fix(python): stop the packaged runtime from hijacking spawned node commands

@yao-pkg/pkg's SEA bootstrap rewrites child_process commands named node -- including the string after a -c flag, exactly the Bash tool's bash -c form -- to the

Fix

@yao-pkg/pkg's SEA bootstrap rewrites child_process commands named node -- including the string after a -c flag, exactly the Bash tool's bash -c form -- to the executable itself and stamps PKG_EXECPATH into every child environment, so a model-issued 'node --version' silently booted the dsh CLI instead of the machine's Node. Pin the packager as an exact root devDependency invoked through pnpm exec

Date
2026-09-02
Version
master@c732ded
commit
c732ded

View commit on GitHub

@yao-pkg/pkg's SEA bootstrap rewrites child_process commands named node -- including the string after a -c flag, exactly the Bash tool's bash -c form -- to the executable itself and stamps PKG_EXECPATH into every child environment, so a model-issued 'node --version' silently booted the dsh CLI instead of the machine's Node. Pin the packager as an exact root devDependency invoked through pnpm exec