[codex] Centralize subprocess env boundaries (#585)

* Centralize subprocess env boundaries

* Remove env boundary static audit test

* Tighten env boundary process launches

* Fix Windows native process launches

* Inline provider env pass-throughs

packages/desktop/src/daemon/daemon-manager.ts

@@ -359,7 +359,9 @@ async function startDaemon(): Promise<DesktopDaemonStatus> {
 
   const child: ChildProcess = spawnProcess(invocation.command, invocation.args, {
     detached: true,
-    env: { ...invocation.env, PASEO_DESKTOP_MANAGED: "1" },
+    envMode: "internal",
+    env: invocation.env,
+    envOverlay: { PASEO_DESKTOP_MANAGED: "1" },
     stdio: ["ignore", "pipe", "pipe"],
   });
 

packages/desktop/src/daemon/node-entrypoint-launcher.test.ts

@@ -109,7 +109,7 @@ describe("node-entrypoint-launcher", () => {
         env: {
           PATH: "/usr/bin",
           ELECTRON_RUN_AS_NODE: "1",
-          NODE_ENV: "production",
+          PASEO_NODE_ENV: "production",
         },
       });
     });
@@ -150,7 +150,8 @@ describe("node-entrypoint-launcher", () => {
       ).toMatchObject({
         PATH: "/usr/bin",
         ELECTRON_RUN_AS_NODE: "1",
-        NODE_ENV: "production",
+        NODE_ENV: "development",
+        PASEO_NODE_ENV: "production",
       });
     });
 
@@ -178,7 +179,7 @@ describe("node-entrypoint-launcher", () => {
         env: {
           PATH: "/usr/bin",
           ELECTRON_RUN_AS_NODE: "1",
-          NODE_ENV: "production",
+          PASEO_NODE_ENV: "production",
         },
       });
     });

packages/desktop/src/daemon/node-entrypoint-launcher.ts

@@ -1,6 +1,7 @@
 const IGNORED_ARG_PREFIXES = ["-psn_", "--no-sandbox"];
 
 export const DESKTOP_CLI_ENV = "PASEO_DESKTOP_CLI";
+const PASEO_NODE_ENV = "PASEO_NODE_ENV";
 
 export interface NodeEntrypointSpec {
   entryPath: string;
@@ -38,7 +39,7 @@ export function createElectronNodeEnv(
   return {
     ...baseEnv,
     ELECTRON_RUN_AS_NODE: "1",
-    ...(options?.isPackaged === true ? { NODE_ENV: "production" } : {}),
+    ...(options?.isPackaged === true ? { [PASEO_NODE_ENV]: "production" } : {}),
   };
 }
 

packages/desktop/src/daemon/runtime-paths.ts

@@ -257,6 +257,7 @@ function spawnAsync(
 ): Promise<{ stdout: string; stderr: string; exitCode: number | null }> {
   return new Promise((resolve, reject) => {
     const child = spawnProcess(command, args, {
+      envMode: "internal",
       env: options.env,
       stdio: ["ignore", "pipe", "pipe"],
     });