@openclaw/codex 2026.7.2-beta.5 → 2026.8.1-beta.2

package/dist/{runtime-artifact-C2ITXdhM.js → runtime-artifact-BVSPdd6g.js}

@@ -1,4 +1,4 @@
-import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-DXgGZ7Ib.js";
+import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-DIImwDVS.js";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { createHash } from "node:crypto";
@@ -17,16 +17,31 @@ const MAX_ARTIFACT_FILES = 8192;
 const MAX_ARTIFACT_TOTAL_BYTES = 1024n * 1024n * 1024n;
 const READ_CHUNK_BYTES = 64 * 1024;
 const CODE_MODE_HOST_PATH_ENV = "CODEX_CODE_MODE_HOST_PATH";
-const RUNTIME_INJECTION_ENV_KEYS = /* @__PURE__ */ new Set([
-	"NODE_PATH",
-	"LD_AUDIT",
-	"LD_LIBRARY_PATH",
-	"LD_PRELOAD",
-	"DYLD_FALLBACK_FRAMEWORK_PATH",
-	"DYLD_FALLBACK_LIBRARY_PATH",
-	"DYLD_FRAMEWORK_PATH",
-	"DYLD_INSERT_LIBRARIES",
-	"DYLD_LIBRARY_PATH"
+const SAFE_NODE_OPTIONS_BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
+	"--enable-network-family-autoselection",
+	"--network-family-autoselection",
+	"--no-deprecation",
+	"--no-network-family-autoselection",
+	"--no-warnings",
+	"--pending-deprecation",
+	"--throw-deprecation",
+	"--trace-deprecation",
+	"--trace-warnings",
+	"--use-bundled-ca",
+	"--use-env-proxy",
+	"--use-openssl-ca",
+	"--use-system-ca"
+]);
+const SAFE_NODE_OPTIONS_NUMERIC_FLAGS = /* @__PURE__ */ new Set([
+	"--max-old-space-size",
+	"--max-semi-space-size",
+	"--network-family-autoselection-attempt-timeout",
+	"--stack-trace-limit"
+]);
+const SAFE_NODE_OPTIONS_DNS_RESULT_ORDERS = /* @__PURE__ */ new Set([
+	"ipv4first",
+	"ipv6first",
+	"verbatim"
 ]);
 const ARTIFACT_BINDINGS_SYMBOL = Symbol.for("openclaw.codexAppServerRuntimeArtifactBindings");
 function getRuntimeArtifactBindings() {
@@ -112,44 +127,80 @@ function pathIsWithin(rootPath, candidatePath) {
 	const relative = path.relative(rootPath, candidatePath);
 	return relative === "" || !path.isAbsolute(relative) && !relative.startsWith(`..${path.sep}`) && relative !== "..";
 }
-function assertNoRuntimeInjectionEnvironment(env) {
+function assertSafeNodeOptions(env) {
 	for (const [rawKey, value] of Object.entries(env)) {
-		const key = rawKey.toUpperCase();
-		if (!value?.trim()) continue;
-		if (key === "NODE_OPTIONS" && isSafeNodeOptions(value)) continue;
-		if (key === "NODE_OPTIONS") throw new Error(`Codex runtime artifact cannot attest injected runtime environment: ${key}`);
-		if (RUNTIME_INJECTION_ENV_KEYS.has(key) || key.startsWith("DYLD_")) throw new Error(`Codex runtime artifact cannot attest injected runtime environment: ${key}`);
+		if (rawKey.toUpperCase() !== "NODE_OPTIONS" || !value?.trim()) continue;
+		const result = attestNodeOptions(value);
+		if (result.ok) continue;
+		if (result.option) throw new Error(`Codex runtime artifact cannot attest NODE_OPTIONS option ${result.option}`);
+		throw new Error("Codex runtime artifact cannot safely parse NODE_OPTIONS");
 	}
 }
-function isSafeNodeOptions(value) {
-	const tokens = value.trim().split(/\s+/u);
-	const valueFlags = /* @__PURE__ */ new Set([
-		"--max-old-space-size",
-		"--max_old_space_size",
-		"--max-semi-space-size",
-		"--max_semi_space_size",
-		"--stack-trace-limit"
-	]);
-	const booleanFlags = /* @__PURE__ */ new Set([
-		"--no-deprecation",
-		"--no-warnings",
-		"--pending-deprecation",
-		"--throw-deprecation",
-		"--trace-deprecation",
-		"--trace-warnings"
-	]);
+function parseNodeOptions(value) {
+	const tokens = [];
+	let inQuotes = false;
+	let startsNewToken = true;
+	for (let index = 0; index < value.length; index += 1) {
+		let character = value[index];
+		if (character === "\\" && inQuotes) {
+			index += 1;
+			if (index >= value.length) return;
+			character = value[index];
+		} else if (character === " " && !inQuotes) {
+			startsNewToken = true;
+			continue;
+		} else if (character === "\"") {
+			inQuotes = !inQuotes;
+			continue;
+		}
+		if (startsNewToken) {
+			tokens.push(character);
+			startsNewToken = false;
+		} else tokens[tokens.length - 1] += character;
+	}
+	return inQuotes ? void 0 : tokens;
+}
+function normalizedNodeOptionName(token) {
+	const equalsIndex = token.indexOf("=");
+	const name = (equalsIndex === -1 ? token : token.slice(0, equalsIndex)).replaceAll("_", "-");
+	return /^--[a-z][a-z0-9-]{0,63}$/u.test(name) ? name : void 0;
+}
+function attestNodeOptions(value) {
+	const tokens = parseNodeOptions(value);
+	if (!tokens || tokens.length === 0) return { ok: false };
 	for (let index = 0; index < tokens.length; index += 1) {
 		const token = tokens[index];
-		if (booleanFlags.has(token)) continue;
 		const equalsIndex = token.indexOf("=");
-		const flag = equalsIndex === -1 ? token : token.slice(0, equalsIndex);
+		const flag = normalizedNodeOptionName(token);
+		if (!flag) return { ok: false };
 		const inlineValue = equalsIndex === -1 ? void 0 : token.slice(equalsIndex + 1);
+		if (SAFE_NODE_OPTIONS_BOOLEAN_FLAGS.has(flag)) {
+			if (inlineValue === void 0) continue;
+			return {
+				ok: false,
+				option: flag
+			};
+		}
 		if (flag === "--disable-warning" && inlineValue && /^[A-Za-z][A-Za-z0-9_.:-]{0,63}$/u.test(inlineValue)) continue;
-		if (!valueFlags.has(flag)) return false;
+		if (flag === "--dns-result-order") {
+			const order = inlineValue ?? tokens[++index];
+			if (order && SAFE_NODE_OPTIONS_DNS_RESULT_ORDERS.has(order)) continue;
+			return {
+				ok: false,
+				option: flag
+			};
+		}
+		if (!SAFE_NODE_OPTIONS_NUMERIC_FLAGS.has(flag)) return {
+			ok: false,
+			option: flag
+		};
 		const numericValue = inlineValue ?? tokens[++index];
-		if (!numericValue || !/^\d+$/u.test(numericValue)) return false;
+		if (!numericValue || !/^\d+$/u.test(numericValue)) return {
+			ok: false,
+			option: flag
+		};
 	}
-	return tokens.length > 0;
+	return { ok: true };
 }
 async function hashSelectedArtifactFiles(descriptor, signal) {
 	throwIfAborted(signal);
@@ -311,7 +362,7 @@ async function captureFilesystemDescriptor(params) {
 	throwIfAborted(params.signal);
 	if (params.startOptions.transport !== "stdio") throw new Error("Verified Codex inference requires a local stdio runtime artifact; WebSocket attestation is unsupported");
 	const env = resolveCodexAppServerSpawnEnv(params.startOptions);
-	assertNoRuntimeInjectionEnvironment(env);
+	assertSafeNodeOptions(env);
 	const spawnCwd = path.resolve(params.startOptions.cwd ?? process.cwd());
 	const commandPath = await resolveCommandPath(params.startOptions.command, env, spawnCwd);
 	const commandRealPath = await fs.realpath(commandPath);

package/dist/{sandbox-guard-D1Wky__S.js → sandbox-guard-Cmwc9eIk.js}

@@ -1,11 +1,8 @@
+import { C as isCodexRemoteExecPlacementSandbox } from "./session-binding-DPxIvMgE.js";
+import { normalizeAgentId } from "openclaw/plugin-sdk/routing";
 import { getSessionEntry } from "openclaw/plugin-sdk/session-store-runtime";
 import { resolveSandboxRuntimeStatus } from "openclaw/plugin-sdk/sandbox";
 //#region extensions/codex/src/app-server/native-execution-policy.ts
-const DEFAULT_AGENT_ID = "main";
-const VALID_AGENT_ID_PATTERN = /^[a-z0-9][a-z0-9_-]{0,63}$/i;
-const INVALID_AGENT_ID_CHARS_PATTERN = /[^a-z0-9_-]+/g;
-const LEADING_DASH_PATTERN = /^-+/;
-const TRAILING_DASH_PATTERN = /-+$/;
 /** Projects node execution ownership into the runtime tool factory options. */
 function resolveCodexNodeExecToolOverrides(policy) {
 	if (policy.effectiveExecHost !== "node") return;
@@ -109,14 +106,7 @@ function resolveDefaultPolicyAgentId(agents) {
 }
 function normalizeAgentIdOrDefault(value) {
 	const normalized = normalizeAgentId(value);
-	return normalized === DEFAULT_AGENT_ID && !(value ?? "").trim() ? void 0 : normalized;
-}
-function normalizeAgentId(value) {
-	const trimmed = (value ?? "").trim();
-	if (!trimmed) return DEFAULT_AGENT_ID;
-	const normalized = trimmed.toLowerCase();
-	if (VALID_AGENT_ID_PATTERN.test(trimmed)) return normalized;
-	return normalized.replace(INVALID_AGENT_ID_CHARS_PATTERN, "-").replace(LEADING_DASH_PATTERN, "").replace(TRAILING_DASH_PATTERN, "").slice(0, 64) || DEFAULT_AGENT_ID;
+	return normalized === "main" && !(value ?? "").trim() ? void 0 : normalized;
 }
 function normalizeExecTarget(value) {
 	const normalized = value?.trim().toLowerCase();
@@ -142,7 +132,10 @@ function readRuntimeSessionEntryBestEffort(params) {
 const DIRECT_METHOD_POLICIES = /* @__PURE__ */ new Map([
 	["account/rateLimits/read", "allowed-control-plane"],
 	["account/read", "allowed-control-plane"],
+	["app/installed", "allowed-control-plane"],
 	["app/list", "allowed-control-plane"],
+	["app/read", "allowed-control-plane"],
+	["config/batchWrite", "allowed-control-plane"],
 	["config/mcpServer/reload", "allowed-control-plane"],
 	["config/read", "allowed-control-plane"],
 	["config/value/write", "allowed-control-plane"],
@@ -155,6 +148,7 @@ const DIRECT_METHOD_POLICIES = /* @__PURE__ */ new Map([
 	["mcpServerStatus/list", "allowed-control-plane"],
 	["model/list", "allowed-control-plane"],
 	["plugin/install", "allowed-control-plane"],
+	["plugin/installed", "allowed-control-plane"],
 	["plugin/list", "allowed-control-plane"],
 	["plugin/read", "allowed-control-plane"],
 	["skills/list", "allowed-control-plane"],
@@ -219,6 +213,7 @@ function resolveCodexAppServerDirectSandboxBypassBlock(params) {
 	const sandboxBlock = resolveCodexNativeSandboxBlock({
 		config: params.config,
 		sessionKey,
+		sandbox: params.sandbox,
 		surface: `app-server method \`${params.method}\``
 	});
 	if (!sandboxBlock) return;
@@ -231,8 +226,10 @@ function resolveCodexNativeExecutionBlock(params) {
 }
 /** Returns a block message when native Codex execution cannot honor active sandboxing. */
 function resolveCodexNativeSandboxBlock(params) {
+	if (params.sandboxEnvironmentSelected) return;
 	const sessionKey = params.sessionKey?.trim() || params.sessionId?.trim();
 	if (!sessionKey) return;
+	if (isCodexRemoteExecPlacementSandbox(params.sandbox) || params.sandbox?.enabled === true) return formatCodexNativeSandboxBlock({ surface: params.surface });
 	if (!resolveSandboxRuntimeStatus({
 		cfg: params.config,
 		sessionKey