sanitize release child environments and bump version to 5.0.83

@@ -1,7 +1,7 @@11 {22   "manifest_version": 3,33   "name": "Peach Password Manager",4-  "version": "5.0.82",4+  "version": "5.0.83",55   "description": "Zero-knowledge password manager",66   "browser_specific_settings": {77     "gecko": {

@@ -2,7 +2,7 @@22   "manifest_version": 3,33   "minimum_chrome_version": "116",44   "name": "Peach Password Manager",5-  "version": "5.0.82",5+  "version": "5.0.83",66   "description": "Zero-knowledge password manager",77   "action": {88     "default_popup": "src/popup/index.html",

@@ -1,6 +1,6 @@11 {22   "name": "peach",3-  "version": "5.0.82",3+  "version": "5.0.83",44   "description": "Zero-knowledge password manager",55   "license": "GPL-3.0-only",66   "type": "module",

@@ -8,6 +8,7 @@88 import {99   buildCommand,1010   safeEnv,11+  releaseGateEnv,1112   cwsUploadEnv,1213   amoSignEnv,1314   resolveBin,@@ -117,6 +118,40 @@117118     const env = safeEnv();118119     expect(env.PATH).toBe("/usr/bin:/bin");119120     expect(env.HOME).toBe("/tmp/test-home");121+  });122+123+  it("safeEnv strips build-behavior overrides from release children", () => {124+    for (const [name, value] of Object.entries({125+      BUILD_TARGET: "firefox",126+      PEACH_E2E_PASSKEYS: "1",127+      PEACH_DEBUG: "1",128+      DEBUG: "vite:*",129+      NODE_ENV: "development",130+      MODE: "development",131+      VITE_MODE: "development",132+      CI: "true",133+    })) setEnv(name, value);134+135+    const env = safeEnv();136+    for (const name of [137+      "BUILD_TARGET",138+      "PEACH_E2E_PASSKEYS",139+      "PEACH_DEBUG",140+      "DEBUG",141+      "NODE_ENV",142+      "MODE",143+      "VITE_MODE",144+      "CI",145+    ]) expect(env, `safeEnv must not contain ${name}`).not.toHaveProperty(name);146+  });147+148+  it("releaseGateEnv opts into only the intended release gate", () => {149+    setEnv("PEACH_RELEASE_BROWSER_GATE", "0");150+    setEnv("BUILD_TARGET", "firefox");151+152+    const env = releaseGateEnv();153+    expect(env.PEACH_RELEASE_BROWSER_GATE).toBe("1");154+    expect(env).not.toHaveProperty("BUILD_TARGET");120155   });121156 });122157 

@@ -37,8 +37,24 @@3737   ...AMO_SECRET_NAMES,3838 ]);3939 40-// ─── Binary resolution ─────────────────────────────────────────────────────40+const BUILD_BEHAVIOR_NAMES = new Set([41+  "BUILD_TARGET",42+  "CI",43+  "DEBUG",44+  "MODE",45+  "NODE_ENV",46+  "PEACH_DEBUG",47+  "PEACH_E2E_FIREFOX",48+  "PEACH_E2E_PASSKEYS",49+  "PEACH_RELEASE_BROWSER_GATE",50+]);4151 52+function isBuildBehaviorEnv(name: string): boolean {53+  return BUILD_BEHAVIOR_NAMES.has(name) || name.startsWith("VITE_");54+}55+56+// ─── Binary resolution ──────────────────────────────────────────────────────────57+4258 export function resolveBin(name: string): string {4359   const path = join(BIN_DIR, name);4460   if (!existsSync(path)) {@@ -66,7 +82,7 @@6682   const env: Record<string, string> = {};6783   for (const [key, val] of Object.entries(process.env)) {6884     if (val === undefined) continue;69-    if (ALL_SECRET_SET.has(key)) continue;85+    if (ALL_SECRET_SET.has(key) || isBuildBehaviorEnv(key)) continue;7086     env[key] = val;7187   }7288   return env;