@openclaw/codex 2026.8.1-beta.2 → 2026.8.1

package/dist/{runtime-artifact-BVSPdd6g.js → runtime-artifact-DeBvleJw.js}

@@ -1,9 +1,10 @@
-import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-DIImwDVS.js";
+import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-C7-s9TLG.js";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { createHash } from "node:crypto";
 import { constants } from "node:fs";
 import { resolveWindowsExecutablePath, resolveWindowsSpawnProgram } from "openclaw/plugin-sdk/windows-spawn";
+import { isPathInside } from "openclaw/plugin-sdk/file-access-runtime";
 //#region extensions/codex/src/app-server/runtime-artifact.ts
 /** Exact local runtime artifact identity for verified Codex setup turns. */
 const ARTIFACT_ID_PREFIX = "codex-app-server:v1:";
@@ -123,10 +124,6 @@ async function listPackageFiles(params) {
 	await visit(params.rootPath, 0);
 	return files;
 }
-function pathIsWithin(rootPath, candidatePath) {
-	const relative = path.relative(rootPath, candidatePath);
-	return relative === "" || !path.isAbsolute(relative) && !relative.startsWith(`..${path.sep}`) && relative !== "..";
-}
 function assertSafeNodeOptions(env) {
 	for (const [rawKey, value] of Object.entries(env)) {
 		if (rawKey.toUpperCase() !== "NODE_OPTIONS" || !value?.trim()) continue;
@@ -223,7 +220,7 @@ async function hashSelectedArtifactFiles(descriptor, signal) {
 	} catch (error) {
 		if (!isMissingPathError(error)) throw error;
 	}
-	const externalFiles = [...new Set(allFiles)].filter((filePath) => !packageRoot || !pathIsWithin(packageRoot, filePath)).toSorted(compareArtifactNames);
+	const externalFiles = [...new Set(allFiles)].filter((filePath) => !packageRoot || !isPathInside(packageRoot, filePath)).toSorted(compareArtifactNames);
 	const budget = {
 		fileCount: 0,
 		totalBytes: 0n
@@ -337,7 +334,7 @@ async function resolvePackageRoot(nativePath) {
 	try {
 		if (!(await fs.lstat(metadataPath)).isFile()) return;
 		const root = await fs.realpath(candidate);
-		return pathIsWithin(root, nativePath) ? root : void 0;
+		return isPathInside(root, nativePath) ? root : void 0;
 	} catch {
 		return;
 	}