Python: Fix venv isolation from user-site and base-install site-packages [STUD-81085]

[viogroza]

Summary

• Python Scope's embedded interpreter never goes through CPython's own venv activation path (site.py's venv() function only triggers for a normally-launched <venv>/Scripts/python.exe), so pointing Path at a venv left both the PEP-370 user-site directory and the base install's own site-packages on sys.path unfiltered.
• A native package (e.g. pywin32) installed with a different build in either location could resolve its Python module from one and its native DLL dependency from the other, mismatched, copy — surfacing as DLL load failed while importing win32api: The specified procedure could not be found.
• Fixes both leak paths via PythonEngine.SetNoSiteFlag() (gated on whether the venv requests --system-site-packages), with Controller.ClearUserSiteEnvironmentOverride guarding against an ambient PYTHONNOUSERSITE leaking in from the host's own environment.
• Also fixes PythonHome being pointed at the venv root instead of its declared base install (breaks stdlib resolution entirely), tightens venv detection against false positives, and adds a version cross-check between a venv and the Python library actually being loaded.

Test plan

• UiPath.Python.Tests, UiPath.Python.Activities.Tests, UiPath.Python.Activities.API.Tests all pass (85 total)
• Regression coverage added for: user-site isolation (default + --system-site-packages), base-install site-packages leak, sitecustomize.py preservation, PythonHome resolution, venv detection (root/Scripts/bin/false-positive), venv/library version mismatch, and ambient PYTHONNOUSERSITE override
• Each new/changed behavior verified to actually catch its regression by temporarily reverting the fix and confirming the test fails, then restoring it

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate failed

Failed conditions
D Security Rating on New Code (required ≥ A)
D Reliability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[Copilot]

Pull request overview

This PR hardens the Python activity pack’s handling of virtual environments (venvs) when using an embedded interpreter, ensuring sys.path is correctly isolated from PEP-370 user-site and (when appropriate) the base install’s site-packages, and surfacing clearer errors for misconfigured venv/library pairings.

Changes:

• Adds shared venv detection (pyvenv.cfg) and uses it to drive runtime initialization behavior.
• Updates engine initialization to set an appropriate PythonHome, gate Py_NoSiteFlag / SetNoSiteFlag() based on venv flags, and preserve sitecustomize.py execution.
• Adds validation and regression tests for venv detection, version mismatch, user-site isolation, base-site leakage, and ambient PYTHONNOUSERSITE behavior.

Reviewed changes

Copilot reviewed 10 out of 11 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
Activities/Python/UiPath.Python/Properties/UiPath.Python.resx	Adds localized error text for venv/library version mismatch.
Activities/Python/UiPath.Python/Properties/UiPath.Python.Designer.cs	Adds generated accessor for the new localized resource.
Activities/Python/UiPath.Python/Properties/AssemblyInfo.cs	Grants internals visibility to UiPath.Python.Tests for new regression coverage.
Activities/Python/UiPath.Python/Impl/VenvDetection.cs	Introduces shared, bounded venv detection + config parsing (pyvenv.cfg).
Activities/Python/UiPath.Python/Impl/OutOfProcessEngine.cs	Plumbs venv flag into host spawning to clear ambient PYTHONNOUSERSITE when needed.
Activities/Python/UiPath.Python/Impl/Engine.cs	Fixes PythonHome resolution for venvs, applies SetNoSiteFlag() for default venvs, and preserves sitecustomize.py.
Activities/Python/UiPath.Python/EngineProvider.cs	Adds venv-vs-library version cross-check during installation validation.
Activities/Python/UiPath.Python.Tests/VenvVersionValidationTests.cs	Regression tests for upfront venv/library version mismatch handling.
Activities/Python/UiPath.Python.Tests/VenvUserSiteIsolationTests.cs	Regression coverage for user-site suppression, base-site leakage, sitecustomize preservation, and ambient env-var behavior.
Activities/Python/UiPath.Python.Tests/VenvDetectionTests.cs	Fast unit tests for venv detection shapes and false-positive avoidance.
Activities/Python/Shared/UiPath.Shared.Service/Client/Controller.cs	Adds child-process environment scrubbing for PYTHONNOUSERSITE when requested.

Files not reviewed (1)

• Activities/Python/UiPath.Python/Properties/UiPath.Python.Designer.cs: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.