feat(hook): clean shell environment for exec commands#67
Merged
Conversation
petmal
force-pushed
the
petr/clean-exec-env
branch
from
944eed0 to
a2dcff0
Compare
Contributor
|
@petmal needs conflicts resolved |
petmal
force-pushed
the
petr/clean-exec-env
branch
from
320431e to
b10ae10
Compare
Contributor
Author
|
@z00b I rebased, the PR now contains changes from TTL commit as well which was merged into this branch. |
z00b
reviewed
Mar 12, 2026
Contributor
|
sorry @petmal i just realized my only comment was sitting in a pending review. i'll take a look at the rest now. |
Add TTL to scope markers so dead-session markers (where SessionEnd never fired) can be reclaimed by new sessions. - Add `isExpired()` helper and `MARKER_TTL_MS` constant (default 5 min) - Expired markers from different sessions are reclaimed (both paths) - Non-expired markers preserved (subagent safety unchanged) - Same-session calls always bypass TTL; pauses of any length are safe - Refresh marker timestamp on every same-session `activateScope()` call - Add `getMarkerTtlMs()` to env library, configurable via `CHUNK_HOOK_MARKER_TTL_MS` (0 disables session protection) - Replace "stale" terminology with "valid"/"expired" in log messages - Add 6 unit tests and 3 integration tests for TTL behavior - Update AGENTS.md and README.md with TTL documentation
petmal
force-pushed
the
petr/clean-exec-env
branch
from
b10ae10 to
9b04204
Compare
Exec commands (tests, lint) now run in a clean login-shell environment obtained via the `shell-env` package, preventing environment variables from the agent process (e.g. AGENT_MODE, CLAUDE_*) from leaking into user commands. Internal CLI operations (git, config) continue inheriting process.env normally -- only the user's exec commands get the clean shell. Changes: - Add `shell-env` dependency to packages/hook - Add `getCleanEnv()` to shell-env.ts with Promise-level caching so concurrent callers share a single login-shell spawn - Add `extendEnv` flag to `RunOptions` in proc.ts (defaults to `true` for backward compatibility) - Wire clean env in exec.ts with `extendEnv: false` - Set `env = false` in bunfig.toml to disable .env auto-loading during development (bun run dev) - Remove `--loader .md:text` from build scripts (already defined in bunfig.toml) - Keep `--no-compile-autoload-dotenv` in build scripts -- this is a compile-time flag for `bun build --compile` that embeds the behavior into the standalone binary. Unlike `env = false` in bunfig.toml (which only affects the Bun runtime), compiled binaries do not read bunfig.toml at runtime, so the CLI flag is the only way to prevent them from auto-loading .env files from CWD. - Add tests for extendEnv behavior and getCleanEnv
petmal
force-pushed
the
petr/clean-exec-env
branch
from
9b04204 to
e6f6e05
Compare
Contributor
Author
|
@z00b OK, I tried to incorporate these changes. I also updated the PR. Had to keep --no-compile-autoload-dotenv as that is compile-time flag which builds the auto-load behaviour into the binary itself. |
z00b
approved these changes
Mar 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Exec commands (tests, lint) now run in a clean login-shell environment obtained via the
shell-envpackage, preventing environment variables from the agent process (e.g.AGENT_MODE,CLAUDE_*) from leaking into user commands.Internal CLI operations (git, config) continue inheriting
process.envnormally — only the user's exec commands get the clean shell.Changes
shell-envdependency topackages/hookgetCleanEnv()toshell-env.tswith Promise-level caching so concurrent callers share a single login-shell spawnextendEnvflag toRunOptionsinproc.ts(defaults totruefor backward compatibility)exec.tswithextendEnv: falseenv = falseinbunfig.tomlto disable.envauto-loading during development (bun run dev)--loader .md:textfrom build scripts (already defined inbunfig.toml)--no-compile-autoload-dotenvin build scripts — this is a compile-time flag forbun build --compilethat embeds the behavior into the standalone binary. Unlikeenv = falseinbunfig.toml(which only affects the Bun runtime), compiled binaries do not readbunfig.tomlat runtime, so the CLI flag is the only way to prevent them from auto-loading.envfiles from CWD.extendEnvbehavior andgetCleanEnv