@openclaw/codex 2026.5.12-beta.1 → 2026.5.12-beta.3

package/dist/{client-factory-B_0hRLx5.js → client-factory-Bw7M3rdW.js}

@@ -1,5 +1,5 @@
 //#region extensions/codex/src/app-server/client-factory.ts
-const defaultCodexAppServerClientFactory = (startOptions, authProfileId, agentDir, config) => import("./shared-client-2q_uX6dM.js").then((n) => n.i).then(({ getSharedCodexAppServerClient }) => getSharedCodexAppServerClient({
+const defaultCodexAppServerClientFactory = (startOptions, authProfileId, agentDir, config) => import("./shared-client-DSSqFqHM.js").then((n) => n.i).then(({ getSharedCodexAppServerClient }) => getSharedCodexAppServerClient({
 	startOptions,
 	authProfileId,
 	agentDir,

package/dist/{command-handlers-DBtb-11U.js → command-handlers-D9CzemFF.js}

@@ -1,12 +1,12 @@
 import { i as isCodexFastServiceTier, s as resolveCodexAppServerRuntimeOptions } from "./config-0rd3LnKg.js";
-import { n as listCodexAppServerModels, t as listAllCodexAppServerModels } from "./models-CupVdk6Y.js";
+import { n as listCodexAppServerModels, t as listAllCodexAppServerModels } from "./models-DqfYggBz.js";
 import { t as isJsonObject } from "./protocol-C9UWI98H.js";
-import { n as CODEX_CONTROL_METHODS, r as describeControlFailure, t as requestCodexAppServerJson } from "./request-dv8xEOeW.js";
+import { n as CODEX_CONTROL_METHODS, r as describeControlFailure, t as requestCodexAppServerJson } from "./request-DSOsuqmX.js";
 import { a as formatComputerUseStatus, c as formatThreads, i as formatCodexStatus, l as readString$1, n as formatAccount, o as formatList, p as summarizeCodexAccountUsage, r as formatCodexDisplayText, s as formatModels, t as buildHelp } from "./command-formatters-Ttwc_kgX.js";
 import { i as readCodexAppServerBinding, o as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-CDN-Pf8K.js";
-import { a as parseCodexFastModeArg, c as setCodexConversationFastMode, d as steerCodexConversationTurn, f as stopCodexConversationTurn, i as formatPermissionsMode, l as setCodexConversationModel, m as resolveCodexDefaultWorkspaceDir, o as parseCodexPermissionsModeArg, p as readCodexConversationBindingData, r as startCodexConversationThread, s as readCodexConversationActiveTurn, u as setCodexConversationPermissions } from "./conversation-binding-BSqeZQnB.js";
-import { n as installCodexComputerUse, r as readCodexComputerUseStatus } from "./computer-use-DbjvOEWr.js";
-import { n as rememberCodexRateLimits } from "./rate-limit-cache-dvhq-4pi.js";
+import { a as parseCodexFastModeArg, c as setCodexConversationFastMode, d as steerCodexConversationTurn, f as stopCodexConversationTurn, i as formatPermissionsMode, l as setCodexConversationModel, m as resolveCodexDefaultWorkspaceDir, o as parseCodexPermissionsModeArg, p as readCodexConversationBindingData, r as startCodexConversationThread, s as readCodexConversationActiveTurn, u as setCodexConversationPermissions } from "./conversation-binding-Dn66MHqg.js";
+import { n as installCodexComputerUse, r as readCodexComputerUseStatus } from "./computer-use-Br-1hHIR.js";
+import { n as rememberCodexRateLimits } from "./rate-limit-cache-BFi-50LG.js";
 import crypto from "node:crypto";
 import { ensureAuthProfileStore, findNormalizedProviderValue, resolveAuthProfileEligibility, resolveAuthProfileOrder, resolveDefaultAgentDir, resolveProfileUnusableUntilForDisplay } from "openclaw/plugin-sdk/agent-runtime";
 //#region extensions/codex/src/command-account.ts

package/dist/{compact-C5KQFyRe.js → compact-DfmGNV9J.js}

@@ -1,7 +1,7 @@
 import { s as resolveCodexAppServerRuntimeOptions } from "./config-0rd3LnKg.js";
 import { t as isJsonObject } from "./protocol-C9UWI98H.js";
 import { i as readCodexAppServerBinding } from "./session-binding-CDN-Pf8K.js";
-import { n as defaultCodexAppServerClientFactory, t as createCodexAppServerClientFactoryTestHooks } from "./client-factory-B_0hRLx5.js";
+import { n as defaultCodexAppServerClientFactory, t as createCodexAppServerClientFactoryTestHooks } from "./client-factory-Bw7M3rdW.js";
 import { embeddedAgentLog, formatErrorMessage, isActiveHarnessContextEngine, runHarnessContextEngineMaintenance } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/compact.ts
 const DEFAULT_CODEX_COMPACTION_WAIT_TIMEOUT_MS = 300 * 1e3;

package/dist/{computer-use-DbjvOEWr.js → computer-use-Br-1hHIR.js}

@@ -1,5 +1,5 @@
 import { c as resolveCodexComputerUseConfig, s as resolveCodexAppServerRuntimeOptions } from "./config-0rd3LnKg.js";
-import { r as describeControlFailure, t as requestCodexAppServerJson } from "./request-dv8xEOeW.js";
+import { r as describeControlFailure, t as requestCodexAppServerJson } from "./request-DSOsuqmX.js";
 import { existsSync } from "node:fs";
 //#region extensions/codex/src/app-server/computer-use.ts
 var CodexComputerUseSetupError = class extends Error {

package/dist/{conversation-binding-BSqeZQnB.js → conversation-binding-Dn66MHqg.js}

@@ -1,8 +1,8 @@
 import { i as isCodexFastServiceTier, r as codexSandboxPolicyForTurn, s as resolveCodexAppServerRuntimeOptions } from "./config-0rd3LnKg.js";
 import { t as isJsonObject } from "./protocol-C9UWI98H.js";
-import { n as CODEX_CONTROL_METHODS } from "./request-dv8xEOeW.js";
+import { n as CODEX_CONTROL_METHODS } from "./request-DSOsuqmX.js";
 import { r as formatCodexDisplayText } from "./command-formatters-Ttwc_kgX.js";
-import { l as resolveCodexAppServerAuthProfileIdForAgent, r as getSharedCodexAppServerClient } from "./shared-client-2q_uX6dM.js";
+import { l as resolveCodexAppServerAuthProfileIdForAgent, r as getSharedCodexAppServerClient } from "./shared-client-DSSqFqHM.js";
 import { i as readCodexAppServerBinding, n as isCodexAppServerNativeAuthProfile, o as writeCodexAppServerBinding, r as normalizeCodexAppServerBindingModelProvider, t as clearCodexAppServerBinding } from "./session-binding-CDN-Pf8K.js";
 import { formatErrorMessage } from "openclaw/plugin-sdk/agent-harness-runtime";
 import path from "node:path";

package/dist/harness.js

@@ -18,15 +18,15 @@ function createCodexAppServerAgentHarness(options) {
 			};
 		},
 		runAttempt: async (params) => {
-			const { runCodexAppServerAttempt } = await import("./run-attempt-DIEWRVGH.js");
+			const { runCodexAppServerAttempt } = await import("./run-attempt-y4QDhBHf.js");
 			return runCodexAppServerAttempt(params, { pluginConfig: options?.pluginConfig });
 		},
 		runSideQuestion: async (params) => {
-			const { runCodexAppServerSideQuestion } = await import("./side-question-oO_-Jet5.js");
+			const { runCodexAppServerSideQuestion } = await import("./side-question-BcATx0hX.js");
 			return runCodexAppServerSideQuestion(params, { pluginConfig: options?.pluginConfig });
 		},
 		compact: async (params) => {
-			const { maybeCompactCodexAppServerSession } = await import("./compact-C5KQFyRe.js");
+			const { maybeCompactCodexAppServerSession } = await import("./compact-DfmGNV9J.js");
 			return maybeCompactCodexAppServerSession(params, { pluginConfig: options?.pluginConfig });
 		},
 		reset: async (params) => {
@@ -36,7 +36,7 @@ function createCodexAppServerAgentHarness(options) {
 			}
 		},
 		dispose: async () => {
-			const { clearSharedCodexAppServerClientAndWait } = await import("./shared-client-2q_uX6dM.js").then((n) => n.i);
+			const { clearSharedCodexAppServerClientAndWait } = await import("./shared-client-DSSqFqHM.js").then((n) => n.i);
 			await clearSharedCodexAppServerClientAndWait();
 		}
 	};

package/dist/index.js

@@ -1,11 +1,13 @@
 import { createCodexAppServerAgentHarness } from "./harness.js";
-import { t as CODEX_PLUGINS_MARKETPLACE_NAME } from "./config-0rd3LnKg.js";
+import { o as readCodexPluginConfig, s as resolveCodexAppServerRuntimeOptions, t as CODEX_PLUGINS_MARKETPLACE_NAME } from "./config-0rd3LnKg.js";
 import { buildCodexMediaUnderstandingProvider } from "./media-understanding-provider.js";
 import { buildCodexProvider } from "./provider.js";
-import { r as describeControlFailure, t as requestCodexAppServerJson } from "./request-dv8xEOeW.js";
+import { r as describeControlFailure, t as requestCodexAppServerJson } from "./request-DSOsuqmX.js";
 import { r as formatCodexDisplayText } from "./command-formatters-Ttwc_kgX.js";
-import { n as handleCodexConversationInboundClaim, t as handleCodexConversationBindingResolved } from "./conversation-binding-BSqeZQnB.js";
-import { i as defaultCodexAppInventoryCache, t as ensureCodexPluginActivation } from "./plugin-activation-lmfBoCiu.js";
+import { l as resolveCodexAppServerAuthProfileIdForAgent, s as resolveCodexAppServerAuthAccountCacheKey, u as resolveCodexAppServerEnvApiKeyCacheKey } from "./shared-client-DSSqFqHM.js";
+import { n as handleCodexConversationInboundClaim, t as handleCodexConversationBindingResolved } from "./conversation-binding-Dn66MHqg.js";
+import { a as defaultCodexAppInventoryCache, n as pluginReadParams, t as ensureCodexPluginActivation } from "./plugin-activation-PXGqUjwY.js";
+import { t as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-DjrZp49q.js";
 import { resolveLivePluginConfigObject } from "openclaw/plugin-sdk/plugin-config-runtime";
 import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
 import os from "node:os";
@@ -37,7 +39,7 @@ async function handleCodexCommand(ctx, options = {}) {
 	}
 }
 async function loadDefaultCodexSubcommandHandler() {
-	const { handleCodexSubcommand } = await import("./command-handlers-DBtb-11U.js");
+	const { handleCodexSubcommand } = await import("./command-handlers-D9CzemFF.js");
 	return handleCodexSubcommand;
 }
 //#endregion
@@ -134,47 +136,24 @@ async function discoverPluginDirs(codexHome) {
 	await visit(root, 0);
 	return [...discovered.values()].toSorted((a, b) => a.source.localeCompare(b.source));
 }
-async function discoverInstalledCuratedPlugins(codexHome) {
+async function discoverInstalledCuratedPlugins(codexHome, options = {}) {
+	const requestOptions = { startOptions: sourceCodexAppServerStartOptions(codexHome) };
 	try {
-		const marketplace = (await requestCodexAppServerJson({
+		const marketplace = (await requestSourceCodexAppServerJson(requestOptions, {
 			method: "plugin/list",
-			requestParams: { cwds: [] },
-			timeoutMs: 6e4,
-			isolated: true,
-			startOptions: {
-				transport: "stdio",
-				command: "codex",
-				commandSource: "config",
-				args: [
-					"app-server",
-					"--listen",
-					"stdio://"
-				],
-				headers: {},
-				env: {
-					CODEX_HOME: codexHome,
-					HOME: path.dirname(codexHome)
-				}
-			}
+			requestParams: { cwds: [] }
 		})).marketplaces.find((entry) => entry.name === CODEX_PLUGINS_MARKETPLACE_NAME);
 		if (!marketplace) return {
 			plugins: [],
 			error: `Codex marketplace ${CODEX_PLUGINS_MARKETPLACE_NAME} was not found in source plugin inventory.`
 		};
-		return { plugins: marketplace.plugins.filter((plugin) => plugin.installed).map((plugin) => {
-			const pluginName = pluginNameFromSummary(plugin);
-			if (!pluginName) return;
-			return {
-				name: plugin.name,
-				pluginName,
-				marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
-				source: `${CODEX_PLUGINS_MARKETPLACE_NAME}/${pluginName}`,
-				sourceKind: "app-server",
-				migratable: true,
-				installed: plugin.installed,
-				enabled: plugin.enabled
-			};
-		}).filter((plugin) => plugin !== void 0).toSorted((a, b) => (a.pluginName ?? a.name).localeCompare(b.pluginName ?? b.name)) };
+		const plugins = marketplace.plugins.filter((plugin) => plugin.installed).map((plugin) => buildInstalledPluginSource(plugin)).filter((plugin) => plugin !== void 0);
+		return { plugins: (options.evaluatePluginMigrationEligibility === true ? await withPluginMigrationEligibility({
+			plugins,
+			marketplace: marketplaceRef(marketplace),
+			requestOptions,
+			verifyPluginApps: options.verifyPluginApps === true
+		}) : plugins).toSorted((a, b) => (a.pluginName ?? a.name).localeCompare(b.pluginName ?? b.name)) };
 	} catch (error) {
 		return {
 			plugins: [],
@@ -182,6 +161,239 @@ async function discoverInstalledCuratedPlugins(codexHome) {
 		};
 	}
 }
+function sourceCodexAppServerStartOptions(codexHome) {
+	return {
+		transport: "stdio",
+		command: "codex",
+		commandSource: "config",
+		args: [
+			"app-server",
+			"--listen",
+			"stdio://"
+		],
+		headers: {},
+		env: {
+			CODEX_HOME: codexHome,
+			HOME: path.dirname(codexHome)
+		}
+	};
+}
+async function requestSourceCodexAppServerJson(options, params) {
+	return await requestCodexAppServerJson({
+		method: params.method,
+		requestParams: params.requestParams,
+		timeoutMs: 6e4,
+		startOptions: options.startOptions,
+		authProfileId: null,
+		isolated: true
+	});
+}
+function buildInstalledPluginSource(plugin) {
+	const pluginName = pluginNameFromSummary(plugin);
+	if (!pluginName) return;
+	return {
+		name: plugin.name,
+		pluginName,
+		marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
+		source: `${CODEX_PLUGINS_MARKETPLACE_NAME}/${pluginName}`,
+		sourceKind: "app-server",
+		migratable: true,
+		installed: plugin.installed,
+		enabled: plugin.enabled
+	};
+}
+function marketplaceRef(marketplace) {
+	return {
+		name: CODEX_PLUGINS_MARKETPLACE_NAME,
+		...marketplace.path ? { path: marketplace.path } : {},
+		...!marketplace.path ? { remoteMarketplaceName: marketplace.name } : {}
+	};
+}
+async function withPluginMigrationEligibility(params) {
+	const pending = [];
+	const evaluated = [];
+	for (const plugin of params.plugins) {
+		if (plugin.enabled !== true) {
+			evaluated.push({
+				...plugin,
+				migratable: false,
+				migrationBlock: { code: "plugin_disabled" },
+				message: `Codex plugin "${plugin.pluginName ?? plugin.name}" is installed in Codex but disabled; enable it in Codex before migrating it to OpenClaw.`
+			});
+			continue;
+		}
+		const detail = await readPluginDetail(params.requestOptions, params.marketplace, plugin);
+		if (!detail.ok) {
+			evaluated.push({
+				...plugin,
+				migratable: false,
+				migrationBlock: {
+					code: "plugin_read_unavailable",
+					error: detail.error
+				},
+				message: `Codex plugin "${plugin.pluginName ?? plugin.name}" detail could not be read: ${detail.error}`
+			});
+			continue;
+		}
+		if (detail.detail.apps.length === 0) {
+			evaluated.push({
+				...plugin,
+				migratable: true
+			});
+			continue;
+		}
+		const apps = detail.detail.apps.map(sourcePluginAppFact).toSorted((left, right) => left.id.localeCompare(right.id));
+		pending.push({
+			plugin,
+			apps
+		});
+	}
+	if (pending.length === 0) return evaluated;
+	let sourceAccount;
+	try {
+		sourceAccount = await readSourceCodexAccount(params.requestOptions);
+	} catch (error) {
+		if (!params.verifyPluginApps) {
+			const message = error instanceof Error ? error.message : String(error);
+			for (const { plugin, apps } of pending) evaluated.push({
+				...plugin,
+				migratable: false,
+				migrationBlock: {
+					code: "codex_account_unavailable",
+					apps,
+					error: message
+				},
+				message: `Codex plugin "${plugin.pluginName ?? plugin.name}" owns apps, but the source Codex app-server account could not be read: ${message}`
+			});
+			return evaluated;
+		}
+	}
+	if (sourceAccount && sourceAccount !== "chatgpt") {
+		for (const { plugin, apps } of pending) evaluated.push({
+			...plugin,
+			migratable: false,
+			migrationBlock: {
+				code: "codex_subscription_required",
+				apps
+			},
+			message: codexSubscriptionRequiredMessage(plugin)
+		});
+		return evaluated;
+	}
+	if (!params.verifyPluginApps) {
+		for (const { plugin, apps } of pending) evaluated.push({
+			...plugin,
+			apps,
+			migratable: true
+		});
+		return evaluated;
+	}
+	const snapshot = await refreshSourceAppInventory(params.requestOptions).catch((error) => {
+		const message = error instanceof Error ? error.message : String(error);
+		for (const { plugin, apps } of pending) evaluated.push({
+			...plugin,
+			migratable: false,
+			migrationBlock: {
+				code: "app_inventory_unavailable",
+				apps,
+				error: message
+			},
+			message: `Codex plugin "${plugin.pluginName ?? plugin.name}" owns apps, but source app inventory could not be read: ${message}`
+		});
+	});
+	if (!snapshot) return evaluated;
+	const appInfoById = new Map(snapshot.apps.map((app) => [app.id, app]));
+	for (const { plugin, apps: declaredApps } of pending) {
+		const apps = declaredApps.map((app) => sourcePluginAppFactWithInventory(app, appInfoById.get(app.id))).toSorted((left, right) => left.id.localeCompare(right.id));
+		const blockCode = migrationBlockCodeForApps(apps);
+		if (!blockCode) {
+			evaluated.push({
+				...plugin,
+				apps,
+				migratable: true
+			});
+			continue;
+		}
+		evaluated.push({
+			...plugin,
+			migratable: false,
+			migrationBlock: {
+				code: blockCode,
+				apps
+			},
+			message: appInventoryBlockMessage(plugin, apps, blockCode)
+		});
+	}
+	return evaluated;
+}
+async function readSourceCodexAccount(options) {
+	const response = await requestSourceCodexAppServerJson(options, {
+		method: "account/read",
+		requestParams: { refreshToken: false }
+	});
+	if (!response.account || typeof response.account !== "object" || Array.isArray(response.account)) return "missing";
+	return response.account.type === "chatgpt" ? "chatgpt" : "non_chatgpt";
+}
+async function readPluginDetail(options, marketplace, plugin) {
+	try {
+		return {
+			ok: true,
+			detail: (await requestSourceCodexAppServerJson(options, {
+				method: "plugin/read",
+				requestParams: pluginReadParams(marketplace, plugin.pluginName ?? plugin.name)
+			})).plugin
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			error: error instanceof Error ? error.message : String(error)
+		};
+	}
+}
+async function refreshSourceAppInventory(options) {
+	const key = buildCodexPluginAppCacheKey({ appServer: { start: options.startOptions } });
+	const request = async (method, requestParams) => await requestSourceCodexAppServerJson(options, {
+		method,
+		requestParams
+	});
+	return await defaultCodexAppInventoryCache.refreshNow({
+		key,
+		request,
+		forceRefetch: true
+	});
+}
+function sourcePluginAppFact(app) {
+	return {
+		id: app.id,
+		name: app.name,
+		needsAuth: app.needsAuth
+	};
+}
+function sourcePluginAppFactWithInventory(app, info) {
+	if (!info) return app;
+	return {
+		...app,
+		isAccessible: info.isAccessible,
+		isEnabled: info.isEnabled
+	};
+}
+function migrationBlockCodeForApps(apps) {
+	if (apps.some((app) => app.isAccessible === false)) return "app_inaccessible";
+	if (apps.some((app) => app.isEnabled === false)) return "app_disabled";
+	if (apps.some((app) => app.isAccessible === void 0 || app.isEnabled === void 0)) return "app_missing";
+}
+function appInventoryBlockMessage(plugin, apps, code) {
+	const status = code === "app_inaccessible" ? "inaccessible" : code === "app_disabled" ? "disabled" : "missing";
+	const blocking = apps.find((app) => code === "app_inaccessible" ? app.isAccessible === false : code === "app_disabled" ? app.isEnabled === false : app.isAccessible === void 0 || app.isEnabled === void 0) ?? apps[0];
+	const appLabel = blocking ? ` app "${blocking.name}"` : " an owned app";
+	return `Codex plugin "${plugin.pluginName ?? plugin.name}" owns${appLabel} but the source app inventory reports it is ${status}; authenticate or enable the app in Codex before migrating it to OpenClaw.`;
+}
+function codexPluginMigrationSubscriptionWarning() {
+	return "Codex app-backed plugin migration requires the Codex app-server source account to be logged in with a ChatGPT subscription account. Log in to the Codex app with subscription auth; OpenClaw auth or API-key auth does not satisfy Codex app connector access.";
+}
+function codexSubscriptionRequiredMessage(plugin) {
+	return `Codex plugin "${plugin.pluginName ?? plugin.name}" owns apps, but ${codexPluginMigrationSubscriptionWarning()}`;
+}
 function pluginNameFromSummary(summary) {
 	const candidates = [summary.id, summary.name];
 	for (const candidate of candidates) {
@@ -191,8 +403,9 @@ function pluginNameFromSummary(summary) {
 		if (normalized) return normalized;
 	}
 }
-async function discoverCodexSource(input) {
-	const codexHome = resolveHomePath(input?.trim() || defaultCodexHome());
+async function discoverCodexSource(inputOrOptions) {
+	const options = typeof inputOrOptions === "string" || inputOrOptions === void 0 ? { input: inputOrOptions } : inputOrOptions;
+	const codexHome = resolveHomePath(options.input?.trim() || defaultCodexHome());
 	const codexSkillsDir = path.join(codexHome, "skills");
 	const agentsSkillsDir = personalAgentsSkillsDir();
 	const configPath = path.join(codexHome, "config.toml");
@@ -206,7 +419,7 @@ async function discoverCodexSource(input) {
 		root: agentsSkillsDir,
 		sourceLabel: "personal AgentSkill"
 	});
-	const sourcePluginDiscovery = await discoverInstalledCuratedPlugins(codexHome);
+	const sourcePluginDiscovery = await discoverInstalledCuratedPlugins(codexHome, options);
 	const sourcePluginNames = new Set(sourcePluginDiscovery.plugins.flatMap((plugin) => plugin.pluginName ? [plugin.pluginName] : []));
 	const cachedPlugins = (await discoverPluginDirs(codexHome)).filter((plugin) => {
 		const normalizedName = sanitizePluginName(plugin.name);
@@ -283,6 +496,7 @@ const CODEX_PLUGIN_NATIVE_CONFIG_PATH = [
 	"codexPlugins"
 ];
 const MIGRATION_REASON_PLUGIN_EXISTS = "plugin exists";
+const CODEX_PLUGIN_SOURCE_APP_VERIFICATION_UNVERIFIED = "not_run";
 function uniqueSkillName(skill, counts) {
 	const base = sanitizeName(skill.name) || "codex-skill";
 	if ((counts.get(base) ?? 0) <= 1) return base;
@@ -375,12 +589,32 @@ function buildPluginItems(ctx, plugins) {
 					marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
 					pluginName: plugin.pluginName,
 					sourceInstalled: plugin.installed === true,
-					sourceEnabled: plugin.enabled === true
+					sourceEnabled: plugin.enabled === true,
+					...plugin.apps && plugin.apps.length > 0 && !shouldVerifyPluginApps(ctx) ? { sourceAppVerification: CODEX_PLUGIN_SOURCE_APP_VERIFICATION_UNVERIFIED } : {}
 				}
 			}));
 			continue;
 		}
 		manualIndex += 1;
+		if (plugin.migrationBlock && plugin.pluginName) {
+			const details = {
+				pluginName: plugin.pluginName,
+				marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
+				...plugin.migrationBlock.apps ? { apps: plugin.migrationBlock.apps } : {},
+				...plugin.migrationBlock.error ? { error: plugin.migrationBlock.error } : {}
+			};
+			items.push(createMigrationItem({
+				id: `plugin:${sanitizeName(plugin.name) || sanitizeName(path.basename(plugin.source))}:${manualIndex}`,
+				kind: "manual",
+				action: "manual",
+				source: plugin.source,
+				status: "skipped",
+				reason: plugin.migrationBlock.code,
+				message: plugin.message ?? `Codex native plugin "${plugin.name}" was found but not activated automatically.`,
+				details: { ...details }
+			}));
+			continue;
+		}
 		items.push(createMigrationManualItem({
 			id: `plugin:${sanitizeName(plugin.name) || sanitizeName(path.basename(plugin.source))}:${manualIndex}`,
 			source: plugin.source,
@@ -390,6 +624,9 @@ function buildPluginItems(ctx, plugins) {
 	}
 	return items;
 }
+function shouldVerifyPluginApps(ctx) {
+	return ctx.providerOptions?.verifyPluginApps === true;
+}
 function readCodexPluginMigrationConfigEntry(item, enabled) {
 	const configKey = item.details?.configKey;
 	const marketplaceName = item.details?.marketplaceName;
@@ -461,9 +698,13 @@ function buildPluginConfigItem(ctx, pluginItems) {
 	});
 }
 async function buildCodexMigrationPlan(ctx) {
-	const source = await discoverCodexSource(ctx.source);
-	if (!hasCodexSource(source)) throw new Error(`Codex state was not found at ${source.root}. Pass --from <path> if it lives elsewhere.`);
 	const targets = resolveCodexMigrationTargets(ctx);
+	const source = await discoverCodexSource({
+		input: ctx.source,
+		evaluatePluginMigrationEligibility: true,
+		verifyPluginApps: shouldVerifyPluginApps(ctx)
+	});
+	if (!hasCodexSource(source)) throw new Error(`Codex state was not found at ${source.root}. Pass --from <path> if it lives elsewhere.`);
 	const items = [];
 	items.push(...await buildSkillItems({
 		skills: source.skills,
@@ -484,8 +725,11 @@ async function buildCodexMigrationPlan(ctx) {
 	}));
 	const warnings = [
 		...items.some((item) => item.status === "conflict") ? ["Conflicts were found. Re-run with --overwrite to replace conflicting migration targets after item-level backups."] : [],
-		...source.plugins.length > 0 ? ["Codex source-installed openai-curated plugins are planned for native activation; cached plugin bundles remain manual-review only."] : [],
+		...source.plugins.some((plugin) => plugin.migratable) ? ["Codex source-installed openai-curated plugins are planned for native activation; cached plugin bundles remain manual-review only."] : [],
+		...source.plugins.some((plugin) => plugin.migratable && plugin.apps && plugin.apps.length > 0) && !shouldVerifyPluginApps(ctx) ? ["Codex app-backed plugins were planned without source app accessibility verification. Re-run with --verify-plugin-apps to force a fresh source app/list check before planning native plugin activation."] : [],
+		...source.plugins.some((plugin) => plugin.sourceKind === "cache") ? ["Codex cached plugin bundles remain manual-review only."] : [],
 		...source.pluginDiscoveryError ? [`Codex app-server plugin inventory discovery failed: ${source.pluginDiscoveryError}. Cached plugin bundles, if any, are advisory only.`] : [],
+		...source.plugins.some((plugin) => plugin.migrationBlock?.code === "codex_subscription_required") ? [codexPluginMigrationSubscriptionWarning()] : [],
 		...source.archivePaths.length > 0 ? ["Codex config and hook files are archive-only. They are preserved in the migration report, not loaded into OpenClaw automatically."] : []
 	];
 	return {
@@ -555,6 +799,8 @@ async function applyCodexPluginInstallItem(ctx, item) {
 		}
 	};
 	try {
+		const appCacheKey = await buildTargetCodexPluginAppCacheKey(ctx);
+		const appServer = resolveTargetCodexAppServer(ctx);
 		const result = await ensureCodexPluginActivation({
 			identity: policy,
 			installEvenIfActive: true,
@@ -562,10 +808,13 @@ async function applyCodexPluginInstallItem(ctx, item) {
 				method,
 				requestParams,
 				timeoutMs: 6e4,
+				startOptions: appServer.start,
+				agentDir: resolveCodexMigrationTargets(ctx).agentDir,
 				config: ctx.config
-			})
+			}),
+			appCache: defaultCodexAppInventoryCache,
+			appCacheKey
 		});
-		defaultCodexAppInventoryCache.clear();
 		const baseDetails = {
 			...item.details,
 			code: result.reason,
@@ -607,6 +856,30 @@ async function applyCodexPluginInstallItem(ctx, item) {
 		};
 	}
 }
+function resolveTargetCodexAppServer(ctx) {
+	return resolveCodexAppServerRuntimeOptions({ pluginConfig: readCodexPluginConfig(ctx.config) });
+}
+async function buildTargetCodexPluginAppCacheKey(ctx) {
+	const targets = resolveCodexMigrationTargets(ctx);
+	const appServer = resolveTargetCodexAppServer(ctx);
+	const authProfileId = resolveCodexAppServerAuthProfileIdForAgent({
+		agentDir: targets.agentDir,
+		config: ctx.config
+	});
+	const accountId = await resolveCodexAppServerAuthAccountCacheKey({
+		authProfileId,
+		agentDir: targets.agentDir,
+		config: ctx.config
+	});
+	const envApiKeyFingerprint = authProfileId ? void 0 : resolveCodexAppServerEnvApiKeyCacheKey({ startOptions: appServer.start });
+	return buildCodexPluginAppCacheKey({
+		appServer,
+		agentDir: targets.agentDir,
+		authProfileId,
+		accountId,
+		envApiKeyFingerprint
+	});
+}
 async function applyCodexPluginConfigItem(ctx, item, appliedItems) {
 	const entries = appliedItems.map(readAppliedPluginConfigEntry).filter((entry) => entry !== void 0);
 	if (entries.length === 0) return markMigrationItemSkipped(item, "no selected Codex plugins");
@@ -694,7 +967,7 @@ function buildCodexMigrationProvider(params = {}) {
 		label: "Codex",
 		description: "Inventory and promote Codex CLI skills while keeping Codex native plugins and hooks explicit.",
 		async detect(ctx) {
-			const source = await discoverCodexSource(ctx.source);
+			const source = await discoverCodexSource({ input: ctx.source });
 			const found = hasCodexSource(source);
 			return {
 				found,

package/dist/media-understanding-provider.js

@@ -1,7 +1,7 @@
 import { CODEX_PROVIDER_ID, FALLBACK_CODEX_MODELS } from "./provider-catalog.js";
 import { s as resolveCodexAppServerRuntimeOptions } from "./config-0rd3LnKg.js";
 import { i as assertCodexTurnStartResponse, l as readCodexTurnCompletedNotification, o as readCodexErrorNotification, r as assertCodexThreadStartResponse } from "./protocol-validators-CSY0BFBo.js";
-import { i as readModelListResult } from "./models-CupVdk6Y.js";
+import { i as readModelListResult } from "./models-DqfYggBz.js";
 import { t as isJsonObject } from "./protocol-C9UWI98H.js";
 import { validateJsonSchemaValue } from "openclaw/plugin-sdk/json-schema-runtime";
 //#region extensions/codex/media-understanding-provider.ts
@@ -62,7 +62,7 @@ async function runBoundedCodexVisionTurn(params) {
 	const appServer = resolveCodexAppServerRuntimeOptions({ pluginConfig: params.options.pluginConfig });
 	const timeoutMs = Math.max(100, params.timeoutMs);
 	const ownsClient = !params.options.clientFactory;
-	const client = params.options.clientFactory ? await params.options.clientFactory(appServer.start, params.profile) : await import("./shared-client-2q_uX6dM.js").then((n) => n.i).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
+	const client = params.options.clientFactory ? await params.options.clientFactory(appServer.start, params.profile) : await import("./shared-client-DSSqFqHM.js").then((n) => n.i).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
 		startOptions: appServer.start,
 		timeoutMs,
 		authProfileId: params.profile

package/dist/{models-CupVdk6Y.js → models-DqfYggBz.js}

@@ -39,7 +39,7 @@ async function listAllCodexAppServerModels(options = {}) {
 async function withCodexAppServerModelClient(options, run) {
 	const timeoutMs = options.timeoutMs ?? 2500;
 	const useSharedClient = options.sharedClient !== false;
-	const { createIsolatedCodexAppServerClient, getSharedCodexAppServerClient } = await import("./shared-client-2q_uX6dM.js").then((n) => n.i);
+	const { createIsolatedCodexAppServerClient, getSharedCodexAppServerClient } = await import("./shared-client-DSSqFqHM.js").then((n) => n.i);
 	const client = useSharedClient ? await getSharedCodexAppServerClient({
 		startOptions: options.startOptions,
 		timeoutMs,

package/dist/{plugin-activation-lmfBoCiu.js → plugin-activation-PXGqUjwY.js}

@@ -386,4 +386,4 @@ function activationFailure(identity, reason, diagnostic) {
 	};
 }
 //#endregion
-export { defaultCodexAppInventoryCache as i, readCodexPluginInventory as n, buildCodexAppInventoryCacheKey as r, ensureCodexPluginActivation as t };
+export { defaultCodexAppInventoryCache as a, buildCodexAppInventoryCacheKey as i, pluginReadParams as n, readCodexPluginInventory as r, ensureCodexPluginActivation as t };

package/dist/plugin-app-cache-key-DjrZp49q.js

@@ -0,0 +1,46 @@
+import { d as resolveCodexAppServerHomeDir } from "./shared-client-DSSqFqHM.js";
+import { i as buildCodexAppInventoryCacheKey } from "./plugin-activation-PXGqUjwY.js";
+import { createHash } from "node:crypto";
+//#region extensions/codex/src/app-server/plugin-app-cache-key.ts
+function buildCodexPluginAppCacheKey(params) {
+	return buildCodexAppInventoryCacheKey({
+		codexHome: resolveCodexPluginAppCacheCodexHome(params.appServer, params.agentDir),
+		endpoint: resolveCodexPluginAppCacheEndpoint(params.appServer),
+		authProfileId: params.authProfileId,
+		accountId: params.accountId,
+		envApiKeyFingerprint: params.envApiKeyFingerprint,
+		appServerVersion: params.appServerVersion
+	});
+}
+function resolveCodexPluginAppCacheEndpoint(appServer) {
+	return JSON.stringify({
+		transport: appServer.start.transport,
+		command: appServer.start.command,
+		args: appServer.start.args,
+		url: appServer.start.url ?? null,
+		credentialFingerprint: fingerprintCodexPluginAppCacheCredentials(appServer.start)
+	});
+}
+function resolveCodexPluginAppCacheCodexHome(appServer, agentDir) {
+	const configuredCodexHome = appServer.start.env?.CODEX_HOME?.trim();
+	if (configuredCodexHome) return configuredCodexHome;
+	return appServer.start.transport === "stdio" && agentDir ? resolveCodexAppServerHomeDir(agentDir) : void 0;
+}
+function fingerprintCodexPluginAppCacheCredentials(startOptions) {
+	const authToken = startOptions.authToken ?? "";
+	const headers = Object.entries(startOptions.headers).map(([key, value]) => [key.toLowerCase(), value]).toSorted(([left], [right]) => left.localeCompare(right));
+	if (!authToken && headers.length === 0) return null;
+	const hash = createHash("sha256");
+	hash.update("openclaw:codex:plugin-app-cache-credentials:v1");
+	hash.update("\0");
+	hash.update(authToken);
+	for (const [key, value] of headers) {
+		hash.update("\0");
+		hash.update(key);
+		hash.update("\0");
+		hash.update(value);
+	}
+	return `sha256:${hash.digest("hex")}`;
+}
+//#endregion
+export { buildCodexPluginAppCacheKey as t };

package/dist/provider.js

@@ -123,7 +123,7 @@ async function listModelsBestEffort(params) {
 	}
 }
 async function listCodexAppServerModelsLazy(options) {
-	const { listCodexAppServerModels } = await import("./models-CupVdk6Y.js").then((n) => n.r);
+	const { listCodexAppServerModels } = await import("./models-DqfYggBz.js").then((n) => n.r);
 	return listCodexAppServerModels(options);
 }
 function normalizeTimeoutMs(value) {

package/dist/{request-dv8xEOeW.js → request-DSOsuqmX.js}

@@ -1,5 +1,5 @@
 import { n as CodexAppServerRpcError } from "./client-kySkmL1r.js";
-import { a as withTimeout, n as createIsolatedCodexAppServerClient, r as getSharedCodexAppServerClient } from "./shared-client-2q_uX6dM.js";
+import { a as withTimeout, n as createIsolatedCodexAppServerClient, r as getSharedCodexAppServerClient } from "./shared-client-DSSqFqHM.js";
 //#region extensions/codex/src/app-server/capabilities.ts
 const CODEX_CONTROL_METHODS = {
 	account: "account/read",
@@ -28,6 +28,7 @@ async function requestCodexAppServerJson(params) {
 			startOptions: params.startOptions,
 			timeoutMs,
 			authProfileId: params.authProfileId,
+			agentDir: params.agentDir,
 			config: params.config
 		});
 		try {

package/dist/{run-attempt-DIEWRVGH.js → run-attempt-y4QDhBHf.js}

@@ -2,16 +2,17 @@ import { l as resolveCodexPluginsPolicy, o as readCodexPluginConfig, s as resolv
 import { a as readCodexDynamicToolCallParams, c as readCodexTurn, i as assertCodexTurnStartResponse } from "./protocol-validators-CSY0BFBo.js";
 import { t as isJsonObject } from "./protocol-C9UWI98H.js";
 import { i as isCodexAppServerConnectionClosedError, r as isCodexAppServerApprovalRequest } from "./client-kySkmL1r.js";
-import { n as CODEX_CONTROL_METHODS } from "./request-dv8xEOeW.js";
+import { n as CODEX_CONTROL_METHODS } from "./request-DSOsuqmX.js";
 import { d as resolveCodexUsageLimitResetAtMs, f as shouldRefreshCodexRateLimitsForUsageLimitMessage, r as formatCodexDisplayText, u as formatCodexUsageLimitErrorMessage } from "./command-formatters-Ttwc_kgX.js";
-import { c as resolveCodexAppServerAuthProfileId, d as resolveCodexAppServerHomeDir, l as resolveCodexAppServerAuthProfileIdForAgent, o as refreshCodexAppServerAuthTokens, s as resolveCodexAppServerAuthAccountCacheKey, t as clearSharedCodexAppServerClientIfCurrent, u as resolveCodexAppServerEnvApiKeyCacheKey } from "./shared-client-2q_uX6dM.js";
+import { c as resolveCodexAppServerAuthProfileId, l as resolveCodexAppServerAuthProfileIdForAgent, o as refreshCodexAppServerAuthTokens, s as resolveCodexAppServerAuthAccountCacheKey, t as clearSharedCodexAppServerClientIfCurrent, u as resolveCodexAppServerEnvApiKeyCacheKey } from "./shared-client-DSSqFqHM.js";
 import { i as readCodexAppServerBinding } from "./session-binding-CDN-Pf8K.js";
-import { i as defaultCodexAppInventoryCache, r as buildCodexAppInventoryCacheKey } from "./plugin-activation-lmfBoCiu.js";
-import { d as buildCodexPluginThreadConfig, f as buildCodexPluginThreadConfigInputFingerprint, g as normalizeCodexDynamicToolName, h as filterCodexDynamicTools, m as createCodexDynamicToolBridge, o as buildTurnStartParams, p as shouldBuildCodexPluginThreadConfig, r as buildDeveloperInstructions, s as codexDynamicToolsFingerprint, t as areCodexDynamicToolFingerprintsCompatible, u as startOrResumeThread } from "./thread-lifecycle-CSf1t3iN.js";
-import { n as defaultCodexAppServerClientFactory } from "./client-factory-B_0hRLx5.js";
-import { n as handleCodexAppServerElicitationRequest, r as handleCodexAppServerApprovalRequest, t as filterToolsForVisionInputs } from "./vision-tools-DY2xcYUU.js";
-import { t as ensureCodexComputerUse } from "./computer-use-DbjvOEWr.js";
-import { n as rememberCodexRateLimits, t as readRecentCodexRateLimits } from "./rate-limit-cache-dvhq-4pi.js";
+import { a as defaultCodexAppInventoryCache } from "./plugin-activation-PXGqUjwY.js";
+import { t as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-DjrZp49q.js";
+import { d as buildCodexPluginThreadConfig, f as buildCodexPluginThreadConfigInputFingerprint, g as normalizeCodexDynamicToolName, h as filterCodexDynamicTools, m as createCodexDynamicToolBridge, o as buildTurnStartParams, p as shouldBuildCodexPluginThreadConfig, r as buildDeveloperInstructions, s as codexDynamicToolsFingerprint, t as areCodexDynamicToolFingerprintsCompatible, u as startOrResumeThread } from "./thread-lifecycle-DW0z5zYm.js";
+import { n as defaultCodexAppServerClientFactory } from "./client-factory-Bw7M3rdW.js";
+import { n as handleCodexAppServerElicitationRequest, r as handleCodexAppServerApprovalRequest, t as filterToolsForVisionInputs } from "./vision-tools-DHyuabWn.js";
+import { t as ensureCodexComputerUse } from "./computer-use-Br-1hHIR.js";
+import { n as rememberCodexRateLimits, t as readRecentCodexRateLimits } from "./rate-limit-cache-BFi-50LG.js";
 import { createHash } from "node:crypto";
 import nodeFs from "node:fs";
 import { TOOL_PROGRESS_OUTPUT_MAX_CHARS, acquireSessionWriteLock, appendSessionTranscriptMessage, assembleHarnessContextEngine, bootstrapHarnessContextEngine, buildEmbeddedAttemptToolRunContext, buildHarnessContextEngineRuntimeContext, buildHarnessContextEngineRuntimeContextFromUsage, classifyAgentHarnessTerminalOutcome, clearActiveEmbeddedRun, embeddedAgentLog, emitAgentEvent, emitSessionTranscriptUpdate, finalizeHarnessContextEngineTurn, formatErrorMessage, formatToolAggregate, formatToolProgressOutput, inferToolMetaFromArgs, isActiveHarnessContextEngine, isSubagentSessionKey, normalizeAgentRuntimeTools, normalizeUsage, registerNativeHookRelay, resolveAgentHarnessBeforePromptBuildResult, resolveAttemptSpawnWorkspaceDir, resolveBootstrapContextForRun, resolveModelAuthMode, resolveSandboxContext, resolveSessionAgentIds, resolveSessionWriteLockAcquireTimeoutMs, resolveUserPath, runAgentCleanupStep, runAgentHarnessAfterCompactionHook, runAgentHarnessAfterToolCallHook, runAgentHarnessAgentEndHook, runAgentHarnessBeforeCompactionHook, runAgentHarnessBeforeMessageWriteHook, runAgentHarnessLlmInputHook, runAgentHarnessLlmOutputHook, runHarnessContextEngineMaintenance, setActiveEmbeddedRun, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";
@@ -2353,36 +2354,6 @@ function toCodexTextInput(text) {
 		text_elements: []
 	};
 }
-function resolveCodexPluginAppCacheEndpoint(appServer) {
-	return JSON.stringify({
-		transport: appServer.start.transport,
-		command: appServer.start.command,
-		args: appServer.start.args,
-		url: appServer.start.url ?? null,
-		credentialFingerprint: fingerprintCodexPluginAppCacheCredentials(appServer.start)
-	});
-}
-function fingerprintCodexPluginAppCacheCredentials(startOptions) {
-	const authToken = startOptions.authToken ?? "";
-	const headers = Object.entries(startOptions.headers).map(([key, value]) => [key.toLowerCase(), value]).toSorted(([left], [right]) => left.localeCompare(right));
-	if (!authToken && headers.length === 0) return null;
-	const hash = createHash("sha256");
-	hash.update("openclaw:codex:plugin-app-cache-credentials:v1");
-	hash.update("\0");
-	hash.update(authToken);
-	for (const [key, value] of headers) {
-		hash.update("\0");
-		hash.update(key);
-		hash.update("\0");
-		hash.update(value);
-	}
-	return `sha256:${hash.digest("hex")}`;
-}
-function resolveCodexPluginAppCacheCodexHome(appServer, agentDir) {
-	const configuredCodexHome = appServer.start.env?.CODEX_HOME?.trim();
-	if (configuredCodexHome) return configuredCodexHome;
-	return appServer.start.transport === "stdio" ? resolveCodexAppServerHomeDir(agentDir) : void 0;
-}
 function restrictCodexAppServerSandboxForOpenClawSandbox(appServer, sandbox) {
 	if (!sandbox?.enabled || appServer.sandbox !== "danger-full-access") return appServer;
 	return {
@@ -2613,9 +2584,9 @@ async function runCodexAppServerAttempt(params, options = {}) {
 			hookTimeoutSec: options.nativeHookRelay?.hookTimeoutSec
 		}) : options.nativeHookRelay?.enabled === false ? buildCodexNativeHookRelayDisabledConfig() : void 0;
 		const pluginThreadConfigEnabled = shouldBuildCodexPluginThreadConfig(pluginConfig);
-		const pluginAppCacheKey = buildCodexAppInventoryCacheKey({
-			codexHome: resolveCodexPluginAppCacheCodexHome(appServer, agentDir),
-			endpoint: resolveCodexPluginAppCacheEndpoint(appServer),
+		const pluginAppCacheKey = buildCodexPluginAppCacheKey({
+			appServer,
+			agentDir,
 			authProfileId: startupAuthProfileId,
 			accountId: startupAuthAccountCacheKey,
 			envApiKeyFingerprint: startupEnvApiKeyCacheKey
@@ -3742,6 +3713,7 @@ async function buildDynamicTools(input) {
 			resolvedWorkspace: input.resolvedWorkspace
 		}),
 		config: params.config,
+		authProfileStore: params.authProfileStore,
 		abortSignal: input.runAbortController.signal,
 		modelProvider: params.model.provider,
 		modelId: params.modelId,

package/dist/{shared-client-2q_uX6dM.js → shared-client-DSSqFqHM.js}

@@ -22,6 +22,7 @@ const CODEX_APP_SERVER_ISOLATION_ENV_VARS = [CODEX_HOME_ENV_VAR, HOME_ENV_VAR];
 async function bridgeCodexAppServerStartOptions(params) {
 	if (params.startOptions.transport !== "stdio") return params.startOptions;
 	const isolatedStartOptions = await withAgentCodexHomeEnvironment(params.startOptions, params.agentDir);
+	if (params.authProfileId === null) return isolatedStartOptions;
 	const store = ensureCodexAppServerAuthProfileStore({
 		agentDir: params.agentDir,
 		authProfileId: params.authProfileId,
@@ -174,6 +175,7 @@ function withoutClearedCodexIsolationEnv(clearEnv) {
 	return filtered.length === clearEnv.length ? clearEnv : filtered;
 }
 async function applyCodexAppServerAuthProfile(params) {
+	if (params.authProfileId === null) return;
 	const loginParams = await resolveCodexAppServerAuthProfileLoginParams({
 		agentDir: params.agentDir,
 		authProfileId: params.authProfileId,
@@ -488,20 +490,22 @@ function getSharedCodexAppServerClientState() {
 async function getSharedCodexAppServerClient(options) {
 	const state = getSharedCodexAppServerClientState();
 	const agentDir = options?.agentDir ?? resolveDefaultAgentDir(options?.config ?? {});
-	const authProfileId = resolveCodexAppServerAuthProfileIdForAgent({
-		authProfileId: options?.authProfileId,
+	const usesNativeAuth = options?.authProfileId === null;
+	const requestedAuthProfileId = options?.authProfileId === null ? void 0 : options?.authProfileId;
+	const authProfileId = usesNativeAuth ? void 0 : resolveCodexAppServerAuthProfileIdForAgent({
+		authProfileId: requestedAuthProfileId,
 		agentDir,
 		config: options?.config
 	});
 	const startOptions = await bridgeCodexAppServerStartOptions({
 		startOptions: await resolveManagedCodexAppServerStartOptions(options?.startOptions ?? resolveCodexAppServerRuntimeOptions().start),
 		agentDir,
-		authProfileId,
+		authProfileId: usesNativeAuth ? null : authProfileId,
 		config: options?.config
 	});
 	const key = codexAppServerStartOptionsKey(startOptions, {
 		authProfileId,
-		agentDir
+		agentDir: usesNativeAuth ? void 0 : agentDir
 	});
 	if (state.key && state.key !== key) clearSharedCodexAppServerClient();
 	state.key = key;
@@ -514,7 +518,7 @@ async function getSharedCodexAppServerClient(options) {
 			await applyCodexAppServerAuthProfile({
 				client,
 				agentDir,
-				authProfileId,
+				authProfileId: usesNativeAuth ? null : authProfileId,
 				startOptions,
 				config: options?.config
 			});
@@ -533,15 +537,17 @@ async function getSharedCodexAppServerClient(options) {
 }
 async function createIsolatedCodexAppServerClient(options) {
 	const agentDir = options?.agentDir ?? resolveDefaultAgentDir(options?.config ?? {});
-	const authProfileId = resolveCodexAppServerAuthProfileIdForAgent({
-		authProfileId: options?.authProfileId,
+	const usesNativeAuth = options?.authProfileId === null;
+	const requestedAuthProfileId = options?.authProfileId === null ? void 0 : options?.authProfileId;
+	const authProfileId = usesNativeAuth ? void 0 : resolveCodexAppServerAuthProfileIdForAgent({
+		authProfileId: requestedAuthProfileId,
 		agentDir,
 		config: options?.config
 	});
 	const startOptions = await bridgeCodexAppServerStartOptions({
 		startOptions: await resolveManagedCodexAppServerStartOptions(options?.startOptions ?? resolveCodexAppServerRuntimeOptions().start),
 		agentDir,
-		authProfileId,
+		authProfileId: usesNativeAuth ? null : authProfileId,
 		config: options?.config
 	});
 	const client = CodexAppServerClient.start(startOptions);
@@ -551,7 +557,7 @@ async function createIsolatedCodexAppServerClient(options) {
 		await applyCodexAppServerAuthProfile({
 			client,
 			agentDir,
-			authProfileId,
+			authProfileId: usesNativeAuth ? null : authProfileId,
 			startOptions,
 			config: options?.config
 		});

package/dist/{side-question-oO_-Jet5.js → side-question-BcATx0hX.js}

@@ -3,11 +3,11 @@ import { a as readCodexDynamicToolCallParams, i as assertCodexTurnStartResponse,
 import { t as isJsonObject } from "./protocol-C9UWI98H.js";
 import { r as isCodexAppServerApprovalRequest } from "./client-kySkmL1r.js";
 import { u as formatCodexUsageLimitErrorMessage } from "./command-formatters-Ttwc_kgX.js";
-import { o as refreshCodexAppServerAuthTokens, r as getSharedCodexAppServerClient } from "./shared-client-2q_uX6dM.js";
+import { o as refreshCodexAppServerAuthTokens, r as getSharedCodexAppServerClient } from "./shared-client-DSSqFqHM.js";
 import { i as readCodexAppServerBinding } from "./session-binding-CDN-Pf8K.js";
-import { c as resolveCodexAppServerModelProvider, h as filterCodexDynamicTools, l as resolveReasoningEffort, m as createCodexDynamicToolBridge, n as buildCodexRuntimeThreadConfig } from "./thread-lifecycle-CSf1t3iN.js";
-import { n as handleCodexAppServerElicitationRequest, r as handleCodexAppServerApprovalRequest, t as filterToolsForVisionInputs } from "./vision-tools-DY2xcYUU.js";
-import { n as rememberCodexRateLimits, t as readRecentCodexRateLimits } from "./rate-limit-cache-dvhq-4pi.js";
+import { c as resolveCodexAppServerModelProvider, h as filterCodexDynamicTools, l as resolveReasoningEffort, m as createCodexDynamicToolBridge, n as buildCodexRuntimeThreadConfig } from "./thread-lifecycle-DW0z5zYm.js";
+import { n as handleCodexAppServerElicitationRequest, r as handleCodexAppServerApprovalRequest, t as filterToolsForVisionInputs } from "./vision-tools-DHyuabWn.js";
+import { n as rememberCodexRateLimits, t as readRecentCodexRateLimits } from "./rate-limit-cache-BFi-50LG.js";
 import { embeddedAgentLog, formatErrorMessage, resolveAgentDir, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveSandboxContext, resolveSessionAgentIds, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/side-question.ts
 const CODEX_SIDE_DYNAMIC_TOOL_TIMEOUT_MS = 3e4;

package/dist/test-api.js

@@ -1,5 +1,5 @@
 import { s as resolveCodexAppServerRuntimeOptions } from "./config-0rd3LnKg.js";
-import { a as buildThreadStartParams, h as filterCodexDynamicTools, i as buildThreadResumeParams, m as createCodexDynamicToolBridge, o as buildTurnStartParams, r as buildDeveloperInstructions } from "./thread-lifecycle-CSf1t3iN.js";
+import { a as buildThreadStartParams, h as filterCodexDynamicTools, i as buildThreadResumeParams, m as createCodexDynamicToolBridge, o as buildTurnStartParams, r as buildDeveloperInstructions } from "./thread-lifecycle-DW0z5zYm.js";
 //#region extensions/codex/test-api.ts
 function resolveCodexPromptSnapshotAppServerOptions(pluginConfig) {
 	return resolveCodexAppServerRuntimeOptions({

package/dist/{thread-lifecycle-CSf1t3iN.js → thread-lifecycle-DW0z5zYm.js}

@@ -5,7 +5,7 @@ import { CODEX_GPT5_HEARTBEAT_PROMPT_OVERLAY, renderCodexPromptOverlay } from ".
 import { isModernCodexModel } from "./provider.js";
 import { i as isCodexAppServerConnectionClosedError } from "./client-kySkmL1r.js";
 import { i as readCodexAppServerBinding, n as isCodexAppServerNativeAuthProfile, o as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-CDN-Pf8K.js";
-import { i as defaultCodexAppInventoryCache, n as readCodexPluginInventory, t as ensureCodexPluginActivation } from "./plugin-activation-lmfBoCiu.js";
+import { a as defaultCodexAppInventoryCache, r as readCodexPluginInventory, t as ensureCodexPluginActivation } from "./plugin-activation-PXGqUjwY.js";
 import crypto from "node:crypto";
 import { HEARTBEAT_RESPONSE_TOOL_NAME, createAgentToolResultMiddlewareRunner, createCodexAppServerToolResultExtensionRunner, embeddedAgentLog, extractToolResultMediaArtifact, filterToolResultMediaUrls, isMessagingTool, isMessagingToolSendAction, isToolWrappedWithBeforeToolCallHook, normalizeHeartbeatToolResponse, runAgentHarnessAfterToolCallHook, wrapToolWithBeforeToolCallHook } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/dynamic-tool-profile.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/codex",
-  "version": "2026.5.12-beta.1",
+  "version": "2026.5.12-beta.3",
   "description": "OpenClaw Codex harness and model provider plugin",
   "repository": {
     "type": "git",
@@ -27,10 +27,10 @@
       "minHostVersion": ">=2026.5.1-beta.1"
     },
     "compat": {
-      "pluginApi": ">=2026.5.12-beta.1"
+      "pluginApi": ">=2026.5.12-beta.3"
     },
     "build": {
-      "openclawVersion": "2026.5.12-beta.1"
+      "openclawVersion": "2026.5.12-beta.3"
     },
     "release": {
       "publishToClawHub": true,
@@ -45,7 +45,7 @@
     "openclaw.plugin.json"
   ],
   "peerDependencies": {
-    "openclaw": ">=2026.5.12-beta.1"
+    "openclaw": ">=2026.5.12-beta.3"
   },
   "peerDependenciesMeta": {
     "openclaw": {