@@ -271,12 +271,34 @@ By default, the plugin starts Codex locally with:
271271codex app-server --listen stdio://
272272```
273273274-By default, OpenClaw starts local Codex harness sessions fully unchained:
275-`approvalPolicy: "never"` and `sandbox: "danger-full-access"`. That matches the
276-trusted local operator posture used by the Codex CLI and lets autonomous
277-heartbeats use network and shell tools without waiting on an invisible native
278-approval path. You can tighten that policy, for example by routing reviews
279-through the guardian:
274+By default, OpenClaw starts local Codex harness sessions in YOLO mode:
275+`approvalPolicy: "never"`, `approvalsReviewer: "user"`, and
276+`sandbox: "danger-full-access"`. This is the trusted local operator posture used
277+for autonomous heartbeats: Codex can use shell and network tools without
278+stopping on native approval prompts that nobody is around to answer.
279+280+To opt in to Codex guardian-reviewed approvals, set `appServer.mode:
281+"guardian"`:
282+283+```json5
284+{
285+ plugins: {
286+ entries: {
287+ codex: {
288+ enabled: true,
289+ config: {
290+ appServer: {
291+ mode: "guardian",
292+ serviceTier: "priority",
293+ },
294+ },
295+ },
296+ },
297+ },
298+}
299+```
300+301+Guardian mode expands to:
280302281303```json5
282304{
@@ -286,10 +308,10 @@ through the guardian:
286308 enabled: true,
287309 config: {
288310 appServer: {
289- approvalPolicy: "untrusted",
311+ mode: "guardian",
312+ approvalPolicy: "on-request",
290313 approvalsReviewer: "guardian_subagent",
291314 sandbox: "workspace-write",
292- serviceTier: "priority",
293315 },
294316 },
295317 },
@@ -298,6 +320,23 @@ through the guardian:
298320}
299321```
300322323+Guardian is a native Codex approval reviewer. When Codex asks to leave the
324+sandbox, write outside the workspace, or add permissions such as network access,
325+Codex routes that approval request to a reviewer subagent instead of a human
326+prompt. The reviewer gathers context and applies Codex's risk framework, then
327+approves or denies the specific request. Guardian is useful when you want more
328+guardrails than YOLO mode but still need unattended agents and heartbeats to
329+make progress.
330+331+The Docker live harness includes a Guardian probe when
332+`OPENCLAW_LIVE_CODEX_HARNESS_GUARDIAN_PROBE=1`. It starts the Codex harness in
333+Guardian mode, verifies that a benign escalated shell command is approved, and
334+verifies that a fake-secret upload to an untrusted external destination is
335+denied so the agent asks back for explicit approval.
336+337+The individual policy fields still win over `mode`, so advanced deployments can
338+mix the preset with explicit choices.
339+301340For an already-running app-server, use WebSocket transport:
302341303342```json5
@@ -322,30 +361,35 @@ For an already-running app-server, use WebSocket transport:
322361323362Supported `appServer` fields:
324363325-| Field | Default | Meaning |
326-| ------------------- | ---------------------------------------- | ------------------------------------------------------------------------ |
327-| `transport` | `"stdio"` | `"stdio"` spawns Codex; `"websocket"` connects to `url`. |
328-| `command` | `"codex"` | Executable for stdio transport. |
329-| `args` | `["app-server", "--listen", "stdio://"]` | Arguments for stdio transport. |
330-| `url` | unset | WebSocket app-server URL. |
331-| `authToken` | unset | Bearer token for WebSocket transport. |
332-| `headers` | `{}` | Extra WebSocket headers. |
333-| `requestTimeoutMs` | `60000` | Timeout for app-server control-plane calls. |
334-| `approvalPolicy` | `"never"` | Native Codex approval policy sent to thread start/resume/turn. |
335-| `sandbox` | `"danger-full-access"` | Native Codex sandbox mode sent to thread start/resume. |
336-| `approvalsReviewer` | `"user"` | Use `"guardian_subagent"` to let Codex guardian review native approvals. |
337-| `serviceTier` | unset | Optional Codex service tier, for example `"priority"`. |
364+| Field | Default | Meaning |
365+| ------------------- | ---------------------------------------- | --------------------------------------------------------------- |
366+| `transport` | `"stdio"` | `"stdio"` spawns Codex; `"websocket"` connects to `url`. |
367+| `command` | `"codex"` | Executable for stdio transport. |
368+| `args` | `["app-server", "--listen", "stdio://"]` | Arguments for stdio transport. |
369+| `url` | unset | WebSocket app-server URL. |
370+| `authToken` | unset | Bearer token for WebSocket transport. |
371+| `headers` | `{}` | Extra WebSocket headers. |
372+| `requestTimeoutMs` | `60000` | Timeout for app-server control-plane calls. |
373+| `mode` | `"yolo"` | Preset for YOLO or guardian-reviewed execution. |
374+| `approvalPolicy` | `"never"` | Native Codex approval policy sent to thread start/resume/turn. |
375+| `sandbox` | `"danger-full-access"` | Native Codex sandbox mode sent to thread start/resume. |
376+| `approvalsReviewer` | `"user"` | Use `"guardian_subagent"` to let Codex Guardian review prompts. |
377+| `serviceTier` | unset | Optional Codex service tier, for example `"priority"`. |
338378339379The older environment variables still work as fallbacks for local testing when
340380the matching config field is unset:
341381342382- `OPENCLAW_CODEX_APP_SERVER_BIN`
343383- `OPENCLAW_CODEX_APP_SERVER_ARGS`
384+- `OPENCLAW_CODEX_APP_SERVER_MODE=yolo|guardian`
344385- `OPENCLAW_CODEX_APP_SERVER_APPROVAL_POLICY`
345386- `OPENCLAW_CODEX_APP_SERVER_SANDBOX`
346-- `OPENCLAW_CODEX_APP_SERVER_GUARDIAN=1`
347387348-Config is preferred for repeatable deployments.
388+`OPENCLAW_CODEX_APP_SERVER_GUARDIAN=1` was removed. Use
389+`plugins.entries.codex.config.appServer.mode: "guardian"` instead, or
390+`OPENCLAW_CODEX_APP_SERVER_MODE=guardian` for one-off local testing. Config is
391+preferred for repeatable deployments because it keeps the plugin behavior in the
392+same reviewed file as the rest of the Codex harness setup.
349393350394## Common recipes
351395@@ -390,6 +434,7 @@ Guardian-reviewed Codex approvals:
390434 enabled: true,
391435 config: {
392436 appServer: {
437+ mode: "guardian",
393438 approvalPolicy: "on-request",
394439 approvalsReviewer: "guardian_subagent",
395440 sandbox: "workspace-write",
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。