@openclaw/codex 2026.5.20-beta.2 → 2026.5.22

package/dist/sandbox-guard-CTnEWuor.js

@@ -0,0 +1,233 @@
+import { resolveSandboxRuntimeStatus } from "openclaw/plugin-sdk/sandbox";
+import { getSessionEntry } from "openclaw/plugin-sdk/session-store-runtime";
+//#region extensions/codex/src/app-server/native-execution-policy.ts
+const DEFAULT_AGENT_ID = "main";
+const VALID_AGENT_ID_PATTERN = /^[a-z0-9][a-z0-9_-]{0,63}$/i;
+const INVALID_AGENT_ID_CHARS_PATTERN = /[^a-z0-9_-]+/g;
+const LEADING_DASH_PATTERN = /^-+/;
+const TRAILING_DASH_PATTERN = /-+$/;
+function resolveCodexNativeExecutionPolicy(params) {
+	const config = params.config ?? {};
+	const sessionKey = params.sessionKey?.trim() || params.sessionId?.trim() || void 0;
+	const sessionEntry = params.sessionEntry ?? (params.readRuntimeSessionEntry && sessionKey ? readRuntimeSessionEntryBestEffort(sessionKey) : void 0);
+	const sandboxAvailable = params.sandboxAvailable ?? (sessionKey ? resolveSandboxRuntimeStatus({
+		cfg: config,
+		sessionKey
+	}).sandboxed : false);
+	const agentExec = resolvePolicyAgentExec({
+		config,
+		agentId: resolvePolicyAgentId({
+			config,
+			sessionKey,
+			agentId: params.agentId
+		})
+	});
+	const globalExec = config.tools?.exec;
+	const requestedExecHost = normalizeExecTarget(params.execOverrides?.host) ?? normalizeExecTarget(sessionEntry?.execHost) ?? normalizeExecTarget(agentExec?.host) ?? normalizeExecTarget(globalExec?.host) ?? "auto";
+	const effectiveExecHost = resolveEffectiveExecHost({
+		requestedExecHost,
+		sandboxAvailable
+	});
+	const node = params.execOverrides?.node ?? sessionEntry?.execNode ?? agentExec?.node ?? globalExec?.node;
+	if (effectiveExecHost !== "node") return {
+		nativeToolSurfaceAllowed: true,
+		requestedExecHost,
+		effectiveExecHost,
+		node
+	};
+	return {
+		nativeToolSurfaceAllowed: false,
+		requestedExecHost,
+		effectiveExecHost,
+		node,
+		blockReason: "OpenClaw exec host=node is active for this session. Codex app-server native execution cannot route shell, filesystem, MCP, or app-backed work through the selected OpenClaw node."
+	};
+}
+function formatCodexNativeNodeExecBlock(params) {
+	return [
+		`Codex-native ${params.surface} is unavailable because OpenClaw exec host=node is active for this session.`,
+		params.reason ?? "Codex app-server native execution cannot route execution through the selected OpenClaw node.",
+		"Use a normal Codex harness turn so OpenClaw exec/process tools run on the node, or switch exec host to gateway for native Codex app-server execution."
+	].join(" ");
+}
+function resolvePolicyAgentId(params) {
+	const explicitAgentId = normalizeAgentIdOrDefault(params.agentId);
+	if (explicitAgentId) return explicitAgentId;
+	const sessionAgentId = parseAgentIdFromSessionKey(params.sessionKey);
+	if (sessionAgentId) return sessionAgentId;
+	const agents = listAgentEntries(params.config);
+	return normalizeAgentId((agents.find((entry) => entry?.default) ?? agents[0])?.id);
+}
+function resolvePolicyAgentExec(params) {
+	return listAgentEntries(params.config).find((entry) => normalizeAgentId(entry?.id) === params.agentId)?.tools?.exec;
+}
+function listAgentEntries(config) {
+	return (config.agents?.list ?? []).filter((entry) => entry !== null && typeof entry === "object");
+}
+function parseAgentIdFromSessionKey(sessionKey) {
+	const raw = sessionKey?.trim();
+	if (!raw) return;
+	const parts = raw.toLowerCase().split(":").filter(Boolean);
+	if (parts.length < 3 || parts[0] !== "agent" || !parts[2]) return;
+	return normalizeAgentIdOrDefault(parts[1]);
+}
+function normalizeAgentIdOrDefault(value) {
+	const normalized = normalizeAgentId(value);
+	return normalized === DEFAULT_AGENT_ID && !(value ?? "").trim() ? void 0 : normalized;
+}
+function normalizeAgentId(value) {
+	const trimmed = (value ?? "").trim();
+	if (!trimmed) return DEFAULT_AGENT_ID;
+	const normalized = trimmed.toLowerCase();
+	if (VALID_AGENT_ID_PATTERN.test(trimmed)) return normalized;
+	return normalized.replace(INVALID_AGENT_ID_CHARS_PATTERN, "-").replace(LEADING_DASH_PATTERN, "").replace(TRAILING_DASH_PATTERN, "").slice(0, 64) || DEFAULT_AGENT_ID;
+}
+function normalizeExecTarget(value) {
+	const normalized = value?.trim().toLowerCase();
+	if (normalized === "auto" || normalized === "sandbox" || normalized === "gateway" || normalized === "node") return normalized;
+}
+function resolveEffectiveExecHost(params) {
+	if (params.requestedExecHost === "auto") return params.sandboxAvailable ? "sandbox" : "gateway";
+	return params.requestedExecHost;
+}
+function readRuntimeSessionEntryBestEffort(sessionKey) {
+	try {
+		return getSessionEntry({ sessionKey });
+	} catch {
+		return;
+	}
+}
+//#endregion
+//#region extensions/codex/src/app-server/sandbox-guard.ts
+const DIRECT_METHOD_POLICIES = new Map([
+	["account/rateLimits/read", "allowed-control-plane"],
+	["account/read", "allowed-control-plane"],
+	["app/list", "allowed-control-plane"],
+	["config/mcpServer/reload", "allowed-control-plane"],
+	["environment/add", "allowed-control-plane"],
+	["experimentalFeature/enablement/set", "allowed-control-plane"],
+	["feedback/upload", "allowed-control-plane"],
+	["hooks/list", "allowed-control-plane"],
+	["initialize", "allowed-control-plane"],
+	["marketplace/add", "allowed-control-plane"],
+	["mcpServerStatus/list", "allowed-control-plane"],
+	["model/list", "allowed-control-plane"],
+	["plugin/install", "allowed-control-plane"],
+	["plugin/list", "allowed-control-plane"],
+	["plugin/read", "allowed-control-plane"],
+	["skills/list", "allowed-control-plane"],
+	["thread/archive", "allowed-control-plane"],
+	["thread/inject_items", "allowed-control-plane"],
+	["thread/list", "allowed-control-plane"],
+	["thread/metadata/update", "allowed-control-plane"],
+	["thread/name/update", "allowed-control-plane"],
+	["thread/read", "allowed-control-plane"],
+	["thread/rollback", "allowed-control-plane"],
+	["thread/start", "requires-openclaw-environment"],
+	["thread/unarchive", "allowed-control-plane"],
+	["thread/unsubscribe", "allowed-control-plane"],
+	["turn/interrupt", "allowed-control-plane"],
+	["turn/steer", "allowed-control-plane"],
+	["command/exec", "blocked-native-bypass"],
+	["command/resize", "blocked-native-bypass"],
+	["command/terminate", "blocked-native-bypass"],
+	["command/write", "blocked-native-bypass"],
+	["fuzzyFileSearch", "blocked-native-bypass"],
+	["mcpServer/resource/read", "blocked-native-bypass"],
+	["mcpServer/tool/call", "blocked-native-bypass"],
+	["process/kill", "blocked-native-bypass"],
+	["process/resizePty", "blocked-native-bypass"],
+	["process/spawn", "blocked-native-bypass"],
+	["process/writeStdin", "blocked-native-bypass"],
+	["review/start", "blocked-native-bypass"],
+	["thread/compact/start", "blocked-native-bypass"],
+	["thread/fork", "blocked-native-bypass"],
+	["thread/resume", "blocked-native-bypass"],
+	["thread/shellCommand", "blocked-native-bypass"],
+	["turn/start", "blocked-native-bypass"]
+]);
+const BLOCKED_DIRECT_METHOD_PREFIXES = [
+	"command/",
+	"fs/",
+	"windowsSandbox/"
+];
+const NODE_EXEC_BLOCKED_CONTROL_PLANE_METHODS = new Set(["config/mcpServer/reload"]);
+function resolveCodexAppServerDirectSandboxBypassBlock(params) {
+	const policy = resolveDirectMethodPolicy(params.method);
+	if (NODE_EXEC_BLOCKED_CONTROL_PLANE_METHODS.has(params.method)) {
+		const nodeExecBlock = resolveCodexNativeNodeExecBlock({
+			config: params.config,
+			sessionKey: params.sessionKey,
+			sessionId: params.sessionId,
+			surface: `app-server method \`${params.method}\``
+		});
+		if (nodeExecBlock) return nodeExecBlock;
+	}
+	if (policy === "allowed-control-plane") return;
+	const nodeExecBlock = resolveCodexNativeNodeExecBlock({
+		config: params.config,
+		sessionKey: params.sessionKey,
+		sessionId: params.sessionId,
+		surface: `app-server method \`${params.method}\``
+	});
+	if (nodeExecBlock) return nodeExecBlock;
+	const sessionKey = params.sessionKey?.trim() || params.sessionId?.trim();
+	if (!sessionKey) return;
+	const sandboxBlock = resolveCodexNativeSandboxBlock({
+		config: params.config,
+		sessionKey,
+		surface: `app-server method \`${params.method}\``
+	});
+	if (!sandboxBlock) return;
+	if (policy === "requires-openclaw-environment" && hasOpenClawSandboxEnvironmentSelection(params.requestParams)) return;
+	return sandboxBlock;
+}
+function resolveCodexNativeExecutionBlock(params) {
+	return resolveCodexNativeSandboxBlock(params) ?? resolveCodexNativeNodeExecBlock(params);
+}
+function resolveCodexNativeSandboxBlock(params) {
+	const sessionKey = params.sessionKey?.trim() || params.sessionId?.trim();
+	if (!sessionKey) return;
+	if (!resolveSandboxRuntimeStatus({
+		cfg: params.config,
+		sessionKey
+	}).sandboxed) return;
+	return formatCodexNativeSandboxBlock({ surface: params.surface });
+}
+function resolveDirectMethodPolicy(method) {
+	const exact = DIRECT_METHOD_POLICIES.get(method);
+	if (exact) return exact;
+	if (BLOCKED_DIRECT_METHOD_PREFIXES.some((prefix) => method.startsWith(prefix))) return "blocked-native-bypass";
+	return "blocked-native-bypass";
+}
+function hasOpenClawSandboxEnvironmentSelection(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+	const environments = value.environments;
+	return Array.isArray(environments) && environments.length > 0 && environments.every((entry) => {
+		if (!entry || typeof entry !== "object" || Array.isArray(entry)) return false;
+		const environment = entry;
+		return typeof environment.environmentId === "string" && environment.environmentId.startsWith("openclaw-sandbox-") && typeof environment.cwd === "string" && environment.cwd.trim().length > 0;
+	});
+}
+function formatCodexNativeSandboxBlock(params) {
+	return [
+		`Codex-native ${params.surface} is unavailable because OpenClaw sandboxing is active for this session.`,
+		"This mode cannot route execution through the OpenClaw sandbox backend.",
+		"Use a normal Codex harness turn, or run an intentionally unsandboxed session."
+	].join(" ");
+}
+function resolveCodexNativeNodeExecBlock(params) {
+	const sessionKey = params.sessionKey?.trim() || params.sessionId?.trim();
+	const policy = resolveCodexNativeExecutionPolicy({
+		config: params.config,
+		sessionKey,
+		readRuntimeSessionEntry: Boolean(sessionKey)
+	});
+	if (policy.nativeToolSurfaceAllowed) return;
+	return formatCodexNativeNodeExecBlock({
+		surface: params.surface,
+		reason: policy.blockReason
+	});
+}
+//#endregion
+export { resolveCodexNativeExecutionPolicy as i, resolveCodexNativeExecutionBlock as n, resolveCodexNativeSandboxBlock as r, resolveCodexAppServerDirectSandboxBypassBlock as t };

package/dist/{session-binding-DEiYHgJ_.js → session-binding-Bw_mfIW2.js}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { o as normalizeCodexServiceTier } from "./config-DqIp6oTk.js";
+import { s as normalizeCodexServiceTier } from "./config-DDMrwfJl.js";
 import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
 import fs from "node:fs/promises";
 import { ensureAuthProfileStore, resolveDefaultAgentDir, resolveProviderIdForAuth } from "openclaw/plugin-sdk/agent-runtime";
@@ -56,6 +56,7 @@ async function readCodexAppServerBinding(sessionFile, lookup = {}) {
 			pluginAppsInputFingerprint: typeof parsed.pluginAppsInputFingerprint === "string" ? parsed.pluginAppsInputFingerprint : void 0,
 			pluginAppPolicyContext: readPluginAppPolicyContext(parsed.pluginAppPolicyContext),
 			contextEngine: readContextEngineBinding(parsed.contextEngine),
+			environmentSelectionFingerprint: typeof parsed.environmentSelectionFingerprint === "string" ? parsed.environmentSelectionFingerprint : void 0,
 			createdAt: typeof parsed.createdAt === "string" ? parsed.createdAt : (/* @__PURE__ */ new Date()).toISOString(),
 			updatedAt: typeof parsed.updatedAt === "string" ? parsed.updatedAt : (/* @__PURE__ */ new Date()).toISOString()
 		};
@@ -91,6 +92,7 @@ async function writeCodexAppServerBinding(sessionFile, binding, lookup = {}) {
 		pluginAppsInputFingerprint: binding.pluginAppsInputFingerprint,
 		pluginAppPolicyContext: binding.pluginAppPolicyContext,
 		contextEngine: binding.contextEngine,
+		environmentSelectionFingerprint: binding.environmentSelectionFingerprint,
 		createdAt: binding.createdAt ?? now,
 		updatedAt: now
 	};
@@ -150,7 +152,7 @@ function readPluginAppPolicyContext(value) {
 		pluginAppIds: parsedPluginAppIds
 	};
 }
-async function clearCodexAppServerBinding(sessionFile) {
+async function clearCodexAppServerBinding(sessionFile, _lookup = {}) {
 	try {
 		await fs.unlink(resolveCodexAppServerBindingPath(sessionFile));
 	} catch (error) {

package/dist/{shared-client-DCxJx5QU.js → shared-client-C_RbGxW8.js}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { c as resolveCodexAppServerRuntimeOptions, n as codexAppServerStartOptionsKey } from "./config-DqIp6oTk.js";
-import { a as MANAGED_CODEX_APP_SERVER_PACKAGE, o as resolveCodexAppServerSpawnEnv, t as CodexAppServerClient } from "./client-Ab4Fw77C.js";
+import { l as resolveCodexAppServerRuntimeOptions, n as codexAppServerStartOptionsKey } from "./config-DDMrwfJl.js";
+import { c as resolveCodexAppServerSpawnEnv, o as MANAGED_CODEX_APP_SERVER_PACKAGE, t as CodexAppServerClient } from "./client-D3SUwPFl.js";
 import { createRequire } from "node:module";
 import { createHash } from "node:crypto";
 import { constants, readFileSync } from "node:fs";

package/dist/{side-question-DlJAUYst.js → side-question-DzP1wClA.js}

@@ -1,12 +1,14 @@
-import { c as resolveCodexAppServerRuntimeOptions, s as readCodexPluginConfig } from "./config-DqIp6oTk.js";
-import { a as readCodexDynamicToolCallParams, i as assertCodexTurnStartResponse, l as readCodexTurnCompletedNotification, t as assertCodexThreadForkResponse } from "./protocol-validators-_gKDcd0x.js";
+import { c as readCodexPluginConfig, l as resolveCodexAppServerRuntimeOptions } from "./config-DDMrwfJl.js";
+import { a as readCodexDynamicToolCallParams, c as readCodexTurn, i as assertCodexTurnStartResponse, t as assertCodexThreadForkResponse } from "./protocol-validators-_gKDcd0x.js";
 import { t as isJsonObject } from "./protocol-oeJQu4rs.js";
-import { r as isCodexAppServerApprovalRequest } from "./client-Ab4Fw77C.js";
-import { u as formatCodexUsageLimitErrorMessage } from "./command-formatters-BVBnEgyA.js";
-import { i as getSharedCodexAppServerClient, s as refreshCodexAppServerAuthTokens } from "./shared-client-DCxJx5QU.js";
-import { i as readCodexAppServerBinding } from "./session-binding-DEiYHgJ_.js";
-import { S as filterCodexDynamicTools, T as resolveCodexDynamicToolsLoading, b as createCodexDynamicToolBridge, d as resolveReasoningEffort, h as mergeCodexThreadConfigs, n as buildCodexRuntimeThreadConfig, u as resolveCodexAppServerModelProvider } from "./thread-lifecycle-Cgi62SSl.js";
-import { a as handleCodexAppServerElicitationRequest, c as emitDynamicToolTerminalDiagnostic, i as buildCodexNativeHookRelayDisabledConfig, l as handleCodexAppServerApprovalRequest, n as CODEX_NATIVE_HOOK_RELAY_EVENTS, o as emitDynamicToolErrorDiagnostic, r as buildCodexNativeHookRelayConfig, s as emitDynamicToolStartedDiagnostic, t as filterToolsForVisionInputs } from "./vision-tools-B2wt6ecs.js";
+import { i as isCodexAppServerApprovalRequest } from "./client-D3SUwPFl.js";
+import { d as resolveReasoningEffort, h as mergeCodexThreadConfigs, n as buildCodexRuntimeThreadConfig, u as resolveCodexAppServerModelProvider } from "./thread-lifecycle-4Ul7RoW4.js";
+import { i as readCodexAppServerBinding } from "./session-binding-Bw_mfIW2.js";
+import { i as readCodexNotificationTurnId, m as formatCodexUsageLimitErrorMessage, r as readCodexNotificationThreadId } from "./notification-correlation-qKY_sgga.js";
+import { i as getSharedCodexAppServerClient, s as refreshCodexAppServerAuthTokens } from "./shared-client-C_RbGxW8.js";
+import { n as resolveCodexNativeExecutionBlock } from "./sandbox-guard-CTnEWuor.js";
+import { a as resolveCodexDynamicToolsLoading, n as filterCodexDynamicTools, t as createCodexDynamicToolBridge } from "./dynamic-tools-DA42no4X.js";
+import { a as handleCodexAppServerElicitationRequest, c as emitDynamicToolTerminalDiagnostic, i as buildCodexNativeHookRelayDisabledConfig, l as handleCodexAppServerApprovalRequest, n as CODEX_NATIVE_HOOK_RELAY_EVENTS, o as emitDynamicToolErrorDiagnostic, r as buildCodexNativeHookRelayConfig, s as emitDynamicToolStartedDiagnostic, t as filterToolsForVisionInputs } from "./vision-tools-DOnxzH2y.js";
 import { n as rememberCodexRateLimits, t as readRecentCodexRateLimits } from "./rate-limit-cache-N66I-Rd7.js";
 import { buildAgentHookContextChannelFields, embeddedAgentLog, formatErrorMessage, registerNativeHookRelay, resolveAgentDir, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveSandboxContext, resolveSessionAgentIds, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/side-question.ts
@@ -49,6 +51,13 @@ async function runCodexAppServerSideQuestion(params, options = {}) {
 		config: params.cfg
 	});
 	if (!binding?.threadId) throw new Error("Codex /btw needs an active Codex thread. Send a normal message first, then try /btw again.");
+	const nativeExecutionBlock = resolveCodexNativeExecutionBlock({
+		config: params.cfg,
+		sessionKey: params.sessionKey,
+		sessionId: params.sessionId,
+		surface: "/btw side-question mode"
+	});
+	if (nativeExecutionBlock) throw new Error(nativeExecutionBlock);
 	const pluginConfig = readCodexPluginConfig(options.pluginConfig);
 	const appServer = resolveCodexAppServerRuntimeOptions({ pluginConfig });
 	const authProfileId = params.authProfileId ?? binding.authProfileId;
@@ -601,7 +610,7 @@ var CodexSideQuestionCollector = class {
 		this.assistantText += delta;
 	}
 	completeFromTurn(params) {
-		const turn = readCodexTurnCompletedNotification(params)?.turn;
+		const turn = readCodexTurn(params.turn);
 		if (!turn || turn.id !== this.turnId) return;
 		this.completed = true;
 		if (turn.status === "failed") {
@@ -636,14 +645,10 @@ function collectAssistantText(turn) {
 	return (turn.items ?? []).filter((item) => item.type === "agentMessage" && typeof item.text === "string").map((item) => item.text.trim()).filter(Boolean).at(-1) ?? "";
 }
 function isNotificationForTurn(params, threadId, turnId) {
-	return readString(params, "threadId") === threadId && readNotificationTurnId(params) === turnId;
+	return readCodexNotificationThreadId(params) === threadId && readNotificationTurnId(params) === turnId;
 }
 function readNotificationTurnId(record) {
-	return readString(record, "turnId") ?? readNestedTurnId(record);
-}
-function readNestedTurnId(record) {
-	const turn = record.turn;
-	return isJsonObject(turn) ? readString(turn, "id") : void 0;
+	return readCodexNotificationTurnId(record);
 }
 function readBooleanAlias(record, keys) {
 	for (const key of keys) {

package/dist/test-api.js

@@ -1,5 +1,6 @@
-import { c as resolveCodexAppServerRuntimeOptions } from "./config-DqIp6oTk.js";
-import { S as filterCodexDynamicTools, a as buildThreadResumeParams, b as createCodexDynamicToolBridge, i as buildDeveloperInstructions, o as buildThreadStartParams, s as buildTurnStartParams } from "./thread-lifecycle-Cgi62SSl.js";
+import { l as resolveCodexAppServerRuntimeOptions } from "./config-DDMrwfJl.js";
+import { a as buildThreadResumeParams, i as buildDeveloperInstructions, o as buildThreadStartParams, s as buildTurnStartParams } from "./thread-lifecycle-4Ul7RoW4.js";
+import { n as filterCodexDynamicTools, t as createCodexDynamicToolBridge } from "./dynamic-tools-DA42no4X.js";
 //#region extensions/codex/test-api.ts
 function resolveCodexPromptSnapshotAppServerOptions(pluginConfig) {
 	return resolveCodexAppServerRuntimeOptions({