[codex] Centralize subprocess env boundaries (#585)

* Centralize subprocess env boundaries

* Remove env boundary static audit test

* Tighten env boundary process launches

* Fix Windows native process launches

* Inline provider env pass-throughs

packages/server/src/utils/run-git-command.ts

@@ -1,4 +1,5 @@
 import pLimit from "p-limit";
+import type { ProcessEnvRecord } from "../server/paseo-env.js";
 import { spawnProcess } from "./spawn.js";
 
 const DEFAULT_TIMEOUT_MS = 30_000;
@@ -10,7 +11,8 @@ const gitLimit = pLimit(gitConcurrency);
 
 export interface GitCommandOptions {
   cwd: string;
-  env?: NodeJS.ProcessEnv;
+  env?: ProcessEnvRecord;
+  envOverlay?: ProcessEnvRecord;
   timeout?: number;
   maxOutputBytes?: number;
   acceptExitCodes?: number[];
@@ -24,6 +26,19 @@ export interface GitCommandResult {
   signal: NodeJS.Signals | null;
 }
 
+function mergeEnvOverlays(
+  env: ProcessEnvRecord | undefined,
+  envOverlay: ProcessEnvRecord | undefined,
+): ProcessEnvRecord | undefined {
+  if (!env) {
+    return envOverlay;
+  }
+  if (!envOverlay) {
+    return env;
+  }
+  return { ...env, ...envOverlay };
+}
+
 export function runGitCommand(
   args: string[],
   options: GitCommandOptions,
@@ -38,7 +53,7 @@ export function runGitCommand(
 
         const child = spawnProcess("git", args, {
           cwd: options.cwd,
-          env: options.env,
+          envOverlay: mergeEnvOverlays(options.env, options.envOverlay),
           stdio: ["ignore", "pipe", "pipe"],
         });