From 2e3696ae509bcb31f8c389fd73f4a483bea4888c Mon Sep 17 00:00:00 2001
From: Affaan Mustafa <affaan@itomarkets.com>
Date: Fri, 24 Jul 2026 00:39:15 -0400
Subject: [PATCH] fix(ito): allow coverage instrumentation on isolated env

---
 scripts/ecc.js | 8 +++++---
 scripts/ito.js | 4 +++-
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/scripts/ecc.js b/scripts/ecc.js
index 7408952a4..48831bf31 100755
--- a/scripts/ecc.js
+++ b/scripts/ecc.js
@@ -233,9 +233,11 @@ function runCommand(commandName, args) {
     {
       cwd: process.cwd(),
       env: commandName === 'ito'
-        ? createSafeItoInvocationEnvironment(process.env, args, {
-          includeControls: true,
-        })
+        ? {
+          ...createSafeItoInvocationEnvironment(process.env, args, {
+            includeControls: true,
+          }),
+        }
         : process.env,
       encoding: 'utf8',
       maxBuffer: 10 * 1024 * 1024,
diff --git a/scripts/ito.js b/scripts/ito.js
index 8ba23ffb1..eec7a650f 100755
--- a/scripts/ito.js
+++ b/scripts/ito.js
@@ -257,7 +257,9 @@ function invokeIto(executable, args, environment = process.env) {
   const result = spawnSync(invocation.executable, invocation.args, {
     cwd: process.cwd(),
     encoding: "utf8",
-    env: createSafeItoInvocationEnvironment(environment, args),
+    // Keep policy helpers immutable for callers, but give child-process
+    // instrumentation its own mutable copy (for example NODE_V8_COVERAGE).
+    env: { ...createSafeItoInvocationEnvironment(environment, args) },
     maxBuffer: MAX_OUTPUT_BYTES,
     timeout: isNodeQualification ? NODE_QUALIFICATION_TIMEOUT_MS : undefined,
     shell: false,