fix(shell): skip env vars with invalid names instead of breaking the shell

[mikeland73]

Summary

A "//" comment key in a devbox.jsonenv block was exported verbatim as export //=..., which zsh rejects with the cryptic not valid in this context: //, breaking the entire devbox shell. exportify and exportifyNushell now skip env vars whose names aren't valid shell identifiers (^[a-zA-Z_][a-zA-Z0-9_]*$) and emit a single clear warning naming the offending keys, instead of generating invalid shell.

How was it tested?

Added unit tests for isValidEnvName and for both export formats skipping invalid names; the full internal/devbox suite, go vet, and go build ./... pass. Reproduced the original failure (export //=x → not valid in this context: //) and confirmed the generated shellenv now passes zsh -n with only valid vars exported and the warning shown on stderr.

Community Contribution License

All community contributions in this pull request are licensed to the project
maintainers under the terms of the
Apache 2 License.

By creating this pull request, I represent that I have the right to license the
contributions to the project maintainers under the Apache 2 License as stated in
the
Community Contribution License.

[Copilot]

Pull request overview

This pull request hardens Devbox’s shell environment export generation by filtering out invalid environment variable names (e.g., JSON “comment keys” like "//") so devbox shell / devbox shellenv no longer emits syntactically invalid shell code and breaks shells like zsh.

Changes:

• Add env var name validation (isValidEnvName) and a consolidated warning for skipped invalid keys.
• Update exportify and exportifyNushell to skip exporting invalid identifiers instead of generating invalid shell syntax.
• Add unit tests covering env name validation and the “skip invalid names” behavior for both export formats.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
internal/devbox/envvars.go	Adds env var name validation, warning emission, and skips invalid env names in both POSIX and nushell export generators.
internal/devbox/envvars_test.go	Adds unit tests for env name validation and verifying invalid names are not emitted in export output.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.