fix: sanitize sidecar launch environment

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

src/main/sidecar/sidecarEnvironment.ts

@@ -0,0 +1,17 @@
+const blockedEnvironmentKeys = new Set(['ELECTRON_RUN_AS_NODE', 'NODE_OPTIONS']);
+
+export function createSidecarEnvironment(baseEnvironment: NodeJS.ProcessEnv): NodeJS.ProcessEnv {
+  const sanitizedEnvironment: NodeJS.ProcessEnv = {};
+
+  for (const [name, value] of Object.entries(baseEnvironment)) {
+    const normalizedName = name.toUpperCase();
+
+    if (normalizedName.startsWith('COPILOT_') || blockedEnvironmentKeys.has(normalizedName)) {
+      continue;
+    }
+
+    sanitizedEnvironment[name] = value;
+  }
+
+  return sanitizedEnvironment;
+}

src/main/sidecar/sidecarProcess.ts

@@ -10,6 +10,7 @@ import type {
   RunTurnCommand,
 } from '@shared/contracts/sidecar';
 import type { ChatMessageRecord } from '@shared/domain/session';
+import { createSidecarEnvironment } from '@main/sidecar/sidecarEnvironment';
 import { resolveSidecarProcess } from '@main/sidecar/sidecarRuntime';
 
 type PendingCommand =
@@ -78,6 +79,7 @@ export class SidecarClient {
     });
     this.process = spawn(sidecar.command, sidecar.args, {
       cwd: sidecar.cwd,
+      env: createSidecarEnvironment(process.env),
       stdio: 'pipe',
       windowsHide: true,
     });