@openclaw/codex 2026.5.18-beta.1 → 2026.5.19-alpha.1

package/dist/{client-6FkrXfaz.js → client-BCJaLwdZ.js}

@@ -1,4 +1,4 @@
-import { c as resolveCodexAppServerRuntimeOptions } from "./config-B5pq6hEz.js";
+import { c as resolveCodexAppServerRuntimeOptions } from "./config-B5rU0vP3.js";
 import { n as isRpcResponse } from "./protocol-C9UWI98H.js";
 import { createInterface } from "node:readline";
 import { OPENCLAW_VERSION, embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";

package/dist/{client-factory-9L6Ie1dC.js → client-factory-By1f68U_.js}

@@ -1,5 +1,5 @@
 //#region extensions/codex/src/app-server/client-factory.ts
-const defaultCodexAppServerClientFactory = (startOptions, authProfileId, agentDir, config) => import("./shared-client-DlvmoLBJ.js").then((n) => n.a).then(({ getSharedCodexAppServerClient }) => getSharedCodexAppServerClient({
+const defaultCodexAppServerClientFactory = (startOptions, authProfileId, agentDir, config) => import("./shared-client-DWgKldR5.js").then((n) => n.a).then(({ getSharedCodexAppServerClient }) => getSharedCodexAppServerClient({
 	startOptions,
 	authProfileId,
 	agentDir,

package/dist/{command-formatters-BRW7_Nu7.js → command-formatters-BpPOTePl.js}

@@ -448,7 +448,8 @@ function buildHelp() {
 		"- /codex computer-use [status|install]",
 		"- /codex account",
 		"- /codex mcp",
-		"- /codex skills"
+		"- /codex skills",
+		"- /codex plugins [list|enable|disable]"
 	].join("\n");
 }
 function summarizeAccount(value) {

package/dist/{command-handlers-DcoFMn4e.js → command-handlers-CFFYwpt4.js}

@@ -1,11 +1,11 @@
-import { a as isCodexFastServiceTier, c as resolveCodexAppServerRuntimeOptions } from "./config-B5pq6hEz.js";
-import { n as listCodexAppServerModels, t as listAllCodexAppServerModels } from "./models-C1zn2RN0.js";
+import { a as isCodexFastServiceTier, c as resolveCodexAppServerRuntimeOptions } from "./config-B5rU0vP3.js";
+import { n as listCodexAppServerModels, t as listAllCodexAppServerModels } from "./models-6ViLQ-HQ.js";
 import { t as isJsonObject } from "./protocol-C9UWI98H.js";
-import { i as describeControlFailure, r as CODEX_CONTROL_METHODS, t as requestCodexAppServerJson } from "./request-XPjLayGw.js";
-import { a as formatComputerUseStatus, c as formatThreads, i as formatCodexStatus, l as readString$1, n as formatAccount, o as formatList, p as summarizeCodexAccountUsage, r as formatCodexDisplayText, s as formatModels, t as buildHelp } from "./command-formatters-BRW7_Nu7.js";
-import { i as readCodexAppServerBinding, o as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-DqApZIgD.js";
-import { _ as steerCodexConversationTurn, b as readCodexConversationBindingData, d as parseCodexFastModeArg, f as parseCodexPermissionsModeArg, g as setCodexConversationPermissions, h as setCodexConversationModel, l as startCodexConversationThread, m as setCodexConversationFastMode, p as readCodexConversationActiveTurn, r as formatCodexCliSessions, u as formatPermissionsMode, v as stopCodexConversationTurn, x as resolveCodexDefaultWorkspaceDir, y as createCodexCliNodeConversationBindingData } from "./node-cli-sessions-C9rlYMPw.js";
-import { n as installCodexComputerUse, r as readCodexComputerUseStatus } from "./computer-use-UJ3dxrXF.js";
+import { i as describeControlFailure, r as CODEX_CONTROL_METHODS, t as requestCodexAppServerJson } from "./request-BLCZjckr.js";
+import { a as formatComputerUseStatus, c as formatThreads, i as formatCodexStatus, l as readString$1, n as formatAccount, o as formatList, p as summarizeCodexAccountUsage, r as formatCodexDisplayText, s as formatModels, t as buildHelp } from "./command-formatters-BpPOTePl.js";
+import { i as readCodexAppServerBinding, o as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-D9ejASYj.js";
+import { _ as steerCodexConversationTurn, b as readCodexConversationBindingData, d as parseCodexFastModeArg, f as parseCodexPermissionsModeArg, g as setCodexConversationPermissions, h as setCodexConversationModel, l as startCodexConversationThread, m as setCodexConversationFastMode, p as readCodexConversationActiveTurn, r as formatCodexCliSessions, u as formatPermissionsMode, v as stopCodexConversationTurn, x as resolveCodexDefaultWorkspaceDir, y as createCodexCliNodeConversationBindingData } from "./node-cli-sessions-douLgfcf.js";
+import { n as installCodexComputerUse, r as readCodexComputerUseStatus } from "./computer-use-BD8UmXB-.js";
 import { n as rememberCodexRateLimits } from "./rate-limit-cache-dvhq-4pi.js";
 import crypto from "node:crypto";
 import { ensureAuthProfileStore, findNormalizedProviderValue, resolveAgentDir, resolveAuthProfileEligibility, resolveAuthProfileOrder, resolveDefaultAgentDir, resolveProfileUnusableUntilForDisplay, resolveSessionAgentIds } from "openclaw/plugin-sdk/agent-runtime";
@@ -289,6 +289,73 @@ function dedupe(values) {
 	return result;
 }
 //#endregion
+//#region extensions/codex/src/command-plugins-management.ts
+const POLICY_REFRESH_HINT = "New Codex conversations pick this up automatically. Use /new or /reset to refresh the current one.";
+async function handleCodexPluginsSubcommand(ctx, rest, io) {
+	const [verb = "list", ...args] = rest;
+	const normalized = verb.toLowerCase();
+	if (normalized === "list") {
+		if (args.length > 0) return { text: "Usage: /codex plugins list" };
+		const current = await io.readConfig();
+		return { text: formatPluginList(current.plugins ?? {}, { globalEnabled: current.enabled === true }) };
+	}
+	const target = args[0];
+	if (normalized === "enable" || normalized === "disable") {
+		if (!target || args.length > 1) return { text: `Usage: /codex plugins ${normalized} <name>` };
+		if (!canMutateCodexPlugins(ctx)) return { text: `Only an owner or operator.admin gateway client can run /codex plugins ${normalized}.` };
+		const wantEnabled = normalized === "enable";
+		if (!((await io.readConfig()).plugins ?? {})[target]) return { text: `Codex sub-plugin '${formatCodexDisplayText(target)}' is not configured. Run '/codex plugins list' to see configured plugins.` };
+		await io.mutate((block) => {
+			if (wantEnabled) block.enabled = true;
+			block.plugins ??= {};
+			block.plugins[target] = {
+				...block.plugins[target],
+				enabled: wantEnabled
+			};
+		});
+		return { text: `${formatCodexDisplayText(target)}: ${wantEnabled ? "enabled" : "disabled"} in openclaw.json. ${POLICY_REFRESH_HINT}` };
+	}
+	return { text: `Unknown /codex plugins subcommand: ${formatCodexDisplayText(verb)}\n\n${buildPluginsHelp()}` };
+}
+function canMutateCodexPlugins(ctx) {
+	if (ctx.senderIsOwner === true) return true;
+	return ctx.gatewayClientScopes?.includes("operator.admin") === true;
+}
+function buildPluginsHelp() {
+	return [
+		"Codex sub-plugin management (writes only to ~/.openclaw/openclaw.json, never to ~/.codex/config.toml):",
+		"- /codex plugins                  (alias for list)",
+		"- /codex plugins list             show all configured Codex sub-plugins",
+		"- /codex plugins enable <name>    enable a configured sub-plugin",
+		"- /codex plugins disable <name>   disable a configured sub-plugin"
+	].join("\n");
+}
+function formatPluginList(plugins, options = {}) {
+	const globalEnabled = options.globalEnabled === true;
+	const keys = Object.keys(plugins).toSorted();
+	if (keys.length === 0) return "No Codex sub-plugins configured under plugins.entries.codex.config.codexPlugins.plugins";
+	const rows = keys.map((key) => {
+		const entry = plugins[key] ?? {};
+		const state = globalEnabled && entry.enabled !== false ? "ON " : "OFF";
+		return {
+			displayKey: formatCodexDisplayText(key),
+			state,
+			pluginName: formatCodexDisplayText(entry.pluginName ?? key),
+			marketplace: formatCodexDisplayText(entry.marketplaceName ?? "?")
+		};
+	});
+	const keyW = Math.max(...rows.map((r) => r.displayKey.length));
+	const pluginW = Math.max(...rows.map((r) => r.pluginName.length));
+	return [
+		"Codex sub-plugins in Openclaw config (~/.openclaw/openclaw.json):",
+		"",
+		...rows.map((r) => `  ${r.state}  ${r.displayKey.padEnd(keyW)}  ${r.pluginName.padEnd(pluginW)}  [${r.marketplace}]`),
+		"",
+		...globalEnabled ? [] : ["Global codexPlugins.enabled is off; configured sub-plugins are inactive.", ""],
+		"New Codex conversations pick up policy changes automatically; /new or /reset to refresh the current one."
+	].join("\n");
+}
+//#endregion
 //#region extensions/codex/src/command-rpc.ts
 function requestOptions(pluginConfig, limit, config) {
 	const runtime = resolveCodexAppServerRuntimeOptions({ pluginConfig });
@@ -398,6 +465,10 @@ async function handleCodexSubcommand(ctx, options) {
 	const [subcommand = "status", ...rest] = splitArgs(ctx.args);
 	const normalized = subcommand.toLowerCase();
 	if (normalized === "help") return { text: buildHelp() };
+	if (normalized === "plugins") {
+		if (!deps.codexPluginsManagementIo) return { text: "Codex sub-plugin management is not wired up (codexPluginsManagementIo dep is undefined). Edit ~/.openclaw/openclaw.json or use `openclaw config patch` until the runtime exposes the IO." };
+		return await handleCodexPluginsSubcommand(ctx, rest, deps.codexPluginsManagementIo);
+	}
 	if (normalized === "status") {
 		if (rest.length > 0) return { text: "Usage: /codex status" };
 		return { text: formatCodexStatus(await deps.readCodexStatusProbes(options.pluginConfig, ctx.config)) };

package/dist/{compact-UKyG6Pw2.js → compact-BPnB6ZWJ.js}

@@ -1,8 +1,8 @@
-import { c as resolveCodexAppServerRuntimeOptions } from "./config-B5pq6hEz.js";
+import { c as resolveCodexAppServerRuntimeOptions } from "./config-B5rU0vP3.js";
 import { t as isJsonObject } from "./protocol-C9UWI98H.js";
-import { i as readCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-DqApZIgD.js";
-import { t as defaultCodexAppServerClientFactory } from "./client-factory-9L6Ie1dC.js";
-import { embeddedAgentLog, formatErrorMessage, isActiveHarnessContextEngine, resolveContextEngineOwnerPluginId, runHarnessContextEngineMaintenance } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { i as readCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-D9ejASYj.js";
+import { t as defaultCodexAppServerClientFactory } from "./client-factory-By1f68U_.js";
+import { compactContextEngineWithSafetyTimeout, embeddedAgentLog, formatErrorMessage, isActiveHarnessContextEngine, resolveCompactionTimeoutMs, resolveContextEngineOwnerPluginId, runHarnessContextEngineMaintenance } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/compact.ts
 const DEFAULT_CODEX_COMPACTION_WAIT_TIMEOUT_MS = 300 * 1e3;
 const warnedIgnoredCompactionOverrides = /* @__PURE__ */ new Set();
@@ -43,7 +43,7 @@ async function compactOwningContextEngine(params, contextEngine) {
 	});
 	let result;
 	try {
-		result = await contextEngine.compact({
+		result = await compactContextEngineWithSafetyTimeout(contextEngine, {
 			sessionId: params.sessionId,
 			sessionKey: params.sessionKey,
 			sessionFile: params.sessionFile,
@@ -53,7 +53,7 @@ async function compactOwningContextEngine(params, contextEngine) {
 			customInstructions: params.customInstructions,
 			force: params.trigger === "manual",
 			runtimeContext: params.contextEngineRuntimeContext
-		});
+		}, resolveCompactionTimeoutMs(params.config), params.abortSignal);
 	} catch (error) {
 		embeddedAgentLog.warn("context-engine-owned Codex app-server compaction failed", {
 			sessionId: params.sessionId,

package/dist/{computer-use-UJ3dxrXF.js → computer-use-BD8UmXB-.js}

@@ -1,5 +1,5 @@
-import { c as resolveCodexAppServerRuntimeOptions, l as resolveCodexComputerUseConfig } from "./config-B5pq6hEz.js";
-import { i as describeControlFailure, t as requestCodexAppServerJson } from "./request-XPjLayGw.js";
+import { c as resolveCodexAppServerRuntimeOptions, l as resolveCodexComputerUseConfig } from "./config-B5rU0vP3.js";
+import { i as describeControlFailure, t as requestCodexAppServerJson } from "./request-BLCZjckr.js";
 import { existsSync } from "node:fs";
 //#region extensions/codex/src/app-server/computer-use.ts
 var CodexComputerUseSetupError = class extends Error {

package/dist/{config-B5pq6hEz.js → config-B5rU0vP3.js}

@@ -69,6 +69,7 @@ const codexPluginConfigSchema = z.object({
 		authToken: z.string().optional(),
 		headers: z.record(z.string(), z.string()).optional(),
 		clearEnv: z.array(z.string()).optional(),
+		codeModeOnly: z.boolean().optional(),
 		requestTimeoutMs: z.number().positive().optional(),
 		turnCompletionIdleTimeoutMs: z.number().positive().optional(),
 		approvalPolicy: codexAppServerApprovalPolicySchema.optional(),
@@ -151,6 +152,7 @@ function resolveCodexAppServerRuntimeOptions(params = {}) {
 			headers,
 			...transport === "stdio" && clearEnv.length > 0 ? { clearEnv } : {}
 		},
+		codeModeOnly: config.codeModeOnly === true,
 		requestTimeoutMs: normalizePositiveNumber(config.requestTimeoutMs, 6e4),
 		turnCompletionIdleTimeoutMs: normalizePositiveNumber(config.turnCompletionIdleTimeoutMs, 6e4),
 		approvalPolicy: resolveApprovalPolicy(config.approvalPolicy) ?? resolveApprovalPolicy(env.OPENCLAW_CODEX_APP_SERVER_APPROVAL_POLICY) ?? defaultPolicy?.approvalPolicy ?? (policyMode === "guardian" ? "on-request" : "never"),

package/dist/harness.js

@@ -18,31 +18,31 @@ function createCodexAppServerAgentHarness(options) {
 			};
 		},
 		runAttempt: async (params) => {
-			const { runCodexAppServerAttempt } = await import("./run-attempt-DyLQRA61.js");
+			const { runCodexAppServerAttempt } = await import("./run-attempt-nWX3d1pe.js");
 			return runCodexAppServerAttempt(params, {
-				pluginConfig: options?.pluginConfig,
+				pluginConfig: options?.resolvePluginConfig?.() ?? options?.pluginConfig,
 				nativeHookRelay: { enabled: true }
 			});
 		},
 		runSideQuestion: async (params) => {
-			const { runCodexAppServerSideQuestion } = await import("./side-question-CfRPUq5X.js");
+			const { runCodexAppServerSideQuestion } = await import("./side-question-CpJYlXni.js");
 			return runCodexAppServerSideQuestion(params, {
-				pluginConfig: options?.pluginConfig,
+				pluginConfig: options?.resolvePluginConfig?.() ?? options?.pluginConfig,
 				nativeHookRelay: { enabled: true }
 			});
 		},
 		compact: async (params) => {
-			const { maybeCompactCodexAppServerSession } = await import("./compact-UKyG6Pw2.js");
-			return maybeCompactCodexAppServerSession(params, { pluginConfig: options?.pluginConfig });
+			const { maybeCompactCodexAppServerSession } = await import("./compact-BPnB6ZWJ.js");
+			return maybeCompactCodexAppServerSession(params, { pluginConfig: options?.resolvePluginConfig?.() ?? options?.pluginConfig });
 		},
 		reset: async (params) => {
 			if (params.sessionFile) {
-				const { clearCodexAppServerBinding } = await import("./session-binding-DqApZIgD.js").then((n) => n.a);
+				const { clearCodexAppServerBinding } = await import("./session-binding-D9ejASYj.js").then((n) => n.a);
 				await clearCodexAppServerBinding(params.sessionFile);
 			}
 		},
 		dispose: async () => {
-			const { clearSharedCodexAppServerClientAndWait } = await import("./shared-client-DlvmoLBJ.js").then((n) => n.a);
+			const { clearSharedCodexAppServerClientAndWait } = await import("./shared-client-DWgKldR5.js").then((n) => n.a);
 			await clearSharedCodexAppServerClientAndWait();
 		}
 	};

package/dist/index.js

@@ -1,12 +1,13 @@
 import { createCodexAppServerAgentHarness } from "./harness.js";
-import { c as resolveCodexAppServerRuntimeOptions, s as readCodexPluginConfig, t as CODEX_PLUGINS_MARKETPLACE_NAME } from "./config-B5pq6hEz.js";
+import { c as resolveCodexAppServerRuntimeOptions, s as readCodexPluginConfig, t as CODEX_PLUGINS_MARKETPLACE_NAME } from "./config-B5rU0vP3.js";
 import { buildCodexMediaUnderstandingProvider } from "./media-understanding-provider.js";
 import { buildCodexProvider } from "./provider.js";
-import { i as describeControlFailure, n as buildCodexPluginAppCacheKey, t as requestCodexAppServerJson } from "./request-XPjLayGw.js";
-import { r as formatCodexDisplayText } from "./command-formatters-BRW7_Nu7.js";
-import { c as resolveCodexAppServerAuthAccountCacheKey, d as resolveCodexAppServerEnvApiKeyCacheKey, i as getSharedCodexAppServerClient, n as clearSharedCodexAppServerClientIfCurrentAndWait, u as resolveCodexAppServerAuthProfileIdForAgent } from "./shared-client-DlvmoLBJ.js";
-import { a as resolveCodexCliSessionForBindingOnNode, c as handleCodexConversationInboundClaim, i as listCodexCliSessionsOnNode, n as createCodexCliSessionNodeInvokePolicies, o as resumeCodexCliSessionOnNode, s as handleCodexConversationBindingResolved, t as createCodexCliSessionNodeHostCommands } from "./node-cli-sessions-C9rlYMPw.js";
-import { a as defaultCodexAppInventoryCache, n as pluginReadParams, t as ensureCodexPluginActivation } from "./plugin-activation-B49xb7pI.js";
+import { i as describeControlFailure, n as buildCodexPluginAppCacheKey, t as requestCodexAppServerJson } from "./request-BLCZjckr.js";
+import { r as formatCodexDisplayText } from "./command-formatters-BpPOTePl.js";
+import { c as resolveCodexAppServerAuthAccountCacheKey, d as resolveCodexAppServerEnvApiKeyCacheKey, i as getSharedCodexAppServerClient, n as clearSharedCodexAppServerClientIfCurrentAndWait, u as resolveCodexAppServerAuthProfileIdForAgent } from "./shared-client-DWgKldR5.js";
+import { a as resolveCodexCliSessionForBindingOnNode, c as handleCodexConversationInboundClaim, i as listCodexCliSessionsOnNode, n as createCodexCliSessionNodeInvokePolicies, o as resumeCodexCliSessionOnNode, s as handleCodexConversationBindingResolved, t as createCodexCliSessionNodeHostCommands } from "./node-cli-sessions-douLgfcf.js";
+import { a as defaultCodexAppInventoryCache, n as pluginReadParams, t as ensureCodexPluginActivation } from "./plugin-activation-Dtcfb3sk.js";
+import { mutateConfigFile } from "openclaw/plugin-sdk/config-mutation";
 import { resolveLivePluginConfigObject } from "openclaw/plugin-sdk/plugin-config-runtime";
 import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
 import os from "node:os";
@@ -23,7 +24,13 @@ function createCodexCommand(options) {
 		name: "codex",
 		description: "Inspect and control the Codex app-server harness",
 		ownership: "reserved",
-		agentPromptGuidance: ["Native Codex app-server plugin is available (`/codex ...`). For Codex bind/control/thread/resume/steer/stop requests, prefer `/codex bind`, `/codex threads`, `/codex resume`, `/codex steer`, and `/codex stop` over ACP.", "Use ACP for Codex only when the user explicitly asks for ACP/acpx or wants to test the ACP path."],
+		agentPromptGuidance: [{
+			text: "Native Codex app-server plugin is available (`/codex ...`). For Codex bind/control/thread/resume/steer/stop requests, prefer `/codex bind`, `/codex threads`, `/codex resume`, `/codex steer`, and `/codex stop` over ACP.",
+			surfaces: ["pi_main"]
+		}, {
+			text: "Use ACP for Codex only when the user explicitly asks for ACP/acpx or wants to test the ACP path.",
+			surfaces: ["pi_main"]
+		}],
 		acceptsArgs: true,
 		requireAuth: true,
 		handler: (ctx) => handleCodexCommand(ctx, options)
@@ -38,7 +45,7 @@ async function handleCodexCommand(ctx, options = {}) {
 	}
 }
 async function loadDefaultCodexSubcommandHandler() {
-	const { handleCodexSubcommand } = await import("./command-handlers-DcoFMn4e.js");
+	const { handleCodexSubcommand } = await import("./command-handlers-CFFYwpt4.js");
 	return handleCodexSubcommand;
 }
 //#endregion
@@ -1094,7 +1101,7 @@ var codex_default = definePluginEntry({
 	description: "Codex app-server harness and Codex-managed GPT model catalog.",
 	register(api) {
 		const resolveCurrentPluginConfig = () => resolveLivePluginConfigObject(api.runtime.config?.current ? () => api.runtime.config.current() : void 0, "codex", api.pluginConfig) ?? api.pluginConfig;
-		api.registerAgentHarness(createCodexAppServerAgentHarness({ pluginConfig: api.pluginConfig }));
+		api.registerAgentHarness(createCodexAppServerAgentHarness({ resolvePluginConfig: resolveCurrentPluginConfig }));
 		api.registerProvider(buildCodexProvider({ pluginConfig: api.pluginConfig }));
 		api.registerMediaUnderstandingProvider(buildCodexMediaUnderstandingProvider({ pluginConfig: api.pluginConfig }));
 		api.registerMigrationProvider(buildCodexMigrationProvider({ runtime: api.runtime }));
@@ -1110,7 +1117,44 @@ var codex_default = definePluginEntry({
 				resolveCodexCliSessionForBindingOnNode: (params) => resolveCodexCliSessionForBindingOnNode({
 					runtime: api.runtime,
 					...params
-				})
+				}),
+				codexPluginsManagementIo: {
+					readConfig: () => {
+						const plugins = (api.runtime.config?.current?.() ?? {}).plugins;
+						if (!plugins || typeof plugins !== "object") return Promise.resolve({});
+						const entries = plugins.entries;
+						if (!entries || typeof entries !== "object") return Promise.resolve({});
+						const codexEntry = entries.codex;
+						if (!codexEntry || typeof codexEntry !== "object") return Promise.resolve({});
+						const config = codexEntry.config;
+						if (!config || typeof config !== "object") return Promise.resolve({});
+						const codexPlugins = config.codexPlugins;
+						if (!codexPlugins || typeof codexPlugins !== "object") return Promise.resolve({});
+						const declared = codexPlugins.plugins;
+						if (!declared || typeof declared !== "object") return Promise.resolve({ enabled: codexPlugins.enabled === true });
+						return Promise.resolve({
+							enabled: codexPlugins.enabled === true,
+							plugins: declared
+						});
+					},
+					mutate: async (update) => {
+						await mutateConfigFile({ mutate: (draft) => {
+							const root = draft;
+							root.plugins = root.plugins ?? {};
+							const pluginsBlock = root.plugins;
+							pluginsBlock.entries = pluginsBlock.entries ?? {};
+							const entries = pluginsBlock.entries;
+							entries.codex = entries.codex ?? {};
+							const codexEntry = entries.codex;
+							codexEntry.config = codexEntry.config ?? {};
+							const config = codexEntry.config;
+							config.codexPlugins = config.codexPlugins ?? {};
+							const codexPlugins = config.codexPlugins;
+							codexPlugins.plugins = codexPlugins.plugins ?? {};
+							update(codexPlugins);
+						} });
+					}
+				}
 			}
 		}));
 		api.on("inbound_claim", (event, ctx) => handleCodexConversationInboundClaim(event, ctx, {

package/dist/media-understanding-provider.js

@@ -1,7 +1,7 @@
 import { CODEX_PROVIDER_ID, FALLBACK_CODEX_MODELS } from "./provider-catalog.js";
-import { c as resolveCodexAppServerRuntimeOptions } from "./config-B5pq6hEz.js";
+import { c as resolveCodexAppServerRuntimeOptions } from "./config-B5rU0vP3.js";
 import { i as assertCodexTurnStartResponse, l as readCodexTurnCompletedNotification, o as readCodexErrorNotification, r as assertCodexThreadStartResponse } from "./protocol-validators-BGBspNmF.js";
-import { i as readModelListResult } from "./models-C1zn2RN0.js";
+import { i as readModelListResult } from "./models-6ViLQ-HQ.js";
 import { t as isJsonObject } from "./protocol-C9UWI98H.js";
 import { validateJsonSchemaValue } from "openclaw/plugin-sdk/json-schema-runtime";
 //#region extensions/codex/media-understanding-provider.ts
@@ -62,7 +62,7 @@ async function runBoundedCodexVisionTurn(params) {
 	const appServer = resolveCodexAppServerRuntimeOptions({ pluginConfig: params.options.pluginConfig });
 	const timeoutMs = Math.max(100, params.timeoutMs);
 	const ownsClient = !params.options.clientFactory;
-	const client = params.options.clientFactory ? await params.options.clientFactory(appServer.start, params.profile) : await import("./shared-client-DlvmoLBJ.js").then((n) => n.a).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
+	const client = params.options.clientFactory ? await params.options.clientFactory(appServer.start, params.profile) : await import("./shared-client-DWgKldR5.js").then((n) => n.a).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
 		startOptions: appServer.start,
 		timeoutMs,
 		authProfileId: params.profile

package/dist/{models-C1zn2RN0.js → models-6ViLQ-HQ.js}

@@ -39,7 +39,7 @@ async function listAllCodexAppServerModels(options = {}) {
 async function withCodexAppServerModelClient(options, run) {
 	const timeoutMs = options.timeoutMs ?? 2500;
 	const useSharedClient = options.sharedClient !== false;
-	const { createIsolatedCodexAppServerClient, getSharedCodexAppServerClient } = await import("./shared-client-DlvmoLBJ.js").then((n) => n.a);
+	const { createIsolatedCodexAppServerClient, getSharedCodexAppServerClient } = await import("./shared-client-DWgKldR5.js").then((n) => n.a);
 	const client = useSharedClient ? await getSharedCodexAppServerClient({
 		startOptions: options.startOptions,
 		timeoutMs,

package/dist/{node-cli-sessions-C9rlYMPw.js → node-cli-sessions-douLgfcf.js}

@@ -1,9 +1,9 @@
-import { a as isCodexFastServiceTier, c as resolveCodexAppServerRuntimeOptions, r as codexSandboxPolicyForTurn } from "./config-B5pq6hEz.js";
+import { a as isCodexFastServiceTier, c as resolveCodexAppServerRuntimeOptions, r as codexSandboxPolicyForTurn } from "./config-B5rU0vP3.js";
 import { t as isJsonObject } from "./protocol-C9UWI98H.js";
-import { r as CODEX_CONTROL_METHODS } from "./request-XPjLayGw.js";
-import { r as formatCodexDisplayText } from "./command-formatters-BRW7_Nu7.js";
-import { i as getSharedCodexAppServerClient, u as resolveCodexAppServerAuthProfileIdForAgent } from "./shared-client-DlvmoLBJ.js";
-import { i as readCodexAppServerBinding, n as isCodexAppServerNativeAuthProfile, o as writeCodexAppServerBinding, r as normalizeCodexAppServerBindingModelProvider, t as clearCodexAppServerBinding } from "./session-binding-DqApZIgD.js";
+import { r as CODEX_CONTROL_METHODS } from "./request-BLCZjckr.js";
+import { r as formatCodexDisplayText } from "./command-formatters-BpPOTePl.js";
+import { i as getSharedCodexAppServerClient, u as resolveCodexAppServerAuthProfileIdForAgent } from "./shared-client-DWgKldR5.js";
+import { i as readCodexAppServerBinding, n as isCodexAppServerNativeAuthProfile, o as writeCodexAppServerBinding, r as normalizeCodexAppServerBindingModelProvider, t as clearCodexAppServerBinding } from "./session-binding-D9ejASYj.js";
 import os from "node:os";
 import { formatErrorMessage } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { spawn } from "node:child_process";

package/dist/{plugin-activation-B49xb7pI.js → plugin-activation-Dtcfb3sk.js}

@@ -1,6 +1,8 @@
-import { t as CODEX_PLUGINS_MARKETPLACE_NAME, u as resolveCodexPluginsPolicy } from "./config-B5pq6hEz.js";
+import { t as CODEX_PLUGINS_MARKETPLACE_NAME, u as resolveCodexPluginsPolicy } from "./config-B5rU0vP3.js";
+import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
 import "node:fs/promises";
 import "node:path";
+const MAX_SERIALIZED_ERROR_MESSAGE_LENGTH = 500;
 var CodexAppInventoryCache = class {
 	constructor(options = {}) {
 		this.entries = /* @__PURE__ */ new Map();
@@ -14,7 +16,7 @@ var CodexAppInventoryCache = class {
 		const nowMs = params.nowMs ?? Date.now();
 		const entry = this.entries.get(params.key);
 		if (!entry) {
-			const refreshScheduled = this.scheduleRefresh(params);
+			const refreshScheduled = params.suppressRefresh ? false : this.scheduleRefresh(params);
 			return {
 				state: "missing",
 				key: params.key,
@@ -103,16 +105,31 @@ var CodexAppInventoryCache = class {
 			return snapshot;
 		} catch (error) {
 			const diagnostic = {
-				message: error instanceof Error ? error.message : String(error),
+				message: sanitizeErrorMessage(error instanceof Error ? error.message : String(error)),
 				atMs: nowMs
 			};
 			this.diagnostics.set(params.key, diagnostic);
 			const entry = this.entries.get(params.key);
 			if (entry) entry.lastError = diagnostic;
+			embeddedAgentLog.warn("codex app inventory refresh failed", {
+				forceRefetch: params.forceRefetch === true,
+				keyFingerprint: fingerprintInventoryCacheKey(params.key),
+				error: serializeCodexAppInventoryError(error)
+			});
 			throw error;
 		}
 	}
 };
+function serializeCodexAppInventoryError(error) {
+	const record = isRecord(error) ? error : void 0;
+	const data = record && "data" in record ? redactErrorData(record.data) : void 0;
+	return {
+		name: error instanceof Error ? error.name : typeof record?.name === "string" ? record.name : void 0,
+		message: sanitizeErrorMessage(error instanceof Error ? error.message : String(error)),
+		...typeof record?.code === "number" ? { code: record.code } : {},
+		...data !== void 0 ? { data } : {}
+	};
+}
 const defaultCodexAppInventoryCache = new CodexAppInventoryCache();
 function buildCodexAppInventoryCacheKey(input) {
 	return JSON.stringify({
@@ -142,6 +159,39 @@ function stripEntryState(entry) {
 	const { invalidated: _invalidated, ...snapshot } = entry;
 	return snapshot;
 }
+function fingerprintInventoryCacheKey(key) {
+	let hash = 0;
+	for (let index = 0; index < key.length; index += 1) hash = hash * 31 + key.charCodeAt(index) >>> 0;
+	return hash.toString(16).padStart(8, "0");
+}
+function isRecord(value) {
+	return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+function redactErrorData(value, depth = 0) {
+	if (value === void 0) return;
+	if (value === null || typeof value === "boolean" || typeof value === "number") return value;
+	if (depth > 6) return "[truncated]";
+	if (Array.isArray(value)) return value.map((entry) => redactErrorData(entry, depth + 1) ?? null);
+	if (isRecord(value)) {
+		const redacted = {};
+		for (const [key, entry] of Object.entries(value)) redacted[key] = isSensitiveErrorDataKey(key) ? "<redacted>" : redactErrorData(entry, depth + 1) ?? null;
+		return redacted;
+	}
+	if (typeof value === "string" && value.length > 500) return `${value.slice(0, 500)}...`;
+	if (typeof value === "string") return value;
+	if (typeof value === "bigint") return value.toString();
+	if (typeof value === "symbol") return value.description ? `Symbol(${value.description})` : "Symbol()";
+	if (typeof value === "function") return value.name ? `[function ${value.name}]` : "[function]";
+	return "[unserializable]";
+}
+function sanitizeErrorMessage(message) {
+	const htmlStart = message.search(/<html[\s>]/i);
+	const redacted = (htmlStart >= 0 ? `${message.slice(0, htmlStart).trimEnd()} [HTML response body omitted]` : message).replace(/([?&][^=\s"'<>]*(?:api[_-]?key|authorization|cookie|credential|password|secret|token|tk)[^=\s"'<>]*=)[^&\s"'<>]+/gi, "$1<redacted>");
+	return redacted.length > MAX_SERIALIZED_ERROR_MESSAGE_LENGTH ? `${redacted.slice(0, MAX_SERIALIZED_ERROR_MESSAGE_LENGTH)}...` : redacted;
+}
+function isSensitiveErrorDataKey(key) {
+	return /api[_-]?key|authorization|cookie|credential|password|secret|token/i.test(key);
+}
 //#endregion
 //#region extensions/codex/src/app-server/plugin-inventory.ts
 async function readCodexPluginInventory(params) {
@@ -206,6 +256,7 @@ async function readCodexPluginInventory(params) {
 			message: `${pluginPolicy.pluginName} is installed in Codex but disabled.`
 		});
 		const apps = resolveOwnedApps({
+			pluginPolicy,
 			detail,
 			appInventory
 		});
@@ -250,7 +301,8 @@ function readCachedAppInventory(params) {
 	return params.appCache.read({
 		key: params.appCacheKey,
 		request,
-		nowMs: params.nowMs
+		nowMs: params.nowMs,
+		suppressRefresh: params.suppressAppInventoryRefresh
 	});
 }
 async function readPluginDetail(params, marketplace, pluginPolicy, diagnostics) {
@@ -273,7 +325,14 @@ function resolveAppOwnership(params) {
 function resolveOwnedApps(params) {
 	const detailApps = params.detail?.apps ?? [];
 	if (detailApps.length === 0) return [];
-	if (params.appInventory?.state === "missing") return [];
+	if (params.appInventory?.state === "missing") {
+		embeddedAgentLog.warn("codex plugin inventory missing app inventory for detail apps", {
+			configKey: params.pluginPolicy.configKey,
+			pluginName: params.pluginPolicy.pluginName,
+			appIds: detailApps.map((app) => app.id).toSorted()
+		});
+		return [];
+	}
 	const appInfoById = new Map((params.appInventory?.snapshot?.apps ?? []).map((app) => [app.id, app]));
 	return detailApps.map((app) => {
 		const info = appInfoById.get(app.id);
@@ -390,4 +449,4 @@ function activationFailure(identity, reason, diagnostic) {
 	};
 }
 //#endregion
-export { defaultCodexAppInventoryCache as a, buildCodexAppInventoryCacheKey as i, pluginReadParams as n, readCodexPluginInventory as r, ensureCodexPluginActivation as t };
+export { defaultCodexAppInventoryCache as a, buildCodexAppInventoryCacheKey as i, pluginReadParams as n, serializeCodexAppInventoryError as o, readCodexPluginInventory as r, ensureCodexPluginActivation as t };

package/dist/provider.js

@@ -1,5 +1,5 @@
 import { CODEX_APP_SERVER_AUTH_MARKER, CODEX_BASE_URL, CODEX_PROVIDER_ID, FALLBACK_CODEX_MODELS, buildCodexModelDefinition, buildCodexProviderConfig } from "./provider-catalog.js";
-import { c as resolveCodexAppServerRuntimeOptions, s as readCodexPluginConfig } from "./config-B5pq6hEz.js";
+import { c as resolveCodexAppServerRuntimeOptions, s as readCodexPluginConfig } from "./config-B5rU0vP3.js";
 import { resolveCodexSystemPromptContribution } from "./prompt-overlay.js";
 import { resolvePluginConfigObject } from "openclaw/plugin-sdk/plugin-config-runtime";
 import { createSubsystemLogger } from "openclaw/plugin-sdk/core";
@@ -123,7 +123,7 @@ async function listModelsBestEffort(params) {
 	}
 }
 async function listCodexAppServerModelsLazy(options) {
-	const { listCodexAppServerModels } = await import("./models-C1zn2RN0.js").then((n) => n.r);
+	const { listCodexAppServerModels } = await import("./models-6ViLQ-HQ.js").then((n) => n.r);
 	return listCodexAppServerModels(options);
 }
 function normalizeTimeoutMs(value) {

package/dist/{request-XPjLayGw.js → request-BLCZjckr.js}

@@ -1,6 +1,6 @@
-import { n as CodexAppServerRpcError } from "./client-6FkrXfaz.js";
-import { f as resolveCodexAppServerHomeDir, i as getSharedCodexAppServerClient, o as withTimeout, r as createIsolatedCodexAppServerClient } from "./shared-client-DlvmoLBJ.js";
-import { i as buildCodexAppInventoryCacheKey } from "./plugin-activation-B49xb7pI.js";
+import { n as CodexAppServerRpcError } from "./client-BCJaLwdZ.js";
+import { f as resolveCodexAppServerHomeDir, i as getSharedCodexAppServerClient, o as withTimeout, r as createIsolatedCodexAppServerClient } from "./shared-client-DWgKldR5.js";
+import { i as buildCodexAppInventoryCacheKey } from "./plugin-activation-Dtcfb3sk.js";
 import { createHash } from "node:crypto";
 //#region extensions/codex/src/app-server/capabilities.ts
 const CODEX_CONTROL_METHODS = {