@openclaw/codex 2026.5.3 → 2026.5.4-beta.2

package/dist/{shared-client-0El8eRIE.js → shared-client-Dfk3Enm-.js}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-DUslC3ob.js";
-import { i as resolveCodexAppServerRuntimeOptions, t as codexAppServerStartOptionsKey } from "./config-CkkoMeqF.js";
-import { a as MANAGED_CODEX_APP_SERVER_PACKAGE, o as resolveCodexAppServerSpawnEnv, t as CodexAppServerClient } from "./client-chGfNrq5.js";
+import { i as resolveCodexAppServerRuntimeOptions, t as codexAppServerStartOptionsKey } from "./config-ByrA30No.js";
+import { a as MANAGED_CODEX_APP_SERVER_PACKAGE, o as resolveCodexAppServerSpawnEnv, t as CodexAppServerClient } from "./client-BGbqC7jk.js";
 import { createRequire } from "node:module";
 import fs, { access } from "node:fs/promises";
 import path from "node:path";
@@ -25,8 +25,10 @@ async function bridgeCodexAppServerStartOptions(params) {
 		store,
 		authProfileId: resolveCodexAppServerAuthProfileId({
 			authProfileId: params.authProfileId,
-			store
-		})
+			store,
+			config: params.config
+		}),
+		config: params.config
 	}) ? withClearedEnvironmentVariables(isolatedStartOptions, CODEX_APP_SERVER_API_KEY_ENV_VARS) : isolatedStartOptions;
 }
 function resolveCodexAppServerAuthProfileId(params) {
@@ -76,7 +78,8 @@ function withoutClearedCodexIsolationEnv(clearEnv) {
 async function applyCodexAppServerAuthProfile(params) {
 	const loginParams = await resolveCodexAppServerAuthProfileLoginParams({
 		agentDir: params.agentDir,
-		authProfileId: params.authProfileId
+		authProfileId: params.authProfileId,
+		config: params.config
 	});
 	if (!loginParams) {
 		if (params.startOptions?.transport !== "stdio") return;
@@ -109,15 +112,17 @@ async function resolveCodexAppServerAuthProfileLoginParamsInternal(params) {
 	const store = ensureAuthProfileStore(params.agentDir, { allowKeychainPrompt: false });
 	const profileId = resolveCodexAppServerAuthProfileId({
 		authProfileId: params.authProfileId,
-		store
+		store,
+		config: params.config
 	});
 	if (!profileId) return;
 	const credential = store.profiles[profileId];
 	if (!credential) throw new Error(`Codex app-server auth profile "${profileId}" was not found.`);
-	if (!isCodexAppServerAuthProvider(credential.provider)) throw new Error(`Codex app-server auth profile "${profileId}" must belong to provider "openai-codex" or a supported alias.`);
+	if (!isCodexAppServerAuthProvider(credential.provider, params.config)) throw new Error(`Codex app-server auth profile "${profileId}" must belong to provider "openai-codex" or a supported alias.`);
 	const loginParams = await resolveLoginParamsForCredential(profileId, credential, {
 		agentDir: params.agentDir,
-		forceOAuthRefresh: params.forceOAuthRefresh === true
+		forceOAuthRefresh: params.forceOAuthRefresh === true,
+		config: params.config
 	});
 	if (!loginParams) throw new Error(`Codex app-server auth profile "${profileId}" does not contain usable credentials.`);
 	return loginParams;
@@ -154,7 +159,8 @@ async function resolveLoginParamsForCredential(profileId, credential, params) {
 	}
 	const resolvedCredential = await resolveOAuthCredentialForCodexAppServer(profileId, credential, {
 		agentDir: params.agentDir,
-		forceRefresh: params.forceOAuthRefresh
+		forceRefresh: params.forceOAuthRefresh,
+		config: params.config
 	});
 	const accessToken = resolvedCredential.access?.trim();
 	return accessToken ? buildChatgptAuthTokensParams(profileId, resolvedCredential, accessToken) : void 0;
@@ -166,7 +172,7 @@ async function resolveOAuthCredentialForCodexAppServer(profileId, credential, pa
 	});
 	const store = ensureAuthProfileStore(ownerAgentDir, { allowKeychainPrompt: false });
 	const ownerCredential = store.profiles[profileId];
-	const credentialForOwner = ownerCredential?.type === "oauth" && isCodexAppServerAuthProvider(ownerCredential.provider) ? ownerCredential : credential;
+	const credentialForOwner = ownerCredential?.type === "oauth" && isCodexAppServerAuthProvider(ownerCredential.provider, params.config) ? ownerCredential : credential;
 	if (params.forceRefresh) {
 		store.profiles[profileId] = {
 			...credentialForOwner,
@@ -181,21 +187,21 @@ async function resolveOAuthCredentialForCodexAppServer(profileId, credential, pa
 	});
 	const refreshed = loadAuthProfileStoreForSecretsRuntime(ownerAgentDir).profiles[profileId];
 	const storedCredential = store.profiles[profileId];
-	const candidate = refreshed?.type === "oauth" && isCodexAppServerAuthProvider(refreshed.provider) ? refreshed : storedCredential?.type === "oauth" && isCodexAppServerAuthProvider(storedCredential.provider) ? storedCredential : credential;
+	const candidate = refreshed?.type === "oauth" && isCodexAppServerAuthProvider(refreshed.provider, params.config) ? refreshed : storedCredential?.type === "oauth" && isCodexAppServerAuthProvider(storedCredential.provider, params.config) ? storedCredential : credential;
 	return resolved?.apiKey ? {
 		...candidate,
 		access: resolved.apiKey
 	} : candidate;
 }
-function isCodexAppServerAuthProvider(provider) {
-	return resolveProviderIdForAuth(provider) === CODEX_APP_SERVER_AUTH_PROVIDER;
+function isCodexAppServerAuthProvider(provider, config) {
+	return resolveProviderIdForAuth(provider, { config }) === CODEX_APP_SERVER_AUTH_PROVIDER;
 }
 function shouldClearOpenAiApiKeyForCodexAuthProfile(params) {
 	const profileId = params.authProfileId?.trim();
-	return isCodexSubscriptionCredential(profileId ? params.store.profiles[profileId] : params.store.profiles[OPENAI_CODEX_DEFAULT_PROFILE_ID]);
+	return isCodexSubscriptionCredential(profileId ? params.store.profiles[profileId] : params.store.profiles[OPENAI_CODEX_DEFAULT_PROFILE_ID], params.config);
 }
-function isCodexSubscriptionCredential(credential) {
-	if (!credential || !isCodexAppServerAuthProvider(credential.provider)) return false;
+function isCodexSubscriptionCredential(credential, config) {
+	if (!credential || !isCodexAppServerAuthProvider(credential.provider, config)) return false;
 	return credential.type === "oauth" || credential.type === "token";
 }
 function withClearedEnvironmentVariables(startOptions, envVars) {
@@ -362,13 +368,19 @@ function getSharedCodexAppServerClientState() {
 async function getSharedCodexAppServerClient(options) {
 	const state = getSharedCodexAppServerClientState();
 	const agentDir = options?.agentDir ?? resolveOpenClawAgentDir$1();
+	const authProfileId = resolveCodexAppServerAuthProfileIdForAgent({
+		authProfileId: options?.authProfileId,
+		agentDir,
+		config: options?.config
+	});
 	const startOptions = await bridgeCodexAppServerStartOptions({
 		startOptions: await resolveManagedCodexAppServerStartOptions(options?.startOptions ?? resolveCodexAppServerRuntimeOptions().start),
 		agentDir,
-		authProfileId: options?.authProfileId
+		authProfileId,
+		config: options?.config
 	});
 	const key = codexAppServerStartOptionsKey(startOptions, {
-		authProfileId: options?.authProfileId,
+		authProfileId,
 		agentDir
 	});
 	if (state.key && state.key !== key) clearSharedCodexAppServerClient();
@@ -382,8 +394,9 @@ async function getSharedCodexAppServerClient(options) {
 			await applyCodexAppServerAuthProfile({
 				client,
 				agentDir,
-				authProfileId: options?.authProfileId,
-				startOptions
+				authProfileId,
+				startOptions,
+				config: options?.config
 			});
 			return client;
 		} catch (error) {
@@ -400,10 +413,16 @@ async function getSharedCodexAppServerClient(options) {
 }
 async function createIsolatedCodexAppServerClient(options) {
 	const agentDir = options?.agentDir ?? resolveOpenClawAgentDir$1();
+	const authProfileId = resolveCodexAppServerAuthProfileIdForAgent({
+		authProfileId: options?.authProfileId,
+		agentDir,
+		config: options?.config
+	});
 	const startOptions = await bridgeCodexAppServerStartOptions({
 		startOptions: await resolveManagedCodexAppServerStartOptions(options?.startOptions ?? resolveCodexAppServerRuntimeOptions().start),
 		agentDir,
-		authProfileId: options?.authProfileId
+		authProfileId,
+		config: options?.config
 	});
 	const client = CodexAppServerClient.start(startOptions);
 	const initialize = client.initialize();
@@ -412,8 +431,9 @@ async function createIsolatedCodexAppServerClient(options) {
 		await applyCodexAppServerAuthProfile({
 			client,
 			agentDir,
-			authProfileId: options?.authProfileId,
-			startOptions
+			authProfileId,
+			startOptions,
+			config: options?.config
 		});
 		return client;
 	} catch (error) {

package/dist/test-api.js

@@ -1,5 +1,5 @@
-import { i as resolveCodexAppServerRuntimeOptions } from "./config-CkkoMeqF.js";
-import { i as buildTurnStartParams, n as buildThreadResumeParams, o as createCodexDynamicToolBridge, r as buildThreadStartParams, s as applyCodexDynamicToolProfile, t as buildDeveloperInstructions } from "./thread-lifecycle-OAlp5Pku.js";
+import { i as resolveCodexAppServerRuntimeOptions } from "./config-ByrA30No.js";
+import { a as buildTurnStartParams, c as createCodexDynamicToolBridge, i as buildThreadStartParams, l as applyCodexDynamicToolProfile, n as buildDeveloperInstructions, r as buildThreadResumeParams } from "./thread-lifecycle-CzllX4PU.js";
 //#region extensions/codex/test-api.ts
 function resolveCodexPromptSnapshotAppServerOptions(pluginConfig) {
 	return resolveCodexAppServerRuntimeOptions({

package/dist/{thread-lifecycle-OAlp5Pku.js → thread-lifecycle-CzllX4PU.js}

@@ -1,9 +1,9 @@
-import { n as codexSandboxPolicyForTurn } from "./config-CkkoMeqF.js";
-import { n as assertCodexThreadStartResponse, t as assertCodexThreadResumeResponse } from "./protocol-validators-Cpopom3_.js";
+import { n as codexSandboxPolicyForTurn } from "./config-ByrA30No.js";
+import { n as assertCodexThreadStartResponse, t as assertCodexThreadResumeResponse } from "./protocol-validators-Dky2yV4W.js";
 import { t as isJsonObject } from "./protocol-C9UWI98H.js";
 import { CODEX_GPT5_HEARTBEAT_PROMPT_OVERLAY, renderCodexPromptOverlay } from "./prompt-overlay.js";
 import { isModernCodexModel } from "./provider.js";
-import { i as isCodexAppServerConnectionClosedError } from "./client-chGfNrq5.js";
+import { i as isCodexAppServerConnectionClosedError } from "./client-BGbqC7jk.js";
 import { i as readCodexAppServerBinding, n as isCodexAppServerNativeAuthProfile, o as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-DuJYTJQy.js";
 import { HEARTBEAT_RESPONSE_TOOL_NAME, createAgentToolResultMiddlewareRunner, createCodexAppServerToolResultExtensionRunner, embeddedAgentLog, extractToolResultMediaArtifact, filterToolResultMediaUrls, isMessagingTool, isMessagingToolSendAction, isToolWrappedWithBeforeToolCallHook, normalizeHeartbeatToolResponse, runAgentHarnessAfterToolCallHook, wrapToolWithBeforeToolCallHook } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/dynamic-tool-profile.ts
@@ -28,6 +28,7 @@ function applyCodexDynamicToolProfile(tools, config) {
 //#endregion
 //#region extensions/codex/src/app-server/dynamic-tools.ts
 function createCodexDynamicToolBridge(params) {
+	const toolResultHookContext = toToolResultHookContext(params.hookContext);
 	const tools = params.tools.map((tool) => isToolWrappedWithBeforeToolCallHook(tool) ? tool : wrapToolWithBeforeToolCallHook(tool, params.hookContext));
 	const toolMap = new Map(tools.map((tool) => [tool.name, tool]));
 	const telemetry = {
@@ -40,9 +41,9 @@ function createCodexDynamicToolBridge(params) {
 	};
 	const middlewareRunner = createAgentToolResultMiddlewareRunner({
 		runtime: "codex",
-		...params.hookContext
+		...toolResultHookContext
 	});
-	const legacyExtensionRunner = createCodexAppServerToolResultExtensionRunner(params.hookContext ?? {});
+	const legacyExtensionRunner = createCodexAppServerToolResultExtensionRunner(toolResultHookContext);
 	return {
 		specs: tools.map((tool) => ({
 			name: tool.name,
@@ -83,28 +84,29 @@ function createCodexDynamicToolBridge(params) {
 					args,
 					result: middlewareResult
 				});
+				const resultIsError = rawIsError || isToolResultError(result);
 				collectToolTelemetry({
 					toolName: tool.name,
 					args,
 					result,
 					mediaTrustResult: rawResult,
 					telemetry,
-					isError: rawIsError || isToolResultError(result)
+					isError: resultIsError
 				});
 				runAgentHarnessAfterToolCallHook({
 					toolName: tool.name,
 					toolCallId: call.callId,
-					runId: params.hookContext?.runId,
-					agentId: params.hookContext?.agentId,
-					sessionId: params.hookContext?.sessionId,
-					sessionKey: params.hookContext?.sessionKey,
+					runId: toolResultHookContext.runId,
+					agentId: toolResultHookContext.agentId,
+					sessionId: toolResultHookContext.sessionId,
+					sessionKey: toolResultHookContext.sessionKey,
 					startArgs: args,
 					result,
 					startedAt
 				});
 				return {
 					contentItems: result.content.flatMap(convertToolContent),
-					success: true
+					success: !resultIsError
 				};
 			} catch (error) {
 				collectToolTelemetry({
@@ -117,10 +119,10 @@ function createCodexDynamicToolBridge(params) {
 				runAgentHarnessAfterToolCallHook({
 					toolName: tool.name,
 					toolCallId: call.callId,
-					runId: params.hookContext?.runId,
-					agentId: params.hookContext?.agentId,
-					sessionId: params.hookContext?.sessionId,
-					sessionKey: params.hookContext?.sessionKey,
+					runId: toolResultHookContext.runId,
+					agentId: toolResultHookContext.agentId,
+					sessionId: toolResultHookContext.sessionId,
+					sessionKey: toolResultHookContext.sessionKey,
 					startArgs: args,
 					error: error instanceof Error ? error.message : String(error),
 					startedAt
@@ -136,6 +138,15 @@ function createCodexDynamicToolBridge(params) {
 		}
 	};
 }
+function toToolResultHookContext(ctx) {
+	const { agentId, sessionId, sessionKey, runId } = ctx ?? {};
+	return {
+		...agentId && { agentId },
+		...sessionId && { sessionId },
+		...sessionKey && { sessionKey },
+		...runId && { runId }
+	};
+}
 function composeAbortSignals(...signals) {
 	const activeSignals = signals.filter((signal) => Boolean(signal));
 	if (activeSignals.length === 0) return new AbortController().signal;
@@ -170,7 +181,8 @@ function collectToolTelemetry(params) {
 		"content"
 	]);
 	if (text) params.telemetry.messagingToolSentTexts.push(text);
-	params.telemetry.messagingToolSentMediaUrls.push(...collectMediaUrls(params.args));
+	const mediaUrls = collectMediaUrls(params.args);
+	params.telemetry.messagingToolSentMediaUrls.push(...mediaUrls);
 	params.telemetry.messagingToolSentTargets.push({
 		tool: params.toolName,
 		provider: readFirstString(params.args, ["provider", "channel"]) ?? params.toolName,
@@ -184,7 +196,9 @@ function collectToolTelemetry(params) {
 			"threadId",
 			"thread_id",
 			"messageThreadId"
-		])
+		]),
+		...text ? { text } : {},
+		...mediaUrls.length > 0 ? { mediaUrls } : {}
 	});
 }
 function isRecord(value) {
@@ -265,9 +279,17 @@ async function startOrResumeThread(params) {
 		agentDir: params.params.agentDir,
 		config: params.params.config
 	});
-	if (binding?.threadId) if (binding.dynamicToolsFingerprint && binding.dynamicToolsFingerprint !== dynamicToolsFingerprint) {
-		embeddedAgentLog.debug("codex app-server dynamic tool catalog changed; starting a new thread", { threadId: binding.threadId });
-		await clearCodexAppServerBinding(params.params.sessionFile);
+	let preserveExistingBinding = false;
+	if (binding?.threadId) if (binding.dynamicToolsFingerprint && !areDynamicToolFingerprintsCompatible(binding.dynamicToolsFingerprint, dynamicToolsFingerprint)) {
+		preserveExistingBinding = shouldStartTransientNoToolThread({
+			previous: binding.dynamicToolsFingerprint,
+			next: dynamicToolsFingerprint
+		});
+		if (preserveExistingBinding) embeddedAgentLog.debug("codex app-server dynamic tools unavailable for turn; starting transient thread", { threadId: binding.threadId });
+		else {
+			embeddedAgentLog.debug("codex app-server dynamic tool catalog changed; starting a new thread", { threadId: binding.threadId });
+			await clearCodexAppServerBinding(params.params.sessionFile);
+		}
 	} else try {
 		const authProfileId = params.params.authProfileId ?? binding.authProfileId;
 		const response = assertCodexThreadResumeResponse(await params.client.request("thread/resume", buildThreadResumeParams(params.params, {
@@ -327,7 +349,7 @@ async function startOrResumeThread(params) {
 		config: params.params.config
 	});
 	const createdAt = (/* @__PURE__ */ new Date()).toISOString();
-	await writeCodexAppServerBinding(params.params.sessionFile, {
+	if (!preserveExistingBinding) await writeCodexAppServerBinding(params.params.sessionFile, {
 		threadId: response.thread.id,
 		cwd: params.cwd,
 		authProfileId: params.params.authProfileId,
@@ -425,8 +447,14 @@ function buildTurnCollaborationMode(params) {
 function buildHeartbeatCollaborationInstructions() {
 	return ["This is an OpenClaw heartbeat turn. Apply these instructions only to this heartbeat wake; ordinary chat turns should stay in Codex Default mode.", CODEX_GPT5_HEARTBEAT_PROMPT_OVERLAY].join("\n\n");
 }
+function codexDynamicToolsFingerprint(dynamicTools) {
+	return fingerprintDynamicTools(dynamicTools);
+}
+function areCodexDynamicToolFingerprintsCompatible(params) {
+	return areDynamicToolFingerprintsCompatible(params.previous, params.next);
+}
 function fingerprintDynamicTools(dynamicTools) {
-	return JSON.stringify(dynamicTools.map(fingerprintDynamicToolSpec));
+	return JSON.stringify(dynamicTools.map(fingerprintDynamicToolSpec).toSorted(compareJsonFingerprint));
 }
 function fingerprintDynamicToolSpec(tool) {
 	if (!isJsonObject(tool)) return stabilizeJsonValue(tool);
@@ -444,6 +472,16 @@ function stabilizeJsonValue(value) {
 	for (const [key, child] of Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right))) stable[key] = stabilizeJsonValue(child);
 	return stable;
 }
+const EMPTY_DYNAMIC_TOOLS_FINGERPRINT = JSON.stringify([]);
+function areDynamicToolFingerprintsCompatible(previous, next) {
+	return !previous || previous === next;
+}
+function shouldStartTransientNoToolThread(params) {
+	return Boolean(params.previous && params.previous !== EMPTY_DYNAMIC_TOOLS_FINGERPRINT && params.next === EMPTY_DYNAMIC_TOOLS_FINGERPRINT);
+}
+function compareJsonFingerprint(left, right) {
+	return JSON.stringify(left).localeCompare(JSON.stringify(right));
+}
 function buildDeveloperInstructions(params) {
 	return [
 		"You are running inside OpenClaw. Use OpenClaw dynamic tools for OpenClaw-specific integrations such as messaging, cron, sessions, media, gateway, and nodes when available.",
@@ -497,4 +535,4 @@ function resolveReasoningEffort(thinkLevel, modelId) {
 	return null;
 }
 //#endregion
-export { startOrResumeThread as a, buildTurnStartParams as i, buildThreadResumeParams as n, createCodexDynamicToolBridge as o, buildThreadStartParams as r, applyCodexDynamicToolProfile as s, buildDeveloperInstructions as t };
+export { buildTurnStartParams as a, createCodexDynamicToolBridge as c, buildThreadStartParams as i, applyCodexDynamicToolProfile as l, buildDeveloperInstructions as n, codexDynamicToolsFingerprint as o, buildThreadResumeParams as r, startOrResumeThread as s, areCodexDynamicToolFingerprintsCompatible as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/codex",
-  "version": "2026.5.3",
+  "version": "2026.5.4-beta.2",
   "description": "OpenClaw Codex harness and model provider plugin",
   "repository": {
     "type": "git",
@@ -8,11 +8,11 @@
   },
   "type": "module",
   "dependencies": {
-    "@mariozechner/pi-coding-agent": "0.71.1",
+    "@mariozechner/pi-coding-agent": "0.73.0",
     "@openai/codex": "0.128.0",
     "ajv": "^8.20.0",
     "ws": "^8.20.0",
-    "zod": "^4.4.1"
+    "zod": "^4.4.3"
   },
   "devDependencies": {
     "@openclaw/plugin-sdk": "workspace:*"
@@ -27,10 +27,10 @@
       "minHostVersion": ">=2026.5.1-beta.1"
     },
     "compat": {
-      "pluginApi": ">=2026.5.3"
+      "pluginApi": ">=2026.5.4-beta.2"
     },
     "build": {
-      "openclawVersion": "2026.5.3"
+      "openclawVersion": "2026.5.4-beta.2"
     },
     "release": {
       "publishToClawHub": true,
@@ -45,7 +45,7 @@
     "openclaw.plugin.json"
   ],
   "peerDependencies": {
-    "openclaw": ">=2026.5.3"
+    "openclaw": ">=2026.5.4-beta.2"
   },
   "peerDependenciesMeta": {
     "openclaw": {

package/dist/capabilities-BmhO5h8O.js

@@ -1,22 +0,0 @@
-import { n as CodexAppServerRpcError } from "./client-chGfNrq5.js";
-//#region extensions/codex/src/app-server/capabilities.ts
-const CODEX_CONTROL_METHODS = {
-	account: "account/read",
-	compact: "thread/compact/start",
-	feedback: "feedback/upload",
-	listMcpServers: "mcpServerStatus/list",
-	listSkills: "skills/list",
-	listThreads: "thread/list",
-	rateLimits: "account/rateLimits/read",
-	resumeThread: "thread/resume",
-	review: "review/start"
-};
-function describeControlFailure(error) {
-	if (isUnsupportedControlError(error)) return "unsupported by this Codex app-server";
-	return error instanceof Error ? error.message : String(error);
-}
-function isUnsupportedControlError(error) {
-	return error instanceof CodexAppServerRpcError && error.code === -32601;
-}
-//#endregion
-export { describeControlFailure as n, CODEX_CONTROL_METHODS as t };