fix(messaging): keep build plan out of image env

.github/workflows/sandbox-images-and-e2e.yaml

@@ -141,7 +141,7 @@ jobs:
         name: Set up Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
         with:
-          node-version: 22
+          node-version: 22.19.0
           cache: npm
 
       - &install-root-dependencies
@@ -236,6 +236,59 @@ jobs:
         shell: bash
         run: bash .github/scripts/docker-auth-cleanup.sh
 
+  messaging-plan-image-boundary:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - *checkout
+
+      - *dockerhub-auth
+
+      - *setup-node
+
+      - name: Resolve sandbox base image
+        uses: ./.github/actions/resolve-sandbox-base-image
+
+      - name: Resolve Hermes base image
+        uses: ./.github/actions/resolve-hermes-base-image
+
+      - name: Build and verify OpenClaw messaging plan boundary
+        env:
+          BASE_IMAGE: ${{ env.BASE_IMAGE }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          messaging_plan_b64="$(node --experimental-strip-types scripts/check-messaging-plan-image-boundary.mts plan openclaw)"
+          build_args=(
+            --build-arg "BASE_IMAGE=${BASE_IMAGE}"
+            --build-arg "NEMOCLAW_MESSAGING_PLAN_B64=${messaging_plan_b64}"
+          )
+          scripts/check-production-build-args.sh "${build_args[@]}"
+          docker build "${build_args[@]}" -t nemoclaw-openclaw-plan-boundary .
+          node --experimental-strip-types scripts/check-messaging-plan-image-boundary.mts verify \
+            nemoclaw-openclaw-plan-boundary openclaw
+
+      - name: Build and verify Hermes messaging plan boundary
+        env:
+          HERMES_BASE_IMAGE: ${{ env.HERMES_BASE_IMAGE }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          messaging_plan_b64="$(node --experimental-strip-types scripts/check-messaging-plan-image-boundary.mts plan hermes)"
+          build_args=(
+            -f agents/hermes/Dockerfile
+            --build-arg "BASE_IMAGE=${HERMES_BASE_IMAGE}"
+            --build-arg "NEMOCLAW_MESSAGING_PLAN_B64=${messaging_plan_b64}"
+          )
+          scripts/check-production-build-args.sh "${build_args[@]}"
+          docker build "${build_args[@]}" -t nemoclaw-hermes-plan-boundary .
+          node --experimental-strip-types scripts/check-messaging-plan-image-boundary.mts verify \
+            nemoclaw-hermes-plan-boundary hermes
+
+      - name: Clean up Docker auth
+        if: always()
+        shell: bash
+        run: bash .github/scripts/docker-auth-cleanup.sh
   state-dir-guard-metadata:
     runs-on: ubuntu-latest
     timeout-minutes: 30
@@ -290,7 +343,6 @@ jobs:
       - name: Upload state-dir guard metadata artifacts
         if: always()
         uses: ./.github/actions/upload-e2e-artifacts
-
   build-sandbox-images-arm64:
     if: inputs.run_arm64
     runs-on: ubuntu-24.04-arm

Dockerfile

@@ -920,8 +920,10 @@ ARG NEMOCLAW_OPENCLAW_OTEL_SAMPLE_RATE=1.0
 # certificate, not a secret, so baking it into an image layer is acceptable.
 ARG NEMOCLAW_CORPORATE_CA_B64=
 
-# SECURITY: Promote build-args to env vars so the TypeScript script reads them
+# SECURITY: Promote persistent image config to env vars so TypeScript reads it
 # via process.env, never via string interpolation into executable source code.
+# NEMOCLAW_MESSAGING_PLAN_B64 intentionally remains ARG-only: Docker exposes it
+# to build RUN processes without retaining the full plan in the final image env.
 # Direct ARG interpolation into inline source is a code injection vector (C-2).
 ENV NEMOCLAW_MODEL=${NEMOCLAW_MODEL} \
     NEMOCLAW_PROVIDER_KEY=${NEMOCLAW_PROVIDER_KEY} \
@@ -938,7 +940,6 @@ ENV NEMOCLAW_MODEL=${NEMOCLAW_MODEL} \
     NEMOCLAW_AGENT_TIMEOUT=${NEMOCLAW_AGENT_TIMEOUT} \
     NEMOCLAW_AGENT_HEARTBEAT_EVERY=${NEMOCLAW_AGENT_HEARTBEAT_EVERY} \
     NEMOCLAW_INFERENCE_COMPAT_B64=${NEMOCLAW_INFERENCE_COMPAT_B64} \
-    NEMOCLAW_MESSAGING_PLAN_B64=${NEMOCLAW_MESSAGING_PLAN_B64} \
     NEMOCLAW_EXTRA_AGENTS_JSON_B64=${NEMOCLAW_EXTRA_AGENTS_JSON_B64} \
     NEMOCLAW_OPENCLAW_WECHAT_PLUGIN_PREINSTALLED=1 \
     NEMOCLAW_DASHBOARD_BIND=${NEMOCLAW_DASHBOARD_BIND} \

agents/hermes/Dockerfile

@@ -292,7 +292,9 @@ ARG NEMOCLAW_CORPORATE_CA_B64=
 # cannot override the real window (#6177).
 ARG NEMOCLAW_CONTEXT_WINDOW=
 
-# Promote build-args to env vars for the config generation script.
+# Promote persistent image config to env vars for config generation.
+# NEMOCLAW_MESSAGING_PLAN_B64 intentionally remains ARG-only: Docker exposes it
+# to build RUN processes without retaining the full plan in the final image env.
 ENV NEMOCLAW_MODEL=${NEMOCLAW_MODEL} \
     NEMOCLAW_PROVIDER_KEY=${NEMOCLAW_PROVIDER_KEY} \
     NEMOCLAW_UPSTREAM_PROVIDER=${NEMOCLAW_UPSTREAM_PROVIDER} \
@@ -301,7 +303,6 @@ ENV NEMOCLAW_MODEL=${NEMOCLAW_MODEL} \
     NEMOCLAW_CONTEXT_WINDOW=${NEMOCLAW_CONTEXT_WINDOW} \
     NEMOCLAW_TOOL_DISCLOSURE=${NEMOCLAW_TOOL_DISCLOSURE} \
     CHAT_UI_URL=${CHAT_UI_URL} \
-    NEMOCLAW_MESSAGING_PLAN_B64=${NEMOCLAW_MESSAGING_PLAN_B64} \
     NEMOCLAW_WEB_SEARCH_ENABLED=${NEMOCLAW_WEB_SEARCH_ENABLED} \
     NEMOCLAW_WEB_SEARCH_PROVIDER=${NEMOCLAW_WEB_SEARCH_PROVIDER} \
     NEMOCLAW_HERMES_TOOL_GATEWAY_BROKER=${NEMOCLAW_HERMES_TOOL_GATEWAY_BROKER} \

ci/source-shape-test-budget.json

@@ -261,6 +261,11 @@
       "test": "runs final-destroy against a pinned Docker setup on trusted Intel macOS",
       "category": "compatibility"
     },
+    {
+      "file": "test/messaging-image-env-contract.test.ts",
+      "test": "%s keeps the full plan in build processes but not final runtime environments (#5896)",
+      "category": "security"
+    },
     {
       "file": "test/mcp-openshell-workflow.test.ts",
       "test": "keeps the setup docs aligned with the stable default",