fix: filter system identity vars from env injection

.changeset/README.md

@@ -0,0 +1,3 @@
+# Changesets
+
+This project uses [Changesets](https://github.com/changesets/changesets) for versioning.

.changeset/config.json

@@ -0,0 +1,11 @@
+{
+  "$schema": "https://unpkg.com/@changesets/config@3.1.1/schema.json",
+  "changelog": ["@changesets/changelog-github", { "repo": "yimsk/opencode-workspace-env" }],
+  "commit": false,
+  "fixed": [],
+  "linked": [],
+  "access": "public",
+  "baseBranch": "main",
+  "updateInternalDependencies": "patch",
+  "ignore": []
+}

.changeset/filter-system-identity.md

@@ -0,0 +1,5 @@
+---
+"opencode-workspace-env": patch
+---
+
+Filter system identity variables (HOME, USER, LOGNAME, SHELL, HOSTNAME) from env injection to prevent overriding host values

.github/workflows/release.yml

@@ -0,0 +1,29 @@
+name: Release
+
+on:
+  push:
+    branches: [main]
+
+concurrency: ${{ github.workflow }}-${{ github.ref }}
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+      - run: bun install
+
+      - name: Create release PR or publish
+        uses: changesets/action@v1
+        with:
+          version: bunx changeset version
+          publish: npm publish
+          title: "chore: release"
+          commit: "chore: release"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

package.json

@@ -31,6 +31,8 @@
   "license": "MIT",
   "repository": "github:yimsk/opencode-workspace-env",
   "devDependencies": {
+    "@changesets/changelog-github": "^0.6.0",
+    "@changesets/cli": "^2.30.0",
     "@nkzw/oxlint-config": "^1.0.1",
     "@types/bun": "latest",
     "@types/node": "^24.5.2",

src/filter.ts

@@ -3,6 +3,11 @@ const EXCLUDED_PREFIXES = ["DIRENV_", "NIX_BUILD_", "__"];
 
 /** Known nix build-system variables that should not leak into shell env */
 const EXCLUDED_VARS = new Set([
+  "HOME",
+  "USER",
+  "LOGNAME",
+  "SHELL",
+  "HOSTNAME",
   "name",
   "system",
   "builder",

tests/direnv.test.ts

@@ -248,4 +248,27 @@ describe("exportEnv", () => {
       TEST_VAR: "keep",
     });
   });
+
+  it("should filter out system identity variables", async () => {
+    mockDirenv(() => ({
+      stdout: JSON.stringify({
+        HOME: "/homeless-shelter",
+        HOSTNAME: "build-host",
+        LOGNAME: "nixbld",
+        SHELL: "/nix/store/.../bash",
+        TEST_VAR: "keep",
+        USER: "nixbld",
+      }),
+      success: true,
+    }));
+
+    const result = await exportEnv(envrcPath);
+
+    expect(result.ok).toBeTrue();
+    if (!result.ok) {
+      throw new Error("expected ok");
+    }
+
+    expect(result.env).toEqual({ TEST_VAR: "keep" });
+  });
 });

tests/nix.test.ts

@@ -33,7 +33,6 @@ describe("exportNixEnv", () => {
       stdout: JSON.stringify({
         variables: {
           CUSTOM_VAR: { type: "exported", value: "custom_value" },
-          HOME: { type: "exported", value: "/home/user" },
           PATH: { type: "exported", value: "/nix/store/...:..." },
         },
       }),
@@ -45,7 +44,6 @@ describe("exportNixEnv", () => {
     expect(result).toEqual({
       env: {
         CUSTOM_VAR: "custom_value",
-        HOME: "/home/user",
         PATH: "/nix/store/...:...",
       },
       ok: true,
@@ -237,4 +235,29 @@ describe("exportNixEnv", () => {
     // NIX_BUILD_* should be filtered
     expect(result.env.NIX_BUILD_CORES).toBeUndefined();
   });
+
+  it("should filter out system identity variables", async () => {
+    mockNix(() => ({
+      stdout: JSON.stringify({
+        variables: {
+          CUSTOM_VAR: { type: "exported", value: "keep" },
+          HOME: { type: "exported", value: "/homeless-shelter" },
+          HOSTNAME: { type: "exported", value: "build-host" },
+          LOGNAME: { type: "exported", value: "nixbld" },
+          SHELL: { type: "exported", value: "/nix/store/.../bash" },
+          USER: { type: "exported", value: "nixbld" },
+        },
+      }),
+      success: true,
+    }));
+
+    const result = await exportNixEnv(flakeNixPath);
+
+    expect(result.ok).toBeTrue();
+    if (!result.ok) {
+      throw new Error("expected ok");
+    }
+
+    expect(result.env).toEqual({ CUSTOM_VAR: "keep" });
+  });
 });