@openclaw/acpx 2026.5.14-beta.1 → 2026.5.14-beta.2

package/dist/{process-reaper-DKzgrZt9.js → process-reaper-biYb35VD.js}

@@ -1,6 +1,6 @@
+import fs from "node:fs/promises";
 import path from "node:path";
 import { createHash, randomUUID } from "node:crypto";
-import fs from "node:fs/promises";
 import { readJsonFileWithFallback, writeJsonFileAtomically } from "openclaw/plugin-sdk/json-store";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
@@ -90,12 +90,8 @@ function hashAcpxProcessCommand(command) {
 function quoteEnvValue(value) {
 	return /^[A-Za-z0-9_./:=@+-]+$/.test(value) ? value : `'${value.replace(/'/g, "'\\''")}'`;
 }
-function withAcpxLeaseEnvironment(params) {
-	if ((params.platform ?? process.platform) === "win32") return params.command;
+function appendAcpxLeaseArgs(params) {
 	return [
-		"env",
-		`${OPENCLAW_ACPX_LEASE_ID_ENV}=${quoteEnvValue(params.leaseId)}`,
-		`${OPENCLAW_GATEWAY_INSTANCE_ID_ENV}=${quoteEnvValue(params.gatewayInstanceId)}`,
 		params.command,
 		OPENCLAW_ACPX_LEASE_ID_ARG,
 		quoteEnvValue(params.leaseId),
@@ -103,6 +99,15 @@ function withAcpxLeaseEnvironment(params) {
 		quoteEnvValue(params.gatewayInstanceId)
 	].join(" ");
 }
+function withAcpxLeaseEnvironment(params) {
+	if ((params.platform ?? process.platform) === "win32") return appendAcpxLeaseArgs(params);
+	return [
+		"env",
+		`${OPENCLAW_ACPX_LEASE_ID_ENV}=${quoteEnvValue(params.leaseId)}`,
+		`${OPENCLAW_GATEWAY_INSTANCE_ID_ENV}=${quoteEnvValue(params.gatewayInstanceId)}`,
+		appendAcpxLeaseArgs(params)
+	].join(" ");
+}
 //#endregion
 //#region extensions/acpx/src/process-reaper.ts
 const execFileAsync = promisify(execFile);
@@ -328,4 +333,4 @@ async function reapStaleOpenClawOwnedAcpxOrphans(params) {
 	};
 }
 //#endregion
-export { OPENCLAW_GATEWAY_INSTANCE_ID_ARG as a, hashAcpxProcessCommand as c, OPENCLAW_ACPX_LEASE_ID_ARG as i, withAcpxLeaseEnvironment as l, isOpenClawOwnedAcpxProcessCommand as n, createAcpxProcessLeaseId as o, reapStaleOpenClawOwnedAcpxOrphans as r, createAcpxProcessLeaseStore as s, cleanupOpenClawOwnedAcpxProcessTree as t };
+export { OPENCLAW_ACPX_LEASE_ID_ENV as a, createAcpxProcessLeaseStore as c, OPENCLAW_ACPX_LEASE_ID_ARG as i, hashAcpxProcessCommand as l, isOpenClawOwnedAcpxProcessCommand as n, OPENCLAW_GATEWAY_INSTANCE_ID_ARG as o, reapStaleOpenClawOwnedAcpxOrphans as r, createAcpxProcessLeaseId as s, cleanupOpenClawOwnedAcpxProcessTree as t, withAcpxLeaseEnvironment as u };

package/dist/register.runtime.js

@@ -5,7 +5,7 @@ const ENABLE_STARTUP_PROBE_ENV = "OPENCLAW_ACPX_RUNTIME_STARTUP_PROBE";
 const SKIP_RUNTIME_PROBE_ENV = "OPENCLAW_SKIP_ACPX_RUNTIME_PROBE";
 let serviceModulePromise = null;
 function loadServiceModule() {
-	serviceModulePromise ??= import("./service-DzWriMSw.js");
+	serviceModulePromise ??= import("./service-DPrf6fF8.js");
 	return serviceModulePromise;
 }
 function shouldRunStartupProbe(env = process.env) {

package/dist/{runtime-DeOzZoZw.js → runtime-HSzTNfOq.js}

@@ -1,9 +1,37 @@
 import { AcpRuntimeError } from "./runtime-api.js";
-import { c as hashAcpxProcessCommand, l as withAcpxLeaseEnvironment, n as isOpenClawOwnedAcpxProcessCommand, o as createAcpxProcessLeaseId, t as cleanupOpenClawOwnedAcpxProcessTree } from "./process-reaper-DKzgrZt9.js";
+import { l as hashAcpxProcessCommand, n as isOpenClawOwnedAcpxProcessCommand, s as createAcpxProcessLeaseId, t as cleanupOpenClawOwnedAcpxProcessTree, u as withAcpxLeaseEnvironment } from "./process-reaper-biYb35VD.js";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { resolve } from "node:path";
+import fs from "node:fs/promises";
+import path, { resolve } from "node:path";
 import { ACPX_BACKEND_ID, AcpxRuntime as AcpxRuntime$1, createAcpRuntime, createAgentRegistry, createFileSessionStore, decodeAcpxRuntimeHandleState, encodeAcpxRuntimeHandleState } from "acpx/runtime";
+import { redactSensitiveText } from "openclaw/plugin-sdk/security-runtime";
 //#region extensions/acpx/src/runtime.ts
+const CODEX_WRAPPER_STDERR_LOG_PREFIX = "codex-acp-wrapper.stderr";
+const CODEX_WRAPPER_ERROR_TAIL_MAX_CHARS = 6e3;
+function safeDiagnosticFilePart(value) {
+	return value.replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 120) || "unknown";
+}
+function codexWrapperStderrLogFileName(leaseId) {
+	return `${CODEX_WRAPPER_STDERR_LOG_PREFIX}.${safeDiagnosticFilePart(leaseId)}.log`;
+}
+function compactDiagnosticText(value) {
+	return value.replace(/\s+/g, " ").trim();
+}
+function isGenericInternalAcpErrorMessage(message) {
+	return message.trim() === "Internal error";
+}
+function isGenericInternalAcpError(error) {
+	if (!(error instanceof Error)) return false;
+	return isGenericInternalAcpErrorMessage(error.message);
+}
+async function readCodexWrapperStderrTail(params) {
+	if (!params.wrapperRoot || !params.leaseId) return "";
+	try {
+		return compactDiagnosticText(redactSensitiveText((await fs.readFile(path.join(params.wrapperRoot, codexWrapperStderrLogFileName(params.leaseId)), "utf8")).slice(-CODEX_WRAPPER_ERROR_TAIL_MAX_CHARS)));
+	} catch {
+		return "";
+	}
+}
 function readSessionRecordName(record) {
 	if (typeof record !== "object" || record === null) return "";
 	const { name } = record;
@@ -431,6 +459,26 @@ var AcpxRuntime = class {
 		});
 		return await this.launchLeaseScope.run(launch, params.run);
 	}
+	async withCodexWrapperDiagnostics(params) {
+		try {
+			return await params.run();
+		} catch (error) {
+			if (!isCodexAcpCommand(params.command) || !isGenericInternalAcpError(error)) throw error;
+			const stderrTail = await readCodexWrapperStderrTail({
+				wrapperRoot: this.wrapperRoot,
+				leaseId: this.launchLeaseScope.getStore()?.leaseId
+			});
+			if (!stderrTail) throw error;
+			throw new AcpRuntimeError(params.fallbackCode, `Internal error: ${stderrTail}`, { cause: error });
+		}
+	}
+	async readCodexTurnFailureStderr(params) {
+		const record = await this.sessionStore.load(params.handle.acpxRecordId ?? params.handle.sessionKey);
+		return readCodexWrapperStderrTail({
+			wrapperRoot: this.wrapperRoot,
+			leaseId: readOpenClawLeaseIdFromRecord(record)
+		});
+	}
 	async cleanupProcessTreeForRecord(handle, record) {
 		const leaseId = readOpenClawLeaseIdFromRecord(record);
 		const rootPid = readAgentPidFromRecord(record);
@@ -496,7 +544,11 @@ var AcpxRuntime = class {
 			sessionKey: input.sessionKey,
 			command: stableLaunchCommand,
 			enabled: shouldStartWithLease,
-			run: () => delegate.ensureSession(input)
+			run: () => this.withCodexWrapperDiagnostics({
+				command: stableLaunchCommand,
+				fallbackCode: "ACP_SESSION_INIT_FAILED",
+				run: () => delegate.ensureSession(input)
+			})
 		});
 		const normalizedInput = {
 			...input,
@@ -506,11 +558,39 @@ var AcpxRuntime = class {
 			sessionKey: input.sessionKey,
 			command: stableLaunchCommand,
 			enabled: shouldStartWithLease,
-			run: () => this.codexAcpModelOverrideScope.run(codexModelOverride, () => delegate.ensureSession(normalizedInput))
+			run: () => this.codexAcpModelOverrideScope.run(codexModelOverride, () => this.withCodexWrapperDiagnostics({
+				command: stableLaunchCommand,
+				fallbackCode: "ACP_SESSION_INIT_FAILED",
+				run: () => delegate.ensureSession(normalizedInput)
+			}))
 		});
 	}
 	async *runTurn(input) {
-		yield* (await this.resolveDelegateForHandle(input.handle)).runTurn(input);
+		const command = await this.resolveCommandForHandle(input.handle);
+		const delegate = await this.resolveDelegateForHandle(input.handle);
+		try {
+			for await (const event of delegate.runTurn(input)) {
+				if (event.type !== "error" || !isCodexAcpCommand(command) || !isGenericInternalAcpErrorMessage(event.message)) {
+					yield event;
+					continue;
+				}
+				const stderrTail = await this.readCodexTurnFailureStderr({ handle: input.handle });
+				if (!stderrTail) {
+					yield event;
+					continue;
+				}
+				yield {
+					...event,
+					code: "ACP_TURN_FAILED",
+					message: `Internal error: ${stderrTail}`
+				};
+			}
+		} catch (error) {
+			if (!isCodexAcpCommand(command) || !isGenericInternalAcpError(error)) throw error;
+			const stderrTail = await this.readCodexTurnFailureStderr({ handle: input.handle });
+			if (!stderrTail) throw error;
+			throw new AcpRuntimeError("ACP_TURN_FAILED", `Internal error: ${stderrTail}`, { cause: error });
+		}
 	}
 	getCapabilities() {
 		return this.delegate.getCapabilities();

package/dist/{service-DzWriMSw.js → service-DPrf6fF8.js}

@@ -1,10 +1,10 @@
 import { registerAcpRuntimeBackend, unregisterAcpRuntimeBackend } from "./runtime-api.js";
-import { a as OPENCLAW_GATEWAY_INSTANCE_ID_ARG, i as OPENCLAW_ACPX_LEASE_ID_ARG, r as reapStaleOpenClawOwnedAcpxOrphans, s as createAcpxProcessLeaseStore, t as cleanupOpenClawOwnedAcpxProcessTree } from "./process-reaper-DKzgrZt9.js";
+import { a as OPENCLAW_ACPX_LEASE_ID_ENV, c as createAcpxProcessLeaseStore, i as OPENCLAW_ACPX_LEASE_ID_ARG, o as OPENCLAW_GATEWAY_INSTANCE_ID_ARG, r as reapStaleOpenClawOwnedAcpxOrphans, t as cleanupOpenClawOwnedAcpxProcessTree } from "./process-reaper-biYb35VD.js";
 import { createRequire } from "node:module";
 import { normalizeLowercaseStringOrEmpty } from "openclaw/plugin-sdk/string-coerce-runtime";
+import fs from "node:fs/promises";
 import path from "node:path";
 import { randomUUID } from "node:crypto";
-import fs from "node:fs/promises";
 import { readJsonFileWithFallback } from "openclaw/plugin-sdk/json-store";
 import { inspect } from "node:util";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
@@ -129,16 +129,85 @@ function extractTrustedCodexProjectPaths(configToml) {
 	}
 	return Array.from(trusted);
 }
-function renderIsolatedCodexProjectTrustConfig(projectPaths) {
+const INHERITED_TOP_LEVEL_CODEX_CONFIG_KEYS = new Set([
+	"model",
+	"model_provider",
+	"model_reasoning_effort",
+	"sandbox_mode"
+]);
+const INHERITED_MODEL_PROVIDER_CONFIG_KEYS = new Set([
+	"name",
+	"base_url",
+	"wire_api",
+	"env_key",
+	"env_key_instructions",
+	"requires_openai_auth",
+	"request_max_retries",
+	"stream_max_retries",
+	"stream_idle_timeout_ms"
+]);
+function parseTableHeader(line) {
+	const trimmed = line.trim();
+	if (!trimmed.startsWith("[") || !trimmed.endsWith("]") || trimmed.startsWith("[[")) return;
+	return parseTomlDottedKey(trimmed.slice(1, -1));
+}
+function isInheritedModelProviderTable(parts) {
+	return parts?.[0] === "model_providers" && parts.length === 2;
+}
+function parseTopLevelAssignmentKey(line) {
+	return /^(?<key>[A-Za-z0-9_-]+)\s*=\s*(?<value>.+)$/.exec(line)?.groups?.key;
+}
+function extractInheritedCodexRuntimeConfig(configToml) {
+	const inheritedLines = [];
+	let inAnyTable = false;
+	let inInheritedTable = false;
+	let pendingInheritedTableHeader = "";
+	function flushInheritedTableHeader() {
+		if (!pendingInheritedTableHeader) return;
+		if (inheritedLines.length > 0 && inheritedLines[inheritedLines.length - 1] !== "") inheritedLines.push("");
+		inheritedLines.push(pendingInheritedTableHeader);
+		pendingInheritedTableHeader = "";
+	}
+	for (const rawLine of configToml.split(/\r?\n/)) {
+		const trimmedLine = rawLine.trim();
+		const semanticLine = stripTomlComment(rawLine).trim();
+		if (trimmedLine.startsWith("[")) {
+			const tableParts = parseTableHeader(trimmedLine);
+			inAnyTable = true;
+			inInheritedTable = isInheritedModelProviderTable(tableParts);
+			if (inInheritedTable) pendingInheritedTableHeader = rawLine.trimEnd();
+			else pendingInheritedTableHeader = "";
+			continue;
+		}
+		if (inInheritedTable) {
+			if (!semanticLine) continue;
+			const key = parseTopLevelAssignmentKey(semanticLine);
+			if (!key || !INHERITED_MODEL_PROVIDER_CONFIG_KEYS.has(key)) continue;
+			flushInheritedTableHeader();
+			inheritedLines.push(rawLine.trimEnd());
+			continue;
+		}
+		if (inAnyTable) continue;
+		const key = parseTopLevelAssignmentKey(semanticLine);
+		if (!key) continue;
+		if (!INHERITED_TOP_LEVEL_CODEX_CONFIG_KEYS.has(key)) continue;
+		inheritedLines.push(rawLine.trimEnd());
+	}
+	while (inheritedLines.length > 0 && inheritedLines[inheritedLines.length - 1] === "") inheritedLines.pop();
+	return inheritedLines.join("\n");
+}
+function renderIsolatedCodexConfig(params) {
+	const normalized = Array.from(new Set(params.projectPaths.map((projectPath) => projectPath.trim()).filter(Boolean).map((projectPath) => path.resolve(projectPath)))).toSorted((left, right) => left.localeCompare(right));
 	return [
 		"# Generated by OpenClaw for Codex ACP sessions.",
-		...Array.from(new Set(projectPaths.map((projectPath) => projectPath.trim()).filter(Boolean).map((projectPath) => path.resolve(projectPath)))).toSorted((left, right) => left.localeCompare(right)).flatMap((projectPath) => [
+		params.sourceConfigToml ? extractInheritedCodexRuntimeConfig(params.sourceConfigToml) : "",
+		...normalized.flatMap((projectPath) => [
 			"",
 			`[projects.${JSON.stringify(projectPath)}]`,
 			"trust_level = \"trusted\""
 		]),
 		""
-	].join("\n");
+	].filter((line, index, lines) => !(line === "" && lines[index - 1] === "")).join("\n");
 }
 //#endregion
 //#region extensions/acpx/src/config-schema.ts
@@ -436,19 +505,252 @@ async function resolveInstalledCodexAcpBinPath() {
 async function resolveInstalledClaudeAcpBinPath() {
 	return await resolveInstalledAcpPackageBinPath(CLAUDE_ACP_PACKAGE, CLAUDE_ACP_BIN);
 }
+const DIAGNOSTIC_REDACTION_RULES = [
+	{
+		source: String.raw`(authorization\s*[:=]\s*bearer\s+)[^\s'"<>]+`,
+		flags: "gi",
+		replacement: "$1[REDACTED]"
+	},
+	{
+		source: String.raw`((?:api[_-]?key|apiKey|access[_-]?token|refresh[_-]?token|client[_-]?secret|token|secret|password|passwd|credential)\s*[:=]\s*)[^\s'"<>]+`,
+		flags: "gi",
+		replacement: "$1[REDACTED]"
+	},
+	{
+		source: String.raw`("(?:apiKey|token|secret|password|passwd|accessToken|refreshToken)"\s*:\s*")[^"]+`,
+		flags: "g",
+		replacement: "$1[REDACTED]"
+	},
+	{
+		source: String.raw`(["']?(?:api[-_]?key|apiKey|access[-_]?token|accessToken|refresh[-_]?token|refreshToken|id[-_]?token|idToken|auth[-_]?token|authToken|client[-_]?secret|clientSecret|app[-_]?secret|appSecret|token|secret|password|passwd|credential)["']?\s*[:=]\s*["']?)[^"',}\s<>]+`,
+		flags: "gi",
+		replacement: "$1[REDACTED]"
+	},
+	{
+		source: String.raw`([?&](?:access[-_]?token|auth[-_]?token|refresh[-_]?token|api[-_]?key|client[-_]?secret|token|key|secret|password|pass|passwd|auth|signature)=)[^&\s'"<>]+`,
+		flags: "gi",
+		replacement: "$1[REDACTED]"
+	},
+	{
+		source: String.raw`(--(?:api[-_]?key|token|secret|password|passwd)\s+)[^\s'"]+`,
+		flags: "gi",
+		replacement: "$1[REDACTED]"
+	},
+	{
+		source: String.raw`-----BEGIN [A-Z ]*PRI` + String.raw`VATE KEY-----[\s\S]+?-----END [A-Z ]*PRI` + String.raw`VATE KEY-----`,
+		flags: "g",
+		replacement: "[REDACTED_PRIVATE_KEY]"
+	},
+	{
+		source: String.raw`\b(sk-[A-Za-z0-9_-]{8,})\b`,
+		flags: "g",
+		replacement: "[REDACTED_OPENAI_KEY]"
+	},
+	{
+		source: String.raw`\b(gh[pousr]_[A-Za-z0-9_]{20,})\b`,
+		flags: "g",
+		replacement: "[REDACTED_GITHUB_TOKEN]"
+	},
+	{
+		source: String.raw`\b(github_pat_[A-Za-z0-9_]{20,})\b`,
+		flags: "g",
+		replacement: "[REDACTED_GITHUB_TOKEN]"
+	},
+	{
+		source: String.raw`\b(xox[baprs]-[A-Za-z0-9-]{10,})\b`,
+		flags: "g",
+		replacement: "[REDACTED_SLACK_TOKEN]"
+	},
+	{
+		source: String.raw`\b(gsk_[A-Za-z0-9_-]{10,})\b`,
+		flags: "g",
+		replacement: "[REDACTED_API_KEY]"
+	},
+	{
+		source: String.raw`\b(AIza[0-9A-Za-z\-_]{20,})\b`,
+		flags: "g",
+		replacement: "[REDACTED_GOOGLE_KEY]"
+	},
+	{
+		source: String.raw`\b(ya29\.[0-9A-Za-z_\-./+=]{10,})\b`,
+		flags: "g",
+		replacement: "[REDACTED_GOOGLE_TOKEN]"
+	},
+	{
+		source: String.raw`\b(eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,})\b`,
+		flags: "g",
+		replacement: "[REDACTED_JWT]"
+	},
+	{
+		source: String.raw`\b(pplx-[A-Za-z0-9_-]{10,})\b`,
+		flags: "g",
+		replacement: "[REDACTED_API_KEY]"
+	},
+	{
+		source: String.raw`\b(npm_[A-Za-z0-9]{10,})\b`,
+		flags: "g",
+		replacement: "[REDACTED_NPM_TOKEN]"
+	},
+	{
+		source: String.raw`\b(LTAI[A-Za-z0-9]{10,})\b`,
+		flags: "g",
+		replacement: "[REDACTED_ACCESS_KEY]"
+	},
+	{
+		source: String.raw`\b(hf_[A-Za-z0-9]{10,})\b`,
+		flags: "g",
+		replacement: "[REDACTED_API_KEY]"
+	},
+	{
+		source: String.raw`\bbot(\d{6,}:[A-Za-z0-9_-]{20,})\b`,
+		flags: "g",
+		replacement: "bot[REDACTED_TELEGRAM_TOKEN]"
+	},
+	{
+		source: String.raw`\b(\d{6,}:[A-Za-z0-9_-]{20,})\b`,
+		flags: "g",
+		replacement: "[REDACTED_TELEGRAM_TOKEN]"
+	}
+];
+function renderDiagnosticRedactionRuleSpecs() {
+	return JSON.stringify(DIAGNOSTIC_REDACTION_RULES);
+}
 function buildAdapterWrapperScript(params) {
 	return `#!/usr/bin/env node
-import { existsSync } from "node:fs";
+import { appendFileSync, existsSync, readFileSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
 
 ${params.envSetup}
+const stderrLogFileNamePrefix = ${params.stderrLogFileNamePrefix ? JSON.stringify(params.stderrLogFileNamePrefix) : "undefined"};
+const stderrLogMaxChars = 256 * 1024;
+
 const openClawWrapperArgs = new Set([
   ${quoteCommandPart(OPENCLAW_ACPX_LEASE_ID_ARG)},
   ${quoteCommandPart(OPENCLAW_GATEWAY_INSTANCE_ID_ARG)},
 ]);
 
+function readOpenClawWrapperArg(args, name) {
+  const index = args.indexOf(name);
+  if (index < 0) {
+    return undefined;
+  }
+  const value = args[index + 1];
+  return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+
+function safeDiagnosticFilePart(value) {
+  const sanitized = String(value || "").replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 120);
+  return sanitized || "pid-" + process.pid;
+}
+
+function resolveStderrLogPath(args) {
+  if (!stderrLogFileNamePrefix) {
+    return undefined;
+  }
+  const leaseId =
+    process.env[${JSON.stringify(OPENCLAW_ACPX_LEASE_ID_ENV)}] ||
+    readOpenClawWrapperArg(args, ${quoteCommandPart(OPENCLAW_ACPX_LEASE_ID_ARG)}) ||
+    "pid-" + process.pid;
+  const fileName = stderrLogFileNamePrefix + "." + safeDiagnosticFilePart(leaseId) + ".log";
+  return fileURLToPath(new URL("./" + fileName, import.meta.url));
+}
+
+const diagnosticRedactionRules = ${renderDiagnosticRedactionRuleSpecs()}.map((rule) => [
+  new RegExp(rule.source, rule.flags),
+  rule.replacement,
+]);
+
+function redactDiagnosticText(text) {
+  let redacted = text;
+  for (const [pattern, replacement] of diagnosticRedactionRules) {
+    redacted = redacted.replace(pattern, replacement);
+  }
+  return redacted;
+}
+
+let pendingStderrLogText = "";
+const stderrPrivateKeyEndPattern = /-----END [A-Z ]*PRIVATE KEY-----/;
+
+function hasUnclosedPrivateKeyBlock(text) {
+  let lastBeginIndex = -1;
+  for (const match of text.matchAll(/-----BEGIN [A-Z ]*PRIVATE KEY-----/g)) {
+    lastBeginIndex = match.index ?? lastBeginIndex;
+  }
+  if (lastBeginIndex === -1) {
+    return -1;
+  }
+  return stderrPrivateKeyEndPattern.test(text.slice(lastBeginIndex)) ? -1 : lastBeginIndex;
+}
+
+function writeRedactedStderrLog(text) {
+  if (!stderrLogPath) {
+    return;
+  }
+  if (!text) {
+    return;
+  }
+  try {
+    appendFileSync(stderrLogPath, redactDiagnosticText(text), "utf8");
+    const current = readFileSync(stderrLogPath, "utf8");
+    if (current.length > stderrLogMaxChars) {
+      writeFileSync(stderrLogPath, current.slice(-stderrLogMaxChars), "utf8");
+    }
+  } catch {
+    // Stderr capture is diagnostic-only; never break the ACP adapter.
+  }
+}
+
+function redactIncompletePrivateKeyTail(text) {
+  const unclosedPrivateKeyStart = hasUnclosedPrivateKeyBlock(text);
+  if (unclosedPrivateKeyStart === -1) {
+    return text;
+  }
+  return text.slice(0, unclosedPrivateKeyStart) + "[REDACTED_PRIVATE_KEY]";
+}
+
+function flushFinalizedStderrLogText() {
+  const lastLineBreak = pendingStderrLogText.lastIndexOf("\\n");
+  if (lastLineBreak === -1) {
+    if (pendingStderrLogText.length > stderrLogMaxChars) {
+      pendingStderrLogText = pendingStderrLogText.slice(-stderrLogMaxChars);
+    }
+    return;
+  }
+  let flushEnd = lastLineBreak + 1;
+  const unclosedPrivateKeyStart = hasUnclosedPrivateKeyBlock(
+    pendingStderrLogText.slice(0, flushEnd),
+  );
+  if (unclosedPrivateKeyStart !== -1) {
+    flushEnd = unclosedPrivateKeyStart;
+  }
+  if (flushEnd <= 0) {
+    if (pendingStderrLogText.length > stderrLogMaxChars) {
+      pendingStderrLogText = pendingStderrLogText.slice(-stderrLogMaxChars);
+    }
+    return;
+  }
+  const finalizedText = pendingStderrLogText.slice(0, flushEnd);
+  pendingStderrLogText = pendingStderrLogText.slice(flushEnd);
+  writeRedactedStderrLog(finalizedText);
+}
+
+function appendStderrLog(chunk) {
+  const text = typeof chunk === "string" ? chunk : chunk.toString("utf8");
+  if (!text) {
+    return;
+  }
+  pendingStderrLogText += text;
+  flushFinalizedStderrLogText();
+}
+
+function finishStderrLog() {
+  const text = redactIncompletePrivateKeyTail(pendingStderrLogText);
+  pendingStderrLogText = "";
+  writeRedactedStderrLog(text);
+}
+
 function stripOpenClawWrapperArgs(args) {
   const stripped = [];
   for (let index = 0; index < args.length; index += 1) {
@@ -462,7 +764,18 @@ function stripOpenClawWrapperArgs(args) {
   return stripped;
 }
 
-const configuredArgs = stripOpenClawWrapperArgs(process.argv.slice(2));
+const rawConfiguredArgs = process.argv.slice(2);
+const stderrLogPath = resolveStderrLogPath(rawConfiguredArgs);
+
+try {
+  if (stderrLogPath) {
+    writeFileSync(stderrLogPath, "", "utf8");
+  }
+} catch {
+  // Stderr capture is diagnostic-only; never break the ACP adapter.
+}
+
+const configuredArgs = stripOpenClawWrapperArgs(rawConfiguredArgs);
 
 function resolveNpmCliPath() {
   const candidate = path.resolve(
@@ -506,12 +819,18 @@ if (!command) {
 const child = spawn(command, args, {
   detached: process.platform !== "win32",
   env,
-  stdio: "inherit",
+  stdio: ["inherit", "inherit", "pipe"],
   windowsHide: true,
 });
 
+child.stderr?.on("data", (chunk) => {
+  appendStderrLog(chunk);
+  process.stderr.write(chunk);
+});
+
 let forceKillTimer;
 let orphanCleanupStarted = false;
+let childExitCode = 1;
 
 function killChildTree(signal, options = {}) {
   if (!child.pid || (!options.force && child.killed)) {
@@ -556,7 +875,7 @@ const parentWatcher =
         // a forced fallback signal after SIGTERM.
         forceKillTimer = setTimeout(() => {
           killChildTree("SIGKILL", { force: true });
-          process.exit(1);
+          childExitCode = 1;
         }, 1_500);
       }, 1_000);
 parentWatcher?.unref?.();
@@ -577,9 +896,15 @@ child.on("exit", (code, signal) => {
     clearTimeout(forceKillTimer);
   }
   if (code !== null) {
-    process.exit(code);
+    childExitCode = code;
+    return;
   }
-  process.exit(signal ? 1 : 0);
+  childExitCode = signal ? 1 : 0;
+});
+
+child.on("close", () => {
+  finishStderrLog();
+  process.exit(childExitCode);
 });
 `;
 }
@@ -589,6 +914,7 @@ function buildCodexAcpWrapperScript(installedBinPath) {
 		packageSpec: `${CODEX_ACP_PACKAGE}@${CODEX_ACP_PACKAGE_VERSION}`,
 		binName: CODEX_ACP_BIN,
 		installedBinPath,
+		stderrLogFileNamePrefix: "codex-acp-wrapper.stderr",
 		envSetup: `const codexHome = fileURLToPath(new URL("./codex-home/", import.meta.url));
 const env = {
   ...process.env,
@@ -620,7 +946,10 @@ async function prepareIsolatedCodexHome(params) {
 	const trustedProjectPaths = [...sourceConfig ? extractTrustedCodexProjectPaths(sourceConfig) : [], params.workspaceDir];
 	const codexHome = path.join(params.baseDir, "codex-home");
 	await fs.mkdir(codexHome, { recursive: true });
-	await fs.writeFile(path.join(codexHome, "config.toml"), renderIsolatedCodexProjectTrustConfig(trustedProjectPaths), "utf8");
+	await fs.writeFile(path.join(codexHome, "config.toml"), renderIsolatedCodexConfig({
+		sourceConfigToml: sourceConfig,
+		projectPaths: trustedProjectPaths
+	}), "utf8");
 	return codexHome;
 }
 async function makeGeneratedWrapperExecutableIfPossible(wrapperPath) {
@@ -724,7 +1053,7 @@ const SKIP_RUNTIME_PROBE_ENV = "OPENCLAW_SKIP_ACPX_RUNTIME_PROBE";
 const ACPX_BACKEND_ID = "acpx";
 let runtimeModulePromise = null;
 function loadRuntimeModule() {
-	runtimeModulePromise ??= import("./runtime-DeOzZoZw.js");
+	runtimeModulePromise ??= import("./runtime-HSzTNfOq.js");
 	return runtimeModulePromise;
 }
 function createLazyDefaultRuntime(params) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/acpx",
-  "version": "2026.5.14-beta.1",
+  "version": "2026.5.14-beta.2",
   "description": "OpenClaw ACP runtime backend",
   "repository": {
     "type": "git",
@@ -26,10 +26,10 @@
       "minHostVersion": ">=2026.4.25"
     },
     "compat": {
-      "pluginApi": ">=2026.5.14-beta.1"
+      "pluginApi": ">=2026.5.14-beta.2"
     },
     "build": {
-      "openclawVersion": "2026.5.14-beta.1",
+      "openclawVersion": "2026.5.14-beta.2",
       "staticAssets": [
         {
           "source": "./src/runtime-internals/mcp-proxy.mjs",
@@ -59,7 +59,7 @@
     "skills/**"
   ],
   "peerDependencies": {
-    "openclaw": ">=2026.5.14-beta.1"
+    "openclaw": ">=2026.5.14-beta.2"
   },
   "peerDependenciesMeta": {
     "openclaw": {