@aria-cli/tools 1.0.0

package/tests/executors/shell-env-blocklist.test.ts

@@ -0,0 +1,648 @@
+/**
+ * @aria/tools - Shell env var blocklist tests (C1 + I1)
+ *
+ * Verifies that dangerous environment variables are stripped from both
+ * inputEnv and ctx.env before being passed to child processes.
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import * as os from "node:os";
+import type { ToolContext } from "../../src/types.js";
+import { executeBash } from "../../src/executors/shell.js";
+
+// Uses realpath to resolve symlinks (e.g., /tmp -> /private/tmp on macOS)
+const createTempDir = async (): Promise<string> => {
+  const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), "aria-blocklist-test-"));
+  return fs.realpath(tempDir);
+};
+
+const cleanupTempDir = async (dir: string): Promise<void> => {
+  await fs.rm(dir, { recursive: true, force: true });
+};
+
+const createContext = (workingDir: string, env: Record<string, string> = {}): ToolContext => ({
+  workingDir,
+  env,
+  confirm: async () => true,
+});
+
+/**
+ * Complete list of all blocked environment variables.
+ * Must stay in sync with BLOCKED_INPUT_ENV_VARS in shell.ts.
+ */
+const ALL_BLOCKED_VARS = [
+  // Original blocklist
+  "LD_PRELOAD",
+  "LD_LIBRARY_PATH",
+  "DYLD_INSERT_LIBRARIES",
+  "DYLD_FRAMEWORK_PATH",
+  "DYLD_LIBRARY_PATH",
+  "BASH_ENV",
+  "ENV",
+  "CDPATH",
+  "GLOBIGNORE",
+  "PROMPT_COMMAND",
+  "SHELLOPTS",
+  "BASHOPTS",
+  // Git context hijacks
+  "GIT_DIR",
+  "GIT_WORK_TREE",
+  "GIT_INDEX_FILE",
+  "GIT_OBJECT_DIRECTORY",
+  "GIT_ALTERNATE_OBJECT_DIRECTORIES",
+  "GIT_COMMON_DIR",
+  "GIT_PREFIX",
+  "GIT_INTERNAL_SUPER_PREFIX",
+  "GIT_CONFIG",
+  "GIT_CONFIG_GLOBAL",
+  "GIT_CONFIG_SYSTEM",
+  "GIT_CONFIG_COUNT",
+  "GIT_CEILING_DIRECTORIES",
+  // Expanded blocklist (aria-mx5)
+  "PATH",
+  "NODE_OPTIONS",
+  "NODE_PATH",
+  "PYTHONPATH",
+  "IFS",
+  "HOME",
+  "SHELL",
+  "EDITOR",
+  "VISUAL",
+  // Java runtime hijacks (aria-skg)
+  "JAVA_TOOL_OPTIONS",
+  "_JAVA_OPTIONS",
+  "CLASSPATH",
+  // Ruby runtime hijacks (aria-skg)
+  "RUBYOPT",
+  "GEM_HOME",
+  "GEM_PATH",
+  // Perl runtime hijacks (aria-skg)
+  "PERL5OPT",
+  "PERL5LIB",
+  // Python startup hijack (aria-skg)
+  "PYTHONSTARTUP",
+];
+
+describe("Shell env var blocklist", () => {
+  let tempDir: string;
+
+  beforeEach(async () => {
+    tempDir = await createTempDir();
+  });
+
+  afterEach(async () => {
+    await cleanupTempDir(tempDir);
+  });
+
+  describe("inputEnv filtering", () => {
+    it("should strip LD_PRELOAD from inputEnv", async () => {
+      const ctx = createContext(tempDir);
+      const result = await executeBash(
+        { command: "echo LD_PRELOAD=$LD_PRELOAD", env: { LD_PRELOAD: "/evil/lib.so" } },
+        ctx,
+      );
+
+      expect(result.success).toBe(true);
+      const data = result.data as { stdout: string };
+      expect(data.stdout.trim()).toBe("LD_PRELOAD=");
+    });
+
+    it("should strip BASH_ENV from inputEnv", async () => {
+      const ctx = createContext(tempDir);
+      const result = await executeBash(
+        { command: "echo BASH_ENV=$BASH_ENV", env: { BASH_ENV: "/evil/script.sh" } },
+        ctx,
+      );
+
+      expect(result.success).toBe(true);
+      const data = result.data as { stdout: string };
+      expect(data.stdout.trim()).toBe("BASH_ENV=");
+    });
+
+    it("should strip indexed git config vars from inputEnv", async () => {
+      const ctx = createContext(tempDir);
+      const result = await executeBash(
+        {
+          command: "env | grep -Ec '^GIT_CONFIG_(KEY|VALUE)_0=' || true",
+          env: {
+            GIT_CONFIG_KEY_0: "core.bare",
+            GIT_CONFIG_VALUE_0: "true",
+          },
+        },
+        ctx,
+      );
+
+      expect(result.success).toBe(true);
+      const data = result.data as { stdout: string };
+      expect(data.stdout.trim()).toBe("0");
+    });
+
+    it("should strip DYLD_INSERT_LIBRARIES from inputEnv", async () => {
+      const ctx = createContext(tempDir);
+      const result = await executeBash(
+        {
+          command: "echo DYLD=$DYLD_INSERT_LIBRARIES",
+          env: { DYLD_INSERT_LIBRARIES: "/evil/dylib.dylib" },
+        },
+        ctx,
+      );
+
+      expect(result.success).toBe(true);
+      const data = result.data as { stdout: string };
+      expect(data.stdout.trim()).toBe("DYLD=");
+    });
+
+    it("should strip GIT_DIR from inputEnv", async () => {
+      const ctx = createContext(tempDir);
+      const result = await executeBash(
+        {
+          command: "echo GIT_DIR=$GIT_DIR",
+          env: { GIT_DIR: "/tmp/not-repo" },
+        },
+        ctx,
+      );
+
+      expect(result.success).toBe(true);
+      const data = result.data as { stdout: string };
+      expect(data.stdout.trim()).toBe("GIT_DIR=");
+    });
+
+    it("should strip GIT_CONFIG_KEY_* prefix vars from inputEnv", async () => {
+      const ctx = createContext(tempDir);
+      const result = await executeBash(
+        {
+          command: "env | grep -c '^GIT_CONFIG_KEY_0=' || true",
+          env: {
+            GIT_CONFIG_COUNT: "1",
+            GIT_CONFIG_KEY_0: "user.name",
+            GIT_CONFIG_VALUE_0: "poisoned",
+          },
+        },
+        ctx,
+      );
+
+      expect(result.success).toBe(true);
+      const data = result.data as { stdout: string };
+      expect(data.stdout.trim()).toBe("0");
+    });
+
+    it("should strip NODE_OPTIONS from inputEnv", async () => {
+      const ctx = createContext(tempDir);
+      const result = await executeBash(
+        {
+          command: "echo NODE_OPTIONS=$NODE_OPTIONS",
+          env: { NODE_OPTIONS: "--require /evil/payload.js" },
+        },
+        ctx,
+      );
+
+      expect(result.success).toBe(true);
+      const data = result.data as { stdout: string };
+      expect(data.stdout.trim()).toBe("NODE_OPTIONS=");
+    });
+
+    it("should strip NODE_PATH from inputEnv", async () => {
+      const ctx = createContext(tempDir);
+      // NODE_PATH may be set by vitest in process.env, so check that the evil value is not present
+      const result = await executeBash(
+        {
+          command: "env | grep -c '^NODE_PATH=/evil/modules$' || true",
+          env: { NODE_PATH: "/evil/modules" },
+        },
+        ctx,
+      );
+
+      expect(result.success).toBe(true);
+      const data = result.data as { stdout: string };
+      expect(data.stdout.trim()).toBe("0");
+    });
+
+    it("should strip PYTHONPATH from inputEnv", async () => {
+      const ctx = createContext(tempDir);
+      const result = await executeBash(
+        { command: "echo PYTHONPATH=$PYTHONPATH", env: { PYTHONPATH: "/evil/python" } },
+        ctx,
+      );
+
+      expect(result.success).toBe(true);
+      const data = result.data as { stdout: string };
+      expect(data.stdout.trim()).toBe("PYTHONPATH=");
+    });
+
+    it("should strip IFS from inputEnv", async () => {
+      const ctx = createContext(tempDir);
+      const result = await executeBash({ command: "echo IFS=$IFS", env: { IFS: "EVIL" } }, ctx);
+
+      expect(result.success).toBe(true);
+      const data = result.data as { stdout: string };
+      // IFS is not set to "EVIL" — it should be whatever the shell default is
+      expect(data.stdout.trim()).not.toContain("EVIL");
+    });
+
+    it("should strip EDITOR from inputEnv", async () => {
+      const ctx = createContext(tempDir);
+      const result = await executeBash(
+        { command: "echo EDITOR=$EDITOR", env: { EDITOR: "/evil/editor" } },
+        ctx,
+      );
+
+      expect(result.success).toBe(true);
+      const data = result.data as { stdout: string };
+      expect(data.stdout.trim()).not.toContain("/evil/editor");
+    });
+
+    it("should strip VISUAL from inputEnv", async () => {
+      const ctx = createContext(tempDir);
+      const result = await executeBash(
+        { command: "echo VISUAL=$VISUAL", env: { VISUAL: "/evil/visual" } },
+        ctx,
+      );
+
+      expect(result.success).toBe(true);
+      const data = result.data as { stdout: string };
+      expect(data.stdout.trim()).not.toContain("/evil/visual");
+    });
+
+    it("should handle case-insensitive blocking (lowercase)", async () => {
+      const ctx = createContext(tempDir);
+      const result = await executeBash(
+        { command: "echo $ld_preload", env: { ld_preload: "/evil/lib.so" } },
+        ctx,
+      );
+
+      expect(result.success).toBe(true);
+      const data = result.data as { stdout: string };
+      // Variable should be stripped; output should be empty
+      expect(data.stdout.trim()).toBe("");
+    });
+
+    it("should handle case-insensitive blocking (mixed case)", async () => {
+      const ctx = createContext(tempDir);
+      const result = await executeBash(
+        { command: "echo $Bash_Env", env: { Bash_Env: "/evil/script.sh" } },
+        ctx,
+      );
+
+      expect(result.success).toBe(true);
+      const data = result.data as { stdout: string };
+      expect(data.stdout.trim()).toBe("");
+    });
+
+    it("should handle case-insensitive blocking for new vars (mixed case Node_Options)", async () => {
+      const ctx = createContext(tempDir);
+      const result = await executeBash(
+        { command: "echo $Node_Options", env: { Node_Options: "--require /evil/payload.js" } },
+        ctx,
+      );
+
+      expect(result.success).toBe(true);
+      const data = result.data as { stdout: string };
+      expect(data.stdout.trim()).toBe("");
+    });
+
+    it("should pass through non-blocked variables", async () => {
+      const ctx = createContext(tempDir);
+      const result = await executeBash(
+        { command: "echo $SAFE_VAR", env: { SAFE_VAR: "safe_value" } },
+        ctx,
+      );
+
+      expect(result.success).toBe(true);
+      const data = result.data as { stdout: string };
+      expect(data.stdout.trim()).toBe("safe_value");
+    });
+
+    it("should strip blocked vars while passing non-blocked vars simultaneously", async () => {
+      const ctx = createContext(tempDir);
+      const result = await executeBash(
+        {
+          command: 'echo "safe=$MY_SAFE ld=$LD_PRELOAD"',
+          env: {
+            MY_SAFE: "hello",
+            LD_PRELOAD: "/evil/lib.so",
+          },
+        },
+        ctx,
+      );
+
+      expect(result.success).toBe(true);
+      const data = result.data as { stdout: string };
+      expect(data.stdout.trim()).toBe("safe=hello ld=");
+    });
+
+    it("should strip all known blocked variables from inputEnv", async () => {
+      const blockedVars: Record<string, string> = {};
+      for (const varName of ALL_BLOCKED_VARS) {
+        blockedVars[varName] = `evil_${varName.toLowerCase()}`;
+      }
+      // Add a canary that should survive
+      blockedVars["CANARY"] = "canary_value";
+
+      const ctx = createContext(tempDir);
+      const result = await executeBash({ command: "echo $CANARY", env: blockedVars }, ctx);
+
+      expect(result.success).toBe(true);
+      const data = result.data as { stdout: string };
+      // The non-blocked CANARY should still be available
+      expect(data.stdout.trim()).toBe("canary_value");
+    });
+
+    it.each([
+      ["GIT_DIR", "/evil/.git"],
+      ["GIT_WORK_TREE", "/evil/worktree"],
+      ["GIT_CONFIG_GLOBAL", "/evil/gitconfig"],
+      ["PATH", "/evil/bin"],
+      ["NODE_OPTIONS", "--require /evil/payload.js"],
+      ["NODE_PATH", "/evil/node_modules"],
+      ["PYTHONPATH", "/evil/python"],
+      ["IFS", "EVIL"],
+      ["HOME", "/evil/home"],
+      ["SHELL", "/evil/shell"],
+      ["EDITOR", "/evil/editor"],
+      ["VISUAL", "/evil/visual"],
+      // Java (aria-skg)
+      ["JAVA_TOOL_OPTIONS", "-javaagent:/evil/agent.jar"],
+      ["_JAVA_OPTIONS", "-Xbootclasspath:/evil/boot.jar"],
+      ["CLASSPATH", "/evil/classes"],
+      // Ruby (aria-skg)
+      ["RUBYOPT", "-r/evil/payload"],
+      ["GEM_HOME", "/evil/gems"],
+      ["GEM_PATH", "/evil/gem_path"],
+      // Perl (aria-skg)
+      ["PERL5OPT", "-M/evil/module"],
+      ["PERL5LIB", "/evil/perl_lib"],
+      // Python (aria-skg)
+      ["PYTHONSTARTUP", "/evil/startup.py"],
+    ])("should strip %s from inputEnv (parametric)", async (varName, evilValue) => {
+      const ctx = createContext(tempDir);
+      // Use env command + grep to check if the variable is present in the child env
+      const result = await executeBash(
+        {
+          command: `env | grep -c '^${varName}=${evilValue.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}' || true`,
+          env: { [varName]: evilValue },
+        },
+        ctx,
+      );
+
+      expect(result.success).toBe(true);
+      const data = result.data as { stdout: string };
+      // grep -c should return 0 (no matches) — the evil value was not passed through
+      expect(data.stdout.trim()).toBe("0");
+    });
+  });
+
+  describe("ctx.env filtering (I1 fix)", () => {
+    it("should strip LD_PRELOAD from ctx.env", async () => {
+      const ctx = createContext(tempDir, { LD_PRELOAD: "/evil/lib.so" });
+      const result = await executeBash({ command: "echo LD_PRELOAD=$LD_PRELOAD" }, ctx);
+
+      expect(result.success).toBe(true);
+      const data = result.data as { stdout: string };
+      expect(data.stdout.trim()).toBe("LD_PRELOAD=");
+    });
+
+    it("should strip BASH_ENV from ctx.env", async () => {
+      const ctx = createContext(tempDir, { BASH_ENV: "/evil/script.sh" });
+      const result = await executeBash({ command: "echo BASH_ENV=$BASH_ENV" }, ctx);
+
+      expect(result.success).toBe(true);
+      const data = result.data as { stdout: string };
+      expect(data.stdout.trim()).toBe("BASH_ENV=");
+    });
+
+    it("should strip GIT_WORK_TREE from ctx.env", async () => {
+      const ctx = createContext(tempDir, { GIT_WORK_TREE: "/tmp/not-repo" });
+      const result = await executeBash({ command: "echo GIT_WORK_TREE=$GIT_WORK_TREE" }, ctx);
+
+      expect(result.success).toBe(true);
+      const data = result.data as { stdout: string };
+      expect(data.stdout.trim()).toBe("GIT_WORK_TREE=");
+    });
+
+    it("should strip indexed git config vars from ctx.env", async () => {
+      const ctx = createContext(tempDir, {
+        GIT_CONFIG_KEY_0: "core.bare",
+        GIT_CONFIG_VALUE_0: "true",
+      });
+      const result = await executeBash(
+        { command: "env | grep -Ec '^GIT_CONFIG_(KEY|VALUE)_0=' || true" },
+        ctx,
+      );
+
+      expect(result.success).toBe(true);
+      const data = result.data as { stdout: string };
+      expect(data.stdout.trim()).toBe("0");
+    });
+
+    it("should strip DYLD_INSERT_LIBRARIES from ctx.env", async () => {
+      const ctx = createContext(tempDir, { DYLD_INSERT_LIBRARIES: "/evil/dylib.dylib" });
+      const result = await executeBash({ command: "echo DYLD=$DYLD_INSERT_LIBRARIES" }, ctx);
+
+      expect(result.success).toBe(true);
+      const data = result.data as { stdout: string };
+      expect(data.stdout.trim()).toBe("DYLD=");
+    });
+
+    it("should strip NODE_OPTIONS from ctx.env", async () => {
+      const ctx = createContext(tempDir, { NODE_OPTIONS: "--require /evil/payload.js" });
+      const result = await executeBash({ command: "echo NODE_OPTIONS=$NODE_OPTIONS" }, ctx);
+
+      expect(result.success).toBe(true);
+      const data = result.data as { stdout: string };
+      expect(data.stdout.trim()).toBe("NODE_OPTIONS=");
+    });
+
+    it("should strip NODE_PATH from ctx.env", async () => {
+      const ctx = createContext(tempDir, { NODE_PATH: "/evil/modules" });
+      // NODE_PATH may be set by vitest in process.env, so check that the evil value is not present
+      const result = await executeBash(
+        { command: "env | grep -c '^NODE_PATH=/evil/modules$' || true" },
+        ctx,
+      );
+
+      expect(result.success).toBe(true);
+      const data = result.data as { stdout: string };
+      expect(data.stdout.trim()).toBe("0");
+    });
+
+    it("should strip PYTHONPATH from ctx.env", async () => {
+      const ctx = createContext(tempDir, { PYTHONPATH: "/evil/python" });
+      const result = await executeBash({ command: "echo PYTHONPATH=$PYTHONPATH" }, ctx);
+
+      expect(result.success).toBe(true);
+      const data = result.data as { stdout: string };
+      expect(data.stdout.trim()).toBe("PYTHONPATH=");
+    });
+
+    it("should strip HOME from ctx.env", async () => {
+      const ctx = createContext(tempDir, { HOME: "/evil/home" });
+      const result = await executeBash(
+        { command: "env | grep -c '^HOME=/evil/home' || true" },
+        ctx,
+      );
+
+      expect(result.success).toBe(true);
+      const data = result.data as { stdout: string };
+      expect(data.stdout.trim()).toBe("0");
+    });
+
+    it("should strip SHELL from ctx.env", async () => {
+      const ctx = createContext(tempDir, { SHELL: "/evil/shell" });
+      const result = await executeBash(
+        { command: "env | grep -c '^SHELL=/evil/shell' || true" },
+        ctx,
+      );
+
+      expect(result.success).toBe(true);
+      const data = result.data as { stdout: string };
+      expect(data.stdout.trim()).toBe("0");
+    });
+
+    it("should handle case-insensitive blocking on ctx.env", async () => {
+      const ctx = createContext(tempDir, { ld_preload: "/evil/lib.so" });
+      const result = await executeBash({ command: "echo $ld_preload" }, ctx);
+
+      expect(result.success).toBe(true);
+      const data = result.data as { stdout: string };
+      expect(data.stdout.trim()).toBe("");
+    });
+
+    it("should handle case-insensitive blocking on ctx.env for new vars", async () => {
+      const ctx = createContext(tempDir, { node_options: "--require /evil/payload.js" });
+      const result = await executeBash({ command: "echo $node_options" }, ctx);
+
+      expect(result.success).toBe(true);
+      const data = result.data as { stdout: string };
+      expect(data.stdout.trim()).toBe("");
+    });
+
+    it("should pass through non-blocked ctx.env variables", async () => {
+      const ctx = createContext(tempDir, {
+        SAFE_CTX_VAR: "ctx_safe_value",
+        LD_PRELOAD: "/evil/lib.so",
+      });
+      const result = await executeBash(
+        { command: 'echo "safe=$SAFE_CTX_VAR ld=$LD_PRELOAD"' },
+        ctx,
+      );
+
+      expect(result.success).toBe(true);
+      const data = result.data as { stdout: string };
+      expect(data.stdout.trim()).toBe("safe=ctx_safe_value ld=");
+    });
+
+    it.each([
+      ["GIT_DIR", "/evil/.git"],
+      ["GIT_WORK_TREE", "/evil/worktree"],
+      ["GIT_CONFIG_GLOBAL", "/evil/gitconfig"],
+      ["PATH", "/evil/bin"],
+      ["NODE_OPTIONS", "--require /evil/payload.js"],
+      ["NODE_PATH", "/evil/node_modules"],
+      ["PYTHONPATH", "/evil/python"],
+      ["IFS", "EVIL"],
+      ["HOME", "/evil/home"],
+      ["SHELL", "/evil/shell"],
+      ["EDITOR", "/evil/editor"],
+      ["VISUAL", "/evil/visual"],
+      // Java (aria-skg)
+      ["JAVA_TOOL_OPTIONS", "-javaagent:/evil/agent.jar"],
+      ["_JAVA_OPTIONS", "-Xbootclasspath:/evil/boot.jar"],
+      ["CLASSPATH", "/evil/classes"],
+      // Ruby (aria-skg)
+      ["RUBYOPT", "-r/evil/payload"],
+      ["GEM_HOME", "/evil/gems"],
+      ["GEM_PATH", "/evil/gem_path"],
+      // Perl (aria-skg)
+      ["PERL5OPT", "-M/evil/module"],
+      ["PERL5LIB", "/evil/perl_lib"],
+      // Python (aria-skg)
+      ["PYTHONSTARTUP", "/evil/startup.py"],
+    ])("should strip %s from ctx.env (parametric)", async (varName, evilValue) => {
+      const ctx = createContext(tempDir, { [varName]: evilValue });
+      const result = await executeBash(
+        {
+          command: `env | grep -c '^${varName}=${evilValue.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}' || true`,
+        },
+        ctx,
+      );
+
+      expect(result.success).toBe(true);
+      const data = result.data as { stdout: string };
+      expect(data.stdout.trim()).toBe("0");
+    });
+  });
+
+  describe("end-to-end: blocked vars not visible in child process", () => {
+    it("should not leak LD_PRELOAD to child process env via inputEnv", async () => {
+      const ctx = createContext(tempDir);
+      // Use env command to dump all environment, then grep for LD_PRELOAD
+      const result = await executeBash(
+        {
+          command: "env | grep -c '^LD_PRELOAD=' || true",
+          env: { LD_PRELOAD: "/evil/lib.so" },
+        },
+        ctx,
+      );
+
+      expect(result.success).toBe(true);
+      const data = result.data as { stdout: string };
+      // grep -c should return 0 (no matches)
+      expect(data.stdout.trim()).toBe("0");
+    });
+
+    it("should not leak LD_PRELOAD to child process env via ctx.env", async () => {
+      const ctx = createContext(tempDir, { LD_PRELOAD: "/evil/lib.so" });
+      const result = await executeBash({ command: "env | grep -c '^LD_PRELOAD=' || true" }, ctx);
+
+      expect(result.success).toBe(true);
+      const data = result.data as { stdout: string };
+      expect(data.stdout.trim()).toBe("0");
+    });
+
+    it("should not leak any expanded blocklist vars via inputEnv", async () => {
+      const ctx = createContext(tempDir);
+      const evilEnv: Record<string, string> = {
+        NODE_OPTIONS: "--require /evil/payload.js",
+        NODE_PATH: "/evil/modules",
+        PYTHONPATH: "/evil/python",
+        EDITOR: "/evil/editor",
+        VISUAL: "/evil/visual",
+      };
+
+      const result = await executeBash(
+        {
+          command: ["env | grep -c '^NODE_OPTIONS=--require /evil' || true"].join("; "),
+          env: evilEnv,
+        },
+        ctx,
+      );
+
+      expect(result.success).toBe(true);
+      const data = result.data as { stdout: string };
+      expect(data.stdout.trim()).toBe("0");
+    });
+
+    it("should not leak any expanded blocklist vars via ctx.env", async () => {
+      const ctx = createContext(tempDir, {
+        NODE_OPTIONS: "--require /evil/payload.js",
+        NODE_PATH: "/evil/modules",
+        PYTHONPATH: "/evil/python",
+        EDITOR: "/evil/editor",
+        VISUAL: "/evil/visual",
+      });
+
+      const result = await executeBash(
+        {
+          command: "env | grep -c '^NODE_OPTIONS=--require /evil' || true",
+        },
+        ctx,
+      );
+
+      expect(result.success).toBe(true);
+      const data = result.data as { stdout: string };
+      expect(data.stdout.trim()).toBe("0");
+    });
+  });
+});