[wrangler] Fix case-insensitive-env leaking stale duplicate keys on override

[mittalpk]

Fix case-insensitive-env.ts leaking stale, differently-cased duplicate keys.

On Windows, wrangler loads .env values through a case-insensitive Proxy wrapper (packages/wrangler/src/config/case-insensitive-env.ts) so lookups like env.PATH and env.Path resolve to the same value, and this object is assigned directly to process.env (packages/wrangler/src/config/dot-env.ts). When a key is set again under a different casing (e.g. .env.local overriding a value from .env with different casing), the previous casing's property was never removed from the underlying target object. get/has still resolved correctly through the internal tracking map, but anything that enumerates process.env — Object.keys, for...in, JSON.stringify, object spread, or a spawned subprocess inheriting the environment — saw both the stale and current key.

The set, defineProperty, and deleteProperty traps now keep exactly one own-property per case-insensitive key, so enumeration always reflects only the current value. (deleteProperty had the same class of bug in the other direction: it deleted from the internal tracking map by canonical key but issued Reflect.deleteProperty using whatever casing the caller passed, so delete env.path after env.PATH = ... left an orphaned, untracked PATH property on the target — fixed the same way, by resolving the tracked casing first.)

Repro (before the fix):

const env = caseInsensitiveEnv();
env.PATH = "1";
env.Path = "2";
Object.keys(env); // ["PATH", "Path"] — should be ["Path"]
JSON.stringify(env); // {"PATH":"2","Path":"2"} — should be {"Path":"2"}

---

• Tests
  • Tests included/updated
  • Automated tests not possible - manual testing has been completed as follows:
  • Additional testing not necessary because:
• Public documentation
  • Cloudflare docs PR(s):
  • Documentation not necessary because: internal bug fix, no user-facing API/behavior change beyond correcting the leak

Note

This is a contribution from an AI agent: Claude Code (Anthropic), running under direct human supervision and review.

---

[changeset-bot]

🦋 Changeset detected

Latest commit: 0fc6313

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
wrangler	Patch
@cloudflare/vite-plugin	Patch
@cloudflare/vitest-pool-workers	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[workers-devprod]

Codeowners approval required for this PR:

• @cloudflare/wrangler

Show detailed file reviewers

• .changeset/case-insensitive-env-stale-keys.md: [@cloudflare/wrangler]
• packages/wrangler/src/tests/case-insensitive-env.test.ts: [@cloudflare/wrangler]
• packages/wrangler/src/config/case-insensitive-env.ts: [@cloudflare/wrangler]

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

🟡 Release note explains internal machinery instead of user impact

The release note text (.changeset/case-insensitive-env-stale-keys.md:7) describes internal implementation machinery rather than the user-facing effect, so the published changelog reads like maintainer notes.
Impact: Users reading the changelog get internal details they cannot act on instead of a clear description of what changed for them.

Repository changeset rule about implementation details

REVIEW.md states: "Changesets should target users of the tools (e.g. Wrangler users) rather than maintainers. Avoid including implementation details ... Instead, focus on user-facing impact and benefits." The middle paragraph describes the case-insensitive Proxy wrapper, the assignment to process.env, and "the previous casing was never removed from the underlying object" — all internal mechanics. The last paragraph (line 9) already conveys the user-facing impact and could stand alone.

---

Was this helpful? React with 👍 or 👎 to provide feedback.