[APPS-2792] Add process.env scoping for local execution (Secret Store parity) - #504

Merged

gh-worker-dd-mergequeue-cf854d[bot] merged 9 commits into

tiffany.trinh/apps-2792-secret-store-parity

Sep 11, 2026

Commits on Sep 11, 2026

feat(apps): scope process.env to an allowlist during local execution (Secret Store parity)
tyffical
committed
8f9d348
fix(apps): stop Vite from inlining real process.env into backend function builds

tyffical
and
claude
committed
cee8770
test(apps): widen $ credential-leak test to scan the whole object, not just Source
tyffical
committed
f28e1c4
fix(apps): harden env-guard against bypasses and a CI-breaking Proxy bug found in review
tyffical
committed
f9b6422
fix(apps): close env-guard bypasses via mutable getStore/fs helpers, a self-assignment no-op, and unredacted writeReport output
tyffical
committed
3ee9b4b
fix(apps): stop exposing raw realEnv/AsyncLocalStorage on the shared fs/net registries
tyffical
committed
ac4110e
fix(apps): stop an abandoned execution's env-scope cleanup from disarming a concurrent one
tyffical
committed
a76db84
fix(apps): guard FileHandle read methods against .fd shadow bypasses
tyffical
committed
5bf6365
fix(apps): cross-check extractFdNumber against the native fd getter
tyffical
committed
c694dcf