fix(codex): restrict computer-use installation

eleqtrizit · eleqtrizit · commit 0ed00ca0d82e · 2026-06-29T23:33:22.000Z
diff --git a/docs/plugins/codex-computer-use.md b/docs/plugins/codex-computer-use.md
@@ -147,6 +147,9 @@ report disabled even after a one-off install command.
 `install` enables Codex app-server plugin support, optionally adds a configured
 marketplace source, installs or re-enables the configured plugin through Codex
 app-server, reloads MCP servers, and verifies that the MCP server exposes tools.
+Because installation changes trusted host resources, only an owner or an
+`operator.admin` Gateway client can run `install`. Other authorized senders can
+continue to use the read-only `status` command, including with overrides.
 
 ## Marketplace choices
 
diff --git a/extensions/codex/src/command-authorization.ts b/extensions/codex/src/command-authorization.ts
@@ -0,0 +1,5 @@
+import type { PluginCommandContext } from "openclaw/plugin-sdk/plugin-entry";
+
+export function canMutateCodexHost(ctx: PluginCommandContext): boolean {
+  return ctx.senderIsOwner === true || ctx.gatewayClientScopes?.includes("operator.admin") === true;
+}
diff --git a/extensions/codex/src/command-handlers.ts b/extensions/codex/src/command-handlers.ts
@@ -24,6 +24,7 @@ import {
   writeCodexAppServerBinding,
 } from "./app-server/session-binding.js";
 import { readCodexAccountAuthOverview } from "./command-account.js";
+import { canMutateCodexHost } from "./command-authorization.js";
 import {
   buildHelp,
   formatAccount,
@@ -497,7 +498,7 @@ export async function handleCodexSubcommand(
       return buildCodexComputerUseMenuReply();
     }
     return {
-      text: await handleComputerUseCommand(deps, options.pluginConfig, rest),
+      text: await handleComputerUseCommand(deps, ctx, options.pluginConfig, rest),
     };
   }
   if (normalized === "mcp") {
@@ -631,6 +632,7 @@ function returnsBeforeNativeCodexResume(args: readonly string[]): boolean {
 
 async function handleComputerUseCommand(
   deps: CodexCommandDeps,
+  ctx: PluginCommandContext,
   pluginConfig: unknown,
   args: string[],
 ): Promise<string> {
@@ -641,6 +643,9 @@ async function handleComputerUseCommand(
       "Checks or installs the configured Codex Computer Use plugin through app-server.",
     ].join("\n");
   }
+  if (parsed.action === "install" && !canMutateCodexHost(ctx)) {
+    return "Only an owner or operator.admin gateway client can configure Codex Computer Use.";
+  }
   const params: CodexComputerUseSetupParams = {
     pluginConfig,
     forceEnable: parsed.action === "install" || parsed.hasOverrides,
diff --git a/extensions/codex/src/command-plugins-management.ts b/extensions/codex/src/command-plugins-management.ts
@@ -1,5 +1,6 @@
 // Codex plugin module implements command plugins management behavior.
 import type { PluginCommandContext, PluginCommandResult } from "openclaw/plugin-sdk/plugin-entry";
+import { canMutateCodexHost } from "./command-authorization.js";
 import { formatCodexDisplayText } from "./command-formatters.js";
 import {
   buildCodexCommandPickerPresentation,
@@ -79,7 +80,7 @@ export async function handleCodexPluginsSubcommand(
     if (!target || args.length > 1) {
       return { text: `Usage: /codex plugins ${normalized} <name>` };
     }
-    if (!canMutateCodexPlugins(ctx)) {
+    if (!canMutateCodexHost(ctx)) {
       return {
         text: `Only an owner or operator.admin gateway client can run /codex plugins ${normalized}.`,
       };
@@ -197,13 +198,6 @@ function buildPluginNamePickerReply(
   };
 }
 
-function canMutateCodexPlugins(ctx: PluginCommandContext): boolean {
-  if (ctx.senderIsOwner === true) {
-    return true;
-  }
-  return ctx.gatewayClientScopes?.includes("operator.admin") === true;
-}
-
 export function buildPluginsHelp(): string {
   return [
     "Codex sub-plugin management (writes only to ~/.openclaw/openclaw.json, never to ~/.codex/config.toml):",
diff --git a/extensions/codex/src/commands.test.ts b/extensions/codex/src/commands.test.ts
@@ -2100,6 +2100,68 @@ describe("codex command", () => {
     });
   });
 
+  it("rejects Computer Use installation from non-owner non-admin callers", async () => {
+    const installCodexComputerUse = vi.fn(async () => computerUseReadyStatus());
+    const ctx = createContext(
+      "computer-use install --source attacker/marketplace --plugin untrusted",
+      undefined,
+      { senderIsOwner: false, gatewayClientScopes: ["operator.write"] },
+    );
+
+    const result = await handleCodexCommand(ctx, {
+      deps: createDeps({ installCodexComputerUse }),
+    });
+
+    expectResultTextContains(result, "Only an owner or operator.admin");
+    expect(installCodexComputerUse).not.toHaveBeenCalled();
+  });
+
+  it("keeps Computer Use status overrides read-only for non-owner callers", async () => {
+    const readCodexComputerUseStatus = vi.fn(async () => computerUseReadyStatus());
+    const installCodexComputerUse = vi.fn(async () => computerUseReadyStatus());
+    const ctx = createContext(
+      "computer-use status --source existing/source --marketplace-path /existing/marketplace --marketplace existing --plugin existing-plugin --mcp-server existing-server",
+      undefined,
+      {
+        senderIsOwner: false,
+        gatewayClientScopes: ["operator.write"],
+      },
+    );
+
+    const result = await handleCodexCommand(ctx, {
+      deps: createDeps({ readCodexComputerUseStatus, installCodexComputerUse }),
+    });
+
+    expectResultTextContains(result, "Computer Use: ready");
+    expect(readCodexComputerUseStatus).toHaveBeenCalledWith({
+      pluginConfig: undefined,
+      forceEnable: true,
+      overrides: {
+        marketplaceSource: "existing/source",
+        marketplacePath: "/existing/marketplace",
+        marketplaceName: "existing",
+        pluginName: "existing-plugin",
+        mcpServerName: "existing-server",
+      },
+    });
+    expect(installCodexComputerUse).not.toHaveBeenCalled();
+  });
+
+  it("allows operator.admin gateway callers to install Codex Computer Use", async () => {
+    const installCodexComputerUse = vi.fn(async () => computerUseReadyStatus());
+    const ctx = createContext("computer-use install", undefined, {
+      senderIsOwner: false,
+      gatewayClientScopes: ["operator.admin"],
+    });
+
+    const result = await handleCodexCommand(ctx, {
+      deps: createDeps({ installCodexComputerUse }),
+    });
+
+    expectResultTextContains(result, "Computer Use: ready");
+    expect(installCodexComputerUse).toHaveBeenCalledOnce();
+  });
+
   it("shows help when Computer Use option values are missing", async () => {
     const installCodexComputerUse = vi.fn(async () => computerUseReadyStatus());
 
