@openclaw/codex 2026.5.7-beta.1 → 2026.5.9-beta.1

package/dist/harness.js

@@ -18,21 +18,21 @@ function createCodexAppServerAgentHarness(options) {
 			};
 		},
 		runAttempt: async (params) => {
-			const { runCodexAppServerAttempt } = await import("./run-attempt-BaT_FcTv.js");
+			const { runCodexAppServerAttempt } = await import("./run-attempt-DCCThMaw.js");
 			return runCodexAppServerAttempt(params, { pluginConfig: options?.pluginConfig });
 		},
 		compact: async (params) => {
-			const { maybeCompactCodexAppServerSession } = await import("./compact-DcR5aTxd.js");
+			const { maybeCompactCodexAppServerSession } = await import("./compact-BaeaEEoQ.js");
 			return maybeCompactCodexAppServerSession(params, { pluginConfig: options?.pluginConfig });
 		},
 		reset: async (params) => {
 			if (params.sessionFile) {
-				const { clearCodexAppServerBinding } = await import("./session-binding-DuJYTJQy.js").then((n) => n.a);
+				const { clearCodexAppServerBinding } = await import("./session-binding-C_HDlZx8.js").then((n) => n.a);
 				await clearCodexAppServerBinding(params.sessionFile);
 			}
 		},
 		dispose: async () => {
-			const { clearSharedCodexAppServerClientAndWait } = await import("./shared-client-Dfk3Enm-.js").then((n) => n.r);
+			const { clearSharedCodexAppServerClientAndWait } = await import("./shared-client-pLCOzMaZ.js").then((n) => n.r);
 			await clearSharedCodexAppServerClientAndWait();
 		}
 	};

package/dist/index.js

@@ -1,16 +1,20 @@
 import { createCodexAppServerAgentHarness } from "./harness.js";
+import { t as CODEX_PLUGINS_MARKETPLACE_NAME } from "./config-BZiM7rhH.js";
 import { buildCodexMediaUnderstandingProvider } from "./media-understanding-provider.js";
 import { buildCodexProvider } from "./provider.js";
-import { f as describeControlFailure, r as formatCodexDisplayText } from "./command-formatters-PiJcdUbu.js";
-import { n as handleCodexConversationInboundClaim, t as handleCodexConversationBindingResolved } from "./conversation-binding-CtHkMJfG.js";
+import { i as formatCodexDisplayText, p as describeControlFailure, t as requestCodexAppServerJson } from "./request-CaW8DCAa.js";
+import { n as handleCodexConversationInboundClaim, t as handleCodexConversationBindingResolved } from "./conversation-binding-BjanzgDh.js";
+import { i as defaultCodexAppInventoryCache, t as ensureCodexPluginActivation } from "./plugin-activation-D0uXssSN.js";
 import { resolveLivePluginConfigObject } from "openclaw/plugin-sdk/plugin-config-runtime";
 import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
+import os from "node:os";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { resolveAgentConfig, resolveAgentWorkspaceDir, resolveDefaultAgentId } from "openclaw/plugin-sdk/agent-runtime";
-import { MIGRATION_REASON_TARGET_EXISTS, createMigrationItem, createMigrationManualItem, summarizeMigrationItems } from "openclaw/plugin-sdk/migration";
-import { archiveMigrationItem, copyMigrationFileItem, writeMigrationReport } from "openclaw/plugin-sdk/migration-runtime";
-import os from "node:os";
+import { pathExists } from "openclaw/plugin-sdk/security-runtime";
+import { MIGRATION_REASON_TARGET_EXISTS, applyMigrationManualItem, createMigrationItem, createMigrationManualItem, hasMigrationConfigPatchConflict, markMigrationItemConflict, markMigrationItemError, markMigrationItemSkipped, readMigrationConfigPath, summarizeMigrationItems, writeMigrationConfigPath } from "openclaw/plugin-sdk/migration";
+import { archiveMigrationItem, copyMigrationFileItem, withCachedMigrationConfigRuntime, writeMigrationReport } from "openclaw/plugin-sdk/migration-runtime";
+import { readJsonFileWithFallback } from "openclaw/plugin-sdk/json-store";
 //#region extensions/codex/src/commands.ts
 function createCodexCommand(options) {
 	return {
@@ -24,7 +28,7 @@ function createCodexCommand(options) {
 	};
 }
 async function handleCodexCommand(ctx, options = {}) {
-	const { handleCodexSubcommand } = await import("./command-handlers-DiH-D13x.js");
+	const { handleCodexSubcommand } = await import("./command-handlers-De-V2-4K.js");
 	try {
 		return await handleCodexSubcommand(ctx, options);
 	} catch (error) {
@@ -34,12 +38,7 @@ async function handleCodexCommand(ctx, options = {}) {
 //#endregion
 //#region extensions/codex/src/migration/helpers.ts
 async function exists(filePath) {
-	try {
-		await fs.access(filePath);
-		return true;
-	} catch {
-		return false;
-	}
+	return await pathExists(filePath);
 }
 async function isDirectory(filePath) {
 	if (!filePath) return false;
@@ -62,12 +61,8 @@ function sanitizeName(value) {
 }
 async function readJsonObject(filePath) {
 	if (!filePath) return {};
-	try {
-		const parsed = JSON.parse(await fs.readFile(filePath, "utf8"));
-		return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
-	} catch {
-		return {};
-	}
+	const { value: parsed } = await readJsonFileWithFallback(filePath, {});
+	return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
 }
 //#endregion
 //#region extensions/codex/src/migration/source.ts
@@ -119,7 +114,10 @@ async function discoverPluginDirs(codexHome) {
 			discovered.set(dir, {
 				name,
 				source: dir,
-				manifestPath
+				manifestPath,
+				sourceKind: "cache",
+				migratable: false,
+				message: "Cached Codex plugin bundle found. Review manually unless the plugin is also installed in the source Codex app-server inventory."
 			});
 			return;
 		}
@@ -131,6 +129,62 @@ async function discoverPluginDirs(codexHome) {
 	await visit(root, 0);
 	return [...discovered.values()].toSorted((a, b) => a.source.localeCompare(b.source));
 }
+async function discoverInstalledCuratedPlugins(codexHome) {
+	try {
+		const marketplace = (await requestCodexAppServerJson({
+			method: "plugin/list",
+			requestParams: { cwds: [] },
+			timeoutMs: 6e4,
+			startOptions: {
+				transport: "stdio",
+				command: "codex",
+				commandSource: "config",
+				args: [
+					"app-server",
+					"--listen",
+					"stdio://"
+				],
+				headers: {},
+				env: {
+					CODEX_HOME: codexHome,
+					HOME: path.dirname(codexHome)
+				}
+			}
+		})).marketplaces.find((entry) => entry.name === CODEX_PLUGINS_MARKETPLACE_NAME);
+		if (!marketplace) return {
+			plugins: [],
+			error: `Codex marketplace ${CODEX_PLUGINS_MARKETPLACE_NAME} was not found in source plugin inventory.`
+		};
+		return { plugins: marketplace.plugins.filter((plugin) => plugin.installed).map((plugin) => {
+			const pluginName = pluginNameFromSummary(plugin);
+			if (!pluginName) return;
+			return {
+				name: plugin.name,
+				pluginName,
+				marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
+				source: `${CODEX_PLUGINS_MARKETPLACE_NAME}/${pluginName}`,
+				sourceKind: "app-server",
+				migratable: true,
+				installed: plugin.installed,
+				enabled: plugin.enabled
+			};
+		}).filter((plugin) => plugin !== void 0).toSorted((a, b) => (a.pluginName ?? a.name).localeCompare(b.pluginName ?? b.name)) };
+	} catch (error) {
+		return {
+			plugins: [],
+			error: error instanceof Error ? error.message : String(error)
+		};
+	}
+}
+function pluginNameFromSummary(summary) {
+	const candidates = [summary.id, summary.name];
+	for (const candidate of candidates) {
+		const trimmed = candidate.trim();
+		if (!trimmed) continue;
+		const normalized = ((trimmed.endsWith(`@openai-curated`) ? trimmed.slice(0, -`@${CODEX_PLUGINS_MARKETPLACE_NAME}`.length) : trimmed).split("/").at(-1)?.trim())?.toLowerCase().replaceAll(/\s+/gu, "-");
+		if (normalized) return normalized;
+	}
+}
 async function discoverCodexSource(input) {
 	const codexHome = resolveHomePath(input?.trim() || defaultCodexHome());
 	const codexSkillsDir = path.join(codexHome, "skills");
@@ -146,7 +200,13 @@ async function discoverCodexSource(input) {
 		root: agentsSkillsDir,
 		sourceLabel: "personal AgentSkill"
 	});
-	const plugins = await discoverPluginDirs(codexHome);
+	const sourcePluginDiscovery = await discoverInstalledCuratedPlugins(codexHome);
+	const sourcePluginNames = new Set(sourcePluginDiscovery.plugins.flatMap((plugin) => plugin.pluginName ? [plugin.pluginName] : []));
+	const cachedPlugins = (await discoverPluginDirs(codexHome)).filter((plugin) => {
+		const normalizedName = sanitizePluginName(plugin.name);
+		return !sourcePluginNames.has(normalizedName);
+	});
+	const plugins = [...sourcePluginDiscovery.plugins, ...cachedPlugins].toSorted((a, b) => a.source.localeCompare(b.source));
 	const archivePaths = [];
 	if (await exists(configPath)) archivePaths.push({
 		id: "archive:config.toml",
@@ -173,12 +233,16 @@ async function discoverCodexSource(input) {
 		...await exists(hooksPath) ? { hooksPath } : {},
 		skills,
 		plugins,
+		...sourcePluginDiscovery.error ? { pluginDiscoveryError: sourcePluginDiscovery.error } : {},
 		archivePaths
 	};
 }
 function hasCodexSource(source) {
 	return source.confidence !== "low";
 }
+function sanitizePluginName(value) {
+	return value.trim().toLowerCase().replaceAll(/\s+/gu, "-");
+}
 //#endregion
 //#region extensions/codex/src/migration/targets.ts
 function resolveCodexMigrationTargets(ctx) {
@@ -193,6 +257,26 @@ function resolveCodexMigrationTargets(ctx) {
 }
 //#endregion
 //#region extensions/codex/src/migration/plan.ts
+const CODEX_PLUGIN_CONFIG_ITEM_ID = "config:codex-plugins";
+const CODEX_PLUGIN_CONFIG_PATH = [
+	"plugins",
+	"entries",
+	"codex"
+];
+const CODEX_PLUGIN_ENABLED_PATH = [
+	"plugins",
+	"entries",
+	"codex",
+	"enabled"
+];
+const CODEX_PLUGIN_NATIVE_CONFIG_PATH = [
+	"plugins",
+	"entries",
+	"codex",
+	"config",
+	"codexPlugins"
+];
+const MIGRATION_REASON_PLUGIN_EXISTS = "plugin exists";
 function uniqueSkillName(skill, counts) {
 	const base = sanitizeName(skill.name) || "codex-skill";
 	if ((counts.get(base) ?? 0) <= 1) return base;
@@ -239,6 +323,137 @@ async function buildSkillItems(params) {
 	}
 	return items;
 }
+function uniquePluginConfigKey(plugin, counts, usedCounts) {
+	const base = sanitizeName(plugin.pluginName ?? plugin.name) || "codex-plugin";
+	if ((counts.get(base) ?? 0) <= 1) return base;
+	const next = (usedCounts.get(base) ?? 0) + 1;
+	usedCounts.set(base, next);
+	return sanitizeName(`${base}-${next}`) || base;
+}
+function readExistingCodexPluginEntries(config) {
+	const entries = readMigrationConfigPath(config, [...CODEX_PLUGIN_NATIVE_CONFIG_PATH, "plugins"]);
+	return isRecord(entries) ? entries : {};
+}
+function hasExistingCodexPluginEntry(existingEntries, configKey, pluginName) {
+	if (existingEntries[configKey] !== void 0) return true;
+	return Object.values(existingEntries).some((entry) => {
+		if (!isRecord(entry)) return false;
+		return entry.pluginName === pluginName;
+	});
+}
+function buildPluginItems(ctx, plugins) {
+	const baseCounts = /* @__PURE__ */ new Map();
+	for (const plugin of plugins.filter((entry) => entry.migratable)) {
+		const base = sanitizeName(plugin.pluginName ?? plugin.name) || "codex-plugin";
+		baseCounts.set(base, (baseCounts.get(base) ?? 0) + 1);
+	}
+	const existingPluginEntries = readExistingCodexPluginEntries(ctx.config);
+	const usedCounts = /* @__PURE__ */ new Map();
+	let manualIndex = 0;
+	const items = [];
+	for (const plugin of plugins) {
+		if (plugin.migratable && plugin.marketplaceName === "openai-curated" && plugin.pluginName) {
+			const configKey = uniquePluginConfigKey(plugin, baseCounts, usedCounts);
+			const conflict = !ctx.overwrite && hasExistingCodexPluginEntry(existingPluginEntries, configKey, plugin.pluginName);
+			items.push(createMigrationItem({
+				id: `plugin:${configKey}`,
+				kind: "plugin",
+				action: "install",
+				status: conflict ? "conflict" : "planned",
+				reason: conflict ? MIGRATION_REASON_PLUGIN_EXISTS : void 0,
+				source: plugin.source,
+				target: `plugins.entries.codex.config.codexPlugins.plugins.${configKey}`,
+				message: `Install Codex plugin "${plugin.pluginName}" in the OpenClaw-managed Codex app-server runtime.`,
+				details: {
+					configKey,
+					marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
+					pluginName: plugin.pluginName,
+					sourceInstalled: plugin.installed === true,
+					sourceEnabled: plugin.enabled === true
+				}
+			}));
+			continue;
+		}
+		manualIndex += 1;
+		items.push(createMigrationManualItem({
+			id: `plugin:${sanitizeName(plugin.name) || sanitizeName(path.basename(plugin.source))}:${manualIndex}`,
+			source: plugin.source,
+			message: plugin.message ?? `Codex native plugin "${plugin.name}" was found but not activated automatically.`,
+			recommendation: "Review the plugin bundle first, then install trusted compatible plugins with openclaw plugins install <path>."
+		}));
+	}
+	return items;
+}
+function readCodexPluginMigrationConfigEntry(item, enabled) {
+	const configKey = item.details?.configKey;
+	const marketplaceName = item.details?.marketplaceName;
+	const pluginName = item.details?.pluginName;
+	if (item.kind !== "plugin" || item.action !== "install" || typeof configKey !== "string" || marketplaceName !== "openai-curated" || typeof pluginName !== "string") return;
+	return {
+		configKey,
+		pluginName,
+		enabled
+	};
+}
+function readExistingAllowDestructiveActions(config) {
+	const value = readMigrationConfigPath(config, [...CODEX_PLUGIN_NATIVE_CONFIG_PATH, "allow_destructive_actions"]);
+	return typeof value === "boolean" ? value : void 0;
+}
+function isRecord(value) {
+	return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+function buildCodexPluginsConfigValue(entries, params = {}) {
+	const plugins = Object.fromEntries(entries.toSorted((a, b) => a.configKey.localeCompare(b.configKey)).map((entry) => [entry.configKey, {
+		enabled: entry.enabled,
+		marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
+		pluginName: entry.pluginName
+	}]));
+	return {
+		enabled: true,
+		config: { codexPlugins: {
+			enabled: true,
+			allow_destructive_actions: params.config === void 0 ? false : readExistingAllowDestructiveActions(params.config) ?? false,
+			plugins
+		} }
+	};
+}
+function hasCodexPluginConfigConflict(config, value) {
+	const enabled = readMigrationConfigPath(config, CODEX_PLUGIN_ENABLED_PATH);
+	if (enabled !== void 0 && enabled !== true) return true;
+	const nativeConfig = value.config?.codexPlugins;
+	if (!isRecord(nativeConfig)) return hasMigrationConfigPatchConflict(config, CODEX_PLUGIN_NATIVE_CONFIG_PATH, nativeConfig);
+	const existingNativeConfig = readMigrationConfigPath(config, CODEX_PLUGIN_NATIVE_CONFIG_PATH);
+	if (existingNativeConfig === void 0) return false;
+	if (!isRecord(existingNativeConfig)) return true;
+	if (existingNativeConfig.enabled !== void 0 && existingNativeConfig.enabled !== true) return true;
+	const allowDestructiveActions = nativeConfig.allow_destructive_actions;
+	if (existingNativeConfig.allow_destructive_actions !== void 0 && existingNativeConfig.allow_destructive_actions !== allowDestructiveActions) return true;
+	const plugins = nativeConfig.plugins;
+	if (!isRecord(plugins)) return false;
+	return Object.entries(plugins).some(([configKey, plugin]) => {
+		if (!isRecord(plugin)) return existingNativeConfig[configKey] !== void 0;
+		return hasExistingCodexPluginEntry(readExistingCodexPluginEntries(config), configKey, typeof plugin.pluginName === "string" ? plugin.pluginName : configKey);
+	});
+}
+function buildPluginConfigItem(ctx, pluginItems) {
+	const entries = pluginItems.filter((item) => item.status === "planned").map((item) => readCodexPluginMigrationConfigEntry(item, true)).filter((entry) => entry !== void 0);
+	if (entries.length === 0) return;
+	const value = buildCodexPluginsConfigValue(entries, { config: ctx.config });
+	const conflict = !ctx.overwrite && hasCodexPluginConfigConflict(ctx.config, value);
+	return createMigrationItem({
+		id: CODEX_PLUGIN_CONFIG_ITEM_ID,
+		kind: "config",
+		action: "merge",
+		target: "plugins.entries.codex.config.codexPlugins",
+		status: conflict ? "conflict" : "planned",
+		reason: conflict ? MIGRATION_REASON_TARGET_EXISTS : void 0,
+		message: "Enable OpenClaw's Codex plugin integration and record migrated source-installed curated plugins.",
+		details: {
+			path: [...CODEX_PLUGIN_CONFIG_PATH],
+			value
+		}
+	});
+}
 async function buildCodexMigrationPlan(ctx) {
 	const source = await discoverCodexSource(ctx.source);
 	if (!hasCodexSource(source)) throw new Error(`Codex state was not found at ${source.root}. Pass --from <path> if it lives elsewhere.`);
@@ -249,12 +464,10 @@ async function buildCodexMigrationPlan(ctx) {
 		workspaceDir: targets.workspaceDir,
 		overwrite: ctx.overwrite
 	}));
-	for (const [index, plugin] of source.plugins.entries()) items.push(createMigrationManualItem({
-		id: `plugin:${sanitizeName(plugin.name) || sanitizeName(path.basename(plugin.source))}:${index + 1}`,
-		source: plugin.source,
-		message: `Codex native plugin "${plugin.name}" was found but not activated automatically.`,
-		recommendation: "Review the plugin bundle first, then install trusted compatible plugins with openclaw plugins install <path>."
-	}));
+	const pluginItems = buildPluginItems(ctx, source.plugins);
+	items.push(...pluginItems);
+	const pluginConfigItem = buildPluginConfigItem(ctx, pluginItems);
+	if (pluginConfigItem) items.push(pluginConfigItem);
 	for (const archivePath of source.archivePaths) items.push(createMigrationItem({
 		id: archivePath.id,
 		kind: "archive",
@@ -264,8 +477,9 @@ async function buildCodexMigrationPlan(ctx) {
 		details: { archiveRelativePath: archivePath.relativePath }
 	}));
 	const warnings = [
-		...items.some((item) => item.status === "conflict") ? ["Conflicts were found. Re-run with --overwrite to replace conflicting skill targets after item-level backups."] : [],
-		...source.plugins.length > 0 ? ["Codex native plugins are reported for manual review only. OpenClaw does not auto-activate plugin bundles, hooks, MCP servers, or apps from another Codex home."] : [],
+		...items.some((item) => item.status === "conflict") ? ["Conflicts were found. Re-run with --overwrite to replace conflicting migration targets after item-level backups."] : [],
+		...source.plugins.length > 0 ? ["Codex source-installed openai-curated plugins are planned for native activation; cached plugin bundles remain manual-review only."] : [],
+		...source.pluginDiscoveryError ? [`Codex app-server plugin inventory discovery failed: ${source.pluginDiscoveryError}. Cached plugin bundles, if any, are advisory only.`] : [],
 		...source.archivePaths.length > 0 ? ["Codex config and hook files are archive-only. They are preserved in the migration report, not loaded into OpenClaw automatically."] : []
 	];
 	return {
@@ -275,7 +489,7 @@ async function buildCodexMigrationPlan(ctx) {
 		summary: summarizeMigrationItems(items),
 		items,
 		warnings,
-		nextSteps: ["Run openclaw doctor after applying the migration.", "Review skipped Codex plugin/config/hook items before installing or recreating them in OpenClaw."],
+		nextSteps: ["Run openclaw doctor after applying the migration.", "Review skipped or auth-required Codex plugin/config/hook items before exposing them in OpenClaw sessions."],
 		metadata: {
 			agentDir: targets.agentDir,
 			codexHome: source.codexHome,
@@ -286,16 +500,33 @@ async function buildCodexMigrationPlan(ctx) {
 }
 //#endregion
 //#region extensions/codex/src/migration/apply.ts
+const CODEX_PLUGIN_AUTH_REQUIRED_REASON = "auth_required";
+const CODEX_PLUGIN_NOT_SELECTED_REASON = "not selected for migration";
+var CodexPluginConfigConflictError = class extends Error {
+	constructor(reason) {
+		super(reason);
+		this.reason = reason;
+		this.name = "CodexPluginConfigConflictError";
+	}
+};
 async function applyCodexMigrationPlan(params) {
 	const plan = params.plan ?? await buildCodexMigrationPlan(params.ctx);
 	const reportDir = params.ctx.reportDir ?? path.join(params.ctx.stateDir, "migration", "codex");
 	const items = [];
+	const runtime = withCachedMigrationConfigRuntime(params.ctx.runtime ?? params.runtime, params.ctx.config);
+	const applyCtx = {
+		...params.ctx,
+		runtime
+	};
 	for (const item of plan.items) {
 		if (item.status !== "planned") {
 			items.push(item);
 			continue;
 		}
-		if (item.action === "archive") items.push(await archiveMigrationItem(item, reportDir));
+		if (item.id === "config:codex-plugins") items.push(await applyCodexPluginConfigItem(applyCtx, item, items));
+		else if (item.kind === "plugin" && item.action === "install") items.push(await applyCodexPluginInstallItem(applyCtx, item));
+		else if (item.kind === "manual") items.push(applyMigrationManualItem(item));
+		else if (item.action === "archive") items.push(await archiveMigrationItem(item, reportDir));
 		else items.push(await copyMigrationFileItem(item, reportDir, { overwrite: params.ctx.overwrite }));
 	}
 	const result = {
@@ -308,9 +539,150 @@ async function applyCodexMigrationPlan(params) {
 	await writeMigrationReport(result, { title: "Codex Migration Report" });
 	return result;
 }
+async function applyCodexPluginInstallItem(ctx, item) {
+	const policy = readCodexPluginPolicy(item);
+	if (!policy) return {
+		...markMigrationItemError(item, "invalid Codex plugin migration item"),
+		details: {
+			...item.details,
+			code: "invalid_plugin_item"
+		}
+	};
+	try {
+		const result = await ensureCodexPluginActivation({
+			identity: policy,
+			installEvenIfActive: true,
+			request: async (method, requestParams) => await requestCodexAppServerJson({
+				method,
+				requestParams,
+				timeoutMs: 6e4,
+				config: ctx.config
+			})
+		});
+		defaultCodexAppInventoryCache.clear();
+		const baseDetails = {
+			...item.details,
+			code: result.reason,
+			activationReason: result.reason,
+			...codexPluginActivationReportState(result),
+			installAttempted: result.installAttempted,
+			diagnostics: result.diagnostics.map((diagnostic) => diagnostic.message)
+		};
+		if (result.ok) return {
+			...item,
+			status: "migrated",
+			...result.reason === "already_active" ? { reason: "already active" } : {},
+			details: baseDetails
+		};
+		if (result.reason === CODEX_PLUGIN_AUTH_REQUIRED_REASON) return {
+			...item,
+			status: "skipped",
+			reason: CODEX_PLUGIN_AUTH_REQUIRED_REASON,
+			details: {
+				...baseDetails,
+				appsNeedingAuth: sanitizeAppsNeedingAuth(result.installResponse?.appsNeedingAuth ?? [])
+			}
+		};
+		return {
+			...item,
+			status: "error",
+			reason: result.reason,
+			details: baseDetails
+		};
+	} catch (error) {
+		return {
+			...item,
+			status: "error",
+			reason: error instanceof Error ? error.message : String(error),
+			details: {
+				...item.details,
+				code: "plugin_install_failed"
+			}
+		};
+	}
+}
+async function applyCodexPluginConfigItem(ctx, item, appliedItems) {
+	const entries = appliedItems.map(readAppliedPluginConfigEntry).filter((entry) => entry !== void 0);
+	if (entries.length === 0) return markMigrationItemSkipped(item, "no selected Codex plugins");
+	const configApi = ctx.runtime?.config;
+	if (!configApi?.current || !configApi.mutateConfigFile) return markMigrationItemError(item, "config runtime unavailable");
+	const currentConfig = configApi.current();
+	const value = buildCodexPluginsConfigValue(entries, { config: currentConfig });
+	if (!ctx.overwrite && hasCodexPluginConfigConflict(currentConfig, value)) return markMigrationItemConflict(item, MIGRATION_REASON_TARGET_EXISTS);
+	try {
+		await configApi.mutateConfigFile({
+			base: "runtime",
+			afterWrite: { mode: "auto" },
+			mutate(draft) {
+				if (!ctx.overwrite && hasCodexPluginConfigConflict(draft, value)) throw new CodexPluginConfigConflictError(MIGRATION_REASON_TARGET_EXISTS);
+				writeMigrationConfigPath(draft, CODEX_PLUGIN_CONFIG_PATH, value);
+			}
+		});
+		return {
+			...item,
+			status: "migrated",
+			details: {
+				...item.details,
+				path: [...CODEX_PLUGIN_CONFIG_PATH],
+				value
+			}
+		};
+	} catch (error) {
+		if (error instanceof CodexPluginConfigConflictError) return markMigrationItemConflict(item, error.reason);
+		return markMigrationItemError(item, error instanceof Error ? error.message : String(error));
+	}
+}
+function readAppliedPluginConfigEntry(item) {
+	if (item.status === "migrated") return readCodexPluginMigrationConfigEntry(item, true);
+	if (item.status === "skipped" && item.reason !== CODEX_PLUGIN_NOT_SELECTED_REASON && item.reason === CODEX_PLUGIN_AUTH_REQUIRED_REASON) return readCodexPluginMigrationConfigEntry(item, false);
+}
+function readCodexPluginPolicy(item) {
+	const configKey = item.details?.configKey;
+	const marketplaceName = item.details?.marketplaceName;
+	const pluginName = item.details?.pluginName;
+	if (typeof configKey !== "string" || marketplaceName !== "openai-curated" || typeof pluginName !== "string") return;
+	return {
+		configKey,
+		marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
+		pluginName,
+		enabled: true,
+		allowDestructiveActions: false
+	};
+}
+function codexPluginActivationReportState(result) {
+	switch (result.reason) {
+		case "already_active":
+		case "installed": return {
+			installed: true,
+			enabled: true
+		};
+		case "auth_required": return {
+			installed: true,
+			enabled: false
+		};
+		case "disabled":
+		case "marketplace_missing":
+		case "plugin_missing": return {
+			installed: false,
+			enabled: false
+		};
+		case "refresh_failed": return {
+			installed: true,
+			enabled: false
+		};
+	}
+	return result.reason;
+}
+function sanitizeAppsNeedingAuth(apps) {
+	return apps.map((app) => ({
+		id: app.id,
+		name: app.name,
+		needsAuth: app.needsAuth
+	}));
+}
 //#endregion
 //#region extensions/codex/src/migration/provider.ts
-function buildCodexMigrationProvider() {
+function buildCodexMigrationProvider(params = {}) {
 	return {
 		id: "codex",
 		label: "Codex",
@@ -330,7 +702,8 @@ function buildCodexMigrationProvider() {
 		async apply(ctx, plan) {
 			return await applyCodexMigrationPlan({
 				ctx,
-				plan
+				plan,
+				runtime: params.runtime
 			});
 		}
 	};
@@ -346,7 +719,7 @@ var codex_default = definePluginEntry({
 		api.registerAgentHarness(createCodexAppServerAgentHarness({ pluginConfig: api.pluginConfig }));
 		api.registerProvider(buildCodexProvider({ pluginConfig: api.pluginConfig }));
 		api.registerMediaUnderstandingProvider(buildCodexMediaUnderstandingProvider({ pluginConfig: api.pluginConfig }));
-		api.registerMigrationProvider(buildCodexMigrationProvider());
+		api.registerMigrationProvider(buildCodexMigrationProvider({ runtime: api.runtime }));
 		api.registerCommand(createCodexCommand({ pluginConfig: api.pluginConfig }));
 		api.on("inbound_claim", (event, ctx) => handleCodexConversationInboundClaim(event, ctx, { pluginConfig: resolveCurrentPluginConfig() }));
 		api.onConversationBindingResolved?.(handleCodexConversationBindingResolved);

package/dist/media-understanding-provider.js

@@ -1,7 +1,7 @@
 import { CODEX_PROVIDER_ID, FALLBACK_CODEX_MODELS } from "./provider-catalog.js";
-import { i as resolveCodexAppServerRuntimeOptions } from "./config-ByrA30No.js";
-import { a as readCodexErrorNotification, c as readCodexTurnCompletedNotification, n as assertCodexThreadStartResponse, r as assertCodexTurnStartResponse } from "./protocol-validators-Dky2yV4W.js";
-import { i as readModelListResult } from "./models-CkowdYbm.js";
+import { s as resolveCodexAppServerRuntimeOptions } from "./config-BZiM7rhH.js";
+import { a as readCodexErrorNotification, c as readCodexTurnCompletedNotification, n as assertCodexThreadStartResponse, r as assertCodexTurnStartResponse } from "./protocol-validators-CbqWfY5M.js";
+import { i as readModelListResult } from "./models-nfvRggjT.js";
 import { t as isJsonObject } from "./protocol-C9UWI98H.js";
 //#region extensions/codex/media-understanding-provider.ts
 const DEFAULT_CODEX_IMAGE_MODEL = FALLBACK_CODEX_MODELS.find((model) => model.inputModalities.includes("image"))?.id ?? FALLBACK_CODEX_MODELS[0]?.id;
@@ -37,7 +37,7 @@ async function describeCodexImages(req, options) {
 	const appServer = resolveCodexAppServerRuntimeOptions({ pluginConfig: options.pluginConfig });
 	const timeoutMs = Math.max(100, req.timeoutMs);
 	const ownsClient = !options.clientFactory;
-	const client = options.clientFactory ? await options.clientFactory(appServer.start, req.profile) : await import("./shared-client-Dfk3Enm-.js").then((n) => n.r).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
+	const client = options.clientFactory ? await options.clientFactory(appServer.start, req.profile) : await import("./shared-client-pLCOzMaZ.js").then((n) => n.r).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
 		startOptions: appServer.start,
 		timeoutMs,
 		authProfileId: req.profile

package/dist/{models-CkowdYbm.js → models-nfvRggjT.js}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-DUslC3ob.js";
-import { o as readCodexModelListResponse } from "./protocol-validators-Dky2yV4W.js";
+import { o as readCodexModelListResponse } from "./protocol-validators-CbqWfY5M.js";
 //#region extensions/codex/src/app-server/models.ts
 var models_exports = /* @__PURE__ */ __exportAll({
 	listAllCodexAppServerModels: () => listAllCodexAppServerModels,
@@ -39,7 +39,7 @@ async function listAllCodexAppServerModels(options = {}) {
 async function withCodexAppServerModelClient(options, run) {
 	const timeoutMs = options.timeoutMs ?? 2500;
 	const useSharedClient = options.sharedClient !== false;
-	const { createIsolatedCodexAppServerClient, getSharedCodexAppServerClient } = await import("./shared-client-Dfk3Enm-.js").then((n) => n.r);
+	const { createIsolatedCodexAppServerClient, getSharedCodexAppServerClient } = await import("./shared-client-pLCOzMaZ.js").then((n) => n.r);
 	const client = useSharedClient ? await getSharedCodexAppServerClient({
 		startOptions: options.startOptions,
 		timeoutMs,