@openclaw/codex 2026.9.1 → 2026.9.3

package/dist/{runtime-artifact-C3jVimFn.js → runtime-artifact-T-NwqeSH.js}

@@ -1,11 +1,11 @@
-import { i as resolvePackagedCodexNativeCommand } from "./managed-binary-4-Vjz5GH.js";
-import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-CyPldczm.js";
-import fs from "node:fs/promises";
-import path from "node:path";
-import { isPathInside } from "openclaw/plugin-sdk/file-access-runtime";
+import { i as resolvePackagedCodexNativeCommand } from "./managed-binary-DrjjRRUD.js";
+import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-BGjHoYLr.js";
 import { createHash } from "node:crypto";
-import { constants } from "node:fs";
 import { resolveWindowsExecutablePath, resolveWindowsSpawnProgram } from "openclaw/plugin-sdk/windows-spawn";
+import { constants } from "node:fs";
+import path from "node:path";
+import fs$1 from "node:fs/promises";
+import { isPathInside } from "openclaw/plugin-sdk/file-access-runtime";
 //#region extensions/codex/src/app-server/runtime-artifact.ts
 /** Exact local runtime artifact identity for verified Codex setup turns. */
 const ARTIFACT_ID_PREFIX = "codex-app-server:v1:";
@@ -66,9 +66,9 @@ function sameOpenedFile(left, right) {
 }
 async function readRegularFileFingerprint(params) {
 	throwIfAborted(params.signal);
-	if (!(await fs.lstat(params.filePath, { bigint: true })).isFile()) throw new Error(`Codex runtime artifact contains a non-regular file: ${params.filePath}`);
+	if (!(await fs$1.lstat(params.filePath, { bigint: true })).isFile()) throw new Error(`Codex runtime artifact contains a non-regular file: ${params.filePath}`);
 	const flags = constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0);
-	const handle = await fs.open(params.filePath, flags);
+	const handle = await fs$1.open(params.filePath, flags);
 	try {
 		const before = await handle.stat({ bigint: true });
 		if (!before.isFile()) throw new Error(`Codex runtime artifact contains a non-regular file: ${params.filePath}`);
@@ -86,7 +86,7 @@ async function readRegularFileFingerprint(params) {
 			offset += BigInt(bytesRead);
 		}
 		const after = await handle.stat({ bigint: true });
-		const current = await fs.stat(params.filePath, { bigint: true });
+		const current = await fs$1.stat(params.filePath, { bigint: true });
 		if (!sameOpenedFile(before, after) || !sameOpenedFile(after, current)) throw new Error(`Codex runtime artifact changed while reading: ${params.filePath}`);
 		params.budget.fileCount += 1;
 		params.budget.totalBytes += after.size;
@@ -105,7 +105,7 @@ async function listPackageFiles(params) {
 	const visit = async (directory, depth) => {
 		throwIfAborted(params.signal);
 		if (depth > MAX_ARTIFACT_DEPTH) throw new Error("Codex runtime artifact exceeds the bounded directory depth");
-		const entries = await fs.readdir(directory, {
+		const entries = await fs$1.readdir(directory, {
 			withFileTypes: true,
 			encoding: "utf8"
 		});
@@ -202,21 +202,21 @@ function attestNodeOptions(value) {
 }
 async function hashSelectedArtifactFiles(descriptor, signal) {
 	throwIfAborted(signal);
-	if (await fs.realpath(descriptor.commandPath) !== descriptor.commandRealPath) throw new Error("Codex runtime launcher selection changed");
+	if (await fs$1.realpath(descriptor.commandPath) !== descriptor.commandRealPath) throw new Error("Codex runtime launcher selection changed");
 	const packageRoot = descriptor.packageRoot;
 	if (await resolvePackageRoot(descriptor.nativePath) !== packageRoot) throw new Error("Codex runtime package selection changed");
-	if (packageRoot && await fs.realpath(packageRoot) !== packageRoot) throw new Error("Codex runtime package root changed");
+	if (packageRoot && await fs$1.realpath(packageRoot) !== packageRoot) throw new Error("Codex runtime package root changed");
 	const allFiles = [
 		descriptor.commandRealPath,
 		...descriptor.invocationPaths,
 		descriptor.nativePath,
 		...descriptor.codeModeHostPath ? [descriptor.codeModeHostPath] : []
 	];
-	for (const filePath of allFiles) if (await fs.realpath(filePath) !== filePath) throw new Error(`Codex runtime artifact file selection changed: ${filePath}`);
+	for (const filePath of allFiles) if (await fs$1.realpath(filePath) !== filePath) throw new Error(`Codex runtime artifact file selection changed: ${filePath}`);
 	if (descriptor.codeModeHostPath) {
-		if (await fs.realpath(descriptor.codeModeHostCandidatePath) !== descriptor.codeModeHostPath) throw new Error("Codex code-mode host selection changed");
+		if (await fs$1.realpath(descriptor.codeModeHostCandidatePath) !== descriptor.codeModeHostPath) throw new Error("Codex code-mode host selection changed");
 	} else try {
-		await fs.lstat(descriptor.codeModeHostCandidatePath);
+		await fs$1.lstat(descriptor.codeModeHostCandidatePath);
 		throw new Error("Codex code-mode host selection changed");
 	} catch (error) {
 		if (!isMissingPathError(error)) throw error;
@@ -283,7 +283,7 @@ async function resolveCommandPath(command, env, cwd) {
 			const entryPath = entry === "" ? cwd : path.isAbsolute(entry) ? entry : path.resolve(cwd, entry);
 			const possible = path.join(entryPath, command);
 			try {
-				await fs.access(possible, constants.X_OK);
+				await fs$1.access(possible, constants.X_OK);
 				candidate = possible;
 				break;
 			} catch {}
@@ -291,11 +291,11 @@ async function resolveCommandPath(command, env, cwd) {
 	}
 	if (!candidate) throw new Error(`Codex runtime launcher is unavailable: ${command}`);
 	const absolute = path.resolve(candidate);
-	if (!(await fs.stat(absolute)).isFile()) throw new Error(`Codex runtime launcher is not a regular file: ${absolute}`);
+	if (!(await fs$1.stat(absolute)).isFile()) throw new Error(`Codex runtime launcher is not a regular file: ${absolute}`);
 	return absolute;
 }
 async function readShebang(filePath) {
-	const handle = await fs.open(filePath, "r");
+	const handle = await fs$1.open(filePath, "r");
 	try {
 		const buffer = Buffer.alloc(4096);
 		const { bytesRead } = await handle.read(buffer, 0, buffer.length, 0);
@@ -314,7 +314,7 @@ async function resolvePosixInvocationPaths(params) {
 	if (!shebang) return paths;
 	if (!params.nativeCommand) throw new Error("Codex runtime cannot attest a custom script launcher without its native target");
 	const interpreter = await resolveCommandPath(shebang[0], params.env, params.cwd);
-	paths.push(await fs.realpath(interpreter));
+	paths.push(await fs$1.realpath(interpreter));
 	if (path.basename(interpreter) !== "env") {
 		if (shebang.length !== 1) throw new Error("Codex runtime launcher uses unsupported interpreter arguments");
 		return paths;
@@ -324,7 +324,7 @@ async function resolvePosixInvocationPaths(params) {
 	const target = envArgs[commandIndex];
 	if (!target || target.startsWith("-") || envArgs.length !== commandIndex + 1) throw new Error("Codex runtime launcher uses unsupported env arguments");
 	const targetPath = await resolveCommandPath(target, params.env, params.cwd);
-	paths.push(await fs.realpath(targetPath));
+	paths.push(await fs$1.realpath(targetPath));
 	return paths;
 }
 async function resolvePackageRoot(nativePath) {
@@ -333,8 +333,8 @@ async function resolvePackageRoot(nativePath) {
 	const candidate = path.dirname(binDir);
 	const metadataPath = path.join(candidate, "codex-package.json");
 	try {
-		if (!(await fs.lstat(metadataPath)).isFile()) return;
-		const root = await fs.realpath(candidate);
+		if (!(await fs$1.lstat(metadataPath)).isFile()) return;
+		const root = await fs$1.realpath(candidate);
 		return isPathInside(root, nativePath) ? root : void 0;
 	} catch {
 		return;
@@ -342,8 +342,8 @@ async function resolvePackageRoot(nativePath) {
 }
 async function resolveOptionalRegularFile(filePath) {
 	try {
-		const canonical = await fs.realpath(filePath);
-		return (await fs.stat(canonical)).isFile() ? canonical : void 0;
+		const canonical = await fs$1.realpath(filePath);
+		return (await fs$1.stat(canonical)).isFile() ? canonical : void 0;
 	} catch {
 		return;
 	}
@@ -363,7 +363,7 @@ async function captureFilesystemDescriptor(params) {
 	assertSafeNodeOptions(env);
 	const spawnCwd = path.resolve(params.startOptions.cwd ?? process.cwd());
 	const commandPath = await resolveCommandPath(params.startOptions.command, env, spawnCwd);
-	const commandRealPath = await fs.realpath(commandPath);
+	const commandRealPath = await fs$1.realpath(commandPath);
 	let nativeCommand = params.spawnIdentity.nativeCommand;
 	let nativeCandidate = commandRealPath;
 	let invocationPaths;
@@ -376,7 +376,7 @@ async function captureFilesystemDescriptor(params) {
 			packageName: "@openai/codex"
 		});
 		const entrypoint = program.leadingArgv[0];
-		if (program.resolution === "node-entrypoint" && entrypoint && !nativeCommand) nativeCommand = resolvePackagedCodexNativeCommand(await fs.realpath(entrypoint));
+		if (program.resolution === "node-entrypoint" && entrypoint && !nativeCommand) nativeCommand = resolvePackagedCodexNativeCommand(await fs$1.realpath(entrypoint));
 		if (program.resolution === "node-entrypoint" && !nativeCommand) throw new Error("Codex runtime cannot attest a custom Node launcher without its native target");
 		nativeCandidate = program.command;
 		const invocationCandidates = [
@@ -387,7 +387,7 @@ async function captureFilesystemDescriptor(params) {
 		invocationPaths = [];
 		for (const candidate of invocationCandidates) {
 			const resolved = await resolveCommandPath(candidate, env, spawnCwd);
-			invocationPaths.push(await fs.realpath(resolved));
+			invocationPaths.push(await fs$1.realpath(resolved));
 		}
 	} else {
 		nativeCommand ??= resolvePackagedCodexNativeCommand(commandRealPath);
@@ -400,7 +400,7 @@ async function captureFilesystemDescriptor(params) {
 	}
 	invocationPaths = [...new Set(invocationPaths)].toSorted(compareArtifactNames);
 	if (invocationPaths.length > MAX_ARTIFACT_INVOCATION_PATHS) throw new Error("Codex runtime launcher exceeds the bounded invocation file count");
-	const nativePath = await fs.realpath(await resolveCommandPath(nativeCommand ?? nativeCandidate, env, spawnCwd));
+	const nativePath = await fs$1.realpath(await resolveCommandPath(nativeCommand ?? nativeCandidate, env, spawnCwd));
 	const packageRoot = await resolvePackageRoot(nativePath);
 	const configuredCodeModeHost = readEffectiveSpawnEnvironmentValue(env, CODE_MODE_HOST_PATH_ENV)?.trim();
 	const adjacentCodeModeHost = path.join(path.dirname(nativePath), process.platform === "win32" ? "codex-code-mode-host.exe" : "codex-code-mode-host");

package/dist/sandbox-guard-BcT66fWy.js

@@ -0,0 +1,165 @@
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { y as isCodexRemoteExecPlacementSandbox } from "./protocol-CAAcVIKF.js";
+import { n as resolveCodexNativeExecutionPolicy, t as formatCodexNativeNodeExecBlock } from "./native-execution-policy-umd0tgh4.js";
+import { tryResolveDefaultAgentId } from "openclaw/plugin-sdk/agent-scope-runtime";
+import { parseAgentSessionKey } from "openclaw/plugin-sdk/routing";
+import { resolveSandboxRuntimeStatus } from "openclaw/plugin-sdk/sandbox";
+//#region extensions/codex/src/app-server/sandbox-guard.ts
+/**
+* Blocks direct Codex app-server requests that would bypass OpenClaw sandbox or
+* node-exec routing guarantees.
+*/
+var sandbox_guard_exports = /* @__PURE__ */ __exportAll({
+	resolveCodexAppServerDirectSandboxBypassBlock: () => resolveCodexAppServerDirectSandboxBypassBlock,
+	resolveCodexNativeExecutionBlock: () => resolveCodexNativeExecutionBlock,
+	resolveCodexNativeSandboxBlock: () => resolveCodexNativeSandboxBlock
+});
+const DIRECT_METHOD_POLICIES = /* @__PURE__ */ new Map([
+	["account/rateLimits/read", "allowed-control-plane"],
+	["account/read", "allowed-control-plane"],
+	["app/installed", "allowed-control-plane"],
+	["app/list", "allowed-control-plane"],
+	["app/read", "allowed-control-plane"],
+	["config/batchWrite", "allowed-control-plane"],
+	["config/mcpServer/reload", "allowed-control-plane"],
+	["config/read", "allowed-control-plane"],
+	["config/value/write", "allowed-control-plane"],
+	["environment/add", "allowed-control-plane"],
+	["experimentalFeature/enablement/set", "allowed-control-plane"],
+	["feedback/upload", "allowed-control-plane"],
+	["hooks/list", "allowed-control-plane"],
+	["initialize", "allowed-control-plane"],
+	["marketplace/add", "allowed-control-plane"],
+	["mcpServerStatus/list", "allowed-control-plane"],
+	["model/list", "allowed-control-plane"],
+	["plugin/install", "allowed-control-plane"],
+	["plugin/installed", "allowed-control-plane"],
+	["plugin/list", "allowed-control-plane"],
+	["plugin/read", "allowed-control-plane"],
+	["skills/list", "allowed-control-plane"],
+	["thread/archive", "allowed-control-plane"],
+	["thread/inject_items", "allowed-control-plane"],
+	["thread/list", "allowed-control-plane"],
+	["thread/metadata/update", "allowed-control-plane"],
+	["thread/name/set", "allowed-control-plane"],
+	["thread/read", "allowed-control-plane"],
+	["thread/rollback", "allowed-control-plane"],
+	["thread/start", "requires-openclaw-environment"],
+	["thread/unarchive", "allowed-control-plane"],
+	["thread/unsubscribe", "allowed-control-plane"],
+	["turn/interrupt", "allowed-control-plane"],
+	["turn/steer", "allowed-control-plane"],
+	["command/exec", "blocked-native-bypass"],
+	["command/resize", "blocked-native-bypass"],
+	["command/terminate", "blocked-native-bypass"],
+	["command/write", "blocked-native-bypass"],
+	["fuzzyFileSearch", "blocked-native-bypass"],
+	["mcpServer/resource/read", "blocked-native-bypass"],
+	["mcpServer/tool/call", "blocked-native-bypass"],
+	["process/kill", "blocked-native-bypass"],
+	["process/resizePty", "blocked-native-bypass"],
+	["process/spawn", "blocked-native-bypass"],
+	["process/writeStdin", "blocked-native-bypass"],
+	["review/start", "blocked-native-bypass"],
+	["thread/compact/start", "blocked-native-bypass"],
+	["thread/fork", "blocked-native-bypass"],
+	["thread/resume", "blocked-native-bypass"],
+	["thread/shellCommand", "blocked-native-bypass"],
+	["turn/start", "blocked-native-bypass"]
+]);
+const BLOCKED_DIRECT_METHOD_PREFIXES = [
+	"command/",
+	"fs/",
+	"windowsSandbox/"
+];
+const NODE_EXEC_BLOCKED_CONTROL_PLANE_METHODS = /* @__PURE__ */ new Set(["config/mcpServer/reload"]);
+/** Returns a block message when a direct app-server method would bypass OpenClaw execution policy. */
+function resolveCodexAppServerDirectSandboxBypassBlock(params) {
+	const policy = resolveDirectMethodPolicy(params.method);
+	if (NODE_EXEC_BLOCKED_CONTROL_PLANE_METHODS.has(params.method)) {
+		const nodeExecBlock = resolveCodexNativeNodeExecBlock({
+			config: params.config,
+			sessionKey: params.sessionKey,
+			sessionId: params.sessionId,
+			surface: `app-server method \`${params.method}\``
+		});
+		if (nodeExecBlock) return nodeExecBlock;
+	}
+	if (policy === "allowed-control-plane") return;
+	const nodeExecBlock = resolveCodexNativeNodeExecBlock({
+		config: params.config,
+		sessionKey: params.sessionKey,
+		sessionId: params.sessionId,
+		surface: `app-server method \`${params.method}\``
+	});
+	if (nodeExecBlock) return nodeExecBlock;
+	const sessionKey = params.sessionKey?.trim() || params.sessionId?.trim();
+	if (!sessionKey) return;
+	const sandboxBlock = resolveCodexNativeSandboxBlock({
+		config: params.config,
+		sessionKey,
+		sandbox: params.sandbox,
+		surface: `app-server method \`${params.method}\``
+	});
+	if (!sandboxBlock) return;
+	if (policy === "requires-openclaw-environment" && hasOpenClawSandboxEnvironmentSelection(params.requestParams)) return;
+	return sandboxBlock;
+}
+/** Resolves the generic native-execution block for sandboxed or node-hosted sessions. */
+function resolveCodexNativeExecutionBlock(params) {
+	return resolveCodexNativeSandboxBlock(params) ?? resolveCodexNativeNodeExecBlock(params);
+}
+/** Returns a block message when native Codex execution cannot honor active sandboxing. */
+function resolveCodexNativeSandboxBlock(params) {
+	if (params.sandboxEnvironmentSelected) return;
+	const sessionKey = params.sessionKey?.trim() || params.sessionId?.trim();
+	if (!sessionKey) return;
+	if (isCodexRemoteExecPlacementSandbox(params.sandbox) || params.sandbox?.enabled === true) return formatCodexNativeSandboxBlock({ surface: params.surface });
+	const sandboxAgentId = parseAgentSessionKey(sessionKey)?.agentId ?? params.agentId ?? tryResolveDefaultAgentId(params.config ?? {});
+	if (!sandboxAgentId) return;
+	if (!resolveSandboxRuntimeStatus({
+		cfg: params.config,
+		sessionKey,
+		agentId: sandboxAgentId,
+		classificationAgentId: sandboxAgentId
+	}).sandboxed) return;
+	return formatCodexNativeSandboxBlock({ surface: params.surface });
+}
+function resolveDirectMethodPolicy(method) {
+	const exact = DIRECT_METHOD_POLICIES.get(method);
+	if (exact) return exact;
+	if (BLOCKED_DIRECT_METHOD_PREFIXES.some((prefix) => method.startsWith(prefix))) return "blocked-native-bypass";
+	return "blocked-native-bypass";
+}
+function hasOpenClawSandboxEnvironmentSelection(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+	const environments = value.environments;
+	return Array.isArray(environments) && environments.length > 0 && environments.every((entry) => {
+		if (!entry || typeof entry !== "object" || Array.isArray(entry)) return false;
+		const environment = entry;
+		return typeof environment.environmentId === "string" && environment.environmentId.startsWith("openclaw-sandbox-") && typeof environment.cwd === "string" && environment.cwd.trim().length > 0;
+	});
+}
+function formatCodexNativeSandboxBlock(params) {
+	return [
+		`Codex-native ${params.surface} is unavailable because OpenClaw sandboxing is active for this session.`,
+		"This mode cannot route execution through the OpenClaw sandbox backend.",
+		"Use a normal Codex harness turn, or run an intentionally unsandboxed session."
+	].join(" ");
+}
+function resolveCodexNativeNodeExecBlock(params) {
+	const sessionKey = params.sessionKey?.trim() || params.sessionId?.trim();
+	const policy = resolveCodexNativeExecutionPolicy({
+		config: params.config,
+		sessionKey,
+		agentId: params.agentId,
+		readRuntimeSessionEntry: Boolean(sessionKey)
+	});
+	if (policy.nativeToolSurfaceAllowed) return;
+	return formatCodexNativeNodeExecBlock({
+		surface: params.surface,
+		reason: policy.blockReason
+	});
+}
+//#endregion
+export { resolveCodexNativeSandboxBlock as n, sandbox_guard_exports as r, resolveCodexNativeExecutionBlock as t };