fix: keep an own __proto__ key when copying the spawn environment

[Mykola Dementiev (nikolay-dementiev)]

Fixes #993

Problem

spawn copies options.env with assign (src/utils.ts) using target[key] = source[key]. When the source has an own __proto__ key (for example one that came from JSON.parse), the assignment runs the Object.prototype.__proto__ setter instead of creating a property. A string value is ignored, so the variable never reaches _parseEnv and the child starts without it. child_process passes the same object through.

Change

assign now creates each property with Object.defineProperty (enumerable, writable, configurable), so an own __proto__ key is copied as an ordinary property and the target's prototype is untouched. The properties stay writable and configurable, so _sanitizeEnv (delete) and the later PWD / TERM assignments keep working. Signature and return value are unchanged. The same assign is used by UnixTerminal and WindowsTerminal.

Tests

• src/utils.test.ts (new): assign copies an own __proto__ key as an own property, keeps the prototype, and still copies other keys.
• src/unixTerminal.test.ts: spawn passes an own __proto__ env entry to the child (real spawn, exact output true:selected-value).

Both tests fail on the unfixed code (false !== true and false:[object Object]).

Verification

macOS 26.5.2 arm64, Node v26.3.0, npm 11.16.0:

• npm run build
• npm test: 26 passing (24 before), eslint src/ clean
• reproduction from the issue against the built lib/: prints true:selected-value (was false:[object Object])

Not verified

• Windows / ConPTY: WindowsTerminal runs the same assign, but this was not run on Windows.
• Linux and Node 22.x: covered by CI, not run locally.

[Mykola Dementiev (nikolay-dementiev)]

@microsoft-github-policy-service agree