fix(codex): guard sandbox http requests by eleqtrizit · Pull Request #91752 · openclaw/openclaw

eleqtrizit · 2026-06-09T18:52:10Z

Summary

Harden the Codex sandbox exec-server HTTP bridge so sandbox http/request rejects private/internal HTTP targets before dispatch and keeps the in-sandbox request path bound to validated DNS results.

Changes

Add TypeScript-side URL scheme and host/IP preflight before buffered or streaming sandbox HTTP execution starts.
Add in-sandbox Python checks for blocked hostnames, private/internal/special-use resolved addresses, redirect targets, cloud metadata literals, CGNAT/RFC2544 IPv4 ranges, deprecated site-local IPv6, and embedded IPv4 transition forms.
Disable environment proxy handling for the bridge and pin validated DNS answers for the actual socket connection to avoid validation/connect drift.
Cover blocked private, metadata-style, and Python-helper protected IP targets in the focused Codex sandbox HTTP tests.

Validation

corepack pnpm install --frozen-lockfile
corepack pnpm exec oxfmt --write --threads=1 extensions/codex/src/app-server/sandbox-exec-server/http.ts extensions/codex/src/app-server/sandbox-exec-server.http.test.ts
node scripts/run-vitest.mjs extensions/codex/src/app-server/sandbox-exec-server.http.test.ts - passed, 1 file / 7 tests.
git diff --check - passed.
node scripts/check-src-extension-import-boundary.mjs --json - passed, [].
node scripts/check-sdk-package-extension-import-boundary.mjs --json - passed, [].
node scripts/check-test-helper-extension-import-boundary.mjs --json - passed, [].
.agents/skills/autoreview/scripts/autoreview --mode local - clean, no accepted/actionable findings.

Real behavior proof:

Behavior addressed: sandbox http/request blocks protected metadata/internal targets before backend execution, and the embedded sandbox HTTP helper independently blocks the same protected target class.
Real environment tested: local OpenClaw checkout on branch 734, Node/Vitest test harness plus the generated shell/Python helper executed by bash and python3.
Exact steps or command run after this patch: manual JSON-RPC bridge probe sent http/request for http://100.100.100.200/; manual embedded-helper probe executed SANDBOX_HTTP_REQUEST_SCRIPT with the same URL.
Evidence after fix: JSON-RPC bridge probe returned blocked: true, backendCalls: 0, and Blocked hostname or private/internal IP in sandbox http/request: 100.100.100.200.
Observed result after fix: embedded-helper probe exited with code 1, produced no stdout, and stderr ended with ValueError: Blocked hostname or private/internal/special-use IP address.
What was not tested: a full remote Docker/SSH sandbox session with live external networking was not run; the focused bridge and helper proofs exercise the patched blocking paths directly without contacting the protected endpoint.

Notes

AI-assisted security hardening PR by @eleqtrizit. The related private tracking context is intentionally not expanded in this public PR body.

clawsweeper · 2026-06-09T18:54:19Z

Codex review: needs maintainer review before merge. Reviewed June 9, 2026, 3:22 PM ET / 19:22 UTC.

Summary
The PR adds Codex sandbox http/request host preflight, in-sandbox URL/DNS/redirect/IP checks, proxy disabling, DNS pinning, and focused blocked-target tests.

PR surface: Source +148, Tests +109. Total +257 across 2 files.

Reproducibility: yes. Current main source shows the sandbox HTTP helper accepts any HTTP(S) URL and calls urllib.request.urlopen after only a scheme check, so the unguarded private/internal target path is source-reproducible without running a live protected endpoint.

Review metrics: 2 noteworthy metrics.

Sandbox HTTP guard layers: 2 added. The PR adds both TypeScript pre-dispatch blocking and an in-sandbox Python DNS/redirect/IP guard, which is the core boundary maintainers must validate.
Proxy behavior: 1 changed. The embedded helper disables environment proxy handling, which matters because proxy env could otherwise bypass local target validation.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🐚 platinum hermit
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

[P1] Get maintainer/security-owner approval for the fail-closed private/internal target policy and upgrade impact.
[P2] Consider adding redacted remote Docker or SSH sandbox proof that a protected target is blocked and an ordinary public HTTP target still succeeds.

Risk before merge

[P1] Merging intentionally makes Codex sandbox HTTP fail closed for private, internal, special-use, metadata, and proxy-mediated targets, so any existing sandbox MCP/OAuth flow that relied on those targets would stop working unless maintainers accept that as the desired boundary.
[P1] The PR carries the protected maintainer label and references private tracking context, so final policy scope should be accepted by a maintainer/security owner before merge.
[P1] The PR body has focused bridge/helper proof, but it does not include a full remote Docker or SSH sandbox session with live external networking.

Maintainer options:

Owner-accept fail-closed sandbox HTTP (recommended)
A maintainer/security owner can approve the PR as a deliberate security-boundary hardening after confirming private/internal sandbox HTTP targets should now fail closed.
Require remote sandbox proof first
Before merge, ask for a redacted Docker or SSH sandbox run that shows a blocked protected target and a normal public HTTP target still working through the real remote path.
Pause if private-network HTTP remains supported
If maintainers want existing private/internal sandbox HTTP workflows to keep working, pause this PR and design an explicit policy/opt-in path instead of merging the unconditional block.

Next step before merge

[P2] The remaining action is maintainer/security-owner review of the protected security boundary and compatibility impact, not an automated repair.

Security
Cleared: The diff narrows sandbox HTTP egress and does not add dependency, workflow, secret, package, or supply-chain changes; the remaining security item is owner acceptance of the boundary policy.

Review details

Best possible solution:

Land the fail-closed sandbox HTTP guard only after owner review confirms the protected-target policy and upgrade impact, keeping the bridge aligned with shared OpenClaw net-policy and the Codex http/request contract.

Do we have a high-confidence way to reproduce the issue?

Yes. Current main source shows the sandbox HTTP helper accepts any HTTP(S) URL and calls urllib.request.urlopen after only a scheme check, so the unguarded private/internal target path is source-reproducible without running a live protected endpoint.

Is this the best way to solve the issue?

Yes, with owner approval. The best fix layer is the OpenClaw sandbox exec-server bridge because Codex forwards executor HTTP through http/request; the remaining decision is accepting the fail-closed compatibility impact for private/internal targets.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 5b9cb3bd3a36.

Label changes

Label changes:

add merge-risk: 🚨 compatibility: Existing setups that relied on private, internal, special-use, or proxy-mediated sandbox HTTP targets may fail closed after merge.
add proof: sufficient: Contributor real behavior proof is sufficient. The PR body now includes copied after-fix live output from a manual JSON-RPC bridge probe and embedded-helper probe showing a protected metadata target is blocked; no contributor action is required for this gate.
add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body now includes copied after-fix live output from a manual JSON-RPC bridge probe and embedded-helper probe showing a protected metadata target is blocked; no contributor action is required for this gate.
remove rating: 🧂 unranked krab: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.
remove status: 📣 needs proof: Current PR status label is status: 👀 ready for maintainer look.

Label justifications:

P1: This hardens an active Codex sandbox security boundary that can affect real remote HTTP tool traffic.
merge-risk: 🚨 security-boundary: The diff changes which HTTP targets sandboxed Codex requests are allowed to reach and prevents private/internal target access.
merge-risk: 🚨 compatibility: Existing setups that relied on private, internal, special-use, or proxy-mediated sandbox HTTP targets may fail closed after merge.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body now includes copied after-fix live output from a manual JSON-RPC bridge probe and embedded-helper probe showing a protected metadata target is blocked; no contributor action is required for this gate.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body now includes copied after-fix live output from a manual JSON-RPC bridge probe and embedded-helper probe showing a protected metadata target is blocked; no contributor action is required for this gate.

Evidence reviewed

PR surface:

Source +148, Tests +109. Total +257 across 2 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	1	154	6	+148
Tests	1	110	1	+109
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	2	264	7	+257

What I checked:

Current main sandbox HTTP gap: Current main builds a sandbox HTTP request from the JSON-RPC URL and the embedded Python helper only checks the scheme before calling urllib.request.urlopen, so host/IP/DNS/redirect targets are not guarded on main. (extensions/codex/src/app-server/sandbox-exec-server/http.ts:276, 5b9cb3bd3a36)
PR head adds host-side and in-sandbox guards: The PR head calls assertSandboxHttpRequestTargetAllowed before backend dispatch and adds Python-side hostname/IP checks, DNS resolution validation, redirect validation, proxy disabling, and pinned getaddrinfo for the actual socket path. (extensions/codex/src/app-server/sandbox-exec-server/http.ts:58, 469c26c2ede2)
PR head test coverage: The PR adds tests for host-side blocking before buffered and streaming backends start, plus direct execution of the embedded helper against metadata and IPv6 transition forms. (extensions/codex/src/app-server/sandbox-exec-server.http.test.ts:104, 469c26c2ede2)
Shared SSRF policy contract: OpenClaw's shared SSRF helpers classify private/internal/special-use hosts and resolved addresses through isBlockedHostnameOrIp, backed by net-policy handling for metadata IPs, deprecated site-local IPv6, and embedded IPv4 transition forms. (src/infra/net/ssrf.ts:300, 5b9cb3bd3a36)
Codex dependency contract checked: Sibling Codex source defines http/request as the executor-side HTTP RPC and its reqwest runner validates method/scheme but otherwise sends the request, so OpenClaw's external sandbox bridge is the right place to enforce OpenClaw-specific target policy. (../codex/codex-rs/exec-server/src/protocol.rs:330, 99da697e4c5c)
Codex caller path checked: Codex's RMCP streamable HTTP adapter sends MCP POST/GET/DELETE traffic through HttpRequestParams, confirming this bridge is used for remote HTTP rather than a one-off unused method. (../codex/codex-rs/rmcp-client/src/http_client_adapter.rs:128, 99da697e4c5c)

Likely related people:

vincentkoc: Local blame and history show vincentkoc carrying the current sandbox exec-server HTTP helper and recent Codex sandbox HTTP hardening work. (role: recent area contributor; confidence: high; commits: 1727ec7b2dca, 7b5f0c23e54d; files: extensions/codex/src/app-server/sandbox-exec-server/http.ts, extensions/codex/src/app-server/sandbox-exec-server.http.test.ts)
steipete: GitHub path history shows repeated recent work on SSRF, net-policy extraction, and Codex sandbox HTTP documentation, which is directly adjacent to this policy decision. (role: adjacent security policy owner; confidence: high; commits: 29e9625b18cd, 53aa5232bc00, f4c6c0aec49e; files: src/infra/net/ssrf.ts, packages/net-policy/src/ip.ts, extensions/codex/src/app-server/sandbox-exec-server/http.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

eleqtrizit · 2026-06-09T19:27:45Z

Behavioral proof for ClawSweeper

This is the follow-up proof for ClawSweeper's remaining P2 suggestion: show a real http/request bridge run where a protected target is blocked and an ordinary public HTTP target still succeeds.

Behavior addressed: Codex sandbox exec-server http/request now fails closed for protected private/internal/special-use targets before backend execution, while still allowing ordinary public HTTP(S) requests through the sandbox HTTP helper.

Real environment tested: local OpenClaw checkout on branch 734 at 469c26c2ede2eea185a8a0a022dd316abc30eb81, Node v22.22.2, Python 3.12.3. The probe started the OpenClaw sandbox exec-server, connected over its live WebSocket JSON-RPC URL, and used a backend implementation that actually executed the embedded SANDBOX_HTTP_REQUEST_SCRIPT through bash/python3.

Exact steps or command run after this patch:

node scripts/run-vitest.mjs extensions/codex/src/app-server/sandbox-exec-server.http.test.ts
Manual WebSocket JSON-RPC probe:
- initialize
- http/request for https://example.com/
- http/request for http://100.100.100.200/
Manual embedded-helper probe:
- https://example.com/
- http://100.100.100.200/
- http://metadata.google.internal/

Evidence after fix:

{
  "execServerUrlProtocol": "ws://127.0.0.1:34145/<auth-path>",
  "allowed": {
    "status": 200,
    "bodyBytes": 559
  },
  "blocked": {
    "error": "Blocked hostname or private/internal IP in sandbox http/request: 100.100.100.200"
  },
  "backendRunCount": 1,
  "backendRuns": [
    {
      "code": 0,
      "elapsedMs": 5111,
      "stdoutBytes": 1278,
      "stderrTail": [""]
    }
  ]
}

Observed result after fix:

The public request succeeded through the live JSON-RPC bridge with HTTP 200 and a non-empty body.
The protected metadata-style IP was rejected at the TypeScript pre-dispatch guard.
backendRunCount stayed 1, proving the blocked request did not start the backend helper; the only backend execution was the allowed public request.
The embedded helper independently allowed https://example.com/ and rejected protected destinations:

{"label":"allowed-public","url":"https://example.com/","code":0,"elapsedMs":5129,"status":200,"bodyBytes":559,"stdoutBytes":1275,"stderrTail":[""]}
{"label":"blocked-metadata-ip","url":"http://100.100.100.200/","code":1,"elapsedMs":41,"status":null,"bodyBytes":0,"stdoutBytes":0,"stderrTail":["    raise ValueError(\"Blocked hostname or private/internal/special-use IP address\")","ValueError: Blocked hostname or private/internal/special-use IP address"]}
{"label":"blocked-metadata-host","url":"http://metadata.google.internal/","code":1,"elapsedMs":43,"status":null,"bodyBytes":0,"stdoutBytes":0,"stderrTail":["    raise ValueError(\"Blocked hostname or private/internal/special-use IP address\")","ValueError: Blocked hostname or private/internal/special-use IP address"]}

Validation:

[test] starting test/vitest/vitest.extension-codex.config.ts
Test Files  1 passed (1)
Tests       7 passed (7)
[test] passed 1 Vitest shard in 6.32s

Shipped/current behavior proof:

Latest published npm version checked: openclaw@2026.6.5.
Tag v2026.6.5 still accepts record.url and passes it into runShellCommand without host/IP validation in extensions/codex/src/app-server/sandbox-exec-server/http.ts:23-64.
Tag v2026.6.5 Python helper still checks only http/https before urllib.request.urlopen in extensions/codex/src/app-server/sandbox-exec-server/http.ts:276-297.
PR head adds assertSandboxHttpRequestTargetAllowed before buffered or streaming backend execution in extensions/codex/src/app-server/sandbox-exec-server/http.ts:24-75, then adds Python DNS/IP/redirect/proxy/pinned-address validation in extensions/codex/src/app-server/sandbox-exec-server/http.ts:255-443.

Policy and compatibility note:

This proof supports the hardening/parity fix. It does not change the policy decision ClawSweeper called out: maintainers/security owners still need to accept that sandbox http/request should fail closed for private/internal/special-use and proxy-mediated targets. Under the current OpenClaw trust model, this is still best framed as deliberate boundary hardening/parity unless a separate path is shown where a caller can invoke http/request without equivalent sandbox process/start capability.

Codex dependency note:

The required literal sibling clone ../codex could not be created in this container because /codex is not writable (Permission denied). I inspected a fallback upstream clone at /tmp/codex, commit 99da697e4c5c1fc908732a58b6548bf9cc227f83, as supplemental dependency evidence only. Files checked:

codex-rs/exec-server/src/protocol.rs:13-36: process/start and http/request are methods on the same exec-server protocol.
codex-rs/exec-server/src/protocol.rs:330-364: HttpRequestParams is the executor-side HTTP request envelope.
codex-rs/exec-server/src/client/rpc_http_client.rs:1-88: the orchestrator forwards http/request to the remote runtime over JSON-RPC.
codex-rs/rmcp-client/src/http_client_adapter.rs:128-138, 235-245, 304-314: Streamable HTTP MCP POST/DELETE/GET traffic uses HttpRequestParams.

eleqtrizit · 2026-06-09T20:34:01Z

Relevance

The advisory targets a shipped production path in the Codex sandbox exec-server http/request handler. The fix is in-scope hardening that adds SSRF guardrails to a path that previously had only scheme validation before forwarding URLs to urllib.request.urlopen(). All three relevance checks confirmed the issue is in scope, not already fixed on main, and reasonably hardenable without breaking compatibility.

Compatibility

The change is safe from a compatibility standpoint. The TypeScript import uses the existing plugin-safe SDK subpath openclaw/plugin-sdk/ssrf-runtime, which is already exported by the plugin SDK. No public API types, config schemas, CLI flags, gateway protocol messages, or documented behavior changed. The only user-visible runtime change is intentional security hardening — private/internal/special-use destinations now fail before sandbox backend execution. No existing public contract promised that sandbox http/request could reach those destinations.

ClawSweeper

ClawSweeper reviewed the initial commit and identified two P1 blockers: the Python in-sandbox SSRF classifier missed cloud metadata addresses and site-local IPv6 targets that OpenClaw net-policy explicitly blocks, and real behavior proof was missing. Both have been addressed in the current branch head — the Python classifier was extended with comprehensive coverage including cloud metadata literals, CGNAT/RFC2544 ranges, blocked IPv6 special-use ranges, and embedded IPv4 transition form detection, and real behavior proof was posted showing the patched bridge blocking protected targets while ordinary public HTTP still succeeds through the live JSON-RPC bridge.

Code Reviews Completed

Multiple code reviews were completed across the full lifecycle of the PR. All reviews agreed on the architectural soundness of the two-layer defense (TypeScript preflight + Python in-sandbox guard), the correct plugin boundary usage, and the narrow scope. The policy gap identified in the first pass was fixed and confirmed clean in the final code review.

Complete Verification Table

Check	Status
Unit tests — 7 tests passing (TypeScript preflight + Python in-sandbox guard)	✅ Passed
Import boundary checks — src, SDK, and test-helper boundaries	✅ All clean
Autoreview — no accepted/actionable findings	✅ Clean
`git diff --check` — no whitespace errors	✅ Passed
CI — lint	✅ Passed
CI — prod types	✅ Passed
CI — test types	✅ Passed
CI — security-fast	✅ Passed
CI — dependency guard	✅ Passed
CI — OpenGrep	✅ Passed
CI — Real behavior proof	✅ Passed
CI — extension boundary checks	✅ Passed
Relevance checks — in scope, not already fixed, reasonable hardening	✅ All confirmed
Compatibility checks — API, config, CLI, protocol, plugin boundary	✅ All safe
Code reviews — initial pass, policy gap identified and fixed, final clean review	✅ Complete
Real behavior proof — live WebSocket JSON-RPC bridge probe with allowed public request and blocked protected target	✅ Posted on PR
DNS-rebinding defense — DNS pinning via monkey-patched `socket.getaddrinfo`	✅ Implemented
Redirect validation — `GuardedRedirectHandler` validates all redirect targets	✅ Implemented
Proxy disabling — `ProxyHandler({})` prevents host-side proxy inheritance	✅ Implemented
Python policy parity — cloud metadata, site-local IPv6, CGNAT, RFC2544, embedded IPv4 transition forms	✅ Matches net-policy

* fix(codex): guard sandbox http requests * fix(codex): align sandbox http policy

…26.6.6) (#1040) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/openclaw/openclaw](https://openclaw.ai) ([source](https://github.com/openclaw/openclaw)) | patch | `2026.6.5` → `2026.6.6` | --- ### Release Notes <details> <summary>openclaw/openclaw (ghcr.io/openclaw/openclaw)</summary> ### [`v2026.6.6`](https://github.com/openclaw/openclaw/blob/HEAD/CHANGELOG.md#202666) [Compare Source](openclaw/openclaw@v2026.6.5...v2026.6.6) ##### Highlights - Security boundaries are substantially tighter across transcripts, sandbox binds, host environment inheritance, MCP stdio, Codex HTTP access, native search policy, elevated sender checks, deleted-agent ACP bypasses, loopback tools, Discord moderation, and Teams group actions; exec approvals now fail closed on timeout. ([#91529](openclaw/openclaw#91529), [#91618](openclaw/openclaw#91618), [#91615](openclaw/openclaw#91615), [#91619](openclaw/openclaw#91619), [#91741](openclaw/openclaw#91741), [#91745](openclaw/openclaw#91745), [#91746](openclaw/openclaw#91746), [#91748](openclaw/openclaw#91748), [#91749](openclaw/openclaw#91749), [#91750](openclaw/openclaw#91750), [#91751](openclaw/openclaw#91751), [#91752](openclaw/openclaw#91752), [#91763](openclaw/openclaw#91763), [#89938](openclaw/openclaw#89938)) Thanks [@joshavant](https://github.com/joshavant), [@pgondhi987](https://github.com/pgondhi987), [@mmaps](https://github.com/mmaps), [@eleqtrizit](https://github.com/eleqtrizit), [@shakkernerd](https://github.com/shakkernerd), and [@drobison00](https://github.com/drobison00). - Telegram delivery is safer and more coherent: account-scoped topics route to the right agent, streamed text survives tool calls, `/compact` works on generic ingress, callback handling uses concrete APIs, draft chunking is shared, durable dispatch dedupe moved into the SDK, and unauthorized DM text stays out of cache and prompt context. ([#91189](openclaw/openclaw#91189), [#88682](openclaw/openclaw#88682), [#89588](openclaw/openclaw#89588), [#90212](openclaw/openclaw#90212), [#91876](openclaw/openclaw#91876), [#91874](openclaw/openclaw#91874), [#91904](openclaw/openclaw#91904), [#91478](openclaw/openclaw#91478), [#91915](openclaw/openclaw#91915)) Thanks [@codysai001](https://github.com/codysai001), [@alexzhu0](https://github.com/alexzhu0), [@joelnishanth](https://github.com/joelnishanth), [@snowzlm](https://github.com/snowzlm), [@obviyus](https://github.com/obviyus), and [@sallyom](https://github.com/sallyom). - iMessage recovery and delivery now cover always-on inbound restart, durable echo markers, block streaming, idle approval discovery, hardened outbound transport, and actionable inbound startup diagnostics. ([#91335](openclaw/openclaw#91335), [#91449](openclaw/openclaw#91449), [#88969](openclaw/openclaw#88969), [#88530](openclaw/openclaw#88530), [#91783](openclaw/openclaw#91783), [#91785](openclaw/openclaw#91785)) Thanks [@omarshahine](https://github.com/omarshahine), [@jmissig](https://github.com/jmissig), and [@colmbrogan](https://github.com/colmbrogan). - Browser and MCP connectivity gained existing-session CDP support, discovered WebSocket validation, default-profile `cdpUrl` handling, safer browser-output boundaries, Streamable HTTP loopback transport, corrected OAuth/SSE authorization handling, and broader schema compatibility. ([#91422](openclaw/openclaw#91422), [#89851](openclaw/openclaw#89851), [#91736](openclaw/openclaw#91736), [#91747](openclaw/openclaw#91747), [#91451](openclaw/openclaw#91451), [#80143](openclaw/openclaw#80143)) Thanks [@pgondhi987](https://github.com/pgondhi987), [@anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia), [@lifuyue](https://github.com/lifuyue), [@eleqtrizit](https://github.com/eleqtrizit), [@LiuwqGit](https://github.com/LiuwqGit), and [@HemantSudarshan](https://github.com/HemantSudarshan). - Control UI startup and first-reply latency are lower through cached model metadata, removal of the startup catalog wait, lazy slash-command loading, and first-event tracing with slow-reply diagnostics. ([#91531](openclaw/openclaw#91531), [#91538](openclaw/openclaw#91538), [#91568](openclaw/openclaw#91568), [#91583](openclaw/openclaw#91583), [#91598](openclaw/openclaw#91598)) - Provider support expands with OpenRouter OAuth onboarding and Claude Fable 5 adaptive thinking, while Codex sessions keep correct compaction ownership, local models skip guardian review, dynamic tool progress normalizes cleanly, and Gemma 4 reasoning replay is preserved. ([#91830](openclaw/openclaw#91830), [#91882](openclaw/openclaw#91882), [#91590](openclaw/openclaw#91590), [#88630](openclaw/openclaw#88630), [#88768](openclaw/openclaw#88768), [#91696](openclaw/openclaw#91696)) Thanks [@Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@joshavant](https://github.com/joshavant), [@bdjben](https://github.com/bdjben), and [@Coder-Wangyankun](https://github.com/Coder-Wangyankun). ##### Changes - CLI progress: emit Claude CLI commentary progress events and bridge inter-tool commentary into channel progress without exposing internal protocol scaffolding. ([#89834](openclaw/openclaw#89834), [#90883](openclaw/openclaw#90883)) Thanks [@anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia). - Observability: allow trusted diagnostics channels to capture tool input/output content, add first-assistant-event traces, and warn on slow initial replies. ([#91256](openclaw/openclaw#91256), [#91568](openclaw/openclaw#91568), [#91583](openclaw/openclaw#91583)) Thanks [@amknight](https://github.com/amknight). - Plugins/ClawHub: dogfood reusable package publishing, let dry runs skip publish approval, allow declared installed trusted hooks, report managed plugin version drift, and warn instead of failing on retired Skill Workshop configuration. ([#91574](openclaw/openclaw#91574), [#91591](openclaw/openclaw#91591), [#90004](openclaw/openclaw#90004), [#90927](openclaw/openclaw#90927), [#90838](openclaw/openclaw#90838)) Thanks [@Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@brokemac79](https://github.com/brokemac79), and [@lonexreb](https://github.com/lonexreb). - Memory/providers: move the local llama.cpp runtime into its provider plugin, batch embeddings across files, persist the agent model catalog cache, and keep QMD JSON search one-shot while filtering stale REM recall previews. ([#91324](openclaw/openclaw#91324), [#89138](openclaw/openclaw#89138), [#90457](openclaw/openclaw#90457), [#91837](openclaw/openclaw#91837), [#91851](openclaw/openclaw#91851)) Thanks [@osolmaz](https://github.com/osolmaz), [@mushuiyu886](https://github.com/mushuiyu886), [@ai-hpc](https://github.com/ai-hpc), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Channels/mobile: add the QQBot group mention toggle, improve iPad and iPhone control surfaces, and expose the active connection host in the TUI footer. ([#91423](openclaw/openclaw#91423), [#91557](openclaw/openclaw#91557), [#89909](openclaw/openclaw#89909)) Thanks [@cxyhhhhh](https://github.com/cxyhhhhh), [@Solvely-Colin](https://github.com/Solvely-Colin), and [@baskduf](https://github.com/baskduf). - Performance: prewarm TUI runtime plugins, deduplicate plugin auto-enable fanout, trim dense text-delta snapshots, and reuse prepared startup model metadata. ([#90782](openclaw/openclaw#90782), [#89978](openclaw/openclaw#89978), [#91580](openclaw/openclaw#91580), [#91531](openclaw/openclaw#91531)) Thanks [@RomneyDa](https://github.com/RomneyDa) and [@ai-hpc](https://github.com/ai-hpc). ##### Fixes - Agent/session recovery: drop stale approval follow-ups after session rebind, remove drained reply-queue items by identity, recover stale main and visible replies, preserve Codex context-engine compaction ownership, lower the default compaction timeout to 180 seconds while respecting explicit configuration, and keep provider-failure terminal lifecycle state correct. ([#85679](openclaw/openclaw#85679), [#91450](openclaw/openclaw#91450), [#91566](openclaw/openclaw#91566), [#91840](openclaw/openclaw#91840), [#91590](openclaw/openclaw#91590), [#91361](openclaw/openclaw#91361), [#91895](openclaw/openclaw#91895)) Thanks [@openperf](https://github.com/openperf), [@yetval](https://github.com/yetval), [@joshavant](https://github.com/joshavant), [@wangmiao0668000666](https://github.com/wangmiao0668000666), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - User-visible content boundaries: suppress Codex/Harmony protocol artifacts, neutralize browser and LanceDB memory media directives, redact transcript images, and preserve native `/compact` replies through source suppression. ([#89151](openclaw/openclaw#89151), [#91422](openclaw/openclaw#91422), [#91425](openclaw/openclaw#91425), [#91529](openclaw/openclaw#91529), [#90212](openclaw/openclaw#90212)) Thanks [@joelnishanth](https://github.com/joelnishanth), [@pgondhi987](https://github.com/pgondhi987), [@joshavant](https://github.com/joshavant), and [@snowzlm](https://github.com/snowzlm). - Channel delivery: keep WhatsApp captured replies attached to the successor controller after restart, retry Feishu rate limits, preserve Mattermost thread replies, canonicalize LINE webhook paths, restore Discord reply hydration and runtime timeout exports, and show OpenAI Realtime WebRTC assistant transcripts. ([#85823](openclaw/openclaw#85823), [#89659](openclaw/openclaw#89659), [#91684](openclaw/openclaw#91684), [#91649](openclaw/openclaw#91649), [#90263](openclaw/openclaw#90263), [#91686](openclaw/openclaw#91686), [#90426](openclaw/openclaw#90426)) Thanks [@itsuzef](https://github.com/itsuzef), [@ladygege](https://github.com/ladygege), [@jacobtomlinson](https://github.com/jacobtomlinson), [@fuller-stack-dev](https://github.com/fuller-stack-dev), and [@shushushv](https://github.com/shushushv). - Cron: cancel active task runs cleanly, preserve terminal timeout/cancel state, and recover no-deliver tool warnings instead of silently losing the outcome. ([#90666](openclaw/openclaw#90666), [#90678](openclaw/openclaw#90678)) Thanks [@ai-hpc](https://github.com/ai-hpc). - Gateway/config/auth: share the approval runtime socket token, replace arrays explicitly in `config.patch`, skip the deleted-agent guard only for valid ACP harness sessions, surface headless LaunchAgent state, verify SQLite auth migration before cleanup, and arm QMD startup maintenance. ([#87105](openclaw/openclaw#87105), [#91551](openclaw/openclaw#91551), [#91219](openclaw/openclaw#91219), [#91614](openclaw/openclaw#91614), [#91740](openclaw/openclaw#91740), [#91978](openclaw/openclaw#91978)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev) and [@scotthuang](https://github.com/scotthuang). - Providers/Codex: clarify quota errors, restore the Codex synthetic usage line, canonicalize Codex protocol assets, require API-key auth for realtime voice, normalize ACP model refs, preserve Gemma 4 `reasoning_content`, and avoid guardian review for local models. ([#91390](openclaw/openclaw#91390), [#91709](openclaw/openclaw#91709), [#91507](openclaw/openclaw#91507), [#91567](openclaw/openclaw#91567), [#88630](openclaw/openclaw#88630), [#91696](openclaw/openclaw#91696)) Thanks [@hxy91819](https://github.com/hxy91819), [@brokemac79](https://github.com/brokemac79), [@RomneyDa](https://github.com/RomneyDa), [@joshavant](https://github.com/joshavant), and [@Coder-Wangyankun](https://github.com/Coder-Wangyankun). - Updates/builds: recover package Gateway restarts after refresh failure, expose plugin convergence repair, fall back to Corepack in PATH-less pnpm environments, seed the correct Docker store packages, and keep ClawHub dry-run and publish paths reusable. ([#91581](openclaw/openclaw#91581), [#91599](openclaw/openclaw#91599), [#91547](openclaw/openclaw#91547), [#91591](openclaw/openclaw#91591)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev), [@sallyom](https://github.com/sallyom), and [@Patrick-Erichsen](https://github.com/Patrick-Erichsen). - UI: require explicit user intent before opening chat sessions and drain restored chat queues after session switches. ([#91480](openclaw/openclaw#91480)) Thanks [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Android: avoid the `dataSync` foreground-service type for persistent nodes. ([#80082](openclaw/openclaw#80082)) Thanks [@davelutztx](https://github.com/davelutztx). - Native hooks: bound relay lifetimes so abandoned native hook connections cannot linger indefinitely. ([#91550](openclaw/openclaw#91550)) Thanks [@joshavant](https://github.com/joshavant). </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/1040

fix(codex): guard sandbox http requests

1e64469

openclaw-barnacle Bot added extensions: codex size: S maintainer Maintainer-authored PR labels Jun 9, 2026

fix(codex): align sandbox http policy

469c26c

openclaw-barnacle Bot added size: M and removed size: S labels Jun 9, 2026

eleqtrizit self-assigned this Jun 9, 2026

eleqtrizit merged commit 21410d1 into openclaw:main Jun 9, 2026
198 of 211 checks passed

github-actions Bot mentioned this pull request Jun 9, 2026

📡 Upstream Digest — 2026-06-09 21:46 UTC curtismercier/openclaw-mods#1048

Open

github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jun 10, 2026

fix(codex): guard sandbox http requests (openclaw#91752)

0fa5b62

* fix(codex): guard sandbox http requests * fix(codex): align sandbox http policy

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(codex): guard sandbox http requests#91752

fix(codex): guard sandbox http requests#91752
eleqtrizit merged 2 commits into
openclaw:mainfrom
eleqtrizit:734

eleqtrizit commented Jun 9, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading

Uh oh!

eleqtrizit commented Jun 9, 2026

Uh oh!

eleqtrizit commented Jun 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

eleqtrizit commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Validation

Notes

Uh oh!

clawsweeper Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

eleqtrizit commented Jun 9, 2026

Behavioral proof for ClawSweeper

Uh oh!

eleqtrizit commented Jun 9, 2026

Relevance

Compatibility

ClawSweeper

Code Reviews Completed

Complete Verification Table

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

eleqtrizit commented Jun 9, 2026 •

edited

Loading

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading