fix(macos): scrub malloc diagnostic env

codex-cli/bin/codex.js

@@ -6,6 +6,7 @@ import { existsSync, realpathSync } from "fs";
 import { createRequire } from "node:module";
 import path from "path";
 import { fileURLToPath } from "url";
+import { sanitizeMacosMallocDiagnosticEnv } from "./sanitize-macos-malloc-env.js";
 
 // __dirname equivalent in ESM
 const __filename = fileURLToPath(import.meta.url);
@@ -172,6 +173,7 @@ const packageManagerEnvVar =
     : "CODEX_MANAGED_BY_NPM";
 env[packageManagerEnvVar] = "1";
 env.CODEX_MANAGED_PACKAGE_ROOT = realpathSync(path.join(__dirname, ".."));
+sanitizeMacosMallocDiagnosticEnv(env);
 
 const child = spawn(binaryPath, process.argv.slice(2), {
   stdio: "inherit",

codex-cli/bin/sanitize-macos-malloc-env.js

@@ -0,0 +1,22 @@
+const MACOS_MALLOC_DIAGNOSTIC_ENV_PREFIXES = [
+  "MallocStackLogging",
+  "MallocLogFile",
+];
+
+export function sanitizeMacosMallocDiagnosticEnv(env, platform = process.platform) {
+  if (platform !== "darwin") {
+    return env;
+  }
+
+  for (const key of Object.keys(env)) {
+    if (
+      MACOS_MALLOC_DIAGNOSTIC_ENV_PREFIXES.some((prefix) =>
+        key.startsWith(prefix),
+      )
+    ) {
+      delete env[key];
+    }
+  }
+
+  return env;
+}

codex-cli/tests/sanitize-macos-malloc-env.test.js

@@ -0,0 +1,35 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { sanitizeMacosMallocDiagnosticEnv } from "../bin/sanitize-macos-malloc-env.js";
+
+test("removes macOS malloc diagnostic env vars on darwin", () => {
+  const env = {
+    MallocStackLogging: "0",
+    MallocStackLoggingDirectory: "/tmp/stack-logs",
+    MallocLogFile: "/tmp/malloc.log",
+    MallocNanoZone: "0",
+    PATH: "/usr/bin",
+  };
+
+  sanitizeMacosMallocDiagnosticEnv(env, "darwin");
+
+  assert.deepEqual(env, {
+    MallocNanoZone: "0",
+    PATH: "/usr/bin",
+  });
+});
+
+test("leaves env unchanged off darwin", () => {
+  const env = {
+    MallocStackLogging: "0",
+    PATH: "/usr/bin",
+  };
+
+  sanitizeMacosMallocDiagnosticEnv(env, "linux");
+
+  assert.deepEqual(env, {
+    MallocStackLogging: "0",
+    PATH: "/usr/bin",
+  });
+});