@openclaw/codex 2026.7.2-beta.7 → 2026.8.1-beta.2

package/dist/{runtime-artifact-CmtG_t1L.js → runtime-artifact-BVSPdd6g.js}

@@ -1,4 +1,4 @@
-import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-DXgGZ7Ib.js";
+import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-DIImwDVS.js";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { createHash } from "node:crypto";
@@ -17,17 +17,6 @@ const MAX_ARTIFACT_FILES = 8192;
 const MAX_ARTIFACT_TOTAL_BYTES = 1024n * 1024n * 1024n;
 const READ_CHUNK_BYTES = 64 * 1024;
 const CODE_MODE_HOST_PATH_ENV = "CODEX_CODE_MODE_HOST_PATH";
-const RUNTIME_INJECTION_ENV_KEYS = /* @__PURE__ */ new Set([
-	"NODE_PATH",
-	"LD_AUDIT",
-	"LD_LIBRARY_PATH",
-	"LD_PRELOAD",
-	"DYLD_FALLBACK_FRAMEWORK_PATH",
-	"DYLD_FALLBACK_LIBRARY_PATH",
-	"DYLD_FRAMEWORK_PATH",
-	"DYLD_INSERT_LIBRARIES",
-	"DYLD_LIBRARY_PATH"
-]);
 const SAFE_NODE_OPTIONS_BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
 	"--enable-network-family-autoselection",
 	"--network-family-autoselection",
@@ -138,17 +127,13 @@ function pathIsWithin(rootPath, candidatePath) {
 	const relative = path.relative(rootPath, candidatePath);
 	return relative === "" || !path.isAbsolute(relative) && !relative.startsWith(`..${path.sep}`) && relative !== "..";
 }
-function assertNoRuntimeInjectionEnvironment(env) {
+function assertSafeNodeOptions(env) {
 	for (const [rawKey, value] of Object.entries(env)) {
-		const key = rawKey.toUpperCase();
-		if (!value?.trim()) continue;
-		if (key === "NODE_OPTIONS") {
-			const result = attestNodeOptions(value);
-			if (result.ok) continue;
-			if (result.option) throw new Error(`Codex runtime artifact cannot attest NODE_OPTIONS option ${result.option}`);
-			throw new Error("Codex runtime artifact cannot safely parse NODE_OPTIONS");
-		}
-		if (RUNTIME_INJECTION_ENV_KEYS.has(key) || key.startsWith("DYLD_")) throw new Error(`Codex runtime artifact cannot attest injected runtime environment: ${key}`);
+		if (rawKey.toUpperCase() !== "NODE_OPTIONS" || !value?.trim()) continue;
+		const result = attestNodeOptions(value);
+		if (result.ok) continue;
+		if (result.option) throw new Error(`Codex runtime artifact cannot attest NODE_OPTIONS option ${result.option}`);
+		throw new Error("Codex runtime artifact cannot safely parse NODE_OPTIONS");
 	}
 }
 function parseNodeOptions(value) {
@@ -377,7 +362,7 @@ async function captureFilesystemDescriptor(params) {
 	throwIfAborted(params.signal);
 	if (params.startOptions.transport !== "stdio") throw new Error("Verified Codex inference requires a local stdio runtime artifact; WebSocket attestation is unsupported");
 	const env = resolveCodexAppServerSpawnEnv(params.startOptions);
-	assertNoRuntimeInjectionEnvironment(env);
+	assertSafeNodeOptions(env);
 	const spawnCwd = path.resolve(params.startOptions.cwd ?? process.cwd());
 	const commandPath = await resolveCommandPath(params.startOptions.command, env, spawnCwd);
 	const commandRealPath = await fs.realpath(commandPath);

package/dist/{sandbox-guard-NuhpXmPB.js → sandbox-guard-Cmwc9eIk.js}

@@ -1,11 +1,8 @@
+import { C as isCodexRemoteExecPlacementSandbox } from "./session-binding-DPxIvMgE.js";
+import { normalizeAgentId } from "openclaw/plugin-sdk/routing";
 import { getSessionEntry } from "openclaw/plugin-sdk/session-store-runtime";
 import { resolveSandboxRuntimeStatus } from "openclaw/plugin-sdk/sandbox";
 //#region extensions/codex/src/app-server/native-execution-policy.ts
-const DEFAULT_AGENT_ID = "main";
-const VALID_AGENT_ID_PATTERN = /^[a-z0-9][a-z0-9_-]{0,63}$/i;
-const INVALID_AGENT_ID_CHARS_PATTERN = /[^a-z0-9_-]+/g;
-const LEADING_DASH_PATTERN = /^-+/;
-const TRAILING_DASH_PATTERN = /-+$/;
 /** Projects node execution ownership into the runtime tool factory options. */
 function resolveCodexNodeExecToolOverrides(policy) {
 	if (policy.effectiveExecHost !== "node") return;
@@ -109,14 +106,7 @@ function resolveDefaultPolicyAgentId(agents) {
 }
 function normalizeAgentIdOrDefault(value) {
 	const normalized = normalizeAgentId(value);
-	return normalized === DEFAULT_AGENT_ID && !(value ?? "").trim() ? void 0 : normalized;
-}
-function normalizeAgentId(value) {
-	const trimmed = (value ?? "").trim();
-	if (!trimmed) return DEFAULT_AGENT_ID;
-	const normalized = trimmed.toLowerCase();
-	if (VALID_AGENT_ID_PATTERN.test(trimmed)) return normalized;
-	return normalized.replace(INVALID_AGENT_ID_CHARS_PATTERN, "-").replace(LEADING_DASH_PATTERN, "").replace(TRAILING_DASH_PATTERN, "").slice(0, 64) || DEFAULT_AGENT_ID;
+	return normalized === "main" && !(value ?? "").trim() ? void 0 : normalized;
 }
 function normalizeExecTarget(value) {
 	const normalized = value?.trim().toLowerCase();
@@ -223,6 +213,7 @@ function resolveCodexAppServerDirectSandboxBypassBlock(params) {
 	const sandboxBlock = resolveCodexNativeSandboxBlock({
 		config: params.config,
 		sessionKey,
+		sandbox: params.sandbox,
 		surface: `app-server method \`${params.method}\``
 	});
 	if (!sandboxBlock) return;
@@ -235,8 +226,10 @@ function resolveCodexNativeExecutionBlock(params) {
 }
 /** Returns a block message when native Codex execution cannot honor active sandboxing. */
 function resolveCodexNativeSandboxBlock(params) {
+	if (params.sandboxEnvironmentSelected) return;
 	const sessionKey = params.sessionKey?.trim() || params.sessionId?.trim();
 	if (!sessionKey) return;
+	if (isCodexRemoteExecPlacementSandbox(params.sandbox) || params.sandbox?.enabled === true) return formatCodexNativeSandboxBlock({ surface: params.surface });
 	if (!resolveSandboxRuntimeStatus({
 		cfg: params.config,
 		sessionKey