[davidwkeith]

The vitest plugin hands wrangler.jsonc to wrangler, and wrangler fills the test Worker's env from a local .dev.vars, or, when there isn't one, from .env. A developer's real secrets therefore reached the tests, .env's GPG_PRIVATE_KEY and CLOUDFLARE_API_TOKEN included. miniflare.bindings only overrode TOKEN_SIGNING_KEY and INTROSPECTION_TOKEN.

vitest.config.ts now:

• sets CLOUDFLARE_LOAD_DEV_VARS_FROM_DOT_ENV=false, so wrangler skips .env;
• blanks every key a local .dev.vars defines, using node:util's parseEnv. The plugin has no switch to skip .dev.vars, and it rejects undefined binding values. An empty secret reads as unset (!env[name] in worker/mounts.ts), so the mounts behave as they do in CI.

Verified: a probe test asserting env.OWNER_TOKEN is unset failed before the change with OWNER_TOKEN=leaked-owner in .dev.vars, and separately with leaked-env in .env. Both pass after it. The full suite passes with a .dev.vars present and without one (11 files, 71 tests), and npm run check reports 0 errors.

CLAUDE.md's Testing bullet describes the isolation.

---

Generated by Claude Code

[davidwkeith]

Review: looks good. The change is small and correct.

• parseEnv from node:util needs Node ≥ 20.12. CI uses Node 22, so that's fine.
• Blanking .dev.vars keys with "" works because worker/mounts.ts checks !env[name]. The ...localDevVars spread comes before the fixed test values, so TOKEN_SIGNING_KEY and INTROSPECTION_TOKEN still win.
• The existsSync(".dev.vars") path is relative to the cwd. That's fine for npm test from the repo root.
• The CLAUDE.md note matches the code.

No blocking issues. The test check was still running when I reviewed, so I'm leaving the merge to you.

---

Generated by Claude Code

[cloudflare-workers-and-pages]

🚀 Deploying Preview to Cloudflare 🚀

Preview URL: https://claude-affectionate-curie-3ekeg3-dwk.8k9dgysp29.workers.dev (commit 5b0a50b)

This URL reflects your latest Preview deployment

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://00e303e5-dwk.8k9dgysp29.workers.dev	5b0a50b	2026-10-23T04:09:10.633Z	Visit the dashboard ↗