fix(codex): keep doctor sidecar scan inside stateDir

steipete · steipete · commit 641cd40dbe72 · 2026-07-06T23:32:58.000+01:00
diff --git a/extensions/codex/doctor-contract-api.test.ts b/extensions/codex/doctor-contract-api.test.ts
@@ -226,6 +226,37 @@ describe("codex doctor contract", () => {
     await fs.rm(stateDir, { recursive: true, force: true });
   });
 
+  it("does not scan above stateDir when a session store sits at its parent", async () => {
+    const outerDir = await fs.mkdtemp(path.join(os.tmpdir(), "openclaw-codex-doctor-outer-"));
+    const stateDir = path.join(outerDir, "state");
+    await fs.mkdir(stateDir, { recursive: true });
+    const strayDir = path.join(outerDir, "unrelated");
+    await fs.mkdir(strayDir, { recursive: true });
+    await fs.writeFile(
+      path.join(strayDir, "foreign.jsonl.codex-app-server.json"),
+      JSON.stringify({ schemaVersion: 2, threadId: "thread-foreign" }),
+      "utf8",
+    );
+    const env = { ...process.env, OPENCLAW_STATE_DIR: stateDir };
+    const params = {
+      // The store dir is exactly the parent of stateDir; doctor must treat it
+      // as an external store (indexed reads only), not a scannable state root.
+      config: { session: { store: path.join(outerDir, "sessions.json") } },
+      env,
+      stateDir,
+      oauthDir: path.join(stateDir, "oauth"),
+      context: createDoctorContext(env),
+    };
+    const migration = stateMigrations[0];
+    if (!migration) {
+      throw new Error("missing Codex binding migration");
+    }
+
+    await expect(migration.detectLegacyState(params)).resolves.toBeNull();
+
+    await fs.rm(outerDir, { recursive: true, force: true });
+  });
+
   it("renames old approval-routed destructive plugin policy values", () => {
     const original = {
       plugins: {
diff --git a/extensions/codex/src/app-server/session-binding.ts b/extensions/codex/src/app-server/session-binding.ts
@@ -585,6 +585,10 @@ export function createCodexAppServerBindingStore(
             },
           };
         },
+        // Plain clears may expire immediately: a stale generation that re-sets
+        // the key afterwards is fenced by ownsStoredSessionGeneration on read
+        // and displaced via reclaim-generation; durable stable-key fences come
+        // from retireSessionGeneration, not runtime clears.
         mutation.kind === "clear" && !retainLegacyClear && !leaseContext.getStore()?.has(key)
           ? 1
           : undefined,
diff --git a/extensions/codex/src/migration/session-binding-sidecars.ts b/extensions/codex/src/migration/session-binding-sidecars.ts
@@ -492,7 +492,12 @@ async function isRegularFile(filePath: string): Promise<boolean> {
 
 function isPathWithin(root: string, candidate: string): boolean {
   const relative = path.relative(root, candidate);
-  return relative === "" || (!relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative));
+  // Bare ".." (candidate is root's parent) must stay outside; treating it as
+  // inside would let doctor recursively scan the whole tree above stateDir.
+  return (
+    relative === "" ||
+    (relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative))
+  );
 }
 
 async function canonicalizePath(filePath: string): Promise<string> {
