.ipynb", Arg 2: "~/Workspaces/demo/.venv/bin/python"
17:03:36.513 [debug] Get Custom Env Variables, Class name = Cm, completed in 1ms, has a truthy return value, Arg 1: undefined, Arg 2: "RunPythonCode"
17:03:36.513 [debug] Jupyter Paths : 
17:03:36.533 [info] Process Execution: ~/Workspaces/demo/.venv/bin/python /Users/~/.vscode/extensions/ms-toolsai.jupyter-2024.9.1-darwin-arm64/pythonFiles/printJupyterDataDir.py
17:03:36.565 [debug] Got an empty Jupyter Data Dir from /Users/~/Workspaces/demo/.venv/bin/python, stderr = undefined
17:03:36.565 [debug] getDataDirsImpl, Class name = Mr, completed in 53ms, has a truthy return value, Arg 1: "~/Workspaces/demo/demo.ipynb", Arg 2: "~/Workspaces/demo/.venv/bin/python", Return Value: <Uri:/Users/~/Library/Jupyter>, <Uri:/Users/~/Workspaces/demo/.venv/share/jupyter>, <Uri:/usr/local/share/jupyter>, <Uri:/usr/share/jupyter>
17:03:36.761 [trace] Python API env change detected, update => '/Users/~/Workspaces/demo/.venv/bin/python'
17:03:36.762 [trace] Python API env change detected, update => '/opt/homebrew/anaconda3/bin/python'
17:03:36.762 [trace] Python API env change detected, update => '/usr/bin/python3'
17:03:36.762 [trace] Python API env change detected, update => '/opt/homebrew/bin/python3'
17:03:36.762 [trace] Python API env change detected, update => '/opt/homebrew/bin/python3.12'
17:03:36.763 [trace] Search for KernelSpecs in Interpreter /opt/homebrew/bin/python3.12
17:03:36.764 [debug] Refreshed Environments
17:03:37.770 [debug] End refreshing Kernel Picker (1734397416510)
17:03:38.907 [debug] Handle Execution of Cells 0 for ~/Workspaces/demo/demo.ipynb
17:03:38.909 [trace] Execute Notebook ~/Workspaces/demo/demo.ipynb. Step 1
17:03:38.909 [trace] Connect to Kernel ~/Workspaces/demo/demo.ipynb. Step 2
17:03:38.909 [trace] Connected to Kernel ~/Workspaces/demo/demo.ipynb. Step 3
17:03:38.910 [trace] executeCell 0. Step 4
17:03:38.911 [trace] Cell Index:0 sent to kernel
17:03:38.918 [trace] Start cell 0 execution @ 1734397418918 (clear output)
17:03:38.919 [debug] Kernel acknowledged execution of cell 0 @ 1734397418918
17:03:38.921 [trace] Cell 0 completed in 0.003s (start: 1734397418918, end: 1734397418921)
17:03:38.921 [trace] Cell 0 executed successfully

[DonJayamanne]

When run with the Python extension as a Python script, the output is:

Please could you let me know how exactly you do this, i.e. what is the command or icon you use.
Please can you share a screenshot or screen recording of this.
Finally, is this python file being executed in a terminal?

[siddharthab]

Sure. Screenshot attached here. The Python extension will run the file in a terminal.

By definition of sys.flags.safe_path, the empty string should not be present in sys.path, so it appears that the Jupyter extension is adding it.

[DonJayamanne]

Got it thanks.

[DonJayamanne]

Found that this empty entry isn't added by the Jupyter extesnion in VS Code, but by the ipykernel package itself (thats used by Jupyter Lab for starting Python kernels).
Closing this issue as its not caused by Jupyter extension.

[siddharthab]

Thank you for helping find the root cause.