@openclaw/codex 2026.7.2-beta.5 → 2026.7.2-beta.7

package/dist/{runtime-artifact-C2ITXdhM.js → runtime-artifact-CmtG_t1L.js}

@@ -28,6 +28,32 @@ const RUNTIME_INJECTION_ENV_KEYS = /* @__PURE__ */ new Set([
 	"DYLD_INSERT_LIBRARIES",
 	"DYLD_LIBRARY_PATH"
 ]);
+const SAFE_NODE_OPTIONS_BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
+	"--enable-network-family-autoselection",
+	"--network-family-autoselection",
+	"--no-deprecation",
+	"--no-network-family-autoselection",
+	"--no-warnings",
+	"--pending-deprecation",
+	"--throw-deprecation",
+	"--trace-deprecation",
+	"--trace-warnings",
+	"--use-bundled-ca",
+	"--use-env-proxy",
+	"--use-openssl-ca",
+	"--use-system-ca"
+]);
+const SAFE_NODE_OPTIONS_NUMERIC_FLAGS = /* @__PURE__ */ new Set([
+	"--max-old-space-size",
+	"--max-semi-space-size",
+	"--network-family-autoselection-attempt-timeout",
+	"--stack-trace-limit"
+]);
+const SAFE_NODE_OPTIONS_DNS_RESULT_ORDERS = /* @__PURE__ */ new Set([
+	"ipv4first",
+	"ipv6first",
+	"verbatim"
+]);
 const ARTIFACT_BINDINGS_SYMBOL = Symbol.for("openclaw.codexAppServerRuntimeArtifactBindings");
 function getRuntimeArtifactBindings() {
 	const globalState = globalThis;
@@ -116,40 +142,80 @@ function assertNoRuntimeInjectionEnvironment(env) {
 	for (const [rawKey, value] of Object.entries(env)) {
 		const key = rawKey.toUpperCase();
 		if (!value?.trim()) continue;
-		if (key === "NODE_OPTIONS" && isSafeNodeOptions(value)) continue;
-		if (key === "NODE_OPTIONS") throw new Error(`Codex runtime artifact cannot attest injected runtime environment: ${key}`);
+		if (key === "NODE_OPTIONS") {
+			const result = attestNodeOptions(value);
+			if (result.ok) continue;
+			if (result.option) throw new Error(`Codex runtime artifact cannot attest NODE_OPTIONS option ${result.option}`);
+			throw new Error("Codex runtime artifact cannot safely parse NODE_OPTIONS");
+		}
 		if (RUNTIME_INJECTION_ENV_KEYS.has(key) || key.startsWith("DYLD_")) throw new Error(`Codex runtime artifact cannot attest injected runtime environment: ${key}`);
 	}
 }
-function isSafeNodeOptions(value) {
-	const tokens = value.trim().split(/\s+/u);
-	const valueFlags = /* @__PURE__ */ new Set([
-		"--max-old-space-size",
-		"--max_old_space_size",
-		"--max-semi-space-size",
-		"--max_semi_space_size",
-		"--stack-trace-limit"
-	]);
-	const booleanFlags = /* @__PURE__ */ new Set([
-		"--no-deprecation",
-		"--no-warnings",
-		"--pending-deprecation",
-		"--throw-deprecation",
-		"--trace-deprecation",
-		"--trace-warnings"
-	]);
+function parseNodeOptions(value) {
+	const tokens = [];
+	let inQuotes = false;
+	let startsNewToken = true;
+	for (let index = 0; index < value.length; index += 1) {
+		let character = value[index];
+		if (character === "\\" && inQuotes) {
+			index += 1;
+			if (index >= value.length) return;
+			character = value[index];
+		} else if (character === " " && !inQuotes) {
+			startsNewToken = true;
+			continue;
+		} else if (character === "\"") {
+			inQuotes = !inQuotes;
+			continue;
+		}
+		if (startsNewToken) {
+			tokens.push(character);
+			startsNewToken = false;
+		} else tokens[tokens.length - 1] += character;
+	}
+	return inQuotes ? void 0 : tokens;
+}
+function normalizedNodeOptionName(token) {
+	const equalsIndex = token.indexOf("=");
+	const name = (equalsIndex === -1 ? token : token.slice(0, equalsIndex)).replaceAll("_", "-");
+	return /^--[a-z][a-z0-9-]{0,63}$/u.test(name) ? name : void 0;
+}
+function attestNodeOptions(value) {
+	const tokens = parseNodeOptions(value);
+	if (!tokens || tokens.length === 0) return { ok: false };
 	for (let index = 0; index < tokens.length; index += 1) {
 		const token = tokens[index];
-		if (booleanFlags.has(token)) continue;
 		const equalsIndex = token.indexOf("=");
-		const flag = equalsIndex === -1 ? token : token.slice(0, equalsIndex);
+		const flag = normalizedNodeOptionName(token);
+		if (!flag) return { ok: false };
 		const inlineValue = equalsIndex === -1 ? void 0 : token.slice(equalsIndex + 1);
+		if (SAFE_NODE_OPTIONS_BOOLEAN_FLAGS.has(flag)) {
+			if (inlineValue === void 0) continue;
+			return {
+				ok: false,
+				option: flag
+			};
+		}
 		if (flag === "--disable-warning" && inlineValue && /^[A-Za-z][A-Za-z0-9_.:-]{0,63}$/u.test(inlineValue)) continue;
-		if (!valueFlags.has(flag)) return false;
+		if (flag === "--dns-result-order") {
+			const order = inlineValue ?? tokens[++index];
+			if (order && SAFE_NODE_OPTIONS_DNS_RESULT_ORDERS.has(order)) continue;
+			return {
+				ok: false,
+				option: flag
+			};
+		}
+		if (!SAFE_NODE_OPTIONS_NUMERIC_FLAGS.has(flag)) return {
+			ok: false,
+			option: flag
+		};
 		const numericValue = inlineValue ?? tokens[++index];
-		if (!numericValue || !/^\d+$/u.test(numericValue)) return false;
+		if (!numericValue || !/^\d+$/u.test(numericValue)) return {
+			ok: false,
+			option: flag
+		};
 	}
-	return tokens.length > 0;
+	return { ok: true };
 }
 async function hashSelectedArtifactFiles(descriptor, signal) {
 	throwIfAborted(signal);

package/dist/{sandbox-guard-D1Wky__S.js → sandbox-guard-NuhpXmPB.js}

@@ -142,7 +142,10 @@ function readRuntimeSessionEntryBestEffort(params) {
 const DIRECT_METHOD_POLICIES = /* @__PURE__ */ new Map([
 	["account/rateLimits/read", "allowed-control-plane"],
 	["account/read", "allowed-control-plane"],
+	["app/installed", "allowed-control-plane"],
 	["app/list", "allowed-control-plane"],
+	["app/read", "allowed-control-plane"],
+	["config/batchWrite", "allowed-control-plane"],
 	["config/mcpServer/reload", "allowed-control-plane"],
 	["config/read", "allowed-control-plane"],
 	["config/value/write", "allowed-control-plane"],
@@ -155,6 +158,7 @@ const DIRECT_METHOD_POLICIES = /* @__PURE__ */ new Map([
 	["mcpServerStatus/list", "allowed-control-plane"],
 	["model/list", "allowed-control-plane"],
 	["plugin/install", "allowed-control-plane"],
+	["plugin/installed", "allowed-control-plane"],
 	["plugin/list", "allowed-control-plane"],
 	["plugin/read", "allowed-control-plane"],
 	["skills/list", "allowed-control-plane"],

package/dist/{session-binding-DlVQ-Pxs.js → session-binding-BXpo9ymA.js}

@@ -14,6 +14,7 @@ import { normalizeTrimmedStringList } from "openclaw/plugin-sdk/string-coerce-ru
 import { detectWindowsSpawnCommandInlineArgs } from "openclaw/plugin-sdk/windows-spawn";
 import { z } from "zod";
 import { parse } from "smol-toml";
+import { isLoopbackHost } from "openclaw/plugin-sdk/ssrf-runtime";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { getSessionEntry, resolveStorePath } from "openclaw/plugin-sdk/session-store-runtime";
 //#region extensions/codex/src/app-server/config-contracts.ts
@@ -1025,8 +1026,7 @@ function isLoopbackWebSocketUrl(value) {
 		return false;
 	}
 	if (parsed.protocol !== "ws:" && parsed.protocol !== "wss:") return false;
-	const host = parsed.hostname.toLowerCase();
-	return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]" || host.startsWith("127.");
+	return isLoopbackHost(parsed.hostname);
 }
 function hasIdentityBearingWebSocketAuth(params) {
 	if (readNonEmptyString(params.authToken)) return true;
@@ -1074,11 +1074,23 @@ function resolveDefaultCodexAppServerPolicy(params) {
 }
 //#endregion
 //#region extensions/codex/src/app-server/config-runtime.ts
+/**
+* Sole owner of the app-server home-scope decision. Ordinary harness connections
+* default to the isolated agent home; the supervision connection owns the operator's
+* native Codex home on local transports. Auth handoffs must read the scope from here
+* (or from resolved start options) because a prepared login on a native home rewrites
+* the account Codex CLI and Desktop share.
+*/
+function resolveCodexAppServerHomeScope(params) {
+	const configured = params.appServer?.homeScope;
+	if (configured) return configured;
+	return params.connectionScope === "supervision" && resolveTransport(params.appServer?.transport) !== "websocket" ? "user" : "agent";
+}
 function resolveCodexAppServerRuntimeOptions(params = {}) {
 	const env = params.env ?? process.env;
 	const config = readCodexPluginConfig(params.pluginConfig).appServer ?? {};
 	const transport = resolveTransport(config.transport);
-	const homeScope = config.homeScope ?? "agent";
+	const homeScope = resolveCodexAppServerHomeScope({ appServer: config });
 	const configCommand = readNonEmptyString(config.command);
 	const envCommand = readNonEmptyString(env.OPENCLAW_CODEX_APP_SERVER_BIN);
 	const command = configCommand ?? envCommand ?? "codex";
@@ -1326,8 +1338,10 @@ function codexSandboxPolicyForTurn(mode, cwd, nativeArgs = []) {
 function resolveCodexSupervisionAppServerRuntimeOptions(params = {}) {
 	const pluginConfig = readCodexPluginConfig(params.pluginConfig);
 	const appServer = pluginConfig.appServer ?? {};
-	const transport = resolveTransport(appServer.transport);
-	const homeScope = appServer.homeScope ?? (transport === "websocket" ? "agent" : "user");
+	const homeScope = resolveCodexAppServerHomeScope({
+		appServer,
+		connectionScope: "supervision"
+	});
 	return resolveCodexAppServerRuntimeOptions({
 		...params,
 		pluginConfig: {
@@ -1360,6 +1374,8 @@ var session_binding_exports = /* @__PURE__ */ __exportAll({
 	readStoredCodexAppServerBinding: () => readStoredCodexAppServerBinding,
 	reclaimCurrentCodexSessionGeneration: () => reclaimCurrentCodexSessionGeneration,
 	resolveCodexAppServerBindingModelProvider: () => resolveCodexAppServerBindingModelProvider,
+	resolveCodexRunSessionBindingAuthority: () => resolveCodexRunSessionBindingAuthority,
+	scopeCodexRunBindingStore: () => scopeCodexRunBindingStore,
 	sessionBindingIdentity: () => sessionBindingIdentity
 });
 const CODEX_APP_SERVER_NATIVE_AUTH_PROVIDER = "openai";
@@ -1382,6 +1398,25 @@ function sessionBindingIdentity(params) {
 		...sessionKey ? { sessionKey } : {}
 	};
 }
+/** Decides whether a run may share the durable stable-key binding owner. */
+function resolveCodexRunSessionBindingAuthority(params) {
+	const sessionKey = params.identity.sessionKey?.trim();
+	if (!sessionKey) return "ephemeral";
+	try {
+		const storePath = params.storePath?.trim() || resolveStorePath(params.config?.session?.store, { agentId: params.identity.agentId });
+		const entry = getSessionEntry({
+			agentId: params.identity.agentId,
+			hydrateSkillPromptRefs: false,
+			readConsistency: "latest",
+			sessionKey,
+			storePath
+		});
+		if (!entry) return "ephemeral";
+		return entry.sessionId === params.identity.sessionId ? "current" : "superseded";
+	} catch {
+		return "superseded";
+	}
+}
 /** Builds the terminal coordination error used when a newer OpenClaw session owns the binding. */
 function createCodexSessionGenerationSupersededError(sessionId) {
 	return new AgentHarnessSessionSupersededError(`Codex session generation is no longer current: ${sessionId}`);
@@ -1449,6 +1484,7 @@ const threadBindingSchema = z.object({
 	threadId: z.string().refine((value) => Boolean(value.trim())),
 	clientId: optionalStringSchema,
 	cwd: z.string(),
+	rolloutPath: optionalNonBlankStringSchema,
 	connectionScope: z.literal("supervision").optional(),
 	supervisionSourceThreadId: z.string().trim().min(1).optional(),
 	authProfileId: optionalStringSchema,
@@ -1472,6 +1508,7 @@ const threadBindingSchema = z.object({
 	dynamicToolsFingerprint: optionalStringSchema,
 	dynamicToolsContainDeferred: optionalBooleanSchema,
 	webSearchThreadConfigFingerprint: optionalStringSchema,
+	nativeSkillIsolationFingerprint: optionalStringSchema,
 	userMcpServersFingerprint: optionalStringSchema,
 	mcpServersFingerprint: optionalStringSchema,
 	ringZeroConfigFingerprint: optionalStringSchema,
@@ -1610,6 +1647,22 @@ function createStoredCodexAppServerBinding(value, options = {}) {
 function bindingLeaseLostError(key, cause) {
 	return new Error(`Lost Codex binding lease: ${key}`, cause === void 0 ? void 0 : { cause });
 }
+/** Carries one prepared run identity through callers that rederive it from public params. */
+function scopeCodexRunBindingStore(params) {
+	const mapSessionIdentity = (identity) => identity.agentId === params.logicalIdentity.agentId && identity.sessionId === params.logicalIdentity.sessionId && identity.sessionKey?.trim() === params.logicalIdentity.sessionKey?.trim() ? params.physicalIdentity : identity;
+	const mapIdentity = (identity) => identity.kind === "session" ? mapSessionIdentity(identity) : identity;
+	return {
+		read: (identity) => params.bindingStore.read(mapIdentity(identity)),
+		hasOtherThreadOwner: (threadId, identity) => params.bindingStore.hasOtherThreadOwner(threadId, identity ? mapIdentity(identity) : void 0),
+		mutate: (identity, mutation) => params.bindingStore.mutate(mapIdentity(identity), mutation),
+		prepareSessionGenerationReclaim: (identity) => params.bindingStore.prepareSessionGenerationReclaim(mapSessionIdentity(identity)),
+		adoptSessionGeneration: (identity, expectedPreviousSessionId) => params.bindingStore.adoptSessionGeneration(mapSessionIdentity(identity), expectedPreviousSessionId),
+		resetSessionGeneration: (identity) => params.bindingStore.resetSessionGeneration(mapSessionIdentity(identity)),
+		retireSessionGeneration: (identity) => params.bindingStore.retireSessionGeneration(mapSessionIdentity(identity)),
+		withThreadArchiveFence: (run) => params.bindingStore.withThreadArchiveFence(run),
+		withLease: (identity, run) => params.bindingStore.withLease(mapIdentity(identity), run)
+	};
+}
 /** Lets the authoritative OpenClaw session generation claim a stale stable binding row. */
 async function reclaimCurrentCodexSessionGeneration(params) {
 	const sessionKey = params.identity.sessionKey?.trim();
@@ -1617,7 +1670,7 @@ async function reclaimCurrentCodexSessionGeneration(params) {
 	const plan = await params.bindingStore.prepareSessionGenerationReclaim(params.identity);
 	if (plan.kind === "resolved") return plan.result;
 	try {
-		const storePath = resolveStorePath(params.config?.session?.store, { agentId: params.identity.agentId });
+		const storePath = params.storePath?.trim() || resolveStorePath(params.config?.session?.store, { agentId: params.identity.agentId });
 		if (getSessionEntry({
 			agentId: params.identity.agentId,
 			hydrateSkillPromptRefs: false,
@@ -2158,4 +2211,4 @@ function resolveCodexAppServerBindingModelProvider(params) {
 	return params.modelProvider?.trim() || (isCodexAppServerNativeAuthProfile(params) ? PUBLIC_OPENAI_MODEL_PROVIDER : void 0);
 }
 //#endregion
-export { CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME as A, isCodexAppServerApprovalPolicyAllowedByRequirements as C, resolveOpenClawExecPolicyForCodexAppServer as D, resolveCodexPluginsPolicy as E, isCodexFastServiceTier as O, resolveCodexModelBackedReviewerPolicyContext as S, readCodexPluginConfig as T, assertCodexAppServerConnectionSecurity as _, hashCodexAppServerBindingFingerprint as a, canUseCodexModelBackedApprovalsReviewerForModel as b, reclaimCurrentCodexSessionGeneration as c, codexAppServerStartOptionsKey as d, codexSandboxPolicyForTurn as f, resolveCodexSupervisionAppServerRuntimeOptions as g, resolveCodexComputerUseConfig as h, createCodexSessionGenerationSupersededError as i, CODEX_PLUGINS_MARKETPLACE_NAME as k, sessionBindingIdentity as l, resolveCodexAppServerStartOptionsForAgent as m, assertCodexBindingMayBeReplaced as n, isCodexAppServerNativeAuthProfile as o, resolveCodexAppServerRuntimeOptions as p, bindingStoreKey as r, normalizeCodexAppServerBindingModelProvider as s, CODEX_APP_SERVER_BINDING_GUARDED_REQUEST_TIMEOUT_MS as t, session_binding_exports as u, shouldAutoApproveCodexAppServerApprovals as v, isCodexSandboxExecServerEnabled as w, resolveCodexAppServerUserHomeDir as x, withMcpElicitationsApprovalPolicy as y };
+export { resolveOpenClawExecPolicyForCodexAppServer as A, canUseCodexModelBackedApprovalsReviewerForModel as C, isCodexSandboxExecServerEnabled as D, isCodexAppServerApprovalPolicyAllowedByRequirements as E, CODEX_PLUGINS_MARKETPLACE_NAME as M, CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME as N, readCodexPluginConfig as O, withMcpElicitationsApprovalPolicy as S, resolveCodexModelBackedReviewerPolicyContext as T, resolveCodexAppServerStartOptionsForAgent as _, hashCodexAppServerBindingFingerprint as a, assertCodexAppServerConnectionSecurity as b, reclaimCurrentCodexSessionGeneration as c, sessionBindingIdentity as d, session_binding_exports as f, resolveCodexAppServerRuntimeOptions as g, resolveCodexAppServerHomeScope as h, createCodexSessionGenerationSupersededError as i, isCodexFastServiceTier as j, resolveCodexPluginsPolicy as k, resolveCodexRunSessionBindingAuthority as l, codexSandboxPolicyForTurn as m, assertCodexBindingMayBeReplaced as n, isCodexAppServerNativeAuthProfile as o, codexAppServerStartOptionsKey as p, bindingStoreKey as r, normalizeCodexAppServerBindingModelProvider as s, CODEX_APP_SERVER_BINDING_GUARDED_REQUEST_TIMEOUT_MS as t, scopeCodexRunBindingStore as u, resolveCodexComputerUseConfig as v, resolveCodexAppServerUserHomeDir as w, shouldAutoApproveCodexAppServerApprovals as x, resolveCodexSupervisionAppServerRuntimeOptions as y };