@openclaw/codex 2026.9.5 → 2026.9.7

package/dist/.setup/{run-attempt-lifecycle-B7JbY4-F.mjs → run-attempt-lifecycle-C-6O3Exn.mjs}

@@ -1,7 +1,8 @@
 import { t as attemptTerminal } from "./attempt-terminal-gZrxQ35N.mjs";
 import path from "node:path";
 import fs from "node:fs/promises";
-import { awaitAgentEndSideEffects, embeddedAgentLog, emitAgentEvent, runAgentEndSideEffects } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { awaitAgentEndSideEffects, embeddedAgentLog, runAgentEndSideEffects } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { emitAgentHarnessAttemptEvent } from "openclaw/plugin-sdk/agent-harness-attempt-runtime";
 //#region extensions/codex/src/app-server/workspace-dir-cache.ts
 /** Process-local cache of Codex workspaces already created by the run loop. */
 const codexWorkspaceDirCache = /* @__PURE__ */ new Set();
@@ -13,17 +14,13 @@ function shouldKeepCodexSharedAbortOpen(params) {
 	if (params.explicitCancellationObserved || terminal.aborted || terminal.externalAbort) return false;
 	return params.trigger === "memory" || !params.attemptSucceeded;
 }
-function withCodexAppServerFastModeServiceTier(appServer, params) {
+function withCodexAppServerFastModeServiceTier(appServer, params, configuredAppServer = appServer) {
 	const fastMode = typeof params.fastMode === "function" ? params.fastMode() : params.fastMode;
-	const serviceTier = fastMode === void 0 ? appServer.serviceTier : fastMode ? "priority" : void 0;
+	const serviceTier = fastMode === void 0 ? configuredAppServer.serviceTier : fastMode ? "priority" : void 0;
 	if (serviceTier === appServer.serviceTier) return appServer;
-	if (serviceTier) return {
-		...appServer,
-		serviceTier
-	};
 	return {
 		...appServer,
-		serviceTier: null
+		serviceTier: serviceTier || null
 	};
 }
 function estimateCodexAppServerProjectedTurnTokens(params) {
@@ -36,22 +33,11 @@ async function ensureCodexWorkspaceDirOnce(workspaceDir) {
 	await fs.mkdir(normalized, { recursive: true });
 	codexWorkspaceDirCache.add(normalized);
 }
-async function emitCodexAppServerEvent(params, event) {
-	try {
-		emitAgentEvent({
-			runId: params.runId,
-			stream: event.stream,
-			data: event.data,
-			...params.sessionKey ? { sessionKey: params.sessionKey } : {}
-		});
-	} catch (error) {
-		embeddedAgentLog.debug("codex app-server global agent event emit failed", { error });
-	}
-	try {
-		await params.onAgentEvent?.(event);
-	} catch (error) {
-		embeddedAgentLog.debug("codex app-server agent event handler threw", { error });
-	}
+function emitCodexAppServerEvent(params, event) {
+	return emitAgentHarnessAttemptEvent(params, event, {
+		label: "codex app-server",
+		log: embeddedAgentLog
+	});
 }
 async function runCodexAgentEndHook(params, hookParams) {
 	const sideEffectParams = {

package/dist/.setup/{runtime-artifact-Dy38Z5iU.mjs → runtime-artifact-DDQ-HGXf.mjs}

@@ -1,13 +1,15 @@
-import { a as resolvePackagedCodexNativeCommand } from "./managed-binary-DP6Rib3P.mjs";
-import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-Cmx94Oiy.mjs";
+import { n as isCodexAppServerProxyLaunch } from "./launch-args-DbFCehO7.mjs";
+import { a as resolvePackagedCodexNativeCommand } from "./managed-binary-kiWRhNRE.mjs";
+import { n as resolveCodexAppServerSpawnEnv, r as resolveCodexAppServerSpawnInvocation } from "./transport-stdio-Bdegpn2V.mjs";
+import { captureCodexConfiguredConnection, finalizeCodexConfiguredConnection, isCodexConfiguredConnectionArtifact, validateCodexConfiguredConnectionCapture } from "./runtime-artifact-connection-D68qQn1m.mjs";
 import { createHash } from "node:crypto";
-import { resolveWindowsExecutablePath, resolveWindowsSpawnProgram } from "openclaw/plugin-sdk/windows-spawn";
+import { resolveWindowsExecutablePath } from "openclaw/plugin-sdk/windows-spawn";
 import { constants } from "node:fs";
 import path from "node:path";
 import fs$1 from "node:fs/promises";
-import { isPathInside } from "openclaw/plugin-sdk/file-access-runtime";
+import { isPathInside, sha256File } from "openclaw/plugin-sdk/file-access-runtime";
 //#region extensions/codex/src/app-server/runtime-artifact.ts
-/** Exact local runtime artifact identity for verified Codex setup turns. */
+/** Local executable or configured-service identity for verified Codex turns. */
 const ARTIFACT_ID_PREFIX = "codex-app-server:v1:";
 const ARTIFACT_HASH_DOMAIN = "openclaw-codex-app-server-runtime-artifact-v1\0";
 const MAX_ARTIFACT_ID_BYTES = 32768;
@@ -17,8 +19,6 @@ const MAX_ARTIFACT_DEPTH = 64;
 const MAX_ARTIFACT_ENTRIES = 32768;
 const MAX_ARTIFACT_FILES = 8192;
 const MAX_ARTIFACT_TOTAL_BYTES = 1024n * 1024n * 1024n;
-const READ_CHUNK_BYTES = 65536;
-const CODE_MODE_HOST_PATH_ENV = "CODEX_CODE_MODE_HOST_PATH";
 const SAFE_NODE_OPTIONS_BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
 	"--enable-network-family-autoselection",
 	"--network-family-autoselection",
@@ -74,24 +74,17 @@ async function readRegularFileFingerprint(params) {
 		if (!before.isFile()) throw new Error(`Codex runtime artifact contains a non-regular file: ${params.filePath}`);
 		if (params.budget.fileCount + 1 > MAX_ARTIFACT_FILES) throw new Error("Codex runtime artifact exceeds the bounded file count");
 		if (params.budget.totalBytes + before.size > MAX_ARTIFACT_TOTAL_BYTES) throw new Error("Codex runtime artifact exceeds the bounded content size");
-		const hash = createHash("sha256");
-		const buffer = Buffer.allocUnsafe(READ_CHUNK_BYTES);
-		let offset = 0n;
-		while (offset < before.size) {
-			throwIfAborted(params.signal);
-			const length = Number(before.size - offset < BigInt(buffer.length) ? before.size - offset : BigInt(buffer.length));
-			const { bytesRead } = await handle.read(buffer, 0, length, Number(offset));
-			if (bytesRead === 0) throw new Error(`Codex runtime artifact changed while reading: ${params.filePath}`);
-			hash.update(buffer.subarray(0, bytesRead));
-			offset += BigInt(bytesRead);
-		}
+		const hash = await sha256File(handle, {
+			maxBytes: Number(before.size),
+			signal: params.signal
+		});
 		const after = await handle.stat({ bigint: true });
 		const current = await fs$1.stat(params.filePath, { bigint: true });
-		if (!sameOpenedFile(before, after) || !sameOpenedFile(after, current)) throw new Error(`Codex runtime artifact changed while reading: ${params.filePath}`);
+		if (BigInt(hash.bytes) !== before.size || !sameOpenedFile(before, after) || !sameOpenedFile(after, current)) throw new Error(`Codex runtime artifact changed while reading: ${params.filePath}`);
 		params.budget.fileCount += 1;
 		params.budget.totalBytes += after.size;
 		return {
-			contentHash: hash.digest("hex"),
+			contentHash: hash.digest,
 			mode: String(after.mode),
 			size: String(after.size)
 		};
@@ -351,38 +344,29 @@ async function resolveOptionalRegularFile(filePath) {
 function isMissingPathError(error) {
 	return error instanceof Error && "code" in error && error.code === "ENOENT";
 }
-function readEffectiveSpawnEnvironmentValue(env, name) {
-	if (process.platform !== "win32") return env[name];
-	const effectiveKey = Object.keys(env).toSorted(compareArtifactNames).find((key) => key.toUpperCase() === name.toUpperCase());
-	return effectiveKey ? env[effectiveKey] : void 0;
-}
 async function captureFilesystemDescriptor(params) {
 	throwIfAborted(params.signal);
 	if (params.startOptions.transport !== "stdio") throw new Error("Verified Codex inference requires a local stdio runtime artifact; WebSocket attestation is unsupported");
+	if (isCodexAppServerProxyLaunch(params.startOptions.args)) throw new Error("Verified Codex inference requires a local runtime artifact; app-server proxy attestation is unsupported");
 	const env = resolveCodexAppServerSpawnEnv(params.startOptions);
 	assertSafeNodeOptions(env);
+	const invocation = resolveCodexAppServerSpawnInvocation(params.startOptions, env);
 	const spawnCwd = path.resolve(params.startOptions.cwd ?? process.cwd());
 	const commandPath = await resolveCommandPath(params.startOptions.command, env, spawnCwd);
 	const commandRealPath = await fs$1.realpath(commandPath);
 	let nativeCommand = params.spawnIdentity.nativeCommand;
-	let nativeCandidate = commandRealPath;
 	let invocationPaths;
-	if (process.platform === "win32") {
-		const program = resolveWindowsSpawnProgram({
-			command: params.startOptions.command,
-			platform: process.platform,
-			env,
-			execPath: process.execPath,
-			packageName: "@openai/codex"
-		});
-		const entrypoint = program.leadingArgv[0];
-		if (program.resolution === "node-entrypoint" && entrypoint && !nativeCommand) nativeCommand = resolvePackagedCodexNativeCommand(await fs$1.realpath(entrypoint));
-		if (program.resolution === "node-entrypoint" && !nativeCommand) throw new Error("Codex runtime cannot attest a custom Node launcher without its native target");
-		nativeCandidate = program.command;
+	if (process.platform === "win32" || invocation.resolution === "node-entrypoint") {
+		const entrypoint = invocation.resolution === "node-entrypoint" ? invocation.argv[0] : void 0;
+		if (entrypoint && !nativeCommand) {
+			const entrypointPath = await resolveCommandPath(entrypoint, env, spawnCwd);
+			nativeCommand = resolvePackagedCodexNativeCommand(await fs$1.realpath(entrypointPath));
+		}
+		if (invocation.resolution === "node-entrypoint" && !nativeCommand) throw new Error("Codex runtime cannot attest a custom Node launcher without its native target");
 		const invocationCandidates = [
 			commandRealPath,
-			program.command,
-			...program.leadingArgv
+			invocation.command,
+			...entrypoint ? [entrypoint] : []
 		];
 		invocationPaths = [];
 		for (const candidate of invocationCandidates) {
@@ -400,13 +384,10 @@ async function captureFilesystemDescriptor(params) {
 	}
 	invocationPaths = [...new Set(invocationPaths)].toSorted(compareArtifactNames);
 	if (invocationPaths.length > MAX_ARTIFACT_INVOCATION_PATHS) throw new Error("Codex runtime launcher exceeds the bounded invocation file count");
-	const nativePath = await fs$1.realpath(await resolveCommandPath(nativeCommand ?? nativeCandidate, env, spawnCwd));
+	const nativePath = await fs$1.realpath(await resolveCommandPath(nativeCommand ?? invocation.command, env, spawnCwd));
 	const packageRoot = await resolvePackageRoot(nativePath);
-	const configuredCodeModeHost = readEffectiveSpawnEnvironmentValue(env, CODE_MODE_HOST_PATH_ENV)?.trim();
-	const adjacentCodeModeHost = path.join(path.dirname(nativePath), process.platform === "win32" ? "codex-code-mode-host.exe" : "codex-code-mode-host");
-	const codeModeHostCandidatePath = configuredCodeModeHost ? path.isAbsolute(configuredCodeModeHost) ? configuredCodeModeHost : path.resolve(spawnCwd, configuredCodeModeHost) : adjacentCodeModeHost;
+	const codeModeHostCandidatePath = path.join(path.dirname(nativePath), process.platform === "win32" ? "codex-code-mode-host.exe" : "codex-code-mode-host");
 	const codeModeHostPath = await resolveOptionalRegularFile(codeModeHostCandidatePath);
-	if (configuredCodeModeHost && !codeModeHostPath) throw new Error("Configured Codex code-mode host runtime artifact is unavailable");
 	const descriptor = {
 		version: 1,
 		commandPath,
@@ -438,7 +419,11 @@ function validateFilesystemDescriptorShape(descriptor) {
 		"config",
 		"env"
 	].includes(descriptor.commandSource)) throw new Error("Invalid Codex runtime command source");
-	if (descriptor.managedCommandOrder !== void 0 && descriptor.managedCommandOrder !== "package-first" && descriptor.managedCommandOrder !== "desktop-first") throw new Error("Invalid Codex managed command order");
+	if (descriptor.managedCommandOrder !== void 0 && ![
+		"package-first",
+		"package-only",
+		"desktop-first"
+	].includes(descriptor.managedCommandOrder)) throw new Error("Invalid Codex managed command order");
 	if (descriptor.managedCommandOrder !== void 0 && descriptor.commandSource !== "resolved-managed") throw new Error("Invalid Codex managed runtime descriptor");
 	const canonicalInvocationPaths = [...new Set(descriptor.invocationPaths)].toSorted(compareArtifactNames);
 	if (canonicalInvocationPaths.length !== descriptor.invocationPaths.length || canonicalInvocationPaths.some((entry, index) => entry !== descriptor.invocationPaths[index])) throw new Error("Invalid Codex runtime invocation descriptor");
@@ -483,14 +468,22 @@ function fingerprintBinding(descriptor, contentFingerprint) {
 }
 /** Captures exact candidate bytes immediately before app-server startup. */
 async function captureCodexAppServerRuntimeArtifactBeforeStart(params) {
+	throwIfAborted(params.signal);
+	if (params.startOptions.transport !== "stdio") return captureCodexConfiguredConnection(params.startOptions);
 	const descriptor = await captureFilesystemDescriptor(params);
 	return {
+		kind: "local-executable",
 		descriptor,
 		contentFingerprint: await hashSelectedArtifactFiles(descriptor, params.signal)
 	};
 }
 /** Rechecks startup bytes and adds initialized handshake identity. */
 async function finalizeCodexAppServerRuntimeArtifact(params) {
+	throwIfAborted(params.signal);
+	if (params.before.kind === "configured-connection") return finalizeCodexConfiguredConnection({
+		...params,
+		before: params.before
+	});
 	const afterDescriptor = await captureFilesystemDescriptor(params);
 	const afterContentFingerprint = await hashSelectedArtifactFiles(afterDescriptor, params.signal);
 	if (JSON.stringify(afterDescriptor) !== JSON.stringify(params.before.descriptor) || afterContentFingerprint !== params.before.contentFingerprint) throw new Error("Codex app-server runtime artifact changed during startup");
@@ -510,6 +503,7 @@ async function finalizeCodexAppServerRuntimeArtifact(params) {
 }
 /** Checks current pre-spawn bytes and selection against a previously minted binding. */
 function validateCodexAppServerRuntimeArtifactCapture(binding, capture) {
+	if (capture.kind === "configured-connection") return validateCodexConfiguredConnectionCapture(binding, capture);
 	try {
 		const expectedDescriptor = decodeArtifactId(binding.id);
 		const { serverVersion: _serverVersion, userAgentFingerprint: _userAgentFingerprint, ...expectedFilesystemDescriptor } = expectedDescriptor;
@@ -530,8 +524,10 @@ function readCodexAppServerClientRuntimeArtifact(client) {
 	return getRuntimeArtifactBindings().get(client);
 }
 /** Re-hashes only the exact Codex files named by a server-minted artifact binding. */
-async function validateCodexAppServerRuntimeArtifact(binding, signal) {
+async function validateCodexAppServerRuntimeArtifact(binding, signal, startOptions) {
 	try {
+		throwIfAborted(signal);
+		if (isCodexConfiguredConnectionArtifact(binding.id)) return Boolean(startOptions && validateCodexConfiguredConnectionCapture(binding, captureCodexConfiguredConnection(startOptions)));
 		const descriptor = decodeArtifactId(binding.id);
 		const contentFingerprint = await hashSelectedArtifactFiles(descriptor, signal);
 		return binding.fingerprint === fingerprintBinding(descriptor, contentFingerprint);

package/dist/.setup/runtime-artifact-connection-D68qQn1m.mjs

@@ -0,0 +1,78 @@
+import { t as codexAppServerStartOptionsKey } from "./config-options-CzyWLTJt.mjs";
+import "./config-runtime-C0NbLms1.mjs";
+import { r as resolveCodexAppServerUnixSocketPath } from "./transport-websocket-BTBE-LD9.mjs";
+import { createHash } from "node:crypto";
+import path from "node:path";
+//#region extensions/codex/src/app-server/runtime-artifact-connection.ts
+/** Configured-service identity, distinct from local executable attestation. */
+const CONNECTION_ID_PREFIX = "codex-app-server:connection:v1:";
+const CONNECTION_HASH_DOMAIN = "openclaw-codex-configured-connection-v1\0";
+function captureCodexConfiguredConnection(start) {
+	if (start.transport !== "websocket" && start.transport !== "unix" || start.transport === "websocket" && !start.url?.trim()) throw new Error("Verified remote Codex inference requires a configured socket endpoint");
+	const unixSocketPath = resolveCodexAppServerUnixSocketPath(start);
+	const key = codexAppServerStartOptionsKey({
+		transport: start.transport,
+		command: "",
+		args: [],
+		url: unixSocketPath ? `unix://${path.resolve(unixSocketPath)}` : start.url,
+		authToken: start.authToken,
+		headers: start.headers
+	});
+	return Object.freeze({
+		kind: "configured-connection",
+		transport: start.transport,
+		selectionFingerprint: createHash("sha256").update(key).digest("hex")
+	});
+}
+function finalizeCodexConfiguredConnection(params) {
+	const after = captureCodexConfiguredConnection(params.startOptions);
+	if (JSON.stringify(after) !== JSON.stringify(params.before)) throw new Error("Codex configured connection changed during startup");
+	const serverVersion = params.runtimeIdentity?.serverVersion?.trim();
+	if (!serverVersion) throw new Error("Codex app-server did not report an initialized runtime identity");
+	const descriptor = {
+		...after,
+		runtimeIdentityFingerprint: createHash("sha256").update(JSON.stringify({
+			serverVersion,
+			userAgent: params.runtimeIdentity?.userAgent ?? null,
+			codexHome: params.runtimeIdentity?.codexHome ?? null,
+			platformFamily: params.runtimeIdentity?.platformFamily ?? null,
+			platformOs: params.runtimeIdentity?.platformOs ?? null
+		})).digest("hex")
+	};
+	return Object.freeze({
+		id: encodeConnectionId(descriptor),
+		fingerprint: fingerprint(descriptor)
+	});
+}
+function isCodexConfiguredConnectionArtifact(id) {
+	return id.startsWith(CONNECTION_ID_PREFIX);
+}
+function validateCodexConfiguredConnectionCapture(binding, capture) {
+	try {
+		const descriptor = decodeConnectionId(binding.id);
+		return descriptor.transport === capture.transport && descriptor.selectionFingerprint === capture.selectionFingerprint && binding.fingerprint === fingerprint(descriptor);
+	} catch {
+		return false;
+	}
+}
+function encodeConnectionId(descriptor) {
+	return `${CONNECTION_ID_PREFIX}${Buffer.from(JSON.stringify(descriptor)).toString("base64url")}`;
+}
+function fingerprint(descriptor) {
+	return createHash("sha256").update(CONNECTION_HASH_DOMAIN).update(JSON.stringify(descriptor)).digest("hex");
+}
+function decodeConnectionId(id) {
+	if (!isCodexConfiguredConnectionArtifact(id) || Buffer.byteLength(id) > 2048) throw new Error("Invalid Codex configured connection artifact");
+	const value = JSON.parse(Buffer.from(id.slice(31), "base64url").toString("utf8"));
+	if (!value || typeof value !== "object" || Array.isArray(value) || !("kind" in value) || value.kind !== "configured-connection" || !("transport" in value) || value.transport !== "websocket" && value.transport !== "unix" || !("selectionFingerprint" in value) || typeof value.selectionFingerprint !== "string" || !/^[a-f0-9]{64}$/u.test(value.selectionFingerprint) || !("runtimeIdentityFingerprint" in value) || typeof value.runtimeIdentityFingerprint !== "string" || !/^[a-f0-9]{64}$/u.test(value.runtimeIdentityFingerprint)) throw new Error("Invalid Codex configured connection descriptor");
+	const descriptor = {
+		kind: value.kind,
+		transport: value.transport,
+		selectionFingerprint: value.selectionFingerprint,
+		runtimeIdentityFingerprint: value.runtimeIdentityFingerprint
+	};
+	if (encodeConnectionId(descriptor) !== id) throw new Error("Invalid noncanonical Codex configured connection artifact");
+	return descriptor;
+}
+//#endregion
+export { captureCodexConfiguredConnection, finalizeCodexConfiguredConnection, isCodexConfiguredConnectionArtifact, validateCodexConfiguredConnectionCapture };

package/dist/.setup/sandbox-guard-DjCz2eOw.mjs

@@ -0,0 +1,126 @@
+import { l as isCodexRemoteExecPlacementSandbox } from "./config-parsing-b088LyhT.mjs";
+import { n as resolveCodexNativeExecutionPolicy, t as formatCodexNativeNodeExecBlock } from "./native-execution-policy-BxZJy5mP.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-jo6H8dFr.mjs";
+import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { tryResolveDefaultAgentId } from "openclaw/plugin-sdk/agent-scope-runtime";
+import { parseAgentSessionKey } from "openclaw/plugin-sdk/routing";
+import { resolveSandboxRuntimeStatus } from "openclaw/plugin-sdk/sandbox";
+//#region extensions/codex/src/app-server/sandbox-guard.ts
+/**
+* Blocks direct Codex app-server requests that would bypass OpenClaw sandbox or
+* node-exec routing guarantees.
+*/
+var sandbox_guard_exports = /* @__PURE__ */ __exportAll({
+	resolveCodexAppServerDirectSandboxBypassBlock: () => resolveCodexAppServerDirectSandboxBypassBlock,
+	resolveCodexNativeExecutionBlock: () => resolveCodexNativeExecutionBlock,
+	resolveCodexNativeSandboxBlock: () => resolveCodexNativeSandboxBlock
+});
+const ALLOWED_CONTROL_PLANE_METHODS = /* @__PURE__ */ new Set([
+	"account/rateLimits/read",
+	"account/read",
+	"app/installed",
+	"app/list",
+	"app/read",
+	"config/batchWrite",
+	"config/mcpServer/reload",
+	"config/read",
+	"config/value/write",
+	"environment/add",
+	"experimentalFeature/list",
+	"experimentalFeature/enablement/set",
+	"feedback/upload",
+	"hooks/list",
+	"initialize",
+	"marketplace/add",
+	"mcpServerStatus/list",
+	"model/list",
+	"plugin/install",
+	"plugin/installed",
+	"plugin/list",
+	"plugin/read",
+	"skills/list",
+	"thread/archive",
+	"thread/inject_items",
+	"thread/list",
+	"thread/metadata/update",
+	"thread/name/set",
+	"thread/read",
+	"thread/rollback",
+	"thread/unarchive",
+	"thread/unsubscribe",
+	"turn/interrupt",
+	"turn/steer"
+]);
+/** Returns a block message when a direct app-server method would bypass OpenClaw execution policy. */
+function resolveCodexAppServerDirectSandboxBypassBlock(params) {
+	const controlPlane = ALLOWED_CONTROL_PLANE_METHODS.has(params.method);
+	if (!controlPlane || params.method === "config/mcpServer/reload") {
+		const nodeExecBlock = resolveCodexNativeNodeExecBlock({
+			config: params.config,
+			sessionKey: params.sessionKey,
+			sessionId: params.sessionId,
+			surface: `app-server method \`${params.method}\``
+		});
+		if (nodeExecBlock) return nodeExecBlock;
+	}
+	if (controlPlane) return;
+	const sessionKey = params.sessionKey?.trim() || params.sessionId?.trim();
+	if (!sessionKey) return;
+	const sandboxBlock = resolveCodexNativeSandboxBlock({
+		config: params.config,
+		sessionKey,
+		sandbox: params.sandbox,
+		surface: `app-server method \`${params.method}\``
+	});
+	if (!sandboxBlock) return;
+	if (params.method === "thread/start" && hasOpenClawSandboxEnvironmentSelection(params.requestParams)) return;
+	return sandboxBlock;
+}
+/** Resolves the generic native-execution block for sandboxed or node-hosted sessions. */
+function resolveCodexNativeExecutionBlock(params) {
+	return resolveCodexNativeSandboxBlock(params) ?? resolveCodexNativeNodeExecBlock(params);
+}
+/** Returns a block message when native Codex execution cannot honor active sandboxing. */
+function resolveCodexNativeSandboxBlock(params) {
+	if (params.sandboxEnvironmentSelected) return;
+	const sessionKey = params.sessionKey?.trim() || params.sessionId?.trim();
+	if (!sessionKey) return;
+	if (isCodexRemoteExecPlacementSandbox(params.sandbox) || params.sandbox?.enabled === true) return formatCodexNativeSandboxBlock({ surface: params.surface });
+	const sandboxAgentId = parseAgentSessionKey(sessionKey)?.agentId ?? params.agentId ?? tryResolveDefaultAgentId(params.config ?? {});
+	if (!sandboxAgentId) return;
+	if (!resolveSandboxRuntimeStatus({
+		cfg: params.config,
+		sessionKey,
+		agentId: sandboxAgentId,
+		classificationAgentId: sandboxAgentId
+	}).sandboxed) return;
+	return formatCodexNativeSandboxBlock({ surface: params.surface });
+}
+function hasOpenClawSandboxEnvironmentSelection(value) {
+	if (!isRecord(value)) return false;
+	const environments = value.environments;
+	return Array.isArray(environments) && environments.length > 0 && environments.every((environment) => isRecord(environment) && typeof environment.environmentId === "string" && environment.environmentId.startsWith("openclaw-sandbox-") && typeof environment.cwd === "string" && environment.cwd.trim().length > 0);
+}
+function formatCodexNativeSandboxBlock(params) {
+	return [
+		`Codex-native ${params.surface} is unavailable because OpenClaw sandboxing is active for this session.`,
+		"This mode cannot route execution through the OpenClaw sandbox backend.",
+		"Use a normal Codex harness turn, or run an intentionally unsandboxed session."
+	].join(" ");
+}
+function resolveCodexNativeNodeExecBlock(params) {
+	const sessionKey = params.sessionKey?.trim() || params.sessionId?.trim();
+	const policy = resolveCodexNativeExecutionPolicy({
+		config: params.config,
+		sessionKey,
+		agentId: params.agentId,
+		readRuntimeSessionEntry: Boolean(sessionKey)
+	});
+	if (policy.nativeToolSurfaceAllowed) return;
+	return formatCodexNativeNodeExecBlock({
+		surface: params.surface,
+		reason: policy.blockReason
+	});
+}
+//#endregion
+export { resolveCodexNativeSandboxBlock as n, sandbox_guard_exports as r, resolveCodexNativeExecutionBlock as t };

package/dist/.setup/scope-DOC1Xjc8.mjs

@@ -0,0 +1,6 @@
+//#region extensions/codex/src/migration/scope.ts
+function isOnlyMigrationKind({ itemKinds }, kind) {
+	return Boolean(itemKinds?.length && itemKinds.every((itemKind) => itemKind === kind));
+}
+//#endregion
+export { isOnlyMigrationKind as t };