cubeEnvPrefix function

String cubeEnvPrefix({
  1. required String workspaceRoot,
  2. required String tmpdir,
  3. Map<String, String> envVars = const {},
})

The env -i VAR=value argument words for a kernel-wrapped run: the fixed PATH trio, HOME at workspaceRoot and TMPDIR under it (the only guaranteed-writable area), then the cube's injected envVars on top (a same-named var overrides the default). Values are single-quoted so paths with spaces survive the outer shell.

env -i is the clean-environment ceiling: nothing else leaks in from the host, hidden vars stay hidden (buildProfile's callers already exclude them via CubeEnvPolicy.apply).

Implementation

String cubeEnvPrefix({
  required String workspaceRoot,
  required String tmpdir,
  Map<String, String> envVars = const {},
}) {
  final vars = <String, String>{
    'PATH': '/usr/bin:/bin:/usr/sbin:/sbin',
    'HOME': workspaceRoot,
    'TMPDIR': tmpdir,
    ...envVars,
  };
  return [
    for (final entry in vars.entries) '${entry.key}=${shellQuote(entry.value)}',
  ].join(' ');
}