test(cli): guard public Codex attribution env filtering (#2064)

Plant a caller http.extraHeader entry in the existing performRun fixture so the full attribution env differs from sandboxEnv at the adapter seam. The existing sandbox count assertion now fails if agent.js passes .env instead of .sandboxEnv.

Replace the negative arrayContaining checks with independent not.toContain assertions, so any single leaked token, provider-key, or caller Git-config name fails the adapter test.

Codex adapter and run-loop suites pass 121/121. A local .env mutation failed at the expected sandbox count assertion.

Written by sprint-impl, a Commonly agent.

Pod thread: https://commonly.me/v2/pods/6a692a1be833c668acdb84cf#message-76080

Agent-Model: codex/gpt-6/default

Co-authored-by: Sprint Impl <WyJzcHJpbnQtaW1wbCIsImRlZmF1bHQiXQ@agents.commonly.invalid>

Author: lilyshen0722

cli/__tests__/adapters.codex.test.mjs

@@ -489,16 +489,12 @@ describe('codex adapter — spawn()', () => {
       'COMMONLY_AGENT_SEAT_NAME',
       'COMMONLY_AGENT_ORIGINAL_HOOKS_PATH',
     ]));
-    expect(allowedShellEnvironment).not.toEqual(expect.arrayContaining([
-      'GIT_CONFIG_KEY_1',
-      'GIT_CONFIG_VALUE_1',
-    ]));
-    expect(allowedShellEnvironment).not.toEqual(expect.arrayContaining([
-      'COMMONLY_AGENT_TOKEN',
-      'COMMONLY_TOKEN_FILE',
-      'OPENAI_API_KEY',
-      'SOME_SECRET',
-    ]));
+    expect(allowedShellEnvironment).not.toContain('GIT_CONFIG_KEY_1');
+    expect(allowedShellEnvironment).not.toContain('GIT_CONFIG_VALUE_1');
+    expect(allowedShellEnvironment).not.toContain('COMMONLY_AGENT_TOKEN');
+    expect(allowedShellEnvironment).not.toContain('COMMONLY_TOKEN_FILE');
+    expect(allowedShellEnvironment).not.toContain('OPENAI_API_KEY');
+    expect(allowedShellEnvironment).not.toContain('SOME_SECRET');
     const shellEnvironmentSet = cFlags.find((flag) => (
       flag.startsWith('shell_environment_policy.set=')
     ));

cli/__tests__/run-loop.test.mjs

@@ -92,13 +92,28 @@ const drainMicrotasks = async () => {
   }
 };
 
+let savedGitConfig;
+
 describe('performRun', () => {
   beforeEach(() => {
+    savedGitConfig = new Map(['GIT_CONFIG_COUNT', 'GIT_CONFIG_KEY_0', 'GIT_CONFIG_VALUE_0']
+      .map((name) => [name, process.env[name]]));
     jest.clearAllMocks();
     fs.rmSync(path.join(sessionsTmpDir, '.commonly'), { recursive: true, force: true });
   });
 
-  test('event with content → adapter.spawn → message posted → event acked', async () => {
+  afterEach(() => {
+    for (const [name, value] of savedGitConfig) {
+      if (value === undefined) delete process.env[name];
+      else process.env[name] = value;
+    }
+  });
+
+  test('event with content → adapter.spawn receives sandboxed attribution → reply posted → acked', async () => {
+    // Make the full attribution env differ from sandboxEnv at the adapter seam.
+    process.env.GIT_CONFIG_COUNT = '1';
+    process.env.GIT_CONFIG_KEY_0 = 'http.extraHeader';
+    process.env.GIT_CONFIG_VALUE_0 = 'Authorization: Bearer planted-caller-value';
     const events = [makeEvent({ payload: { content: 'hello from tester', deliveryId: 'delivery-abc' } })];
     const mockGet = jest.fn().mockResolvedValue({ events });
     const mockPost = jest.fn().mockResolvedValue({});