Codex review: needs real behavior proof before merge.

Summary
The PR adds Canvas snapshot response format allowlisting, JPEG extension normalization, temp path part validation, and focused Canvas helper/CLI/tool regression tests.

Reproducibility: yes. Source inspection on current main shows a mocked canvas.snapshot response with a path-like format reaches CLI and tool temp-file construction; I did not execute tests in this read-only review.

Real behavior proof
Needs real behavior proof before merge: The PR body provides targeted test output only and says live Canvas was not tested; the contributor should add redacted live runtime proof and update the PR body for automatic re-review or ask a maintainer to comment @clawsweeper re-review.

Next step before merge
This focused PR needs contributor real behavior proof and protected-label maintainer handling rather than an automated code repair.

Security
Cleared: The diff narrows Canvas snapshot file-path construction and adds regression coverage without new dependencies, permissions, network calls, secrets handling, or code execution paths.

Not applicable to this automation stage; changelog/release-note and external real behavior proof requirements are handled outside auto-pr stages.

Quoted comment from @clawsweeper:

Codex review: needs real behavior proof before merge.

Summary
The PR adds Canvas snapshot response format allowlisting, normalizes JPEG file extensions, rejects unsafe snapshot temp path parts, and adds helper, CLI, and tool regression tests.

Reproducibility: yes. Source inspection gives a high-confidence reproduction path: on current main, a mocked canvas.snapshot response with a path-like format reaches both CLI and tool temp-path construction; I did not execute tests in this read-only review.

Real behavior proof
Needs real behavior proof before merge: The body provides only targeted test output and says live Canvas was not tested; add redacted real runtime proof, then update the PR body to trigger ClawSweeper or ask @clawsweeper re-review.

Next step before merge
No repair job: the patch looks focused, but the protected label and mock-only proof require contributor evidence and maintainer handling rather than automated code repair.

Security
Cleared: The diff narrows Canvas snapshot file-path construction and adds regression coverage without new dependencies, permissions, network calls, secrets handling, or code execution paths.

Review details

Best possible solution:

Land the owner-local Canvas validation after maintainer review and redacted real runtime proof that unsupported snapshot response formats fail before file creation in the Canvas flow.

Do we have a high-confidence way to reproduce the issue?

Yes. Source inspection gives a high-confidence reproduction path: on current main, a mocked canvas.snapshot response with a path-like format reaches both CLI and tool temp-path construction; I did not execute tests in this read-only review.

Is this the best way to solve the issue?

Yes for the code direction. Inbound allowlisting plus temp path part validation in the Canvas plugin helper is the narrow maintainable fix, with merge gated on real behavior proof and maintainer handling.

What I checked:

• Current main accepts arbitrary Canvas snapshot formats in the CLI helper: parseCanvasSnapshotPayload accepts any non-empty string format, and canvasSnapshotTempPath turns the caller-supplied extension into the output suffix without an allowlist. (extensions/canvas/src/cli-helpers.ts:12, 386d321634b3)
• Current main repeats the permissive path in the Canvas tool: The tool-local parser accepts any string format, writeBase64ToTempFile uses it as the file extension, and the snapshot path passes payload.format into that helper. (extensions/canvas/src/tool.ts:62, 386d321634b3)
• Documented snapshot surface is a Canvas { format, base64 } response with CLI png/jpg options: Docs describe canvas.snapshot as returning { format, base64 }, while the CLI exposes supported --format png and --format jpg snapshot flows. Public docs: docs/nodes/index.md. (docs/nodes/index.md:219, 386d321634b3)
• PR diff narrows the affected Canvas helper and test paths: The diff adds png/jpg/jpeg validation, normalizes jpeg to jpg for filenames, validates snapshot IDs, and adds tests that reject path-like returned formats before CLI writes or tool image result creation. (extensions/canvas/src/cli-helpers.ts:5, be904b6fa8eb)
• PR metadata requires human/proof follow-up: The live PR metadata shows the protected maintainer label; the PR body says the live paired Canvas node flow was not tested and provides only targeted repository test output. (be904b6fa8eb)
• Feature history points to the current Canvas snapshot helper author: Blame on the current helper/tool lines attributes the Canvas snapshot parsing and temp-file construction code to commit f3f6a86; the GitHub commit API maps that commit to vincentkoc. (extensions/canvas/src/cli-helpers.ts:12, f3f6a866cae1)

Likely related people:

• vincentkoc: Current-main blame attributes the Canvas snapshot helper and tool parsing/temp-file code to f3f6a86, and the GitHub commit API maps that commit to this login. (role: recent area contributor; confidence: medium; commits: f3f6a866cae1; files: extensions/canvas/src/cli-helpers.ts, extensions/canvas/src/tool.ts)

Remaining risk / open question:

• Real behavior proof is mock/test-only: the PR body explicitly says a live paired Canvas node snapshot flow was not tested.
• The PR changes behavior for non-standard Canvas nodes that return formats outside png/jpg/jpeg; that looks intentional but should be maintainer-accepted before merge.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 386d321634b3.