Skip to content

fix(codex): avoid guardian review for local models#88630

Merged
kevinlin-openai merged 31 commits into
mainfrom
fix-codex-guardian-local-model
Jun 10, 2026
Merged

fix(codex): avoid guardian review for local models#88630
kevinlin-openai merged 31 commits into
mainfrom
fix-codex-guardian-local-model

Conversation

@vincentkoc

@vincentkoc vincentkoc commented May 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Summary

  • Downgrade Codex app-server Guardian/model-backed approval reviewers to user/OpenClaw approvals unless the effective reviewer context is clearly OpenAI.
  • Treat explicit custom providers, provider-qualified local model refs, persisted binding model providers, side-question forks, bound conversation turns, alias collisions, and OpenAI transport overrides as fail-closed for Guardian/model-backed review.
  • Add OpenClaw internal exec auto-review for Codex app-server command approvals only for tools.exec.mode=auto, simple parsed command approvals, and an explicit tools.exec.reviewer.model under openai/...; unsafe control commands, amendments, security-audit suppression, unparsed commands, reviewer ask decisions, unrelated agent-specific aliases, and custom OpenAI transport overrides fall back to plugin/human approval.
  • Refresh the Plugin SDK API baseline for the exec auto-review contract and keep the SDK import/export topology acyclic.

Real behavior proof

Behavior addressed: local/custom model Codex app-server auto approval no longer tries to use Codex Guardian/model-backed review, and internal exec auto-review requires an explicitly OpenAI-qualified reviewer model whose effective OpenAI transport remains native/trusted.
Real environment tested: local focused Vitest/static checks in the Codex worktree with a temporary shared node_modules symlink; delegated Blacksmith Testbox changed gate; GitHub PR CI completed on head e3318f163e636be06c0f7e2e14c22e2b4a04427e.
Exact steps or command run after this patch: node scripts/run-vitest.mjs extensions/codex/src/app-server/thread-lifecycle.test.ts extensions/codex/src/app-server/thread-lifecycle.binding.test.ts extensions/codex/src/app-server/config.test.ts extensions/codex/src/app-server/app-server-policy.test.ts extensions/codex/src/app-server/approval-bridge.test.ts extensions/codex/src/app-server/run-attempt.test.ts extensions/codex/src/app-server/side-question.test.ts extensions/codex/src/conversation-binding.test.ts extensions/codex/src/conversation-control.test.ts; node scripts/run-vitest.mjs extensions/codex/src/app-server/config.test.ts extensions/codex/src/app-server/approval-bridge.test.ts; node --import tsx scripts/check-madge-import-cycles.ts; node scripts/check-plugin-sdk-subpath-exports.mjs; git diff --check; node scripts/crabbox-wrapper.mjs run --provider blacksmith-testbox -- env OPENCLAW_CHECK_CHANGED_REMOTE_CHILD=1 OPENCLAW_CHANGED_LANES_RAW_SYNC=1 corepack pnpm check:changed; .agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main; ghx pr checks 88630 --repo openclaw/openclaw --watch --interval 20.
Evidence after fix: focused local Codex suite passed 9 files / 399 tests before the final rebase; post-rebase focused config/approval regression suite passed 2 files / 159 tests; Madge reported 0 cycles; SDK subpath export check passed; final Testbox tbx_01ktmvpp9t8phfeaxdjaz4t1rt passed check:changed with exit 0; final autoreview reported no accepted/actionable findings for this PR diff; GitHub PR CI completed with all checks passing or skipped.
Observed result after fix: policy, config, side-question, run-attempt, conversation-binding, conversation-control, approval-bridge, thread lifecycle, SDK export, typecheck, lint, import-cycle, runtime-topology, security, critical-quality, and build-artifact checks pass on the rebased branch.
Dependency/Codex contract checked: upstream Codex codex-rs/app-server-protocol/src/protocol/v2/thread.rs:95-100 exposes thread model + model_provider; upstream Codex codex-rs/app-server-protocol/src/protocol/v2/turn.rs:66-87 exposes turn reviewer/approval overrides and model, but no turn-level model_provider.
What was not tested: live LM Studio/Ollama app-server round trip was not run; coverage is via policy/bridge/config regression tests, Codex upstream source inspection, autoreview, Testbox changed gate, and GitHub PR CI.

@clawsweeper

clawsweeper Bot commented May 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: found issues before merge. Reviewed June 8, 2026, 8:39 PM ET / 00:39 UTC.

Summary
The PR changes Codex app-server approval routing for local/custom model providers, adds guarded internal exec auto-review helpers through a new Plugin SDK runtime subpath, expands Codex regression coverage, and includes small Feishu/channel lint edits.

PR surface: Source +1265, Tests +2338, Config +4, Other +1. Total +3608 across 26 files.

Reproducibility: yes. at source level: current main forces Codex app-server execMode: auto toward model-backed review without provider trust context, and the PR adds focused regression tests for local/custom providers. I did not run a live LM Studio or Ollama round trip in this read-only review.

Review metrics: 1 noteworthy metric.

  • Public SDK subpath surface: 1 added. agent-harness-exec-review-runtime is added to package exports and entrypoints, which creates a published plugin contract that needs docs and baseline alignment before merge.

Merge readiness
Overall: 🦐 gold shrimp
Proof: 🦞 diamond lobster
Patch quality: 🦐 gold shrimp
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • Restore awaited Feishu idle cleanup sequencing and keep/extend the existing fallback tests.
  • [P2] Add the SDK subpath docs, doc metadata, and generated API baseline or keep the helper private.
  • [P1] Record explicit maintainer acceptance of the local/custom-provider fail-closed approval behavior before merge.

Risk before merge

  • [P1] Existing local/custom Codex app-server users with tools.exec.mode: auto may move from model-backed Guardian review attempts to user/plugin approval prompts, which is likely safer but still a compatibility-visible behavior change.
  • [P1] The PR changes which reviewer model/provider contexts are trusted to approve exec requests, so maintainer acceptance of the security boundary is still required even with green tests.
  • [P2] The incidental Feishu idle change can let no-visible-reply fallback or later replies run before async typing/streaming cleanup settles.
  • [P1] The new public Plugin SDK subpath becomes a third-party plugin contract unless docs, metadata, and generated API baseline are aligned before publish.

Maintainer options:

  1. Fix blockers before merge (recommended)
    Restore the awaited Feishu idle callback, add the missing SDK subpath docs/metadata/baseline, and keep the Codex fail-closed trust policy available for maintainer review.
  2. Accept the approval-policy compatibility change
    Maintainers can explicitly accept that local/custom app-server users may see user/plugin approval prompts instead of model-backed Guardian review when the reviewer context is not trusted OpenAI.
  3. Pause if the SDK subpath should not be public
    If the exec-review helper is only for the bundled Codex plugin, keep it private or plugin-local instead of publishing a new Plugin SDK contract in this PR.

Next step before merge

  • [P2] The PR has narrow fixable defects, but it is maintainer-labeled and changes exec-approval compatibility plus a security trust boundary, so it needs author/maintainer follow-up rather than an autonomous cleanup close.

Security
Cleared: No concrete exploitable security or supply-chain defect was found in the diff; the exec-review trust-boundary change remains a maintainer acceptance risk rather than a discrete security bug.

Review findings

  • [P2] Await Feishu idle cleanup — extensions/feishu/src/reply-dispatcher.ts:582
  • [P2] Align the new SDK subpath contract — package.json:588-591
Review details

Best possible solution:

Land this only after restoring Feishu idle sequencing, completing the SDK public-surface docs/metadata/baseline, and recording maintainer acceptance of the provider-aware fail-closed exec-review policy.

Do we have a high-confidence way to reproduce the issue?

Yes, at source level: current main forces Codex app-server execMode: auto toward model-backed review without provider trust context, and the PR adds focused regression tests for local/custom providers. I did not run a live LM Studio or Ollama round trip in this read-only review.

Is this the best way to solve the issue?

No, not as currently submitted: the Codex owner-boundary approach looks reasonable, but the PR also introduces a Feishu async regression and an incomplete public SDK contract. A safer merge path fixes those blockers while keeping the provider-aware trust policy explicit for maintainer acceptance.

Full review comments:

  • [P2] Await Feishu idle cleanup — extensions/feishu/src/reply-dispatcher.ts:582
    typingCallbacks.onIdle is part of the reply dispatcher contract as Promise<void> | void, and the Feishu tests rely on awaiting idle side effects before fallback continues. Dropping the await here lets idleSideEffectsPromise resolve before async typing/streaming cleanup finishes, so no-visible-reply fallback or later replies can race cleanup and async failures are no longer propagated. Keep the await Promise.resolve(...) sequencing or otherwise make the callback synchronously guaranteed.
    Confidence: 0.92
  • [P2] Align the new SDK subpath contract — package.json:588-591
    Adding ./plugin-sdk/agent-harness-exec-review-runtime to package.json publishes a new third-party Plugin SDK import path, but the branch does not update the SDK docs/catalog metadata or generated API baseline that define public subpaths. That leaves plugin authors with an undocumented contract and lets the published SDK surface drift from its reference docs. Add the docs/metadata/baseline updates or keep this helper out of the public SDK surface.
    Confidence: 0.88

Overall correctness: patch is incorrect
Overall confidence: 0.89

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 5b76436c452a.

Label changes

Label changes:

  • add merge-risk: 🚨 message-delivery: The Feishu dispatcher edit can make visible-reply fallback race async idle/streaming cleanup.

Label justifications:

  • P2: This is a normal-priority Codex approval-routing bug fix with bounded but compatibility-sensitive blast radius.
  • merge-risk: 🚨 compatibility: The PR intentionally changes approval routing for existing local/custom Codex app-server setups and adds a new public Plugin SDK subpath.
  • merge-risk: 🚨 security-boundary: The diff changes which reviewer model/provider endpoints may approve exec requests, which is a trust-boundary decision beyond CI alone.
  • merge-risk: 🚨 message-delivery: The Feishu dispatcher edit can make visible-reply fallback race async idle/streaming cleanup.
  • rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦞 diamond lobster and patch quality is 🦐 gold shrimp.
  • status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: This is a maintainer-authored PR, so the external-contributor proof gate does not apply; the PR body still records focused tests, Testbox check:changed, autoreview, CI, and upstream Codex source inspection.
Evidence reviewed

PR surface:

Source +1265, Tests +2338, Config +4, Other +1. Total +3608 across 26 files.

View PR surface stats
Area Files Added Removed Net
Source 15 1510 245 +1265
Tests 9 2349 11 +2338
Docs 0 0 0 0
Config 1 4 0 +4
Generated 0 0 0 0
Other 1 1 0 +1
Total 26 3864 256 +3608

Acceptance criteria:

  • [P1] node scripts/run-vitest.mjs extensions/feishu/src/reply-dispatcher.test.ts extensions/codex/src/app-server/config.test.ts extensions/codex/src/app-server/approval-bridge.test.ts.
  • [P1] node scripts/check-plugin-sdk-subpath-exports.mjs.
  • [P1] node scripts/generate-plugin-sdk-api-baseline.ts --check.
  • [P1] git diff --check.

What I checked:

  • Repository policy applied: Read the full root policy plus scoped extension, Plugin SDK, agents, channels, and scripts guides; the SDK and approval-routing guidance materially affects this review. (AGENTS.md:1, 5b76436c452a)
  • Current-main behavior: Current main forces execMode === "auto" into a model-backed reviewer path without provider-specific trust context, which makes the PR's local/custom provider fix relevant. (extensions/codex/src/app-server/config.ts:437, 5b76436c452a)
  • PR implementation evidence: The PR head adds provider/model trust checks and regression tests showing LM Studio/custom OpenAI-compatible app-server runs use approvalsReviewer: "user" instead of Guardian/model-backed review. (extensions/codex/src/app-server/config.ts:459, e3318f163e63)
  • Codex upstream contract checked: Sibling upstream Codex source exposes model_provider on thread start, while turn start exposes model and approval reviewer fields but no turn-level model_provider; this supports the PR's thread-boundary provider normalization. (../codex/codex-rs/app-server-protocol/src/protocol/v2/thread.rs:95, 8534912df930)
  • Prior maintainer review addressed on current head: A maintainer review found that an earlier head scanned unrelated agents.list aliases; current head's configuredAgentModelAliasMatches only checks agents.defaults.models, matching that review's stated resolver scope. (extensions/codex/src/app-server/approval-bridge.ts:557, e3318f163e63)
  • Feishu async regression evidence: The PR removes the await around typingCallbacks.onIdle, but the dispatcher contract and Feishu tests treat onIdle as Promise<void> | void and depend on awaiting idle side effects before fallback continues. (extensions/feishu/src/reply-dispatcher.ts:582, e3318f163e63)

Likely related people:

  • vincentkoc: Authored this PR and has prior merged Codex harness/control-surface and Plugin SDK-adjacent work in the same area. (role: feature owner and current PR author; confidence: high; commits: ac3cd1a0ca8c, d10d71cdb659, edc0a22179a7; files: extensions/codex/src/app-server/approval-bridge.ts, extensions/codex/src/app-server/config.ts, src/plugin-sdk/agent-harness-runtime.ts)
  • steipete: Recent commits touched Codex app-server approval cleanup, SDK/agent-harness docs, and plugin SDK boundary refactors around the affected surfaces. (role: recent area contributor; confidence: high; commits: 56a5d7e8657e, 8f6e71087b01, 6868cde4d45f; files: extensions/codex/src/app-server/approval-bridge.ts, extensions/codex/src/app-server/config.ts, src/plugin-sdk/agent-harness-runtime.ts)
  • kevinslin: Reviewed this PR's trust gate and recently changed Codex app-server config behavior in the same path. (role: reviewer and recent Codex config contributor; confidence: medium; commits: fce002ad0320; files: extensions/codex/src/app-server/config.ts, extensions/codex/src/app-server/approval-bridge.ts)
  • ArthurNie: Recent merged Feishu no-visible-reply fallback work owns the async idle/fallback behavior affected by the incidental Feishu edit. (role: recent Feishu reply lifecycle contributor; confidence: medium; commits: 7c15c2765ebb; files: extensions/feishu/src/reply-dispatcher.ts, extensions/feishu/src/reply-dispatcher.test.ts)
  • MonkeyLeeT: Recently changed long Feishu streaming reply behavior in the same dispatcher, adjacent to the changed idle side-effect sequencing. (role: recent Feishu streaming contributor; confidence: medium; files: extensions/feishu/src/reply-dispatcher.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@vincentkoc vincentkoc force-pushed the fix-codex-guardian-local-model branch from b46e87f to 42cd901 Compare May 31, 2026 13:14
@clawsweeper clawsweeper Bot added rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels May 31, 2026
@vincentkoc vincentkoc self-assigned this May 31, 2026
@clawsweeper clawsweeper Bot added rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. P2 Normal backlog priority with limited blast radius. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. and removed rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels May 31, 2026
@vincentkoc vincentkoc force-pushed the fix-codex-guardian-local-model branch from 42cd901 to d7b7384 Compare May 31, 2026 13:27
@clawsweeper clawsweeper Bot added rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. and removed rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. labels May 31, 2026
@vincentkoc vincentkoc force-pushed the fix-codex-guardian-local-model branch from d7b7384 to 2e7d9e5 Compare May 31, 2026 13:40
@openclaw-barnacle openclaw-barnacle Bot added docs Improvements or additions to documentation size: XL and removed size: M labels May 31, 2026
@vincentkoc vincentkoc force-pushed the fix-codex-guardian-local-model branch from 448efb6 to 5912c1f Compare May 31, 2026 23:20
@openclaw-barnacle openclaw-barnacle Bot added the channel: feishu Channel integration: feishu label May 31, 2026
@vincentkoc vincentkoc marked this pull request as ready for review May 31, 2026 23:20
@clawsweeper clawsweeper Bot added rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. and removed rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. labels May 31, 2026
@vincentkoc vincentkoc force-pushed the fix-codex-guardian-local-model branch from 5912c1f to aa62e53 Compare June 1, 2026 02:22
@openclaw-barnacle openclaw-barnacle Bot added the agents Agent runtime and tooling label Jun 1, 2026
@clawsweeper clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jun 1, 2026
vincentkoc added 19 commits June 9, 2026 09:23
@vincentkoc
fix(codex): prefer qualified app-server model providers
e7abf6f
@vincentkoc
fix(codex): preserve guardian on model control switches
27fbad2
@vincentkoc
fix(codex): retain local providers across model switches
45bb105
@vincentkoc
fix(codex): distrust aliased reviewer model refs
2f31a7f
@vincentkoc
fix(codex): preserve providers after thread rotation
aa12e2c
@vincentkoc
fix(codex): clear stale providers on qualified model switches
5b1e966
@vincentkoc
fix(codex): prefer qualified models over legacy providers
92542db
@vincentkoc
fix(codex): validate reviewer trust before auto approvals
4f7d742
@vincentkoc
fix(codex): recompute reviewer policy after binding rotation
ff27272
@vincentkoc
fix(codex): normalize reviewer aliases before trust checks
0a68058
@vincentkoc
fix(codex): retain bound providers for slashed local models
dcfa086
@vincentkoc
fix(codex): normalize provider trust checks for exec review
2aa2905
@vincentkoc
fix(codex): ignore stale bindings for explicit providers
88c6d4f
@vincentkoc
fix(codex): share trusted reviewer endpoint policy
03a8a53
@vincentkoc
fix(codex): keep network approvals on plugin path
9d05c35
@vincentkoc
fix(codex): route provider-qualified model refs
d6f8440
@vincentkoc
fix(codex): reject blank masked OpenAI base overrides
dc1a9cf
@vincentkoc
fix(codex): scope exec reviewer alias trust
653e206
@vincentkoc
fix(codex): distrust exec reviewer transport overrides
e3318f1
@vincentkoc vincentkoc force-pushed the fix-codex-guardian-local-model branch from 1e12845 to e3318f1 Compare June 9, 2026 00:24
@socket-security

socket-security Bot commented Jun 9, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addednpm/​@​clack/​core@​1.3.11001007397100
Addednpm/​@​grammyjs/​transformer-throttler@​1.2.1751008882100
Addednpm/​@​matrix-org/​matrix-sdk-crypto-nodejs@​0.6.07510010087100
Addednpm/​@​earendil-works/​pi-tui@​0.78.07710010096100
Addednpm/​@​create-markdown/​preview@​2.0.37810010085100
Addednpm/​@​a2ui/​lit@​0.10.07910010094100
Addednpm/​@​copilotkit/​aimock@​1.27.38010010096100
Addednpm/​@​grammyjs/​runner@​2.0.31001009280100
Addednpm/​@​lydell/​node-pty@​1.2.0-beta.121001008084100
Addednpm/​@​aws/​bedrock-token-generator@​1.1.09810010081100
Addednpm/​@​mdx-js/​mdx@​3.1.19910010085100
Addednpm/​@​lit/​context@​1.1.610010010086100
Addednpm/​@​lit-labs/​signals@​0.3.010010010091100
Addednpm/​@​grammyjs/​types@​3.27.310010010092100
Addednpm/​@​matrix-org/​matrix-sdk-crypto-wasm@​18.3.010010010093100
Addednpm/​@​google/​genai@​2.7.09410010098100
Addednpm/​@​discordjs/​voice@​0.19.29910010096100
Addednpm/​@​clack/​prompts@​1.4.010010010097100
Addednpm/​@​homebridge/​ciao@​1.3.99910010098100

View full report

@socket-security

socket-security Bot commented Jun 9, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Publisher changed: npm @earendil-works/pi-tui is now published by mitsuhiko

Author: mitsuhiko

From: pnpm-lock.yaml → npm/@earendil-works/pi-tui@0.76.0

ℹ Read more on: This package | This alert | What is unstable ownership?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@earendil-works/pi-tui@0.76.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@clawsweeper clawsweeper Bot added the merge-risk: 🚨 message-delivery 🚨 May drop, duplicate, misroute, suppress, or wrongly target messages. label Jun 9, 2026
@vincentkoc vincentkoc requested a review from kevinslin June 9, 2026 02:32
@kevinlin-openai kevinlin-openai merged commit b4cdd92 into main Jun 10, 2026
184 checks passed
@kevinlin-openai kevinlin-openai deleted the fix-codex-guardian-local-model branch June 10, 2026 04:38
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jun 10, 2026
@vincentkoc
fix(codex): avoid guardian review for local models (openclaw#88630)
07b03ac 
* fix(codex): avoid guardian review for local models

* fix(codex): route app-server auto exec review

* fix(codex): make guardian requirements provider-aware

* fix(codex): block unrouted bound approvals

* fix(channels): satisfy ingress queue lint

* fix(codex): use local-model policy for side forks

* fix(extensions): satisfy ingress lint

* fix(codex): require trusted exec reviewer model

* fix(exec): share control command approval guards

* fix(codex): fail closed for unknown guardian model provider

* fix(codex): reject custom exec reviewer endpoints

* fix(codex): preserve bound providers on app-server reuse

* fix(codex): prefer qualified app-server model providers

* fix(codex): preserve guardian on model control switches

* fix(codex): retain local providers across model switches

* fix(codex): distrust aliased reviewer model refs

* fix(codex): preserve providers after thread rotation

* fix(codex): clear stale providers on qualified model switches

* fix(codex): prefer qualified models over legacy providers

* fix(codex): validate reviewer trust before auto approvals

* fix(codex): recompute reviewer policy after binding rotation

* fix(codex): normalize reviewer aliases before trust checks

* fix(codex): retain bound providers for slashed local models

* fix(codex): normalize provider trust checks for exec review

* fix(codex): ignore stale bindings for explicit providers

* fix(codex): share trusted reviewer endpoint policy

* fix(codex): keep network approvals on plugin path

* fix(codex): route provider-qualified model refs

* fix(codex): reject blank masked OpenAI base overrides

* fix(codex): scope exec reviewer alias trust

* fix(codex): distrust exec reviewer transport overrides
@github-actions github-actions Bot mentioned this pull request Jun 10, 2026
Open
eleboucher pushed a commit to eleboucher/homelab that referenced this pull request Jun 12, 2026
@eleboucher
fix(container): update image ghcr.io/openclaw/openclaw (2026.6.5 ➔ 20…
bb872cc 
…26.6.6) (#1040)

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [ghcr.io/openclaw/openclaw](https://openclaw.ai) ([source](https://github.com/openclaw/openclaw)) | patch | `2026.6.5` → `2026.6.6` |

---

### Release Notes

<details>
<summary>openclaw/openclaw (ghcr.io/openclaw/openclaw)</summary>

### [`v2026.6.6`](https://github.com/openclaw/openclaw/blob/HEAD/CHANGELOG.md#202666)

[Compare Source](openclaw/openclaw@v2026.6.5...v2026.6.6)

##### Highlights

- Security boundaries are substantially tighter across transcripts, sandbox binds, host environment inheritance, MCP stdio, Codex HTTP access, native search policy, elevated sender checks, deleted-agent ACP bypasses, loopback tools, Discord moderation, and Teams group actions; exec approvals now fail closed on timeout. ([#&#8203;91529](openclaw/openclaw#91529), [#&#8203;91618](openclaw/openclaw#91618), [#&#8203;91615](openclaw/openclaw#91615), [#&#8203;91619](openclaw/openclaw#91619), [#&#8203;91741](openclaw/openclaw#91741), [#&#8203;91745](openclaw/openclaw#91745), [#&#8203;91746](openclaw/openclaw#91746), [#&#8203;91748](openclaw/openclaw#91748), [#&#8203;91749](openclaw/openclaw#91749), [#&#8203;91750](openclaw/openclaw#91750), [#&#8203;91751](openclaw/openclaw#91751), [#&#8203;91752](openclaw/openclaw#91752), [#&#8203;91763](openclaw/openclaw#91763), [#&#8203;89938](openclaw/openclaw#89938)) Thanks [@&#8203;joshavant](https://github.com/joshavant), [@&#8203;pgondhi987](https://github.com/pgondhi987), [@&#8203;mmaps](https://github.com/mmaps), [@&#8203;eleqtrizit](https://github.com/eleqtrizit), [@&#8203;shakkernerd](https://github.com/shakkernerd), and [@&#8203;drobison00](https://github.com/drobison00).
- Telegram delivery is safer and more coherent: account-scoped topics route to the right agent, streamed text survives tool calls, `/compact` works on generic ingress, callback handling uses concrete APIs, draft chunking is shared, durable dispatch dedupe moved into the SDK, and unauthorized DM text stays out of cache and prompt context. ([#&#8203;91189](openclaw/openclaw#91189), [#&#8203;88682](openclaw/openclaw#88682), [#&#8203;89588](openclaw/openclaw#89588), [#&#8203;90212](openclaw/openclaw#90212), [#&#8203;91876](openclaw/openclaw#91876), [#&#8203;91874](openclaw/openclaw#91874), [#&#8203;91904](openclaw/openclaw#91904), [#&#8203;91478](openclaw/openclaw#91478), [#&#8203;91915](openclaw/openclaw#91915)) Thanks [@&#8203;codysai001](https://github.com/codysai001), [@&#8203;alexzhu0](https://github.com/alexzhu0), [@&#8203;joelnishanth](https://github.com/joelnishanth), [@&#8203;snowzlm](https://github.com/snowzlm), [@&#8203;obviyus](https://github.com/obviyus), and [@&#8203;sallyom](https://github.com/sallyom).
- iMessage recovery and delivery now cover always-on inbound restart, durable echo markers, block streaming, idle approval discovery, hardened outbound transport, and actionable inbound startup diagnostics. ([#&#8203;91335](openclaw/openclaw#91335), [#&#8203;91449](openclaw/openclaw#91449), [#&#8203;88969](openclaw/openclaw#88969), [#&#8203;88530](openclaw/openclaw#88530), [#&#8203;91783](openclaw/openclaw#91783), [#&#8203;91785](openclaw/openclaw#91785)) Thanks [@&#8203;omarshahine](https://github.com/omarshahine), [@&#8203;jmissig](https://github.com/jmissig), and [@&#8203;colmbrogan](https://github.com/colmbrogan).
- Browser and MCP connectivity gained existing-session CDP support, discovered WebSocket validation, default-profile `cdpUrl` handling, safer browser-output boundaries, Streamable HTTP loopback transport, corrected OAuth/SSE authorization handling, and broader schema compatibility. ([#&#8203;91422](openclaw/openclaw#91422), [#&#8203;89851](openclaw/openclaw#89851), [#&#8203;91736](openclaw/openclaw#91736), [#&#8203;91747](openclaw/openclaw#91747), [#&#8203;91451](openclaw/openclaw#91451), [#&#8203;80143](openclaw/openclaw#80143)) Thanks [@&#8203;pgondhi987](https://github.com/pgondhi987), [@&#8203;anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia), [@&#8203;lifuyue](https://github.com/lifuyue), [@&#8203;eleqtrizit](https://github.com/eleqtrizit), [@&#8203;LiuwqGit](https://github.com/LiuwqGit), and [@&#8203;HemantSudarshan](https://github.com/HemantSudarshan).
- Control UI startup and first-reply latency are lower through cached model metadata, removal of the startup catalog wait, lazy slash-command loading, and first-event tracing with slow-reply diagnostics. ([#&#8203;91531](openclaw/openclaw#91531), [#&#8203;91538](openclaw/openclaw#91538), [#&#8203;91568](openclaw/openclaw#91568), [#&#8203;91583](openclaw/openclaw#91583), [#&#8203;91598](openclaw/openclaw#91598))
- Provider support expands with OpenRouter OAuth onboarding and Claude Fable 5 adaptive thinking, while Codex sessions keep correct compaction ownership, local models skip guardian review, dynamic tool progress normalizes cleanly, and Gemma 4 reasoning replay is preserved. ([#&#8203;91830](openclaw/openclaw#91830), [#&#8203;91882](openclaw/openclaw#91882), [#&#8203;91590](openclaw/openclaw#91590), [#&#8203;88630](openclaw/openclaw#88630), [#&#8203;88768](openclaw/openclaw#88768), [#&#8203;91696](openclaw/openclaw#91696)) Thanks [@&#8203;Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@&#8203;joshavant](https://github.com/joshavant), [@&#8203;bdjben](https://github.com/bdjben), and [@&#8203;Coder-Wangyankun](https://github.com/Coder-Wangyankun).

##### Changes

- CLI progress: emit Claude CLI commentary progress events and bridge inter-tool commentary into channel progress without exposing internal protocol scaffolding. ([#&#8203;89834](openclaw/openclaw#89834), [#&#8203;90883](openclaw/openclaw#90883)) Thanks [@&#8203;anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia).
- Observability: allow trusted diagnostics channels to capture tool input/output content, add first-assistant-event traces, and warn on slow initial replies. ([#&#8203;91256](openclaw/openclaw#91256), [#&#8203;91568](openclaw/openclaw#91568), [#&#8203;91583](openclaw/openclaw#91583)) Thanks [@&#8203;amknight](https://github.com/amknight).
- Plugins/ClawHub: dogfood reusable package publishing, let dry runs skip publish approval, allow declared installed trusted hooks, report managed plugin version drift, and warn instead of failing on retired Skill Workshop configuration. ([#&#8203;91574](openclaw/openclaw#91574), [#&#8203;91591](openclaw/openclaw#91591), [#&#8203;90004](openclaw/openclaw#90004), [#&#8203;90927](openclaw/openclaw#90927), [#&#8203;90838](openclaw/openclaw#90838)) Thanks [@&#8203;Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@&#8203;brokemac79](https://github.com/brokemac79), and [@&#8203;lonexreb](https://github.com/lonexreb).
- Memory/providers: move the local llama.cpp runtime into its provider plugin, batch embeddings across files, persist the agent model catalog cache, and keep QMD JSON search one-shot while filtering stale REM recall previews. ([#&#8203;91324](openclaw/openclaw#91324), [#&#8203;89138](openclaw/openclaw#89138), [#&#8203;90457](openclaw/openclaw#90457), [#&#8203;91837](openclaw/openclaw#91837), [#&#8203;91851](openclaw/openclaw#91851)) Thanks [@&#8203;osolmaz](https://github.com/osolmaz), [@&#8203;mushuiyu886](https://github.com/mushuiyu886), [@&#8203;ai-hpc](https://github.com/ai-hpc), and [@&#8203;TurboTheTurtle](https://github.com/TurboTheTurtle).
- Channels/mobile: add the QQBot group mention toggle, improve iPad and iPhone control surfaces, and expose the active connection host in the TUI footer. ([#&#8203;91423](openclaw/openclaw#91423), [#&#8203;91557](openclaw/openclaw#91557), [#&#8203;89909](openclaw/openclaw#89909)) Thanks [@&#8203;cxyhhhhh](https://github.com/cxyhhhhh), [@&#8203;Solvely-Colin](https://github.com/Solvely-Colin), and [@&#8203;baskduf](https://github.com/baskduf).
- Performance: prewarm TUI runtime plugins, deduplicate plugin auto-enable fanout, trim dense text-delta snapshots, and reuse prepared startup model metadata. ([#&#8203;90782](openclaw/openclaw#90782), [#&#8203;89978](openclaw/openclaw#89978), [#&#8203;91580](openclaw/openclaw#91580), [#&#8203;91531](openclaw/openclaw#91531)) Thanks [@&#8203;RomneyDa](https://github.com/RomneyDa) and [@&#8203;ai-hpc](https://github.com/ai-hpc).

##### Fixes

- Agent/session recovery: drop stale approval follow-ups after session rebind, remove drained reply-queue items by identity, recover stale main and visible replies, preserve Codex context-engine compaction ownership, lower the default compaction timeout to 180 seconds while respecting explicit configuration, and keep provider-failure terminal lifecycle state correct. ([#&#8203;85679](openclaw/openclaw#85679), [#&#8203;91450](openclaw/openclaw#91450), [#&#8203;91566](openclaw/openclaw#91566), [#&#8203;91840](openclaw/openclaw#91840), [#&#8203;91590](openclaw/openclaw#91590), [#&#8203;91361](openclaw/openclaw#91361), [#&#8203;91895](openclaw/openclaw#91895)) Thanks [@&#8203;openperf](https://github.com/openperf), [@&#8203;yetval](https://github.com/yetval), [@&#8203;joshavant](https://github.com/joshavant), [@&#8203;wangmiao0668000666](https://github.com/wangmiao0668000666), and [@&#8203;TurboTheTurtle](https://github.com/TurboTheTurtle).
- User-visible content boundaries: suppress Codex/Harmony protocol artifacts, neutralize browser and LanceDB memory media directives, redact transcript images, and preserve native `/compact` replies through source suppression. ([#&#8203;89151](openclaw/openclaw#89151), [#&#8203;91422](openclaw/openclaw#91422), [#&#8203;91425](openclaw/openclaw#91425), [#&#8203;91529](openclaw/openclaw#91529), [#&#8203;90212](openclaw/openclaw#90212)) Thanks [@&#8203;joelnishanth](https://github.com/joelnishanth), [@&#8203;pgondhi987](https://github.com/pgondhi987), [@&#8203;joshavant](https://github.com/joshavant), and [@&#8203;snowzlm](https://github.com/snowzlm).
- Channel delivery: keep WhatsApp captured replies attached to the successor controller after restart, retry Feishu rate limits, preserve Mattermost thread replies, canonicalize LINE webhook paths, restore Discord reply hydration and runtime timeout exports, and show OpenAI Realtime WebRTC assistant transcripts. ([#&#8203;85823](openclaw/openclaw#85823), [#&#8203;89659](openclaw/openclaw#89659), [#&#8203;91684](openclaw/openclaw#91684), [#&#8203;91649](openclaw/openclaw#91649), [#&#8203;90263](openclaw/openclaw#90263), [#&#8203;91686](openclaw/openclaw#91686), [#&#8203;90426](openclaw/openclaw#90426)) Thanks [@&#8203;itsuzef](https://github.com/itsuzef), [@&#8203;ladygege](https://github.com/ladygege), [@&#8203;jacobtomlinson](https://github.com/jacobtomlinson), [@&#8203;fuller-stack-dev](https://github.com/fuller-stack-dev), and [@&#8203;shushushv](https://github.com/shushushv).
- Cron: cancel active task runs cleanly, preserve terminal timeout/cancel state, and recover no-deliver tool warnings instead of silently losing the outcome. ([#&#8203;90666](openclaw/openclaw#90666), [#&#8203;90678](openclaw/openclaw#90678)) Thanks [@&#8203;ai-hpc](https://github.com/ai-hpc).
- Gateway/config/auth: share the approval runtime socket token, replace arrays explicitly in `config.patch`, skip the deleted-agent guard only for valid ACP harness sessions, surface headless LaunchAgent state, verify SQLite auth migration before cleanup, and arm QMD startup maintenance. ([#&#8203;87105](openclaw/openclaw#87105), [#&#8203;91551](openclaw/openclaw#91551), [#&#8203;91219](openclaw/openclaw#91219), [#&#8203;91614](openclaw/openclaw#91614), [#&#8203;91740](openclaw/openclaw#91740), [#&#8203;91978](openclaw/openclaw#91978)) Thanks [@&#8203;fuller-stack-dev](https://github.com/fuller-stack-dev) and [@&#8203;scotthuang](https://github.com/scotthuang).
- Providers/Codex: clarify quota errors, restore the Codex synthetic usage line, canonicalize Codex protocol assets, require API-key auth for realtime voice, normalize ACP model refs, preserve Gemma 4 `reasoning_content`, and avoid guardian review for local models. ([#&#8203;91390](openclaw/openclaw#91390), [#&#8203;91709](openclaw/openclaw#91709), [#&#8203;91507](openclaw/openclaw#91507), [#&#8203;91567](openclaw/openclaw#91567), [#&#8203;88630](openclaw/openclaw#88630), [#&#8203;91696](openclaw/openclaw#91696)) Thanks [@&#8203;hxy91819](https://github.com/hxy91819), [@&#8203;brokemac79](https://github.com/brokemac79), [@&#8203;RomneyDa](https://github.com/RomneyDa), [@&#8203;joshavant](https://github.com/joshavant), and [@&#8203;Coder-Wangyankun](https://github.com/Coder-Wangyankun).
- Updates/builds: recover package Gateway restarts after refresh failure, expose plugin convergence repair, fall back to Corepack in PATH-less pnpm environments, seed the correct Docker store packages, and keep ClawHub dry-run and publish paths reusable. ([#&#8203;91581](openclaw/openclaw#91581), [#&#8203;91599](openclaw/openclaw#91599), [#&#8203;91547](openclaw/openclaw#91547), [#&#8203;91591](openclaw/openclaw#91591)) Thanks [@&#8203;fuller-stack-dev](https://github.com/fuller-stack-dev), [@&#8203;sallyom](https://github.com/sallyom), and [@&#8203;Patrick-Erichsen](https://github.com/Patrick-Erichsen).
- UI: require explicit user intent before opening chat sessions and drain restored chat queues after session switches. ([#&#8203;91480](openclaw/openclaw#91480)) Thanks [@&#8203;TurboTheTurtle](https://github.com/TurboTheTurtle).
- Android: avoid the `dataSync` foreground-service type for persistent nodes. ([#&#8203;80082](openclaw/openclaw#80082)) Thanks [@&#8203;davelutztx](https://github.com/davelutztx).
- Native hooks: bound relay lifetimes so abandoned native hook connections cannot linger indefinitely. ([#&#8203;91550](openclaw/openclaw#91550)) Thanks [@&#8203;joshavant](https://github.com/joshavant).

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDEuMSIsInVwZGF0ZWRJblZlciI6IjQzLjEwMS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZS9jb250YWluZXIiLCJ0eXBlL3BhdGNoIl19-->

Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/1040
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kevinlin-openai kevinlin-openai kevinlin-openai approved these changes

@joshavant joshavant Awaiting requested review from joshavant

@jesse-merhi jesse-merhi Awaiting requested review from jesse-merhi

@kevinslin kevinslin Awaiting requested review from kevinslin

Assignees

@vincentkoc vincentkoc

Labels

agents Agent runtime and tooling channel: feishu Channel integration: feishu extensions: codex maintainer Maintainer-authored PR merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. merge-risk: 🚨 message-delivery 🚨 May drop, duplicate, misroute, suppress, or wrongly target messages. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. P2 Normal backlog priority with limited blast radius. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. scripts Repository scripts size: XL status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@vincentkoc @kevinslin @kevinlin-openai