[dezren39]

Fixes #804

Problem

ConfigVariable.substitute (packages/core/src/config/variable.ts) resolved {env:NAME} with a plain lookup — (input.env?.[name] ?? process.env[name]) || fallback — which reads through the prototype chain. For prototype names the reference resolved to the inherited member instead of "unset": {env:constructor} injected function Object() { [native code] }, {env:toString} / {env:hasOwnProperty} / {env:valueOf} injected function sources, {env:__proto__} injected [object Object], and any :- fallback was ignored for all of them — silently baking that text into parsed config from any config source.

Fix

Own-property resolution for both sources, following the established Object.hasOwn precedent (#747 / #774 / #792):

• Supplied env: input.env && Object.hasOwn(input.env, name) ? input.env[name] : undefined
• Process env: Object.hasOwn(process.env, name) ? process.env[name] : undefined

The existing || fallback step is unchanged, so genuinely set variables (including a variable genuinely set under a prototype name in the supplied env, and the documented unset-or-empty :- fallback behavior) behave exactly as before. No {file:} or comment/escaping behavior is touched.

Tests

New test in packages/core/test/config/config.test.ts — "resolves env references by own property, not through the prototype chain" — pins all five names (constructor, toString, hasOwnProperty, valueOf, __proto__) on both paths:

• supplied env without the name → "" / the :- fallback
• no env supplied (process.env path, the normal config-file path) → "" / the :- fallback
• genuinely set under the prototype name in the supplied env → its real value

Verification

• Laptop (worktree ~/git/fleet/2966-804-env-proto): bun test test/config/config.test.ts from packages/core — 59 pass, 0 fail (new test included).
• Core typecheck on the laptop: clean.
• CI is the remaining gate.

Filed from queue task 2966 (repo-health-opencode-pilot, Lane A).

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 7 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: f1b4fe86-5a7b-44de-aab4-4e0fb8c75908

Commits

Reviewing files that changed from the base of the PR and between 67ea7ed and 4b31ac2.

Files selected for processing: 2

• packages/core/src/config/variable.ts
• packages/core/test/config/config.test.ts

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-29T01:55:04.372937Z	4b31ac2	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

This PR doesn't fully meet our contributing guidelines and PR template.

What needs to be fixed:

• PR description is missing required template sections. Please use the PR template.

Please edit this PR description to address the above within 72 hours, or it will be automatically closed.

If you believe this was flagged incorrectly, please let a maintainer know.

[github-actions]

The following comment was made by an LLM, it may be inaccurate: