Sanitize Codex quota app-server environment

Co-Authored-By: Codex <noreply@openai.com>

Author: Pigbibi

service/codex_account.py

@@ -10,6 +10,8 @@
 import time
 from typing import Any
 
+from service.adapters.codex_adapter import _codex_env
+
 
 def _bool_env(name: str, default: bool = False) -> bool:
     value = os.environ.get(name, "").strip().lower()
@@ -108,6 +110,7 @@ def read_codex_rate_limits(timeout_seconds: float | None = None) -> dict[str, An
             stdout=subprocess.PIPE,
             stderr=subprocess.DEVNULL,
             text=True,
+            env=_codex_env(),
         )
         _send(
             proc,
@@ -153,6 +156,10 @@ def read_codex_rate_limits(timeout_seconds: float | None = None) -> dict[str, An
                     proc.wait(timeout=0.5)
                 except subprocess.TimeoutExpired:
                     proc.kill()
+                    try:
+                        proc.wait(timeout=0.5)
+                    except subprocess.TimeoutExpired:
+                        pass
             for stream in (proc.stdin, proc.stdout):
                 if stream is not None:
                     stream.close()

tests/test_codex_account.py

@@ -36,8 +36,12 @@ def test_reads_sanitized_rate_limits_from_app_server(self) -> None:
                     """
                     #!/usr/bin/env python3
                     import json
+                    import os
                     import sys
 
+                    if os.environ.get("CODEX_AUDIT_SERVICE_TOKEN") or os.environ.get("OPENAI_API_KEY"):
+                        sys.exit(7)
+
                     for line in sys.stdin:
                         message = json.loads(line)
                         method = message.get("method")
@@ -66,6 +70,8 @@ def test_reads_sanitized_rate_limits_from_app_server(self) -> None:
             fake_codex.chmod(0o700)
             env = {
                 "CODEX_AUDIT_SERVICE_CODEX_ACCOUNT_USAGE": "1",
+                "CODEX_AUDIT_SERVICE_TOKEN": "service-token-must-not-reach-codex",
+                "OPENAI_API_KEY": "openai-key-must-not-reach-codex",
                 "PATH": str(bin_dir) + os.pathsep + os.environ.get("PATH", ""),
             }
             with patch.dict(os.environ, env, clear=True):