fix: parse codex computer use timeout env strictly

steipete · steipete · commit 5b79ab090168 · 2026-05-28T13:49:38.000-04:00
diff --git a/extensions/codex/src/app-server/config.test.ts b/extensions/codex/src/app-server/config.test.ts
@@ -714,6 +714,23 @@ allowed_sandbox_modes = ["read-only", "workspace-write"]
         marketplaceSource: "github:example/plugins",
       },
     );
+
+    for (const value of ["0x10", "1e3"]) {
+      expectFields(
+        resolveCodexComputerUseConfig({
+          pluginConfig: {},
+          env: {
+            OPENCLAW_CODEX_COMPUTER_USE: "1",
+            OPENCLAW_CODEX_COMPUTER_USE_MARKETPLACE_DISCOVERY_TIMEOUT_MS: value,
+          },
+        }),
+        "computer use config",
+        {
+          enabled: true,
+          marketplaceDiscoveryTimeoutMs: 60_000,
+        },
+      );
+    }
   });
 
   it("allows plugin config to opt in to guardian-reviewed local execution", () => {
diff --git a/extensions/codex/src/app-server/config.ts b/extensions/codex/src/app-server/config.ts
@@ -10,6 +10,7 @@ const START_OPTIONS_KEY_SECRET_SYMBOL = Symbol.for("openclaw.codexAppServerStart
 const START_OPTIONS_KEY_SECRET = getStartOptionsKeySecret();
 const UNIX_CODEX_REQUIREMENTS_PATH = "/etc/codex/requirements.toml";
 const WINDOWS_CODEX_REQUIREMENTS_SUFFIX = "\\OpenAI\\Codex\\requirements.toml";
+const PLAIN_DECIMAL_NUMBER_RE = /^[+-]?(?:(?:\d+\.?\d*)|(?:\.\d+))$/;
 
 type CodexAppServerTransportMode = "stdio" | "websocket";
 type CodexAppServerPolicyMode = "yolo" | "guardian";
@@ -1035,10 +1036,11 @@ function readBooleanEnv(value: string | undefined): boolean | undefined {
 }
 
 function readNumberEnv(value: string | undefined): number | undefined {
-  if (value === undefined) {
+  const trimmed = value?.trim();
+  if (!trimmed || !PLAIN_DECIMAL_NUMBER_RE.test(trimmed)) {
     return undefined;
   }
-  const parsed = Number(value);
+  const parsed = Number(trimmed);
   return Number.isFinite(parsed) ? parsed : undefined;
 }
 

Original file line number	Diff line number	Diff line change
`@@ -10,6 +10,7 @@ const START_OPTIONS_KEY_SECRET_SYMBOL = Symbol.for("openclaw.codexAppServerStart`
`10`	`10`	`const START_OPTIONS_KEY_SECRET = getStartOptionsKeySecret();`
`11`	`11`	`const UNIX_CODEX_REQUIREMENTS_PATH = "/etc/codex/requirements.toml";`
`12`	`12`	`const WINDOWS_CODEX_REQUIREMENTS_SUFFIX = "\\OpenAI\\Codex\\requirements.toml";`
	`13`	`+const PLAIN_DECIMAL_NUMBER_RE = /^[+-]?(?:(?:\d+\.?\d*)\|(?:\.\d+))$/;`
`13`	`14`
`14`	`15`	`type CodexAppServerTransportMode = "stdio" \| "websocket";`
`15`	`16`	`type CodexAppServerPolicyMode = "yolo" \| "guardian";`
`@@ -1035,10 +1036,11 @@ function readBooleanEnv(value: string \| undefined): boolean \| undefined {`
`1035`	`1036`	`}`
`1036`	`1037`
`1037`	`1038`	`function readNumberEnv(value: string \| undefined): number \| undefined {`
`1038`		`- if (value === undefined) {`
	`1039`	`+ const trimmed = value?.trim();`
	`1040`	`+ if (!trimmed \|\| !PLAIN_DECIMAL_NUMBER_RE.test(trimmed)) {`
`1039`	`1041`	`return undefined;`
`1040`	`1042`	`}`
`1041`		`- const parsed = Number(value);`
	`1043`	`+ const parsed = Number(trimmed);`
`1042`	`1044`	`return Number.isFinite(parsed) ? parsed : undefined;`
`1043`	`1045`	`}`
`1044`	`1046`