Start QuickJS worker processes with an explicit minimal environment

[zackbart]

Motivation

The QuickJS process pool starts its child with Node's default fork() environment behavior. The child therefore inherits the deployment's complete environment, which may contain connector credentials, database URLs, encryption keys, telemetry secrets, and Node runtime options unrelated to code execution.

Guest JavaScript cannot currently access process.env, so this is defense in depth rather than a demonstrated guest escape. The child process and its dependencies still should not receive ambient deployment secrets they do not need. Executor made the same boundary explicit for spawned stdio MCP servers: UsefulSoftwareCo/executor#1595.

This change does not turn the child into an operating-system sandbox. Admission, credential brokerage, and host-call policy remain the security boundary.

Behavioral requirements

• QuickJS children must receive an explicit minimal environment rather than the parent's environment by default.
• Deployment credentials and unrelated process configuration must not cross the child-process boundary.
• Any environment entry required for supported startup or execution must be documented and deliberately included.
• Source-mode development, built-package execution, process reuse, memory limits, timeouts, and shutdown behavior must remain intact.

Acceptance criteria

• A test places a sentinel secret in the parent environment and proves that the QuickJS child does not receive it.
• Sensitive Node configuration such as NODE_OPTIONS is not inherited unintentionally.
• Tests identify any environment entries that are required by the supported child contract rather than copying the complete parent environment.
• The Node template, package smoke, and existing QuickJS suites continue to pass.
• The QuickJS documentation describes the child environment as part of the containment boundary without claiming full process isolation.
• npm run check passes.

[zackbart]

Discovery: an empty child environment is viable

The QuickJS child and runtime contain no process.env reads. Their runtime dependencies are file-relative imports, IPC, and quickjs-emscripten; none requires an inherited deployment variable.

I verified both sides of the boundary:

1. A plain Node fork() with env omitted inherited a parent sentinel. The same fork with env: {} reported the sentinel as absent.
2. The actual built dist/executors/quickjs-child.js started, loaded QuickJS, became ready, and returned 42 with env: {}.
3. The actual source-mode src/executors/quickjs-child.ts did the same with env: {} and the existing --import tsx execution argument.

Both actual-child checks returned:

{
  "ready": true,
  "result": {
    "outcome": {
      "result": 42
    }
  }
}

Narrowed boundary

Current evidence does not identify an environment entry that needs to be allowlisted. The smallest viable contract is an explicitly empty child environment. Source-mode loading, built-package loading, WASM preparation, IPC, and a complete execution all worked under that contract.

A focused regression can assert the exact fork() option and retain one functional child-process execution. There is no need to expose environment inspection to guest code or add a production diagnostic channel.

No repository files were changed during this discovery.

[zackbart]

Implementation verification

Updated after rebasing the implementation onto current origin/main at ce7058c (0.21.1). The earlier stale-base verification numbers are superseded by these results.

QuickJS worker processes now start with an explicit empty environment. Deployment credentials and Node startup configuration such as NODE_OPTIONS are no longer inherited by the child that hosts the guest runtime. Regression coverage sets both in the parent and asserts the fork receives env: {}.

Current-tip verification:

• focused QuickJS child suite passes on Node;
• full npm run release:check: 116 test files, 2,785 passed, 40 skipped;
• docs, operator UI, TypeScript, Oxlint, Knip, build, examples, production audit, and package smoke passed;
• production audit: 0 vulnerabilities;
• Docker unavailable, so generated-container smoke was skipped.

[zackbart]

Shipped in v0.21.2. The trusted publish workflow passed and npm latest now resolves to 0.21.2.