sanitize child app env and bump launcher to 1.0.14

src/main/index.ts

@@ -297,12 +297,30 @@ function installDebPackage(debPath: string): Promise<void> {
 function createCleanChildEnv(extraEnv?: NodeJS.ProcessEnv): NodeJS.ProcessEnv {
   const env = { ...process.env, ...extraEnv }
 
-  delete env.APPIMAGE
-  delete env.APPDIR
-  delete env.OWD
-  delete env.ARGV0
-  delete env.ELECTRON_RENDERER_URL
-  delete env.VITE_DEV_SERVER_URL
+  const blockedKeys = [
+    'APPIMAGE',
+    'APPDIR',
+    'OWD',
+    'ARGV0',
+    'ELECTRON_RUN_AS_NODE',
+    'ELECTRON_NO_ATTACH_CONSOLE',
+    'ELECTRON_ENABLE_LOGGING',
+    'ELECTRON_ENABLE_STACK_DUMPING',
+    'ELECTRON_OVERRIDE_DIST_PATH',
+    'ELECTRON_RENDERER_URL',
+    'NODE_OPTIONS',
+    'VITE_DEV_SERVER_URL',
+  ]
+
+  for (const key of blockedKeys) {
+    delete env[key]
+  }
+
+  for (const key of Object.keys(env)) {
+    if (key.startsWith('npm_') || key.startsWith('npm_config_') || key.startsWith('npm_package_')) {
+      delete env[key]
+    }
+  }
 
   return env
 }
@@ -928,6 +946,14 @@ function createWindow(): void {
         childEnv.ATNMY_AUDIENCE_APP = audienceApp
       }
 
+      if (!useDevLauncher) {
+        try {
+          chmodSync(spawnPath, 0o755)
+        } catch {
+          // Launch will surface the actual executable error if chmod is not allowed.
+        }
+      }
+
       const logPath = useDevLauncher ? join(app.getPath('temp'), `autonomy-studio-${appName.replace(/[^a-z0-9_-]+/gi, '-').toLowerCase()}.dev.log`) : undefined
       const logFd = logPath ? openSync(logPath, 'a') : undefined
       if (logPath) {