fix: stop the release executable from loading the project's .env and bunfig.toml (#1589)

Fixes #1579.

## Problem

The release executable is built with `bun build --compile`. By default a
compiled Bun executable loads `.env`, `.env.local` and `bunfig.toml`
from its working directory at startup. The editor starts the agent in
the user's project, so:

- The project's dotenv values land in the agent's `process.env` and are
passed on to Claude and every Bash command as real environment
variables. Most frameworks never override a variable that is already
set, so the project's own `.env.test` is silently ignored. In the
reported case this made a test suite drop the dev database.
- A `bunfig.toml` in the project that Bun cannot parse stops the agent
from starting (`SyntaxError: An error occurred while parsing code`, exit
1).

Only the executable is affected; running the npm package under Node does
not load these files.

## Fix

`scripts/build-binary.mjs` passes `--no-compile-autoload-dotenv` and
`--no-compile-autoload-bunfig`. Bun's other two autoloads
(`tsconfig.json`, `package.json`) are already off by default.

## Testing

`scripts/smoke-binary.mjs` gains a check that runs the executable in a
directory containing a `.env`, a `.env.local` and an unparseable
`bunfig.toml`, with Node standing in for `claude` to print the
environment the CLI is spawned with. It fails on an executable built
without the flags and passes with them.

Run locally on macOS arm64 only; the Linux, Alpine and Windows targets
are covered by the `binaries.yml` matrix.

scripts/build-binary.mjs

@@ -74,9 +74,24 @@ try {
   process.exit(1);
 }
 
+// By default a compiled executable loads `.env`, `.env.local` and `bunfig.toml`
+// from its working directory at startup. That directory is the user's project:
+// its dotenv values would reach Claude and every Bash command as real
+// environment variables (overriding the project's own `.env.test`), and a
+// `bunfig.toml` that fails to parse would stop the agent from starting.
 const bun = spawnSync(
   "bun",
-  ["build", "src/binary-entry.ts", "--compile", "--target", target, "--outfile", outfile],
+  [
+    "build",
+    "src/binary-entry.ts",
+    "--compile",
+    "--no-compile-autoload-dotenv",
+    "--no-compile-autoload-bunfig",
+    "--target",
+    target,
+    "--outfile",
+    outfile,
+  ],
   { cwd: repoRoot, stdio: "inherit", shell: process.platform === "win32" },
 );
 if (bun.error) {

scripts/smoke-binary.mjs

@@ -58,8 +58,9 @@ function check(ok, label, detail) {
 
 // ---------------------------------------------------------------- basic
 
-function runSync(args, [cmd, ...cmdArgs] = [command, ...commandArgs]) {
+function runSync(args, [cmd, ...cmdArgs] = [command, ...commandArgs], cwd) {
   const result = spawnSync(cmd, [...cmdArgs, ...args], {
+    cwd,
     encoding: "utf8",
     timeout: 60_000,
   });
@@ -101,6 +102,26 @@ if (positionals.length === 0) {
       "without claude next to it, says the CLI is missing",
       missing.stdout || missing.error,
     );
+
+    // Started in a project directory, the executable must not read the
+    // project's dotenv files or bunfig.toml. Node stands in for `claude`, to
+    // print the environment the CLI is spawned with.
+    copyFileSync(process.execPath, join(scratch, `claude${exe}`));
+    const project = join(scratch, "project");
+    mkdirSync(project);
+    writeFileSync(join(project, ".env"), "ACP_SMOKE_DOTENV=leaked\n");
+    writeFileSync(join(project, ".env.local"), "ACP_SMOKE_DOTENV_LOCAL=leaked\n");
+    writeFileSync(join(project, "bunfig.toml"), "= not toml\n");
+    const probe = runSync(
+      ["--cli", "-p", "[process.env.ACP_SMOKE_DOTENV, process.env.ACP_SMOKE_DOTENV_LOCAL].join()"],
+      [alone],
+      project,
+    );
+    check(
+      probe.stdout === ",",
+      "ignores .env, .env.local and bunfig.toml in the working directory",
+      probe.stdout || probe.error,
+    );
   } finally {
     rmSync(scratch, { recursive: true, force: true });
   }