test(cli): route every env-less spawner through childEnv(), and make the gate refuse an undeclared child env

packages/cli/test/authoring-rule-command-parity.test.ts

@@ -29,6 +29,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { AUTHORING_COMMANDS, runAuthoringRules, type AuthoringCommand } from '@objectstack/lint';
+import { childEnv } from './helpers/serve-process.js';
 
 const cliBin = join(fileURLToPath(new URL('.', import.meta.url)), '..', 'bin', 'run-dev.js');
 
@@ -189,7 +190,16 @@ describe('every authoring command reaches the same verdict (#4409)', () => {
  let exitCode = 0;
  let output = '';
  try {
- output = execFileSync(process.execPath, [cliBin, command], { cwd: dir, encoding: 'utf8', stdio: 'pipe' });
+ output = execFileSync(process.execPath, [cliBin, command], {
+ cwd: dir,
+ encoding: 'utf8',
+ stdio: 'pipe',
+ // Every spawned child under this directory declares its environment at the
+ // call site (#11595). An omitted `env` is the leak in its purest form: the
+ // child gets the vitest worker's environment verbatim, with nothing on the
+ // page to read.
+ env: childEnv(),
+ });
  } catch (error: any) {
  exitCode = error.status ?? 1;
  output = `${error.stdout ?? ''}${error.stderr ?? ''}`;

packages/cli/test/cloud-login-json-ndjson.e2e.test.ts

@@ -308,7 +308,11 @@ describe('os cloud login --json — the declared NDJSON stream (#6730)', () => {
 
  beforeAll(async () => {
  try {
- execFileSync('script', ['--version'], { stdio: 'ignore' });
+ // Every spawned child under this directory declares its environment at the
+ // call site (#11595). An omitted `env` is the leak in its purest form: the
+ // child gets the vitest worker's environment verbatim, with nothing on the
+ // page to read.
+ execFileSync('script', ['--version'], { stdio: 'ignore', env: childEnv() });
  } catch {
  throw new Error(
  'script(1) is required to drive the TTY-gated device flow — see this file’s header for why this fails instead of skipping.',

packages/cli/test/emit-json-pipe.test.ts

@@ -6,6 +6,7 @@ import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join, resolve } from 'node:path';
 import { promisify } from 'node:util';
+import { childEnv } from './helpers/serve-process.js';
 
 const execFileP = promisify(execFile);
 
@@ -59,7 +60,11 @@ function hash(s: string): number {
 /** Run a harness with stdout on a pipe; return stdout even when the exit code is non-zero. */
 async function runPiped(file: string): Promise<{ stdout: string; code: number }> {
  try {
- const { stdout } = await execFileP(TSX, [file], { maxBuffer: 64 * 1024 * 1024 });
+ // Every spawned child under this directory declares its environment at the
+ // call site (#11595). An omitted `env` is the leak in its purest form: the
+ // child gets the vitest worker's environment verbatim, with nothing on the
+ // page to read.
+ const { stdout } = await execFileP(TSX, [file], { maxBuffer: 64 * 1024 * 1024, env: childEnv() });
  return { stdout, code: 0 };
  } catch (err: any) {
  return { stdout: String(err.stdout ?? ''), code: err.code ?? 1 };
@@ -141,7 +146,7 @@ describe('emitJson over a pipe', () => {
  'process.exit(1);\n',
  );
 
- const child = spawn(TSX, [file], { stdio: ['ignore', 'pipe', 'ignore'] });
+ const child = spawn(TSX, [file], { stdio: ['ignore', 'pipe', 'ignore'], env: childEnv() });
  child.stdout.pause();
  await new Promise<void>((resolve) => child.on('exit', () => resolve()));
  const chunks: Buffer[] = [];
@@ -194,7 +199,7 @@ describe('os validate --json over a pipe', () => {
  const { stdout } = await execFileP(
  TSX,
  [resolve(REPO_CLI, 'bin/run-dev.js'), 'validate', join(configDir, 'objectstack.config.ts'), '--json'],
- { maxBuffer: 64 * 1024 * 1024, cwd: REPO_CLI },
+ { maxBuffer: 64 * 1024 * 1024, cwd: REPO_CLI, env: childEnv() },
  );
  return { stdout, code: 0 };
  } catch (err: any) {

packages/cli/test/format-zod-union.test.ts

@@ -36,6 +36,7 @@ import { fileURLToPath } from 'node:url';
 import { z } from 'zod';
 import { ObjectStackDefinitionSchema } from '@objectstack/spec';
 import { formatZodErrors } from '../src/utils/format';
+import { childEnv } from './helpers/serve-process.js';
 
 const cliBin = join(fileURLToPath(new URL('.', import.meta.url)), '..', 'bin', 'run-dev.js');
 
@@ -177,6 +178,11 @@ function runCli(command: string, stack: Record<string, unknown>, args: string[]
  cwd: dir,
  encoding: 'utf8',
  stdio: 'pipe',
+ // Every spawned child under this directory declares its environment at the
+ // call site (#11595). An omitted `env` is the leak in its purest form: the
+ // child gets the vitest worker's environment verbatim, with nothing on the
+ // page to read.
+ env: childEnv(),
  });
  return { exitCode: 0, output: stripAnsi(output) };
  } catch (error: any) {

packages/cli/test/login-json-ndjson.e2e.test.ts

@@ -296,7 +296,11 @@ describe('os login --json — the declared NDJSON stream (#6531)', () => {
 
  beforeAll(async () => {
  try {
- execFileSync('script', ['--version'], { stdio: 'ignore' });
+ // Every spawned child under this directory declares its environment at the
+ // call site (#11595). An omitted `env` is the leak in its purest form: the
+ // child gets the vitest worker's environment verbatim, with nothing on the
+ // page to read.
+ execFileSync('script', ['--version'], { stdio: 'ignore', env: childEnv() });
  } catch {
  throw new Error(
  'script(1) is required to drive the TTY-gated device flow — see this file’s header for why this fails instead of skipping.',

packages/cli/test/metadata-type-schema-gate.test.ts

@@ -48,6 +48,7 @@ import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { ObjectStackDefinitionSchema, lintUnknownAuthoringKeys, formatUnknownAuthoringKey } from '@objectstack/spec';
 import { getMetadataTypeSchema, listMetadataTypeSchemaTypes } from '@objectstack/spec/kernel';
+import { childEnv } from './helpers/serve-process.js';
 
 const cliBin = join(fileURLToPath(new URL('.', import.meta.url)), '..', 'bin', 'run-dev.js');
 
@@ -186,6 +187,11 @@ function runCli(command: string, dir: string, args: string[] = []): { exitCode:
  cwd: dir,
  encoding: 'utf8',
  stdio: 'pipe',
+ // Every spawned child under this directory declares its environment at the
+ // call site (#11595). An omitted `env` is the leak in its purest form: the
+ // child gets the vitest worker's environment verbatim, with nothing on the
+ // page to read.
+ env: childEnv(),
  });
  return { exitCode: 0, output };
  } catch (error: any) {