@openclaw/codex 2026.5.10-beta.3 → 2026.5.10-beta.4

package/dist/{session-binding-BAaJ-7s-.js → session-binding-UFKjHkKJ.js}

@@ -163,10 +163,19 @@ function normalizeCodexAppServerBindingModelProvider(params) {
 function resolveCodexAppServerAuthProfileCredential(lookup) {
 	const authProfileId = lookup.authProfileId?.trim();
 	if (!authProfileId) return;
-	return (lookup.authProfileStore ?? loadCodexAppServerAuthProfileStore(lookup.agentDir, lookup.config)).profiles[authProfileId];
+	return (lookup.authProfileStore ?? loadCodexAppServerAuthProfileStore({
+		agentDir: lookup.agentDir,
+		authProfileId,
+		config: lookup.config
+	})).profiles[authProfileId];
 }
-function loadCodexAppServerAuthProfileStore(agentDir, config) {
-	return ensureAuthProfileStore(agentDir?.trim() || resolveDefaultAgentDir(config ?? {}), { allowKeychainPrompt: false });
+function loadCodexAppServerAuthProfileStore(params) {
+	return ensureAuthProfileStore(params.agentDir?.trim() || resolveDefaultAgentDir(params.config ?? {}), {
+		allowKeychainPrompt: false,
+		config: params.config,
+		externalCliProviderIds: [CODEX_APP_SERVER_NATIVE_AUTH_PROVIDER],
+		externalCliProfileIds: [params.authProfileId]
+	});
 }
 function isCodexAppServerNativeAuthProvider(params) {
 	const provider = params.provider?.trim();

package/dist/{shared-client-BRX9tReb.js → shared-client-K13b0L1X.js}

@@ -6,11 +6,12 @@ import { createHash } from "node:crypto";
 import { constants, readFileSync } from "node:fs";
 import fs, { access } from "node:fs/promises";
 import path from "node:path";
-import { ensureAuthProfileStore, loadAuthProfileStoreForSecretsRuntime, resolveApiKeyForProfile, resolveAuthProfileOrder, resolveDefaultAgentDir, resolvePersistedAuthProfileOwnerAgentDir, resolveProviderIdForAuth, saveAuthProfileStore } from "openclaw/plugin-sdk/agent-runtime";
+import { ensureAuthProfileStore, ensureAuthProfileStoreWithoutExternalProfiles, loadAuthProfileStoreForSecretsRuntime, refreshOAuthCredentialForRuntime, resolveApiKeyForProfile, resolveAuthProfileOrder, resolveDefaultAgentDir, resolvePersistedAuthProfileOwnerAgentDir, resolveProviderIdForAuth, saveAuthProfileStore } from "openclaw/plugin-sdk/agent-runtime";
 import { fileURLToPath } from "node:url";
 import { withTimeout } from "openclaw/plugin-sdk/security-runtime";
 //#region extensions/codex/src/app-server/auth-bridge.ts
 const CODEX_APP_SERVER_AUTH_PROVIDER = "openai-codex";
+const OPENAI_PROVIDER = "openai";
 const OPENAI_CODEX_DEFAULT_PROFILE_ID = "openai-codex:default";
 const CODEX_HOME_ENV_VAR = "CODEX_HOME";
 const HOME_ENV_VAR = "HOME";
@@ -21,7 +22,11 @@ const CODEX_APP_SERVER_ISOLATION_ENV_VARS = [CODEX_HOME_ENV_VAR, HOME_ENV_VAR];
 async function bridgeCodexAppServerStartOptions(params) {
 	if (params.startOptions.transport !== "stdio") return params.startOptions;
 	const isolatedStartOptions = await withAgentCodexHomeEnvironment(params.startOptions, params.agentDir);
-	const store = ensureAuthProfileStore(params.agentDir, { allowKeychainPrompt: false });
+	const store = ensureCodexAppServerAuthProfileStore({
+		agentDir: params.agentDir,
+		authProfileId: params.authProfileId,
+		config: params.config
+	});
 	return shouldClearOpenAiApiKeyForCodexAuthProfile({
 		store,
 		authProfileId: resolveCodexAppServerAuthProfileId({
@@ -42,16 +47,53 @@ function resolveCodexAppServerAuthProfileId(params) {
 	})[0]?.trim();
 }
 function resolveCodexAppServerAuthProfileIdForAgent(params) {
-	const store = ensureAuthProfileStore(params.agentDir?.trim() || resolveDefaultAgentDir(params.config ?? {}), { allowKeychainPrompt: false });
+	const store = ensureCodexAppServerAuthProfileStore({
+		agentDir: params.agentDir?.trim() || resolveDefaultAgentDir(params.config ?? {}),
+		authProfileId: params.authProfileId,
+		config: params.config
+	});
 	return resolveCodexAppServerAuthProfileId({
 		authProfileId: params.authProfileId,
 		store,
 		config: params.config
 	});
 }
+function ensureCodexAppServerAuthProfileStore(params) {
+	return ensureAuthProfileStore(params.agentDir, {
+		allowKeychainPrompt: false,
+		config: params.config,
+		externalCliProviderIds: [CODEX_APP_SERVER_AUTH_PROVIDER],
+		...params.authProfileId ? { externalCliProfileIds: [params.authProfileId] } : {}
+	});
+}
+function resolveCodexAppServerAuthProfileStore(params) {
+	const overlaidStore = ensureCodexAppServerAuthProfileStore({
+		agentDir: params.agentDir,
+		authProfileId: params.authProfileId,
+		config: params.config
+	});
+	if (!params.authProfileStore) return overlaidStore;
+	const order = params.authProfileStore.order || overlaidStore.order ? {
+		...overlaidStore.order,
+		...params.authProfileStore.order
+	} : void 0;
+	return {
+		...params.authProfileStore,
+		...order ? { order } : {},
+		profiles: {
+			...overlaidStore.profiles,
+			...params.authProfileStore.profiles
+		}
+	};
+}
 async function resolveCodexAppServerAuthAccountCacheKey(params) {
 	const agentDir = params.agentDir?.trim() || resolveDefaultAgentDir(params.config ?? {});
-	const store = params.authProfileStore ?? ensureAuthProfileStore(agentDir, { allowKeychainPrompt: false });
+	const store = resolveCodexAppServerAuthProfileStore({
+		agentDir,
+		authProfileId: params.authProfileId,
+		authProfileStore: params.authProfileStore,
+		config: params.config
+	});
 	const profileId = resolveCodexAppServerAuthProfileId({
 		authProfileId: params.authProfileId,
 		store,
@@ -59,7 +101,7 @@ async function resolveCodexAppServerAuthAccountCacheKey(params) {
 	});
 	if (!profileId) return;
 	const credential = store.profiles[profileId];
-	if (!credential || !isCodexAppServerAuthProvider(credential.provider, params.config)) return;
+	if (!credential || !isCodexAppServerAuthProfileCredential(credential, params.config)) return;
 	if (credential.type === "api_key") {
 		const apiKey = (await resolveApiKeyForProfile({
 			store,
@@ -165,7 +207,11 @@ async function refreshCodexAppServerAuthTokens(params) {
 	};
 }
 async function resolveCodexAppServerAuthProfileLoginParamsInternal(params) {
-	const store = ensureAuthProfileStore(params.agentDir, { allowKeychainPrompt: false });
+	const store = ensureCodexAppServerAuthProfileStore({
+		agentDir: params.agentDir,
+		authProfileId: params.authProfileId,
+		config: params.config
+	});
 	const profileId = resolveCodexAppServerAuthProfileId({
 		authProfileId: params.authProfileId,
 		store,
@@ -174,7 +220,7 @@ async function resolveCodexAppServerAuthProfileLoginParamsInternal(params) {
 	if (!profileId) return;
 	const credential = store.profiles[profileId];
 	if (!credential) throw new Error(`Codex app-server auth profile "${profileId}" was not found.`);
-	if (!isCodexAppServerAuthProvider(credential.provider, params.config)) throw new Error(`Codex app-server auth profile "${profileId}" must belong to provider "openai-codex" or a supported alias.`);
+	if (!isCodexAppServerAuthProfileCredential(credential, params.config)) throw new Error(`Codex app-server auth profile "${profileId}" must be OpenAI Codex auth or an OpenAI API-key backup.`);
 	const loginParams = await resolveLoginParamsForCredential(profileId, credential, {
 		agentDir: params.agentDir,
 		forceOAuthRefresh: params.forceOAuthRefresh === true,
@@ -227,10 +273,23 @@ async function resolveOAuthCredentialForCodexAppServer(profileId, credential, pa
 		agentDir: params.agentDir,
 		profileId
 	});
-	const store = ensureAuthProfileStore(ownerAgentDir, { allowKeychainPrompt: false });
+	const store = ensureCodexAppServerAuthProfileStore({
+		agentDir: ownerAgentDir,
+		authProfileId: profileId,
+		config: params.config
+	});
+	const persistedCredential = ensureAuthProfileStoreWithoutExternalProfiles(ownerAgentDir, { allowKeychainPrompt: false }).profiles[profileId];
+	const persistedOAuthCredential = persistedCredential?.type === "oauth" && isCodexAppServerAuthProvider(persistedCredential.provider, params.config) ? persistedCredential : void 0;
 	const ownerCredential = store.profiles[profileId];
-	const credentialForOwner = ownerCredential?.type === "oauth" && isCodexAppServerAuthProvider(ownerCredential.provider, params.config) ? ownerCredential : credential;
-	if (params.forceRefresh) {
+	const overlaidOAuthCredential = ownerCredential?.type === "oauth" && isCodexAppServerAuthProvider(ownerCredential.provider, params.config) ? ownerCredential : void 0;
+	const credentialForOwner = persistedOAuthCredential ?? overlaidOAuthCredential ?? credential;
+	if (params.forceRefresh && !persistedOAuthCredential && overlaidOAuthCredential) {
+		const refreshedRuntimeCredential = await refreshOAuthCredentialForRuntime({ credential: overlaidOAuthCredential });
+		if (!refreshedRuntimeCredential?.access?.trim()) throw new Error(`Codex app-server auth profile "${profileId}" could not refresh.`);
+		store.profiles[profileId] = refreshedRuntimeCredential;
+		return refreshedRuntimeCredential;
+	}
+	if (params.forceRefresh && persistedOAuthCredential) {
 		store.profiles[profileId] = {
 			...credentialForOwner,
 			expires: 0
@@ -253,6 +312,12 @@ async function resolveOAuthCredentialForCodexAppServer(profileId, credential, pa
 function isCodexAppServerAuthProvider(provider, config) {
 	return resolveProviderIdForAuth(provider, { config }) === CODEX_APP_SERVER_AUTH_PROVIDER;
 }
+function isOpenAIApiKeyBackupCredential(credential, config) {
+	return credential.type === "api_key" && resolveProviderIdForAuth(credential.provider, { config }) === OPENAI_PROVIDER;
+}
+function isCodexAppServerAuthProfileCredential(credential, config) {
+	return isCodexAppServerAuthProvider(credential.provider, config) || isOpenAIApiKeyBackupCredential(credential, config);
+}
 function shouldClearOpenAiApiKeyForCodexAuthProfile(params) {
 	const profileId = params.authProfileId?.trim();
 	return isCodexSubscriptionCredential(profileId ? params.store.profiles[profileId] : params.store.profiles[OPENAI_CODEX_DEFAULT_PROFILE_ID], params.config);
@@ -531,4 +596,4 @@ function clearSharedClientIfCurrent(client) {
 	state.key = void 0;
 }
 //#endregion
-export { refreshCodexAppServerAuthTokens as a, resolveCodexAppServerAuthProfileIdForAgent as c, withTimeout$1 as i, resolveCodexAppServerEnvApiKeyCacheKey as l, getSharedCodexAppServerClient as n, resolveCodexAppServerAuthAccountCacheKey as o, shared_client_exports as r, resolveCodexAppServerAuthProfileId as s, clearSharedCodexAppServerClientIfCurrent as t, resolveCodexAppServerHomeDir as u };
+export { withTimeout$1 as a, resolveCodexAppServerAuthProfileId as c, resolveCodexAppServerHomeDir as d, shared_client_exports as i, resolveCodexAppServerAuthProfileIdForAgent as l, createIsolatedCodexAppServerClient as n, refreshCodexAppServerAuthTokens as o, getSharedCodexAppServerClient as r, resolveCodexAppServerAuthAccountCacheKey as s, clearSharedCodexAppServerClientIfCurrent as t, resolveCodexAppServerEnvApiKeyCacheKey as u };