From 89dd2f6559b7ec62d36230ba720e9bbcd4d333ee Mon Sep 17 00:00:00 2001 From: Dotta Date: Tue, 6 Oct 2026 11:43:18 -0500 Subject: [PATCH] fix: keep host-only variables out of Codex agent shells Co-Authored-By: Paperclip --- packages/adapters/codex-local/src/server/execute.test.ts | 8 +++++++- packages/adapters/codex-local/src/server/execute.ts | 4 +++- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/packages/adapters/codex-local/src/server/execute.test.ts b/packages/adapters/codex-local/src/server/execute.test.ts index 23a0b5b333c..27da091b25c 100644 --- a/packages/adapters/codex-local/src/server/execute.test.ts +++ b/packages/adapters/codex-local/src/server/execute.test.ts @@ -89,6 +89,7 @@ describe("codex execute — outbound auth copy-back restore contribution", () => afterEach(async () => { vi.clearAllMocks(); + vi.unstubAllEnvs(); if (savedCodexHomeEnv === undefined) { delete process.env.CODEX_HOME; } else { @@ -190,11 +191,16 @@ describe("codex execute — outbound auth copy-back restore contribution", () => } it("keeps assigned API and tool credentials in the identity-enabled CLI shell", async () => { + vi.stubEnv("DATABASE_URL", "postgres://operator:host-password@host/private"); + vi.stubEnv("HOST_DATABASE_PASSWORD", "host-password"); const { commandArgs } = await runTeardown({ sandboxAuth: "{}", hostAuth: "{}", withIdentity: true }); const policy = commandArgs.find(arg => arg.startsWith("shell_environment_policy.include_only=")); - expect(JSON.parse(policy!.slice(policy!.indexOf("=") + 1))).toEqual(expect.arrayContaining([ + const keys = JSON.parse(policy!.slice(policy!.indexOf("=") + 1)); + expect(keys).toEqual(expect.arrayContaining([ "PAPERCLIP_API_KEY", "MY_SERVICE_TOKEN", "PAPERCLIP_AGENT_PRIVATE_KEY", ])); + expect(keys).not.toContain("DATABASE_URL"); + expect(keys).not.toContain("HOST_DATABASE_PASSWORD"); expect(commandArgs.join(" ")).not.toContain("assigned-run-token"); expect(commandArgs.join(" ")).not.toContain("assigned-tool-token"); }); diff --git a/packages/adapters/codex-local/src/server/execute.ts b/packages/adapters/codex-local/src/server/execute.ts index e767643723f..63c00368382 100644 --- a/packages/adapters/codex-local/src/server/execute.ts +++ b/packages/adapters/codex-local/src/server/execute.ts @@ -1231,7 +1231,9 @@ export async function execute(ctx: AdapterExecutionContext): Promise !/key|secret|token/i.test(key)), + "PATH", "HOME", "LANG", "LANGUAGE", "LC_ALL", "LC_CTYPE", "TZ", "TMPDIR", "TEMP", "TMP", "CODEX_HOME", + // Only explicitly assigned run/config credentials cross this boundary. + // Arbitrary host variables (DATABASE_URL, passwords, etc.) do not. ...Object.keys(env), ...identityNames, ])]; args.unshift("-c", "features.shell_snapshot=false", "-c", 'shell_environment_policy.inherit="all"', "-c", "shell_environment_policy.ignore_default_excludes=true",