fix: Exclude framework-inferred env vars with wildcards

crates/turborepo-env/src/lib.rs

@@ -418,6 +418,7 @@ mod tests {
     #[test_case(&["FOO*"], &["BAR"], &["BAR", "FOO", "FOOBAR", "FOOD"] ; "wildcard")]
     #[test_case(&["FOO*", "!FOOBAR"], &["BAR"], &["BAR", "FOO", "FOOD"] ; "omit wild")]
     #[test_case(&["FOO*"], &["!FOOBAR"], &["FOO", "FOOD"] ; "omit task")]
+    #[test_case(&["FOO*"], &["!FOO*"], &[] ; "exclude all framework vars")]
     fn test_hashable_env(wildcards: &[&str], task: &[&str], expected: &[&str]) {
         let env_at_start = EnvironmentVariableMap(
             vec![

crates/turborepo-lib/src/run/mod.rs

@@ -661,6 +661,7 @@ impl Run {
             self.processes.clone(),
             &self.repo_root,
             global_env,
+            &self.root_turbo_json.global_env,
             ui_sender,
             is_watch,
             self.micro_frontend_configs.as_ref(),

crates/turborepo-lib/src/task_graph/visitor/mod.rs

@@ -133,6 +133,7 @@ impl<'a> Visitor<'a> {
         manager: ProcessManager,
         repo_root: &'a AbsoluteSystemPath,
         global_env: EnvironmentVariableMap,
+        global_env_patterns: &'a [String],
         ui_sender: Option<UISender>,
         is_watch: bool,
         micro_frontends_configs: Option<&'a MicrofrontendsConfigs>,
@@ -143,6 +144,7 @@ impl<'a> Visitor<'a> {
             env_at_execution_start,
             global_hash,
             global_env,
+            global_env_patterns,
         );
 
         let sink = Self::sink(run_opts);

crates/turborepo-lib/src/task_hash.rs

@@ -41,6 +41,15 @@ pub enum Error {
     Mutex,
     #[error("Missing environment variables for {0}.")]
     MissingEnvVars(TaskId<'static>),
+    #[error(
+        "Error processing environment patterns for task {task_id} (including global exclusions): \
+         {err}"
+    )]
+    EnvPattern {
+        task_id: TaskId<'static>,
+        #[source]
+        err: turborepo_env::Error,
+    },
     #[error(transparent)]
     Scm(#[from] turborepo_scm::Error),
     #[error(transparent)]
@@ -244,6 +253,7 @@ pub struct TaskHasher<'a> {
     run_opts: &'a RunOpts,
     env_at_execution_start: &'a EnvironmentVariableMap,
     global_env: EnvironmentVariableMap,
+    global_env_patterns: &'a [String],
     global_hash: &'a str,
     task_hash_tracker: TaskHashTracker,
 }
@@ -255,6 +265,7 @@ impl<'a> TaskHasher<'a> {
         env_at_execution_start: &'a EnvironmentVariableMap,
         global_hash: &'a str,
         global_env: EnvironmentVariableMap,
+        global_env_patterns: &'a [String],
     ) -> Self {
         let PackageInputsHashes {
             hashes,
@@ -266,6 +277,7 @@ impl<'a> TaskHasher<'a> {
             env_at_execution_start,
             global_hash,
             global_env,
+            global_env_patterns,
             task_hash_tracker: TaskHashTracker::new(expanded_hashes),
         }
     }
@@ -318,8 +330,26 @@ impl<'a> TaskHasher<'a> {
                 computed_wildcards.push(computed_exclude);
             }
 
+            // Combine task-specific env patterns with global env exclusions
+            // Global exclusions (patterns starting with !) should apply to framework
+            // inference
+            let combined_env_patterns: Vec<String> = task_definition
+                .env
+                .iter()
+                .chain(
+                    self.global_env_patterns
+                        .iter()
+                        .filter(|p| p.starts_with('!')),
+                )
+                .cloned()
+                .collect();
+
             self.env_at_execution_start
-                .hashable_task_env(&computed_wildcards, &task_definition.env)?
+                .hashable_task_env(&computed_wildcards, &combined_env_patterns)
+                .map_err(|err| Error::EnvPattern {
+                    task_id: task_id.clone().into_owned(),
+                    err,
+                })?
         } else {
             let all_env_var_map = self
                 .env_at_execution_start

turborepo-tests/integration/tests/other/framework-inference.t

@@ -34,3 +34,45 @@ Confirm that the right values appear in the run summary when framework inference
   false
   $ cat output.json | jq -r '.tasks[].framework'
 
+
+Exclude framework-inferred variables using negative wildcard in env key.
+First, update turbo.json to add env exclusion pattern.
+  $ cat turbo.json | jq '.tasks.build.env = ["!NEXT_PUBLIC_*"]' > turbo.json.tmp && mv turbo.json.tmp turbo.json
+  $ cat turbo.json
+  {
+    "$schema": "https://turborepo.com/schema.json",
+    "globalPassThroughEnv": [],
+    "tasks": {
+      "build": {
+        "env": [
+          "!NEXT_PUBLIC_*"
+        ]
+      }
+    }
+  }
+
+Now verify that framework-inferred vars are excluded when negative wildcard is present.
+  $ NEXT_PUBLIC_CHANGED=true ${TURBO} run build --dry=json | jq -c '.tasks[].environmentVariables.inferred'
+  []
+
+The framework is still detected even with exclusion.
+  $ NEXT_PUBLIC_CHANGED=true ${TURBO} run build --dry=json | jq -r '.tasks[].framework'
+  nextjs
+
+Test globalEnv exclusion also applies to framework-inferred vars.
+Reset turbo.json and use globalEnv instead.
+  $ cat > turbo.json << 'EOF'
+  > {
+  >   "$schema": "https://turborepo.com/schema.json",
+  >   "globalEnv": ["!NEXT_PUBLIC_*"],
+  >   "globalPassThroughEnv": [],
+  >   "tasks": {
+  >     "build": {}
+  >   }
+  > }
+  > EOF
+
+Verify globalEnv exclusions also apply to framework-inferred variables.
+  $ NEXT_PUBLIC_CHANGED=true ${TURBO} run build --dry=json | jq -c '.tasks[].environmentVariables.inferred'
+  []
+