codex: propagate dependency env to unified exec

Co-authored-by: Codex <noreply@openai.com>

codex-rs/core/src/unified_exec/mod_tests.rs

@@ -303,6 +303,34 @@ async fn multi_unified_exec_sessions() -> anyhow::Result<()> {
     Ok(())
 }
 
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn unified_exec_inherits_dependency_env() -> anyhow::Result<()> {
+    skip_if_sandbox!(Ok(()));
+
+    let (session, turn) = test_session_and_turn().await;
+    session
+        .set_dependency_env(HashMap::from([(
+            "OPENAI_API_KEY".to_string(),
+            "session-api-key".to_string(),
+        )]))
+        .await;
+
+    let output = exec_command(
+        &session,
+        &turn,
+        "printf '%s' \"$OPENAI_API_KEY\"",
+        2_500,
+        None,
+    )
+    .await?;
+    assert!(
+        output.truncated_output().contains("session-api-key"),
+        "expected exec_command to inherit dependency env"
+    );
+
+    Ok(())
+}
+
 #[tokio::test]
 async fn unified_exec_timeouts() -> anyhow::Result<()> {
     skip_if_sandbox!(Ok(()));

codex-rs/core/src/unified_exec/process_manager.rs

@@ -649,10 +649,20 @@ impl UnifiedExecProcessManager {
         cwd: PathBuf,
         context: &UnifiedExecContext,
     ) -> Result<(UnifiedExecProcess, Option<DeferredNetworkApproval>), UnifiedExecError> {
-        let env = apply_unified_exec_env(create_env(
+        let dependency_env = context.session.dependency_env().await;
+        let mut env = apply_unified_exec_env(create_env(
             &context.turn.shell_environment_policy,
             Some(context.session.conversation_id),
         ));
+        if !dependency_env.is_empty() {
+            env.extend(dependency_env.clone());
+        }
+        let mut explicit_env_overrides = context.turn.shell_environment_policy.r#set.clone();
+        for key in dependency_env.keys() {
+            if let Some(value) = env.get(key) {
+                explicit_env_overrides.insert(key.clone(), value.clone());
+            }
+        }
         let mut orchestrator = ToolOrchestrator::new();
         let mut runtime = UnifiedExecRuntime::new(
             self,
@@ -680,7 +690,7 @@ impl UnifiedExecProcessManager {
             process_id: request.process_id,
             cwd,
             env,
-            explicit_env_overrides: context.turn.shell_environment_policy.r#set.clone(),
+            explicit_env_overrides,
             network: request.network.clone(),
             tty: request.tty,
             sandbox_permissions: request.sandbox_permissions,