openclaw - 💡(How to fix) Fix OpenClaw Codex runtime silently injects coding-agent base prompt into operational agents [2 comments, 2 participants]

Summary

OpenClaw can route normal operational agents through the @openclaw/codex app-server harness via agentRuntime.id = "codex". In this configuration, the active agent receives Codex coding-agent base instructions such as You are Codex, a coding agent based on GPT-5... even when the user is interacting with an OpenClaw operational agent in a non-repo workspace.

This appears to be an unintended and invasive prompt/runtime contamination path. It silently changes the agent's behavior profile and can cause repo/code-workflow assumptions to leak into operational direct-chat work.

Environment

• OpenClaw: 2026.5.19-beta.1
• Codex plugin: @openclaw/[email protected]
• Codex CLI dependency: @openai/[email protected]
• Agent: Argus
• Workspace: /home/argus/.openclaw/workspace
• Per-agent Codex home: /home/argus/.openclaw/agents/argus/agent/codex-home
• Model involved: gpt-5.5
• Approval policy in turn context: never
• Sandbox policy in turn context: danger-full-access

Evidence

Native Codex rollout JSONL under per-agent codex-home contains:

• type = "session_meta"
• payload.originator = "openclaw"
• payload.cwd = "/home/argus/.openclaw/workspace"
• payload.base_instructions.text starts with You are Codex, a coding agent based on GPT-5...
• base instructions include repo/Git/worktree guidance

OpenClaw config contains:

• plugins.entries.codex.enabled = true
• OPENCLAW_DEFAULT_MODEL = openai-codex/gpt-5.5
• multiple agentRuntime.id = "codex" mappings under agent defaults and agent-specific models

Expected Behavior

Operational OpenClaw agents should not receive hidden Codex coding-agent base prompts unless the user explicitly opts into a Codex coding session. Runtime selection should be visible, auditable, and gated by context class.

Actual Behavior

Normal direct-chat operational turns can run under Codex app-server and receive Codex coding-agent instructions. The user-visible conversation does not clearly show that this behavioral layer has been injected.

Impact

• Repo/worktree assumptions leak into non-repo operational workspace activity.
• Agent may perform inappropriate Git verification or code-harness behaviors.
• Debugging is difficult because the prompt source is stored in native Codex rollout logs, not surfaced clearly in normal OpenClaw context.
• Multi-agent OpenClaw deployments can unknowingly inherit the same contamination wherever model mappings route to agentRuntime.id = "codex".

Requested Fixes

1. Do not use Codex app-server as the default runtime for operational agents.
2. Require explicit opt-in for Codex runtime per session/task.
3. Surface active harness/base-prompt identity in session diagnostics.
4. Add a hard config warning when an operational workspace is routed through Codex.
5. Add a runtime preflight that blocks Git verification commands in non-Git workspaces.
6. Provide a quarantine/disable command that removes Codex runtime mappings from all agents, not only plugins.entries.codex.enabled.
7. Add regression tests proving that OpenClaw direct-chat agents do not receive Codex coding-agent base instructions unless explicitly requested.

Proposed Security Classification

Treat as a prompt-boundary and runtime-confusion vulnerability. It is not necessarily malicious dependency behavior, but it creates a hostile-equivalent failure mode because hidden instructions override the expected operational-agent contract.