securewithtrace 0.52.0 → 0.54.0

package/bin/bunfig.toml

@@ -0,0 +1,2 @@
+# Passed to bun as --config by bin/tracecli so the bunfig.toml of whatever
+# directory the user runs in (and any preload it names) is never read.

package/bin/tracecli

@@ -21,10 +21,20 @@ const installMessage = [
 
 const launcherPath = realpathSync(fileURLToPath(import.meta.url));
 const bundledEntry = resolve(dirname(launcherPath), '../dist/index.js');
-const child = spawn('bun', [bundledEntry, ...process.argv.slice(2)], {
-  stdio: 'inherit',
-  windowsHide: false,
-});
+// Bun reads `.env` and `bunfig.toml` (which can preload code) from the
+// directory the user runs in. A shared checkout must not be able to set the
+// CLI's environment or run code inside it, so both are switched off; the empty
+// config shipped beside this file replaces whatever the directory holds.
+// `--no-env-file` needs Bun 1.3.3 or newer.
+const emptyConfig = resolve(dirname(launcherPath), 'bunfig.toml');
+const child = spawn(
+  'bun',
+  ['--no-env-file', `--config=${emptyConfig}`, bundledEntry, ...process.argv.slice(2)],
+  {
+    stdio: 'inherit',
+    windowsHide: false,
+  }
+);
 
 child.on('error', (error) => {
   if (error && 'code' in error && error.code === 'ENOENT') {