@openclaw/codex 2026.5.1-beta.1 → 2026.5.2-beta.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/codex",
-  "version": "2026.5.1-beta.1",
+  "version": "2026.5.2-beta.1",
   "description": "OpenClaw Codex harness and model provider plugin",
   "repository": {
     "type": "git",
@@ -26,14 +26,11 @@
       "defaultChoice": "npm",
       "minHostVersion": ">=2026.5.1-beta.1"
     },
-    "bundle": {
-      "includeInCore": false
-    },
     "compat": {
-      "pluginApi": ">=2026.5.1-beta.1"
+      "pluginApi": ">=2026.5.2-beta.1"
     },
     "build": {
-      "openclawVersion": "2026.5.1-beta.1"
+      "openclawVersion": "2026.5.2-beta.1"
     },
     "release": {
       "publishToClawHub": true,

package/src/app-server/auth-profile-runtime-contract.test.ts

@@ -26,6 +26,7 @@ function createParams(sessionFile: string, workspaceDir: string): EmbeddedRunAtt
     disableTools: true,
     timeoutMs: 5_000,
     authStorage: {} as never,
+    authProfileStore: { version: 1, profiles: {} },
     modelRegistry: {} as never,
   } as EmbeddedRunAttemptParams;
 }

package/src/app-server/client.test.ts

@@ -61,6 +61,7 @@ describe("CodexAppServerClient", () => {
       expect(warn).toHaveBeenCalledWith(
         "failed to parse codex app-server message",
         expect.objectContaining({
+          consoleMessage: expect.stringContaining("<redacted>"),
           linePreview: '{"token":"<redacted>"} trailing',
         }),
       ),
@@ -68,6 +69,40 @@ describe("CodexAppServerClient", () => {
     expect(JSON.stringify(warn.mock.calls)).not.toContain("secret-value");
   });
 
+  it("redacts prefixed env credential names from app-server previews", () => {
+    expect(
+      __testing.redactCodexAppServerLinePreview(
+        "fatal OPENAI_API_KEY=sk-live ANTHROPIC_API_KEY='anthropic-secret' OTHER=value",
+      ),
+    ).toBe("fatal OPENAI_API_KEY=<redacted> ANTHROPIC_API_KEY='<redacted>' OTHER=value");
+  });
+
+  it("recovers app-server messages split by raw newlines inside JSON strings", async () => {
+    const warn = vi.spyOn(embeddedAgentLog, "warn").mockImplementation(() => undefined);
+    const harness = createClientHarness();
+    clients.push(harness.client);
+    const notifications: unknown[] = [];
+    harness.client.addNotificationHandler((notification) => {
+      notifications.push(notification);
+    });
+
+    harness.process.stdout.write(
+      '{"method":"item/commandExecution/outputDelta","params":{"delta":"first' +
+        "\n" +
+        'second"}}\n',
+    );
+
+    await vi.waitFor(() =>
+      expect(notifications).toEqual([
+        {
+          method: "item/commandExecution/outputDelta",
+          params: { delta: "first\nsecond" },
+        },
+      ]),
+    );
+    expect(warn).not.toHaveBeenCalled();
+  });
+
   it("preserves JSON-RPC error codes", async () => {
     const harness = createClientHarness();
     clients.push(harness.client);
@@ -278,9 +313,23 @@ describe("CodexAppServerClient", () => {
     // an unhandled exception tearing down the gateway.
     await expect(pending).rejects.toThrow("write EPIPE");
 
-    // Subsequent requests are rejected immediately (client is closed).
+    // Subsequent requests keep the original close reason so startup logs stay actionable.
+    await expect(harness.client.request("another/method")).rejects.toThrow("write EPIPE");
+  });
+
+  it("preserves redacted app-server stderr on exit errors", async () => {
+    const harness = createClientHarness();
+    clients.push(harness.client);
+
+    const pending = harness.client.request("test/method");
+    harness.process.stderr.write('fatal token="secret-value" while booting\n');
+    harness.process.emit("exit", 1, null);
+
+    await expect(pending).rejects.toThrow(
+      'codex app-server exited: code=1 signal=null stderr="fatal token=\\"<redacted>\\" while booting"',
+    );
     await expect(harness.client.request("another/method")).rejects.toThrow(
-      "codex app-server client is closed",
+      "codex app-server exited: code=1 signal=null",
     );
   });
 

package/src/app-server/client.ts

@@ -25,7 +25,10 @@ import { MIN_CODEX_APP_SERVER_VERSION } from "./version.js";
 
 export { MIN_CODEX_APP_SERVER_VERSION } from "./version.js";
 const CODEX_APP_SERVER_PARSE_LOG_MAX = 500;
+const CODEX_APP_SERVER_PARSE_BUFFER_MAX = 1_000_000;
+const CODEX_APP_SERVER_PARSE_BUFFER_MAX_LINES = 1_000;
 const CODEX_DYNAMIC_TOOL_SERVER_REQUEST_TIMEOUT_MS = 30_000;
+const CODEX_APP_SERVER_STDERR_TAIL_MAX = 2_000;
 
 type PendingRequest = {
   method: string;
@@ -46,6 +49,16 @@ export class CodexAppServerRpcError extends Error {
   }
 }
 
+export function isCodexAppServerConnectionClosedError(error: unknown): boolean {
+  if (!(error instanceof Error)) {
+    return false;
+  }
+  return (
+    error.message === "codex app-server client is closed" ||
+    error.message.startsWith("codex app-server exited:")
+  );
+}
+
 type CodexServerRequestHandler = (
   request: Required<Pick<RpcRequest, "id" | "method">> & { params?: JsonValue },
 ) => Promise<JsonValue | undefined> | JsonValue | undefined;
@@ -64,26 +77,33 @@ export class CodexAppServerClient {
   private nextId = 1;
   private initialized = false;
   private closed = false;
+  private closeError: Error | undefined;
+  private stderrTail = "";
+  private pendingParse:
+    | {
+        text: string;
+        lineCount: number;
+        firstError: unknown;
+      }
+    | undefined;
 
   private constructor(child: CodexAppServerTransport) {
     this.child = child;
     this.lines = createInterface({ input: child.stdout });
     this.lines.on("line", (line) => this.handleLine(line));
     child.stderr.on("data", (chunk: Buffer | string) => {
-      const text = chunk.toString("utf8").trim();
-      if (text) {
-        embeddedAgentLog.debug(`codex app-server stderr: ${text}`);
+      const text = chunk.toString("utf8");
+      this.stderrTail = appendBoundedTail(this.stderrTail, text, CODEX_APP_SERVER_STDERR_TAIL_MAX);
+      const trimmed = text.trim();
+      if (trimmed) {
+        embeddedAgentLog.debug(`codex app-server stderr: ${trimmed}`);
       }
     });
     child.once("error", (error) =>
       this.closeWithError(error instanceof Error ? error : new Error(String(error))),
     );
     child.once("exit", (code, signal) => {
-      this.closeWithError(
-        new Error(
-          `codex app-server exited: code=${formatExitValue(code)} signal=${formatExitValue(signal)}`,
-        ),
-      );
+      this.closeWithError(buildCodexAppServerExitError(code, signal, this.stderrTail));
     });
     // Guard against unhandled EPIPE / write-after-close errors on the stdin
     // stream. When the child process terminates abruptly the pipe can break
@@ -152,7 +172,7 @@ export class CodexAppServerClient {
   ): Promise<T> {
     options ??= {};
     if (this.closed) {
-      return Promise.reject(new Error("codex app-server client is closed"));
+      return Promise.reject(this.closeError ?? new Error("codex app-server client is closed"));
     }
     if (options.signal?.aborted) {
       return Promise.reject(new Error(`${method} aborted`));
@@ -262,7 +282,12 @@ export class CodexAppServerClient {
   }
 
   private handleLine(line: string): void {
-    const trimmed = line.trim();
+    const rawLine = line.endsWith("\r") ? line.slice(0, -1) : line;
+    if (this.pendingParse) {
+      this.handlePendingParseLine(rawLine);
+      return;
+    }
+    const trimmed = rawLine.trim();
     if (!trimmed) {
       return;
     }
@@ -270,12 +295,43 @@ export class CodexAppServerClient {
     try {
       parsed = JSON.parse(trimmed);
     } catch (error) {
-      embeddedAgentLog.warn("failed to parse codex app-server message", {
-        error,
-        linePreview: redactCodexAppServerLinePreview(trimmed),
-      });
+      if (shouldBufferCodexAppServerParseFailure(trimmed, error)) {
+        this.pendingParse = { text: trimmed, lineCount: 1, firstError: error };
+        return;
+      }
+      logCodexAppServerParseFailure(trimmed, error, 1);
+      return;
+    }
+    this.handleParsedMessage(parsed);
+  }
+
+  private handlePendingParseLine(line: string): void {
+    const pending = this.pendingParse;
+    if (!pending) {
+      return;
+    }
+    const candidate = `${pending.text}\\n${line}`;
+    let parsed: unknown;
+    try {
+      parsed = JSON.parse(candidate);
+    } catch (error) {
+      const lineCount = pending.lineCount + 1;
+      if (
+        candidate.length <= CODEX_APP_SERVER_PARSE_BUFFER_MAX &&
+        lineCount <= CODEX_APP_SERVER_PARSE_BUFFER_MAX_LINES
+      ) {
+        this.pendingParse = { text: candidate, lineCount, firstError: pending.firstError };
+        return;
+      }
+      this.pendingParse = undefined;
+      logCodexAppServerParseFailure(candidate, error, lineCount);
       return;
     }
+    this.pendingParse = undefined;
+    this.handleParsedMessage(parsed);
+  }
+
+  private handleParsedMessage(parsed: unknown): void {
     if (!parsed || typeof parsed !== "object") {
       return;
     }
@@ -396,6 +452,7 @@ export class CodexAppServerClient {
       return false;
     }
     this.closed = true;
+    this.closeError = error;
     this.lines.close();
     this.rejectPendingRequests(error);
     return true;
@@ -541,12 +598,55 @@ function redactCodexAppServerLinePreview(value: string): string {
     .replace(
       /("(?:api_?key|authorization|token|access_token|refresh_token)"\s*:\s*")([^"]+)(")/gi,
       "$1<redacted>$3",
+    )
+    .replace(
+      /\b([a-z0-9_]*(?:api_?key|authorization|access_token|refresh_token|token))(\s*=\s*)(["']?)[^\s"']+(\3)/gi,
+      "$1$2$3<redacted>$4",
     );
   return redacted.length > CODEX_APP_SERVER_PARSE_LOG_MAX
     ? `${redacted.slice(0, CODEX_APP_SERVER_PARSE_LOG_MAX)}...`
     : redacted;
 }
 
+function appendBoundedTail(current: string, next: string, maxLength: number): string {
+  const combined = `${current}${next}`;
+  return combined.length > maxLength ? combined.slice(combined.length - maxLength) : combined;
+}
+
+function buildCodexAppServerExitError(code: unknown, signal: unknown, stderrTail: string): Error {
+  const stderrPreview = redactCodexAppServerLinePreview(stderrTail);
+  const suffix = stderrPreview ? ` stderr=${JSON.stringify(stderrPreview)}` : "";
+  return new Error(
+    `codex app-server exited: code=${formatExitValue(code)} signal=${formatExitValue(
+      signal,
+    )}${suffix}`,
+  );
+}
+
+function shouldBufferCodexAppServerParseFailure(value: string, error: unknown): boolean {
+  if (!value.startsWith("{") && !value.startsWith("[")) {
+    return false;
+  }
+  const message = error instanceof Error ? error.message : String(error);
+  return (
+    message.includes("Unterminated string") || message.includes("Unexpected end of JSON input")
+  );
+}
+
+function logCodexAppServerParseFailure(value: string, error: unknown, fragmentCount: number): void {
+  const linePreview = redactCodexAppServerLinePreview(value);
+  const suffix = fragmentCount > 1 ? ` fragments=${fragmentCount}` : "";
+  embeddedAgentLog.warn("failed to parse codex app-server message", {
+    error,
+    errorMessage: error instanceof Error ? error.message : String(error),
+    fragmentCount,
+    linePreview,
+    consoleMessage: `failed to parse codex app-server message${suffix}: preview=${JSON.stringify(
+      linePreview,
+    )}`,
+  });
+}
+
 const CODEX_APP_SERVER_APPROVAL_REQUEST_METHODS = new Set([
   "item/commandExecution/requestApproval",
   "item/fileChange/requestApproval",

package/src/app-server/compact.ts

@@ -74,6 +74,7 @@ export async function maybeCompactCodexAppServerSession(
           sessionFile: params.sessionFile,
           reason: "compaction",
           runtimeContext: params.contextEngineRuntimeContext,
+          config: params.config,
         });
       } catch (error) {
         embeddedAgentLog.warn(

package/src/app-server/dynamic-tool-profile.ts

@@ -0,0 +1,31 @@
+import type { CodexPluginConfig } from "./config.js";
+
+export const CODEX_NATIVE_FIRST_DYNAMIC_TOOL_EXCLUDES = [
+  "read",
+  "write",
+  "edit",
+  "apply_patch",
+  "exec",
+  "process",
+  "update_plan",
+] as const;
+
+export function applyCodexDynamicToolProfile<T extends { name: string }>(
+  tools: T[],
+  config: Pick<CodexPluginConfig, "codexDynamicToolsProfile" | "codexDynamicToolsExclude">,
+): T[] {
+  const excludes = new Set<string>();
+  const profile = config.codexDynamicToolsProfile ?? "native-first";
+  if (profile === "native-first") {
+    for (const name of CODEX_NATIVE_FIRST_DYNAMIC_TOOL_EXCLUDES) {
+      excludes.add(name);
+    }
+  }
+  for (const name of config.codexDynamicToolsExclude ?? []) {
+    const trimmed = name.trim();
+    if (trimmed) {
+      excludes.add(trimmed);
+    }
+  }
+  return excludes.size === 0 ? tools : tools.filter((tool) => !excludes.has(tool.name));
+}

package/src/app-server/event-projector.ts

@@ -220,6 +220,7 @@ export class CodexAppServerEventProjector {
       timedOut: false,
       idleTimedOut: false,
       timedOutDuringCompaction: false,
+      timedOutDuringToolExecution: false,
       promptError,
       promptErrorSource: promptError ? this.promptErrorSource || "prompt" : null,
       sessionIdUsed: this.params.sessionId,

package/src/app-server/managed-binary.test.ts

@@ -1,7 +1,10 @@
+import { mkdir, mkdtemp, realpath, writeFile } from "node:fs/promises";
+import os from "node:os";
 import path from "node:path";
 import { describe, expect, it, vi } from "vitest";
 import type { CodexAppServerStartOptions } from "./config.js";
 import {
+  __testing,
   resolveManagedCodexAppServerPaths,
   resolveManagedCodexAppServerStartOptions,
 } from "./managed-binary.js";
@@ -64,6 +67,16 @@ describe("managed Codex app-server binary", () => {
     );
   });
 
+  it("uses the package root when the resolver is bundled into a dist chunk", () => {
+    expect(__testing.resolveDefaultCodexPluginRoot("/repo/openclaw/dist")).toBe("/repo/openclaw");
+    expect(__testing.resolveDefaultCodexPluginRoot("/repo/openclaw/dist-runtime")).toBe(
+      "/repo/openclaw",
+    );
+    expect(
+      __testing.resolveDefaultCodexPluginRoot("/repo/openclaw/extensions/codex/src/app-server"),
+    ).toBe("/repo/openclaw/extensions/codex");
+  });
+
   it("finds Codex in the package install root used by packaged plugins", async () => {
     const installRoot = path.join("/tmp", "openclaw-plugin-package", "codex");
     const pluginRoot = path.join(installRoot, "dist", "extensions", "codex");
@@ -83,6 +96,39 @@ describe("managed Codex app-server binary", () => {
     });
   });
 
+  it("falls back to the resolved Codex package bin when no command shim exists", async () => {
+    const installRoot = await mkdtemp(path.join(os.tmpdir(), "openclaw-codex-package-"));
+    const pluginRoot = path.join(installRoot, "dist", "extensions", "codex");
+    const packageRoot = path.join(installRoot, "node_modules", "@openai", "codex");
+    const packageBin = path.join(packageRoot, "bin", "codex.js");
+    await mkdir(path.dirname(packageBin), { recursive: true });
+    await writeFile(
+      path.join(packageRoot, "package.json"),
+      JSON.stringify({
+        name: "@openai/codex",
+        bin: {
+          codex: "bin/codex.js",
+        },
+      }),
+    );
+    await writeFile(packageBin, "#!/usr/bin/env node\n");
+    const resolvedPackageBin = await realpath(packageBin);
+
+    const pathExists = vi.fn(async (filePath: string) => filePath === resolvedPackageBin);
+
+    await expect(
+      resolveManagedCodexAppServerStartOptions(startOptions("managed"), {
+        platform: "linux",
+        pluginRoot,
+        pathExists,
+      }),
+    ).resolves.toEqual({
+      ...startOptions("managed"),
+      command: resolvedPackageBin,
+      commandSource: "resolved-managed",
+    });
+  });
+
   it("fails clearly when the managed Codex binary is missing", async () => {
     await expect(
       resolveManagedCodexAppServerStartOptions(startOptions("managed"), {

package/src/app-server/managed-binary.ts

@@ -1,11 +1,13 @@
-import { constants as fsConstants } from "node:fs";
+import { constants as fsConstants, readFileSync } from "node:fs";
 import { access } from "node:fs/promises";
+import { createRequire } from "node:module";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import type { CodexAppServerStartOptions } from "./config.js";
 import { MANAGED_CODEX_APP_SERVER_PACKAGE } from "./version.js";
 
-const CODEX_PLUGIN_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "..");
+const CODEX_APP_SERVER_MODULE_DIR = path.dirname(fileURLToPath(import.meta.url));
+const CODEX_PLUGIN_ROOT = resolveDefaultCodexPluginRoot(CODEX_APP_SERVER_MODULE_DIR);
 
 type ManagedCodexAppServerPaths = {
   commandPath: string;
@@ -66,7 +68,29 @@ function resolveManagedCodexAppServerCommandCandidates(
 ): string[] {
   const pathApi = pathForPlatform(platform);
   const commandName = platform === "win32" ? "codex.cmd" : "codex";
-  const roots = [
+  const roots = resolveManagedCodexAppServerCandidateRoots(pluginRoot, platform);
+  return [
+    ...new Set([
+      ...roots.map((root) => pathApi.join(root, "node_modules", ".bin", commandName)),
+      ...resolveManagedCodexPackageBinCandidates(roots, platform),
+    ]),
+  ];
+}
+
+function resolveDefaultCodexPluginRoot(moduleDir: string): string {
+  const moduleBaseName = path.basename(moduleDir);
+  if (moduleBaseName === "dist" || moduleBaseName === "dist-runtime") {
+    return path.dirname(moduleDir);
+  }
+  return path.resolve(moduleDir, "..", "..");
+}
+
+function resolveManagedCodexAppServerCandidateRoots(
+  pluginRoot: string,
+  platform: NodeJS.Platform,
+): string[] {
+  const pathApi = pathForPlatform(platform);
+  return [
     pluginRoot,
     pathApi.dirname(pluginRoot),
     pathApi.dirname(pathApi.dirname(pluginRoot)),
@@ -74,9 +98,56 @@ function resolveManagedCodexAppServerCommandCandidates(
       ? pathApi.dirname(pathApi.dirname(pathApi.dirname(pluginRoot)))
       : null,
   ].filter((root): root is string => Boolean(root));
-  return [...new Set(roots.map((root) => pathApi.join(root, "node_modules", ".bin", commandName)))];
 }
 
+function resolveManagedCodexPackageBinCandidates(
+  roots: readonly string[],
+  platform: NodeJS.Platform,
+): string[] {
+  if (platform === "win32") {
+    return [];
+  }
+
+  const candidates: string[] = [];
+  for (const root of roots) {
+    const candidate = resolveManagedCodexPackageBinCandidate(root);
+    if (candidate) {
+      candidates.push(candidate);
+    }
+  }
+  return candidates;
+}
+
+function resolveManagedCodexPackageBinCandidate(root: string): string | null {
+  try {
+    const requireFromRoot = createRequire(path.join(root, "package.json"));
+    const packageJsonPath = requireFromRoot.resolve(
+      `${MANAGED_CODEX_APP_SERVER_PACKAGE}/package.json`,
+    );
+    const packageRoot = path.dirname(packageJsonPath);
+    const packageJson = JSON.parse(readFileSync(packageJsonPath, "utf8")) as {
+      bin?: unknown;
+    };
+    const binPath =
+      typeof packageJson.bin === "string"
+        ? packageJson.bin
+        : isRecord(packageJson.bin) && typeof packageJson.bin.codex === "string"
+          ? packageJson.bin.codex
+          : null;
+    return binPath ? path.resolve(packageRoot, binPath) : null;
+  } catch {
+    return null;
+  }
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null;
+}
+
+export const __testing = {
+  resolveDefaultCodexPluginRoot,
+};
+
 function isDistExtensionRoot(pluginRoot: string, platform: NodeJS.Platform): boolean {
   const pathApi = pathForPlatform(platform);
   const extensionsDir = pathApi.dirname(pluginRoot);

package/src/app-server/run-attempt.context-engine.test.ts

@@ -30,6 +30,7 @@ function createParams(sessionFile: string, workspaceDir: string): EmbeddedRunAtt
     disableTools: true,
     timeoutMs: 5_000,
     authStorage: {} as never,
+    authProfileStore: { version: 1, profiles: {} },
     modelRegistry: {} as never,
   } as EmbeddedRunAttemptParams;
 }
@@ -212,6 +213,7 @@ describe("runCodexAppServerAttempt context-engine lifecycle", () => {
     SessionManager.open(sessionFile).appendMessage(
       assistantMessage("existing context", Date.now()) as never,
     );
+    const openSpy = vi.spyOn(SessionManager, "open");
     const contextEngine = createContextEngine();
     const harness = createStartedThreadHarness();
     const params = createParams(sessionFile, workspaceDir);
@@ -265,6 +267,7 @@ describe("runCodexAppServerAttempt context-engine lifecycle", () => {
 
     await harness.completeTurn();
     await run;
+    expect(openSpy).not.toHaveBeenCalled();
   });
 
   it("calls afterTurn with the mirrored transcript and runs turn maintenance", async () => {