test(env): add comprehensive tests for env utilities

Author: jdalton

CHANGELOG.md

@@ -5,6 +5,25 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.3.5](https://github.com/SocketDev/socket-lib/releases/tag/v1.3.5) - 2025-10-26
+
+### Added
+
+- Added `createEnvProxy()` utility function to `env` module for Windows-compatible environment variable access
+  - Provides case-insensitive environment variable access (e.g., PATH, Path, path all work)
+  - Smart priority system: overrides > exact match > case-insensitive fallback
+  - Full Proxy implementation with proper handlers for get, set, has, deleteProperty, ownKeys
+  - Opt-in helper for users who need Windows env var compatibility
+  - Well-documented with usage examples and performance notes
+
+### Fixed
+
+- Fixed `spawn` module to preserve Windows `process.env` Proxy behavior
+  - When no custom environment variables are provided, use `process.env` directly instead of spreading it
+  - Preserves Windows case-insensitive environment variable access (PATH vs Path)
+  - Fixes empty CLI output issue on Windows CI runners
+  - Only spreads `process.env` when merging custom environment variables
+
 ## [1.3.4](https://github.com/SocketDev/socket-lib/releases/tag/v1.3.4) - 2025-10-26
 
 ### Added

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@socketsecurity/lib",
-  "version": "1.3.4",
+  "version": "1.3.5",
   "license": "MIT",
   "description": "Core utilities and infrastructure for Socket.dev security tools",
   "keywords": [

src/env.ts

@@ -67,7 +67,6 @@ export function createEnvProxy(
   base: NodeJS.ProcessEnv,
   overrides?: Record<string, string | undefined>,
 ): NodeJS.ProcessEnv {
-
   return new Proxy(
     {},
     {
@@ -149,7 +148,10 @@ export function createEnvProxy(
         // Case-insensitive check.
         const upperProp = prop.toUpperCase()
         if (caseInsensitiveKeys.has(upperProp)) {
-          if (overrides && findCaseInsensitiveEnvKey(overrides, upperProp) !== undefined) {
+          if (
+            overrides &&
+            findCaseInsensitiveEnvKey(overrides, upperProp) !== undefined
+          ) {
             return true
           }
           if (findCaseInsensitiveEnvKey(base, upperProp) !== undefined) {
@@ -251,7 +253,9 @@ export function findCaseInsensitiveEnvKey(
   const targetLength = upperEnvVarName.length
   for (const key of Object.keys(env)) {
     // Fast path: bail early if lengths don't match.
-    if (key.length !== targetLength) continue
+    if (key.length !== targetLength) {
+      continue
+    }
     // Only call toUpperCase if length matches.
     if (key.toUpperCase() === upperEnvVarName) {
       return key