Prevent runner startup from loading project configuration

[cedrecode]

Closes #25

What changed

• Start the shipped runner through a POSIX shell boundary before Bun can read project-controlled configuration.
• Disable automatic .env loading, ignore the working directory's bunfig.toml, and remove inherited BUN_OPTIONS and NODE_OPTIONS before trusted TypeScript starts.
• Preserve the existing wrapper-entry deadline and signal semantics in a dedicated TypeScript entry point.
• Add a boundary regression test covering .env, Bun preload execution, inherited startup options, ordinary inherited environment variables, and the shipped executable.

Verification

• Bun tests, strict typecheck, static invariants, and plugin validation pass.
• The exact candidate is installed in every affected harness.
• The changed behavior passes from each real user surface.
• The installed version, action, and observed result appear below.

Live evidence:

• Candidate: fe2537fff55dbc3ef8e276678cc9d682cd44b93e, Open Pstack 1.2.0, Bun 1.4.0.
• Automated: 156 tests and 639 assertions pass; strict TypeScript, static invariants, both strict Claude manifest validations, sh -n, and git diff --check pass.
• Adversarial review: a security/code reviewer first found project bunfig.toml, BUN_OPTIONS, and NODE_OPTIONS bypasses in the initial fix. After the shell-boundary revision, the reviewer reported no findings, residual risks, or test gaps.
• Codex: pstack@open-pstack installed and enabled from the exact checkout. From a fixture containing hostile .env, bunfig.toml preload, BUN_OPTIONS, and NODE_OPTIONS, the real subscription-backed Codex lane completed with PSTACK_LIVE_OK; the preload marker remained absent.
• Claude Code: pstack@open-pstack installed and enabled from the same checkout. The real Claude preflight authenticated, reached the subscription-backed API, and the hostile preload marker remained absent, proving the changed startup boundary. The subsequent model completion stopped on an unrelated account-level HTTP 429 (out of usage credits); the successful Codex lane above verifies end-to-end completion through the same shared runner.

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[devtechdigital]

@Mergifyio queue

[mergify]

queue

☑️ Command disallowed due to command restrictions in the Mergify configuration.

Details

• sender-permission >= write

[devtechdigital]

@ericlitman CI is still awaiting maintainer approval: https://github.com/ericlitman/open-pstack/actions/runs/33003113377

Mergify has accepted the queue command, so approving that workflow run is the remaining blocker.

[ericlitman]

Gavel verdict: Request changes

2 blocking findings; 0 unconfirmed plausible findings; 0 killed by adjudication.

Quorum: 4/3 successful reviewers.
Continuity: 2 open · 0 resolved · 0 reopened.
Scope: initial full review.

Top findings

• CRITICAL plugins/pstack/skills/poteto-mode/scripts/runner/pstack-runner:4 RIGHT Avoid PATH-searching dirname in the trusted wrapper — The bare dirname command is resolved through the inherited PATH before BUN_OPTIONS and NODE_OPTIONS are cleared. For example, with PATH=$HOME/.bun/bin:$PWD/bin:/usr/bin, the old shebang selected the trusted Bun from the first component, but the new wrapper executes a repository-controlled $PWD/bin/dirname, allowing arbitrary code to run with the user's credentials before preflight. Derive the directory using shell parameter expansion or otherwise invoke a known-trusted utility without searching inherited project paths.
• MEDIUM plugins/pstack/skills/poteto-mode/scripts/runner/entry.ts:3 RIGHT Start the deadline at the shell boundary — The new shell wrapper performs directory resolution and starts Bun before this timestamp is captured, so receipts underreport elapsed time and an explicit timeout can begin preflight after the caller's deadline when shell startup is slow. Capture and pass the launch time from pstack-runner so the end-to-end deadline still starts at wrapper entry.

---

Gavel run panel:fe2537fff55dbc3ef8e276678cc9d682cd44b93e:Md9jErmixqi:_pV0TgS-FAM · Commit fe2537fff55dbc3ef8e276678cc9d682cd44b93e
Judge: native (primary) openai/gpt-6-astra · tools: yes
Full record: GET /gavel/run/panel:fe2537fff55dbc3ef8e276678cc9d682cd44b93e:Md9jErmixqi:_pV0TgS-FAM