refactor(process): hybrid launcher — Linux posix_spawn, macOS/Windows shell

Per review: use a direct exec (posix_spawn) on Linux, where the leak actually
lives and where it can be iterated locally, and keep the proven std::system
shell path on macOS/Windows (which inject no runtime env / have no glibc symbol
versioning). This gives Linux the clean child-only env isolation with no shell
quoting/signal/injection surface, while not risking the platforms that can't be
reproduced here. A TODO(launcher-unify) marks unifying onto spawn later if
macOS/Windows ever need the same isolation.

Linux verified: unit 19/19, e2e 74, hostile-LD_LIBRARY_PATH run, fast-path,
passthrough args.

Author: Sunrisepeak

src/platform/process.cppm

@@ -25,6 +25,13 @@ module;
 #include <stdlib.h>    // _putenv_s
 #define popen  _popen
 #define pclose _pclose
+#elif defined(__linux__)
+// Linux is the only platform where the launcher does a direct exec (see
+// run_exec / capture_exec below); macOS keeps the std::system shell path.
+#include <unistd.h>    // pipe, dup2, close, read, environ
+#include <sys/wait.h>  // waitpid
+#include <spawn.h>     // posix_spawnp, posix_spawn_file_actions_*
+extern "C" char **environ;
 #endif
 
 export module mcpp.platform.process;
@@ -125,10 +132,30 @@ int normalize_exit_code(int rc) {
 #endif
 }
 
+#if defined(__linux__)
+// Build a child environment block = the current environ with `extra` overrides
+// applied. Returned vector owns the strings; the caller derives a NUL-terminated
+// char* array from it. Built in the PARENT so the child env never requires a
+// post-fork setenv and mcpp's own environment is never touched.
+std::vector<std::string> merged_environ(
+    const std::vector<std::pair<std::string, std::string>>& extra)
+{
+    std::vector<std::string> out;
+    std::set<std::string> overridden;
+    for (auto& [k, v] : extra) { out.push_back(k + "=" + v); overridden.insert(k); }
+    for (char** e = environ; e && *e; ++e) {
+        std::string_view entry(*e);
+        auto eq = entry.find('=');
+        std::string key(eq == std::string_view::npos ? entry : entry.substr(0, eq));
+        if (!overridden.contains(key)) out.emplace_back(entry);
+    }
+    return out;
+}
+#else
 // Build a shell command line from an argv vector. The first token (program)
 // is kept RAW on Windows — quoting it would make cmd.exe's `/c "..."` strip the
 // outer quotes and mangle the path (see platform.shell) — and shell-quoted on
-// POSIX. Remaining args are always shell-quoted.
+// macOS. Remaining args are always shell-quoted.
 std::string command_from_argv(const std::vector<std::string>& argv) {
     if (argv.empty()) return "";
 #if defined(_WIN32)
@@ -142,6 +169,7 @@ std::string command_from_argv(const std::vector<std::string>& argv) {
     }
     return cmd;
 }
+#endif
 
 } // namespace
 
@@ -251,18 +279,48 @@ int run_passthrough(std::string_view command, std::string* output) {
     return normalize_exit_code(::pclose(fp));
 }
 
+// run_exec / capture_exec are split by platform on purpose:
+//
+//   Linux   — DIRECT exec via posix_spawn. The runtime env (a bundled-glibc
+//             LD_LIBRARY_PATH) goes into the child's envp ONLY; it never enters
+//             mcpp's own environment nor the host /bin/sh. That is the exact
+//             fix for the newer-glibc `sh:` crash, and a direct exec also drops
+//             the shell quoting / signal / injection surface entirely.
+//   macOS /
+//   Windows — KEEP the proven std::system shell path. The leak does not exist
+//             here (macOS injects no runtime library env; Windows has no glibc
+//             symbol versioning), so we deliberately do not swap the launch
+//             primitive on platforms we cannot iterate on locally. The env is
+//             applied as a `KEY='val' cmd` prefix (macOS) / _putenv_s (Windows)
+//             via the existing build_env_prefix / capture_with_env helpers.
+//
+// TODO(launcher-unify): if macOS/Windows ever need the same child-only env
+// isolation (e.g. they start bundling a runtime), unify both onto posix_spawn
+// and a Windows CreateProcess/_spawn equivalent, and delete the shell branch.
 int run_exec(const std::vector<std::string>& argv,
              const std::vector<std::pair<std::string, std::string>>& extraEnv)
 {
     if (argv.empty()) return 127;
-    // Shell launch via std::system, with the runtime env applied as a COMMAND
-    // PREFIX on POSIX (`KEY='val' cmd`). The shell std::system spawns starts
-    // with a clean environment — a bundled-glibc LD_LIBRARY_PATH is set only
-    // for the target child, never for /bin/sh itself (the newer-glibc `sh:`
-    // crash class). On Windows build_env_prefix does _putenv_s and returns "".
+#if defined(__linux__)
+    auto envStore = merged_environ(extraEnv);
+    std::vector<char*> envp;
+    for (auto& s : envStore) envp.push_back(s.data());
+    envp.push_back(nullptr);
+    std::vector<char*> cargv;
+    for (auto& a : argv) cargv.push_back(const_cast<char*>(a.c_str()));
+    cargv.push_back(nullptr);
+
+    pid_t pid = 0;
+    if (::posix_spawnp(&pid, cargv[0], nullptr, nullptr, cargv.data(), envp.data()) != 0)
+        return 127;  // spawn failed (e.g. program not found)
+    int status = 0;
+    while (::waitpid(pid, &status, 0) < 0) { /* EINTR retry */ }
+    return normalize_exit_code(status);
+#else
     std::string prefix = mcpp::platform::env::build_env_prefix(extraEnv);
     std::string cmd = prefix + command_from_argv(argv);
     return normalize_exit_code(std::system(cmd.c_str()));
+#endif
 }
 
 RunResult capture_exec(
@@ -271,11 +329,46 @@ RunResult capture_exec(
 {
     RunResult result;
     if (argv.empty()) { result.exit_code = 127; return result; }
-    // Capture stdout+stderr combined (the trailing `2>&1` replaces the old
-    // redirect). capture_with_env applies the env as a POSIX prefix / Windows
-    // _putenv_s, so the shell is never pre-poisoned with the loader path.
+#if defined(__linux__)
+    // posix_spawn + a pipe; stdout and stderr both go to the pipe so the
+    // captured text is combined (replaces the old `2>&1`).
+    int fds[2];
+    if (::pipe(fds) != 0) { result.exit_code = 127; return result; }
+
+    auto envStore = merged_environ(extraEnv);
+    std::vector<char*> envp;
+    for (auto& s : envStore) envp.push_back(s.data());
+    envp.push_back(nullptr);
+    std::vector<char*> cargv;
+    for (auto& a : argv) cargv.push_back(const_cast<char*>(a.c_str()));
+    cargv.push_back(nullptr);
+
+    posix_spawn_file_actions_t fa;
+    ::posix_spawn_file_actions_init(&fa);
+    ::posix_spawn_file_actions_adddup2(&fa, fds[1], 1);  // stdout → pipe
+    ::posix_spawn_file_actions_adddup2(&fa, fds[1], 2);  // stderr → same pipe
+    ::posix_spawn_file_actions_addclose(&fa, fds[0]);
+    ::posix_spawn_file_actions_addclose(&fa, fds[1]);
+
+    pid_t pid = 0;
+    int sp = ::posix_spawnp(&pid, cargv[0], &fa, nullptr, cargv.data(), envp.data());
+    ::posix_spawn_file_actions_destroy(&fa);
+    ::close(fds[1]);
+    if (sp != 0) { ::close(fds[0]); result.exit_code = 127; return result; }
+
+    std::array<char, 4096> buf{};
+    ssize_t n;
+    while ((n = ::read(fds[0], buf.data(), buf.size())) > 0)
+        result.output.append(buf.data(), static_cast<size_t>(n));
+    ::close(fds[0]);
+    int status = 0;
+    while (::waitpid(pid, &status, 0) < 0) { /* EINTR retry */ }
+    result.exit_code = normalize_exit_code(status);
+    return result;
+#else
     std::string cmd = command_from_argv(argv) + " 2>&1";
     return capture_with_env(cmd, extraEnv);
+#endif
 }
 
 } // namespace mcpp::platform::process