fix(e2e): bound codex live assertion reads

vincentkoc · vincentkoc · commit 9b1c0dac6877 · 2026-06-07T06:15:42.000+02:00
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -42,6 +42,7 @@ Docs: https://docs.openclaw.ai
 - Release/CI/E2E: main CI guard drift, PR merge diff scoping, live Docker credential staging, base-image qualification, installer Docker classification, Playwright dependency install recovery, API-key auth for Codex live Docker lanes, Parallels option terminators, and JSON-mode progress handling are tighter so release proof fails cleaner. (#90532, #90287, #90058) Thanks @RomneyDa, @hxy91819, and @mrunalp.
 - Release/CI/E2E: Docker E2E and live Docker harness runs now apply default memory, CPU, and process ceilings while preserving explicit per-lane overrides.
 - Release/CI/E2E: plugin lifecycle matrix resource sampling now fails phases that exceed RSS, wall-clock, or CPU ceilings instead of only logging the measurements.
+- Release/CI/E2E: Codex npm plugin live assertions now cap transcript discovery and diagnostic log reads so failure proof stays bounded.
 - Tests/state isolation: provider, media, auth, cron, task, session, sandbox, Gateway, and Codex timeout fixtures now scope more home/state/env data per test, reducing cross-test leakage and making release validation failures less noisy. (#90027, #89974)
 
 ## 2026.6.2
diff --git a/scripts/e2e/codex-npm-plugin-live-docker.sh b/scripts/e2e/codex-npm-plugin-live-docker.sh
@@ -308,7 +308,7 @@ fi
 if ! grep -Fq 'Requested agent harness "codex" is not registered' /tmp/openclaw-codex-agent-after-uninstall.err &&
   ! grep -Fq 'Unknown model: codex/' /tmp/openclaw-codex-agent-after-uninstall.err; then
   echo "Unexpected post-uninstall agent error:" >&2
-  cat /tmp/openclaw-codex-agent-after-uninstall.err >&2 || true
+  tail -n 120 /tmp/openclaw-codex-agent-after-uninstall.err >&2 || true
   exit 1
 fi
 
diff --git a/scripts/e2e/lib/codex-npm-plugin-live/assertions.mjs b/scripts/e2e/lib/codex-npm-plugin-live/assertions.mjs
@@ -17,6 +17,64 @@ import {
 const command = process.argv[2];
 const allowBetaCompatDiagnostics =
   process.env.OPENCLAW_CODEX_NPM_PLUGIN_ALLOW_BETA_COMPAT_DIAGNOSTICS === "1";
+const MAX_TEXT_FILE_BYTES = readPositiveIntEnv(
+  "OPENCLAW_CODEX_NPM_PLUGIN_ASSERT_MAX_TEXT_FILE_BYTES",
+  1024 * 1024,
+);
+const MAX_ERROR_TAIL_BYTES = readPositiveIntEnv(
+  "OPENCLAW_CODEX_NPM_PLUGIN_ASSERT_MAX_ERROR_TAIL_BYTES",
+  64 * 1024,
+);
+const MAX_TRANSCRIPT_FILES = readPositiveIntEnv(
+  "OPENCLAW_CODEX_NPM_PLUGIN_ASSERT_MAX_TRANSCRIPT_FILES",
+  64,
+);
+const MAX_TRANSCRIPT_WALK_ENTRIES = readPositiveIntEnv(
+  "OPENCLAW_CODEX_NPM_PLUGIN_ASSERT_MAX_TRANSCRIPT_WALK_ENTRIES",
+  4096,
+);
+const MAX_TRANSCRIPT_SCAN_BYTES = readPositiveIntEnv(
+  "OPENCLAW_CODEX_NPM_PLUGIN_ASSERT_MAX_TRANSCRIPT_SCAN_BYTES",
+  2 * 1024 * 1024,
+);
+
+function readPositiveIntEnv(name, fallback) {
+  const text = String(process.env[name] ?? fallback).trim();
+  if (!/^\d+$/u.test(text)) {
+    throw new Error(`${name} must be a positive integer; got: ${text}`);
+  }
+  const value = Number(text);
+  if (!Number.isSafeInteger(value) || value <= 0) {
+    throw new Error(`${name} must be a positive integer; got: ${text}`);
+  }
+  return value;
+}
+
+function readTextFileBounded(filePath, label, maxBytes = MAX_TEXT_FILE_BYTES) {
+  const stat = fs.statSync(filePath);
+  if (stat.size > maxBytes) {
+    throw new Error(`${label} exceeded ${maxBytes} bytes: ${filePath}`);
+  }
+  return fs.readFileSync(filePath, "utf8");
+}
+
+function readTextFileTail(filePath, label, maxBytes = MAX_ERROR_TAIL_BYTES) {
+  if (!fs.existsSync(filePath)) {
+    return "";
+  }
+  const stat = fs.statSync(filePath);
+  if (stat.size <= maxBytes) {
+    return fs.readFileSync(filePath, "utf8");
+  }
+  const fd = fs.openSync(filePath, "r");
+  try {
+    const buffer = Buffer.alloc(maxBytes);
+    fs.readSync(fd, buffer, 0, maxBytes, stat.size - maxBytes);
+    return `[${label} truncated to last ${maxBytes} bytes]\n${buffer.toString("utf8")}`;
+  } finally {
+    fs.closeSync(fd);
+  }
+}
 
 function configure() {
   const modelRef = process.argv[3] || "codex/gpt-5.4";
@@ -255,7 +313,7 @@ function printCodexBin() {
 
 function assertPreflight() {
   const marker = process.argv[3];
-  const output = fs.readFileSync("/tmp/openclaw-codex-preflight.log", "utf8");
+  const output = readTextFileBounded("/tmp/openclaw-codex-preflight.log", "Codex preflight log");
   if (!output.includes(marker)) {
     throw new Error(`Codex CLI preflight did not contain ${marker}:\n${output}`);
   }
@@ -267,10 +325,17 @@ function listFilesRecursive(root) {
   }
   const files = [];
   const stack = [root];
+  let visited = 0;
   while (stack.length > 0) {
     const current = stack.pop();
     const entries = fs.readdirSync(current, { withFileTypes: true });
     for (const entry of entries) {
+      visited += 1;
+      if (visited > MAX_TRANSCRIPT_WALK_ENTRIES) {
+        throw new Error(
+          `native Codex session transcript walk exceeded ${MAX_TRANSCRIPT_WALK_ENTRIES} entries under ${root}`,
+        );
+      }
       const fullPath = path.join(current, entry.name);
       if (entry.isDirectory()) {
         stack.push(fullPath);
@@ -284,21 +349,29 @@ function listFilesRecursive(root) {
 
 function assertNativeCodexSessionEvidence(params) {
   const roots = params.roots.filter((root) => fs.existsSync(root));
-  const files = roots.flatMap((root) =>
-    listFilesRecursive(root).filter((filePath) => filePath.endsWith(".jsonl")),
-  );
+  const files = roots
+    .flatMap((root) => listFilesRecursive(root).filter((filePath) => filePath.endsWith(".jsonl")))
+    .map((filePath) => ({ filePath, stat: fs.statSync(filePath) }))
+    .toSorted((left, right) => right.stat.mtimeMs - left.stat.mtimeMs)
+    .slice(0, MAX_TRANSCRIPT_FILES);
   if (files.length === 0) {
     throw new Error(
       `missing native Codex session transcript files; checked ${params.roots.join(", ")}`,
     );
   }
-  const matchingFile = files.find((filePath) => {
-    const content = fs.readFileSync(filePath, "utf8");
+  let scannedBytes = 0;
+  const matchingFile = files.find(({ filePath, stat }) => {
+    const readableBytes = Math.min(stat.size, MAX_TEXT_FILE_BYTES);
+    if (scannedBytes + readableBytes > MAX_TRANSCRIPT_SCAN_BYTES) {
+      return false;
+    }
+    scannedBytes += readableBytes;
+    const content = readTextFileTail(filePath, "native Codex session transcript", readableBytes);
     return content.includes(params.marker) || content.includes(params.threadId);
-  });
+  })?.filePath;
   if (!matchingFile) {
     throw new Error(
-      `native Codex session transcripts did not contain ${params.marker} or ${params.threadId}; checked ${files.join(", ")}`,
+      `native Codex session transcripts did not contain ${params.marker} or ${params.threadId}; scanned ${scannedBytes} bytes across ${files.length} newest files: ${files.map((entry) => entry.filePath).join(", ")}`,
     );
   }
   assertPathInside(params.codexHome, matchingFile, "native Codex session transcript");
@@ -308,10 +381,8 @@ function assertAgentTurn() {
   const marker = process.argv[3];
   const sessionId = process.argv[4];
   const modelRef = process.argv[5];
-  const stdout = fs.readFileSync("/tmp/openclaw-codex-agent.json", "utf8");
-  const stderr = fs.existsSync("/tmp/openclaw-codex-agent.err")
-    ? fs.readFileSync("/tmp/openclaw-codex-agent.err", "utf8")
-    : "";
+  const stdout = readTextFileBounded("/tmp/openclaw-codex-agent.json", "OpenClaw agent JSON");
+  const stderr = readTextFileTail("/tmp/openclaw-codex-agent.err", "OpenClaw agent stderr");
   const response = JSON.parse(stdout);
   const text = extractAgentReplyTexts(JSON.stringify(response)).join("\n");
   if (!text.includes(marker)) {
@@ -405,10 +476,16 @@ function assertAgentError() {
     );
   }
   const stdout = fs.existsSync("/tmp/openclaw-codex-agent-after-uninstall.json")
-    ? fs.readFileSync("/tmp/openclaw-codex-agent-after-uninstall.json", "utf8")
+    ? readTextFileTail(
+        "/tmp/openclaw-codex-agent-after-uninstall.json",
+        "post-uninstall agent stdout",
+      )
     : "";
   const stderr = fs.existsSync("/tmp/openclaw-codex-agent-after-uninstall.err")
-    ? fs.readFileSync("/tmp/openclaw-codex-agent-after-uninstall.err", "utf8")
+    ? readTextFileTail(
+        "/tmp/openclaw-codex-agent-after-uninstall.err",
+        "post-uninstall agent stderr",
+      )
     : "";
   const combined = `${stdout}\n${stderr}`;
   if (
diff --git a/test/scripts/docker-build-helper.test.ts b/test/scripts/docker-build-helper.test.ts
@@ -37,6 +37,8 @@ const KITCHEN_SINK_RPC_DOCKER_E2E_PATH = "scripts/e2e/kitchen-sink-rpc-docker.sh
 const CODEX_ON_DEMAND_DOCKER_E2E_PATH = "scripts/e2e/codex-on-demand-docker.sh";
 const CODEX_MEDIA_PATH_SCENARIO_PATH = "scripts/e2e/lib/codex-media-path/scenario.sh";
 const CODEX_NPM_PLUGIN_LIVE_DOCKER_E2E_PATH = "scripts/e2e/codex-npm-plugin-live-docker.sh";
+const CODEX_NPM_PLUGIN_LIVE_ASSERTIONS_PATH =
+  "scripts/e2e/lib/codex-npm-plugin-live/assertions.mjs";
 const LIVE_PLUGIN_TOOL_DOCKER_E2E_PATH = "scripts/e2e/live-plugin-tool-docker.sh";
 const NPM_ONBOARD_CHANNEL_AGENT_DOCKER_E2E_PATH = "scripts/e2e/npm-onboard-channel-agent-docker.sh";
 const SKILL_INSTALL_DOCKER_E2E_PATH = "scripts/e2e/skill-install-docker.sh";
@@ -1822,6 +1824,27 @@ test -f "$TMPDIR/docker-cmd-seen"
     expect(runner).not.toContain('rm -f "$run_log"\n  exit 1');
   });
 
+  it("bounds Codex npm plugin live assertion file and transcript reads", () => {
+    const assertions = readFileSync(CODEX_NPM_PLUGIN_LIVE_ASSERTIONS_PATH, "utf8");
+    const runner = readFileSync(CODEX_NPM_PLUGIN_LIVE_DOCKER_E2E_PATH, "utf8");
+
+    expect(assertions).toContain("OPENCLAW_CODEX_NPM_PLUGIN_ASSERT_MAX_TEXT_FILE_BYTES");
+    expect(assertions).toContain("OPENCLAW_CODEX_NPM_PLUGIN_ASSERT_MAX_ERROR_TAIL_BYTES");
+    expect(assertions).toContain("OPENCLAW_CODEX_NPM_PLUGIN_ASSERT_MAX_TRANSCRIPT_FILES");
+    expect(assertions).toContain("OPENCLAW_CODEX_NPM_PLUGIN_ASSERT_MAX_TRANSCRIPT_WALK_ENTRIES");
+    expect(assertions).toContain("OPENCLAW_CODEX_NPM_PLUGIN_ASSERT_MAX_TRANSCRIPT_SCAN_BYTES");
+    expect(assertions).toContain("readTextFileBounded");
+    expect(assertions).toContain("readTextFileTail");
+    expect(assertions).toContain(
+      ".toSorted((left, right) => right.stat.mtimeMs - left.stat.mtimeMs)",
+    );
+    expect(assertions).toContain(".slice(0, MAX_TRANSCRIPT_FILES)");
+    expect(assertions).toContain("scannedBytes + readableBytes > MAX_TRANSCRIPT_SCAN_BYTES");
+    expect(assertions).not.toContain('const content = fs.readFileSync(filePath, "utf8")');
+    expect(runner).toContain("tail -n 120 /tmp/openclaw-codex-agent-after-uninstall.err");
+    expect(runner).not.toContain("cat /tmp/openclaw-codex-agent-after-uninstall.err");
+  });
+
   it("cleans package-backed onboarding and plugin Docker artifacts on every exit path", () => {
     for (const path of [
       CODEX_ON_DEMAND_DOCKER_E2E_PATH,
