[Bug] macOS node_repl sandbox startup loses both CLI path overrides

[CodeHourra]

Area

Desktop / Renderer — native Shim / node_repl sandbox startup

Summary

On macOS with Codex Desktop 26.908.40834 (build 8881), both cua_repl.js and node_repl.js fail before JavaScript or browser navigation starts when Desktop was launched through codexhost 0.7.1.

This is a remaining startup path beyond #164: the sandbox child receives neither CLI environment variable, whereas the existing browser-helper fallback requires CODEX_CLI_PATH to identify the running Shim.

Expected behavior

The Shim forwards this helper invocation to the CLI in the validated official Desktop bundle. The official CLI continues to enforce the requested sandbox policy; normal app-server Host routing stays unchanged.

Actual behavior

node_repl kernel exited unexpectedly
codexhost shim: CODEXHOST_STOCK_CODEX_PATH is required

An isolated probe at CODEX_CLI_PATH, invoked by the actual bundled node_repl, observed:

{
  "argv_command": ["sandbox", "-c"],
  "argument_count": 15,
  "environment": {
    "CODEX_CLI_PATH": null,
    "CODEXHOST_STOCK_CODEX_PATH": null,
    "NODE_REPL_NODE_PATH": null
  }
}

node_repl resolves its CLI before constructing a sanitized environment for the sandbox child. This is distinct from the older policy/config helper that preserved the self-referencing override. Restoring private Host variables globally or editing generated user MCP configuration is not a durable fix.

Reproduction

1. Launch Codex Desktop 26.908.40834 through codexhost 0.7.1.
2. Invoke node_repl.js with nodeRepl.write(1 + 1), or cua_repl.js to create an in-app browser tab.
3. The kernel exits with the error above before the requested code runs.

The Shim-level trigger can also be reproduced with both variables absent:

env -u CODEX_CLI_PATH -u CODEXHOST_STOCK_CODEX_PATH \
  /path/to/codexhost-shim sandbox -- /usr/bin/true

codexhost version

npm 0.7.1. Source examined at upstream main c55fd9d.

Codex Desktop version

26.908.40834, build 8881; bundled CLI 0.154.0-alpha.6.2.

OS / Architecture

macOS / arm64.

Installation

npm.

Harness / Version

Codex, bundled CLI 0.154.0-alpha.6.2. The failure is in the native tool kernel before Harness-specific work.

Connection

Local.