@kodelyth/codex 2026.5.40 → 2026.5.42

package/src/app-server/run-attempt.vision-tools.test.ts

@@ -0,0 +1,35 @@
+import { describe, expect, it } from "vitest";
+import { filterToolsForVisionInputs } from "./vision-tools.js";
+
+describe("Codex dynamic tool filtering", () => {
+  it("drops the image tool when the model already has inbound vision input", () => {
+    const toolNames = filterToolsForVisionInputs(
+      [{ name: "image" }, { name: "read" }, { name: "write" }],
+      {
+        modelHasVision: true,
+        hasInboundImages: true,
+      },
+    ).map((tool) => tool.name);
+
+    expect(toolNames).toContain("read");
+    expect(toolNames).toContain("write");
+    expect(toolNames).not.toContain("image");
+  });
+
+  it("keeps the image tool unless both model vision and inbound images are present", () => {
+    const tools = [{ name: "image" }, { name: "read" }];
+
+    expect(
+      filterToolsForVisionInputs(tools, {
+        modelHasVision: false,
+        hasInboundImages: true,
+      }),
+    ).toBe(tools);
+    expect(
+      filterToolsForVisionInputs(tools, {
+        modelHasVision: true,
+        hasInboundImages: false,
+      }),
+    ).toBe(tools);
+  });
+});

package/src/app-server/schema-normalization-runtime-contract.test.ts

@@ -0,0 +1,206 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import type { EmbeddedRunAttemptParams } from "klaw/plugin-sdk/agent-harness";
+import {
+  createParameterFreeTool,
+  createPermissiveTool,
+  normalizedParameterFreeSchema,
+} from "klaw/plugin-sdk/agent-runtime-test-contracts";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import type { CodexThreadStartParams } from "./protocol.js";
+import { createCodexTestModel } from "./test-support.js";
+import { startOrResumeThread } from "./thread-lifecycle.js";
+
+let tempDir: string;
+
+function createParams(sessionFile: string, workspaceDir: string): EmbeddedRunAttemptParams {
+  return {
+    prompt: "hello",
+    sessionId: "session-1",
+    sessionKey: "agent:main:session-1",
+    sessionFile,
+    workspaceDir,
+    runId: "run-1",
+    provider: "codex",
+    modelId: "gpt-5.4",
+    model: createCodexTestModel("codex"),
+    thinkLevel: "medium",
+    disableTools: true,
+    timeoutMs: 5_000,
+    authStorage: {} as never,
+    authProfileStore: { version: 1, profiles: {} },
+    modelRegistry: {} as never,
+  } as EmbeddedRunAttemptParams;
+}
+
+function createAppServerOptions(): Parameters<typeof startOrResumeThread>[0]["appServer"] {
+  return {
+    start: {
+      transport: "stdio",
+      command: "codex",
+      args: ["app-server"],
+      headers: {},
+    },
+    codeModeOnly: false,
+    requestTimeoutMs: 60_000,
+    turnCompletionIdleTimeoutMs: 60_000,
+    approvalPolicy: "never",
+    approvalsReviewer: "user",
+    sandbox: "workspace-write",
+  };
+}
+
+function threadStartResult(threadId = "thread-1", serviceTier: string | null = null) {
+  return {
+    thread: {
+      id: threadId,
+      sessionId: "session-1",
+      forkedFromId: null,
+      preview: "",
+      ephemeral: false,
+      modelProvider: "openai",
+      createdAt: 1,
+      updatedAt: 1,
+      status: { type: "idle" },
+      path: null,
+      cwd: tempDir,
+      cliVersion: "0.125.0",
+      source: "unknown",
+      agentNickname: null,
+      agentRole: null,
+      gitInfo: null,
+      name: null,
+      turns: [],
+    },
+    model: "gpt-5.4",
+    modelProvider: "openai",
+    serviceTier,
+    cwd: tempDir,
+    instructionSources: [],
+    approvalPolicy: "never",
+    approvalsReviewer: "user",
+    sandbox: { type: "dangerFullAccess" },
+    permissionProfile: null,
+    reasoningEffort: null,
+  };
+}
+
+describe("Codex app-server dynamic tool schema boundary contract", () => {
+  beforeEach(async () => {
+    tempDir = await fs.mkdtemp(path.join(os.tmpdir(), "klaw-codex-schema-contract-"));
+  });
+
+  afterEach(async () => {
+    await fs.rm(tempDir, { recursive: true, force: true });
+    vi.restoreAllMocks();
+  });
+
+  it("passes prepared executable dynamic tool schemas through thread start unchanged", async () => {
+    const sessionFile = path.join(tempDir, "session.jsonl");
+    const workspaceDir = path.join(tempDir, "workspace");
+    const parameterFreeTool = createParameterFreeTool("message");
+    const dynamicTool = {
+      name: parameterFreeTool.name,
+      description: parameterFreeTool.description,
+      inputSchema: normalizedParameterFreeSchema(),
+    };
+    const request = vi.fn(async (method: string, _payload?: unknown) => {
+      if (method === "thread/start") {
+        return threadStartResult();
+      }
+      throw new Error(`unexpected method: ${method}`);
+    });
+
+    await startOrResumeThread({
+      client: { request } as never,
+      params: createParams(sessionFile, workspaceDir),
+      cwd: workspaceDir,
+      dynamicTools: [dynamicTool],
+      appServer: createAppServerOptions(),
+    });
+
+    expect(request).toHaveBeenCalledTimes(1);
+    const [method, payload] = request.mock.calls[0] ?? [];
+    if (method !== "thread/start") {
+      throw new Error(`expected thread/start request, got ${method}`);
+    }
+    const startPayload = payload as CodexThreadStartParams | undefined;
+    expect(startPayload?.dynamicTools).toStrictEqual([dynamicTool]);
+    expect(startPayload?.cwd).toBe(workspaceDir);
+    expect(startPayload?.model).toBe("gpt-5.4");
+    expect(startPayload?.modelProvider).toBeUndefined();
+    expect(startPayload?.approvalPolicy).toBe("never");
+    expect(startPayload?.approvalsReviewer).toBe("user");
+    expect(startPayload?.sandbox).toBe("workspace-write");
+    expect(startPayload?.serviceName).toBe("Klaw");
+    expect(startPayload?.experimentalRawEvents).toBe(true);
+    expect(startPayload?.persistExtendedHistory).toBe(true);
+    expect(typeof startPayload?.developerInstructions).toBe("string");
+    expect(startPayload?.developerInstructions).toContain("Klaw");
+  });
+
+  it("accepts Codex app-server priority service tier responses", async () => {
+    const sessionFile = path.join(tempDir, "session.jsonl");
+    const workspaceDir = path.join(tempDir, "workspace");
+    const request = vi.fn(async (method: string) => {
+      if (method === "thread/start") {
+        return threadStartResult("thread-priority", "priority");
+      }
+      throw new Error(`unexpected method: ${method}`);
+    });
+
+    const binding = await startOrResumeThread({
+      client: { request } as never,
+      params: createParams(sessionFile, workspaceDir),
+      cwd: workspaceDir,
+      dynamicTools: [],
+      appServer: createAppServerOptions(),
+    });
+
+    expect(binding.threadId).toBe("thread-priority");
+  });
+
+  it("treats dynamic tool schema changes as thread-fingerprint changes", async () => {
+    const sessionFile = path.join(tempDir, "session.jsonl");
+    const workspaceDir = path.join(tempDir, "workspace");
+    const appServer = createAppServerOptions();
+    let nextThreadId = 1;
+    const request = vi.fn(async (method: string) => {
+      if (method === "thread/start") {
+        return threadStartResult(`thread-${nextThreadId++}`);
+      }
+      throw new Error(`unexpected method: ${method}`);
+    });
+
+    await startOrResumeThread({
+      client: { request } as never,
+      params: createParams(sessionFile, workspaceDir),
+      cwd: workspaceDir,
+      dynamicTools: [
+        {
+          name: "message",
+          description: "Permissive test tool",
+          inputSchema: { type: "object" },
+        },
+      ],
+      appServer,
+    });
+    const permissiveTool = createPermissiveTool("message");
+    await startOrResumeThread({
+      client: { request } as never,
+      params: createParams(sessionFile, workspaceDir),
+      cwd: workspaceDir,
+      dynamicTools: [
+        {
+          name: permissiveTool.name,
+          description: permissiveTool.description,
+          inputSchema: permissiveTool.parameters,
+        },
+      ],
+      appServer,
+    });
+
+    expect(request.mock.calls.map(([method]) => method)).toEqual(["thread/start", "thread/start"]);
+  });
+});

package/src/app-server/session-binding.test.ts

@@ -0,0 +1,303 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import {
+  clearCodexAppServerBinding,
+  readCodexAppServerBinding,
+  resolveCodexAppServerBindingPath,
+  writeCodexAppServerBinding,
+  type CodexAppServerAuthProfileLookup,
+} from "./session-binding.js";
+
+let tempDir: string;
+
+const nativeAuthLookup: Pick<CodexAppServerAuthProfileLookup, "authProfileStore"> = {
+  authProfileStore: {
+    version: 1,
+    profiles: {
+      work: {
+        type: "oauth",
+        provider: "openai-codex",
+        access: "access-token",
+        refresh: "refresh-token",
+        expires: Date.now() + 60_000,
+      },
+    },
+  },
+};
+
+async function writeCodexCliAuthFile(codexHome: string): Promise<void> {
+  await fs.mkdir(codexHome, { recursive: true });
+  await fs.writeFile(
+    path.join(codexHome, "auth.json"),
+    `${JSON.stringify({
+      tokens: {
+        access_token: "cli-access-token",
+        refresh_token: "cli-refresh-token",
+        account_id: "account-cli",
+      },
+    })}\n`,
+  );
+}
+
+describe("codex app-server session binding", () => {
+  beforeEach(async () => {
+    tempDir = await fs.mkdtemp(path.join(os.tmpdir(), "klaw-codex-binding-"));
+  });
+
+  afterEach(async () => {
+    vi.unstubAllEnvs();
+    await fs.rm(tempDir, { recursive: true, force: true });
+  });
+
+  it("round-trips the thread binding beside the PI session file", async () => {
+    const sessionFile = path.join(tempDir, "session.json");
+    await writeCodexAppServerBinding(sessionFile, {
+      threadId: "thread-123",
+      cwd: tempDir,
+      model: "gpt-5.4-codex",
+      modelProvider: "openai",
+      dynamicToolsFingerprint: "tools-v1",
+      userMcpServersFingerprint: "user-mcp-v1",
+    });
+
+    const binding = await readCodexAppServerBinding(sessionFile);
+
+    expect(binding?.schemaVersion).toBe(1);
+    expect(binding?.threadId).toBe("thread-123");
+    expect(binding?.sessionFile).toBe(sessionFile);
+    expect(binding?.cwd).toBe(tempDir);
+    expect(binding?.model).toBe("gpt-5.4-codex");
+    expect(binding?.modelProvider).toBe("openai");
+    expect(binding?.dynamicToolsFingerprint).toBe("tools-v1");
+    expect(binding?.userMcpServersFingerprint).toBe("user-mcp-v1");
+    const bindingStat = await fs.stat(resolveCodexAppServerBindingPath(sessionFile));
+    expect(bindingStat.isFile()).toBe(true);
+  });
+
+  it("round-trips plugin app policy context with app ids as record keys", async () => {
+    const sessionFile = path.join(tempDir, "session.json");
+    const pluginAppPolicyContext = {
+      fingerprint: "plugin-policy-1",
+      apps: {
+        "google-calendar-app": {
+          configKey: "google-calendar",
+          marketplaceName: "openai-curated" as const,
+          pluginName: "google-calendar",
+          allowDestructiveActions: true,
+          mcpServerNames: ["google-calendar"],
+        },
+      },
+      pluginAppIds: {
+        "google-calendar": ["google-calendar-app"],
+      },
+    };
+    await writeCodexAppServerBinding(sessionFile, {
+      threadId: "thread-123",
+      cwd: tempDir,
+      pluginAppPolicyContext,
+    });
+
+    const binding = await readCodexAppServerBinding(sessionFile);
+
+    expect(binding?.pluginAppPolicyContext).toEqual(pluginAppPolicyContext);
+  });
+
+  it("round-trips context-engine binding metadata", async () => {
+    const sessionFile = path.join(tempDir, "session.json");
+    await writeCodexAppServerBinding(sessionFile, {
+      threadId: "thread-123",
+      cwd: tempDir,
+      contextEngine: {
+        schemaVersion: 1,
+        engineId: "lossless-claw",
+        policyFingerprint: "lossless-policy-1",
+      },
+    });
+
+    const binding = await readCodexAppServerBinding(sessionFile);
+
+    expect(binding?.contextEngine).toEqual({
+      schemaVersion: 1,
+      engineId: "lossless-claw",
+      policyFingerprint: "lossless-policy-1",
+    });
+  });
+
+  it("rejects old plugin app policy entries that duplicate the app id", async () => {
+    const sessionFile = path.join(tempDir, "session.json");
+    await fs.writeFile(
+      resolveCodexAppServerBindingPath(sessionFile),
+      `${JSON.stringify({
+        schemaVersion: 1,
+        threadId: "thread-123",
+        sessionFile,
+        cwd: tempDir,
+        pluginAppPolicyContext: {
+          fingerprint: "plugin-policy-1",
+          apps: {
+            "google-calendar-app": {
+              appId: "google-calendar-app",
+              configKey: "google-calendar",
+              marketplaceName: "openai-curated",
+              pluginName: "google-calendar",
+              allowDestructiveActions: true,
+              mcpServerNames: ["google-calendar"],
+            },
+          },
+          pluginAppIds: {
+            "google-calendar": ["google-calendar-app"],
+          },
+        },
+        createdAt: "2026-05-03T00:00:00.000Z",
+        updatedAt: "2026-05-03T00:00:00.000Z",
+      })}\n`,
+    );
+
+    const binding = await readCodexAppServerBinding(sessionFile);
+
+    expect(binding?.pluginAppPolicyContext).toBeUndefined();
+  });
+
+  it("does not persist public OpenAI as the provider for Codex-native auth bindings", async () => {
+    const sessionFile = path.join(tempDir, "session.json");
+    await writeCodexAppServerBinding(
+      sessionFile,
+      {
+        threadId: "thread-123",
+        cwd: tempDir,
+        authProfileId: "work",
+        model: "gpt-5.4-mini",
+        modelProvider: "openai",
+      },
+      nativeAuthLookup,
+    );
+
+    const raw = await fs.readFile(resolveCodexAppServerBindingPath(sessionFile), "utf8");
+    const binding = await readCodexAppServerBinding(sessionFile, nativeAuthLookup);
+
+    expect(raw).not.toContain('"modelProvider": "openai"');
+    expect(binding?.threadId).toBe("thread-123");
+    expect(binding?.authProfileId).toBe("work");
+    expect(binding?.model).toBe("gpt-5.4-mini");
+    expect(binding?.modelProvider).toBeUndefined();
+  });
+
+  it("normalizes older Codex-native bindings that stored public OpenAI provider", async () => {
+    const sessionFile = path.join(tempDir, "session.json");
+    await fs.writeFile(
+      resolveCodexAppServerBindingPath(sessionFile),
+      `${JSON.stringify({
+        schemaVersion: 1,
+        threadId: "thread-123",
+        sessionFile,
+        cwd: tempDir,
+        authProfileId: "work",
+        model: "gpt-5.4-mini",
+        modelProvider: "openai",
+        createdAt: "2026-05-03T00:00:00.000Z",
+        updatedAt: "2026-05-03T00:00:00.000Z",
+      })}\n`,
+    );
+
+    const binding = await readCodexAppServerBinding(sessionFile, nativeAuthLookup);
+
+    expect(binding?.authProfileId).toBe("work");
+    expect(binding?.modelProvider).toBeUndefined();
+  });
+
+  it("normalizes legacy fast service tier bindings to Codex priority", async () => {
+    const sessionFile = path.join(tempDir, "session.json");
+    await fs.writeFile(
+      resolveCodexAppServerBindingPath(sessionFile),
+      `${JSON.stringify({
+        schemaVersion: 1,
+        threadId: "thread-123",
+        sessionFile,
+        cwd: tempDir,
+        serviceTier: "fast",
+        createdAt: "2026-05-03T00:00:00.000Z",
+        updatedAt: "2026-05-03T00:00:00.000Z",
+      })}\n`,
+    );
+
+    const binding = await readCodexAppServerBinding(sessionFile);
+
+    expect(binding?.serviceTier).toBe("priority");
+  });
+
+  it("does not infer native Codex auth from the profile id prefix", async () => {
+    const sessionFile = path.join(tempDir, "session.json");
+    await writeCodexAppServerBinding(
+      sessionFile,
+      {
+        threadId: "thread-123",
+        cwd: tempDir,
+        authProfileId: "openai-codex:work",
+        model: "gpt-5.4-mini",
+        modelProvider: "openai",
+      },
+      {
+        authProfileStore: {
+          version: 1,
+          profiles: {
+            "openai-codex:work": {
+              type: "api_key",
+              provider: "openai",
+              key: "sk-test",
+            },
+          },
+        },
+      },
+    );
+
+    const binding = await readCodexAppServerBinding(sessionFile, {
+      authProfileStore: {
+        version: 1,
+        profiles: {
+          "openai-codex:work": {
+            type: "api_key",
+            provider: "openai",
+            key: "sk-test",
+          },
+        },
+      },
+    });
+
+    expect(binding?.modelProvider).toBe("openai");
+  });
+
+  it("normalizes Codex CLI OAuth bindings even without a local auth profile slot", async () => {
+    const sessionFile = path.join(tempDir, "session.json");
+    const codexHome = path.join(tempDir, "codex-cli");
+    const agentDir = path.join(tempDir, "agent");
+    vi.stubEnv("CODEX_HOME", codexHome);
+    await writeCodexCliAuthFile(codexHome);
+
+    await writeCodexAppServerBinding(
+      sessionFile,
+      {
+        threadId: "thread-123",
+        cwd: tempDir,
+        authProfileId: "openai-codex:default",
+        model: "gpt-5.4-mini",
+        modelProvider: "openai",
+      },
+      { agentDir },
+    );
+
+    const raw = await fs.readFile(resolveCodexAppServerBindingPath(sessionFile), "utf8");
+    const binding = await readCodexAppServerBinding(sessionFile, { agentDir });
+
+    expect(raw).not.toContain('"modelProvider": "openai"');
+    expect(binding?.authProfileId).toBe("openai-codex:default");
+    expect(binding?.modelProvider).toBeUndefined();
+  });
+
+  it("clears missing bindings without throwing", async () => {
+    const sessionFile = path.join(tempDir, "missing.json");
+    await clearCodexAppServerBinding(sessionFile);
+    await expect(readCodexAppServerBinding(sessionFile)).resolves.toBeUndefined();
+  });
+});