vultr/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-06 11:40:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

Harden Codex harness control surfaces (#77459)

Browse Source 
* fix(scripts): find codex protocol source from worktrees

* fix(test): keep codex harness docker caches writable

* fix(test): relax live codex cache mount permissions

* test(codex): add live docker harness debug output

* fix(test): detect numeric ci env in codex docker harness

* fix(codex): skip duplicate agent-command telemetry

* fix(tooling): skip sparse-missing oxlint tsconfig

* fix(tooling): route changed checks through testbox

* fix(qa): keep coverage json source-clean

* fix(test): preflight codex docker auth

* fix(codex): validate bind option values

* fix(codex): parse quoted command arguments

* fix(codex): reject extra control args

* fix(codex): use content for blank bound prompts

* fix(codex): decode local image file urls

* fix(codex): treat local media urls as images

* fix(codex): keep windows media paths local

* fix(codex): reject malformed diagnostics confirmations

* fix(codex): reject malformed resume commands

* fix(codex): reject malformed thread actions

* fix(codex): reject malformed turn controls

* fix(codex): reject malformed model controls

* fix(codex): resolve empty user input prompts

* fix(codex): enforce user input options

* fix(codex): reject ambiguous computer-use actions

* fix(codex): ignore stale bound turn notifications

* test(gateway): close task registries in gateway harness

* test(gateway): route cleanup through task seams

* fix(codex): describe current permission approvals

* fix(codex): disclose command approval amendments

* fix(codex): preserve approval detail under truncation

* fix(codex): propagate dynamic tool failures

* test(codex): align dynamic tool block contract

* fix(codex): reject extra read-only command operands

* fix(codex): escape command readout fields

* fix(codex): escape status probe errors

* fix(codex): narrow formatted thread details

* fix(codex): escape successful status summaries

* fix(codex): escape bound control replies

* fix(codex): escape user input prompts

* fix(codex): escape control failure replies

* fix(codex): escape approval prompt text

* test(codex): narrow escaped reply assertions

* test(codex): complete strict reply fixtures

* test(codex): preserve account fixture literals

* test(codex): align status probe fixtures

* fix(codex): satisfy sanitizer regex lint

* fix(codex): harden command readouts

* fix(codex): harden bound image inputs

* fix(codex): sanitize command failure replies

* test(codex): complete rate limit fixture

* test(tooling): isolate postinstall compile cache fixture

* fix(codex): keep app-server event ownership explicit

---------

Co-authored-by: pashpashpash <nik@vault77.ai>
This commit is contained in:
Vincent Koc
2026-05-04 15:23:41 -07:00
committed by GitHub
parent b3e42bf327
commit ac3cd1a0ca
42 changed files with 2672 additions and 245 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
scripts/check-codex-app-server-protocol.ts
View File

@@ -1,11 +1,9 @@
import fs from "node:fs/promises";
import path from "node:path";
import { resolveCodexAppServerProtocolSource } from "./lib/codex-app-server-protocol-source.js";
const codexRepo = process.env.OPENCLAW_CODEX_REPO
? path.resolve(process.env.OPENCLAW_CODEX_REPO)
: path.resolve(process.cwd(), "../codex");
const schemaRoot = path.join(codexRepo, "codex-rs/app-server-protocol/schema/typescript");
const sourceSchemaRoot = path.join(codexRepo, "codex-rs/app-server-protocol/schema");
const { sourceRoot: sourceSchemaRoot } = await resolveCodexAppServerProtocolSource(process.cwd());
const schemaRoot = path.join(sourceSchemaRoot, "typescript");
const generatedRoot = path.resolve(
process.cwd(),
"extensions/codex/src/app-server/protocol-generated",
@@ -104,12 +102,14 @@ if (failures.length > 0) {
for (const failure of failures) {
console.error(`- ${failure}`);
}
console.error("Run `pnpm codex-app-server:protocol:sync` after refreshing ../codex.");
console.error(
`Run \`pnpm codex-app-server:protocol:sync\` after refreshing the Codex checkout at ${path.resolve(sourceSchemaRoot, "../../..")}.`,
);
process.exit(1);
}
console.log(
`Codex app-server generated protocol matches OpenClaw bridge assumptions: ${schemaRoot}`,
`Codex app-server generated protocol matches OpenClaw bridge assumptions: ${sourceSchemaRoot}`,
);
async function compareGeneratedProtocolMirror(): Promise<void> {
@@ -130,14 +130,12 @@ async function compareGeneratedProtocolMirror(): Promise<void> {
);
const target = await fs.readFile(path.join(targetTsRoot, file), "utf8");
if (source !== target) {
failures.push(
`protocol-generated/typescript/${file}: differs from normalized ../codex schema`,
);
failures.push(`protocol-generated/typescript/${file}: differs from normalized source schema`);
}
}
for (const file of targetFiles) {
if (!sourceSet.has(file)) {
failures.push(`protocol-generated/typescript/${file}: no longer present in ../codex schema`);
failures.push(`protocol-generated/typescript/${file}: no longer present in source schema`);
}
}
@@ -161,7 +159,7 @@ async function compareGeneratedProtocolMirror(): Promise<void> {
continue;
}
if (source !== target) {
failures.push(`protocol-generated/json/${schema}: differs from ../codex schema`);
failures.push(`protocol-generated/json/${schema}: differs from source schema`);
}
}
}