@openclaw/codex 2026.5.16-beta.3 → 2026.5.16-beta.5

package/dist/{session-binding-DbdVqMzW.js → session-binding-DqApZIgD.js}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-DUslC3ob.js";
-import { o as normalizeCodexServiceTier } from "./config-3ATInASk.js";
+import { o as normalizeCodexServiceTier } from "./config-B5pq6hEz.js";
 import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
 import fs from "node:fs/promises";
 import { ensureAuthProfileStore, resolveDefaultAgentDir, resolveProviderIdForAuth } from "openclaw/plugin-sdk/agent-runtime";

package/dist/{shared-client-CnbrvEfV.js → shared-client-DlvmoLBJ.js}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-DUslC3ob.js";
-import { c as resolveCodexAppServerRuntimeOptions, n as codexAppServerStartOptionsKey } from "./config-3ATInASk.js";
-import { a as MANAGED_CODEX_APP_SERVER_PACKAGE, o as resolveCodexAppServerSpawnEnv, t as CodexAppServerClient } from "./client-CA7amCZ8.js";
+import { c as resolveCodexAppServerRuntimeOptions, n as codexAppServerStartOptionsKey } from "./config-B5pq6hEz.js";
+import { a as MANAGED_CODEX_APP_SERVER_PACKAGE, o as resolveCodexAppServerSpawnEnv, t as CodexAppServerClient } from "./client-6FkrXfaz.js";
 import { createRequire } from "node:module";
 import { createHash } from "node:crypto";
 import { constants, readFileSync } from "node:fs";
@@ -467,20 +467,39 @@ async function withTimeout$1(promise, timeoutMs, timeoutMessage) {
 //#endregion
 //#region extensions/codex/src/app-server/shared-client.ts
 var shared_client_exports = /* @__PURE__ */ __exportAll({
-	clearSharedCodexAppServerClient: () => clearSharedCodexAppServerClient,
 	clearSharedCodexAppServerClientAndWait: () => clearSharedCodexAppServerClientAndWait,
 	clearSharedCodexAppServerClientIfCurrent: () => clearSharedCodexAppServerClientIfCurrent,
+	clearSharedCodexAppServerClientIfCurrentAndWait: () => clearSharedCodexAppServerClientIfCurrentAndWait,
 	createIsolatedCodexAppServerClient: () => createIsolatedCodexAppServerClient,
 	getSharedCodexAppServerClient: () => getSharedCodexAppServerClient
 });
 const SHARED_CODEX_APP_SERVER_CLIENT_STATE = Symbol.for("openclaw.codexAppServerClientState");
 function getSharedCodexAppServerClientState() {
 	const globalState = globalThis;
-	globalState[SHARED_CODEX_APP_SERVER_CLIENT_STATE] ??= {};
-	return globalState[SHARED_CODEX_APP_SERVER_CLIENT_STATE];
+	const state = globalState[SHARED_CODEX_APP_SERVER_CLIENT_STATE];
+	if (isSharedCodexAppServerClientState(state)) return state;
+	const legacyState = readLegacySharedCodexAppServerClientState(state);
+	const clients = /* @__PURE__ */ new Map();
+	if (legacyState?.key && (legacyState.client || legacyState.promise)) {
+		const legacyKey = legacyState.key;
+		clients.set(legacyKey, {
+			client: legacyState.client,
+			promise: legacyState.promise
+		});
+		legacyState.client?.addCloseHandler((closedClient) => clearSharedClientEntryIfCurrent(legacyKey, closedClient));
+	}
+	const nextState = { clients };
+	globalState[SHARED_CODEX_APP_SERVER_CLIENT_STATE] = nextState;
+	return nextState;
+}
+function isSharedCodexAppServerClientState(value) {
+	return value !== null && typeof value === "object" && value.clients instanceof Map;
+}
+function readLegacySharedCodexAppServerClientState(value) {
+	if (value === null || typeof value !== "object") return;
+	return value;
 }
 async function getSharedCodexAppServerClient(options) {
-	const state = getSharedCodexAppServerClientState();
 	const agentDir = options?.agentDir ?? resolveDefaultAgentDir(options?.config ?? {});
 	const usesNativeAuth = options?.authProfileId === null;
 	const requestedAuthProfileId = options?.authProfileId === null ? void 0 : options?.authProfileId;
@@ -499,12 +518,12 @@ async function getSharedCodexAppServerClient(options) {
 		authProfileId,
 		agentDir: usesNativeAuth ? void 0 : agentDir
 	});
-	if (state.key && state.key !== key) clearSharedCodexAppServerClient();
-	state.key = key;
-	const sharedPromise = state.promise ?? (state.promise = (async () => {
+	const state = getSharedCodexAppServerClientState();
+	const entry = getOrCreateSharedClientEntry(state, key);
+	const sharedPromise = entry.promise ?? (entry.promise = (async () => {
 		const client = CodexAppServerClient.start(startOptions);
-		state.client = client;
-		client.addCloseHandler(clearSharedClientIfCurrent);
+		entry.client = client;
+		client.addCloseHandler((closedClient) => clearSharedClientEntryIfCurrent(key, closedClient));
 		try {
 			await client.initialize();
 			await applyCodexAppServerAuthProfile({
@@ -523,7 +542,8 @@ async function getSharedCodexAppServerClient(options) {
 	try {
 		return await withTimeout$1(sharedPromise, options?.timeoutMs ?? 0, "codex app-server initialize timed out");
 	} catch (error) {
-		if (state.promise === sharedPromise && state.key === key) clearSharedCodexAppServerClient();
+		const currentEntry = state.clients.get(key);
+		if (currentEntry?.promise === sharedPromise) clearSharedClientEntry(key, currentEntry);
 		throw error;
 	}
 }
@@ -560,38 +580,52 @@ async function createIsolatedCodexAppServerClient(options) {
 		throw error;
 	}
 }
-function clearSharedCodexAppServerClient() {
+function clearSharedCodexAppServerClientIfCurrent(client) {
+	if (!client) return false;
 	const state = getSharedCodexAppServerClientState();
-	const client = state.client;
-	state.client = void 0;
-	state.promise = void 0;
-	state.key = void 0;
-	client?.close();
+	for (const [key, entry] of state.clients) if (entry.client === client) {
+		state.clients.delete(key);
+		client.close();
+		return true;
+	}
+	return false;
 }
-function clearSharedCodexAppServerClientIfCurrent(client) {
+async function clearSharedCodexAppServerClientIfCurrentAndWait(client, options) {
 	if (!client) return false;
 	const state = getSharedCodexAppServerClientState();
-	if (state.client !== client) return false;
-	state.client = void 0;
-	state.promise = void 0;
-	state.key = void 0;
-	client.close();
-	return true;
+	for (const [key, entry] of state.clients) if (entry.client === client) {
+		state.clients.delete(key);
+		await client.closeAndWait(options);
+		return true;
+	}
+	return false;
 }
 async function clearSharedCodexAppServerClientAndWait(options) {
 	const state = getSharedCodexAppServerClientState();
-	const client = state.client;
-	state.client = void 0;
-	state.promise = void 0;
-	state.key = void 0;
-	await client?.closeAndWait(options);
+	const clients = collectSharedClients(state);
+	state.clients.clear();
+	await Promise.all(clients.map((client) => client.closeAndWait(options)));
+}
+function getOrCreateSharedClientEntry(state, key) {
+	let entry = state.clients.get(key);
+	if (!entry) {
+		entry = {};
+		state.clients.set(key, entry);
+	}
+	return entry;
+}
+function clearSharedClientEntry(key, entry) {
+	const state = getSharedCodexAppServerClientState();
+	if (state.clients.get(key) !== entry) return;
+	state.clients.delete(key);
+	entry.client?.close();
 }
-function clearSharedClientIfCurrent(client) {
+function clearSharedClientEntryIfCurrent(key, client) {
 	const state = getSharedCodexAppServerClientState();
-	if (state.client !== client) return;
-	state.client = void 0;
-	state.promise = void 0;
-	state.key = void 0;
+	if (state.clients.get(key)?.client === client) state.clients.delete(key);
+}
+function collectSharedClients(state) {
+	return [...new Set([...state.clients.values()].map((entry) => entry.client).filter((client) => Boolean(client)))];
 }
 //#endregion
-export { shared_client_exports as a, resolveCodexAppServerAuthAccountCacheKey as c, resolveCodexAppServerEnvApiKeyCacheKey as d, resolveCodexAppServerHomeDir as f, getSharedCodexAppServerClient as i, resolveCodexAppServerAuthProfileId as l, clearSharedCodexAppServerClientIfCurrent as n, withTimeout$1 as o, createIsolatedCodexAppServerClient as r, refreshCodexAppServerAuthTokens as s, clearSharedCodexAppServerClientAndWait as t, resolveCodexAppServerAuthProfileIdForAgent as u };
+export { shared_client_exports as a, resolveCodexAppServerAuthAccountCacheKey as c, resolveCodexAppServerEnvApiKeyCacheKey as d, resolveCodexAppServerHomeDir as f, getSharedCodexAppServerClient as i, resolveCodexAppServerAuthProfileId as l, clearSharedCodexAppServerClientIfCurrentAndWait as n, withTimeout$1 as o, createIsolatedCodexAppServerClient as r, refreshCodexAppServerAuthTokens as s, clearSharedCodexAppServerClientIfCurrent as t, resolveCodexAppServerAuthProfileIdForAgent as u };

package/dist/{side-question-D3nH-Jk1.js → side-question-DgVgwmjR.js}

@@ -1,19 +1,23 @@
-import { c as resolveCodexAppServerRuntimeOptions, s as readCodexPluginConfig } from "./config-3ATInASk.js";
+import { c as resolveCodexAppServerRuntimeOptions, s as readCodexPluginConfig } from "./config-B5pq6hEz.js";
 import { a as readCodexDynamicToolCallParams, i as assertCodexTurnStartResponse, l as readCodexTurnCompletedNotification, t as assertCodexThreadForkResponse } from "./protocol-validators-BGBspNmF.js";
 import { t as isJsonObject } from "./protocol-C9UWI98H.js";
-import { r as isCodexAppServerApprovalRequest } from "./client-CA7amCZ8.js";
+import { r as isCodexAppServerApprovalRequest } from "./client-6FkrXfaz.js";
 import { u as formatCodexUsageLimitErrorMessage } from "./command-formatters-BRW7_Nu7.js";
-import { i as getSharedCodexAppServerClient, s as refreshCodexAppServerAuthTokens } from "./shared-client-CnbrvEfV.js";
-import { i as readCodexAppServerBinding } from "./session-binding-DbdVqMzW.js";
-import { b as createCodexDynamicToolBridge, d as resolveReasoningEffort, n as buildCodexRuntimeThreadConfig, u as resolveCodexAppServerModelProvider, x as filterCodexDynamicTools } from "./thread-lifecycle-D2sxRPdz.js";
-import { n as handleCodexAppServerElicitationRequest, r as handleCodexAppServerApprovalRequest, t as filterToolsForVisionInputs } from "./vision-tools-Cm_YicZb.js";
+import { i as getSharedCodexAppServerClient, s as refreshCodexAppServerAuthTokens } from "./shared-client-DlvmoLBJ.js";
+import { i as readCodexAppServerBinding } from "./session-binding-DqApZIgD.js";
+import { S as filterCodexDynamicTools, T as resolveCodexDynamicToolsLoading, b as createCodexDynamicToolBridge, d as resolveReasoningEffort, h as mergeCodexThreadConfigs, n as buildCodexRuntimeThreadConfig, u as resolveCodexAppServerModelProvider } from "./thread-lifecycle-BbriKhTq.js";
+import { a as handleCodexAppServerElicitationRequest, i as buildCodexNativeHookRelayDisabledConfig, n as CODEX_NATIVE_HOOK_RELAY_EVENTS, o as handleCodexAppServerApprovalRequest, r as buildCodexNativeHookRelayConfig, t as filterToolsForVisionInputs } from "./vision-tools-BX9YuTEK.js";
 import { n as rememberCodexRateLimits, t as readRecentCodexRateLimits } from "./rate-limit-cache-dvhq-4pi.js";
-import { embeddedAgentLog, formatErrorMessage, resolveAgentDir, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveSandboxContext, resolveSessionAgentIds, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { buildAgentHookContextChannelFields, embeddedAgentLog, formatErrorMessage, registerNativeHookRelay, resolveAgentDir, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveSandboxContext, resolveSessionAgentIds, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/side-question.ts
 const CODEX_SIDE_DYNAMIC_TOOL_TIMEOUT_MS = 3e4;
 const CODEX_SIDE_DYNAMIC_TOOL_MAX_TIMEOUT_MS = 6e5;
 const CODEX_SIDE_DYNAMIC_IMAGE_TOOL_TIMEOUT_MS = 6e4;
 const SIDE_QUESTION_COMPLETION_TIMEOUT_MS = 6e5;
+const CODEX_SIDE_NATIVE_HOOK_RELAY_MIN_TTL_MS = 30 * 6e4;
+const CODEX_SIDE_NATIVE_HOOK_RELAY_TTL_GRACE_MS = 5 * 6e4;
+const CODEX_SIDE_NATIVE_HOOK_RELAY_STARTUP_REQUEST_COUNT = 3;
+const CODEX_SIDE_NATIVE_HOOK_RELAY_EVENTS_WITH_APP_SERVER_APPROVALS = CODEX_NATIVE_HOOK_RELAY_EVENTS.filter((event) => event !== "permission_request");
 const SIDE_BOUNDARY_PROMPT = `Side conversation boundary.
 
 Everything before this boundary is inherited history from the parent thread. It is reference context only. It is not your current task.
@@ -63,6 +67,7 @@ async function runCodexAppServerSideQuestion(params, options = {}) {
 	let childThreadId;
 	let turnId;
 	let removeRequestHandler;
+	let nativeHookRelay;
 	try {
 		const cwd = binding.cwd || params.workspaceDir || process.cwd();
 		const sideRunParams = buildSideRunAttemptParams(params, {
@@ -103,6 +108,7 @@ async function runCodexAppServerSideQuestion(params, options = {}) {
 				paramsForRun: sideRunParams,
 				threadId: childThreadId,
 				turnId,
+				nativeHookRelay,
 				signal: runAbortController.signal
 			});
 			if (request.method !== "item/tool/call") return;
@@ -122,6 +128,36 @@ async function runCodexAppServerSideQuestion(params, options = {}) {
 		const approvalPolicy = binding.approvalPolicy ?? appServer.approvalPolicy;
 		const sandbox = binding.sandbox ?? appServer.sandbox;
 		const serviceTier = binding.serviceTier ?? appServer.serviceTier;
+		const nativeHookRelayEvents = resolveCodexSideNativeHookRelayEvents({
+			configuredEvents: options.nativeHookRelay?.events,
+			approvalPolicy
+		});
+		nativeHookRelay = options.nativeHookRelay ? registerCodexSideNativeHookRelay({
+			options: options.nativeHookRelay,
+			events: nativeHookRelayEvents,
+			agentId: sessionAgentId,
+			sessionId: params.sessionId,
+			sessionKey: params.sessionKey,
+			config: params.cfg,
+			runId: sideRunParams.runId,
+			channelId: buildAgentHookContextChannelFields({
+				sessionKey: params.sessionKey,
+				messageChannel: params.messageChannel,
+				messageProvider: params.messageProvider,
+				currentChannelId: params.currentChannelId
+			}).channelId,
+			requestTimeoutMs: appServer.requestTimeoutMs,
+			completionTimeoutMs: Math.max(appServer.turnCompletionIdleTimeoutMs, SIDE_QUESTION_COMPLETION_TIMEOUT_MS),
+			signal: runAbortController.signal
+		}) : void 0;
+		const nativeHookRelayConfig = nativeHookRelay ? buildCodexNativeHookRelayConfig({
+			relay: nativeHookRelay,
+			events: nativeHookRelayEvents,
+			hookTimeoutSec: options.nativeHookRelay?.hookTimeoutSec,
+			clearOmittedEvents: true
+		}) : options.nativeHookRelay?.enabled === false ? buildCodexNativeHookRelayDisabledConfig() : void 0;
+		const runtimeThreadConfig = buildCodexRuntimeThreadConfig(void 0);
+		const threadConfig = mergeCodexThreadConfigs(nativeHookRelayConfig, runtimeThreadConfig) ?? runtimeThreadConfig;
 		const modelProvider = resolveCodexAppServerModelProvider({
 			provider: params.provider,
 			authProfileId,
@@ -137,7 +173,7 @@ async function runCodexAppServerSideQuestion(params, options = {}) {
 			approvalsReviewer: appServer.approvalsReviewer,
 			sandbox,
 			...serviceTier ? { serviceTier } : {},
-			config: buildCodexRuntimeThreadConfig(void 0),
+			config: threadConfig,
 			developerInstructions: SIDE_DEVELOPER_INSTRUCTIONS,
 			ephemeral: true,
 			threadSource: "user"
@@ -184,18 +220,51 @@ async function runCodexAppServerSideQuestion(params, options = {}) {
 		if (!trimmed) throw new Error("Codex /btw completed without an answer.");
 		return { text: trimmed };
 	} finally {
-		params.opts?.abortSignal?.removeEventListener("abort", abortFromUpstream);
-		if (!runAbortController.signal.aborted) runAbortController.abort("codex_side_question_finished");
-		removeNotificationHandler();
-		removeRequestHandler?.();
-		await cleanupCodexSideThread(client, {
-			threadId: childThreadId,
-			turnId,
-			interrupt: !collector.completed,
-			timeoutMs: appServer.requestTimeoutMs
-		});
+		try {
+			params.opts?.abortSignal?.removeEventListener("abort", abortFromUpstream);
+			if (!runAbortController.signal.aborted) runAbortController.abort("codex_side_question_finished");
+			removeNotificationHandler();
+			removeRequestHandler?.();
+			await cleanupCodexSideThread(client, {
+				threadId: childThreadId,
+				turnId,
+				interrupt: !collector.completed,
+				timeoutMs: appServer.requestTimeoutMs
+			});
+		} finally {
+			nativeHookRelay?.unregister();
+		}
 	}
 }
+function resolveCodexSideNativeHookRelayEvents(params) {
+	if (params.configuredEvents?.length) return params.configuredEvents;
+	return params.approvalPolicy === "never" ? CODEX_NATIVE_HOOK_RELAY_EVENTS : CODEX_SIDE_NATIVE_HOOK_RELAY_EVENTS_WITH_APP_SERVER_APPROVALS;
+}
+function registerCodexSideNativeHookRelay(params) {
+	if (params.options.enabled === false) return;
+	return registerNativeHookRelay({
+		provider: "codex",
+		...params.agentId ? { agentId: params.agentId } : {},
+		sessionId: params.sessionId,
+		...params.sessionKey ? { sessionKey: params.sessionKey } : {},
+		...params.config ? { config: params.config } : {},
+		runId: params.runId,
+		...params.channelId ? { channelId: params.channelId } : {},
+		allowedEvents: params.events,
+		ttlMs: resolveCodexSideNativeHookRelayTtlMs({
+			explicitTtlMs: params.options.ttlMs,
+			requestTimeoutMs: params.requestTimeoutMs,
+			completionTimeoutMs: params.completionTimeoutMs
+		}),
+		signal: params.signal,
+		command: { timeoutMs: params.options.gatewayTimeoutMs }
+	});
+}
+function resolveCodexSideNativeHookRelayTtlMs(params) {
+	if (params.explicitTtlMs !== void 0) return params.explicitTtlMs;
+	const relayBudgetMs = params.requestTimeoutMs * CODEX_SIDE_NATIVE_HOOK_RELAY_STARTUP_REQUEST_COUNT + params.completionTimeoutMs + CODEX_SIDE_NATIVE_HOOK_RELAY_TTL_GRACE_MS;
+	return Math.max(CODEX_SIDE_NATIVE_HOOK_RELAY_MIN_TTL_MS, Math.floor(relayBudgetMs));
+}
 function buildSideRunAttemptParams(params, options) {
 	return {
 		params,
@@ -211,6 +280,9 @@ function buildSideRunAttemptParams(params, options) {
 		sessionFile: params.sessionFile,
 		sessionKey: params.sessionKey,
 		agentId: params.agentId,
+		...params.messageChannel ? { messageChannel: params.messageChannel } : {},
+		...params.messageProvider ? { messageProvider: params.messageProvider } : {},
+		...params.currentChannelId ? { currentChannelId: params.currentChannelId } : {},
 		workspaceDir: options.cwd,
 		authProfileId: options.authProfileId,
 		authProfileIdSource: params.authProfileIdSource,
@@ -262,6 +334,14 @@ async function createCodexSideToolBridge(input) {
 			modelApi: runtimeModel.api,
 			modelContextWindowTokens: runtimeModel.contextWindow,
 			modelAuthMode: resolveModelAuthMode(runtimeModel.provider, input.params.cfg, void 0, { workspaceDir: input.cwd }),
+			...input.params.messageProvider || input.params.messageChannel ? { messageProvider: input.params.messageProvider ?? input.params.messageChannel } : {},
+			...input.params.currentChannelId ? { currentChannelId: input.params.currentChannelId } : {},
+			hookChannelId: buildAgentHookContextChannelFields({
+				sessionKey: input.params.sessionKey,
+				messageChannel: input.params.messageChannel,
+				messageProvider: input.params.messageProvider,
+				currentChannelId: input.params.currentChannelId
+			}).channelId,
 			sandbox,
 			modelHasVision: runtimeModel.input?.includes("image") ?? false,
 			requireExplicitMessageTarget: true
@@ -270,16 +350,23 @@ async function createCodexSideToolBridge(input) {
 			hasInboundImages: false
 		});
 	}
+	const hookChannelFields = buildAgentHookContextChannelFields({
+		sessionKey: input.params.sessionKey,
+		messageChannel: input.params.messageChannel,
+		messageProvider: input.params.messageProvider,
+		currentChannelId: input.params.currentChannelId
+	});
 	return createCodexDynamicToolBridge({
 		tools,
 		signal: input.signal,
-		loading: input.pluginConfig.codexDynamicToolsLoading ?? "searchable",
+		loading: resolveCodexDynamicToolsLoading(input.pluginConfig),
 		hookContext: {
 			agentId: input.sessionAgentId,
 			config: input.params.cfg,
 			sessionId: input.params.sessionId,
 			sessionKey: input.params.sessionKey,
-			runId: input.params.opts?.runId ?? `codex-btw:${input.params.sessionId}`
+			runId: input.params.opts?.runId ?? `codex-btw:${input.params.sessionId}`,
+			...hookChannelFields
 		}
 	});
 }

package/dist/test-api.js

@@ -1,5 +1,5 @@
-import { c as resolveCodexAppServerRuntimeOptions } from "./config-3ATInASk.js";
-import { a as buildThreadResumeParams, b as createCodexDynamicToolBridge, i as buildDeveloperInstructions, o as buildThreadStartParams, s as buildTurnStartParams, x as filterCodexDynamicTools } from "./thread-lifecycle-D2sxRPdz.js";
+import { c as resolveCodexAppServerRuntimeOptions } from "./config-B5pq6hEz.js";
+import { S as filterCodexDynamicTools, a as buildThreadResumeParams, b as createCodexDynamicToolBridge, i as buildDeveloperInstructions, o as buildThreadStartParams, s as buildTurnStartParams } from "./thread-lifecycle-BbriKhTq.js";
 //#region extensions/codex/test-api.ts
 function resolveCodexPromptSnapshotAppServerOptions(pluginConfig) {
 	return resolveCodexAppServerRuntimeOptions({