@openclaw/codex 2026.5.24-beta.2 → 2026.5.26-beta.1

package/dist/{session-binding-Bw_mfIW2.js → session-binding-UFjjws4k.js}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { s as normalizeCodexServiceTier } from "./config-DDMrwfJl.js";
+import { s as normalizeCodexServiceTier } from "./config-0-UN67Qg.js";
 import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
 import fs from "node:fs/promises";
 import { ensureAuthProfileStore, resolveDefaultAgentDir, resolveProviderIdForAuth } from "openclaw/plugin-sdk/agent-runtime";

package/dist/{shared-client-CFCUGEVs.js → shared-client-Fou5nAyt.js}

@@ -1,9 +1,10 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { l as resolveCodexAppServerRuntimeOptions, n as codexAppServerStartOptionsKey } from "./config-DDMrwfJl.js";
-import { c as resolveCodexAppServerSpawnEnv, o as MANAGED_CODEX_APP_SERVER_PACKAGE, t as CodexAppServerClient } from "./client-1sSy4p3z.js";
+import { l as resolveCodexAppServerRuntimeOptions, n as codexAppServerStartOptionsKey } from "./config-0-UN67Qg.js";
+import { c as resolveCodexAppServerSpawnEnv, o as MANAGED_CODEX_APP_SERVER_PACKAGE, t as CodexAppServerClient } from "./client-BVK_jmHW.js";
 import { createRequire } from "node:module";
 import { createHash } from "node:crypto";
-import { constants, readFileSync } from "node:fs";
+import fsSync, { constants, readFileSync } from "node:fs";
+import os from "node:os";
 import fs, { access } from "node:fs/promises";
 import path from "node:path";
 import { ensureAuthProfileStore, ensureAuthProfileStoreWithoutExternalProfiles, loadAuthProfileStoreForSecretsRuntime, refreshOAuthCredentialForRuntime, resolveApiKeyForProfile, resolveAuthProfileOrder, resolveDefaultAgentDir, resolvePersistedAuthProfileOwnerAgentDir, resolveProviderIdForAuth } from "openclaw/plugin-sdk/agent-runtime";
@@ -18,6 +19,8 @@ const HOME_ENV_VAR = "HOME";
 const CODEX_APP_SERVER_HOME_DIRNAME = "codex-home";
 const CODEX_APP_SERVER_API_KEY_ENV_VARS = ["CODEX_API_KEY", "OPENAI_API_KEY"];
 const CODEX_APP_SERVER_HOME_ENV_VARS = [CODEX_HOME_ENV_VAR, HOME_ENV_VAR];
+const CODEX_AUTH_JSON_FILENAME = "auth.json";
+const CODEX_HOME_DIRNAME = ".codex";
 async function bridgeCodexAppServerStartOptions(params) {
 	if (params.startOptions.transport !== "stdio") return params.startOptions;
 	const isolatedStartOptions = await withAgentCodexHomeEnvironment(params.startOptions, params.agentDir);
@@ -132,6 +135,10 @@ function resolveCodexAppServerEnvApiKeyCacheKey(params) {
 	hash.update(apiKey.value);
 	return `${apiKey.key}:sha256:${hash.digest("hex")}`;
 }
+function resolveCodexAppServerFallbackApiKeyCacheKey(params) {
+	if (params.startOptions.transport !== "stdio") return;
+	return resolveCodexAppServerEnvApiKeyCacheKey(params) ?? resolveCodexCliAuthFileApiKeyCacheKey(params.baseEnv ?? process.env);
+}
 function fingerprintApiKeyAuthProfileCacheKey(apiKey) {
 	const hash = createHash("sha256");
 	hash.update("openclaw:codex:app-server-auth-profile-api-key:v1");
@@ -146,6 +153,13 @@ function fingerprintTokenAuthProfileCacheKey(accessToken) {
 	hash.update(accessToken);
 	return `token:sha256:${hash.digest("hex")}`;
 }
+function fingerprintCodexCliAuthFileApiKeyCacheKey(apiKey) {
+	const hash = createHash("sha256");
+	hash.update("openclaw:codex:app-server-cli-auth-json-api-key:v1");
+	hash.update("\0");
+	hash.update(apiKey);
+	return `CODEX_AUTH_JSON:sha256:${hash.digest("hex")}`;
+}
 function resolveCodexAppServerHomeDir(agentDir) {
 	return path.join(path.resolve(agentDir), CODEX_APP_SERVER_HOME_DIRNAME);
 }
@@ -183,9 +197,10 @@ async function applyCodexAppServerAuthProfile(params) {
 	if (!loginParams) {
 		if (params.startOptions?.transport !== "stdio") return;
 		const env = resolveCodexAppServerSpawnEnv(params.startOptions, process.env);
-		const fallbackLoginParams = await resolveCodexAppServerEnvApiKeyLoginParams({
+		const fallbackLoginParams = await resolveCodexAppServerFallbackApiKeyLoginParams({
 			client: params.client,
-			env
+			env,
+			codexCliAuthEnv: process.env
 		});
 		if (fallbackLoginParams) await params.client.request("account/login/start", fallbackLoginParams);
 		return;
@@ -230,16 +245,54 @@ async function resolveCodexAppServerAuthProfileLoginParamsInternal(params) {
 	if (!loginParams) throw new Error(`Codex app-server auth profile "${profileId}" does not contain usable credentials.`);
 	return loginParams;
 }
-async function resolveCodexAppServerEnvApiKeyLoginParams(params) {
-	const apiKey = readFirstNonEmptyEnv(params.env, CODEX_APP_SERVER_API_KEY_ENV_VARS);
+async function resolveCodexAppServerFallbackApiKeyLoginParams(params) {
+	const apiKey = readFirstNonEmptyEnv(params.env, CODEX_APP_SERVER_API_KEY_ENV_VARS) ?? await readCodexCliAuthFileApiKey(params.codexCliAuthEnv);
 	if (!apiKey) return;
-	const response = await params.client.request("account/read", { refreshToken: false });
-	if (response.account || !response.requiresOpenaiAuth) return;
+	if ((await params.client.request("account/read", { refreshToken: false })).account) return;
 	return {
 		type: "apiKey",
 		apiKey
 	};
 }
+function resolveCodexCliAuthFilePath(env) {
+	const configuredCodexHome = env[CODEX_HOME_ENV_VAR]?.trim();
+	if (configuredCodexHome) return path.join(resolveHomeRelativePath(configuredCodexHome, env), CODEX_AUTH_JSON_FILENAME);
+	const home = env[HOME_ENV_VAR]?.trim() || env.USERPROFILE?.trim() || os.homedir();
+	return path.join(home, CODEX_HOME_DIRNAME, CODEX_AUTH_JSON_FILENAME);
+}
+function resolveHomeRelativePath(value, env) {
+	if (value === "~" || value.startsWith("~/") || value.startsWith("~\\")) {
+		const home = env[HOME_ENV_VAR]?.trim() || env.USERPROFILE?.trim() || os.homedir();
+		return path.join(home, value.slice(value === "~" ? 1 : 2));
+	}
+	return value;
+}
+function parseCodexCliAuthFileApiKey(raw) {
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		return;
+	}
+	if (!parsed || typeof parsed !== "object") return;
+	const apiKey = parsed.OPENAI_API_KEY;
+	return typeof apiKey === "string" && apiKey.trim() ? apiKey.trim() : void 0;
+}
+async function readCodexCliAuthFileApiKey(env) {
+	try {
+		return parseCodexCliAuthFileApiKey(await fs.readFile(resolveCodexCliAuthFilePath(env), "utf8"));
+	} catch {
+		return;
+	}
+}
+function resolveCodexCliAuthFileApiKeyCacheKey(env) {
+	try {
+		const apiKey = parseCodexCliAuthFileApiKey(fsSync.readFileSync(resolveCodexCliAuthFilePath(env), "utf8"));
+		return apiKey ? fingerprintCodexCliAuthFileApiKeyCacheKey(apiKey) : void 0;
+	} catch {
+		return;
+	}
+}
 async function resolveLoginParamsForCredential(profileId, credential, params) {
 	if (credential.type === "api_key") {
 		const apiKey = (await resolveApiKeyForProfile({
@@ -514,9 +567,11 @@ async function getSharedCodexAppServerClient(options) {
 		authProfileId: usesNativeAuth ? null : authProfileId,
 		config: options?.config
 	});
+	const fallbackApiKeyCacheKey = authProfileId ? void 0 : resolveCodexAppServerFallbackApiKeyCacheKey({ startOptions });
 	const key = codexAppServerStartOptionsKey(startOptions, {
 		authProfileId,
-		agentDir: usesNativeAuth ? void 0 : agentDir
+		agentDir: usesNativeAuth ? void 0 : agentDir,
+		fallbackApiKeyCacheKey
 	});
 	const state = getSharedCodexAppServerClientState();
 	const entry = getOrCreateSharedClientEntry(state, key);
@@ -628,4 +683,4 @@ function collectSharedClients(state) {
 	return [...new Set([...state.clients.values()].map((entry) => entry.client).filter((client) => Boolean(client)))];
 }
 //#endregion
-export { shared_client_exports as a, resolveCodexAppServerAuthAccountCacheKey as c, resolveCodexAppServerEnvApiKeyCacheKey as d, resolveCodexAppServerHomeDir as f, getSharedCodexAppServerClient as i, resolveCodexAppServerAuthProfileId as l, clearSharedCodexAppServerClientIfCurrentAndWait as n, withTimeout$1 as o, createIsolatedCodexAppServerClient as r, refreshCodexAppServerAuthTokens as s, clearSharedCodexAppServerClientIfCurrent as t, resolveCodexAppServerAuthProfileIdForAgent as u };
+export { shared_client_exports as a, resolveCodexAppServerAuthAccountCacheKey as c, resolveCodexAppServerFallbackApiKeyCacheKey as d, resolveCodexAppServerHomeDir as f, getSharedCodexAppServerClient as i, resolveCodexAppServerAuthProfileId as l, clearSharedCodexAppServerClientIfCurrentAndWait as n, withTimeout$1 as o, createIsolatedCodexAppServerClient as r, refreshCodexAppServerAuthTokens as s, clearSharedCodexAppServerClientIfCurrent as t, resolveCodexAppServerAuthProfileIdForAgent as u };

package/dist/{side-question-CYFMTA1O.js → side-question-fq_T2d_x.js}

@@ -1,14 +1,13 @@
-import { c as readCodexPluginConfig, l as resolveCodexAppServerRuntimeOptions } from "./config-DDMrwfJl.js";
-import { a as readCodexDynamicToolCallParams, c as readCodexTurn, i as assertCodexTurnStartResponse, t as assertCodexThreadForkResponse } from "./protocol-validators-_gKDcd0x.js";
-import { t as isJsonObject } from "./protocol-oeJQu4rs.js";
-import { i as isCodexAppServerApprovalRequest } from "./client-1sSy4p3z.js";
-import { d as resolveCodexAppServerModelProvider, f as resolveReasoningEffort, g as mergeCodexThreadConfigs, n as buildCodexRuntimeThreadConfig } from "./thread-lifecycle-DGoaguJh.js";
-import { i as readCodexAppServerBinding } from "./session-binding-Bw_mfIW2.js";
-import { i as readCodexNotificationTurnId, m as formatCodexUsageLimitErrorMessage, r as readCodexNotificationThreadId } from "./notification-correlation-qKY_sgga.js";
-import { i as getSharedCodexAppServerClient, s as refreshCodexAppServerAuthTokens } from "./shared-client-CFCUGEVs.js";
+import { c as readCodexPluginConfig, f as shouldAutoApproveCodexAppServerApprovals, l as resolveCodexAppServerRuntimeOptions } from "./config-0-UN67Qg.js";
+import { a as readCodexDynamicToolCallParams, c as readCodexTurn, i as assertCodexTurnStartResponse, t as assertCodexThreadForkResponse } from "./protocol-validators-CSuFMLvY.js";
+import { i as isCodexAppServerApprovalRequest, l as isJsonObject } from "./client-BVK_jmHW.js";
+import { f as resolveCodexAppServerModelProvider, p as resolveReasoningEffort, r as buildCodexRuntimeThreadConfig, t as CODEX_NATIVE_PERSONALITY_NONE, v as mergeCodexThreadConfigs } from "./thread-lifecycle-BapIT9Qs.js";
+import { i as readCodexAppServerBinding } from "./session-binding-UFjjws4k.js";
+import { i as readCodexNotificationTurnId, m as formatCodexUsageLimitErrorMessage, r as readCodexNotificationThreadId } from "./notification-correlation-YINts3PA.js";
+import { i as getSharedCodexAppServerClient, s as refreshCodexAppServerAuthTokens } from "./shared-client-Fou5nAyt.js";
 import { n as resolveCodexNativeExecutionBlock } from "./sandbox-guard-CTnEWuor.js";
-import { a as resolveCodexDynamicToolsLoading, n as filterCodexDynamicTools, t as createCodexDynamicToolBridge } from "./dynamic-tools-Bq717oJR.js";
-import { a as handleCodexAppServerElicitationRequest, c as emitDynamicToolTerminalDiagnostic, i as buildCodexNativeHookRelayDisabledConfig, l as handleCodexAppServerApprovalRequest, n as CODEX_NATIVE_HOOK_RELAY_EVENTS, o as emitDynamicToolErrorDiagnostic, r as buildCodexNativeHookRelayConfig, s as emitDynamicToolStartedDiagnostic, t as filterToolsForVisionInputs } from "./vision-tools-DOnxzH2y.js";
+import { a as resolveCodexDynamicToolsLoading, n as filterCodexDynamicTools, t as createCodexDynamicToolBridge } from "./dynamic-tools-BG9ICyU4.js";
+import { a as handleCodexAppServerElicitationRequest, c as emitDynamicToolTerminalDiagnostic, i as buildCodexNativeHookRelayDisabledConfig, l as handleCodexAppServerApprovalRequest, n as CODEX_NATIVE_HOOK_RELAY_EVENTS, o as emitDynamicToolErrorDiagnostic, r as buildCodexNativeHookRelayConfig, s as emitDynamicToolStartedDiagnostic, t as filterToolsForVisionInputs } from "./vision-tools-B30YCKRK.js";
 import { n as rememberCodexRateLimits, t as readRecentCodexRateLimits } from "./rate-limit-cache-N66I-Rd7.js";
 import { buildAgentHookContextChannelFields, embeddedAgentLog, formatErrorMessage, registerNativeHookRelay, resolveAgentDir, resolveAttemptSpawnWorkspaceDir, resolveModelAuthMode, resolveSandboxContext, resolveSessionAgentIds, supportsModelTools } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/side-question.ts
@@ -84,6 +83,8 @@ async function runCodexAppServerSideQuestion(params, options = {}) {
 			cwd,
 			authProfileId
 		});
+		const approvalPolicy = binding.approvalPolicy ?? appServer.approvalPolicy;
+		const sandbox = binding.sandbox ?? appServer.sandbox;
 		const { sessionAgentId } = resolveSessionAgentIds({
 			sessionKey: params.sessionKey,
 			config: params.cfg,
@@ -119,6 +120,10 @@ async function runCodexAppServerSideQuestion(params, options = {}) {
 				threadId: childThreadId,
 				turnId,
 				nativeHookRelay,
+				autoApprove: shouldAutoApproveCodexAppServerApprovals({
+					approvalPolicy,
+					sandbox
+				}),
 				signal: runAbortController.signal
 			});
 			if (request.method !== "item/tool/call") return;
@@ -160,8 +165,6 @@ async function runCodexAppServerSideQuestion(params, options = {}) {
 				throw error;
 			}
 		});
-		const approvalPolicy = binding.approvalPolicy ?? appServer.approvalPolicy;
-		const sandbox = binding.sandbox ?? appServer.sandbox;
 		const serviceTier = binding.serviceTier ?? appServer.serviceTier;
 		const nativeHookRelayEvents = resolveCodexSideNativeHookRelayEvents({
 			configuredEvents: options.nativeHookRelay?.events,
@@ -203,6 +206,7 @@ async function runCodexAppServerSideQuestion(params, options = {}) {
 			threadId: binding.threadId,
 			model: params.model,
 			...modelProvider ? { modelProvider } : {},
+			personality: CODEX_NATIVE_PERSONALITY_NONE,
 			cwd,
 			approvalPolicy,
 			approvalsReviewer: appServer.approvalsReviewer,
@@ -233,6 +237,7 @@ async function runCodexAppServerSideQuestion(params, options = {}) {
 			}],
 			cwd,
 			model: params.model,
+			personality: CODEX_NATIVE_PERSONALITY_NONE,
 			...serviceTier ? { serviceTier } : {},
 			effort,
 			collaborationMode: {

package/dist/test-api.js

@@ -1,6 +1,6 @@
-import { l as resolveCodexAppServerRuntimeOptions } from "./config-DDMrwfJl.js";
-import { a as buildThreadResumeParams, c as buildTurnStartParams, i as buildDeveloperInstructions, o as buildThreadStartParams } from "./thread-lifecycle-DGoaguJh.js";
-import { n as filterCodexDynamicTools, t as createCodexDynamicToolBridge } from "./dynamic-tools-Bq717oJR.js";
+import { l as resolveCodexAppServerRuntimeOptions } from "./config-0-UN67Qg.js";
+import { a as buildDeveloperInstructions, l as buildTurnStartParams, o as buildThreadResumeParams, s as buildThreadStartParams } from "./thread-lifecycle-BapIT9Qs.js";
+import { n as filterCodexDynamicTools, t as createCodexDynamicToolBridge } from "./dynamic-tools-BG9ICyU4.js";
 //#region extensions/codex/test-api.ts
 function resolveCodexPromptSnapshotAppServerOptions(pluginConfig) {
 	return resolveCodexAppServerRuntimeOptions({

package/dist/{thread-lifecycle-DGoaguJh.js → thread-lifecycle-BapIT9Qs.js}

@@ -1,17 +1,18 @@
-import { d as resolveCodexPluginsPolicy, r as codexSandboxPolicyForTurn, t as CODEX_PLUGINS_MARKETPLACE_NAME } from "./config-DDMrwfJl.js";
-import { n as assertCodexThreadResumeResponse, r as assertCodexThreadStartResponse } from "./protocol-validators-_gKDcd0x.js";
-import { t as isJsonObject } from "./protocol-oeJQu4rs.js";
+import { d as resolveCodexPluginsPolicy, r as codexSandboxPolicyForTurn, t as CODEX_PLUGINS_MARKETPLACE_NAME } from "./config-0-UN67Qg.js";
+import { n as assertCodexThreadResumeResponse, r as assertCodexThreadStartResponse } from "./protocol-validators-CSuFMLvY.js";
+import { a as isCodexAppServerConnectionClosedError, l as isJsonObject } from "./client-BVK_jmHW.js";
 import { CODEX_GPT5_HEARTBEAT_PROMPT_OVERLAY } from "./prompt-overlay.js";
 import { isModernCodexModel } from "./provider.js";
-import { a as isCodexAppServerConnectionClosedError } from "./client-1sSy4p3z.js";
-import { i as readCodexAppServerBinding, n as isCodexAppServerNativeAuthProfile, o as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-Bw_mfIW2.js";
+import { i as readCodexAppServerBinding, n as isCodexAppServerNativeAuthProfile, o as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-UFjjws4k.js";
 import crypto from "node:crypto";
+import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { embeddedAgentLog, isActiveHarnessContextEngine } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { buildCodexUserMcpServersThreadConfigPatch } from "openclaw/plugin-sdk/codex-mcp-projection";
 import { listRegisteredPluginAgentPromptGuidance } from "openclaw/plugin-sdk/plugin-runtime";
 import { redactSensitiveFieldValue, redactToolPayloadText } from "openclaw/plugin-sdk/logging-core";
 import "node:fs/promises";
 import "node:path";
+import { isDiagnosticFlagEnabled } from "openclaw/plugin-sdk/diagnostic-runtime";
 //#region extensions/codex/src/app-server/context-engine-projection.ts
 const CONTEXT_HEADER = "OpenClaw assembled context for this turn:";
 const CONTEXT_OPEN = "<conversation_context>";
@@ -301,9 +302,6 @@ function sanitizeInlineImageDataUrl(imageUrl) {
 function invalidInlineImageText(label) {
 	return `[${label}] ${IMAGE_OMITTED_TEXT}`;
 }
-function isRecord$1(value) {
-	return Boolean(value && typeof value === "object" && !Array.isArray(value));
-}
 function sanitizeImageContentRecord(record, label) {
 	if (record.type === "image" && typeof record.data === "string") {
 		const mimeType = typeof record.mimeType === "string" ? record.mimeType : "image/png";
@@ -343,7 +341,7 @@ function sanitizeImageContentRecord(record, label) {
 }
 function sanitizeCodexHistoryImagePayloads(value, label) {
 	if (Array.isArray(value)) return value.map((entry) => sanitizeCodexHistoryImagePayloads(entry, label));
-	if (!isRecord$1(value)) return value;
+	if (!isRecord(value)) return value;
 	const imageRecord = sanitizeImageContentRecord(value, label);
 	if (imageRecord) return imageRecord;
 	const next = {};
@@ -512,9 +510,6 @@ function fingerprintInventoryCacheKey(key) {
 	for (let index = 0; index < key.length; index += 1) hash = hash * 31 + key.charCodeAt(index) >>> 0;
 	return hash.toString(16).padStart(8, "0");
 }
-function isRecord(value) {
-	return Boolean(value && typeof value === "object" && !Array.isArray(value));
-}
 function redactErrorData(value, depth = 0) {
 	if (value === void 0) return;
 	if (value === null || typeof value === "boolean" || typeof value === "number") return value;
@@ -1073,7 +1068,14 @@ function stableStringify(value) {
 	return JSON.stringify(value);
 }
 //#endregion
+//#region extensions/codex/src/app-server/profiler-flag.ts
+const PROFILER_FLAGS = ["profiler", "codex.profiler"];
+function isCodexAppServerProfilerEnabled(config, env = process.env) {
+	return PROFILER_FLAGS.some((flag) => isDiagnosticFlagEnabled(flag, config, env));
+}
+//#endregion
 //#region extensions/codex/src/app-server/thread-lifecycle.ts
+const CODEX_NATIVE_PERSONALITY_NONE = "none";
 const CODEX_CODE_MODE_THREAD_CONFIG = {
 	"features.code_mode": true,
 	"features.code_mode_only": false
@@ -1083,17 +1085,81 @@ const CODEX_CODE_MODE_DISABLED_THREAD_CONFIG = {
 	"features.code_mode_only": false
 };
 const CODEX_LIGHTWEIGHT_CONTEXT_THREAD_CONFIG = { project_doc_max_bytes: 0 };
+const CODEX_THREAD_LIFECYCLE_TIMING_WARN_TOTAL_MS = 1e3;
+const CODEX_THREAD_LIFECYCLE_TIMING_WARN_STAGE_MS = 500;
+function createCodexThreadLifecycleTimingTracker(options = {}) {
+	if (!options.enabled) return {
+		async measure(_name, run) {
+			return await run();
+		},
+		measureSync(_name, run) {
+			return run();
+		},
+		logIfSlow() {}
+	};
+	const startedAt = Date.now();
+	let didLog = false;
+	const spans = [];
+	const toMs = (value) => Math.max(0, Math.round(value));
+	const record = (name, spanStartedAt) => {
+		spans.push({
+			name,
+			durationMs: toMs(Date.now() - spanStartedAt),
+			elapsedMs: toMs(Date.now() - startedAt)
+		});
+	};
+	const snapshot = () => ({
+		totalMs: toMs(Date.now() - startedAt),
+		spans: spans.slice()
+	});
+	const shouldLog = (summary) => summary.totalMs >= CODEX_THREAD_LIFECYCLE_TIMING_WARN_TOTAL_MS || summary.spans.some((span) => span.durationMs >= CODEX_THREAD_LIFECYCLE_TIMING_WARN_STAGE_MS);
+	const formatSpans = (summary) => summary.spans.length > 0 ? summary.spans.map((span) => `${span.name}:${span.durationMs}ms@${span.elapsedMs}ms`).join(",") : "none";
+	return {
+		async measure(name, run) {
+			const spanStartedAt = Date.now();
+			try {
+				return await run();
+			} finally {
+				record(name, spanStartedAt);
+			}
+		},
+		measureSync(name, run) {
+			const spanStartedAt = Date.now();
+			try {
+				return run();
+			} finally {
+				record(name, spanStartedAt);
+			}
+		},
+		logIfSlow(params) {
+			if (didLog) return;
+			const summary = snapshot();
+			if (!shouldLog(summary)) return;
+			didLog = true;
+			embeddedAgentLog.warn(`codex app-server thread lifecycle timings runId=${params.runId} sessionId=${params.sessionId} sessionKey=${params.sessionKey ?? "unknown"} action=${params.action} totalMs=${summary.totalMs} stages=${formatSpans(summary)}`, {
+				runId: params.runId,
+				sessionId: params.sessionId,
+				sessionKey: params.sessionKey,
+				action: params.action,
+				threadId: params.threadId,
+				totalMs: summary.totalMs,
+				spans: summary.spans
+			});
+		}
+	};
+}
 async function startOrResumeThread(params) {
-	const dynamicToolsFingerprint = fingerprintDynamicTools(params.dynamicTools);
-	const contextEngineBinding = buildContextEngineBinding(params.params, params.contextEngineProjection);
+	const lifecycleTiming = createCodexThreadLifecycleTimingTracker({ enabled: isCodexAppServerProfilerEnabled(params.params.config) });
+	const dynamicToolsFingerprint = lifecycleTiming.measureSync("fingerprint_dynamic_tools", () => fingerprintDynamicTools(params.dynamicTools));
+	const contextEngineBinding = lifecycleTiming.measureSync("context_engine_binding", () => buildContextEngineBinding(params.params, params.contextEngineProjection));
 	const userMcpServersConfigPatch = params.userMcpServersEnabled === false ? void 0 : buildCodexUserMcpServersThreadConfigPatch(params.params.config, { agentId: params.agentId ?? params.params.agentId });
 	const userMcpServersFingerprint = fingerprintUserMcpServersConfigPatch(userMcpServersConfigPatch);
 	const environmentSelectionFingerprint = fingerprintEnvironmentSelection(params.environmentSelection);
-	let binding = await readCodexAppServerBinding(params.params.sessionFile, {
+	let binding = await lifecycleTiming.measure("read_binding", () => readCodexAppServerBinding(params.params.sessionFile, {
 		authProfileStore: params.params.authProfileStore,
 		agentDir: params.params.agentDir,
 		config: params.params.config
-	});
+	}));
 	let preserveExistingBinding = false;
 	let rotatedContextEngineBinding = false;
 	let prebuiltPluginThreadConfig;
@@ -1147,7 +1213,7 @@ async function startOrResumeThread(params) {
 			binding,
 			pluginThreadConfig: params.pluginThreadConfig
 		})) try {
-			prebuiltPluginThreadConfig = await params.pluginThreadConfig?.build();
+			prebuiltPluginThreadConfig = await lifecycleTiming.measure("plugin_config_recovery", () => params.pluginThreadConfig?.build());
 			pluginBindingStale = prebuiltPluginThreadConfig?.fingerprint !== binding.pluginAppsFingerprint;
 		} catch (error) {
 			embeddedAgentLog.warn("codex app-server plugin app config recovery check failed", {
@@ -1179,7 +1245,7 @@ async function startOrResumeThread(params) {
 	} else try {
 		const authProfileId = params.params.authProfileId ?? binding.authProfileId;
 		const resumeConfig = mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, params.finalConfigPatch);
-		const response = assertCodexThreadResumeResponse(await params.client.request("thread/resume", buildThreadResumeParams(params.params, {
+		const resumeParams = lifecycleTiming.measureSync("thread_resume_params", () => buildThreadResumeParams(params.params, {
 			threadId: binding.threadId,
 			authProfileId,
 			appServer: params.appServer,
@@ -1188,7 +1254,8 @@ async function startOrResumeThread(params) {
 			config: resumeConfig,
 			nativeCodeModeEnabled: params.nativeCodeModeEnabled,
 			nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled
-		})));
+		}));
+		const response = assertCodexThreadResumeResponse(await lifecycleTiming.measure("thread_resume_request", () => params.client.request("thread/resume", resumeParams)));
 		const boundAuthProfileId = authProfileId;
 		const fallbackModelProvider = resolveCodexAppServerModelProvider({
 			provider: params.params.provider,
@@ -1198,7 +1265,7 @@ async function startOrResumeThread(params) {
 			config: params.params.config
 		});
 		const nextMcpServersFingerprint = params.mcpServersFingerprintEvaluated === true ? params.mcpServersFingerprint : binding.mcpServersFingerprint;
-		await writeCodexAppServerBinding(params.params.sessionFile, {
+		await lifecycleTiming.measure("thread_resume_write_binding", () => writeCodexAppServerBinding(params.params.sessionFile, {
 			threadId: response.thread.id,
 			cwd: params.cwd,
 			authProfileId: boundAuthProfileId,
@@ -1217,7 +1284,7 @@ async function startOrResumeThread(params) {
 			authProfileStore: params.params.authProfileStore,
 			agentDir: params.params.agentDir,
 			config: params.params.config
-		});
+		}));
 		if (contextEngineBinding) embeddedAgentLog.info("codex app-server wrote context-engine thread binding", {
 			sessionId: params.params.sessionId,
 			sessionKey: params.params.sessionKey,
@@ -1227,6 +1294,13 @@ async function startOrResumeThread(params) {
 			fingerprint: contextEngineBinding.projection?.fingerprint,
 			action: "resumed"
 		});
+		lifecycleTiming.logIfSlow({
+			runId: params.params.runId,
+			sessionId: params.params.sessionId,
+			sessionKey: params.params.sessionKey,
+			threadId: response.thread.id,
+			action: "resumed"
+		});
 		return {
 			...binding,
 			threadId: response.thread.id,
@@ -1249,9 +1323,9 @@ async function startOrResumeThread(params) {
 		embeddedAgentLog.warn("codex app-server thread resume failed; starting a new thread", { error });
 		await clearCodexAppServerBinding(params.params.sessionFile);
 	}
-	const pluginThreadConfig = params.pluginThreadConfig?.enabled ? prebuiltPluginThreadConfig ?? await params.pluginThreadConfig.build() : void 0;
-	const config = mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginThreadConfig?.configPatch, params.finalConfigPatch);
-	const response = assertCodexThreadStartResponse(await params.client.request("thread/start", buildThreadStartParams(params.params, {
+	const pluginThreadConfig = params.pluginThreadConfig?.enabled ? prebuiltPluginThreadConfig ?? await lifecycleTiming.measure("plugin_config_build", () => params.pluginThreadConfig?.build()) : void 0;
+	const config = lifecycleTiming.measureSync("merge_thread_config", () => mergeCodexThreadConfigs(params.config, userMcpServersConfigPatch, pluginThreadConfig?.configPatch, params.finalConfigPatch));
+	const startParams = lifecycleTiming.measureSync("thread_start_params", () => buildThreadStartParams(params.params, {
 		cwd: params.cwd,
 		dynamicTools: params.dynamicTools,
 		appServer: params.appServer,
@@ -1260,7 +1334,8 @@ async function startOrResumeThread(params) {
 		nativeCodeModeEnabled: params.nativeCodeModeEnabled,
 		nativeCodeModeOnlyEnabled: params.nativeCodeModeOnlyEnabled,
 		environmentSelection: params.environmentSelection
-	})));
+	}));
+	const response = assertCodexThreadStartResponse(await lifecycleTiming.measure("thread_start_request", () => params.client.request("thread/start", startParams)));
 	const modelProvider = resolveCodexAppServerModelProvider({
 		provider: params.params.provider,
 		authProfileId: params.params.authProfileId,
@@ -1271,7 +1346,7 @@ async function startOrResumeThread(params) {
 	const createdAt = (/* @__PURE__ */ new Date()).toISOString();
 	const nextMcpServersFingerprint = params.mcpServersFingerprintEvaluated === true ? params.mcpServersFingerprint : void 0;
 	if (!preserveExistingBinding) {
-		await writeCodexAppServerBinding(params.params.sessionFile, {
+		await lifecycleTiming.measure("thread_start_write_binding", () => writeCodexAppServerBinding(params.params.sessionFile, {
 			threadId: response.thread.id,
 			cwd: params.cwd,
 			authProfileId: params.params.authProfileId,
@@ -1290,7 +1365,7 @@ async function startOrResumeThread(params) {
 			authProfileStore: params.params.authProfileStore,
 			agentDir: params.params.agentDir,
 			config: params.params.config
-		});
+		}));
 		if (contextEngineBinding) embeddedAgentLog.info("codex app-server wrote context-engine thread binding", {
 			sessionId: params.params.sessionId,
 			sessionKey: params.params.sessionKey,
@@ -1301,6 +1376,13 @@ async function startOrResumeThread(params) {
 			action: rotatedContextEngineBinding ? "rotated" : "started"
 		});
 	}
+	lifecycleTiming.logIfSlow({
+		runId: params.params.runId,
+		sessionId: params.params.sessionId,
+		sessionKey: params.params.sessionKey,
+		threadId: response.thread.id,
+		action: rotatedContextEngineBinding ? "rotated" : "started"
+	});
 	return {
 		schemaVersion: 1,
 		threadId: response.thread.id,
@@ -1401,6 +1483,7 @@ function buildThreadStartParams(params, options) {
 		approvalsReviewer: options.appServer.approvalsReviewer,
 		sandbox: options.appServer.sandbox,
 		...options.appServer.serviceTier ? { serviceTier: options.appServer.serviceTier } : {},
+		personality: CODEX_NATIVE_PERSONALITY_NONE,
 		serviceName: "OpenClaw",
 		config: buildCodexRuntimeThreadConfigForRun(params, options.config, {
 			nativeCodeModeEnabled: options.nativeCodeModeEnabled,
@@ -1429,6 +1512,7 @@ function buildThreadResumeParams(params, options) {
 		approvalsReviewer: options.appServer.approvalsReviewer,
 		sandbox: options.appServer.sandbox,
 		...options.appServer.serviceTier ? { serviceTier: options.appServer.serviceTier } : {},
+		personality: CODEX_NATIVE_PERSONALITY_NONE,
 		config: buildCodexRuntimeThreadConfigForRun(params, options.config, {
 			nativeCodeModeEnabled: options.nativeCodeModeEnabled,
 			nativeCodeModeOnlyEnabled: options.nativeCodeModeOnlyEnabled
@@ -1466,6 +1550,7 @@ function buildTurnStartParams(params, options) {
 		approvalsReviewer: options.appServer.approvalsReviewer,
 		sandboxPolicy: options.sandboxPolicy ?? codexSandboxPolicyForTurn(options.appServer.sandbox, options.cwd),
 		model: params.modelId,
+		personality: CODEX_NATIVE_PERSONALITY_NONE,
 		...options.appServer.serviceTier ? { serviceTier: options.appServer.serviceTier } : {},
 		effort: resolveReasoningEffort(params.thinkLevel, params.modelId),
 		...options.environmentSelection ? { environments: options.environmentSelection } : {},
@@ -1625,4 +1710,4 @@ function resolveReasoningEffort(thinkLevel, modelId) {
 	return null;
 }
 //#endregion
-export { sanitizeCodexHistoryImagePayloads as C, resolveCodexContextEngineProjectionMaxChars as D, projectContextEngineAssemblyForCodex as E, resolveCodexContextEngineProjectionReserveTokens as O, invalidInlineImageText as S, DEFAULT_CODEX_PROJECTION_RESERVE_TOKENS as T, shouldBuildCodexPluginThreadConfig as _, buildThreadResumeParams as a, buildCodexAppInventoryCacheKey as b, buildTurnStartParams as c, resolveCodexAppServerModelProvider as d, resolveReasoningEffort as f, mergeCodexThreadConfigs as g, buildCodexPluginThreadConfigInputFingerprint as h, buildDeveloperInstructions as i, codexDynamicToolsFingerprint as l, buildCodexPluginThreadConfig as m, buildCodexRuntimeThreadConfig as n, buildThreadStartParams as o, startOrResumeThread as p, buildContextEngineBinding as r, buildTurnCollaborationMode as s, areCodexDynamicToolFingerprintsCompatible as t, isContextEngineBindingCompatible as u, ensureCodexPluginActivation as v, sanitizeInlineImageDataUrl as w, defaultCodexAppInventoryCache as x, pluginReadParams as y };
+export { defaultCodexAppInventoryCache as C, projectContextEngineAssemblyForCodex as D, sanitizeInlineImageDataUrl as E, resolveCodexContextEngineProjectionMaxChars as O, buildCodexAppInventoryCacheKey as S, sanitizeCodexHistoryImagePayloads as T, buildCodexPluginThreadConfigInputFingerprint as _, buildDeveloperInstructions as a, ensureCodexPluginActivation as b, buildTurnCollaborationMode as c, isContextEngineBindingCompatible as d, resolveCodexAppServerModelProvider as f, buildCodexPluginThreadConfig as g, isCodexAppServerProfilerEnabled as h, buildContextEngineBinding as i, resolveCodexContextEngineProjectionReserveTokens as k, buildTurnStartParams as l, startOrResumeThread as m, areCodexDynamicToolFingerprintsCompatible as n, buildThreadResumeParams as o, resolveReasoningEffort as p, buildCodexRuntimeThreadConfig as r, buildThreadStartParams as s, CODEX_NATIVE_PERSONALITY_NONE as t, codexDynamicToolsFingerprint as u, mergeCodexThreadConfigs as v, invalidInlineImageText as w, pluginReadParams as x, shouldBuildCodexPluginThreadConfig as y };

package/dist/{vision-tools-DOnxzH2y.js → vision-tools-B30YCKRK.js}

@@ -1,6 +1,7 @@
-import { t as isJsonObject } from "./protocol-oeJQu4rs.js";
-import { s as formatCodexDisplayText } from "./notification-correlation-qKY_sgga.js";
+import { l as isJsonObject } from "./client-BVK_jmHW.js";
+import { s as formatCodexDisplayText } from "./notification-correlation-YINts3PA.js";
 import { createHash } from "node:crypto";
+import { normalizeTrimmedStringList } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { buildAgentHookContextChannelFields, callGatewayTool, embeddedAgentLog, formatApprovalDisplayPath, hasNativeHookRelayInvocation, invokeNativeHookRelay, runBeforeToolCallHook } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { emitTrustedDiagnosticEvent } from "openclaw/plugin-sdk/diagnostic-runtime";
 //#region extensions/codex/src/app-server/plugin-approval-roundtrip.ts
@@ -106,6 +107,18 @@ async function handleCodexAppServerApprovalRequest(params) {
 			});
 			return buildApprovalResponse(params.method, context.requestParams, "denied");
 		}
+		if (params.autoApprove === true) {
+			emitApprovalEvent(params.paramsForRun, {
+				phase: "resolved",
+				kind: context.kind,
+				status: "approved",
+				title: context.title,
+				...context.eventDetails,
+				...approvalEventScope(params.method, "approved-session"),
+				message: "Codex app-server approval auto-approved by runtime policy."
+			});
+			return buildApprovalResponse(params.method, context.requestParams, "approved-session");
+		}
 		const requestResult = await requestPluginApproval({
 			paramsForRun: params.paramsForRun,
 			title: context.title,
@@ -567,8 +580,7 @@ function summarizeNetworkPolicyAmendments(value) {
 	return `Proposed network policy: ${samples.join(", ")}${remainderSuffix}`;
 }
 function readStringArray(record, key) {
-	const value = record[key];
-	return Array.isArray(value) ? value.map((entry) => typeof entry === "string" ? entry.trim() : "").filter(Boolean) : [];
+	return normalizeTrimmedStringList(record[key]);
 }
 function sanitizePermissionHostValue(value) {
 	const withoutScheme = sanitizePermissionScalar(value).toLowerCase().replace(/^[a-z][a-z0-9+.-]*:\/\//, "");