@openclaw/codex 2026.7.2-beta.7 → 2026.8.1-beta.3

package/dist/{runtime-artifact-CmtG_t1L.js → runtime-artifact-BvyT1uyd.js}

@@ -1,9 +1,10 @@
-import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-DXgGZ7Ib.js";
+import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-DhoGy33Z.js";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { createHash } from "node:crypto";
 import { constants } from "node:fs";
 import { resolveWindowsExecutablePath, resolveWindowsSpawnProgram } from "openclaw/plugin-sdk/windows-spawn";
+import { isPathInside } from "openclaw/plugin-sdk/file-access-runtime";
 //#region extensions/codex/src/app-server/runtime-artifact.ts
 /** Exact local runtime artifact identity for verified Codex setup turns. */
 const ARTIFACT_ID_PREFIX = "codex-app-server:v1:";
@@ -17,17 +18,6 @@ const MAX_ARTIFACT_FILES = 8192;
 const MAX_ARTIFACT_TOTAL_BYTES = 1024n * 1024n * 1024n;
 const READ_CHUNK_BYTES = 64 * 1024;
 const CODE_MODE_HOST_PATH_ENV = "CODEX_CODE_MODE_HOST_PATH";
-const RUNTIME_INJECTION_ENV_KEYS = /* @__PURE__ */ new Set([
-	"NODE_PATH",
-	"LD_AUDIT",
-	"LD_LIBRARY_PATH",
-	"LD_PRELOAD",
-	"DYLD_FALLBACK_FRAMEWORK_PATH",
-	"DYLD_FALLBACK_LIBRARY_PATH",
-	"DYLD_FRAMEWORK_PATH",
-	"DYLD_INSERT_LIBRARIES",
-	"DYLD_LIBRARY_PATH"
-]);
 const SAFE_NODE_OPTIONS_BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
 	"--enable-network-family-autoselection",
 	"--network-family-autoselection",
@@ -134,21 +124,13 @@ async function listPackageFiles(params) {
 	await visit(params.rootPath, 0);
 	return files;
 }
-function pathIsWithin(rootPath, candidatePath) {
-	const relative = path.relative(rootPath, candidatePath);
-	return relative === "" || !path.isAbsolute(relative) && !relative.startsWith(`..${path.sep}`) && relative !== "..";
-}
-function assertNoRuntimeInjectionEnvironment(env) {
+function assertSafeNodeOptions(env) {
 	for (const [rawKey, value] of Object.entries(env)) {
-		const key = rawKey.toUpperCase();
-		if (!value?.trim()) continue;
-		if (key === "NODE_OPTIONS") {
-			const result = attestNodeOptions(value);
-			if (result.ok) continue;
-			if (result.option) throw new Error(`Codex runtime artifact cannot attest NODE_OPTIONS option ${result.option}`);
-			throw new Error("Codex runtime artifact cannot safely parse NODE_OPTIONS");
-		}
-		if (RUNTIME_INJECTION_ENV_KEYS.has(key) || key.startsWith("DYLD_")) throw new Error(`Codex runtime artifact cannot attest injected runtime environment: ${key}`);
+		if (rawKey.toUpperCase() !== "NODE_OPTIONS" || !value?.trim()) continue;
+		const result = attestNodeOptions(value);
+		if (result.ok) continue;
+		if (result.option) throw new Error(`Codex runtime artifact cannot attest NODE_OPTIONS option ${result.option}`);
+		throw new Error("Codex runtime artifact cannot safely parse NODE_OPTIONS");
 	}
 }
 function parseNodeOptions(value) {
@@ -238,7 +220,7 @@ async function hashSelectedArtifactFiles(descriptor, signal) {
 	} catch (error) {
 		if (!isMissingPathError(error)) throw error;
 	}
-	const externalFiles = [...new Set(allFiles)].filter((filePath) => !packageRoot || !pathIsWithin(packageRoot, filePath)).toSorted(compareArtifactNames);
+	const externalFiles = [...new Set(allFiles)].filter((filePath) => !packageRoot || !isPathInside(packageRoot, filePath)).toSorted(compareArtifactNames);
 	const budget = {
 		fileCount: 0,
 		totalBytes: 0n
@@ -352,7 +334,7 @@ async function resolvePackageRoot(nativePath) {
 	try {
 		if (!(await fs.lstat(metadataPath)).isFile()) return;
 		const root = await fs.realpath(candidate);
-		return pathIsWithin(root, nativePath) ? root : void 0;
+		return isPathInside(root, nativePath) ? root : void 0;
 	} catch {
 		return;
 	}
@@ -377,7 +359,7 @@ async function captureFilesystemDescriptor(params) {
 	throwIfAborted(params.signal);
 	if (params.startOptions.transport !== "stdio") throw new Error("Verified Codex inference requires a local stdio runtime artifact; WebSocket attestation is unsupported");
 	const env = resolveCodexAppServerSpawnEnv(params.startOptions);
-	assertNoRuntimeInjectionEnvironment(env);
+	assertSafeNodeOptions(env);
 	const spawnCwd = path.resolve(params.startOptions.cwd ?? process.cwd());
 	const commandPath = await resolveCommandPath(params.startOptions.command, env, spawnCwd);
 	const commandRealPath = await fs.realpath(commandPath);

package/dist/{sandbox-guard-NuhpXmPB.js → sandbox-guard-C1qEeZ5C.js}

@@ -1,11 +1,9 @@
+import { p as isCodexRemoteExecPlacementSandbox } from "./config-CpNeo5AE.js";
+import { resolveAgentConfig, tryResolveDefaultAgentId } from "openclaw/plugin-sdk/agent-scope-runtime";
 import { getSessionEntry } from "openclaw/plugin-sdk/session-store-runtime";
+import { normalizeAgentId, parseAgentSessionKey } from "openclaw/plugin-sdk/routing";
 import { resolveSandboxRuntimeStatus } from "openclaw/plugin-sdk/sandbox";
 //#region extensions/codex/src/app-server/native-execution-policy.ts
-const DEFAULT_AGENT_ID = "main";
-const VALID_AGENT_ID_PATTERN = /^[a-z0-9][a-z0-9_-]{0,63}$/i;
-const INVALID_AGENT_ID_CHARS_PATTERN = /[^a-z0-9_-]+/g;
-const LEADING_DASH_PATTERN = /^-+/;
-const TRAILING_DASH_PATTERN = /-+$/;
 /** Projects node execution ownership into the runtime tool factory options. */
 function resolveCodexNodeExecToolOverrides(policy) {
 	if (policy.effectiveExecHost !== "node") return;
@@ -24,23 +22,26 @@ function resolveCodexNativeExecutionPolicy(params) {
 		sessionKey,
 		agentId: params.agentId
 	});
-	const canReadSessionEntry = params.readRuntimeSessionEntry && shouldReadRuntimeSessionEntry({
+	const canReadSessionEntry = Boolean(agentId) && params.readRuntimeSessionEntry && shouldReadRuntimeSessionEntry({
 		config,
 		sessionKey,
-		agentId: params.agentId
+		agentId
 	});
-	const sessionEntry = params.sessionEntry ?? (canReadSessionEntry && sessionKey ? readRuntimeSessionEntryBestEffort({
+	const sessionEntry = params.sessionEntry ?? (canReadSessionEntry && sessionKey && agentId ? readRuntimeSessionEntryBestEffort({
 		sessionKey,
 		agentId
 	}) : void 0);
-	const sandboxAvailable = params.sandboxAvailable ?? (sessionKey ? resolveSandboxRuntimeStatus({
+	const sandboxAgentId = parseAgentSessionKey(sessionKey)?.agentId ?? agentId;
+	const sandboxAvailable = params.sandboxAvailable ?? (sessionKey && sandboxAgentId ? resolveSandboxRuntimeStatus({
 		cfg: config,
-		sessionKey
+		sessionKey,
+		agentId: sandboxAgentId,
+		classificationAgentId: sandboxAgentId
 	}).sandboxed : false);
-	const agentExec = resolvePolicyAgentExec({
+	const agentExec = agentId ? resolvePolicyAgentExec({
 		config,
 		agentId
-	});
+	}) : void 0;
 	const globalExec = config.tools?.exec;
 	const requestedExecHost = normalizeExecTarget(params.execOverrides?.host) ?? normalizeExecTarget(sessionEntry?.execHost) ?? normalizeExecTarget(agentExec?.host) ?? normalizeExecTarget(globalExec?.host) ?? "auto";
 	const effectiveExecHost = resolveEffectiveExecHost({
@@ -75,13 +76,10 @@ function resolvePolicyAgentId(params) {
 	if (explicitAgentId) return explicitAgentId;
 	const sessionAgentId = parseAgentIdFromSessionKey(params.sessionKey);
 	if (sessionAgentId) return sessionAgentId;
-	return resolveDefaultPolicyAgentId(listAgentEntries(params.config));
+	return tryResolveDefaultAgentId(params.config);
 }
 function resolvePolicyAgentExec(params) {
-	return listAgentEntries(params.config).find((entry) => normalizeAgentId(entry?.id) === params.agentId)?.tools?.exec;
-}
-function listAgentEntries(config) {
-	return (config.agents?.list ?? []).filter((entry) => entry !== null && typeof entry === "object");
+	return resolveAgentConfig(params.config, params.agentId)?.tools?.exec;
 }
 function parseAgentIdFromSessionKey(sessionKey) {
 	const raw = sessionKey?.trim();
@@ -102,21 +100,11 @@ function shouldReadRuntimeSessionEntry(params) {
 	return sessionAgentId === explicitAgentId;
 }
 function isDefaultAgentSessionKeyForAgent(params) {
-	return normalizeAgentId(params.agentId) === resolveDefaultPolicyAgentId(listAgentEntries(params.config));
-}
-function resolveDefaultPolicyAgentId(agents) {
-	return normalizeAgentId((agents.find((entry) => entry?.default) ?? agents[0])?.id);
+	return normalizeAgentId(params.agentId) === tryResolveDefaultAgentId(params.config);
 }
 function normalizeAgentIdOrDefault(value) {
 	const normalized = normalizeAgentId(value);
-	return normalized === DEFAULT_AGENT_ID && !(value ?? "").trim() ? void 0 : normalized;
-}
-function normalizeAgentId(value) {
-	const trimmed = (value ?? "").trim();
-	if (!trimmed) return DEFAULT_AGENT_ID;
-	const normalized = trimmed.toLowerCase();
-	if (VALID_AGENT_ID_PATTERN.test(trimmed)) return normalized;
-	return normalized.replace(INVALID_AGENT_ID_CHARS_PATTERN, "-").replace(LEADING_DASH_PATTERN, "").replace(TRAILING_DASH_PATTERN, "").slice(0, 64) || DEFAULT_AGENT_ID;
+	return normalized === "main" && !(value ?? "").trim() ? void 0 : normalized;
 }
 function normalizeExecTarget(value) {
 	const normalized = value?.trim().toLowerCase();
@@ -139,6 +127,10 @@ function readRuntimeSessionEntryBestEffort(params) {
 }
 //#endregion
 //#region extensions/codex/src/app-server/sandbox-guard.ts
+/**
+* Blocks direct Codex app-server requests that would bypass OpenClaw sandbox or
+* node-exec routing guarantees.
+*/
 const DIRECT_METHOD_POLICIES = /* @__PURE__ */ new Map([
 	["account/rateLimits/read", "allowed-control-plane"],
 	["account/read", "allowed-control-plane"],
@@ -223,6 +215,7 @@ function resolveCodexAppServerDirectSandboxBypassBlock(params) {
 	const sandboxBlock = resolveCodexNativeSandboxBlock({
 		config: params.config,
 		sessionKey,
+		sandbox: params.sandbox,
 		surface: `app-server method \`${params.method}\``
 	});
 	if (!sandboxBlock) return;
@@ -235,11 +228,17 @@ function resolveCodexNativeExecutionBlock(params) {
 }
 /** Returns a block message when native Codex execution cannot honor active sandboxing. */
 function resolveCodexNativeSandboxBlock(params) {
+	if (params.sandboxEnvironmentSelected) return;
 	const sessionKey = params.sessionKey?.trim() || params.sessionId?.trim();
 	if (!sessionKey) return;
+	if (isCodexRemoteExecPlacementSandbox(params.sandbox) || params.sandbox?.enabled === true) return formatCodexNativeSandboxBlock({ surface: params.surface });
+	const sandboxAgentId = parseAgentSessionKey(sessionKey)?.agentId ?? params.agentId ?? tryResolveDefaultAgentId(params.config ?? {});
+	if (!sandboxAgentId) return;
 	if (!resolveSandboxRuntimeStatus({
 		cfg: params.config,
-		sessionKey
+		sessionKey,
+		agentId: sandboxAgentId,
+		classificationAgentId: sandboxAgentId
 	}).sandboxed) return;
 	return formatCodexNativeSandboxBlock({ surface: params.surface });
 }