From fe50b616899eef5aac0dacf1e2d36a09c109944b Mon Sep 17 00:00:00 2001
From: epanero-openai <166539875+epanero-openai@users.noreply.github.com>
Date: Tue, 18 Aug 2026 21:48:27 +0000
Subject: [PATCH] Prevent Node REPL auth tokens from reaching child processes
 (#39301)

## What changed

- Add `NODE_REPL_AUTH_TOKEN` to the environment variables that model-reachable child processes cannot inherit.
- Remove the variable case-insensitively after shell environment policy overrides and from explicitly configured child command environments.
- Extend the environment scrubber tests to cover inherited and configured forms of the token.

GitOrigin-RevId: 716c65e0a9e222f705c226b7c86545251d3ea580
---
 codex-rs/protocol/src/shell_environment.rs       | 1 +
 codex-rs/protocol/src/shell_environment_tests.rs | 4 ++++
 2 files changed, 5 insertions(+)

diff --git a/codex-rs/protocol/src/shell_environment.rs b/codex-rs/protocol/src/shell_environment.rs
index ebe06a97c8..6f886bf065 100644
--- a/codex-rs/protocol/src/shell_environment.rs
+++ b/codex-rs/protocol/src/shell_environment.rs
@@ -13,6 +13,7 @@ pub const OPENAI_WORKLOAD_IDENTITY_CONTEXT_ENV_VAR: &str = "OPENAI_WORKLOAD_IDEN
 /// Environment variables that model-reachable child processes must not inherit.
 pub const NON_INHERITABLE_ENV_VARS: &[&str] = &[
     CODEX_EXEC_SERVER_NOISE_AUTH_TOKEN_ENV_VAR,
+    "NODE_REPL_AUTH_TOKEN",
     OPENAI_FEDERATION_RULE_ID_ENV_VAR,
     OPENAI_IDENTITY_TOKEN_FILE_ENV_VAR,
     OPENAI_WORKLOAD_IDENTITY_CONTEXT_ENV_VAR,
diff --git a/codex-rs/protocol/src/shell_environment_tests.rs b/codex-rs/protocol/src/shell_environment_tests.rs
index ad8a60ef94..2ec577e9b4 100644
--- a/codex-rs/protocol/src/shell_environment_tests.rs
+++ b/codex-rs/protocol/src/shell_environment_tests.rs
@@ -13,6 +13,7 @@ const TEST_NAME: &str =
 fn non_inheritable_environment_is_removed_after_policy_overrides() {
     let vars = [
         ("SAFE".to_string(), "inherited".to_string()),
+        ("node_repl_auth_token".into(), "inherited-token".into()),
         (
             "openai_federation_rule_id".to_string(),
             "inherited-rule".to_string(),
@@ -31,6 +32,7 @@ fn non_inheritable_environment_is_removed_after_policy_overrides() {
         ignore_default_excludes: true,
         r#set: HashMap::from([
             ("SAFE".to_string(), "override".to_string()),
+            ("Node_Repl_Auth_Token".into(), "configured-token".into()),
             (
                 "OpenAI_Identity_Token_File".to_string(),
                 "/run/identity-token".to_string(),
@@ -55,6 +57,7 @@ fn command_scrubber_removes_names_from_real_child_environment() {
         let output = Command::new(std::env::current_exe().expect("locate current test binary"))
             .args([TEST_NAME, "--exact", "--nocapture"])
             .env(CHILD_MODE_ENV_VAR, "1")
+            .env("Node_Repl_Auth_Token", "inherited-token")
             .env("OpenAI_Federation_Rule_Id", "inherited-rule")
             .env(
                 "OpenAI_Workload_Identity_Context",
@@ -77,6 +80,7 @@ fn command_scrubber_removes_names_from_real_child_environment() {
 
     let mut command = environment_command();
     command
+        .env("NODE_REPL_AUTH_TOKEN", "configured-token")
         .env("openai_identity_token_file", "/run/identity-token")
         .env(
             CODEX_EXEC_SERVER_NOISE_AUTH_TOKEN_ENV_VAR,