Best possible solution:

Land this maintainer-labeled PR after owner review accepts the compatibility/security-boundary change and relevant CI is green, then close or supersede the older overlapping policy PR so only one Google Meet chrome-node policy path remains.

Do we have a high-confidence way to reproduce the issue?

Yes, at source level. Current main appends the macOS Chrome URL after --args for profiled launches and forwards googlemeet.chrome params without a plugin policy; I did not run the live macOS paired-node flow in this read-only review.

Is this the best way to solve the issue?

Yes, this appears to be the best fix shape: Google Meet owns the command policy, the gateway already has the pre-dispatch policy hook, and the macOS argument fix lives at the node-host launch point. The remaining question is maintainer acceptance of the intentional compatibility/security-boundary change.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 6830aa39eaa1.

Label justifications:

• P2: This is a bounded Google Meet chrome-node bug/security hardening PR with limited blast radius and no evidence of an active widespread outage.
• merge-risk: 🚨 compatibility: Direct googlemeet.chrome node invocations that previously supplied launch/profile/audio helper overrides can behave differently after the policy rewrite.
• merge-risk: 🚨 security-boundary: The PR changes where executable node-host command arrays are trusted and enforced before a paired node runs them.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The PR is protected with the maintainer label, so the external-contributor proof gate is not applied; the body still reports live macOS Google Meet proof in prose and GitHub's real-behavior-proof check passed.

PR surface:

Source +200, Tests +184. Total +384 across 7 files.

What I checked:

• Repository policy read: Root and extensions scoped AGENTS.md were read and applied because this PR touches a bundled plugin, plugin SDK node-invoke policy, compatibility, and security-boundary behavior. (AGENTS.md:1, 6830aa39eaa1)
• Current main lacks the Google Meet policy: Current main registers googlemeet.chrome as a node-host command without dangerous: true and without a matching plugin node.invoke policy, so the PR is not obsolete on main. (extensions/google-meet/index.ts:1198, 6830aa39eaa1)
• Current main has the launch-order issue: Current main appends the Meet URL after --args, so a profiled macOS Chrome launch can pass the URL as an app argument instead of the URL to open. (extensions/google-meet/src/node-host.ts:334, 6830aa39eaa1)
• PR policy narrows forwarded start parameters: The PR head normalizes the Meet URL, rejects unsupported start modes, and forwards launch/profile/audio command parameters from resolved Google Meet config rather than caller-supplied executable arrays. (extensions/google-meet/src/node-invoke-policy.ts:43, 70e7219db271)
• Gateway policy contract checked: Gateway node.invoke applies plugin node.invoke policy after global allowlist checks and before raw node transport dispatch, with a fail-closed path for dangerous plugin node-host commands that lack policy. (src/gateway/server-methods/nodes.ts:1447, 6830aa39eaa1)
• Tests cover the new boundary: The PR adds tests for config-owned executable fields, trusted bridge commands, non-Meet URL rejection, setup sanitization, unsupported action rejection, and macOS URL-before-profile launch order. (extensions/google-meet/src/node-invoke-policy.test.ts:27, 70e7219db271)

Likely related people:

• steipete: Live GitHub history shows repeated Google Meet chrome-node/runtime maintenance and node policy documentation work near the affected files. (role: feature owner and recent area contributor; confidence: high; commits: 96e581242605, b13e9f186491, 2b45a112cb65; files: extensions/google-meet/src/node-host.ts, extensions/google-meet/src/transports/chrome.ts, src/gateway/node-invoke-plugin-policy.ts)
• BsnizND: Merged history includes chrome-node bridge cleanup, realtime interruption playback, and gateway-owned tool session fixes in the same Google Meet node-host/runtime area. (role: recent Google Meet chrome-node contributor; confidence: high; commits: f2a17b299119, 2785be2604d9, 916eda16c19f; files: extensions/google-meet/src/node-host.ts, extensions/google-meet/src/transports/chrome.ts, extensions/google-meet/index.test.ts)
• pgondhi987: Live history shows work on gateway approval access and node-invoke policy plumbing, which is the generic security boundary this Google Meet policy uses. (role: adjacent gateway policy contributor; confidence: medium; commits: 386d321634b3; files: src/gateway/node-invoke-plugin-policy.ts, src/plugins/types.ts)

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.