fix: address PR review feedback

mmaps · mmaps · commit 1ef1c423a859 · 2026-04-29T15:57:32.000Z
diff --git a/src/infra/dotenv.test.ts b/src/infra/dotenv.test.ts
@@ -34,6 +34,8 @@ const BUNDLED_TRUST_ROOT_ENV_KEYS = BUNDLED_TRUST_ROOT_ENV_LINES.map(
 );
 
 const WINDOWS_SHELL_TRUST_ROOT_ENV_KEYS = [
+  "ComSpec",
+  "COMSPEC",
   "ProgramFiles",
   "PROGRAMFILES",
   "ProgramW6432",
@@ -301,11 +303,16 @@ describe("loadDotEnv", () => {
         await writeEnvFile(
           path.join(cwdDir, ".env"),
           [
+            "ComSpec=.\\evil-comspec",
+            "COMSPEC=.\\evil-comspec-upper",
             "ProgramFiles=.\\evil-pfiles",
             "PROGRAMFILES=.\\evil-pfiles-upper",
             "ProgramW6432=.\\evil-pw6432",
+            "PROGRAMW6432=.\\evil-pw6432-upper",
             "SystemRoot=.\\fake-root",
+            "SYSTEMROOT=.\\fake-root-upper",
             "windir=.\\fake-windir",
+            "WINDIR=.\\fake-windir-upper",
           ].join("\n"),
         );
 
diff --git a/src/infra/dotenv.ts b/src/infra/dotenv.ts
@@ -19,6 +19,7 @@ const BLOCKED_WORKSPACE_DOTENV_KEYS = new Set([
   "CLAWHUB_CONFIG_PATH",
   "CLAWHUB_TOKEN",
   "CLAWHUB_URL",
+  "COMSPEC",
   "HTTP_PROXY",
   "HTTPS_PROXY",
   "IRC_HOST",
