openclaw/docs/plugins/codex-harness-runtime/sandbox-streaming.md

summary	read_when	title	sidebarTitle
Experimental native sandbox execution streaming and node-backed remote exec	You are enabling the experimental sandbox exec-server You are running Codex native execution on a paired node	Codex sandbox process streaming	Sandbox streaming

Opt-in streaming for sandboxed native execution, and how node-backed remote exec differs from it. Part of the Codex harness runtime guide; Where each section moved lists every section.

Experimental sandbox process streaming

Native sandbox execution remains opt-in through appServer.experimental.sandboxExecServer. When enabled for an active OpenClaw sandbox, sandboxed processes stream ordered stdout, stderr, or PTY output notifications. OpenClaw retains only a bounded recent-output buffer for polling and replay, so long-running processes cannot grow the app-server bridge without limit. Process exit and cleanup remain tied to the sandbox-owned process. Failed environment registration never falls back to host execution.

Interactive commands receive a real terminal. Ctrl-C interrupts both interactive and noninteractive native commands. Closing the exec-server connection cancels its outstanding HTTP requests and waits for cleanup before releasing the sandbox lease.

See Sandboxed native execution for configuration and local-only transport restrictions.

Node-backed remote-exec, whether on a paired device or the same Crabbox cloud profile used for OpenClaw worker turns, is separate from the experimental local sandbox flag. Codex app-server and model auth stay on the Gateway, while an explicitly authorized managed exec-server on the enrolled node owns process, filesystem, capability, and credential-free HTTP operations. The Gateway rejects authentication, cookie, API-key, and other sensitive HTTP headers before they reach the node; authenticated HTTP must run on the Gateway. The existing duplex node channel carries the Codex JSON-RPC stream without starting an OpenClaw worker child or consuming a worker slot. Explicit Gateway command allowlisting remains required. Launch needs per-attempt allow-once approval or exact admitted session Full access with node-local full/off policy. Full access never overrides local deny, ask, or allowlist restrictions, pairing, hosting consent, command authorization, or tool policy. The node rechecks local policy immediately before spawning the pinned binary; a stale launch is refused. Each attempt owns an isolated Gateway app-server client so its remote environment registration retires with that attempt. Disconnect ends the active attempt and its remote processes; reconnect allows only a fresh attempt. Normal Codex turns work, but /btw side questions fail closed because they are not placement-bound. The placement workspace does not confine execution: process and filesystem access remain bounded only by the node's operating system account.

A turn assigned to an active remote placement uses that execution owner, including for writable-sandbox checks. The Gateway still prepares source files and prompt attachments under its host filesystem policy; remote execution roots remain owned by the placement. Local sandbox allocation is reserved for turns without a remote placement.