[Autoloop: python-to-go-migration] Iteration 4: Migrate subprocess_env.py and helpers.py to Go

Run: https://github.com/githubnext/apm/actions/runs/25747630390

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: github-actions[bot]

benchmarks/migration-status.json

@@ -1,6 +1,6 @@
 {
   "original_python_lines": 71696,
-  "migrated_python_lines": 612,
+  "migrated_python_lines": 827,
   "migrated_modules": [
     {
       "module": "src/apm_cli/constants.py",
@@ -64,8 +64,22 @@
       "python_lines": 123,
       "status": "migrated",
       "notes": "ReadOnlyProjectGuard with snapshot-based mutation detection; stdlib-only"
+    },
+    {
+      "module": "src/apm_cli/utils/subprocess_env.py",
+      "go_package": "internal/utils/subprocenv",
+      "python_lines": 84,
+      "status": "migrated",
+      "notes": "PyInstaller env restoration; stdlib-only; MapToSlice helper"
+    },
+    {
+      "module": "src/apm_cli/utils/helpers.py",
+      "go_package": "internal/utils/helpers",
+      "python_lines": 131,
+      "status": "migrated",
+      "notes": "IsToolAvailable, GetAvailablePackageManagers, DetectPlatform, FindPluginJSON"
     }
   ],
-  "last_updated": "2026-05-12T15:33:35Z",
-  "iteration": 3
+  "last_updated": "2026-05-12T16:29:36Z",
+  "iteration": 4
 }

internal/utils/helpers/helpers.go

@@ -0,0 +1,82 @@
+// Package helpers provides miscellaneous utility functions for APM.
+package helpers
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+)
+
+// IsToolAvailable reports whether a command-line tool can be found on PATH.
+func IsToolAvailable(toolName string) bool {
+	_, err := exec.LookPath(toolName)
+	return err == nil
+}
+
+// GetAvailablePackageManagers returns a map of package manager name -> name
+// for every package manager binary found on PATH.
+func GetAvailablePackageManagers() map[string]string {
+	candidates := []string{
+		// Python
+		"uv", "pip", "pipx",
+		// JavaScript
+		"npm", "yarn", "pnpm",
+		// System
+		"brew",   // macOS
+		"apt",    // Debian/Ubuntu
+		"yum",    // CentOS/RHEL
+		"dnf",    // Fedora
+		"apk",    // Alpine
+		"pacman", // Arch
+	}
+	out := make(map[string]string)
+	for _, name := range candidates {
+		if IsToolAvailable(name) {
+			out[name] = name
+		}
+	}
+	return out
+}
+
+// DetectPlatform returns a normalised platform name: "macos", "linux",
+// "windows", or "unknown".
+func DetectPlatform() string {
+	switch runtime.GOOS {
+	case "darwin":
+		return "macos"
+	case "linux":
+		return "linux"
+	case "windows":
+		return "windows"
+	default:
+		return "unknown"
+	}
+}
+
+// pluginJSONRelPaths is the ordered list of relative paths where plugin.json
+// may live inside a plugin directory.
+var pluginJSONRelPaths = []string{
+	"plugin.json",
+	filepath.Join(".github", "plugin", "plugin.json"),
+	filepath.Join(".claude-plugin", "plugin.json"),
+	filepath.Join(".cursor-plugin", "plugin.json"),
+}
+
+// FindPluginJSON searches for plugin.json in the well-known locations inside
+// pluginPath and returns the first match. Returns an empty string when not found.
+func FindPluginJSON(pluginPath string) string {
+	for _, rel := range pluginJSONRelPaths {
+		candidate := filepath.Join(pluginPath, rel)
+		if fileExists(candidate) {
+			return candidate
+		}
+	}
+	return ""
+}
+
+// fileExists reports whether path refers to a regular file.
+func fileExists(path string) bool {
+	info, err := os.Stat(path)
+	return err == nil && info.Mode().IsRegular()
+}

internal/utils/helpers/helpers_test.go

@@ -0,0 +1,70 @@
+package helpers_test
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/githubnext/apm/internal/utils/helpers"
+)
+
+func TestIsToolAvailable(t *testing.T) {
+	// "sh" or "cat" should exist on any POSIX CI runner.
+	if !helpers.IsToolAvailable("sh") {
+		t.Error("expected 'sh' to be found on PATH")
+	}
+	if helpers.IsToolAvailable("definitely-not-a-real-binary-xyz") {
+		t.Error("expected nonexistent tool to return false")
+	}
+}
+
+func TestDetectPlatform(t *testing.T) {
+	p := helpers.DetectPlatform()
+	valid := map[string]bool{"macos": true, "linux": true, "windows": true, "unknown": true}
+	if !valid[p] {
+		t.Errorf("unexpected platform %q", p)
+	}
+}
+
+func TestGetAvailablePackageManagers(t *testing.T) {
+	// Just check it returns a map (may be empty in a minimal container).
+	m := helpers.GetAvailablePackageManagers()
+	if m == nil {
+		t.Error("expected non-nil map")
+	}
+}
+
+func TestFindPluginJSON(t *testing.T) {
+	dir := t.TempDir()
+
+	// No plugin.json yet.
+	if got := helpers.FindPluginJSON(dir); got != "" {
+		t.Errorf("expected empty, got %q", got)
+	}
+
+	// Create the top-level plugin.json.
+	pj := filepath.Join(dir, "plugin.json")
+	if err := os.WriteFile(pj, []byte("{}"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if got := helpers.FindPluginJSON(dir); got != pj {
+		t.Errorf("expected %q, got %q", pj, got)
+	}
+}
+
+func TestFindPluginJSONSubdirs(t *testing.T) {
+	dir := t.TempDir()
+
+	// Create under .github/plugin/
+	sub := filepath.Join(dir, ".github", "plugin")
+	if err := os.MkdirAll(sub, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	pj := filepath.Join(sub, "plugin.json")
+	if err := os.WriteFile(pj, []byte("{}"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if got := helpers.FindPluginJSON(dir); got != pj {
+		t.Errorf("expected %q, got %q", pj, got)
+	}
+}

internal/utils/subprocenv/subprocenv.go

@@ -0,0 +1,104 @@
+// Package subprocenv provides environment sanitisation for spawning external
+// processes from a PyInstaller-frozen binary.
+//
+// When APM ships as a PyInstaller --onedir binary the bootloader prepends
+// the bundle's _internal directory to LD_LIBRARY_PATH (Linux) and the
+// DYLD_* variables (macOS) so that the main Python process can find its own
+// shared libraries. Child processes inherit that environment by default,
+// which causes system binaries (git, curl, the install script) to resolve
+// their dependencies against the bundled libraries. This package centralises
+// the restoration logic that mirrors the Python subprocess_env module.
+package subprocenv
+
+import (
+	"os"
+	"runtime"
+	"strings"
+)
+
+// pyinstallerManagedVars are the library-path variables that PyInstaller's
+// bootloader rewrites at launch. Each has a sibling <NAME>_ORIG holding the
+// pre-launch value that must be restored before handing the environment to a
+// child process.
+var pyinstallerManagedVars = []string{
+	"LD_LIBRARY_PATH",    // Linux and most Unixes
+	"DYLD_LIBRARY_PATH",  // macOS dynamic library search path
+	"DYLD_FRAMEWORK_PATH", // macOS framework search path
+}
+
+// isFrozen returns true when the process was started by PyInstaller. This is
+// detected by checking for the _MEIPASS environment variable that PyInstaller
+// always sets in a frozen binary.
+func isFrozen() bool {
+	_, ok := os.LookupEnv("_MEIPASS")
+	return ok
+}
+
+// ExternalProcessEnv returns an environment map safe for spawning external
+// system binaries.
+//
+// When not running as a PyInstaller-frozen binary the current os.Environ() is
+// returned as a fresh map with no modifications.
+//
+// When frozen, every library-path variable in pyinstallerManagedVars is
+// restored from its <NAME>_ORIG sibling. If no _ORIG sibling exists the
+// variable is removed entirely so the child does not inherit the bundle's
+// _internal path. The _ORIG keys themselves are stripped.
+//
+// If base is non-nil it is used as the source mapping instead of os.Environ().
+func ExternalProcessEnv(base map[string]string) map[string]string {
+	env := envToMap(base)
+
+	if !isFrozen() {
+		return env
+	}
+
+	for _, key := range pyinstallerManagedVars {
+		origKey := key + "_ORIG"
+		if origVal, ok := env[origKey]; ok {
+			env[key] = origVal
+			delete(env, origKey)
+		} else {
+			delete(env, key)
+		}
+	}
+	return env
+}
+
+// envToMap converts a []string slice (KEY=VALUE pairs) or an existing map into
+// a fresh map[string]string copy. When base is nil os.Environ() is used.
+func envToMap(base map[string]string) map[string]string {
+	if base != nil {
+		out := make(map[string]string, len(base))
+		for k, v := range base {
+			out[k] = v
+		}
+		return out
+	}
+	pairs := os.Environ()
+	out := make(map[string]string, len(pairs))
+	for _, pair := range pairs {
+		idx := strings.IndexByte(pair, '=')
+		if idx < 0 {
+			out[pair] = ""
+			continue
+		}
+		out[pair[:idx]] = pair[idx+1:]
+	}
+	return out
+}
+
+// MapToSlice converts a map[string]string into a []string of KEY=VALUE pairs
+// suitable for exec.Cmd.Env.
+func MapToSlice(env map[string]string) []string {
+	out := make([]string, 0, len(env))
+	for k, v := range env {
+		out = append(out, k+"="+v)
+	}
+	return out
+}
+
+// IsWindows reports whether the current OS is Windows.
+func IsWindows() bool {
+	return runtime.GOOS == "windows"
+}

internal/utils/subprocenv/subprocenv_test.go

@@ -0,0 +1,44 @@
+package subprocenv_test
+
+import (
+	"testing"
+
+	"github.com/githubnext/apm/internal/utils/subprocenv"
+)
+
+func TestExternalProcessEnvNoFreeze(t *testing.T) {
+	// Without _MEIPASS set, ExternalProcessEnv returns a clean copy of the base.
+	base := map[string]string{
+		"LD_LIBRARY_PATH":      "/bundled/lib",
+		"LD_LIBRARY_PATH_ORIG": "/usr/lib",
+		"HOME":                 "/home/user",
+	}
+	env := subprocenv.ExternalProcessEnv(base)
+	// When not frozen the map is returned as-is (no restoration).
+	if env["LD_LIBRARY_PATH"] != "/bundled/lib" {
+		t.Errorf("expected /bundled/lib, got %s", env["LD_LIBRARY_PATH"])
+	}
+}
+
+func TestMapToSlice(t *testing.T) {
+	env := map[string]string{"FOO": "bar", "BAZ": "qux"}
+	slice := subprocenv.MapToSlice(env)
+	if len(slice) != 2 {
+		t.Errorf("expected 2 entries, got %d", len(slice))
+	}
+	seen := map[string]bool{}
+	for _, s := range slice {
+		seen[s] = true
+	}
+	if !seen["FOO=bar"] || !seen["BAZ=qux"] {
+		t.Errorf("missing expected entries: %v", slice)
+	}
+}
+
+func TestExternalProcessEnvNilBase(t *testing.T) {
+	// With nil base we get the real process env -- just verify no panic.
+	env := subprocenv.ExternalProcessEnv(nil)
+	if env == nil {
+		t.Error("expected non-nil env")
+	}
+}