fix: substitute every ${VAR} reference when merging env files

[Alexandre Kohler (kwy404)]

Problem

mergeEnvVariables expands ${VAR} references in env file values (the python.envFile file, the project .env and API overrides) with String.prototype.replace and a string pattern. That has two effects:

• Only the first reference to a variable is replaced. With ROOT=/home/user in the base environment, PATHS=${ROOT}/a:${ROOT}/b becomes /home/user/a:${ROOT}/b.
• $ sequences in the substituted value are read as replacement patterns. A base value of pa$$word comes out as pa$word.

Fix

Use split(token).join(value), which replaces every occurrence and inserts the value as is. (replaceAll is not available with the ES2020 lib target.)

Tests

Added src/test/features/execution/envVarUtils.unit.test.ts, which merges a value with a repeated ${ROOT} reference and a ${SECRET} whose base value contains $$. It fails before the fix (actual /home/user/a:${ROOT}/b) and passes after it.

• npm run unittest (Windows, Node 24): 2430 passing, 4 pending.
• eslint and prettier pass on the changed files.

[Rich Chiodo (rchiodo)]

🔒 Automated review in progress — Rich Chiodo (@rchiodo) is auto-reviewing this PR.

[Rich Chiodo (rchiodo)]

Result: 🔴 could-not-verify

Verification details

Verification: The relevant tests could not be fully run in the isolated environment; this review is not fully verified.

Summary: [unavailable] Container verification could not start and local execution was not authorized for this PR HEAD: Podman machine 'pyrx-automation' is not running.

Test runs: none recorded.

[Rich Chiodo (rchiodo)]

Approved via Review Center.

[Eduardo Villalpando Mello (edvilme)]

Hello Alexandre Kohler (@kwy404) thank you so much for working on this. Changes look good :)