fix(cli): strip WIGOLO_STUDIO_HIDDEN case-insensitively in runStudio

[KnockOutEZ]

Closes wigolo-studio-run#179 (PX0 exit-4, security reviewer, CONFIRMED LOW).

The defect

runStudio's docstring claims the hidden flag is "stripped rather than merely
unset, in case the shell already carried it". Spreading process.env collapses
Node's win32 case-insensitive env proxy into a plain object, so
delete env.WIGOLO_STUDIO_HIDDEN removed exactly one spelling. A shell that
exported wigolo_studio_hidden=1 left that key sitting in the spread; the child
read it back through its OWN case-insensitive process.env and started hidden.
The human typed wigolo studio and got no window — the precise outcome the
visible-launch contract exists to deny.

Moot on today's darwin-arm64-only substrate, but the code asserted a guarantee
it did not deliver on one platform.

The fix

Filter the spread on an uppercased key match instead of deleting one spelling.
toUpperCase() is locale-independent, so the comparison does not vary by locale.
The docstring now states the case rule and why it exists.

The pin

New arm in tests/unit/cli/studio.test.ts asserting on the plain object handed
to the injected spawn seam, so it is platform-independent: it reds on darwin
today if the filter regresses. It plants a lowercase wigolo_studio_hidden,
then asserts that no key whose uppercase spelling is the flag survives — and,
as the anti-vacuity half, that PATH still comes through, so the pin cannot be
satisfied by handing spawn an empty env.

Mutation-proven, not N clean runs. Reverting the filter to the original bare
delete:

Test Files  1 failed (1)
     Tests  1 failed | 84 passed (85)
- []
+ [ "wigolo_studio_hidden" ]

Restored: 85 passed (85). The six pre-existing runStudio arms are among the
84 survivors, so the new arm is the only thing that moves.

Auto-launch, checked

defaultLaunch (src/studio/auto-launch.ts:160) has the mirror-image shape,
but SETTING is the weaker case: it writes the canonical spelling, and the worst
outcome is an unexpectedly visible auto-launch rather than a swallowed window.
It is a declared non-goal here (pinned by sd-164/165) and src/studio/** is
outside lane core:cli, so it is logged in known-issues.md rather than fixed.

Non-goals honoured

Windows substrate support; no change to what auto-launch sets.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: d8407dbe-9adf-4b18-b78c-860ae64ef4e7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}