perf(gateway): cache stable plugin index fingerprints

extensions/codex/src/app-server/sandbox-exec-server.http.test.ts

@@ -10,7 +10,6 @@ import {
   execServerUrlFromClient,
   openSocket,
   rpc,
-  shellQuote,
   waitForHttpBodyDeltas,
 } from "./sandbox-exec-server.test-helpers.js";
 
@@ -19,6 +18,12 @@ afterEach(async () => {
   await closeCodexSandboxExecServersForTests();
 });
 
+function testExecEnv(): NodeJS.ProcessEnv {
+  return {
+    PATH: process.env.PATH,
+  };
+}
+
 describe("OpenClaw Codex sandbox exec-server HTTP", () => {
   it("routes HTTP requests through the sandbox backend", async () => {
     const runShellCommand = vi.fn(async () => ({
@@ -84,13 +89,13 @@ describe("OpenClaw Codex sandbox exec-server HTTP", () => {
     });
     const buildExecSpec = vi.fn(async () => ({
       argv: [
-        "/bin/sh",
-        "-lc",
+        process.execPath,
+        "-e",
         [headerLine, bodyLine, doneLine]
-          .map((line) => `printf '%s\\n' ${shellQuote(line)}`)
-          .join("; "),
+          .map((line) => `process.stdout.write(${JSON.stringify(`${line}\n`)});`)
+          .join(""),
       ],
-      env: process.env,
+      env: testExecEnv(),
       stdinMode: "pipe-closed" as const,
     }));
     const runShellCommand = vi.fn(async () => ({
@@ -167,7 +172,7 @@ describe("OpenClaw Codex sandbox exec-server HTTP", () => {
             "setInterval(() => {}, 1000);",
           ].join(""),
         ],
-        env: process.env,
+        env: testExecEnv(),
         finalizeToken: "stream-token",
         stdinMode: "pipe-closed",
       }),

extensions/codex/src/app-server/sandbox-exec-server.test-helpers.ts

@@ -40,8 +40,8 @@ export function createSandboxContext(overrides: {
       buildExecSpec:
         overrides.buildExecSpec ??
         (async () => ({
-          argv: ["/bin/sh", "-lc", "true"],
-          env: process.env,
+          argv: [process.execPath, "-e", ""],
+          env: { PATH: process.env.PATH },
           stdinMode: "pipe-closed",
         })),
       finalizeExec: overrides.finalizeExec,

extensions/codex/src/app-server/sandbox-exec-server.test.ts

@@ -20,6 +20,26 @@ afterEach(async () => {
   await closeCodexSandboxExecServersForTests();
 });
 
+function testExecEnv(): NodeJS.ProcessEnv {
+  return {
+    PATH: process.env.PATH,
+  };
+}
+
+function echoFirstInputLineScript(prefix: string): string {
+  return [
+    "let data = '';",
+    "process.stdin.setEncoding('utf8');",
+    "process.stdin.on('data', (chunk) => {",
+    "data += chunk;",
+    "if (data.includes('\\n')) {",
+    `process.stdout.write(${JSON.stringify(prefix)} + data);`,
+    "process.exit(0);",
+    "}",
+    "});",
+  ].join(" ");
+}
+
 describe("OpenClaw Codex sandbox exec-server", () => {
   it("reports unavailable app-server remote environment support without exposing an environment", async () => {
     const sandbox = createSandboxContext({});
@@ -95,8 +115,8 @@ describe("OpenClaw Codex sandbox exec-server", () => {
 
   it("registers a sandbox-backed Codex environment and routes process execution through it", async () => {
     const buildExecSpec = vi.fn(async () => ({
-      argv: ["/bin/sh", "-lc", "printf 'sandbox-process-ok\\n'"],
-      env: process.env,
+      argv: [process.execPath, "-e", "process.stdout.write('sandbox-process-ok\\n')"],
+      env: testExecEnv(),
       stdinMode: "pipe-closed" as const,
     }));
     const sandbox = createSandboxContext({ buildExecSpec });
@@ -172,8 +192,8 @@ describe("OpenClaw Codex sandbox exec-server", () => {
 
   it("rejects unsupported arg0 overrides instead of dropping them", async () => {
     const buildExecSpec = vi.fn(async () => ({
-      argv: ["/bin/sh", "-lc", "true"],
-      env: process.env,
+      argv: [process.execPath, "-e", ""],
+      env: testExecEnv(),
       stdinMode: "pipe-closed" as const,
     }));
     const sandbox = createSandboxContext({ buildExecSpec });
@@ -204,8 +224,8 @@ describe("OpenClaw Codex sandbox exec-server", () => {
   it("accepts stdin writes for pipe-backed processes", async () => {
     const sandbox = createSandboxContext({
       buildExecSpec: async () => ({
-        argv: ["/bin/sh", "-lc", 'read line; printf "echo:%s\\n" "$line"'],
-        env: process.env,
+        argv: [process.execPath, "-e", echoFirstInputLineScript("echo:")],
+        env: testExecEnv(),
         stdinMode: "pipe-open",
       }),
     });
@@ -242,8 +262,8 @@ describe("OpenClaw Codex sandbox exec-server", () => {
 
   it("keeps tty process starts pipe-backed for sandbox backends", async () => {
     const buildExecSpec = vi.fn(async () => ({
-      argv: ["/bin/sh", "-lc", 'read line; printf "tty:%s\\n" "$line"'],
-      env: process.env,
+      argv: [process.execPath, "-e", echoFirstInputLineScript("tty:")],
+      env: testExecEnv(),
       stdinMode: "pipe-open" as const,
     }));
     const sandbox = createSandboxContext({ buildExecSpec });
@@ -289,7 +309,7 @@ describe("OpenClaw Codex sandbox exec-server", () => {
     vi.stubEnv("OPENCLAW_TEST_DATABASE_PASSWORD", "host-password");
     vi.stubEnv("OPENCLAW_TEST_PRIVATE_KEY", "host-private-key");
     const buildExecSpec = vi.fn(async () => ({
-      argv: ["/bin/sh", "-lc", "true"],
+      argv: [process.execPath, "-e", ""],
       env: {},
       stdinMode: "pipe-closed" as const,
     }));
@@ -336,7 +356,7 @@ describe("OpenClaw Codex sandbox exec-server", () => {
           "-e",
           "process.stdout.write('aaaa'); process.stderr.write('bbbb');",
         ],
-        env: process.env,
+        env: testExecEnv(),
         stdinMode: "pipe-closed",
       }),
     });