- Shipped
- September 3, 2026 at 7:50 PM UTC
- Author
- Kamo
- Commit
- d95d21d
Dropping su from the exec path left it in reap_idle, which runs on every terminal connect. Same three objections, and the last one is the one that bites: `su - <user> -c "..."` builds a shell string, opens a PAM session, and sources the account's profile — so a .bashrc that prints anything would prepend it to the tmux listing this method parses. `runuser -u <user> --` takes an argv list and does none of those things. With this, no part of the terminal path assembles a command as a string. A test now asserts no argv in the reaper contains `su` and every one starts with runuser, so this cannot quietly come back. 114 tests.