fix: keep exec auto-review bound to exact approvals#103430
Conversation
openclaw-barnacle
Bot
added
docs
0f8665b to
4983347
Compare
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0f8665b851
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if (decision.decision !== "allow-once" || decision.risk !== "low") { | ||
| return undefined; | ||
| } |
There was a problem hiding this comment.
When tools.exec.mode=auto is used through the Codex app-server bridge, this branch now treats any low-risk allow-once as enough to return approved-once, but buildAppServerExecAutoReviewInput() still delegates to buildExecAutoReviewInputForShellCommand() without supplying resolvedPath or an enforced command. For a bare command such as git status, the reviewer can approve based only on argv while Codex resumes execution using the app-server environment/PATH, bypassing the exact executable binding that the gateway path now enforces; fail closed here unless the input is bound to the executable that Codex will run.
Useful? React with 👍 / 👎.
|
Merged via squash.
|
(cherry picked from commit 9d4fb60)
1 participant
Closes #103427
AI-assisted: Codex implementation with independent sub-agent audits and repo-native autoreview.
What Problem This Solves
Fixes an issue where operators using exec auto-review could receive an automatic approval whose resolved executable, completion state, risk classification, cancellation state, or Codex approval correlation did not exactly match the command reaching execution policy.
Why This Change Was Made
Automatic approvals now require a completed low-risk review for a single resolved executable and execute the enforced, path-pinned command. Ambiguous plans, unsupported reviewer results, non-low risk, cancellation, unsafe prompt content, and untrusted Codex reviewer configuration all fail closed to human approval; Codex execve subapprovals retain their unique approval IDs.
User Impact
Exec auto-review remains automatic for clearly resolved low-risk commands. Commands that cannot be bound to an exact executable or exact approval result now ask a human instead of inheriting a permissive fallback, and Codex Guardian applies each subcommand approval independently.
Evidence
run_02efe2986693).run_161c39fcc526).run_cb3e92431e05).test:changedcleared thousands of unit/contract/tooling/gateway tests before one unrelated gateway crash-loop timing case stalled under full-shard load; that entire file passed 96/96 in isolation (run_758d43581a0e).