Connex Client Access and Claude Opus 5
a0fd8ba529
fix(evidence): stop bun's dotenv autoload from reaching the spawned command
...
`bin/gstack-evidence` has a `#!/usr/bin/env bun` shebang, and bun AUTO-LOADS
`.env`, `.env.<NODE_ENV>` and `.env.local` from the cwd into `process.env`. The
wrapper then spawned the command with no `env` override, so every command run
through it inherited those variables — and a repo `.env.local` routinely holds
production credentials.
Two things go wrong, and the second is worse than the leak:
1. Secrets reach a child that would not otherwise have them. `npm test` run by
hand in the same shell sees none of them; the same command through the wrapper
sees all of them.
2. THE COMMAND UNDER TEST BEHAVES DIFFERENTLY, so the ledger certifies a run that
is not the run CI performs. Observed in a Next.js repo on 2026-08-20: four
tests failed 4/4 through the wrapper and passed 5/5 without it, because app
code branched on env vars only the wrapper supplied. Nearly an hour went into
chasing a "flake" that was the measuring instrument. The wrapper exists to
record trustworthy evidence, so silently altering the environment defeats its
purpose.
The fix builds the child env from `process.env` minus the keys bun injected, and
detection is exact rather than heuristic: verified on bun 1.3.11, a dotenv file
does NOT override a variable the shell already exported (the shell's value wins).
So a key whose live value equals the dotenv file's value was injected by bun, and
dropping it restores the environment the user's own shell would have given the
command. A key whose live value differs is genuinely the caller's and survives.
`BUN_DOTENV_FILES()` mirrors bun's precedence, including that `.env.local` is
skipped when NODE_ENV is "test" — scrubbing a key bun never loaded would strip a
variable the caller legitimately provided.
Escape hatch: GSTACK_EVIDENCE_KEEP_DOTENV=1 keeps the old behaviour. When keys are
scrubbed the wrapper warns with the KEY NAMES ONLY, so the diagnostic cannot
become the leak it prevents.
Tests: 6 cases, mutation-verified — removing `env: spawnEnv` reddens exactly the
two leak tests and restoring it gives 30/30. Every leak test asserts the scrub
warning fired, because `bun test` sets NODE_ENV=test and the first version of
these tests passed vacuously against a `.env.local` bun had never loaded.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com >
Absorbed from PR #2652 with authorship preserved. Wave additions: a doc-comment on the ${VAR}-expansion limitation (bun expands refs, the reader compares raw text — those keys are left in the child env, failing open) and a regression pin for the unreadable-.env fail-open path with a functional DAC-override skip guard.
Fixes #2624
2026-08-22 01:56:34 +00:00
..
2026-08-19 11:42:55 -07:00
2026-08-19 11:42:55 -07:00
2026-08-15 22:20:30 -07:00
2026-03-18 23:57:59 -05:00
2026-08-15 22:20:30 -07:00
2026-08-16 19:34:41 -07:00
2026-05-17 08:26:36 -07:00
2026-08-15 11:42:19 -07:00
2026-08-19 16:53:19 -07:00
2026-06-07 21:38:21 -07:00
2026-08-14 22:02:07 -07:00
2026-04-19 17:50:31 +08:00
2026-08-19 11:42:55 -07:00
2026-06-21 07:15:19 -07:00
2026-08-19 16:53:19 -07:00
2026-08-19 11:42:55 -07:00
2026-08-19 11:42:55 -07:00
2026-05-29 08:35:00 -07:00
2026-08-19 11:42:55 -07:00
2026-08-19 11:42:55 -07:00
2026-08-16 19:34:41 -07:00
2026-08-16 19:34:41 -07:00
2026-05-20 07:35:01 -07:00
2026-04-08 22:21:28 -10:00
2026-05-29 08:35:00 -07:00
2026-06-07 19:13:24 -07:00
2026-06-07 19:13:24 -07:00
2026-08-15 09:37:04 -07:00
2026-06-07 19:13:24 -07:00
2026-08-14 09:28:56 -07:00
2026-05-30 14:57:07 -07:00
2026-08-16 19:34:41 -07:00
2026-08-15 22:20:30 -07:00
2026-08-15 11:42:19 -07:00
2026-08-16 19:34:41 -07:00
2026-04-23 07:25:20 -07:00
2026-08-15 09:37:04 -07:00
2026-08-18 17:00:04 -07:00
2026-08-15 22:20:30 -07:00
2026-08-18 17:00:04 -07:00
2026-08-16 19:34:41 -07:00
2026-08-16 19:34:41 -07:00
2026-05-09 08:06:47 -07:00
2026-08-16 19:34:41 -07:00
2026-08-16 19:34:41 -07:00
2026-05-16 12:32:33 -07:00
2026-08-15 11:42:19 -07:00
2026-08-08 09:28:45 -07:00
2026-06-07 19:13:24 -07:00
2026-08-15 09:37:04 -07:00
2026-05-28 18:21:09 -07:00
2026-08-15 22:20:30 -07:00
2026-06-09 22:29:23 -07:00
2026-06-12 15:38:53 -07:00
2026-08-16 19:34:41 -07:00
2026-05-30 12:09:10 -07:00
2026-05-28 18:21:09 -07:00
2026-05-28 18:21:09 -07:00
2026-05-21 21:21:07 -07:00
2026-06-07 19:13:24 -07:00
2026-04-26 13:55:13 -07:00
2026-08-15 22:20:30 -07:00
2026-08-16 19:34:41 -07:00
2026-08-16 19:34:41 -07:00
2026-08-16 19:34:41 -07:00
2026-08-16 19:34:41 -07:00
2026-08-15 22:20:30 -07:00
2026-08-07 15:08:12 -07:00
2026-08-15 22:20:30 -07:00
2026-08-22 01:56:34 +00:00
2026-08-14 22:02:07 -07:00
2026-08-14 22:02:07 -07:00
2026-05-20 07:35:01 -07:00
2026-08-15 11:42:19 -07:00
2026-08-15 22:20:30 -07:00
2026-08-15 09:37:04 -07:00
2026-08-15 11:42:19 -07:00
2026-06-08 06:20:58 -07:00
2026-08-15 22:20:30 -07:00
2026-06-21 07:15:19 -07:00
2026-08-16 19:34:41 -07:00
2026-08-16 19:34:41 -07:00
2026-05-17 08:26:36 -07:00
2026-06-08 06:20:58 -07:00
2026-05-14 17:20:48 -07:00
2026-08-15 11:42:19 -07:00
2026-05-21 21:21:07 -07:00
2026-04-24 01:38:21 -07:00
2026-08-19 11:42:55 -07:00
2026-08-16 19:34:41 -07:00
2026-08-19 11:42:55 -07:00
2026-08-15 11:42:19 -07:00
2026-05-17 08:26:36 -07:00
2026-08-19 11:42:55 -07:00
2026-05-30 14:57:07 -07:00
2026-08-08 09:28:45 -07:00
2026-08-16 19:34:41 -07:00
2026-08-15 22:20:30 -07:00
2026-07-10 16:51:16 -07:00
2026-05-21 18:55:55 -07:00
2026-08-14 09:28:56 -07:00
2026-08-15 09:37:04 -07:00
2026-08-16 19:34:41 -07:00
2026-08-19 11:42:55 -07:00
2026-05-20 06:56:41 -07:00
2026-08-14 22:02:07 -07:00
2026-05-21 21:21:07 -07:00
2026-08-15 11:42:19 -07:00
2026-05-28 18:21:09 -07:00
2026-08-19 11:42:55 -07:00
2026-08-19 16:53:19 -07:00
2026-05-30 08:54:46 -07:00
2026-08-15 11:42:19 -07:00
2026-06-08 06:20:58 -07:00
2026-06-08 06:20:58 -07:00
2026-06-14 11:40:57 -07:00
2026-08-08 09:28:45 -07:00
2026-08-16 19:34:41 -07:00
2026-08-08 09:28:45 -07:00
2026-08-14 09:28:56 -07:00
2026-08-22 01:54:19 +00:00
2026-08-16 19:34:41 -07:00
2026-06-08 06:39:38 -07:00
2026-08-16 19:34:41 -07:00
2026-08-19 11:42:55 -07:00
2026-08-19 11:42:55 -07:00
2026-08-14 22:02:07 -07:00
2026-06-21 07:15:19 -07:00
2026-08-19 11:42:55 -07:00
2026-08-19 11:42:55 -07:00
2026-07-10 03:09:13 -07:00
2026-05-29 08:35:00 -07:00
2026-06-07 21:38:21 -07:00
2026-08-19 16:53:19 -07:00
2026-08-16 19:34:41 -07:00
2026-08-19 11:42:55 -07:00
2026-08-16 19:34:41 -07:00
2026-05-28 18:21:09 -07:00
2026-08-14 22:02:07 -07:00
2026-04-28 01:17:54 -07:00
2026-05-14 17:20:48 -07:00
2026-05-25 10:57:15 -07:00
2026-08-19 11:42:55 -07:00
2026-04-26 13:55:13 -07:00
2026-08-14 09:28:56 -07:00
2026-08-16 19:34:41 -07:00
2026-08-16 09:53:31 -07:00
2026-08-14 22:02:07 -07:00
2026-08-18 17:00:04 -07:00
2026-08-14 22:02:07 -07:00
2026-08-17 07:50:37 -07:00
2026-07-14 16:35:30 -07:00
2026-08-15 11:42:19 -07:00
2026-07-14 16:35:30 -07:00
2026-06-14 11:40:57 -07:00
2026-04-18 15:05:42 +08:00
2026-05-30 14:57:07 -07:00
2026-08-15 09:37:04 -07:00
2026-05-21 21:21:07 -07:00
2026-05-21 21:21:07 -07:00
2026-06-21 07:15:19 -07:00
2026-05-01 19:51:51 -07:00
2026-05-07 20:14:59 -07:00
2026-08-08 09:28:45 -07:00
2026-08-15 11:42:19 -07:00
2026-05-20 07:35:01 -07:00
2026-05-30 14:57:07 -07:00
2026-04-19 08:38:19 +08:00
2026-08-15 11:42:19 -07:00
2026-08-15 11:42:19 -07:00
2026-08-15 11:42:19 -07:00
2026-08-14 22:02:07 -07:00
2026-08-18 17:00:04 -07:00
2026-04-25 11:52:48 -07:00
2026-08-14 22:02:07 -07:00
2026-08-14 22:02:07 -07:00
2026-08-14 22:02:07 -07:00
2026-08-15 11:42:19 -07:00
2026-08-14 22:02:07 -07:00
2026-08-08 09:28:45 -07:00
2026-04-17 00:45:13 -07:00
2026-08-18 17:00:04 -07:00
2026-08-14 22:02:07 -07:00
2026-05-26 16:50:03 -07:00
2026-05-30 12:09:10 -07:00
2026-08-15 09:37:04 -07:00
2026-05-28 18:21:09 -07:00
2026-05-30 11:42:13 -07:00
2026-05-06 19:37:53 -07:00
2026-08-14 22:02:07 -07:00
2026-06-07 22:04:18 -07:00
2026-06-14 11:40:57 -07:00
2026-06-25 09:42:45 -07:00
2026-08-14 09:28:56 -07:00
2026-08-16 19:34:41 -07:00
2026-08-14 22:02:07 -07:00
2026-08-08 09:28:45 -07:00
2026-08-16 19:34:41 -07:00
2026-04-18 15:05:42 +08:00
2026-05-30 08:54:46 -07:00
2026-08-15 09:37:04 -07:00
2026-05-30 08:54:46 -07:00
2026-08-17 07:50:37 -07:00
2026-08-16 19:34:41 -07:00
2026-05-30 08:54:46 -07:00
2026-08-16 19:34:41 -07:00
2026-08-16 19:34:41 -07:00
2026-08-16 19:34:41 -07:00
2026-05-30 08:54:46 -07:00
2026-05-30 12:09:10 -07:00
2026-06-07 06:51:10 -07:00
2026-05-21 21:21:07 -07:00
2026-08-14 22:02:07 -07:00
2026-05-20 06:56:41 -07:00
2026-05-20 06:56:41 -07:00
2026-08-16 19:34:41 -07:00
2026-05-30 12:09:10 -07:00
2026-06-14 11:40:57 -07:00
2026-05-29 08:35:00 -07:00
2026-05-29 08:35:00 -07:00
2026-08-16 09:53:31 -07:00
2026-08-16 19:34:41 -07:00
2026-08-14 22:02:07 -07:00
2026-05-29 08:35:00 -07:00
2026-05-29 08:35:00 -07:00
2026-04-24 01:38:21 -07:00
2026-06-04 11:14:43 -07:00
2026-06-21 07:15:19 -07:00
2026-07-09 23:49:09 -07:00
2026-08-19 11:42:55 -07:00
2026-08-16 19:34:41 -07:00
2026-08-16 19:34:41 -07:00
2026-08-19 11:42:55 -07:00
2026-08-14 22:02:07 -07:00
2026-08-18 17:00:04 -07:00
2026-05-14 21:19:58 -07:00
2026-05-29 18:06:19 -07:00
2026-08-16 19:34:41 -07:00
2026-05-06 19:37:53 -07:00
2026-08-14 22:02:07 -07:00
2026-08-19 16:53:19 -07:00
2026-08-19 16:53:19 -07:00
2026-08-14 22:02:07 -07:00
2026-08-16 19:34:41 -07:00
2026-08-19 16:53:19 -07:00
2026-08-16 19:34:41 -07:00
2026-08-15 11:42:19 -07:00
2026-05-30 12:09:10 -07:00
2026-08-16 19:34:41 -07:00
2026-05-30 12:09:10 -07:00
2026-08-15 11:42:19 -07:00
2026-04-18 23:58:59 +08:00
2026-08-14 09:28:56 -07:00
2026-08-16 19:34:41 -07:00
2026-06-04 11:14:43 -07:00
2026-04-19 08:38:19 +08:00
2026-08-15 22:20:30 -07:00
2026-08-15 22:20:30 -07:00
2026-06-12 15:38:53 -07:00
2026-05-01 19:51:51 -07:00
2026-08-15 09:37:04 -07:00
2026-08-15 09:37:04 -07:00
2026-08-15 22:20:30 -07:00
2026-08-15 09:37:04 -07:00
2026-08-15 11:42:19 -07:00
2026-08-15 09:37:04 -07:00
2026-07-09 23:49:09 -07:00
2026-08-14 09:28:56 -07:00
2026-08-15 11:42:19 -07:00
2026-06-25 09:42:45 -07:00
2026-08-15 09:37:04 -07:00
2026-08-15 22:20:30 -07:00
2026-08-15 22:20:30 -07:00
2026-08-16 19:34:41 -07:00
2026-03-26 11:08:31 -07:00
2026-08-15 11:42:19 -07:00
2026-06-12 15:38:53 -07:00
2026-06-25 09:42:45 -07:00
2026-05-29 08:35:00 -07:00
2026-08-14 09:28:56 -07:00
2026-07-14 16:35:30 -07:00
2026-07-14 16:35:30 -07:00
2026-07-14 16:35:30 -07:00
2026-03-31 23:08:22 -06:00
2026-08-19 11:42:55 -07:00
2026-08-15 09:37:04 -07:00
2026-06-04 11:14:43 -07:00
2026-05-01 19:51:51 -07:00
2026-06-04 11:14:43 -07:00
2026-08-15 22:20:30 -07:00
2026-08-15 09:37:04 -07:00
2026-08-15 09:37:04 -07:00
2026-08-15 09:37:04 -07:00
2026-08-15 09:37:04 -07:00
2026-08-15 09:37:04 -07:00
2026-08-15 09:37:04 -07:00
2026-08-15 09:37:04 -07:00
2026-08-15 09:37:04 -07:00
2026-08-15 09:37:04 -07:00
2026-08-15 09:37:04 -07:00
2026-08-15 09:37:04 -07:00
2026-08-15 09:37:04 -07:00
2026-08-15 09:37:04 -07:00
2026-08-15 09:37:04 -07:00
2026-08-15 09:37:04 -07:00
2026-08-15 09:37:04 -07:00
2026-08-15 09:37:04 -07:00
2026-08-15 09:37:04 -07:00
2026-05-01 19:51:51 -07:00
2026-08-15 22:20:30 -07:00
2026-04-23 18:25:34 -07:00
2026-08-08 09:28:45 -07:00
2026-04-18 15:05:42 +08:00
2026-08-15 11:42:19 -07:00
2026-05-11 12:16:26 -07:00
2026-08-15 11:42:19 -07:00
2026-08-15 22:20:30 -07:00
2026-08-15 22:20:30 -07:00
2026-08-15 22:20:30 -07:00
2026-08-15 22:20:30 -07:00
2026-04-19 08:38:19 +08:00
2026-08-15 09:37:04 -07:00
2026-08-15 09:37:04 -07:00
2026-08-15 11:42:19 -07:00
2026-08-15 22:20:30 -07:00
2026-08-15 09:37:04 -07:00
2026-08-15 22:20:30 -07:00
2026-08-15 09:37:04 -07:00
2026-08-15 22:20:30 -07:00
2026-08-15 22:20:30 -07:00
2026-08-15 22:20:30 -07:00
2026-05-26 21:36:53 -07:00
2026-08-15 09:37:04 -07:00
2026-03-13 21:08:12 -07:00
2026-05-29 08:35:00 -07:00
2026-08-15 22:20:30 -07:00
2026-08-15 22:20:30 -07:00
2026-08-15 11:42:19 -07:00
2026-06-07 19:13:24 -07:00
2026-08-15 22:20:30 -07:00
2026-05-25 10:57:15 -07:00
2026-08-15 22:20:30 -07:00
2026-05-29 08:35:00 -07:00
2026-08-15 11:42:19 -07:00
2026-04-19 17:50:31 +08:00
2026-04-22 01:06:22 -07:00
2026-08-15 11:42:19 -07:00
2026-06-21 07:15:19 -07:00
2026-05-30 12:09:10 -07:00
2026-06-08 05:41:07 -07:00
2026-08-18 17:00:04 -07:00
2026-08-19 16:53:19 -07:00
2026-05-25 10:57:15 -07:00
2026-08-15 22:20:30 -07:00
2026-08-15 22:20:30 -07:00
2026-08-15 09:37:04 -07:00
2026-08-16 09:53:31 -07:00
2026-08-16 09:53:31 -07:00
2026-05-30 12:09:10 -07:00
2026-08-16 19:34:41 -07:00
2026-08-19 16:53:19 -07:00
2026-08-14 22:02:07 -07:00
2026-05-24 01:43:51 -07:00
2026-08-19 11:42:55 -07:00
2026-08-16 19:34:41 -07:00
2026-08-14 22:02:07 -07:00
2026-08-15 09:37:04 -07:00
2026-08-19 16:53:19 -07:00
2026-08-14 22:02:07 -07:00
2026-04-06 14:41:06 -07:00
2026-05-26 16:50:03 -07:00