@openclaw/codex 2026.8.1-beta.2 → 2026.8.1-beta.3

package/dist/{runtime-artifact-BVSPdd6g.js → runtime-artifact-BvyT1uyd.js}

@@ -1,9 +1,10 @@
-import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-DIImwDVS.js";
+import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-DhoGy33Z.js";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { createHash } from "node:crypto";
 import { constants } from "node:fs";
 import { resolveWindowsExecutablePath, resolveWindowsSpawnProgram } from "openclaw/plugin-sdk/windows-spawn";
+import { isPathInside } from "openclaw/plugin-sdk/file-access-runtime";
 //#region extensions/codex/src/app-server/runtime-artifact.ts
 /** Exact local runtime artifact identity for verified Codex setup turns. */
 const ARTIFACT_ID_PREFIX = "codex-app-server:v1:";
@@ -123,10 +124,6 @@ async function listPackageFiles(params) {
 	await visit(params.rootPath, 0);
 	return files;
 }
-function pathIsWithin(rootPath, candidatePath) {
-	const relative = path.relative(rootPath, candidatePath);
-	return relative === "" || !path.isAbsolute(relative) && !relative.startsWith(`..${path.sep}`) && relative !== "..";
-}
 function assertSafeNodeOptions(env) {
 	for (const [rawKey, value] of Object.entries(env)) {
 		if (rawKey.toUpperCase() !== "NODE_OPTIONS" || !value?.trim()) continue;
@@ -223,7 +220,7 @@ async function hashSelectedArtifactFiles(descriptor, signal) {
 	} catch (error) {
 		if (!isMissingPathError(error)) throw error;
 	}
-	const externalFiles = [...new Set(allFiles)].filter((filePath) => !packageRoot || !pathIsWithin(packageRoot, filePath)).toSorted(compareArtifactNames);
+	const externalFiles = [...new Set(allFiles)].filter((filePath) => !packageRoot || !isPathInside(packageRoot, filePath)).toSorted(compareArtifactNames);
 	const budget = {
 		fileCount: 0,
 		totalBytes: 0n
@@ -337,7 +334,7 @@ async function resolvePackageRoot(nativePath) {
 	try {
 		if (!(await fs.lstat(metadataPath)).isFile()) return;
 		const root = await fs.realpath(candidate);
-		return pathIsWithin(root, nativePath) ? root : void 0;
+		return isPathInside(root, nativePath) ? root : void 0;
 	} catch {
 		return;
 	}

package/dist/{sandbox-guard-Cmwc9eIk.js → sandbox-guard-C1qEeZ5C.js}

@@ -1,6 +1,7 @@
-import { C as isCodexRemoteExecPlacementSandbox } from "./session-binding-DPxIvMgE.js";
-import { normalizeAgentId } from "openclaw/plugin-sdk/routing";
+import { p as isCodexRemoteExecPlacementSandbox } from "./config-CpNeo5AE.js";
+import { resolveAgentConfig, tryResolveDefaultAgentId } from "openclaw/plugin-sdk/agent-scope-runtime";
 import { getSessionEntry } from "openclaw/plugin-sdk/session-store-runtime";
+import { normalizeAgentId, parseAgentSessionKey } from "openclaw/plugin-sdk/routing";
 import { resolveSandboxRuntimeStatus } from "openclaw/plugin-sdk/sandbox";
 //#region extensions/codex/src/app-server/native-execution-policy.ts
 /** Projects node execution ownership into the runtime tool factory options. */
@@ -21,23 +22,26 @@ function resolveCodexNativeExecutionPolicy(params) {
 		sessionKey,
 		agentId: params.agentId
 	});
-	const canReadSessionEntry = params.readRuntimeSessionEntry && shouldReadRuntimeSessionEntry({
+	const canReadSessionEntry = Boolean(agentId) && params.readRuntimeSessionEntry && shouldReadRuntimeSessionEntry({
 		config,
 		sessionKey,
-		agentId: params.agentId
+		agentId
 	});
-	const sessionEntry = params.sessionEntry ?? (canReadSessionEntry && sessionKey ? readRuntimeSessionEntryBestEffort({
+	const sessionEntry = params.sessionEntry ?? (canReadSessionEntry && sessionKey && agentId ? readRuntimeSessionEntryBestEffort({
 		sessionKey,
 		agentId
 	}) : void 0);
-	const sandboxAvailable = params.sandboxAvailable ?? (sessionKey ? resolveSandboxRuntimeStatus({
+	const sandboxAgentId = parseAgentSessionKey(sessionKey)?.agentId ?? agentId;
+	const sandboxAvailable = params.sandboxAvailable ?? (sessionKey && sandboxAgentId ? resolveSandboxRuntimeStatus({
 		cfg: config,
-		sessionKey
+		sessionKey,
+		agentId: sandboxAgentId,
+		classificationAgentId: sandboxAgentId
 	}).sandboxed : false);
-	const agentExec = resolvePolicyAgentExec({
+	const agentExec = agentId ? resolvePolicyAgentExec({
 		config,
 		agentId
-	});
+	}) : void 0;
 	const globalExec = config.tools?.exec;
 	const requestedExecHost = normalizeExecTarget(params.execOverrides?.host) ?? normalizeExecTarget(sessionEntry?.execHost) ?? normalizeExecTarget(agentExec?.host) ?? normalizeExecTarget(globalExec?.host) ?? "auto";
 	const effectiveExecHost = resolveEffectiveExecHost({
@@ -72,13 +76,10 @@ function resolvePolicyAgentId(params) {
 	if (explicitAgentId) return explicitAgentId;
 	const sessionAgentId = parseAgentIdFromSessionKey(params.sessionKey);
 	if (sessionAgentId) return sessionAgentId;
-	return resolveDefaultPolicyAgentId(listAgentEntries(params.config));
+	return tryResolveDefaultAgentId(params.config);
 }
 function resolvePolicyAgentExec(params) {
-	return listAgentEntries(params.config).find((entry) => normalizeAgentId(entry?.id) === params.agentId)?.tools?.exec;
-}
-function listAgentEntries(config) {
-	return (config.agents?.list ?? []).filter((entry) => entry !== null && typeof entry === "object");
+	return resolveAgentConfig(params.config, params.agentId)?.tools?.exec;
 }
 function parseAgentIdFromSessionKey(sessionKey) {
 	const raw = sessionKey?.trim();
@@ -99,10 +100,7 @@ function shouldReadRuntimeSessionEntry(params) {
 	return sessionAgentId === explicitAgentId;
 }
 function isDefaultAgentSessionKeyForAgent(params) {
-	return normalizeAgentId(params.agentId) === resolveDefaultPolicyAgentId(listAgentEntries(params.config));
-}
-function resolveDefaultPolicyAgentId(agents) {
-	return normalizeAgentId((agents.find((entry) => entry?.default) ?? agents[0])?.id);
+	return normalizeAgentId(params.agentId) === tryResolveDefaultAgentId(params.config);
 }
 function normalizeAgentIdOrDefault(value) {
 	const normalized = normalizeAgentId(value);
@@ -129,6 +127,10 @@ function readRuntimeSessionEntryBestEffort(params) {
 }
 //#endregion
 //#region extensions/codex/src/app-server/sandbox-guard.ts
+/**
+* Blocks direct Codex app-server requests that would bypass OpenClaw sandbox or
+* node-exec routing guarantees.
+*/
 const DIRECT_METHOD_POLICIES = /* @__PURE__ */ new Map([
 	["account/rateLimits/read", "allowed-control-plane"],
 	["account/read", "allowed-control-plane"],
@@ -230,9 +232,13 @@ function resolveCodexNativeSandboxBlock(params) {
 	const sessionKey = params.sessionKey?.trim() || params.sessionId?.trim();
 	if (!sessionKey) return;
 	if (isCodexRemoteExecPlacementSandbox(params.sandbox) || params.sandbox?.enabled === true) return formatCodexNativeSandboxBlock({ surface: params.surface });
+	const sandboxAgentId = parseAgentSessionKey(sessionKey)?.agentId ?? params.agentId ?? tryResolveDefaultAgentId(params.config ?? {});
+	if (!sandboxAgentId) return;
 	if (!resolveSandboxRuntimeStatus({
 		cfg: params.config,
-		sessionKey
+		sessionKey,
+		agentId: sandboxAgentId,
+		classificationAgentId: sandboxAgentId
 	}).sandboxed) return;
 	return formatCodexNativeSandboxBlock({ surface: params.surface });
 }