@openclaw/codex 2026.5.24-beta.2 → 2026.5.25-beta.1

package/dist/{session-binding-Bw_mfIW2.js → session-binding-CwNOIDP2.js}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { s as normalizeCodexServiceTier } from "./config-DDMrwfJl.js";
+import { s as normalizeCodexServiceTier } from "./config-D6TUuyo2.js";
 import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
 import fs from "node:fs/promises";
 import { ensureAuthProfileStore, resolveDefaultAgentDir, resolveProviderIdForAuth } from "openclaw/plugin-sdk/agent-runtime";

package/dist/{shared-client-CFCUGEVs.js → shared-client-CZP1DjaN.js}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { l as resolveCodexAppServerRuntimeOptions, n as codexAppServerStartOptionsKey } from "./config-DDMrwfJl.js";
-import { c as resolveCodexAppServerSpawnEnv, o as MANAGED_CODEX_APP_SERVER_PACKAGE, t as CodexAppServerClient } from "./client-1sSy4p3z.js";
+import { l as resolveCodexAppServerRuntimeOptions, n as codexAppServerStartOptionsKey } from "./config-D6TUuyo2.js";
+import { c as resolveCodexAppServerSpawnEnv, o as MANAGED_CODEX_APP_SERVER_PACKAGE, t as CodexAppServerClient } from "./client-SrtuTTVa.js";
 import { createRequire } from "node:module";
 import { createHash } from "node:crypto";
 import { constants, readFileSync } from "node:fs";
@@ -233,8 +233,7 @@ async function resolveCodexAppServerAuthProfileLoginParamsInternal(params) {
 async function resolveCodexAppServerEnvApiKeyLoginParams(params) {
 	const apiKey = readFirstNonEmptyEnv(params.env, CODEX_APP_SERVER_API_KEY_ENV_VARS);
 	if (!apiKey) return;
-	const response = await params.client.request("account/read", { refreshToken: false });
-	if (response.account || !response.requiresOpenaiAuth) return;
+	if ((await params.client.request("account/read", { refreshToken: false })).account) return;
 	return {
 		type: "apiKey",
 		apiKey

package/dist/{side-question-CYFMTA1O.js → side-question-Cb4COOQ9.js}

@@ -1,14 +1,13 @@
-import { c as readCodexPluginConfig, l as resolveCodexAppServerRuntimeOptions } from "./config-DDMrwfJl.js";
+import { c as readCodexPluginConfig, f as shouldAutoApproveCodexAppServerApprovals, l as resolveCodexAppServerRuntimeOptions } from "./config-D6TUuyo2.js";
 import { a as readCodexDynamicToolCallParams, c as readCodexTurn, i as assertCodexTurnStartResponse, t as assertCodexThreadForkResponse } from "./protocol-validators-_gKDcd0x.js";
-import { t as isJsonObject } from "./protocol-oeJQu4rs.js";
-import { i as isCodexAppServerApprovalRequest } from "./client-1sSy4p3z.js";
-import { d as resolveCodexAppServerModelProvider, f as resolveReasoningEffort, g as mergeCodexThreadConfigs, n as buildCodexRuntimeThreadConfig } from "./thread-lifecycle-DGoaguJh.js";
-import { i as readCodexAppServerBinding } from "./session-binding-Bw_mfIW2.js";
-import { i as readCodexNotificationTurnId, m as formatCodexUsageLimitErrorMessage, r as readCodexNotificationThreadId } from "./notification-correlation-qKY_sgga.js";
-import { i as getSharedCodexAppServerClient, s as refreshCodexAppServerAuthTokens } from "./shared-client-CFCUGEVs.js";
+import { i as isCodexAppServerApprovalRequest, l as isJsonObject } from "./client-SrtuTTVa.js";
+import { _ as mergeCodexThreadConfigs, f as resolveCodexAppServerModelProvider, p as resolveReasoningEffort, r as buildCodexRuntimeThreadConfig, t as CODEX_NATIVE_PERSONALITY_NONE } from "./thread-lifecycle-CXMd9UgJ.js";
+import { i as readCodexAppServerBinding } from "./session-binding-CwNOIDP2.js";
+import { i as readCodexNotificationTurnId, m as formatCodexUsageLimitErrorMessage, r as readCodexNotificationThreadId } from "./notification-correlation-D7tJW3FW.js";
+import { i as getSharedCodexAppServerClient, s as refreshCodexAppServerAuthTokens } from "./shared-client-CZP1DjaN.js";
 import { n as resolveCodexNativeExecutionBlock } from "./sandbox-guard-CTnEWuor.js";
-import { a as resolveCodexDynamicToolsLoading, n as filterCodexDynamicTools, t as createCodexDynamicToolBridge } from "./dynamic-tools-Bq717oJR.js";
-import { a as handleCodexAppServerElicitationRequest, c as emitDynamicToolTerminalDiagnostic, i as buildCodexNativeHookRelayDisabledConfig, l as handleCodexAppServerApprovalRequest, n as CODEX_NATIVE_HOOK_RELAY_EVENTS, o as emitDynamicToolErrorDiagnostic, r as buildCodexNativeHookRelayConfig, s as emitDynamicToolStartedDiagnostic, t as filterToolsForVisionInputs } from "./vision-tools-DOnxzH2y.js";
+import { a as resolveCodexDynamicToolsLoading, n as filterCodexDynamicTools, t as createCodexDynamicToolBridge } from "./dynamic-tools-BXAE1U1-.js";
+import { a as handleCodexAppServerElicitationRequest, c as emitDynamicToolTerminalDiagnostic, i as buildCodexNativeHookRelayDisabledConfig, l as handleCodexAppServerApprovalRequest, n as CODEX_NATIVE_HOOK_RELAY_EVENTS, o as emitDynamicToolErrorDiagnostic, r as buildCodexNativeHookRelayConfig, s as emitDynamicToolStartedDiagnostic, t as filterToolsForVisionInputs } from "./vision-tools-CETeQgze.js";
 import { n as rememberCodexRateLimits, t as readRecentCodexRateLimits } from "./rate-limit-cache-N66I-Rd7.js";
 import { buildAgentHookContextChannelFields, embeddedAgentLog, formatErrorMessage, registerNativeHookRelay, resolveAgentDir, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveSandboxContext, resolveSessionAgentIds, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/side-question.ts
@@ -84,6 +83,8 @@ async function runCodexAppServerSideQuestion(params, options = {}) {
 			cwd,
 			authProfileId
 		});
+		const approvalPolicy = binding.approvalPolicy ?? appServer.approvalPolicy;
+		const sandbox = binding.sandbox ?? appServer.sandbox;
 		const { sessionAgentId } = resolveSessionAgentIds({
 			sessionKey: params.sessionKey,
 			config: params.cfg,
@@ -119,6 +120,10 @@ async function runCodexAppServerSideQuestion(params, options = {}) {
 				threadId: childThreadId,
 				turnId,
 				nativeHookRelay,
+				autoApprove: shouldAutoApproveCodexAppServerApprovals({
+					approvalPolicy,
+					sandbox
+				}),
 				signal: runAbortController.signal
 			});
 			if (request.method !== "item/tool/call") return;
@@ -160,8 +165,6 @@ async function runCodexAppServerSideQuestion(params, options = {}) {
 				throw error;
 			}
 		});
-		const approvalPolicy = binding.approvalPolicy ?? appServer.approvalPolicy;
-		const sandbox = binding.sandbox ?? appServer.sandbox;
 		const serviceTier = binding.serviceTier ?? appServer.serviceTier;
 		const nativeHookRelayEvents = resolveCodexSideNativeHookRelayEvents({
 			configuredEvents: options.nativeHookRelay?.events,
@@ -203,6 +206,7 @@ async function runCodexAppServerSideQuestion(params, options = {}) {
 			threadId: binding.threadId,
 			model: params.model,
 			...modelProvider ? { modelProvider } : {},
+			personality: CODEX_NATIVE_PERSONALITY_NONE,
 			cwd,
 			approvalPolicy,
 			approvalsReviewer: appServer.approvalsReviewer,
@@ -233,6 +237,7 @@ async function runCodexAppServerSideQuestion(params, options = {}) {
 			}],
 			cwd,
 			model: params.model,
+			personality: CODEX_NATIVE_PERSONALITY_NONE,
 			...serviceTier ? { serviceTier } : {},
 			effort,
 			collaborationMode: {

package/dist/test-api.js

@@ -1,6 +1,6 @@
-import { l as resolveCodexAppServerRuntimeOptions } from "./config-DDMrwfJl.js";
-import { a as buildThreadResumeParams, c as buildTurnStartParams, i as buildDeveloperInstructions, o as buildThreadStartParams } from "./thread-lifecycle-DGoaguJh.js";
-import { n as filterCodexDynamicTools, t as createCodexDynamicToolBridge } from "./dynamic-tools-Bq717oJR.js";
+import { l as resolveCodexAppServerRuntimeOptions } from "./config-D6TUuyo2.js";
+import { a as buildDeveloperInstructions, l as buildTurnStartParams, o as buildThreadResumeParams, s as buildThreadStartParams } from "./thread-lifecycle-CXMd9UgJ.js";
+import { n as filterCodexDynamicTools, t as createCodexDynamicToolBridge } from "./dynamic-tools-BXAE1U1-.js";
 //#region extensions/codex/test-api.ts
 function resolveCodexPromptSnapshotAppServerOptions(pluginConfig) {
 	return resolveCodexAppServerRuntimeOptions({

package/dist/{thread-lifecycle-DGoaguJh.js → thread-lifecycle-CXMd9UgJ.js}

@@ -1,11 +1,11 @@
-import { d as resolveCodexPluginsPolicy, r as codexSandboxPolicyForTurn, t as CODEX_PLUGINS_MARKETPLACE_NAME } from "./config-DDMrwfJl.js";
+import { d as resolveCodexPluginsPolicy, r as codexSandboxPolicyForTurn, t as CODEX_PLUGINS_MARKETPLACE_NAME } from "./config-D6TUuyo2.js";
 import { n as assertCodexThreadResumeResponse, r as assertCodexThreadStartResponse } from "./protocol-validators-_gKDcd0x.js";
-import { t as isJsonObject } from "./protocol-oeJQu4rs.js";
+import { a as isCodexAppServerConnectionClosedError, l as isJsonObject } from "./client-SrtuTTVa.js";
 import { CODEX_GPT5_HEARTBEAT_PROMPT_OVERLAY } from "./prompt-overlay.js";
 import { isModernCodexModel } from "./provider.js";
-import { a as isCodexAppServerConnectionClosedError } from "./client-1sSy4p3z.js";
-import { i as readCodexAppServerBinding, n as isCodexAppServerNativeAuthProfile, o as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-Bw_mfIW2.js";
+import { i as readCodexAppServerBinding, n as isCodexAppServerNativeAuthProfile, o as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-CwNOIDP2.js";
 import crypto from "node:crypto";
+import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { embeddedAgentLog, isActiveHarnessContextEngine } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { buildCodexUserMcpServersThreadConfigPatch } from "openclaw/plugin-sdk/codex-mcp-projection";
 import { listRegisteredPluginAgentPromptGuidance } from "openclaw/plugin-sdk/plugin-runtime";
@@ -301,9 +301,6 @@ function sanitizeInlineImageDataUrl(imageUrl) {
 function invalidInlineImageText(label) {
 	return `[${label}] ${IMAGE_OMITTED_TEXT}`;
 }
-function isRecord$1(value) {
-	return Boolean(value && typeof value === "object" && !Array.isArray(value));
-}
 function sanitizeImageContentRecord(record, label) {
 	if (record.type === "image" && typeof record.data === "string") {
 		const mimeType = typeof record.mimeType === "string" ? record.mimeType : "image/png";
@@ -343,7 +340,7 @@ function sanitizeImageContentRecord(record, label) {
 }
 function sanitizeCodexHistoryImagePayloads(value, label) {
 	if (Array.isArray(value)) return value.map((entry) => sanitizeCodexHistoryImagePayloads(entry, label));
-	if (!isRecord$1(value)) return value;
+	if (!isRecord(value)) return value;
 	const imageRecord = sanitizeImageContentRecord(value, label);
 	if (imageRecord) return imageRecord;
 	const next = {};
@@ -512,9 +509,6 @@ function fingerprintInventoryCacheKey(key) {
 	for (let index = 0; index < key.length; index += 1) hash = hash * 31 + key.charCodeAt(index) >>> 0;
 	return hash.toString(16).padStart(8, "0");
 }
-function isRecord(value) {
-	return Boolean(value && typeof value === "object" && !Array.isArray(value));
-}
 function redactErrorData(value, depth = 0) {
 	if (value === void 0) return;
 	if (value === null || typeof value === "boolean" || typeof value === "number") return value;
@@ -1074,6 +1068,7 @@ function stableStringify(value) {
 }
 //#endregion
 //#region extensions/codex/src/app-server/thread-lifecycle.ts
+const CODEX_NATIVE_PERSONALITY_NONE = "none";
 const CODEX_CODE_MODE_THREAD_CONFIG = {
 	"features.code_mode": true,
 	"features.code_mode_only": false
@@ -1401,6 +1396,7 @@ function buildThreadStartParams(params, options) {
 		approvalsReviewer: options.appServer.approvalsReviewer,
 		sandbox: options.appServer.sandbox,
 		...options.appServer.serviceTier ? { serviceTier: options.appServer.serviceTier } : {},
+		personality: CODEX_NATIVE_PERSONALITY_NONE,
 		serviceName: "OpenClaw",
 		config: buildCodexRuntimeThreadConfigForRun(params, options.config, {
 			nativeCodeModeEnabled: options.nativeCodeModeEnabled,
@@ -1429,6 +1425,7 @@ function buildThreadResumeParams(params, options) {
 		approvalsReviewer: options.appServer.approvalsReviewer,
 		sandbox: options.appServer.sandbox,
 		...options.appServer.serviceTier ? { serviceTier: options.appServer.serviceTier } : {},
+		personality: CODEX_NATIVE_PERSONALITY_NONE,
 		config: buildCodexRuntimeThreadConfigForRun(params, options.config, {
 			nativeCodeModeEnabled: options.nativeCodeModeEnabled,
 			nativeCodeModeOnlyEnabled: options.nativeCodeModeOnlyEnabled
@@ -1466,6 +1463,7 @@ function buildTurnStartParams(params, options) {
 		approvalsReviewer: options.appServer.approvalsReviewer,
 		sandboxPolicy: options.sandboxPolicy ?? codexSandboxPolicyForTurn(options.appServer.sandbox, options.cwd),
 		model: params.modelId,
+		personality: CODEX_NATIVE_PERSONALITY_NONE,
 		...options.appServer.serviceTier ? { serviceTier: options.appServer.serviceTier } : {},
 		effort: resolveReasoningEffort(params.thinkLevel, params.modelId),
 		...options.environmentSelection ? { environments: options.environmentSelection } : {},
@@ -1625,4 +1623,4 @@ function resolveReasoningEffort(thinkLevel, modelId) {
 	return null;
 }
 //#endregion
-export { sanitizeCodexHistoryImagePayloads as C, resolveCodexContextEngineProjectionMaxChars as D, projectContextEngineAssemblyForCodex as E, resolveCodexContextEngineProjectionReserveTokens as O, invalidInlineImageText as S, DEFAULT_CODEX_PROJECTION_RESERVE_TOKENS as T, shouldBuildCodexPluginThreadConfig as _, buildThreadResumeParams as a, buildCodexAppInventoryCacheKey as b, buildTurnStartParams as c, resolveCodexAppServerModelProvider as d, resolveReasoningEffort as f, mergeCodexThreadConfigs as g, buildCodexPluginThreadConfigInputFingerprint as h, buildDeveloperInstructions as i, codexDynamicToolsFingerprint as l, buildCodexPluginThreadConfig as m, buildCodexRuntimeThreadConfig as n, buildThreadStartParams as o, startOrResumeThread as p, buildContextEngineBinding as r, buildTurnCollaborationMode as s, areCodexDynamicToolFingerprintsCompatible as t, isContextEngineBindingCompatible as u, ensureCodexPluginActivation as v, sanitizeInlineImageDataUrl as w, defaultCodexAppInventoryCache as x, pluginReadParams as y };
+export { invalidInlineImageText as C, resolveCodexContextEngineProjectionMaxChars as D, projectContextEngineAssemblyForCodex as E, resolveCodexContextEngineProjectionReserveTokens as O, defaultCodexAppInventoryCache as S, sanitizeInlineImageDataUrl as T, mergeCodexThreadConfigs as _, buildDeveloperInstructions as a, pluginReadParams as b, buildTurnCollaborationMode as c, isContextEngineBindingCompatible as d, resolveCodexAppServerModelProvider as f, buildCodexPluginThreadConfigInputFingerprint as g, buildCodexPluginThreadConfig as h, buildContextEngineBinding as i, buildTurnStartParams as l, startOrResumeThread as m, areCodexDynamicToolFingerprintsCompatible as n, buildThreadResumeParams as o, resolveReasoningEffort as p, buildCodexRuntimeThreadConfig as r, buildThreadStartParams as s, CODEX_NATIVE_PERSONALITY_NONE as t, codexDynamicToolsFingerprint as u, shouldBuildCodexPluginThreadConfig as v, sanitizeCodexHistoryImagePayloads as w, buildCodexAppInventoryCacheKey as x, ensureCodexPluginActivation as y };

package/dist/{vision-tools-DOnxzH2y.js → vision-tools-CETeQgze.js}

@@ -1,6 +1,7 @@
-import { t as isJsonObject } from "./protocol-oeJQu4rs.js";
-import { s as formatCodexDisplayText } from "./notification-correlation-qKY_sgga.js";
+import { l as isJsonObject } from "./client-SrtuTTVa.js";
+import { s as formatCodexDisplayText } from "./notification-correlation-D7tJW3FW.js";
 import { createHash } from "node:crypto";
+import { normalizeTrimmedStringList } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { buildAgentHookContextChannelFields, callGatewayTool, embeddedAgentLog, formatApprovalDisplayPath, hasNativeHookRelayInvocation, invokeNativeHookRelay, runBeforeToolCallHook } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { emitTrustedDiagnosticEvent } from "openclaw/plugin-sdk/diagnostic-runtime";
 //#region extensions/codex/src/app-server/plugin-approval-roundtrip.ts
@@ -106,6 +107,18 @@ async function handleCodexAppServerApprovalRequest(params) {
 			});
 			return buildApprovalResponse(params.method, context.requestParams, "denied");
 		}
+		if (params.autoApprove === true) {
+			emitApprovalEvent(params.paramsForRun, {
+				phase: "resolved",
+				kind: context.kind,
+				status: "approved",
+				title: context.title,
+				...context.eventDetails,
+				...approvalEventScope(params.method, "approved-session"),
+				message: "Codex app-server approval auto-approved by runtime policy."
+			});
+			return buildApprovalResponse(params.method, context.requestParams, "approved-session");
+		}
 		const requestResult = await requestPluginApproval({
 			paramsForRun: params.paramsForRun,
 			title: context.title,
@@ -567,8 +580,7 @@ function summarizeNetworkPolicyAmendments(value) {
 	return `Proposed network policy: ${samples.join(", ")}${remainderSuffix}`;
 }
 function readStringArray(record, key) {
-	const value = record[key];
-	return Array.isArray(value) ? value.map((entry) => typeof entry === "string" ? entry.trim() : "").filter(Boolean) : [];
+	return normalizeTrimmedStringList(record[key]);
 }
 function sanitizePermissionHostValue(value) {
 	const withoutScheme = sanitizePermissionScalar(value).toLowerCase().replace(/^[a-z][a-z0-9+.-]*:\/\//, "");