fix(codex): require admin for native controls by eleqtrizit · Pull Request #97952 · openclaw/openclaw

eleqtrizit · 2026-06-29T23:19:36Z

Summary

What Problem This Solves

Sensitive native Codex controls did not consistently consume the owner/admin authorization facts already available to the command and bound-conversation paths.

Why This Change Was Made

Native execution and binding mutation should follow the existing privileged-control boundary while read-only status, help, and invalid-usage responses remain available.

Changes

Rebase onto merged fix(codex): restrict computer-use installation #97955 and reuse its canonical canMutateCodexHost owner-or-operator.admin predicate.
Preserve fix(codex): restrict computer-use installation #97955's /codex computer-use install authorization and documentation unchanged.
Require current owner identity or operator.admin scope for native Codex execution, control, binding, and detach operations.
Recheck current sender authority before every bound Codex turn.
Return an explicit denial for command-authorized, non-empty blocked bound turns while preserving silent handling for unauthorized and empty traffic.
Carry the canonical current owner/admin decision through the generic inbound-claim event without exposing raw Gateway scopes.
Document the native-control authorization boundary.
Regenerate docs/docs_map.md after rebasing onto current main.
Add regression coverage for denied side effects, owner/admin allowance, current-sender propagation, visible denial, silent unauthorized handling, and read-only status access.

Validation

Evidence

node scripts/run-vitest.mjs extensions/codex/src/commands.test.ts extensions/codex/src/conversation-binding.test.ts src/auto-reply/reply/dispatch-from-config.test.ts src/auto-reply/command-auth.owner-default.test.ts — 4 files, 391 tests passed across 3 shards.
node scripts/generate-docs-map.mjs --check — generated docs map is current.
node scripts/check-src-extension-import-boundary.mjs --json — no violations.
node scripts/check-sdk-package-extension-import-boundary.mjs --json — no violations.
node scripts/check-test-helper-extension-import-boundary.mjs --json — no violations.
node scripts/format-docs.mjs --check — 670 files clean.
node scripts/check-docs-mdx.mjs docs README.md — 686 files passed.
node scripts/docs-link-audit.mjs — 5,494 internal links checked, zero broken.
git diff --check — passed.
Structured Codex autoreview after the docs and hook-contract refinement — clean, no accepted/actionable findings (0.94 confidence).
Existing real stdio child-process proof remains attached with its original proof SHA and current-head alignment notes.

Notes

User Impact

Owners and operator.admin callers retain native Codex control. Ordinary command-authorized senders can still use read-only/status surfaces but cannot start, mutate, detach, or drive native Codex execution. Command-authorized, non-empty blocked bound turns explain the owner/admin requirement; ordinary unauthorized or empty bound traffic remains silently handled.

Maintainer acceptance: the fail-closed access change and the single optional senderIsOwner inbound-claim field are intentional. Command authorization alone must not grant native Codex control, and the prepared owner/admin decision is required to recheck authority at bound-turn time. Raw gatewayClientScopes are not added to the hook event.

pnpm docs:list was attempted but pnpm aborted an interactive modules-directory reconciliation in the non-TTY checkout. The underlying generated-map, formatting, MDX, and link checks were run directly and passed.

AI-assisted change; I reviewed the implementation and validation results.

clawsweeper · 2026-06-29T23:20:40Z

Codex review: needs maintainer review before merge. Reviewed June 29, 2026, 11:31 PM ET / 03:31 UTC.

Summary
The PR gates mutating Codex native commands and bound native turns on owner or operator.admin authority, adds a prepared senderIsOwner inbound-claim fact, updates docs, and adds regression coverage.

PR surface: Source +40, Tests +153, Docs +14. Total +207 across 10 files.

Reproducibility: yes. at source level: current main routes mutating /codex native controls and command-authorized bound turns toward native execution without rechecking the owner/operator.admin predicate. I did not run tests because this review was read-only, but the changed paths and regression tests are clear from source and PR-head inspection.

Review metrics: 2 noteworthy metrics.

Native Codex control gates: 2 entry surfaces restricted. Both slash-command native controls and bound conversation native turns now fail closed for non-owner, non-admin callers, which is the core compatibility and security decision.
Plugin hook event surface: 1 optional field added. The new senderIsOwner inbound-claim fact is additive, but plugin API surface changes need maintainer-visible compatibility review.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🐚 platinum hermit
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

none.

Risk before merge

[P1] Merging intentionally removes existing native Codex control access for command-authorized senders who are not the owner and do not hold operator.admin; existing setups using that broader access will receive an authorization denial instead.
[P1] Bound Codex turns now depend on a newly propagated current senderIsOwner fact, so owner configuration or internal-scope mismatches can suppress native bound-turn execution and deliver the denial rather than starting a Codex turn.

Maintainer options:

Accept the fail-closed native-control boundary (recommended)
Maintainers can merge after explicitly accepting that non-owner, non-admin command-authorized callers lose mutating native Codex command and bound-turn access while owners and operator.admin callers remain supported.
Preserve current access until a policy switch exists
If that compatibility break is not acceptable, require a compatibility-preserving default or maintainer-approved migration path before merging the stricter gate.
Pause for plugin-hook API ownership
If senderIsOwner should not be added to PluginHookInboundClaimEvent without broader SDK discussion, pause this PR and decide the permanent hook contract first.

Next step before merge

[P2] Manual maintainer review is required because the PR has a protected maintainer label and intentionally changes existing native Codex access semantics.

Security
Cleared: The diff tightens Codex native execution authorization and adds no dependencies, workflow changes, package scripts, downloaded code, secrets handling, or raw gateway-scope exposure.

Review details

Best possible solution:

Land a maintainer-approved version that explicitly accepts the fail-closed owner/operator.admin boundary, keeps read-only Codex status surfaces available, and treats the senderIsOwner inbound-claim field as the intended narrow plugin API extension.

Do we have a high-confidence way to reproduce the issue?

Yes, at source level: current main routes mutating /codex native controls and command-authorized bound turns toward native execution without rechecking the owner/operator.admin predicate. I did not run tests because this review was read-only, but the changed paths and regression tests are clear from source and PR-head inspection.

Is this the best way to solve the issue?

Yes, this is the best inspected fix shape: it reuses the existing canMutateCodexHost boundary and carries only a prepared owner/admin fact into the bound-turn hook. A lower app-server-wide gate or compatibility mode would be broader product/API work rather than a narrower repair.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 54b09580f61b.

Label changes

Label changes:

add P0: The PR addresses a security authorization boundary where command-authorized non-owner callers could control native Codex execution paths.
add proof: sufficient: Contributor real behavior proof is sufficient. The PR comment includes redacted terminal output showing after-fix denial before native startup for a non-admin caller and successful operator.admin binding plus turn/start through a real stdio app-server-protocol child process, with current-head alignment notes.
add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🦞 diamond lobster.
add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR comment includes redacted terminal output showing after-fix denial before native startup for a non-admin caller and successful operator.admin binding plus turn/start through a real stdio app-server-protocol child process, with current-head alignment notes.
remove P2: Current review triage priority is P0, so this older priority label is no longer current.

Label justifications:

P0: The PR addresses a security authorization boundary where command-authorized non-owner callers could control native Codex execution paths.
merge-risk: 🚨 compatibility: The patch deliberately changes existing non-owner, non-admin native Codex control behavior from allowed to denied.
merge-risk: 🚨 message-delivery: The bound conversation path can now consume a command-authorized message with an authorization denial instead of delivering it to Codex native execution.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🦞 diamond lobster.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR comment includes redacted terminal output showing after-fix denial before native startup for a non-admin caller and successful operator.admin binding plus turn/start through a real stdio app-server-protocol child process, with current-head alignment notes.
proof: sufficient: Contributor real behavior proof is sufficient. The PR comment includes redacted terminal output showing after-fix denial before native startup for a non-admin caller and successful operator.admin binding plus turn/start through a real stdio app-server-protocol child process, with current-head alignment notes.

Evidence reviewed

PR surface:

Source +40, Tests +153, Docs +14. Total +207 across 10 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	5	47	7	+40
Tests	3	155	2	+153
Docs	2	14	0	+14
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	10	216	9	+207

What I checked:

Repository policy applied: Read the full root AGENTS.md plus scoped extensions, docs, and src/plugins guidance; the review applied the Codex dependency-source hard gate, whole-path review, plugin API compatibility, docs, and merge-risk guidance. (AGENTS.md:13, 54b09580f61b)
Current main lacks the native-control owner/admin gate: Current main dispatches native Codex subcommands after only sandbox checks; the owner/admin predicate is not applied to bind, resume, stop, steer, model, fast, permissions, compact, review, detach, or unbind on this path. (extensions/codex/src/command-handlers.ts:381, 54b09580f61b)
Current main allows bound Codex turns after command authorization only: The bound conversation inbound claim currently proceeds from commandAuthorized plus non-empty prompt to native execution checks without rechecking current owner/admin authority. (extensions/codex/src/conversation-binding.ts:240, 54b09580f61b)
PR gates mutating native command controls: At head c5fbd59, the command handler adds CODEX_NATIVE_CONTROL_SUBCOMMANDS and returns the shared native-control auth denial before sandbox/native execution for non-owner, non-admin callers while leaving early-return usage/status paths intact. (extensions/codex/src/command-handlers.ts:236, c5fbd59476bf)
PR gates bound native turns and preserves silent non-command handling: At head c5fbd59, bound inbound claims still silently consume unauthorized or empty traffic, but command-authorized non-empty turns require canMutateCodexHost before any native Codex turn can start. (extensions/codex/src/conversation-binding.ts:241, c5fbd59476bf)
PR carries only prepared owner/admin fact through plugin hook: The dispatch path recomputes command authorization at bound-turn time and passes senderIsOwner to the targeted plugin inbound-claim event without exposing raw gatewayClientScopes. (src/auto-reply/reply/dispatch-from-config.ts:2152, c5fbd59476bf)

Likely related people:

eleqtrizit: Authored and merged the current-main PR that introduced the shared Codex host-mutation predicate reused here, and is the current PR author with prior merged history on this exact authorization helper. (role: recent adjacent owner; confidence: high; commits: e87b0df67575, c5fbd59476bf; files: extensions/codex/src/command-authorization.ts, extensions/codex/src/command-handlers.ts, extensions/codex/src/command-plugins-management.ts)
jesse-merhi: Recent history on the Codex command and bound app-server runtime path includes bound agent exec host policy and session override work near the native-control surface. (role: recent bound-runtime contributor; confidence: medium; commits: 804e5f21d1b5; files: extensions/codex/src/command-handlers.ts, extensions/codex/src/conversation-binding.ts)
vincentkoc: Recent commits touched Codex conversation binding and app-server runtime policy around network proxies, service tiers, provider preservation, and owner-sensitive execution behavior. (role: recent Codex binding contributor; confidence: medium; commits: 8afc1f770bbe, 5c3469549159, b4cdd9211957; files: extensions/codex/src/conversation-binding.ts, extensions/codex/src/command-handlers.ts)
kevinslin: Authored the sibling /codex plugins management surface and owner-or-operator.admin write gate that current main and this PR use as the authorization pattern. (role: adjacent authorization owner; confidence: high; commits: 9b97e1ef2fd2, e82d19fb06b5, c5d34c8376f8; files: extensions/codex/src/command-plugins-management.ts, extensions/codex/src/command-plugins-management.test.ts, extensions/codex/src/commands.test.ts)
fuller-stack-dev: Most recent live history on src/auto-reply/reply/dispatch-from-config.ts changed durable delivery behavior adjacent to the bound-plugin dispatch path touched here. (role: recent auto-reply dispatch contributor; confidence: medium; commits: 455f813d6ee6; files: src/auto-reply/reply/dispatch-from-config.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

eleqtrizit · 2026-06-29T23:38:42Z

Behavioral proof and post-merge alignment update for head c5fbd59476bf0a8710760531fb9eebe9dba531e9 (2026-06-30 UTC)

The original runtime proof was recorded at pre-rebase head c68e6974a6b583be6be097fd6453282a3ba61f4c. It exercised the production Codex command handler and bound inbound-claim gate against a real stdio child process implementing the Codex app-server protocol. The child process records protocol requests and creates a native-turn marker only after receiving turn/start with the expected execution policy. This is runtime/side-effect proof, not a mocked-client assertion.

Redacted terminal output from that run:

{
  "nonAdminOperatorWrite": {
    "bindReply": "Only an owner or operator.admin can control Codex native execution.",
    "appServerStarted": false,
    "inboundClaim": { "handled": true },
    "nativeMarkerCreated": false
  },
  "operatorAdmin": {
    "bindReply": "Bound this conversation to Codex thread thread-proof in <temp>.",
    "nativeTurn": {
      "turn": { "id": "turn-proof-1", "status": "inProgress", "items": [] }
    },
    "nativeMarker": {
      "approvalPolicy": "never",
      "sandboxPolicy": { "type": "dangerFullAccess" },
      "childProcess": true
    },
    "appServerMethods": [
      "initialize",
      "initialized",
      "thread/start",
      "turn/start"
    ]
  }
}

What this demonstrates:

A command-authorized non-owner with only operator.write is rejected before native process startup for /codex bind.
The same non-admin identity cannot drive an existing bound conversation into the native client: no turn/start occurs and no marker is created.
An operator.admin caller can still bind and drive the native path end to end through a real child process.

Current-head alignment and review resolutions:

Rebasing onto merged fix(codex): restrict computer-use installation #97955 preserved its /codex computer-use install gate and canonical canMutateCodexHost owner-or-operator.admin predicate.
Native controls and bound turns reuse that predicate instead of maintaining divergent policy.
Command-authorized, non-empty blocked bound turns return the explicit owner/admin denial; unauthorized and empty bound traffic remains silently handled.
The Codex harness docs describe the privileged native-control boundary.
docs/docs_map.md was regenerated after rebasing onto current main; the exact generated-map check passes.
The inbound-claim expansion is reduced from two optional fields to one: core passes the canonical senderIsOwner decision, which already folds internal operator.admin authority into the prepared fact. Raw gatewayClientScopes remain inside core/direct command contexts and are not exposed on the hook event.

Focused current-head validation:

node scripts/run-vitest.mjs extensions/codex/src/commands.test.ts extensions/codex/src/conversation-binding.test.ts src/auto-reply/reply/dispatch-from-config.test.ts src/auto-reply/command-auth.owner-default.test.ts

Test Files  1 passed (1)
Tests       8 passed (8)
Test Files  1 passed (1)
Tests       226 passed (226)
Test Files  2 passed (2)
Tests       157 passed (157)
[test] passed 3 Vitest shards

Additional current-head validation:

node scripts/generate-docs-map.mjs --check: passed.
Three extension/core import-boundary inventories: no violations.
Docs formatting: 670 files clean.
Docs MDX: 686 files passed.
Internal docs links: 5,494 checked, zero broken.
git diff --check: passed.
Structured Codex autoreview: clean, no accepted/actionable findings (0.94 confidence).

Maintainer risk acceptance:

The fail-closed compatibility change is intentional: command authorization alone must not grant native Codex control or bound-turn execution. Existing non-owner/non-admin callers lose that mutating access; owners and callers holding operator.admin remain supported.
The single optional senderIsOwner hook field is an additive, generic prepared fact required to recheck current authority before a bound turn. It is preferable to an untyped metadata value or Codex policy in core.
The explicit denial for command-authorized blocked turns is intentional user feedback. Unauthorized and empty traffic remains silently consumed, so the prior message-delivery regression is fixed.

eleqtrizit · 2026-06-29T23:38:55Z

@clawsweeper re-review

clawsweeper · 2026-06-29T23:38:57Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

eleqtrizit · 2026-06-30T00:31:49Z

@clawsweeper re-review

clawsweeper · 2026-06-30T00:31:52Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

eleqtrizit · 2026-06-30T00:58:38Z

@clawsweeper re-review

clawsweeper · 2026-06-30T00:58:41Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Gate Codex native session controls and bound turns on current owner or operator.admin authority. Preserve gateway scope precedence and read-only status behavior.

eleqtrizit · 2026-06-30T01:33:02Z

@clawsweeper re-review

clawsweeper · 2026-06-30T01:33:05Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

* fix(codex): require admin for native controls Gate Codex native session controls and bound turns on current owner or operator.admin authority. Preserve gateway scope precedence and read-only status behavior. * fix(codex): align native authorization * fix(codex): preserve silent bound handling * fix(codex): narrow bound auth contract * fix(docs): refresh generated docs map

openclaw-barnacle Bot added extensions: codex size: M maintainer Maintainer-authored PR labels Jun 29, 2026

eleqtrizit self-assigned this Jun 29, 2026

eleqtrizit force-pushed the 799 branch from c68e697 to 8401272 Compare June 30, 2026 00:31

openclaw-barnacle Bot added the docs Improvements or additions to documentation label Jun 30, 2026

clawsweeper Bot added rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. and removed rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. labels Jun 30, 2026

eleqtrizit added 5 commits June 30, 2026 01:26

fix(codex): require admin for native controls

bf73f6d

Gate Codex native session controls and bound turns on current owner or operator.admin authority. Preserve gateway scope precedence and read-only status behavior.

fix(codex): align native authorization

67215ac

fix(codex): preserve silent bound handling

21f5c7a

fix(codex): narrow bound auth contract

b3d65f5

fix(docs): refresh generated docs map

c5fbd59

eleqtrizit force-pushed the 799 branch from 179dc49 to c5fbd59 Compare June 30, 2026 01:32

eleqtrizit merged commit 72f837a into openclaw:main Jun 30, 2026
154 of 165 checks passed

100yenadmin mentioned this pull request Jun 30, 2026

Add Telegram /login Codex pairing flow #98006

Merged

eleqtrizit deleted the 799 branch June 30, 2026 19:27

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(codex): require admin for native controls#97952

fix(codex): require admin for native controls#97952
eleqtrizit merged 5 commits into
openclaw:mainfrom
eleqtrizit:799

eleqtrizit commented Jun 29, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jun 29, 2026 •

edited

Loading

Uh oh!

eleqtrizit commented Jun 29, 2026 •

edited

Loading

Uh oh!

eleqtrizit commented Jun 29, 2026

Uh oh!

clawsweeper Bot commented Jun 29, 2026 •

edited

Loading

Uh oh!

eleqtrizit commented Jun 30, 2026

Uh oh!

clawsweeper Bot commented Jun 30, 2026 •

edited

Loading

Uh oh!

eleqtrizit commented Jun 30, 2026

Uh oh!

clawsweeper Bot commented Jun 30, 2026 •

edited

Loading

Uh oh!

eleqtrizit commented Jun 30, 2026

Uh oh!

clawsweeper Bot commented Jun 30, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

eleqtrizit commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What Problem This Solves

Why This Change Was Made

Changes

Validation

Evidence

Notes

User Impact

Uh oh!

clawsweeper Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

eleqtrizit commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

eleqtrizit commented Jun 29, 2026

Uh oh!

clawsweeper Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

eleqtrizit commented Jun 30, 2026

Uh oh!

clawsweeper Bot commented Jun 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

eleqtrizit commented Jun 30, 2026

Uh oh!

clawsweeper Bot commented Jun 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

eleqtrizit commented Jun 30, 2026

Uh oh!

clawsweeper Bot commented Jun 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

eleqtrizit commented Jun 29, 2026 •

edited

Loading

clawsweeper Bot commented Jun 29, 2026 •

edited

Loading

eleqtrizit commented Jun 29, 2026 •

edited

Loading

clawsweeper Bot commented Jun 29, 2026 •

edited

Loading

clawsweeper Bot commented Jun 30, 2026 •

edited

Loading

clawsweeper Bot commented Jun 30, 2026 •

edited

Loading

clawsweeper Bot commented Jun 30, 2026 •

edited

Loading