[codex] Centralize subprocess env boundaries (#585)

* Centralize subprocess env boundaries * Remove env boundary static audit test * Tighten env boundary process launches * Fix Windows native process launches * Inline provider env pass-throughs
2026-04-27 13:24:16 +08:00
parent 90032570ec
commit 15df680a64
40 changed files with 760 additions and 304 deletions
@@ -54,11 +54,16 @@ function resolveShellEnv(): Record<string, string> | undefined {
    }
  }

+  const shellEnv = { ...process.env };
+  delete shellEnv.PASEO_NODE_ENV;
+  delete shellEnv.PASEO_DESKTOP_MANAGED;
+  delete shellEnv.PASEO_SUPERVISED;
+
  const result = spawnSync(shell, [...shellArgs, command], {
    encoding: "utf8",
    timeout: RESOLVE_TIMEOUT_MS,
    env: {
-      ...process.env,
+      ...shellEnv,
      ELECTRON_RUN_AS_NODE: "1",
      ELECTRON_NO_ATTACH_CONSOLE: "1",
    },