@openclaw/codex 2026.5.20-beta.1 → 2026.5.20-beta.2

package/dist/harness.js

@@ -18,14 +18,14 @@ function createCodexAppServerAgentHarness(options) {
 			};
 		},
 		runAttempt: async (params) => {
-			const { runCodexAppServerAttempt } = await import("./run-attempt-8r4wCbNk.js");
+			const { runCodexAppServerAttempt } = await import("./run-attempt-CRHVB240.js");
 			return runCodexAppServerAttempt(params, {
 				pluginConfig: options?.resolvePluginConfig?.() ?? options?.pluginConfig,
 				nativeHookRelay: { enabled: true }
 			});
 		},
 		runSideQuestion: async (params) => {
-			const { runCodexAppServerSideQuestion } = await import("./side-question-Ufu1Z7Ne.js");
+			const { runCodexAppServerSideQuestion } = await import("./side-question-DlJAUYst.js");
 			return runCodexAppServerSideQuestion(params, {
 				pluginConfig: options?.resolvePluginConfig?.() ?? options?.pluginConfig,
 				nativeHookRelay: { enabled: true }

package/dist/{run-attempt-8r4wCbNk.js → run-attempt-CRHVB240.js}

@@ -7,7 +7,7 @@ import { d as resolveCodexUsageLimitResetAtMs, f as shouldRefreshCodexRateLimits
 import { c as resolveCodexAppServerAuthAccountCacheKey, d as resolveCodexAppServerEnvApiKeyCacheKey, f as resolveCodexAppServerHomeDir, l as resolveCodexAppServerAuthProfileId, s as refreshCodexAppServerAuthTokens, t as clearSharedCodexAppServerClientIfCurrent, u as resolveCodexAppServerAuthProfileIdForAgent } from "./shared-client-DCxJx5QU.js";
 import { i as readCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-DEiYHgJ_.js";
 import { a as defaultCodexAppInventoryCache } from "./plugin-activation-BkQkPLOY.js";
-import { C as isForcedPrivateQaCodexRuntime, S as filterCodexDynamicTools, T as resolveCodexDynamicToolsLoading, _ as projectContextEngineAssemblyForCodex, b as createCodexDynamicToolBridge, c as codexDynamicToolsFingerprint, f as startOrResumeThread, g as shouldBuildCodexPluginThreadConfig, h as mergeCodexThreadConfigs, i as buildDeveloperInstructions, l as isContextEngineBindingCompatible, m as buildCodexPluginThreadConfigInputFingerprint, p as buildCodexPluginThreadConfig, r as buildContextEngineBinding, s as buildTurnStartParams, t as areCodexDynamicToolFingerprintsCompatible, v as resolveCodexContextEngineProjectionMaxChars, w as normalizeCodexDynamicToolName, x as sanitizeCodexHistoryImagePayloads, y as resolveCodexContextEngineProjectionReserveTokens } from "./thread-lifecycle-CeH-cRV4.js";
+import { C as isForcedPrivateQaCodexRuntime, S as filterCodexDynamicTools, T as resolveCodexDynamicToolsLoading, _ as projectContextEngineAssemblyForCodex, b as createCodexDynamicToolBridge, c as codexDynamicToolsFingerprint, f as startOrResumeThread, g as shouldBuildCodexPluginThreadConfig, h as mergeCodexThreadConfigs, i as buildDeveloperInstructions, l as isContextEngineBindingCompatible, m as buildCodexPluginThreadConfigInputFingerprint, p as buildCodexPluginThreadConfig, r as buildContextEngineBinding, s as buildTurnStartParams, t as areCodexDynamicToolFingerprintsCompatible, v as resolveCodexContextEngineProjectionMaxChars, w as normalizeCodexDynamicToolName, x as sanitizeCodexHistoryImagePayloads, y as resolveCodexContextEngineProjectionReserveTokens } from "./thread-lifecycle-Cgi62SSl.js";
 import { t as defaultCodexAppServerClientFactory } from "./client-factory-BbesECdh.js";
 import { a as handleCodexAppServerElicitationRequest, c as emitDynamicToolTerminalDiagnostic, i as buildCodexNativeHookRelayDisabledConfig, l as handleCodexAppServerApprovalRequest, n as CODEX_NATIVE_HOOK_RELAY_EVENTS, o as emitDynamicToolErrorDiagnostic, r as buildCodexNativeHookRelayConfig, s as emitDynamicToolStartedDiagnostic, t as filterToolsForVisionInputs } from "./vision-tools-B2wt6ecs.js";
 import { t as ensureCodexComputerUse } from "./computer-use-B4iTog6z.js";
@@ -4609,7 +4609,6 @@ async function buildDynamicTools(input) {
 		senderName: params.senderName,
 		senderUsername: params.senderUsername,
 		senderE164: params.senderE164,
-		senderIsOwner: params.senderIsOwner,
 		allowGatewaySubagentBinding: params.allowGatewaySubagentBinding || isForcedPrivateQaCodexRuntime(),
 		...sessionKeys,
 		sessionId: params.sessionId,
@@ -5238,10 +5237,12 @@ function buildCodexBootstrapInjectionStats(params) {
 	const injectedIndex = indexCodexContextFileContent(params.injectedFiles);
 	const developerInstructionIndex = indexCodexContextFileContent(params.developerInstructionFiles ?? []);
 	return params.bootstrapFiles.map((file) => {
-		const pathValue = readNonEmptyString(file.path) ?? file.name;
-		const baseName = getCodexContextFileBasename(pathValue || file.name);
+		const fileName = readNonEmptyString(file.name);
+		const pathValue = readNonEmptyString(file.path) ?? fileName ?? "";
+		const displayName = (fileName ?? getCodexContextFileDisplayBasename(pathValue)) || pathValue;
+		const baseName = getCodexContextFileBasename(pathValue || fileName || "");
 		const rawChars = file.missing ? 0 : (file.content ?? "").trimEnd().length;
-		const injected = readCodexIndexedContextFileContent(injectedIndex, pathValue, file.name) ?? readCodexIndexedContextFileContent(developerInstructionIndex, pathValue, file.name);
+		const injected = readCodexIndexedContextFileContent(injectedIndex, pathValue, fileName) ?? readCodexIndexedContextFileContent(developerInstructionIndex, pathValue, fileName);
 		let injectedChars = injected?.length ?? 0;
 		let truncated = !file.missing && injectedChars < rawChars;
 		if (injected === void 0) {
@@ -5254,7 +5255,7 @@ function buildCodexBootstrapInjectionStats(params) {
 			}
 		}
 		return {
-			name: file.name,
+			name: displayName,
 			path: pathValue,
 			missing: file.missing,
 			rawChars,
@@ -5279,7 +5280,14 @@ function indexCodexContextFileContent(files) {
 	};
 }
 function readCodexIndexedContextFileContent(index, pathValue, fileName) {
-	return index.byPath.get(pathValue) ?? index.byPath.get(fileName) ?? index.byBaseName.get(getCodexContextFileBasename(fileName));
+	const pathContent = index.byPath.get(pathValue);
+	if (pathContent !== void 0) return pathContent;
+	if (fileName) {
+		const nameContent = index.byPath.get(fileName);
+		if (nameContent !== void 0) return nameContent;
+	}
+	const baseName = getCodexContextFileBasename(fileName ?? pathValue);
+	return baseName ? index.byBaseName.get(baseName) : void 0;
 }
 function readPositiveNumber(value) {
 	return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.floor(value) : void 0;
@@ -5396,6 +5404,9 @@ function compareCodexContextFiles(left, right) {
 function normalizeCodexContextFilePath(filePath) {
 	return filePath.trim().replaceAll("\\", "/").toLowerCase();
 }
+function getCodexContextFileDisplayBasename(filePath) {
+	return filePath.trim().replaceAll("\\", "/").split("/").pop()?.trim() ?? "";
+}
 function getCodexContextFileBasename(filePath) {
 	return normalizeCodexContextFilePath(filePath).split("/").pop() ?? "";
 }

package/dist/{side-question-Ufu1Z7Ne.js → side-question-DlJAUYst.js}

@@ -5,7 +5,7 @@ import { r as isCodexAppServerApprovalRequest } from "./client-Ab4Fw77C.js";
 import { u as formatCodexUsageLimitErrorMessage } from "./command-formatters-BVBnEgyA.js";
 import { i as getSharedCodexAppServerClient, s as refreshCodexAppServerAuthTokens } from "./shared-client-DCxJx5QU.js";
 import { i as readCodexAppServerBinding } from "./session-binding-DEiYHgJ_.js";
-import { S as filterCodexDynamicTools, T as resolveCodexDynamicToolsLoading, b as createCodexDynamicToolBridge, d as resolveReasoningEffort, h as mergeCodexThreadConfigs, n as buildCodexRuntimeThreadConfig, u as resolveCodexAppServerModelProvider } from "./thread-lifecycle-CeH-cRV4.js";
+import { S as filterCodexDynamicTools, T as resolveCodexDynamicToolsLoading, b as createCodexDynamicToolBridge, d as resolveReasoningEffort, h as mergeCodexThreadConfigs, n as buildCodexRuntimeThreadConfig, u as resolveCodexAppServerModelProvider } from "./thread-lifecycle-Cgi62SSl.js";
 import { a as handleCodexAppServerElicitationRequest, c as emitDynamicToolTerminalDiagnostic, i as buildCodexNativeHookRelayDisabledConfig, l as handleCodexAppServerApprovalRequest, n as CODEX_NATIVE_HOOK_RELAY_EVENTS, o as emitDynamicToolErrorDiagnostic, r as buildCodexNativeHookRelayConfig, s as emitDynamicToolStartedDiagnostic, t as filterToolsForVisionInputs } from "./vision-tools-B2wt6ecs.js";
 import { n as rememberCodexRateLimits, t as readRecentCodexRateLimits } from "./rate-limit-cache-N66I-Rd7.js";
 import { buildAgentHookContextChannelFields, embeddedAgentLog, formatErrorMessage, registerNativeHookRelay, resolveAgentDir, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveSandboxContext, resolveSessionAgentIds, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";

package/dist/test-api.js

@@ -1,5 +1,5 @@
 import { c as resolveCodexAppServerRuntimeOptions } from "./config-DqIp6oTk.js";
-import { S as filterCodexDynamicTools, a as buildThreadResumeParams, b as createCodexDynamicToolBridge, i as buildDeveloperInstructions, o as buildThreadStartParams, s as buildTurnStartParams } from "./thread-lifecycle-CeH-cRV4.js";
+import { S as filterCodexDynamicTools, a as buildThreadResumeParams, b as createCodexDynamicToolBridge, i as buildDeveloperInstructions, o as buildThreadStartParams, s as buildTurnStartParams } from "./thread-lifecycle-Cgi62SSl.js";
 //#region extensions/codex/test-api.ts
 function resolveCodexPromptSnapshotAppServerOptions(pluginConfig) {
 	return resolveCodexAppServerRuntimeOptions({

package/dist/{thread-lifecycle-CeH-cRV4.js → thread-lifecycle-Cgi62SSl.js}

@@ -53,6 +53,24 @@ function filterCodexDynamicTools(tools, config, env = process.env) {
 //#region extensions/codex/src/app-server/image-payload-sanitizer.ts
 const DATA_URL_PREFIX = "data:";
 const IMAGE_OMITTED_TEXT = "omitted image payload: invalid inline image data";
+const IMAGE_SIGNATURES = [
+	{
+		mime: "image/png",
+		matches: (buffer) => buffer.length >= 8 && buffer[0] === 137 && buffer[1] === 80 && buffer[2] === 78 && buffer[3] === 71 && buffer[4] === 13 && buffer[5] === 10 && buffer[6] === 26 && buffer[7] === 10
+	},
+	{
+		mime: "image/jpeg",
+		matches: (buffer) => buffer.length >= 3 && buffer[0] === 255 && buffer[1] === 216 && buffer[2] === 255
+	},
+	{
+		mime: "image/webp",
+		matches: (buffer) => buffer.length >= 12 && buffer.subarray(0, 4).toString("ascii") === "RIFF" && buffer.subarray(8, 12).toString("ascii") === "WEBP"
+	},
+	{
+		mime: "image/gif",
+		matches: (buffer) => buffer.length >= 6 && (buffer.subarray(0, 6).toString("ascii") === "GIF87a" || buffer.subarray(0, 6).toString("ascii") === "GIF89a")
+	}
+];
 function startsWithDataUrl(value) {
 	return value.slice(0, 5).toLowerCase() === DATA_URL_PREFIX;
 }
@@ -77,21 +95,30 @@ function canonicalizeBase64(base64) {
 	return cleaned;
 }
 function sniffImageMime(buffer) {
-	if (buffer.length >= 8 && buffer[0] === 137 && buffer[1] === 80 && buffer[2] === 78 && buffer[3] === 71 && buffer[4] === 13 && buffer[5] === 10 && buffer[6] === 26 && buffer[7] === 10) return "image/png";
-	if (buffer.length >= 3 && buffer[0] === 255 && buffer[1] === 216 && buffer[2] === 255) return "image/jpeg";
-	if (buffer.length >= 12 && buffer.subarray(0, 4).toString("ascii") === "RIFF" && buffer.subarray(8, 12).toString("ascii") === "WEBP") return "image/webp";
-	if (buffer.length >= 6 && (buffer.subarray(0, 6).toString("ascii") === "GIF87a" || buffer.subarray(0, 6).toString("ascii") === "GIF89a")) return "image/gif";
+	return IMAGE_SIGNATURES.find((signature) => signature.matches(buffer))?.mime;
 }
-function sanitizeInlineImageDataUrl(imageUrl) {
-	if (!startsWithDataUrl(imageUrl)) return imageUrl;
-	const commaIndex = imageUrl.indexOf(",");
+function parseImageDataUrl(value) {
+	if (!startsWithDataUrl(value)) return {
+		metadata: [],
+		payload: value
+	};
+	const commaIndex = value.indexOf(",");
 	if (commaIndex < 0) return;
-	const metadata = imageUrl.slice(5, commaIndex);
-	const payload = imageUrl.slice(commaIndex + 1);
-	const metadataParts = metadata.split(";").map((part) => part.trim());
-	if (!(metadataParts[0]?.toLowerCase())?.startsWith("image/")) return;
-	if (!metadataParts.slice(1).some((part) => part.toLowerCase() === "base64")) return;
-	const canonicalPayload = canonicalizeBase64(payload);
+	return {
+		metadata: value.slice(5, commaIndex).split(";").map((part) => part.trim()),
+		payload: value.slice(commaIndex + 1)
+	};
+}
+function metadataAllowsImageBase64(metadata) {
+	const [mimeType, ...options] = metadata;
+	return mimeType !== void 0 && mimeType.toLowerCase().startsWith("image/") && options.some((part) => part.toLowerCase() === "base64");
+}
+function sanitizeInlineImageDataUrl(imageUrl) {
+	const parsed = parseImageDataUrl(imageUrl);
+	if (!parsed) return;
+	if (parsed.metadata.length === 0) return imageUrl;
+	if (!metadataAllowsImageBase64(parsed.metadata)) return;
+	const canonicalPayload = canonicalizeBase64(parsed.payload);
 	if (!canonicalPayload) return;
 	const sniffedMimeType = sniffImageMime(Buffer.from(canonicalPayload, "base64"));
 	if (!sniffedMimeType) return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/codex",
-  "version": "2026.5.20-beta.1",
+  "version": "2026.5.20-beta.2",
   "description": "OpenClaw Codex harness and model provider plugin",
   "repository": {
     "type": "git",
@@ -8,7 +8,7 @@
   },
   "type": "module",
   "dependencies": {
-    "@earendil-works/pi-coding-agent": "0.75.3",
+    "@earendil-works/pi-coding-agent": "0.75.4",
     "@openai/codex": "0.132.0",
     "ajv": "8.20.0",
     "ws": "8.20.1",
@@ -27,10 +27,10 @@
       "minHostVersion": ">=2026.5.1-beta.1"
     },
     "compat": {
-      "pluginApi": ">=2026.5.20-beta.1"
+      "pluginApi": ">=2026.5.20-beta.2"
     },
     "build": {
-      "openclawVersion": "2026.5.20-beta.1"
+      "openclawVersion": "2026.5.20-beta.2"
     },
     "release": {
       "publishToClawHub": true,
@@ -45,7 +45,7 @@
     "openclaw.plugin.json"
   ],
   "peerDependencies": {
-    "openclaw": ">=2026.5.20-beta.1"
+    "openclaw": ">=2026.5.20-beta.2"
   },
   "peerDependenciesMeta": {
     "openclaw": {