@openclaw/codex 2026.5.19 → 2026.5.20-beta.2

package/dist/{client-BCJaLwdZ.js → client-Ab4Fw77C.js}

@@ -1,5 +1,5 @@
-import { c as resolveCodexAppServerRuntimeOptions } from "./config-B5rU0vP3.js";
-import { n as isRpcResponse } from "./protocol-C9UWI98H.js";
+import { c as resolveCodexAppServerRuntimeOptions } from "./config-DqIp6oTk.js";
+import { n as isRpcResponse } from "./protocol-oeJQu4rs.js";
 import { createInterface } from "node:readline";
 import { OPENCLAW_VERSION, embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { spawn } from "node:child_process";

package/dist/{client-factory-By1f68U_.js → client-factory-BbesECdh.js}

@@ -1,5 +1,5 @@
 //#region extensions/codex/src/app-server/client-factory.ts
-const defaultCodexAppServerClientFactory = (startOptions, authProfileId, agentDir, config) => import("./shared-client-DWgKldR5.js").then((n) => n.a).then(({ getSharedCodexAppServerClient }) => getSharedCodexAppServerClient({
+const defaultCodexAppServerClientFactory = (startOptions, authProfileId, agentDir, config) => import("./shared-client-DCxJx5QU.js").then((n) => n.a).then(({ getSharedCodexAppServerClient }) => getSharedCodexAppServerClient({
 	startOptions,
 	authProfileId,
 	agentDir,

package/dist/{command-formatters-BpPOTePl.js → command-formatters-BVBnEgyA.js}

@@ -1,4 +1,4 @@
-import { t as isJsonObject } from "./protocol-C9UWI98H.js";
+import { t as isJsonObject } from "./protocol-oeJQu4rs.js";
 //#region extensions/codex/src/app-server/rate-limits.ts
 const CODEX_LIMIT_ID = "codex";
 const LIMIT_WINDOW_KEYS = ["primary", "secondary"];

package/dist/{command-handlers-CFFYwpt4.js → command-handlers-Gceg_rBZ.js}

@@ -1,12 +1,12 @@
-import { a as isCodexFastServiceTier, c as resolveCodexAppServerRuntimeOptions } from "./config-B5rU0vP3.js";
-import { n as listCodexAppServerModels, t as listAllCodexAppServerModels } from "./models-6ViLQ-HQ.js";
-import { t as isJsonObject } from "./protocol-C9UWI98H.js";
-import { i as describeControlFailure, r as CODEX_CONTROL_METHODS, t as requestCodexAppServerJson } from "./request-BLCZjckr.js";
-import { a as formatComputerUseStatus, c as formatThreads, i as formatCodexStatus, l as readString$1, n as formatAccount, o as formatList, p as summarizeCodexAccountUsage, r as formatCodexDisplayText, s as formatModels, t as buildHelp } from "./command-formatters-BpPOTePl.js";
-import { i as readCodexAppServerBinding, o as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-D9ejASYj.js";
-import { _ as steerCodexConversationTurn, b as readCodexConversationBindingData, d as parseCodexFastModeArg, f as parseCodexPermissionsModeArg, g as setCodexConversationPermissions, h as setCodexConversationModel, l as startCodexConversationThread, m as setCodexConversationFastMode, p as readCodexConversationActiveTurn, r as formatCodexCliSessions, u as formatPermissionsMode, v as stopCodexConversationTurn, x as resolveCodexDefaultWorkspaceDir, y as createCodexCliNodeConversationBindingData } from "./node-cli-sessions-douLgfcf.js";
-import { n as installCodexComputerUse, r as readCodexComputerUseStatus } from "./computer-use-BD8UmXB-.js";
-import { n as rememberCodexRateLimits } from "./rate-limit-cache-dvhq-4pi.js";
+import { a as isCodexFastServiceTier, c as resolveCodexAppServerRuntimeOptions } from "./config-DqIp6oTk.js";
+import { n as listCodexAppServerModels, t as listAllCodexAppServerModels } from "./models-C8MdOXGD.js";
+import { t as isJsonObject } from "./protocol-oeJQu4rs.js";
+import { i as describeControlFailure, r as CODEX_CONTROL_METHODS, t as requestCodexAppServerJson } from "./request-BePR77QD.js";
+import { a as formatComputerUseStatus, c as formatThreads, i as formatCodexStatus, l as readString$1, n as formatAccount, o as formatList, p as summarizeCodexAccountUsage, r as formatCodexDisplayText, s as formatModels, t as buildHelp } from "./command-formatters-BVBnEgyA.js";
+import { i as readCodexAppServerBinding, o as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-DEiYHgJ_.js";
+import { _ as steerCodexConversationTurn, b as readCodexConversationBindingData, d as parseCodexFastModeArg, f as parseCodexPermissionsModeArg, g as setCodexConversationPermissions, h as setCodexConversationModel, l as startCodexConversationThread, m as setCodexConversationFastMode, p as readCodexConversationActiveTurn, r as formatCodexCliSessions, u as formatPermissionsMode, v as stopCodexConversationTurn, x as resolveCodexDefaultWorkspaceDir, y as createCodexCliNodeConversationBindingData } from "./node-cli-sessions-T1olB1SH.js";
+import { n as installCodexComputerUse, r as readCodexComputerUseStatus } from "./computer-use-B4iTog6z.js";
+import { n as rememberCodexRateLimits } from "./rate-limit-cache-N66I-Rd7.js";
 import crypto from "node:crypto";
 import { ensureAuthProfileStore, findNormalizedProviderValue, resolveAgentDir, resolveAuthProfileEligibility, resolveAuthProfileOrder, resolveDefaultAgentDir, resolveProfileUnusableUntilForDisplay, resolveSessionAgentIds } from "openclaw/plugin-sdk/agent-runtime";
 //#region extensions/codex/src/command-account.ts
@@ -18,7 +18,7 @@ async function readCodexAccountAuthOverview(params) {
 		allowKeychainPrompt: false,
 		config
 	});
-	const order = resolveDisplayAuthOrder({
+	const { order, explicit: explicitOrder } = resolveDisplayAuthOrder({
 		config,
 		store
 	});
@@ -27,6 +27,7 @@ async function readCodexAccountAuthOverview(params) {
 	const activeProfileId = resolveActiveProfileId({
 		store,
 		order,
+		explicitOrder,
 		config,
 		account: params.account,
 		limits: params.limits,
@@ -71,12 +72,28 @@ async function readCodexAccountAuthOverview(params) {
 }
 function resolveDisplayAuthOrder(params) {
 	const codexOrder = resolveOrder(params.store.order, OPENAI_CODEX_PROVIDER_ID) ?? resolveOrder(params.config?.auth?.order, OPENAI_CODEX_PROVIDER_ID);
-	if (codexOrder && codexOrder.length > 0) return dedupe(codexOrder);
-	return resolveAuthProfileOrder({
-		cfg: params.config,
-		store: params.store,
-		provider: OPENAI_CODEX_PROVIDER_ID
-	});
+	if (codexOrder && codexOrder.length > 0) return {
+		order: dedupe(codexOrder),
+		explicit: true
+	};
+	return {
+		order: resolveAuthProfileOrder({
+			cfg: params.config,
+			store: params.store,
+			provider: OPENAI_CODEX_PROVIDER_ID
+		}),
+		explicit: hasExplicitOpenAiAuthOrder(params)
+	};
+}
+function hasExplicitOpenAiAuthOrder(params) {
+	const sources = [params.store.order, params.config?.auth?.order];
+	for (const source of sources) {
+		const codex = resolveOrder(source, OPENAI_CODEX_PROVIDER_ID);
+		if (codex && codex.length > 0) return true;
+		const openai = resolveOrder(source, OPENAI_PROVIDER_ID);
+		if (openai && openai.length > 0) return true;
+	}
+	return false;
 }
 function resolveOrder(order, provider) {
 	return findNormalizedProviderValue(order, provider);
@@ -88,6 +105,13 @@ function resolveActiveProfileId(params) {
 		order: params.order
 	});
 	if (liveProfileId) return liveProfileId;
+	if (params.explicitOrder) return params.order.find((profileId) => isActiveProfileCandidate(params, profileId) && resolveAuthProfileEligibility({
+		cfg: params.config,
+		store: params.store,
+		provider: OPENAI_CODEX_PROVIDER_ID,
+		profileId,
+		now: params.now
+	}).eligible);
 	const lastGood = [params.store.lastGood?.[OPENAI_PROVIDER_ID], params.store.lastGood?.[OPENAI_CODEX_PROVIDER_ID]].find((profileId) => !!profileId && params.order.includes(profileId) && isActiveProfileCandidate(params, profileId));
 	if (lastGood) return lastGood;
 	const mostRecent = params.order.map((profileId) => ({

package/dist/{compact-BPnB6ZWJ.js → compact-BaSDurdH.js}

@@ -1,7 +1,7 @@
-import { c as resolveCodexAppServerRuntimeOptions } from "./config-B5rU0vP3.js";
-import { t as isJsonObject } from "./protocol-C9UWI98H.js";
-import { i as readCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-D9ejASYj.js";
-import { t as defaultCodexAppServerClientFactory } from "./client-factory-By1f68U_.js";
+import { c as resolveCodexAppServerRuntimeOptions } from "./config-DqIp6oTk.js";
+import { t as isJsonObject } from "./protocol-oeJQu4rs.js";
+import { i as readCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-DEiYHgJ_.js";
+import { t as defaultCodexAppServerClientFactory } from "./client-factory-BbesECdh.js";
 import { compactContextEngineWithSafetyTimeout, embeddedAgentLog, formatErrorMessage, isActiveHarnessContextEngine, resolveCompactionTimeoutMs, resolveContextEngineOwnerPluginId, runHarnessContextEngineMaintenance } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/compact.ts
 const DEFAULT_CODEX_COMPACTION_WAIT_TIMEOUT_MS = 300 * 1e3;

package/dist/{computer-use-BD8UmXB-.js → computer-use-B4iTog6z.js}

@@ -1,5 +1,5 @@
-import { c as resolveCodexAppServerRuntimeOptions, l as resolveCodexComputerUseConfig } from "./config-B5rU0vP3.js";
-import { i as describeControlFailure, t as requestCodexAppServerJson } from "./request-BLCZjckr.js";
+import { c as resolveCodexAppServerRuntimeOptions, l as resolveCodexComputerUseConfig } from "./config-DqIp6oTk.js";
+import { i as describeControlFailure, t as requestCodexAppServerJson } from "./request-BePR77QD.js";
 import { existsSync } from "node:fs";
 //#region extensions/codex/src/app-server/computer-use.ts
 var CodexComputerUseSetupError = class extends Error {

package/dist/harness.js

@@ -18,31 +18,31 @@ function createCodexAppServerAgentHarness(options) {
 			};
 		},
 		runAttempt: async (params) => {
-			const { runCodexAppServerAttempt } = await import("./run-attempt-BqRPAaHk.js");
+			const { runCodexAppServerAttempt } = await import("./run-attempt-CRHVB240.js");
 			return runCodexAppServerAttempt(params, {
 				pluginConfig: options?.resolvePluginConfig?.() ?? options?.pluginConfig,
 				nativeHookRelay: { enabled: true }
 			});
 		},
 		runSideQuestion: async (params) => {
-			const { runCodexAppServerSideQuestion } = await import("./side-question-DjyRnjPQ.js");
+			const { runCodexAppServerSideQuestion } = await import("./side-question-DlJAUYst.js");
 			return runCodexAppServerSideQuestion(params, {
 				pluginConfig: options?.resolvePluginConfig?.() ?? options?.pluginConfig,
 				nativeHookRelay: { enabled: true }
 			});
 		},
 		compact: async (params) => {
-			const { maybeCompactCodexAppServerSession } = await import("./compact-BPnB6ZWJ.js");
+			const { maybeCompactCodexAppServerSession } = await import("./compact-BaSDurdH.js");
 			return maybeCompactCodexAppServerSession(params, { pluginConfig: options?.resolvePluginConfig?.() ?? options?.pluginConfig });
 		},
 		reset: async (params) => {
 			if (params.sessionFile) {
-				const { clearCodexAppServerBinding } = await import("./session-binding-D9ejASYj.js").then((n) => n.a);
+				const { clearCodexAppServerBinding } = await import("./session-binding-DEiYHgJ_.js").then((n) => n.a);
 				await clearCodexAppServerBinding(params.sessionFile);
 			}
 		},
 		dispose: async () => {
-			const { clearSharedCodexAppServerClientAndWait } = await import("./shared-client-DWgKldR5.js").then((n) => n.a);
+			const { clearSharedCodexAppServerClientAndWait } = await import("./shared-client-DCxJx5QU.js").then((n) => n.a);
 			await clearSharedCodexAppServerClientAndWait();
 		}
 	};

package/dist/index.js

@@ -1,12 +1,12 @@
 import { createCodexAppServerAgentHarness } from "./harness.js";
-import { c as resolveCodexAppServerRuntimeOptions, s as readCodexPluginConfig, t as CODEX_PLUGINS_MARKETPLACE_NAME } from "./config-B5rU0vP3.js";
+import { c as resolveCodexAppServerRuntimeOptions, s as readCodexPluginConfig, t as CODEX_PLUGINS_MARKETPLACE_NAME } from "./config-DqIp6oTk.js";
 import { buildCodexMediaUnderstandingProvider } from "./media-understanding-provider.js";
 import { buildCodexProvider } from "./provider.js";
-import { i as describeControlFailure, n as buildCodexPluginAppCacheKey, t as requestCodexAppServerJson } from "./request-BLCZjckr.js";
-import { r as formatCodexDisplayText } from "./command-formatters-BpPOTePl.js";
-import { c as resolveCodexAppServerAuthAccountCacheKey, d as resolveCodexAppServerEnvApiKeyCacheKey, i as getSharedCodexAppServerClient, n as clearSharedCodexAppServerClientIfCurrentAndWait, u as resolveCodexAppServerAuthProfileIdForAgent } from "./shared-client-DWgKldR5.js";
-import { a as resolveCodexCliSessionForBindingOnNode, c as handleCodexConversationInboundClaim, i as listCodexCliSessionsOnNode, n as createCodexCliSessionNodeInvokePolicies, o as resumeCodexCliSessionOnNode, s as handleCodexConversationBindingResolved, t as createCodexCliSessionNodeHostCommands } from "./node-cli-sessions-douLgfcf.js";
-import { a as defaultCodexAppInventoryCache, n as pluginReadParams, t as ensureCodexPluginActivation } from "./plugin-activation-Dtcfb3sk.js";
+import { i as describeControlFailure, n as buildCodexPluginAppCacheKey, t as requestCodexAppServerJson } from "./request-BePR77QD.js";
+import { r as formatCodexDisplayText } from "./command-formatters-BVBnEgyA.js";
+import { c as resolveCodexAppServerAuthAccountCacheKey, d as resolveCodexAppServerEnvApiKeyCacheKey, i as getSharedCodexAppServerClient, n as clearSharedCodexAppServerClientIfCurrentAndWait, u as resolveCodexAppServerAuthProfileIdForAgent } from "./shared-client-DCxJx5QU.js";
+import { a as resolveCodexCliSessionForBindingOnNode, c as handleCodexConversationInboundClaim, i as listCodexCliSessionsOnNode, n as createCodexCliSessionNodeInvokePolicies, o as resumeCodexCliSessionOnNode, s as handleCodexConversationBindingResolved, t as createCodexCliSessionNodeHostCommands } from "./node-cli-sessions-T1olB1SH.js";
+import { a as defaultCodexAppInventoryCache, n as pluginReadParams, t as ensureCodexPluginActivation } from "./plugin-activation-BkQkPLOY.js";
 import { mutateConfigFile } from "openclaw/plugin-sdk/config-mutation";
 import { resolveLivePluginConfigObject } from "openclaw/plugin-sdk/plugin-config-runtime";
 import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
@@ -45,7 +45,7 @@ async function handleCodexCommand(ctx, options = {}) {
 	}
 }
 async function loadDefaultCodexSubcommandHandler() {
-	const { handleCodexSubcommand } = await import("./command-handlers-CFFYwpt4.js");
+	const { handleCodexSubcommand } = await import("./command-handlers-Gceg_rBZ.js");
 	return handleCodexSubcommand;
 }
 //#endregion

package/dist/media-understanding-provider.js

@@ -1,8 +1,8 @@
 import { CODEX_PROVIDER_ID, FALLBACK_CODEX_MODELS } from "./provider-catalog.js";
-import { c as resolveCodexAppServerRuntimeOptions } from "./config-B5rU0vP3.js";
-import { i as assertCodexTurnStartResponse, l as readCodexTurnCompletedNotification, o as readCodexErrorNotification, r as assertCodexThreadStartResponse } from "./protocol-validators-BGBspNmF.js";
-import { i as readModelListResult } from "./models-6ViLQ-HQ.js";
-import { t as isJsonObject } from "./protocol-C9UWI98H.js";
+import { c as resolveCodexAppServerRuntimeOptions } from "./config-DqIp6oTk.js";
+import { i as assertCodexTurnStartResponse, l as readCodexTurnCompletedNotification, o as readCodexErrorNotification, r as assertCodexThreadStartResponse } from "./protocol-validators-_gKDcd0x.js";
+import { i as readModelListResult } from "./models-C8MdOXGD.js";
+import { t as isJsonObject } from "./protocol-oeJQu4rs.js";
 import { validateJsonSchemaValue } from "openclaw/plugin-sdk/json-schema-runtime";
 //#region extensions/codex/media-understanding-provider.ts
 const DEFAULT_CODEX_IMAGE_MODEL = FALLBACK_CODEX_MODELS.find((model) => model.inputModalities.includes("image"))?.id ?? FALLBACK_CODEX_MODELS[0]?.id;
@@ -62,7 +62,7 @@ async function runBoundedCodexVisionTurn(params) {
 	const appServer = resolveCodexAppServerRuntimeOptions({ pluginConfig: params.options.pluginConfig });
 	const timeoutMs = Math.max(100, params.timeoutMs);
 	const ownsClient = !params.options.clientFactory;
-	const client = params.options.clientFactory ? await params.options.clientFactory(appServer.start, params.profile) : await import("./shared-client-DWgKldR5.js").then((n) => n.a).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
+	const client = params.options.clientFactory ? await params.options.clientFactory(appServer.start, params.profile) : await import("./shared-client-DCxJx5QU.js").then((n) => n.a).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
 		startOptions: appServer.start,
 		timeoutMs,
 		authProfileId: params.profile

package/dist/{models-6ViLQ-HQ.js → models-C8MdOXGD.js}

@@ -1,5 +1,5 @@
-import { t as __exportAll } from "./rolldown-runtime-DUslC3ob.js";
-import { s as readCodexModelListResponse } from "./protocol-validators-BGBspNmF.js";
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { s as readCodexModelListResponse } from "./protocol-validators-_gKDcd0x.js";
 //#region extensions/codex/src/app-server/models.ts
 var models_exports = /* @__PURE__ */ __exportAll({
 	listAllCodexAppServerModels: () => listAllCodexAppServerModels,
@@ -39,7 +39,7 @@ async function listAllCodexAppServerModels(options = {}) {
 async function withCodexAppServerModelClient(options, run) {
 	const timeoutMs = options.timeoutMs ?? 2500;
 	const useSharedClient = options.sharedClient !== false;
-	const { createIsolatedCodexAppServerClient, getSharedCodexAppServerClient } = await import("./shared-client-DWgKldR5.js").then((n) => n.a);
+	const { createIsolatedCodexAppServerClient, getSharedCodexAppServerClient } = await import("./shared-client-DCxJx5QU.js").then((n) => n.a);
 	const client = useSharedClient ? await getSharedCodexAppServerClient({
 		startOptions: options.startOptions,
 		timeoutMs,

package/dist/{node-cli-sessions-douLgfcf.js → node-cli-sessions-T1olB1SH.js}

@@ -1,9 +1,9 @@
-import { a as isCodexFastServiceTier, c as resolveCodexAppServerRuntimeOptions, r as codexSandboxPolicyForTurn } from "./config-B5rU0vP3.js";
-import { t as isJsonObject } from "./protocol-C9UWI98H.js";
-import { r as CODEX_CONTROL_METHODS } from "./request-BLCZjckr.js";
-import { r as formatCodexDisplayText } from "./command-formatters-BpPOTePl.js";
-import { i as getSharedCodexAppServerClient, u as resolveCodexAppServerAuthProfileIdForAgent } from "./shared-client-DWgKldR5.js";
-import { i as readCodexAppServerBinding, n as isCodexAppServerNativeAuthProfile, o as writeCodexAppServerBinding, r as normalizeCodexAppServerBindingModelProvider, t as clearCodexAppServerBinding } from "./session-binding-D9ejASYj.js";
+import { a as isCodexFastServiceTier, c as resolveCodexAppServerRuntimeOptions, r as codexSandboxPolicyForTurn } from "./config-DqIp6oTk.js";
+import { t as isJsonObject } from "./protocol-oeJQu4rs.js";
+import { r as CODEX_CONTROL_METHODS } from "./request-BePR77QD.js";
+import { r as formatCodexDisplayText } from "./command-formatters-BVBnEgyA.js";
+import { i as getSharedCodexAppServerClient, u as resolveCodexAppServerAuthProfileIdForAgent } from "./shared-client-DCxJx5QU.js";
+import { i as readCodexAppServerBinding, n as isCodexAppServerNativeAuthProfile, o as writeCodexAppServerBinding, r as normalizeCodexAppServerBindingModelProvider, t as clearCodexAppServerBinding } from "./session-binding-DEiYHgJ_.js";
 import os from "node:os";
 import { formatErrorMessage } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { spawn } from "node:child_process";

package/dist/{plugin-activation-Dtcfb3sk.js → plugin-activation-BkQkPLOY.js}

@@ -1,4 +1,4 @@
-import { t as CODEX_PLUGINS_MARKETPLACE_NAME, u as resolveCodexPluginsPolicy } from "./config-B5rU0vP3.js";
+import { t as CODEX_PLUGINS_MARKETPLACE_NAME, u as resolveCodexPluginsPolicy } from "./config-DqIp6oTk.js";
 import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
 import "node:fs/promises";
 import "node:path";

package/dist/provider.js

@@ -1,5 +1,5 @@
 import { CODEX_APP_SERVER_AUTH_MARKER, CODEX_BASE_URL, CODEX_PROVIDER_ID, FALLBACK_CODEX_MODELS, buildCodexModelDefinition, buildCodexProviderConfig } from "./provider-catalog.js";
-import { c as resolveCodexAppServerRuntimeOptions, s as readCodexPluginConfig } from "./config-B5rU0vP3.js";
+import { c as resolveCodexAppServerRuntimeOptions, s as readCodexPluginConfig } from "./config-DqIp6oTk.js";
 import { resolveCodexSystemPromptContribution } from "./prompt-overlay.js";
 import { resolvePluginConfigObject } from "openclaw/plugin-sdk/plugin-config-runtime";
 import { createSubsystemLogger } from "openclaw/plugin-sdk/core";
@@ -123,7 +123,7 @@ async function listModelsBestEffort(params) {
 	}
 }
 async function listCodexAppServerModelsLazy(options) {
-	const { listCodexAppServerModels } = await import("./models-6ViLQ-HQ.js").then((n) => n.r);
+	const { listCodexAppServerModels } = await import("./models-C8MdOXGD.js").then((n) => n.r);
 	return listCodexAppServerModels(options);
 }
 function normalizeTimeoutMs(value) {

package/dist/{request-BLCZjckr.js → request-BePR77QD.js}

@@ -1,6 +1,6 @@
-import { n as CodexAppServerRpcError } from "./client-BCJaLwdZ.js";
-import { f as resolveCodexAppServerHomeDir, i as getSharedCodexAppServerClient, o as withTimeout, r as createIsolatedCodexAppServerClient } from "./shared-client-DWgKldR5.js";
-import { i as buildCodexAppInventoryCacheKey } from "./plugin-activation-Dtcfb3sk.js";
+import { n as CodexAppServerRpcError } from "./client-Ab4Fw77C.js";
+import { f as resolveCodexAppServerHomeDir, i as getSharedCodexAppServerClient, o as withTimeout, r as createIsolatedCodexAppServerClient } from "./shared-client-DCxJx5QU.js";
+import { i as buildCodexAppInventoryCacheKey } from "./plugin-activation-BkQkPLOY.js";
 import { createHash } from "node:crypto";
 //#region extensions/codex/src/app-server/capabilities.ts
 const CODEX_CONTROL_METHODS = {

package/dist/{run-attempt-BqRPAaHk.js → run-attempt-CRHVB240.js}

@@ -1,17 +1,17 @@
-import { c as resolveCodexAppServerRuntimeOptions, d as withMcpElicitationsApprovalPolicy, i as isCodexAppServerApprovalPolicyAllowedByRequirements, s as readCodexPluginConfig, u as resolveCodexPluginsPolicy } from "./config-B5rU0vP3.js";
-import { a as readCodexDynamicToolCallParams, c as readCodexTurn, i as assertCodexTurnStartResponse } from "./protocol-validators-BGBspNmF.js";
-import { t as isJsonObject } from "./protocol-C9UWI98H.js";
-import { i as isCodexAppServerConnectionClosedError, r as isCodexAppServerApprovalRequest } from "./client-BCJaLwdZ.js";
-import { n as buildCodexPluginAppCacheKey, r as CODEX_CONTROL_METHODS } from "./request-BLCZjckr.js";
-import { d as resolveCodexUsageLimitResetAtMs, f as shouldRefreshCodexRateLimitsForUsageLimitMessage, r as formatCodexDisplayText, u as formatCodexUsageLimitErrorMessage } from "./command-formatters-BpPOTePl.js";
-import { c as resolveCodexAppServerAuthAccountCacheKey, d as resolveCodexAppServerEnvApiKeyCacheKey, f as resolveCodexAppServerHomeDir, l as resolveCodexAppServerAuthProfileId, s as refreshCodexAppServerAuthTokens, t as clearSharedCodexAppServerClientIfCurrent, u as resolveCodexAppServerAuthProfileIdForAgent } from "./shared-client-DWgKldR5.js";
-import { i as readCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-D9ejASYj.js";
-import { a as defaultCodexAppInventoryCache } from "./plugin-activation-Dtcfb3sk.js";
-import { C as isForcedPrivateQaCodexRuntime, S as filterCodexDynamicTools, T as resolveCodexDynamicToolsLoading, _ as projectContextEngineAssemblyForCodex, b as createCodexDynamicToolBridge, c as codexDynamicToolsFingerprint, f as startOrResumeThread, g as shouldBuildCodexPluginThreadConfig, h as mergeCodexThreadConfigs, i as buildDeveloperInstructions, l as isContextEngineBindingCompatible, m as buildCodexPluginThreadConfigInputFingerprint, p as buildCodexPluginThreadConfig, r as buildContextEngineBinding, s as buildTurnStartParams, t as areCodexDynamicToolFingerprintsCompatible, v as resolveCodexContextEngineProjectionMaxChars, w as normalizeCodexDynamicToolName, x as sanitizeCodexHistoryImagePayloads, y as resolveCodexContextEngineProjectionReserveTokens } from "./thread-lifecycle-C07GnPSH.js";
-import { t as defaultCodexAppServerClientFactory } from "./client-factory-By1f68U_.js";
-import { a as handleCodexAppServerElicitationRequest, c as emitDynamicToolTerminalDiagnostic, i as buildCodexNativeHookRelayDisabledConfig, l as handleCodexAppServerApprovalRequest, n as CODEX_NATIVE_HOOK_RELAY_EVENTS, o as emitDynamicToolErrorDiagnostic, r as buildCodexNativeHookRelayConfig, s as emitDynamicToolStartedDiagnostic, t as filterToolsForVisionInputs } from "./vision-tools-CDoJ4rDN.js";
-import { t as ensureCodexComputerUse } from "./computer-use-BD8UmXB-.js";
-import { n as rememberCodexRateLimits, t as readRecentCodexRateLimits } from "./rate-limit-cache-dvhq-4pi.js";
+import { c as resolveCodexAppServerRuntimeOptions, d as withMcpElicitationsApprovalPolicy, i as isCodexAppServerApprovalPolicyAllowedByRequirements, l as resolveCodexComputerUseConfig, s as readCodexPluginConfig, u as resolveCodexPluginsPolicy } from "./config-DqIp6oTk.js";
+import { a as readCodexDynamicToolCallParams, c as readCodexTurn, i as assertCodexTurnStartResponse } from "./protocol-validators-_gKDcd0x.js";
+import { t as isJsonObject } from "./protocol-oeJQu4rs.js";
+import { i as isCodexAppServerConnectionClosedError, r as isCodexAppServerApprovalRequest } from "./client-Ab4Fw77C.js";
+import { n as buildCodexPluginAppCacheKey, r as CODEX_CONTROL_METHODS } from "./request-BePR77QD.js";
+import { d as resolveCodexUsageLimitResetAtMs, f as shouldRefreshCodexRateLimitsForUsageLimitMessage, r as formatCodexDisplayText, u as formatCodexUsageLimitErrorMessage } from "./command-formatters-BVBnEgyA.js";
+import { c as resolveCodexAppServerAuthAccountCacheKey, d as resolveCodexAppServerEnvApiKeyCacheKey, f as resolveCodexAppServerHomeDir, l as resolveCodexAppServerAuthProfileId, s as refreshCodexAppServerAuthTokens, t as clearSharedCodexAppServerClientIfCurrent, u as resolveCodexAppServerAuthProfileIdForAgent } from "./shared-client-DCxJx5QU.js";
+import { i as readCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-DEiYHgJ_.js";
+import { a as defaultCodexAppInventoryCache } from "./plugin-activation-BkQkPLOY.js";
+import { C as isForcedPrivateQaCodexRuntime, S as filterCodexDynamicTools, T as resolveCodexDynamicToolsLoading, _ as projectContextEngineAssemblyForCodex, b as createCodexDynamicToolBridge, c as codexDynamicToolsFingerprint, f as startOrResumeThread, g as shouldBuildCodexPluginThreadConfig, h as mergeCodexThreadConfigs, i as buildDeveloperInstructions, l as isContextEngineBindingCompatible, m as buildCodexPluginThreadConfigInputFingerprint, p as buildCodexPluginThreadConfig, r as buildContextEngineBinding, s as buildTurnStartParams, t as areCodexDynamicToolFingerprintsCompatible, v as resolveCodexContextEngineProjectionMaxChars, w as normalizeCodexDynamicToolName, x as sanitizeCodexHistoryImagePayloads, y as resolveCodexContextEngineProjectionReserveTokens } from "./thread-lifecycle-Cgi62SSl.js";
+import { t as defaultCodexAppServerClientFactory } from "./client-factory-BbesECdh.js";
+import { a as handleCodexAppServerElicitationRequest, c as emitDynamicToolTerminalDiagnostic, i as buildCodexNativeHookRelayDisabledConfig, l as handleCodexAppServerApprovalRequest, n as CODEX_NATIVE_HOOK_RELAY_EVENTS, o as emitDynamicToolErrorDiagnostic, r as buildCodexNativeHookRelayConfig, s as emitDynamicToolStartedDiagnostic, t as filterToolsForVisionInputs } from "./vision-tools-B2wt6ecs.js";
+import { t as ensureCodexComputerUse } from "./computer-use-B4iTog6z.js";
+import { n as rememberCodexRateLimits, t as readRecentCodexRateLimits } from "./rate-limit-cache-N66I-Rd7.js";
 import { createHash } from "node:crypto";
 import nodeFs from "node:fs";
 import { TOOL_PROGRESS_OUTPUT_MAX_CHARS, acquireSessionWriteLock, appendSessionTranscriptMessage, assembleHarnessContextEngine, bootstrapHarnessContextEngine, buildAgentHookContextChannelFields, buildEmbeddedAttemptToolRunContext, buildHarnessContextEngineRuntimeContext, buildHarnessContextEngineRuntimeContextFromUsage, classifyAgentHarnessTerminalOutcome, clearActiveEmbeddedRun, compactContextEngineWithSafetyTimeout, embeddedAgentLog, emitAgentEvent, emitSessionTranscriptUpdate, finalizeHarnessContextEngineTurn, formatErrorMessage, formatToolAggregate, formatToolProgressOutput, hasBeforeToolCallPolicy, hasSandboxBindContainerPathAliases, hasSandboxBindReadonlyHostShadows, inferToolMetaFromArgs, isActiveHarnessContextEngine, isSubagentSessionKey, loadCodexBundleMcpThreadConfig, normalizeAgentRuntimeTools, normalizeUsage, registerNativeHookRelay, resolveAgentHarnessBeforePromptBuildResult, resolveAttemptSpawnWorkspaceDir, resolveBootstrapContextForRun, resolveCompactionTimeoutMs, resolveContextEngineOwnerPluginId, resolveModelAuthMode, resolveSandboxContext, resolveSessionAgentIds, resolveSessionWriteLockOptions, resolveUserPath, resolveWritableSandboxBindHostRoots, runAgentCleanupStep, runAgentHarnessAfterCompactionHook, runAgentHarnessAfterToolCallHook, runAgentHarnessAgentEndHook, runAgentHarnessBeforeCompactionHook, runAgentHarnessBeforeMessageWriteHook, runAgentHarnessLlmInputHook, runAgentHarnessLlmOutputHook, runHarnessContextEngineMaintenance, setActiveEmbeddedRun, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";
@@ -1407,7 +1407,8 @@ var CodexAppServerEventProjector = class {
 		this.emitToolResultMessage({
 			itemId,
 			text: formatToolOutput(toolName, itemMeta(item, this.toolProgressDetailMode()), output),
-			finalOutput: true
+			finalOutput: true,
+			isError: isNonSuccessItemStatus(itemStatus(item))
 		});
 	}
 	emitToolResultMessage(params) {
@@ -1416,7 +1417,10 @@ var CodexAppServerEventProjector = class {
 		this.toolProgressTexts.add(text);
 		if (params.finalOutput) this.toolResultOutputItemIds.add(params.itemId);
 		try {
-			Promise.resolve(this.params.onToolResult?.({ text })).catch(() => {});
+			Promise.resolve(this.params.onToolResult?.({
+				text,
+				...params.isError === true ? { isError: true } : {}
+			})).catch(() => {});
 		} catch {}
 	}
 	shouldEmitToolResult() {
@@ -1499,7 +1503,8 @@ var CodexAppServerEventProjector = class {
 		this.emitToolResultMessage({
 			itemId: params.id,
 			text: formatToolOutput(params.name, void 0, text),
-			finalOutput: true
+			finalOutput: true,
+			isError: params.isError
 		});
 	}
 	formatCodexErrorMessage(params) {
@@ -2394,7 +2399,6 @@ const CODEX_BOOTSTRAP_CONTEXT_ORDER = new Map([
 	["memory.md", 60],
 	["heartbeat.md", 70]
 ]);
-let openClawCodingToolsFactoryForTests;
 function emitCodexAppServerEvent(params, event) {
 	try {
 		emitAgentEvent({
@@ -2741,6 +2745,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 	const attemptStartedAt = Date.now();
 	const attemptClientFactory = options.clientFactory ?? defaultCodexAppServerClientFactory;
 	const pluginConfig = readCodexPluginConfig(options.pluginConfig);
+	const computerUseConfig = resolveCodexComputerUseConfig({ pluginConfig });
 	const configuredAppServer = resolveCodexAppServerRuntimeOptions({ pluginConfig });
 	const resolvedWorkspace = resolveUserPath(params.workspaceDir);
 	await fs.mkdir(resolvedWorkspace, { recursive: true });
@@ -3073,6 +3078,8 @@ async function runCodexAppServerAttempt(params, options = {}) {
 			appCacheKey: pluginAppCacheKey
 		}) : void 0;
 		const resolvedPluginPolicy = pluginThreadConfigRequired ? resolveCodexPluginsPolicy(pluginThreadConfigPluginConfig) : void 0;
+		const computerUseMcpElicitationDelegationRequired = computerUseConfig.enabled;
+		const mcpElicitationDelegationRequired = resolvedPluginPolicy?.enabled === true || computerUseMcpElicitationDelegationRequired;
 		const enabledPluginConfigKeys = resolvedPluginPolicy ? resolvedPluginPolicy.pluginPolicies.filter((plugin) => plugin.enabled).map((plugin) => plugin.configKey).toSorted() : void 0;
 		embeddedAgentLog.info("codex plugin thread config eligibility", buildCodexPluginThreadConfigEligibilityLogData({
 			sessionId: params.sessionId,
@@ -3084,7 +3091,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 			startupAuthProfileId,
 			appServer
 		}));
-		pluginAppServer = resolvedPluginPolicy?.enabled === true ? {
+		pluginAppServer = mcpElicitationDelegationRequired ? {
 			...appServer,
 			approvalPolicy: withMcpElicitationsApprovalPolicy(appServer.approvalPolicy)
 		} : appServer;
@@ -3099,7 +3106,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 					startupClientForCleanup = startupClient;
 					await ensureCodexComputerUse({
 						client: startupClient,
-						pluginConfig: options.pluginConfig,
+						pluginConfig,
 						timeoutMs: appServer.requestTimeoutMs,
 						signal: runAbortController.signal
 					});
@@ -3651,6 +3658,7 @@ async function runCodexAppServerAttempt(params, options = {}) {
 					threadId: thread.threadId,
 					turnId,
 					pluginAppPolicyContext: thread.pluginAppPolicyContext,
+					...computerUseConfig.enabled ? { computerUseMcpServerName: computerUseConfig.mcpServerName } : {},
 					signal: runAbortController.signal
 				});
 			}
@@ -4579,7 +4587,7 @@ async function buildDynamicTools(input) {
 	if (params.disableTools || !supportsModelTools(params.model)) return [];
 	const modelHasVision = params.model.input?.includes("image") ?? false;
 	const agentDir = params.agentDir ?? resolveAgentDir$1(params.config ?? {}, input.sessionAgentId);
-	const createOpenClawCodingTools = openClawCodingToolsFactoryForTests ?? (await import("openclaw/plugin-sdk/agent-harness")).createOpenClawCodingTools;
+	const createOpenClawCodingTools = (await import("openclaw/plugin-sdk/agent-harness")).createOpenClawCodingTools;
 	const sessionKeys = resolveOpenClawCodingToolsSessionKeys(params, input.sandboxSessionKey);
 	const allTools = createOpenClawCodingTools({
 		agentId: input.sessionAgentId,
@@ -4601,7 +4609,6 @@ async function buildDynamicTools(input) {
 		senderName: params.senderName,
 		senderUsername: params.senderUsername,
 		senderE164: params.senderE164,
-		senderIsOwner: params.senderIsOwner,
 		allowGatewaySubagentBinding: params.allowGatewaySubagentBinding || isForcedPrivateQaCodexRuntime(),
 		...sessionKeys,
 		sessionId: params.sessionId,
@@ -5230,10 +5237,12 @@ function buildCodexBootstrapInjectionStats(params) {
 	const injectedIndex = indexCodexContextFileContent(params.injectedFiles);
 	const developerInstructionIndex = indexCodexContextFileContent(params.developerInstructionFiles ?? []);
 	return params.bootstrapFiles.map((file) => {
-		const pathValue = readNonEmptyString(file.path) ?? file.name;
-		const baseName = getCodexContextFileBasename(pathValue || file.name);
+		const fileName = readNonEmptyString(file.name);
+		const pathValue = readNonEmptyString(file.path) ?? fileName ?? "";
+		const displayName = (fileName ?? getCodexContextFileDisplayBasename(pathValue)) || pathValue;
+		const baseName = getCodexContextFileBasename(pathValue || fileName || "");
 		const rawChars = file.missing ? 0 : (file.content ?? "").trimEnd().length;
-		const injected = readCodexIndexedContextFileContent(injectedIndex, pathValue, file.name) ?? readCodexIndexedContextFileContent(developerInstructionIndex, pathValue, file.name);
+		const injected = readCodexIndexedContextFileContent(injectedIndex, pathValue, fileName) ?? readCodexIndexedContextFileContent(developerInstructionIndex, pathValue, fileName);
 		let injectedChars = injected?.length ?? 0;
 		let truncated = !file.missing && injectedChars < rawChars;
 		if (injected === void 0) {
@@ -5246,7 +5255,7 @@ function buildCodexBootstrapInjectionStats(params) {
 			}
 		}
 		return {
-			name: file.name,
+			name: displayName,
 			path: pathValue,
 			missing: file.missing,
 			rawChars,
@@ -5271,7 +5280,14 @@ function indexCodexContextFileContent(files) {
 	};
 }
 function readCodexIndexedContextFileContent(index, pathValue, fileName) {
-	return index.byPath.get(pathValue) ?? index.byPath.get(fileName) ?? index.byBaseName.get(getCodexContextFileBasename(fileName));
+	const pathContent = index.byPath.get(pathValue);
+	if (pathContent !== void 0) return pathContent;
+	if (fileName) {
+		const nameContent = index.byPath.get(fileName);
+		if (nameContent !== void 0) return nameContent;
+	}
+	const baseName = getCodexContextFileBasename(fileName ?? pathValue);
+	return baseName ? index.byBaseName.get(baseName) : void 0;
 }
 function readPositiveNumber(value) {
 	return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.floor(value) : void 0;
@@ -5388,6 +5404,9 @@ function compareCodexContextFiles(left, right) {
 function normalizeCodexContextFilePath(filePath) {
 	return filePath.trim().replaceAll("\\", "/").toLowerCase();
 }
+function getCodexContextFileDisplayBasename(filePath) {
+	return filePath.trim().replaceAll("\\", "/").split("/").pop()?.trim() ?? "";
+}
 function getCodexContextFileBasename(filePath) {
 	return normalizeCodexContextFilePath(filePath).split("/").pop() ?? "";
 }

package/dist/{session-binding-D9ejASYj.js → session-binding-DEiYHgJ_.js}

@@ -1,5 +1,5 @@
-import { t as __exportAll } from "./rolldown-runtime-DUslC3ob.js";
-import { o as normalizeCodexServiceTier } from "./config-B5rU0vP3.js";
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { o as normalizeCodexServiceTier } from "./config-DqIp6oTk.js";
 import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
 import fs from "node:fs/promises";
 import { ensureAuthProfileStore, resolveDefaultAgentDir, resolveProviderIdForAuth } from "openclaw/plugin-sdk/agent-runtime";

package/dist/{shared-client-DWgKldR5.js → shared-client-DCxJx5QU.js}

@@ -1,6 +1,6 @@
-import { t as __exportAll } from "./rolldown-runtime-DUslC3ob.js";
-import { c as resolveCodexAppServerRuntimeOptions, n as codexAppServerStartOptionsKey } from "./config-B5rU0vP3.js";
-import { a as MANAGED_CODEX_APP_SERVER_PACKAGE, o as resolveCodexAppServerSpawnEnv, t as CodexAppServerClient } from "./client-BCJaLwdZ.js";
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { c as resolveCodexAppServerRuntimeOptions, n as codexAppServerStartOptionsKey } from "./config-DqIp6oTk.js";
+import { a as MANAGED_CODEX_APP_SERVER_PACKAGE, o as resolveCodexAppServerSpawnEnv, t as CodexAppServerClient } from "./client-Ab4Fw77C.js";
 import { createRequire } from "node:module";
 import { createHash } from "node:crypto";
 import { constants, readFileSync } from "node:fs";

package/dist/{side-question-DjyRnjPQ.js → side-question-DlJAUYst.js}

@@ -1,13 +1,13 @@
-import { c as resolveCodexAppServerRuntimeOptions, s as readCodexPluginConfig } from "./config-B5rU0vP3.js";
-import { a as readCodexDynamicToolCallParams, i as assertCodexTurnStartResponse, l as readCodexTurnCompletedNotification, t as assertCodexThreadForkResponse } from "./protocol-validators-BGBspNmF.js";
-import { t as isJsonObject } from "./protocol-C9UWI98H.js";
-import { r as isCodexAppServerApprovalRequest } from "./client-BCJaLwdZ.js";
-import { u as formatCodexUsageLimitErrorMessage } from "./command-formatters-BpPOTePl.js";
-import { i as getSharedCodexAppServerClient, s as refreshCodexAppServerAuthTokens } from "./shared-client-DWgKldR5.js";
-import { i as readCodexAppServerBinding } from "./session-binding-D9ejASYj.js";
-import { S as filterCodexDynamicTools, T as resolveCodexDynamicToolsLoading, b as createCodexDynamicToolBridge, d as resolveReasoningEffort, h as mergeCodexThreadConfigs, n as buildCodexRuntimeThreadConfig, u as resolveCodexAppServerModelProvider } from "./thread-lifecycle-C07GnPSH.js";
-import { a as handleCodexAppServerElicitationRequest, c as emitDynamicToolTerminalDiagnostic, i as buildCodexNativeHookRelayDisabledConfig, l as handleCodexAppServerApprovalRequest, n as CODEX_NATIVE_HOOK_RELAY_EVENTS, o as emitDynamicToolErrorDiagnostic, r as buildCodexNativeHookRelayConfig, s as emitDynamicToolStartedDiagnostic, t as filterToolsForVisionInputs } from "./vision-tools-CDoJ4rDN.js";
-import { n as rememberCodexRateLimits, t as readRecentCodexRateLimits } from "./rate-limit-cache-dvhq-4pi.js";
+import { c as resolveCodexAppServerRuntimeOptions, s as readCodexPluginConfig } from "./config-DqIp6oTk.js";
+import { a as readCodexDynamicToolCallParams, i as assertCodexTurnStartResponse, l as readCodexTurnCompletedNotification, t as assertCodexThreadForkResponse } from "./protocol-validators-_gKDcd0x.js";
+import { t as isJsonObject } from "./protocol-oeJQu4rs.js";
+import { r as isCodexAppServerApprovalRequest } from "./client-Ab4Fw77C.js";
+import { u as formatCodexUsageLimitErrorMessage } from "./command-formatters-BVBnEgyA.js";
+import { i as getSharedCodexAppServerClient, s as refreshCodexAppServerAuthTokens } from "./shared-client-DCxJx5QU.js";
+import { i as readCodexAppServerBinding } from "./session-binding-DEiYHgJ_.js";
+import { S as filterCodexDynamicTools, T as resolveCodexDynamicToolsLoading, b as createCodexDynamicToolBridge, d as resolveReasoningEffort, h as mergeCodexThreadConfigs, n as buildCodexRuntimeThreadConfig, u as resolveCodexAppServerModelProvider } from "./thread-lifecycle-Cgi62SSl.js";
+import { a as handleCodexAppServerElicitationRequest, c as emitDynamicToolTerminalDiagnostic, i as buildCodexNativeHookRelayDisabledConfig, l as handleCodexAppServerApprovalRequest, n as CODEX_NATIVE_HOOK_RELAY_EVENTS, o as emitDynamicToolErrorDiagnostic, r as buildCodexNativeHookRelayConfig, s as emitDynamicToolStartedDiagnostic, t as filterToolsForVisionInputs } from "./vision-tools-B2wt6ecs.js";
+import { n as rememberCodexRateLimits, t as readRecentCodexRateLimits } from "./rate-limit-cache-N66I-Rd7.js";
 import { buildAgentHookContextChannelFields, embeddedAgentLog, formatErrorMessage, registerNativeHookRelay, resolveAgentDir, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveSandboxContext, resolveSessionAgentIds, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/side-question.ts
 const CODEX_SIDE_DYNAMIC_TOOL_TIMEOUT_MS = 3e4;

package/dist/test-api.js

@@ -1,5 +1,5 @@
-import { c as resolveCodexAppServerRuntimeOptions } from "./config-B5rU0vP3.js";
-import { S as filterCodexDynamicTools, a as buildThreadResumeParams, b as createCodexDynamicToolBridge, i as buildDeveloperInstructions, o as buildThreadStartParams, s as buildTurnStartParams } from "./thread-lifecycle-C07GnPSH.js";
+import { c as resolveCodexAppServerRuntimeOptions } from "./config-DqIp6oTk.js";
+import { S as filterCodexDynamicTools, a as buildThreadResumeParams, b as createCodexDynamicToolBridge, i as buildDeveloperInstructions, o as buildThreadStartParams, s as buildTurnStartParams } from "./thread-lifecycle-Cgi62SSl.js";
 //#region extensions/codex/test-api.ts
 function resolveCodexPromptSnapshotAppServerOptions(pluginConfig) {
 	return resolveCodexAppServerRuntimeOptions({

package/dist/{thread-lifecycle-C07GnPSH.js → thread-lifecycle-Cgi62SSl.js}

@@ -1,11 +1,11 @@
-import { r as codexSandboxPolicyForTurn, u as resolveCodexPluginsPolicy } from "./config-B5rU0vP3.js";
-import { n as assertCodexThreadResumeResponse, r as assertCodexThreadStartResponse } from "./protocol-validators-BGBspNmF.js";
-import { t as isJsonObject } from "./protocol-C9UWI98H.js";
+import { r as codexSandboxPolicyForTurn, u as resolveCodexPluginsPolicy } from "./config-DqIp6oTk.js";
+import { n as assertCodexThreadResumeResponse, r as assertCodexThreadStartResponse } from "./protocol-validators-_gKDcd0x.js";
+import { t as isJsonObject } from "./protocol-oeJQu4rs.js";
 import { CODEX_GPT5_HEARTBEAT_PROMPT_OVERLAY } from "./prompt-overlay.js";
 import { isModernCodexModel } from "./provider.js";
-import { i as isCodexAppServerConnectionClosedError } from "./client-BCJaLwdZ.js";
-import { i as readCodexAppServerBinding, n as isCodexAppServerNativeAuthProfile, o as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-D9ejASYj.js";
-import { a as defaultCodexAppInventoryCache, o as serializeCodexAppInventoryError, r as readCodexPluginInventory, t as ensureCodexPluginActivation } from "./plugin-activation-Dtcfb3sk.js";
+import { i as isCodexAppServerConnectionClosedError } from "./client-Ab4Fw77C.js";
+import { i as readCodexAppServerBinding, n as isCodexAppServerNativeAuthProfile, o as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-DEiYHgJ_.js";
+import { a as defaultCodexAppInventoryCache, o as serializeCodexAppInventoryError, r as readCodexPluginInventory, t as ensureCodexPluginActivation } from "./plugin-activation-BkQkPLOY.js";
 import crypto from "node:crypto";
 import { HEARTBEAT_RESPONSE_TOOL_NAME, createAgentToolResultMiddlewareRunner, createCodexAppServerToolResultExtensionRunner, embeddedAgentLog, extractToolResultMediaArtifact, filterToolResultMediaUrls, isActiveHarnessContextEngine, isMessagingTool, isMessagingToolSendAction, isToolWrappedWithBeforeToolCallHook, normalizeHeartbeatToolResponse, runAgentHarnessAfterToolCallHook, setBeforeToolCallDiagnosticsEnabled, wrapToolWithBeforeToolCallHook } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { normalizeAgentId } from "openclaw/plugin-sdk/routing";
@@ -53,6 +53,24 @@ function filterCodexDynamicTools(tools, config, env = process.env) {
 //#region extensions/codex/src/app-server/image-payload-sanitizer.ts
 const DATA_URL_PREFIX = "data:";
 const IMAGE_OMITTED_TEXT = "omitted image payload: invalid inline image data";
+const IMAGE_SIGNATURES = [
+	{
+		mime: "image/png",
+		matches: (buffer) => buffer.length >= 8 && buffer[0] === 137 && buffer[1] === 80 && buffer[2] === 78 && buffer[3] === 71 && buffer[4] === 13 && buffer[5] === 10 && buffer[6] === 26 && buffer[7] === 10
+	},
+	{
+		mime: "image/jpeg",
+		matches: (buffer) => buffer.length >= 3 && buffer[0] === 255 && buffer[1] === 216 && buffer[2] === 255
+	},
+	{
+		mime: "image/webp",
+		matches: (buffer) => buffer.length >= 12 && buffer.subarray(0, 4).toString("ascii") === "RIFF" && buffer.subarray(8, 12).toString("ascii") === "WEBP"
+	},
+	{
+		mime: "image/gif",
+		matches: (buffer) => buffer.length >= 6 && (buffer.subarray(0, 6).toString("ascii") === "GIF87a" || buffer.subarray(0, 6).toString("ascii") === "GIF89a")
+	}
+];
 function startsWithDataUrl(value) {
 	return value.slice(0, 5).toLowerCase() === DATA_URL_PREFIX;
 }
@@ -77,21 +95,30 @@ function canonicalizeBase64(base64) {
 	return cleaned;
 }
 function sniffImageMime(buffer) {
-	if (buffer.length >= 8 && buffer[0] === 137 && buffer[1] === 80 && buffer[2] === 78 && buffer[3] === 71 && buffer[4] === 13 && buffer[5] === 10 && buffer[6] === 26 && buffer[7] === 10) return "image/png";
-	if (buffer.length >= 3 && buffer[0] === 255 && buffer[1] === 216 && buffer[2] === 255) return "image/jpeg";
-	if (buffer.length >= 12 && buffer.subarray(0, 4).toString("ascii") === "RIFF" && buffer.subarray(8, 12).toString("ascii") === "WEBP") return "image/webp";
-	if (buffer.length >= 6 && (buffer.subarray(0, 6).toString("ascii") === "GIF87a" || buffer.subarray(0, 6).toString("ascii") === "GIF89a")) return "image/gif";
+	return IMAGE_SIGNATURES.find((signature) => signature.matches(buffer))?.mime;
 }
-function sanitizeInlineImageDataUrl(imageUrl) {
-	if (!startsWithDataUrl(imageUrl)) return imageUrl;
-	const commaIndex = imageUrl.indexOf(",");
+function parseImageDataUrl(value) {
+	if (!startsWithDataUrl(value)) return {
+		metadata: [],
+		payload: value
+	};
+	const commaIndex = value.indexOf(",");
 	if (commaIndex < 0) return;
-	const metadata = imageUrl.slice(5, commaIndex);
-	const payload = imageUrl.slice(commaIndex + 1);
-	const metadataParts = metadata.split(";").map((part) => part.trim());
-	if (!(metadataParts[0]?.toLowerCase())?.startsWith("image/")) return;
-	if (!metadataParts.slice(1).some((part) => part.toLowerCase() === "base64")) return;
-	const canonicalPayload = canonicalizeBase64(payload);
+	return {
+		metadata: value.slice(5, commaIndex).split(";").map((part) => part.trim()),
+		payload: value.slice(commaIndex + 1)
+	};
+}
+function metadataAllowsImageBase64(metadata) {
+	const [mimeType, ...options] = metadata;
+	return mimeType !== void 0 && mimeType.toLowerCase().startsWith("image/") && options.some((part) => part.toLowerCase() === "base64");
+}
+function sanitizeInlineImageDataUrl(imageUrl) {
+	const parsed = parseImageDataUrl(imageUrl);
+	if (!parsed) return;
+	if (parsed.metadata.length === 0) return imageUrl;
+	if (!metadataAllowsImageBase64(parsed.metadata)) return;
+	const canonicalPayload = canonicalizeBase64(parsed.payload);
 	if (!canonicalPayload) return;
 	const sniffedMimeType = sniffImageMime(Buffer.from(canonicalPayload, "base64"));
 	if (!sniffedMimeType) return;
@@ -1528,12 +1555,7 @@ function buildDeferredDynamicToolManifest(dynamicTools) {
 }
 function buildVisibleReplyInstruction(params, dynamicTools) {
 	const messageToolAvailable = dynamicTools ? dynamicTools.some((tool) => tool.name.trim() === "message") : params.disableMessageTool !== true;
-	if (params.sourceReplyDeliveryMode === "message_tool_only" && messageToolAvailable) return [
-		"Preserve channel/session context.",
-		"If this turn needs visible output in the current channel, call `message` with `action=\"send\"` before ending the turn.",
-		"Do not rely on normal final assistant text for visible delivery; final text is private to OpenClaw/Codex in this mode.",
-		"If no visible channel response is needed, do not call `message(action=\"send\")`."
-	].join(" ");
+	if (params.sourceReplyDeliveryMode === "message_tool_only" && messageToolAvailable) return "To send a visible message, use the `message` tool.";
 	return "To send a visible reply, use the active Codex delivery path.";
 }
 function buildUserInput(params, promptText = params.prompt) {

package/dist/{vision-tools-CDoJ4rDN.js → vision-tools-B2wt6ecs.js}

@@ -1,5 +1,5 @@
-import { t as isJsonObject } from "./protocol-C9UWI98H.js";
-import { r as formatCodexDisplayText } from "./command-formatters-BpPOTePl.js";
+import { t as isJsonObject } from "./protocol-oeJQu4rs.js";
+import { r as formatCodexDisplayText } from "./command-formatters-BVBnEgyA.js";
 import { createHash } from "node:crypto";
 import { buildAgentHookContextChannelFields, callGatewayTool, embeddedAgentLog, formatApprovalDisplayPath, hasNativeHookRelayInvocation, invokeNativeHookRelay, runBeforeToolCallHook } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { emitTrustedDiagnosticEvent } from "openclaw/plugin-sdk/diagnostic-runtime";
@@ -9,7 +9,7 @@ const MAX_PLUGIN_APPROVAL_TITLE_LENGTH = 80;
 const MAX_PLUGIN_APPROVAL_DESCRIPTION_LENGTH = 256;
 async function requestPluginApproval(params) {
 	const timeoutMs = DEFAULT_CODEX_APPROVAL_TIMEOUT_MS;
-	return callGatewayTool("plugin.approval.request", { timeoutMs: timeoutMs + 1e4 }, {
+	return callGatewayTool("plugin.approval.request", { timeoutMs: 13e4 }, {
 		pluginId: "openclaw-codex-app-server",
 		title: truncateForGateway(params.title, MAX_PLUGIN_APPROVAL_TITLE_LENGTH),
 		description: truncateForGateway(params.description, MAX_PLUGIN_APPROVAL_DESCRIPTION_LENGTH),
@@ -37,7 +37,7 @@ function approvalRequestExplicitlyUnavailable(result) {
 	return descriptor !== void 0 && "value" in descriptor && descriptor.value === null;
 }
 async function waitForPluginApprovalDecision(params) {
-	const waitPromise = callGatewayTool("plugin.approval.waitDecision", { timeoutMs: DEFAULT_CODEX_APPROVAL_TIMEOUT_MS + 1e4 }, { id: params.approvalId });
+	const waitPromise = callGatewayTool("plugin.approval.waitDecision", { timeoutMs: 13e4 }, { id: params.approvalId });
 	if (!params.signal) return (await waitPromise)?.decision;
 	let onAbort;
 	const abortPromise = new Promise((_, reject) => {
@@ -807,6 +807,7 @@ const MCP_TOOL_APPROVAL_TOOL_PARAMS_DISPLAY_KEY = "tool_params_display";
 const MCP_TOOL_APPROVAL_SOURCE_KEY = "source";
 const MCP_TOOL_APPROVAL_CONNECTOR_SOURCE = "connector";
 const CODEX_APPS_SERVER_NAME = "codex_apps";
+const COMPUTER_USE_APPROVAL_TITLE = "Computer Use approval";
 const PLUGIN_APP_ID_META_KEYS = [
 	"app_id",
 	"appId",
@@ -862,7 +863,7 @@ async function handleCodexAppServerElicitationRequest(params) {
 		}
 		return buildPluginPolicyElicitationResponse(pluginResolution.entry, requestParams);
 	}
-	const approvalPrompt = readBridgeableApprovalElicitation(requestParams);
+	const approvalPrompt = readComputerUseApprovalElicitation(requestParams, params.computerUseMcpServerName) ?? readBridgeableApprovalElicitation(requestParams);
 	if (!approvalPrompt) return;
 	const outcome = await requestPluginApprovalOutcome({
 		paramsForRun: params.paramsForRun,
@@ -1014,6 +1015,25 @@ function readBridgeableApprovalElicitation(requestParams) {
 		meta: requestParams["_meta"]
 	};
 }
+function readComputerUseApprovalElicitation(requestParams, expectedServerName) {
+	const serverName = readString(requestParams, "serverName");
+	if (!serverName || !expectedServerName || serverName !== expectedServerName || readString(requestParams, "mode") !== "form" || !isJsonObject(requestParams?.requestedSchema)) return;
+	const requestedSchema = requestParams.requestedSchema;
+	if (readString(requestedSchema, "type") !== "object" || !isJsonObject(requestedSchema.properties)) return;
+	const meta = isJsonObject(requestParams?.["_meta"]) ? requestParams["_meta"] : {};
+	const title = sanitizeDisplayText(readString(requestParams, "message") ?? "") || COMPUTER_USE_APPROVAL_TITLE;
+	return {
+		title,
+		description: buildApprovalDescription({
+			title,
+			meta,
+			requestedSchema,
+			serverName: sanitizeOptionalDisplayText(serverName)
+		}),
+		requestedSchema,
+		meta
+	};
+}
 function buildApprovalDescription(params) {
 	const connectorName = sanitizeOptionalDisplayText(readString(params.meta, MCP_TOOL_APPROVAL_CONNECTOR_NAME_KEY));
 	const toolTitle = sanitizeOptionalDisplayText(readString(params.meta, MCP_TOOL_APPROVAL_TOOL_TITLE_KEY));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/codex",
-  "version": "2026.5.19",
+  "version": "2026.5.20-beta.2",
   "description": "OpenClaw Codex harness and model provider plugin",
   "repository": {
     "type": "git",
@@ -8,8 +8,8 @@
   },
   "type": "module",
   "dependencies": {
-    "@earendil-works/pi-coding-agent": "0.75.1",
-    "@openai/codex": "0.130.0",
+    "@earendil-works/pi-coding-agent": "0.75.4",
+    "@openai/codex": "0.132.0",
     "ajv": "8.20.0",
     "ws": "8.20.1",
     "zod": "4.4.3"
@@ -27,10 +27,10 @@
       "minHostVersion": ">=2026.5.1-beta.1"
     },
     "compat": {
-      "pluginApi": ">=2026.5.19"
+      "pluginApi": ">=2026.5.20-beta.2"
     },
     "build": {
-      "openclawVersion": "2026.5.19"
+      "openclawVersion": "2026.5.20-beta.2"
     },
     "release": {
       "publishToClawHub": true,
@@ -45,7 +45,7 @@
     "openclaw.plugin.json"
   ],
   "peerDependencies": {
-    "openclaw": ">=2026.5.19"
+    "openclaw": ">=2026.5.20-beta.2"
   },
   "peerDependenciesMeta": {
     "openclaw": {