Security: command_daemon leaks environment variables into argv via --data-dir (v1.1.0) #18

Summary

In CLI v1.1.0 the long-lived command_daemon is spawned with an environment
variable KEY=VALUE string as the value of --data-dir, instead of a
directory path. Any secret present in the shell environment can therefore end
up in plaintext in the daemon's argv, readable by every local process via
ps.

Environment

• CLI: browser-act-cli 1.1.0 (installed via uv tool install)
• Python: 3.12
• OS: macOS 25.1.0 (Apple Silicon)
• Previous version 1.0.1 on the same machine was not affected — it had no daemon.

Reproduction

1. Ensure some variable is exported in the shell, e.g. export MY_TOKEN=sk-example.
2. Run any command that spawns the daemon, e.g. browser-act browser list.
3. Inspect the process table:

pgrep -lf command_daemon

Actual result

python3 -m browser_act_cli.command_daemon --cli-version 1.1.0 \
  --data-dir AGENT_ROUTER_TOKEN=sk-<redacted>

The behaviour is deterministic rather than random. After unsetting that
variable and re-running the exact same command, the daemon picked up a
different environment entry at the same position:

python3 -m browser_act_cli.command_daemon --cli-version 1.1.0 \
  --data-dir AIHUBMIX_API_KEY=<redacted>

Expected result

--data-dir should receive the CLI data directory path, and no environment
entry should ever be placed into argv.

Impact

• Any secret exported in the user's shell (API keys, agent tokens, CI
  credentials) may be exposed in plaintext to any local process that can run ps.
• Because the daemon is long-lived, the exposure is continuous rather than
  momentary — unlike a short-lived subprocess.
• Agent hosts such as Cursor, Claude Code, and CI runners routinely inject
  tokens into the environment, so this is likely to hit real secrets in
  practice.

Likely cause

The environment mapping and the argument list appear to be concatenated or
indexed incorrectly when building the Popen call for the daemon.

Worth noting that --data-dir is evidently not honored at all: commands keep
working normally despite receiving this garbage value, which suggests the
argument is parsed and then discarded.

Suggested fix

Pass the environment via the env= parameter of Popen and keep argv
limited to real CLI arguments; additionally validate that --data-dir is an
existing path before accepting it.