fix(env): use --env-file flags to pass env vars to script subprocesses

Bun's automatic .env loading doesn't pass env vars to subprocesses like
drizzle-kit. This fixes the issue by explicitly passing --env-file flags.

Also updates init-worktree to:
- Explicitly create new branches from HEAD to get latest tooling
- Merge base branch into existing branches to get latest tooling

Author: brandonkachen

.bin/bun

@@ -1,17 +1,20 @@
 #!/usr/bin/env bash
 
 # Bun wrapper that syncs secrets from Infisical to .env.local
-# Bun natively loads .env files in this order (highest precedence last):
-#   1. .env
-#   2. .env.development (or .env.production/.env.test based on NODE_ENV)
-#   3. .env.local
-#   4. .env.development.local - Worktree-specific overrides (ports, etc.)
 #
-# .env.development.local has highest precedence, so worktree port overrides
-# correctly override values from Infisical-synced .env.local.
+# Why this wrapper exists:
+# Bun's automatic .env loading doesn't pass env vars to script subprocesses
+# (e.g., drizzle-kit, tsx, etc.). This wrapper explicitly passes --env-file
+# flags to ensure env vars are available everywhere.
 #
-# This wrapper ensures .env.local is up-to-date from Infisical before running bun.
-# If Infisical is not set up, it falls back to using existing .env.local if present.
+# Env file precedence (later files override earlier ones):
+#   1. .env.local - Main secrets from Infisical
+#   2. .env.development.local - Worktree-specific overrides (ports, etc.)
+#
+# This wrapper:
+# 1. Syncs .env.local from Infisical (with caching)
+# 2. Creates symlinks in subdirectories for tools that need local .env files
+# 3. Passes --env-file flags to bun so subprocesses inherit env vars
 
 # Common bun installation paths to check
 BUN_PATHS=(
@@ -202,11 +205,29 @@ check_env_setup() {
     echo "" >&2
 }
 
+# Build env file arguments for bun
+# Bun's automatic .env loading doesn't pass vars to script subprocesses (like drizzle-kit),
+# so we explicitly pass --env-file flags to ensure env vars are available everywhere.
+build_env_file_args() {
+    ENV_FILE_ARGS=""
+
+    # Add .env.local if it exists
+    if [ -f "$ENV_LOCAL_FILE" ]; then
+        ENV_FILE_ARGS="--env-file=$ENV_LOCAL_FILE"
+    fi
+
+    # Add .env.development.local if it exists (higher precedence for worktree overrides)
+    if [ -f "$ENV_DEVELOPMENT_LOCAL_FILE" ]; then
+        ENV_FILE_ARGS="$ENV_FILE_ARGS --env-file=$ENV_DEVELOPMENT_LOCAL_FILE"
+    fi
+}
+
 run_bun() {
     create_env_symlinks
     check_env_setup
-    # Bun natively loads .env files and gives them precedence over inherited shell vars
-    exec "$REAL_BUN" "$@"
+    build_env_file_args
+    # Use --env-file to ensure env vars are passed to script subprocesses
+    exec "$REAL_BUN" $ENV_FILE_ARGS "$@"
 }
 
 # Main logic

scripts/init-worktree.ts

@@ -206,6 +206,15 @@ async function checkGitBranchExists(branchName: string): Promise<boolean> {
   }
 }
 
+async function getCurrentBranch(): Promise<string> {
+  const proc = Bun.spawn(['git', 'rev-parse', '--abbrev-ref', 'HEAD'], {
+    stdout: 'pipe',
+    stderr: 'pipe',
+  })
+  const output = await new Response(proc.stdout).text()
+  return output.trim() || 'main'
+}
+
 function createEnvDevelopmentLocalFile(
   worktreePath: string,
   args: WorktreeArgs,
@@ -387,14 +396,33 @@ async function main(): Promise<void> {
     console.log(`Location: ${worktreePath}`)
 
     // Create the git worktree (with or without creating new branch)
+    // Explicitly use HEAD to ensure worktree has latest tooling (.bin/bun, etc.)
+    const baseBranch = await getCurrentBranch()
     const worktreeAddArgs = ['worktree', 'add', worktreePath]
     if (branchExists) {
+      // Branch exists - check it out
       worktreeAddArgs.push(args.name)
     } else {
-      worktreeAddArgs.push('-b', args.name)
+      // New branch - explicitly create from HEAD to get latest tooling
+      worktreeAddArgs.push('-b', args.name, 'HEAD')
     }
     await runCommand('git', worktreeAddArgs)
 
+    // If branch already existed, merge in the base branch to get latest tooling
+    if (branchExists) {
+      console.log(`Merging ${baseBranch} into ${args.name} to get latest tooling...`)
+      const mergeResult = await runCommand(
+        'git',
+        ['merge', baseBranch, '--no-edit', '-m', `Merge ${baseBranch} to get latest tooling`],
+        worktreePath,
+      )
+      if (mergeResult.exitCode !== 0) {
+        console.warn(
+          `Warning: Merge had conflicts. Please resolve them manually in the worktree.`,
+        )
+      }
+    }
+
     console.log('Setting up worktree environment...')
     console.log(`Backend port: ${args.backendPort}`)
     console.log(`Web port: ${args.webPort}`)
@@ -416,6 +444,7 @@ async function main(): Promise<void> {
 
     console.log(`✅ Worktree '${args.name}' created and set up successfully!`)
     console.log(`📁 Location: ${worktreePath}`)
+    console.log(`🌿 Based on: ${baseBranch} (HEAD)`)
     console.log(`🚀 You can now cd into the worktree and start working:`)
     console.log(`   cd ${worktreePath}`)
     console.log(``)