[kazooooo-ma]

	Files	Added	Deleted	Net
Test	1	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​47	0	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​47
Prod	4	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​67	$\color{#cf222e}{\Huge{\mathbf{−}}}$​4	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​63

ELI5

Let a caller disable automatic settings synchronization before a new terminal's shell starts.

What Changed

• Add terminal create --env-json for the explicit SETTINGS_AUTO_SYNC string values 0 and 1
• Reject malformed or oversized JSON, unrelated environment keys, remote or unknown execution hosts, and missing worktree identity before creation
• Send the validated map through the existing terminal.create.env field, binding creation to the verified worktree ID
• Preserve the existing --shell capability checks and the unchanged payload and RPC sequence when the new flag is absent

Why

A command-time export runs after shell startup hooks. The existing spawn-environment field applies the policy early enough without adding another launch path.

Linked Issue

N/A: fork-local change.

Visual Proof

N/A: command-line and startup-environment behavior only.

Testing

• I manually tested these changes locally
• Automated tests added/updated

Added 24 parser cases. An isolated Node 24 adapter and inert RPC fixtures passed 43 parser, handler, host-boundary, shell-compatibility and specification checks. Independent source review approved this exact patch.

Native Vitest, typecheck, lint, application build, and live terminal verification remain pending.

AI Disclosure

Implementation was assisted by OpenAI Codex.

Review

Source-only proposal. Apply and verify the CLI before dependent callers enable the new option.

Agent skill upstream boundary

• Not applicable; no skill-installer changes

Notes

The comparison base is pinned to upstream commit 3284b4c70c901402831bb4ccc5576ea083d2e5ae so this PR contains only the five changed files. The fork's main branch is unchanged.

Explicit environment use is restricted to a verified local worktree. Existing remote behavior without the flag is preserved.

Checklist

• This PR is small and focused
• I explained what changed and why
• N/A visual proof explained
• Source reviewed for correctness, security, and performance
• Cross-platform and remote impact considered
• Native lint, typecheck, tests, and build pass