fix: spawn resolves runtime PATH; doctor --fix root-ignores the secret key

Bun.spawn without an explicit env resolves argv[0] against the
startup PATH snapshot — CI (no real docker) failed where dev machines
masked it. buildSpawnEnv now always passes the live process env.
That exposed a real test leak: remote-caddy-routes restored HOME from
an unset per-test capture, unsetting HOME for the rest of the run.
doctor --fix now also ensures the root .gitignore entry when
untracking a leaked .hack.secret.key (nested .hack/.gitignore cannot
cover a repo-root file) — from PR review.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: roodboi

src/commands/doctor.ts

@@ -52,6 +52,7 @@ import {
 import { parseDotEnv } from "../lib/env.ts";
 import {
   ensureDir,
+  ensureGitignoreEntry,
   pathExists,
   readTextFile,
   writeTextFileIfChanged,
@@ -2726,7 +2727,16 @@ async function maybeUntrackGeneratedFiles(opts: {
     "Commit the removal to stop sharing these files.",
   ];
   if (inspection.secretKeyTracked) {
+    // The nested .hack/.gitignore cannot cover the repo-root key file; without
+    // the root entry the just-untracked key shows up as untracked and gets
+    // re-committed.
+    await ensureGitignoreEntry({
+      gitignorePath: resolve(project.projectRoot, ".gitignore"),
+      entry: PROJECT_ENV_KEY_FILENAME,
+      comment: "# project env key",
+    });
     notes.push(
+      `Ensured ${PROJECT_ENV_KEY_FILENAME} is ignored in the root .gitignore.`,
       `${PROJECT_ENV_KEY_FILENAME} was committed — treat it as leaked: rotate the key and re-encrypt secrets, and consider rewriting git history if the repo is shared.`
     );
   }

src/lib/shell.ts

@@ -10,20 +10,25 @@ export interface ExecOptions {
   readonly stdin?: "inherit" | "pipe" | "ignore";
 }
 
+/**
+ * Build the child env from the CURRENT `process.env` plus overrides.
+ *
+ * Always returns an explicit env (never undefined): `Bun.spawn` without an
+ * env resolves argv[0] against the PATH snapshot captured at process
+ * startup, which ignores runtime PATH changes — the same pitfall
+ * `findExecutableInPath` documents. Passing the live env keeps child
+ * behavior identical for normal runs while honoring runtime PATH.
+ */
 function buildSpawnEnv(
   override: Record<string, string> | undefined
-): Record<string, string> | undefined {
-  if (!override) {
-    return undefined;
-  }
-
+): Record<string, string> {
   const base: Record<string, string> = {};
   for (const [key, value] of Object.entries(process.env)) {
     if (typeof value === "string") {
       base[key] = value;
     }
   }
-  return { ...base, ...override };
+  return override ? { ...base, ...override } : base;
 }
 
 export async function exec(

tests/doctor-generated-files.test.ts

@@ -9,7 +9,7 @@ import {
   inspectTrackedGeneratedFiles,
   untrackGeneratedFiles,
 } from "../src/lib/doctor-generated-files.ts";
-import { pathExists } from "../src/lib/fs.ts";
+import { ensureGitignoreEntry, pathExists } from "../src/lib/fs.ts";
 import { ensureHackDirGitignore } from "../src/lib/project-env-config.ts";
 
 const tempDirs = new Set<string>();
@@ -179,3 +179,38 @@ test("untrackGeneratedFiles with no paths is a no-op", async () => {
   });
   expect(result).toEqual({ ok: true, error: null });
 });
+
+test("untracked secret key stays ignored once the root gitignore entry is ensured", async () => {
+  const repoRoot = await createLeakedRepo();
+
+  const inspection = await inspectTrackedGeneratedFiles({
+    projectRoot: repoRoot,
+    projectDirName: ".hack",
+  });
+  expect(inspection?.secretKeyTracked).toBe(true);
+
+  const untracked = await untrackGeneratedFiles({
+    projectRoot: repoRoot,
+    paths: inspection?.trackedPaths ?? [],
+  });
+  expect(untracked.ok).toBe(true);
+
+  await ensureHackDirGitignore({ projectDir: resolve(repoRoot, ".hack") });
+  await ensureGitignoreEntry({
+    gitignorePath: resolve(repoRoot, ".gitignore"),
+    entry: PROJECT_ENV_KEY_FILENAME,
+    comment: "# project env key",
+  });
+
+  const ignored = await runGit(
+    ["check-ignore", PROJECT_ENV_KEY_FILENAME],
+    repoRoot
+  );
+  expect(ignored).toBe(PROJECT_ENV_KEY_FILENAME);
+
+  const status = await runGit(["status", "--porcelain"], repoRoot);
+  expect(status).not.toContain(`?? ${PROJECT_ENV_KEY_FILENAME}`);
+  expect(await pathExists(resolve(repoRoot, PROJECT_ENV_KEY_FILENAME))).toBe(
+    true
+  );
+});

tests/remote-caddy-routes.test.ts

@@ -12,14 +12,22 @@ import {
 } from "../src/lib/remote-caddy-routes.ts";
 
 let tempHome: string | null = null;
-let previousHome: string | undefined;
+// Captured at module scope: afterEach runs after EVERY test, including ones
+// that never reassign HOME — a per-test capture would restore `undefined`
+// and unset HOME for the rest of the process (Bun deletes on
+// undefined-assign, unlike Node's string coercion).
+const previousHome: string | undefined = process.env.HOME;
 
 afterEach(async () => {
   if (tempHome) {
     await rm(tempHome, { recursive: true, force: true });
     tempHome = null;
   }
-  process.env.HOME = previousHome;
+  if (previousHome === undefined) {
+    Reflect.deleteProperty(process.env, "HOME");
+  } else {
+    process.env.HOME = previousHome;
+  }
 });
 
 test("extractCaddyHostsFromCompose returns normalized hostnames from caddy labels", () => {
@@ -65,7 +73,6 @@ test("resolveProjectHostsForBridge falls back to <project>.hack when compose has
 
 test("reconcileRemoteCaddyRoutesForProject writes registry and compose when global caddy is not installed", async () => {
   tempHome = await mkdtemp(join(tmpdir(), "hack-remote-routes-reconcile-"));
-  previousHome = process.env.HOME;
   process.env.HOME = tempHome;
 
   const projectDir = resolve(tempHome, "workspace", "bridge-project", ".hack");
@@ -108,7 +115,6 @@ test("reconcileRemoteCaddyRoutesForProject writes registry and compose when glob
 
 test("readRemoteCaddyRoutesState reports persisted registry/compose metadata", async () => {
   tempHome = await mkdtemp(join(tmpdir(), "hack-remote-routes-state-"));
-  previousHome = process.env.HOME;
   process.env.HOME = tempHome;
 
   const projectDir = resolve(tempHome, "workspace", "state-project", ".hack");