Anton Panasenko 89e297729e Prevent Noise auth tokens from reaching child processes (#38941) ...

## Why

`CODEX_EXEC_SERVER_NOISE_AUTH_TOKEN` is an execution-server credential and
must not be exposed to model-reachable commands or command hooks, including
when shell environment policy explicitly sets a case variant of the name.

## What changed

- Add `CODEX_EXEC_SERVER_NOISE_AUTH_TOKEN` to the shared list of
  non-inheritable environment variables.
- Keep the environment variable constant in `codex-protocol` so the exec
  server and environment scrubber use the same definition.
- Verify case-insensitive removal after policy overrides for shell commands
  and command hooks.

GitOrigin-RevId: 759b224b6a7fb4f56f7b1a6d94ffbb0b188c658f

2026-08-17 04:17:45 +00:00

..

schema/generated

Add SessionEnd hooks for thread teardown (#33895)

2026-07-17 19:58:56 +00:00

src

Prevent Noise auth tokens from reaching child processes (#38941)

2026-08-17 04:17:45 +00:00

BUILD.bazel

build: run buildifier from just fmt (#28125)

2026-06-13 21:43:39 -07:00

Cargo.toml

Support asynchronous command hooks (#37533)

2026-08-08 04:24:12 +00:00