feat(bundler): disable Bun env autoloading in compiled binaries

[zrosenbauer]

Summary

• Always disables bunfig.toml autoloading in compiled binaries (--no-compile-autoload-bunfig)
• Disables .env autoloading by default (--no-compile-autoload-dotenv), opt-in via autoloadDotenv: true in compile config
• Prevents Bun from leaking .env vars into process.env before kidd's auth dotenv strategy runs

Test plan

• pnpm typecheck passes
• pnpm lint passes (no new warnings)
• pnpm format passes
• pnpm test passes — 3 new compile tests, 2 new resolve-config tests, 1 new schema test

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
oss-kidd	Ignored	Preview	Apr 15, 2026 9:19pm

[changeset-bot]

🦋 Changeset detected

Latest commit: 4e72791

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages

Name	Type
@kidd-cli/config	Minor
@kidd-cli/bundler	Minor
@kidd-cli/cli	Patch
@kidd-cli/core	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[codspeed-hq]

Merging this PR will not alter performance

✅ 2 untouched benchmarks
⏩ 2 skipped benchmarks¹

---

_{Comparing feat/disable-bun-env-autoloading (4e72791) with main (6f1cccd)}

Footnotes

1. 2 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 6f1ea95d-9141-4519-a400-7ff133deb9b8

📥 Commits

Reviewing files that changed from the base of the PR and between a2ee9d8 and 4e72791.

📒 Files selected for processing (1)

• packages/config/src/types.ts

---

📝 Walkthrough

Walkthrough

Adds a new compile option autoloadDotenv (optional in public config, required in resolved types) and threads it through config resolution into the bundler compile flow. resolveConfig defaults it to false; ResolvedCompileOptions includes it; compile() now accepts and forwards it to compileTargetsSequentially()/compileSingleTarget(). A helper computes Bun CLI flags and conditionally emits --no-compile-autoload-dotenv when autoloadDotenv is false. Tests and schema were updated to cover the new option. A non-functional reformat of a watch() call was made.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~22 minutes

Possibly related PRs

• refactor(repo): remove dead and internal-only public exports #124 — Touches ResolvedCompileOptions and resolveConfig, affecting the same resolved compile surface.
• fix(bundler): check bun exists in PATH before compile #98 — Modifies packages/bundler/src/compile/compile.ts and its tests; overlaps with compile argument construction changes.
• fix(bundler): fix compile failures on CI and example type errors #96 — Changes the bundler compile pipeline and tests, related to threading flags into compile targets.

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: disabling Bun environment variable autoloading in compiled binaries, which is the primary objective of this PR.
Description check	✅ Passed	The description clearly relates to the changeset, detailing the implementation approach (always disabling bunfig.toml, conditionally disabling .env autoloading) and the reasoning (preventing env leakage before kidd's auth strategy runs).
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/disable-bun-env-autoloading

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@packages/config/src/types.ts`:
- Line 70: Mark the public interface property autoloadDotenv as readonly to
conform to the repository TypeScript standard; update the declaration of the
autoloadDotenv property in the public interface (the autoloadDotenv property in
packages/config/src/types.ts) to be readonly so the type becomes readonly
autoloadDotenv?: boolean, ensuring all public properties are immutable per the
coding-style guidance.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 325cfdf7-967f-470d-bf97-b20bc5ac6e6a

📥 Commits

Reviewing files that changed from the base of the PR and between 6f1cccd and 946d29b.

⛔ Files ignored due to path filters (1)

• .changeset/disable-bun-env-autoloading.md is excluded by !.changeset/**

📒 Files selected for processing (9)

• packages/bundler/src/bundler.ts
• packages/bundler/src/compile/compile.test.ts
• packages/bundler/src/compile/compile.ts
• packages/bundler/src/types.ts
• packages/bundler/src/utils/resolve-config.test.ts
• packages/bundler/src/utils/resolve-config.ts
• packages/config/src/types.ts
• packages/config/src/utils/schema.test.ts
• packages/config/src/utils/schema.ts