@openclaw/codex 2026.10.5-beta.4 → 2026.10.10-beta.1

package/dist/.setup/native-execution-policy-D09tLP-u.mjs

@@ -0,0 +1,152 @@
+import { resolveAgentConfig, tryResolveDefaultAgentId } from "openclaw/plugin-sdk/agent-scope-runtime";
+import { normalizeAgentId, parseAgentSessionKey } from "openclaw/plugin-sdk/routing";
+import { resolvePreparedSandboxRuntimeStatus } from "openclaw/plugin-sdk/sandbox";
+import { captureSessionEntryCurrentCheckAsync } from "openclaw/plugin-sdk/session-binding-runtime";
+//#region extensions/codex/src/app-server/native-execution-policy.ts
+function resolveRunPolicyParams(params, options) {
+	return {
+		config: params.config,
+		sessionKey: options.runtimeSessionKey?.trim() || params.sandboxSessionKey?.trim() || params.sessionKey?.trim() || params.sessionId,
+		sessionId: params.sessionId,
+		agentId: options.agentId,
+		sessionTarget: params.sessionTarget,
+		execOverrides: params.execOverrides,
+		sandboxAvailable: options.sandbox === null ? false : options.sandbox?.enabled,
+		readRuntimeSessionEntry: true
+	};
+}
+function prepareCodexNativeExecutionPolicyForRun(params, options = {}) {
+	return prepareCodexNativeExecutionPolicy(resolveRunPolicyParams(params, options));
+}
+/** Prepare the selected row once; retained checks use its exact execution policy. */
+async function prepareCodexNativeExecutionPolicy(params) {
+	const captured = {
+		...params,
+		execOverrides: params.execOverrides && { ...params.execOverrides },
+		sessionTarget: params.sessionTarget && { ...params.sessionTarget }
+	};
+	const { sourceAgentId, sourceSessionKey, canReadSessionEntry } = resolveSessionSelection(captured);
+	if (!canReadSessionEntry || !sourceAgentId || !sourceSessionKey) return {
+		policy: resolveCodexNativeExecutionPolicy({
+			...captured,
+			sessionEntry: captured.sessionEntry ?? null
+		}),
+		async assertCurrent() {},
+		retain: () => () => {},
+		release() {}
+	};
+	const selected = await captureSessionEntryCurrentCheckAsync({
+		agentId: sourceAgentId,
+		sessionKey: sourceSessionKey,
+		storePath: captured.sessionTarget?.storePath ?? captured.storePath,
+		fields: [
+			"sessionId",
+			"lifecycleRevision",
+			"execHost",
+			"execNode",
+			"sandbox",
+			"sandboxMode"
+		],
+		errorMessage: "Codex session execution policy changed; prepare the operation again."
+	});
+	try {
+		let owners = 0;
+		const retain = () => {
+			owners++;
+			let released = false;
+			return () => {
+				if (released) return;
+				released = true;
+				if (--owners === 0) selected.release();
+			};
+		};
+		return {
+			policy: resolveCodexNativeExecutionPolicy({
+				...captured,
+				sessionEntry: selected.entry ?? null,
+				readRuntimeSessionEntry: false
+			}),
+			assertCurrent: selected.assertCurrent,
+			source: selected.source,
+			retain,
+			release: retain()
+		};
+	} catch (error) {
+		selected.release();
+		throw error;
+	}
+}
+/** Projects node execution ownership into the runtime tool factory options. */
+function resolveCodexNodeExecToolOverrides(policy) {
+	if (policy.effectiveExecHost !== "node") return;
+	const node = policy.node?.trim();
+	return {
+		host: "node",
+		...node ? { node } : {}
+	};
+}
+/** Resolves node/gateway/sandbox execution ownership from overrides, session, agent, and config. */
+function resolveCodexNativeExecutionPolicy(params) {
+	const config = params.config ?? {};
+	const { agentId, sessionKey } = resolveSessionSelection(params);
+	const sessionEntry = params.sessionEntry;
+	const sandboxAgentId = parseAgentSessionKey(sessionKey)?.agentId ?? agentId;
+	const sandboxed = params.sandboxAvailable === true || (sessionKey && sandboxAgentId ? resolvePreparedSandboxRuntimeStatus({
+		cfg: config,
+		sessionKey,
+		agentId: sandboxAgentId,
+		classificationAgentId: sandboxAgentId,
+		preparedSessionEntry: sessionEntry
+	}).sandboxed : false);
+	const sandboxAvailable = params.sandboxAvailable ?? sandboxed;
+	const agentExec = agentId ? resolveAgentConfig(config, agentId)?.tools?.exec : void 0;
+	const globalExec = config.tools?.exec;
+	const requestedExecHost = normalizeExecTarget(params.execOverrides?.host) ?? normalizeExecTarget(sessionEntry?.execHost) ?? normalizeExecTarget(agentExec?.host) ?? normalizeExecTarget(globalExec?.host) ?? "auto";
+	const effectiveExecHost = requestedExecHost === "auto" ? sandboxAvailable ? "sandbox" : "gateway" : requestedExecHost;
+	const node = params.execOverrides?.node ?? sessionEntry?.execNode ?? agentExec?.node ?? globalExec?.node;
+	return {
+		nativeToolSurfaceAllowed: effectiveExecHost !== "node",
+		sandboxed,
+		requestedExecHost,
+		effectiveExecHost,
+		node,
+		...effectiveExecHost === "node" ? { blockReason: "OpenClaw exec host=node is active for this session. Codex app-server native execution cannot route shell, filesystem, MCP, or app-backed work through the selected OpenClaw node." } : {}
+	};
+}
+function resolveSessionSelection(params) {
+	const config = params.config ?? {};
+	const sessionKey = params.sessionKey?.trim() || params.sessionId?.trim() || void 0;
+	const agentId = normalizeAgentIdOrDefault(params.agentId) ?? parseAgentIdFromSessionKey(sessionKey) ?? tryResolveDefaultAgentId(config);
+	return {
+		sessionKey,
+		agentId,
+		sourceSessionKey: params.sessionTarget?.sessionKey ?? sessionKey,
+		sourceAgentId: params.sessionTarget?.agentId ?? agentId,
+		canReadSessionEntry: params.sessionEntry === void 0 && params.readRuntimeSessionEntry && (params.sessionTarget !== void 0 || (parseAgentIdFromSessionKey(sessionKey) ?? tryResolveDefaultAgentId(config)) === agentId)
+	};
+}
+/** Formats the user-facing explanation shown when native tools are blocked by exec host=node. */
+function formatCodexNativeNodeExecBlock(params) {
+	return [
+		`Codex-native ${params.surface} is unavailable because OpenClaw exec host=node is active for this session.`,
+		params.reason ?? "Codex app-server native execution cannot route execution through the selected OpenClaw node.",
+		"Use a normal Codex harness turn so OpenClaw exec/process tools run on the node, or switch exec host to gateway for native Codex app-server execution."
+	].join(" ");
+}
+function parseAgentIdFromSessionKey(sessionKey) {
+	const raw = sessionKey?.trim();
+	if (!raw) return;
+	const parts = raw.toLowerCase().split(":").filter(Boolean);
+	if (parts.length < 3 || parts[0] !== "agent" || !parts[2]) return;
+	return normalizeAgentIdOrDefault(parts[1]);
+}
+function normalizeAgentIdOrDefault(value) {
+	const normalized = normalizeAgentId(value);
+	return normalized === "main" && !(value ?? "").trim() ? void 0 : normalized;
+}
+function normalizeExecTarget(value) {
+	const normalized = value?.trim().toLowerCase();
+	if (normalized === "auto" || normalized === "sandbox" || normalized === "gateway" || normalized === "node") return normalized;
+}
+//#endregion
+export { resolveCodexNodeExecToolOverrides as a, resolveCodexNativeExecutionPolicy as i, prepareCodexNativeExecutionPolicy as n, prepareCodexNativeExecutionPolicyForRun as r, formatCodexNativeNodeExecBlock as t };

package/dist/.setup/{native-hook-relay-wq7jrNLk.mjs → native-hook-relay-C7aaLJaP.mjs}

@@ -1,9 +1,9 @@
-import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
+import { r as isJsonObject } from "./protocol-CaPAVwe9.mjs";
 import { l as fingerprintCodexPolicy } from "./config-security-clxAZYWX.mjs";
-import { D as nativeHookRelayUnregisterQueue } from "./shared-client-BCx1wbyA.mjs";
-import { k as resolveCodexToolAbortTerminalReason } from "./client-D93nbdB8.mjs";
-import { R as normalizeCodexDynamicToolName } from "./thread-requests-BgzJwJtS.mjs";
-import { t as codexNativeSubagentMonitorRuntime } from "./native-subagent-monitor-DOLEIf9r.mjs";
+import { b as nativeHookRelayUnregisterQueue } from "./shared-client-CE_uY0A1.mjs";
+import { O as resolveCodexToolAbortTerminalReason } from "./client-BS8X7HmG.mjs";
+import { R as normalizeCodexDynamicToolName } from "./thread-requests-BjawdIVV.mjs";
+import { t as codexNativeSubagentMonitorRuntime } from "./native-subagent-monitor-CFE7b4oC.mjs";
 import { createHash } from "node:crypto";
 import { addTimerTimeoutGraceMs, finiteSecondsToTimerSafeMilliseconds } from "openclaw/plugin-sdk/number-runtime";
 import { escapeRegExp } from "openclaw/plugin-sdk/text-utility-runtime";
@@ -124,7 +124,12 @@ function createCodexNativeHookRemoteCredential(params) {
 					}, {
 						timeoutMs: params.timeoutMs,
 						signal: params.signal,
-						assertCurrent: params.assertCurrent
+						assertCurrent: params.assertCurrent,
+						withCurrent: async (write) => {
+							await params.assertCurrentAsync?.();
+							params.assertCurrent();
+							write();
+						}
 					});
 				} catch {
 					throw new Error("Could not deliver the native hook relay credential to Codex");
@@ -180,6 +185,22 @@ const CODEX_HOOK_MATCHER_NAMES_BY_TOOL_ID = {
 		"exec",
 		"exec_command"
 	],
+	process: ["process", "write_stdin"],
+	read: [
+		"read",
+		"Read",
+		"read_file"
+	],
+	write: ["write", "Write"],
+	edit: ["edit", "Edit"],
+	ls: ["ls", "list_dir"],
+	grep: [
+		"grep",
+		"Grep",
+		"grep_files"
+	],
+	find: ["find", "Glob"],
+	view_image: ["view_image"],
 	apply_patch: [
 		"apply_patch",
 		"Write",
@@ -241,6 +262,7 @@ function createCodexNativeHookRelay(params) {
 		pendingDirectChildAdmissions.clear();
 	};
 	let releaseProcessAdmission;
+	let releaseExecutionPolicy;
 	let processAdmissionDisposed = false;
 	let remoteCredential;
 	let remoteCleanup;
@@ -273,8 +295,12 @@ function createCodexNativeHookRelay(params) {
 		}),
 		signal: params.signal,
 		runBeforeToolCall: params.hostCapabilities.runBeforeToolCall,
-		executionAdmission: params.nativeProcessAuthority || params.nativeModelAdmission ? {
-			toolNames: [...params.nativeProcessAuthority ? ["exec"] : [], ...params.nativeModelAdmission ? modelInputTools : []],
+		executionAdmission: params.nativeProcessAuthority || params.nativeModelAdmission || params.hostCapabilities.workspaceReadiness ? {
+			toolNames: [
+				...params.nativeProcessAuthority ? ["exec"] : [],
+				...params.nativeModelAdmission ? modelInputTools : [],
+				...params.hostCapabilities.workspaceReadiness?.toolNames ?? []
+			],
 			admit: async (invocation, assertAdmissionCurrent, preparation) => {
 				const payload = invocation.rawPayload;
 				const toolName = CODEX_NATIVE_SPAWN_HOOK_NAMES.includes(invocation.toolName ?? "") ? "spawn_agent" : invocation.toolName;
@@ -309,6 +335,11 @@ function createCodexNativeHookRelay(params) {
 					assertAdmissionCurrent();
 					return;
 				}
+				if (!params.nativeProcessAuthority || ![
+					"Bash",
+					"exec",
+					"exec_command"
+				].includes(invocation.toolName ?? "")) return;
 				const rootThreadId = isJsonObject(payload) && typeof payload.session_id === "string" ? payload.session_id.trim() : void 0;
 				const childThreadId = readCodexNativeChildThreadId(payload);
 				const threadId = childThreadId ?? rootThreadId;
@@ -325,6 +356,7 @@ function createCodexNativeHookRelay(params) {
 			params.hostCapabilities.assertActive();
 			params.assertCurrent?.();
 		},
+		assertActiveAsync: params.assertCurrentAsync,
 		retention: {
 			readClaim: readCodexNativeChildThreadId,
 			shouldRetainAfterForegroundClose: () => successfulYieldRetentionAuthorized && directChildClaims.size > 0,
@@ -361,6 +393,7 @@ function createCodexNativeHookRelay(params) {
 				rejectPendingAdmissions("native hook relay registration closed");
 				processAdmissionDisposed = true;
 				releaseProcessAdmission?.();
+				releaseExecutionPolicy?.();
 				if (remoteCredential) {
 					remoteCleanup = remoteCredential.dispose().catch((error) => params.remoteCallback?.onCleanupFailure(toErrorObject(error, "Native hook relay credential cleanup failed")));
 					nativeHookRelayUnregisterQueue.track(remoteCleanup);
@@ -370,10 +403,11 @@ function createCodexNativeHookRelay(params) {
 		onPreToolUseFailure: params.onPreToolUseFailure,
 		command: {
 			nice: 10,
-			timeoutMs: params.options?.gatewayTimeoutMs
+			timeoutMs: params.hostCapabilities.workspaceReadiness ? Math.max(params.options?.gatewayTimeoutMs ?? 0, params.attemptTimeoutMs) : params.options?.gatewayTimeoutMs
 		}
 	});
 	if (!processAdmissionDisposed) try {
+		releaseExecutionPolicy = params.retainExecutionPolicy?.();
 		releaseProcessAdmission = params.nativeProcessAuthority?.owner.retainAdmission();
 	} catch (error) {
 		relay.unregister();
@@ -387,7 +421,8 @@ function createCodexNativeHookRelay(params) {
 			assertCurrent: () => {
 				params.hostCapabilities.assertActive();
 				params.assertCurrent?.();
-			}
+			},
+			assertCurrentAsync: params.assertCurrentAsync
 		});
 		if (processAdmissionDisposed) remoteCredential.dispose();
 	}

package/dist/.setup/{native-mcp-app-DX3nyTtc.mjs → native-mcp-app-CsWj-v_x.mjs}

@@ -1,9 +1,9 @@
-import { W as protectCodexAppServerLiveThread, _ as retainSharedCodexAppServerClientIfCurrent, n as captureCodexAppServerClientLifetime } from "./shared-client-BCx1wbyA.mjs";
-import { F as getCodexAppServerClientInstanceId } from "./client-D93nbdB8.mjs";
-import { n as getCodexAppServerTurnRouter } from "./turn-router-DBVMToGo.mjs";
-import { a as requestPluginApprovalOutcome } from "./plugin-approval-roundtrip-CD88q3yx.mjs";
+import { I as protectCodexAppServerLiveThread, p as retainSharedCodexAppServerClientIfCurrent, t as captureCodexAppServerClientLifetime } from "./shared-client-CE_uY0A1.mjs";
+import { M as getCodexAppServerClientInstanceId } from "./client-BS8X7HmG.mjs";
+import { n as getCodexAppServerTurnRouter } from "./turn-router-Dbw17k3K.mjs";
+import { a as requestPluginApprovalOutcome } from "./plugin-approval-roundtrip-DIZHLbAM.mjs";
 import { i as readCodexMcpToolUiVisibility, n as projectCodexMcpToolMetadata, r as readCodexMcpToolConnectorId, t as projectCodexMcpServerMetadata } from "./mcp-tool-metadata-DW41snf3.mjs";
-import { t as __exportAll } from "./session-binding-sidecars-DD-enC8w.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-BNSS6WL4.mjs";
 import { asOptionalRecord, normalizeLowercaseStringOrEmpty, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { z } from "zod";
 import { loadAgentHarnessMcpConfig, prepareHarnessNativeMcpAppPreview } from "openclaw/plugin-sdk/agent-harness-runtime";

package/dist/.setup/{native-skill-isolation-DSBeF-Yy.mjs → native-skill-isolation-CMimsKYy.mjs}

@@ -1,9 +1,9 @@
-import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
+import { r as isJsonObject } from "./protocol-CaPAVwe9.mjs";
 import { n as resolveCodexAppServerLocalHomeDir } from "./auth-start-options-BPIPeEX8.mjs";
-import { t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-Bg9DbDI6.mjs";
-import { G as readCodexClientSessionMeta } from "./shared-client-BCx1wbyA.mjs";
-import { f as unsubscribeCodexThreadBestEffort, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS } from "./attempt-client-cleanup-zNuNTKVr.mjs";
-import { b as codexDynamicToolsFingerprint, p as attestCodexRestrictedToolSurfaceMcpServersDisabled } from "./thread-requests-BgzJwJtS.mjs";
+import { t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-DRb-niJc.mjs";
+import { L as readCodexClientSessionMeta } from "./shared-client-CE_uY0A1.mjs";
+import { f as unsubscribeCodexThreadBestEffort, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS } from "./attempt-client-cleanup-6OcbMH46.mjs";
+import { b as codexDynamicToolsFingerprint, p as attestCodexRestrictedToolSurfaceMcpServersDisabled } from "./thread-requests-BjawdIVV.mjs";
 import path from "node:path";
 import os from "node:os";
 import fs from "node:fs/promises";
@@ -16,7 +16,7 @@ function hasCodexNativeToolCatalog(binding) {
 }
 /** Pinned serde omits empty catalogs and false deferLoading; declarations remain native-owned. */
 function parseCodexNativeToolCatalog(metadata, threadId, fingerprint) {
-	const fail = () => /* @__PURE__ */ new Error("The canonical Codex native tool catalog is missing, corrupt, or changed; the thread is preserved. Reconnect and inspect its native metadata before retrying.");
+	const fail = () => /* @__PURE__ */ new Error("The saved Codex native tool catalog is missing, corrupt, or changed; the thread is preserved. Reconnect and inspect its native metadata before retrying.");
 	if (!isJsonObject(metadata) || metadata.id !== threadId) throw fail();
 	const catalog = metadata.dynamic_tools ?? [];
 	if (!Array.isArray(catalog) || Buffer.byteLength(JSON.stringify(catalog)) > 1048576) throw fail();
@@ -65,7 +65,7 @@ async function loadCodexNativeToolCatalog(params) {
 	assertCurrent();
 	const home = resolveCodexAppServerLocalHomeDir(appServer.start, agentDir);
 	const actualHome = client.getRuntimeIdentity()?.codexHome;
-	if (!hasCodexNativeToolCatalog(binding) || !binding.dynamicToolsFingerprint || appServer.start.transport !== "stdio" && appServer.start.transport !== "unix" || appServer.remoteWorkspaceRoot || !actualHome || path.resolve(actualHome) !== path.resolve(home) || binding.appServerRuntimeFingerprint !== buildCodexAppServerConnectionFingerprint(appServer, agentDir)) throw new Error("Canonical Codex declarations require the original verified local binding and selected native connection; the thread is preserved.");
+	if (!hasCodexNativeToolCatalog(binding) || !binding.dynamicToolsFingerprint || appServer.start.transport !== "stdio" && appServer.start.transport !== "unix" || appServer.remoteWorkspaceRoot || !actualHome || path.resolve(actualHome) !== path.resolve(home) || binding.appServerRuntimeFingerprint !== buildCodexAppServerConnectionFingerprint(appServer, agentDir)) throw new Error("Saved Codex declarations require the original verified local binding and selected native connection; the thread is preserved.");
 	const metadata = await readCodexClientSessionMeta(client, path.join(home, "sessions"), binding.rolloutPath, binding.threadId);
 	const consume = () => {
 		assertCurrent();