spawn drops an own __proto__ environment entry #993

Environment details

• OS: macOS (arm64)
• OS version: 26.5.2
• node-pty version: 1.1.0 (Node.js 26.3.0)

Issue description

spawn copies options.env with assign (src/utils.ts):

sources.forEach(source => Object.keys(source).forEach(key => target[key] = source[key]));

When the source object has an own __proto__ key (for example one that came from JSON.parse), target["__proto__"] = value invokes the Object.prototype.__proto__ setter instead of creating a property. A string value is ignored, so the variable never reaches _parseEnv and the child starts without it. child_process passes the same object through.

const pty = require("node-pty");
const env = { ...process.env, ...JSON.parse('{"__proto__":"selected-value"}') };
console.log(Object.hasOwn(env, "__proto__")); // true
const child = "console.log(Object.hasOwn(process.env, '__proto__') + ':' + process.env['__proto__'])";
pty.spawn(process.execPath, ["-e", child], { env }).onData((d) => process.stdout.write(d));
// prints: false:[object Object]

With child_process.execFileSync(process.execPath, ["-e", child], { env }) the child prints true:selected-value, and launching through /usr/bin/env __proto__=selected-value node -e ... under node-pty does too, so the operating system and Node accept the name.

Copying with Object.defineProperty(target, key, { value: source[key], enumerable: true, writable: true, configurable: true }), or building the key=value pairs from the source keys directly, keeps the entry.

A downstream process-capture tool hit this in morluto/rea#3338.