mirror of
https://github.com/openai/codex.git
synced 2026-09-08 15:50:34 +00:00
c4513cb982
## Why Model-reachable child processes should not inherit Codex launch context. ## What changed - Treat `OPENAI_FEDERATION_RULE_ID` and `OPENAI_IDENTITY_TOKEN_FILE` as non-inheritable environment variables, with case-insensitive matching. - Remove them after shell environment policy overrides and before spawning commands across execution, MCP, hooks, Git helpers, and remote helper processes. ## Testing - Cover inherited and explicitly configured variants, including mixed-case names. - Verify the variables are absent from real child environments and app-server command and process execution. GitOrigin-RevId: 2535527893985fef0995617f4c5b2462bea7c136
codex-git-utils
Helpers for interacting with git, including patch application. The crate also
exposes a lightweight baseline API for internal directories that use git only
as a resettable diff mechanism: ensure_git_baseline_repository preserves a
usable root/.git baseline or creates one when it is missing or unusable,
reset_git_repository replaces root/.git with a fresh one-commit baseline,
and diff_since_latest_init returns structured file changes plus a unified
diff from that baseline to the current directory contents.
use std::path::Path;
use codex_git_utils::{apply_git_patch, ApplyGitRequest};
let repo = Path::new("/path/to/repo");
// Apply a patch (omitted here) to the repository.
let request = ApplyGitRequest {
cwd: repo.to_path_buf(),
diff: String::from("...diff contents..."),
revert: false,
preflight: false,
};
let result = apply_git_patch(&request)?;