Max Weinbach7/12/2026, 4:54:57 PM

The managed Codex app-server inherited the full parent environment with
CODEX_HOME appended via object spread. Windows environment names are
case-insensitive while the spread is case-sensitive, so a differently
cased Codex_Home from a shell profile could shadow the pinned Cowork
home, and standalone-Codex markers (CODEX_SANDBOX,
CODEX_COMPANION_SESSION_ID, ...) leaked into the managed runtime.

Build the spawn env through buildCodexSpawnEnv, which drops every
inherited CODEX_*-prefixed variable case-insensitively before pinning
CODEX_HOME to ~/.cowork/auth/codex-cli, keeping the managed runtime
fully isolated from any ~/.codex install.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Parent16740eb