@openclaw/codex 2026.10.7 → 2026.10.9

package/dist/.setup/native-assignment-repair-BjS4uyQr.mjs

@@ -0,0 +1,162 @@
+import { c as readCodexNativeSubagentSubmissions, g as codexNativeSubagentHistoryConnectionFingerprint, l as codexNativeSubagentRunId, r as normalizeNativePendingAssignments } from "./native-subagent-pending-assignments-BAOzwy85.mjs";
+import { a as readStoredCodexAppServerBinding } from "./session-binding-record-codec-CWQXr9os.mjs";
+import { i as CODEX_APP_SERVER_BINDING_NAMESPACE } from "./session-binding-meta-Lkm5Lpf4.mjs";
+import { asOptionalRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { isDeepStrictEqual } from "node:util";
+//#region extensions/codex/src/migration/native-assignment-repair.ts
+async function normalizeRow(entry, params, warnings) {
+	const raw = asOptionalRecord(entry.value);
+	if (raw?.nativeSubagentAssignments === void 0) return;
+	const stored = readStoredCodexAppServerBinding(raw);
+	if (!stored) {
+		warnings.push(`Preserved Codex native assignments in ${entry.key}; the binding could not be decoded. Inspect it before retrying Doctor.`);
+		return;
+	}
+	if (stored.state !== "active") return;
+	let inventory;
+	try {
+		inventory = normalizeNativePendingAssignments(raw.nativeSubagentAssignments);
+	} catch {
+		warnings.push(`Preserved malformed Codex native assignments in ${entry.key}; inspect the binding before retrying Doctor.`);
+		return;
+	}
+	let assignments = inventory?.assignments ?? [];
+	const originalAssignments = assignments;
+	const identity = /^(session-key|session):([a-z0-9][a-z0-9_-]{0,63}):(.+)$/u.exec(entry.key);
+	const binding = asOptionalRecord(raw.binding);
+	const fingerprint = codexNativeSubagentHistoryConnectionFingerprint(stored.binding);
+	if (assignments.length > 0 && identity && stored.sessionId && binding && raw.retired === void 0 && (identity[1] === "session-key" ? /^[A-Za-z0-9_-]{43}$/u.test(identity[3]) : identity[3] === stored.sessionId) && binding.connectionScope === void 0 && binding.supervisionSourceThreadId === void 0 && binding.pendingSupervisionBranch === void 0 && (binding.authProfileId === void 0 || typeof binding.authProfileId === "string") && fingerprint && params.context.readSessionIdentityEvidenceBatch) try {
+		const agentId = identity[2];
+		const [evidence] = await params.context.readSessionIdentityEvidenceBatch([{
+			agentId,
+			sessionId: stored.sessionId
+		}]);
+		if (evidence?.state === "absent") assignments = [];
+		else if (evidence?.state === "current") {
+			const { getSessionEntryByIdAsync, resolveStorePath } = await import("openclaw/plugin-sdk/session-store-runtime");
+			const { bindingStoreKey } = await import("./session-binding-record-O62ZRFhy.mjs").then((n) => n.h);
+			const current = await getSessionEntryByIdAsync({
+				agentId,
+				sessionId: stored.sessionId,
+				env: params.env,
+				storePath: resolveStorePath(params.config.session?.store, {
+					agentId,
+					env: params.env
+				}),
+				readConsistency: "latest"
+			});
+			if (!current || current.entry.sessionId !== stored.sessionId || current.sessionKey !== evidence.sessionKey) throw new Error("Requester ownership is unresolved");
+			const currentKey = bindingStoreKey({
+				kind: "session",
+				agentId,
+				sessionId: current.entry.sessionId,
+				...identity[1] === "session-key" ? { sessionKey: current.sessionKey } : {}
+			});
+			let unknownLifecycle = false;
+			assignments = assignments.filter((assignment) => {
+				if (currentKey !== entry.key || assignment.owner.sessionId !== current.entry.sessionId || assignment.owner.connectionFingerprint !== fingerprint) return false;
+				if (!assignment.owner.lifecycleRevision || !current.entry.lifecycleRevision) {
+					unknownLifecycle = true;
+					return true;
+				}
+				return assignment.owner.lifecycleRevision === current.entry.lifecycleRevision;
+			});
+			if (unknownLifecycle) warnings.push(`Preserved Codex assignments with unknown lifecycle evidence in ${entry.key}.`);
+		} else warnings.push(`Preserved Codex assignments with unknown requester evidence in ${entry.key}.`);
+	} catch {
+		warnings.push(`Could not establish requester ownership for Codex native assignments in ${entry.key}; preserved them for a later Doctor repair.`);
+	}
+	else if (assignments.length > 0) warnings.push(`Preserved Codex native assignments in ${entry.key}; ownership inspection prerequisites are incomplete. Inspect the binding before retrying Doctor.`);
+	const next = assignments.length ? {
+		version: 1,
+		assignments
+	} : void 0;
+	if (isDeepStrictEqual(next, raw.nativeSubagentAssignments)) return;
+	const { nativeSubagentAssignments: _previous, ...value } = raw;
+	const retired = originalAssignments.filter((assignment) => !assignments.includes(assignment));
+	if (retired.length) try {
+		const submissions = readCodexNativeSubagentSubmissions(raw.nativeSubagentSubmissions);
+		if (submissions) {
+			const receipts = submissions.receipts.filter((receipt) => !retired.some((assignment) => isDeepStrictEqual(submissions.owner, assignment.owner) && submissions.owner.parentThreadId === assignment.nativeParentThreadId && receipt.childThreadId === assignment.childThreadId && (receipt.submissionId === assignment.nativeTurnId || codexNativeSubagentRunId(receipt.childThreadId, receipt.submissionId) === assignment.runId) && (!assignment.submission || isDeepStrictEqual(receipt, assignment.submission))));
+			if (receipts.length !== submissions.receipts.length) {
+				delete value.nativeSubagentSubmissions;
+				if (receipts.length) value.nativeSubagentSubmissions = {
+					...submissions,
+					receipts
+				};
+			}
+		}
+	} catch {
+		warnings.push(`Preserved uncertain native submission receipts in ${entry.key}; inspect them before retrying Doctor.`);
+	}
+	return {
+		entry,
+		value: {
+			...value,
+			...next ? { nativeSubagentAssignments: next } : {}
+		}
+	};
+}
+async function* inspect(params) {
+	const read = params.context.readPluginStateEntriesInKeyRange;
+	if (!read) return;
+	let after;
+	while (true) {
+		const rows = read(CODEX_APP_SERVER_BINDING_NAMESPACE, {
+			prefix: "",
+			after,
+			limit: 512
+		});
+		const replacements = [];
+		const warnings = [];
+		for (const entry of rows) {
+			const replacement = await normalizeRow(entry, params, warnings);
+			if (replacement) replacements.push(replacement);
+		}
+		if (replacements.length || warnings.length) yield {
+			replacements,
+			warnings
+		};
+		if (rows.length < 512) return;
+		after = rows.at(-1)?.key;
+	}
+}
+const codexNativeAssignmentRepair = {
+	id: "codex-native-assignment-repair",
+	label: "Codex native pending assignment repair",
+	doctorOnly: true,
+	phase: "after-session-repair",
+	collectBackupResources: () => [],
+	async detectLegacyState(params) {
+		for await (const _ of inspect(params)) return { preview: ["- Repair duplicate or obsolete Codex native pending assignments"] };
+		return null;
+	},
+	async migrateLegacyState(params) {
+		const changes = [];
+		const warnings = [];
+		const repair = params.context.repairPluginStateEntries;
+		if (!repair) return {
+			changes,
+			warnings: ["Codex native assignment repair requires locked SQLite maintenance ownership"],
+			warningDisposition: "recoverable"
+		};
+		for await (const inspected of inspect(params)) {
+			warnings.push(...inspected.warnings);
+			if (!inspected.replacements.length) continue;
+			try {
+				const result = await repair(CODEX_APP_SERVER_BINDING_NAMESPACE, inspected.replacements);
+				changes.push(...result.changes, `Repaired native pending assignments in ${inspected.replacements.length} Codex binding(s)`);
+				warnings.push(...result.warnings);
+			} catch {
+				warnings.push("Codex native assignment bindings could not be repaired; preserved them for a later openclaw doctor --fix pass.");
+			}
+		}
+		return {
+			changes,
+			warnings,
+			...warnings.length ? { warningDisposition: "recoverable" } : {}
+		};
+	}
+};
+//#endregion
+export { codexNativeAssignmentRepair };

package/dist/.setup/{native-auth-CveRfTpz.mjs → native-auth-TAGxZP-r.mjs}

@@ -1,8 +1,8 @@
 import { d as readCodexPluginConfig } from "./config-parsing-CVK2Q463.mjs";
 import { n as isCodexAppServerProxyLaunch, t as buildCodexLoginStatusArgs } from "./launch-args-DbFCehO7.mjs";
-import { r as resolveManagedCodexAppServerStartOptions } from "./managed-binary-DwC9wxch.mjs";
-import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-lgeKKHyw.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-DGB1-VbB.mjs";
+import { r as resolveManagedCodexAppServerStartOptions } from "./managed-binary-Boj8_lWV.mjs";
+import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-BsXQmXll.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-BUH-IDVE.mjs";
 import { materializeWindowsSpawnProgram, resolveWindowsSpawnProgram } from "openclaw/plugin-sdk/windows-spawn";
 import { runUtf8CommandWithTimeout } from "openclaw/plugin-sdk/process-runtime";
 //#region extensions/codex/src/app-server/native-auth.ts

package/dist/.setup/{native-hook-relay-Ctyky2Qt.mjs → native-hook-relay-CwkDznGH.mjs}

@@ -1,9 +1,9 @@
+import { k as resolveCodexToolAbortTerminalReason } from "./client-CafYfF2n.mjs";
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
 import { l as fingerprintCodexPolicy } from "./config-security-DpkGNy5T.mjs";
-import { D as nativeHookRelayUnregisterQueue } from "./shared-client-AdQX0Tdq.mjs";
-import { k as resolveCodexToolAbortTerminalReason } from "./client-BM97zH3z.mjs";
-import { R as normalizeCodexDynamicToolName } from "./thread-requests-DjyDmCo4.mjs";
-import { t as codexNativeSubagentMonitorRuntime } from "./native-subagent-monitor-CJaIve3h.mjs";
+import { D as nativeHookRelayUnregisterQueue } from "./shared-client-C0gEybHs.mjs";
+import { R as normalizeCodexDynamicToolName } from "./thread-requests-pX9_RXpU.mjs";
+import { t as codexNativeSubagentMonitorRuntime } from "./native-subagent-monitor-D_tvjJxa.mjs";
 import { createHash } from "node:crypto";
 import { addTimerTimeoutGraceMs, finiteSecondsToTimerSafeMilliseconds } from "openclaw/plugin-sdk/number-runtime";
 import { escapeRegExp } from "openclaw/plugin-sdk/text-utility-runtime";

package/dist/.setup/{native-mcp-app-DprMGBqj.mjs → native-mcp-app-B7N--ols.mjs}

@@ -1,9 +1,9 @@
-import { G as protectCodexAppServerLiveThread, _ as retainSharedCodexAppServerClientIfCurrent, n as captureCodexAppServerClientLifetime } from "./shared-client-AdQX0Tdq.mjs";
-import { F as getCodexAppServerClientInstanceId } from "./client-BM97zH3z.mjs";
-import { n as getCodexAppServerTurnRouter } from "./turn-router-DnfbVPvu.mjs";
-import { a as requestPluginApprovalOutcome } from "./plugin-approval-roundtrip-x7UI_uqk.mjs";
+import { F as getCodexAppServerClientInstanceId } from "./client-CafYfF2n.mjs";
+import { G as protectCodexAppServerLiveThread, _ as retainSharedCodexAppServerClientIfCurrent, n as captureCodexAppServerClientLifetime } from "./shared-client-C0gEybHs.mjs";
+import { n as getCodexAppServerTurnRouter } from "./turn-router-8CkGlezp.mjs";
+import { a as requestPluginApprovalOutcome } from "./plugin-approval-roundtrip-ts-2EU8i.mjs";
 import { i as readCodexMcpToolUiVisibility, n as projectCodexMcpToolMetadata, r as readCodexMcpToolConnectorId, t as projectCodexMcpServerMetadata } from "./mcp-tool-metadata-_sawBkIh.mjs";
-import { t as __exportAll } from "./session-binding-sidecars-DijNZb31.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-CAHe3enw.mjs";
 import { asOptionalRecord, normalizeLowercaseStringOrEmpty, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { z } from "zod";
 import { loadAgentHarnessMcpConfig, prepareHarnessNativeMcpAppPreview } from "openclaw/plugin-sdk/agent-harness-runtime";

package/dist/.setup/{native-skill-isolation-C4XYLm33.mjs → native-skill-isolation-0pEyxLRX.mjs}

@@ -1,9 +1,9 @@
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
 import { n as resolveCodexAppServerLocalHomeDir } from "./auth-start-options-BPIPeEX8.mjs";
 import { t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-Bg9DbDI6.mjs";
-import { K as readCodexClientSessionMeta } from "./shared-client-AdQX0Tdq.mjs";
-import { f as unsubscribeCodexThreadBestEffort, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS } from "./attempt-client-cleanup-jWVRH043.mjs";
-import { b as codexDynamicToolsFingerprint, p as attestCodexRestrictedToolSurfaceMcpServersDisabled } from "./thread-requests-DjyDmCo4.mjs";
+import { K as readCodexClientSessionMeta } from "./shared-client-C0gEybHs.mjs";
+import { f as unsubscribeCodexThreadBestEffort, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS } from "./attempt-client-cleanup-DQBa7iiq.mjs";
+import { b as codexDynamicToolsFingerprint, p as attestCodexRestrictedToolSurfaceMcpServersDisabled } from "./thread-requests-pX9_RXpU.mjs";
 import path from "node:path";
 import os from "node:os";
 import fs from "node:fs/promises";