@openclaw/codex 2026.5.7 → 2026.5.10-beta.1

package/dist/{session-binding-DuJYTJQy.js → session-binding-B44KIZM2.js}

@@ -1,7 +1,8 @@
 import { t as __exportAll } from "./rolldown-runtime-DUslC3ob.js";
+import { a as normalizeCodexServiceTier } from "./config-CT01BBDc.js";
 import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
 import fs from "node:fs/promises";
-import { ensureAuthProfileStore, resolveOpenClawAgentDir as resolveOpenClawAgentDir$1, resolveProviderIdForAuth } from "openclaw/plugin-sdk/agent-runtime";
+import { ensureAuthProfileStore, resolveDefaultAgentDir, resolveProviderIdForAuth } from "openclaw/plugin-sdk/agent-runtime";
 //#region extensions/codex/src/app-server/session-binding.ts
 var session_binding_exports = /* @__PURE__ */ __exportAll({
 	clearCodexAppServerBinding: () => clearCodexAppServerBinding,
@@ -49,6 +50,9 @@ async function readCodexAppServerBinding(sessionFile, lookup = {}) {
 			sandbox: readSandboxMode(parsed.sandbox),
 			serviceTier: readServiceTier(parsed.serviceTier),
 			dynamicToolsFingerprint: typeof parsed.dynamicToolsFingerprint === "string" ? parsed.dynamicToolsFingerprint : void 0,
+			pluginAppsFingerprint: typeof parsed.pluginAppsFingerprint === "string" ? parsed.pluginAppsFingerprint : void 0,
+			pluginAppsInputFingerprint: typeof parsed.pluginAppsInputFingerprint === "string" ? parsed.pluginAppsInputFingerprint : void 0,
+			pluginAppPolicyContext: readPluginAppPolicyContext(parsed.pluginAppPolicyContext),
 			createdAt: typeof parsed.createdAt === "string" ? parsed.createdAt : (/* @__PURE__ */ new Date()).toISOString(),
 			updatedAt: typeof parsed.updatedAt === "string" ? parsed.updatedAt : (/* @__PURE__ */ new Date()).toISOString()
 		};
@@ -78,11 +82,46 @@ async function writeCodexAppServerBinding(sessionFile, binding, lookup = {}) {
 		sandbox: binding.sandbox,
 		serviceTier: binding.serviceTier,
 		dynamicToolsFingerprint: binding.dynamicToolsFingerprint,
+		pluginAppsFingerprint: binding.pluginAppsFingerprint,
+		pluginAppsInputFingerprint: binding.pluginAppsInputFingerprint,
+		pluginAppPolicyContext: binding.pluginAppPolicyContext,
 		createdAt: binding.createdAt ?? now,
 		updatedAt: now
 	};
 	await fs.writeFile(resolveCodexAppServerBindingPath(sessionFile), `${JSON.stringify(payload, null, 2)}\n`);
 }
+function readPluginAppPolicyContext(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return;
+	const record = value;
+	if (typeof record.fingerprint !== "string") return;
+	const apps = record.apps;
+	if (!apps || typeof apps !== "object" || Array.isArray(apps)) return;
+	const parsedApps = {};
+	for (const [appId, rawEntry] of Object.entries(apps)) {
+		if (!rawEntry || typeof rawEntry !== "object" || Array.isArray(rawEntry)) return;
+		const entry = rawEntry;
+		if ("appId" in entry || typeof entry.configKey !== "string" || entry.marketplaceName !== "openai-curated" || typeof entry.pluginName !== "string" || typeof entry.allowDestructiveActions !== "boolean" || !Array.isArray(entry.mcpServerNames) || entry.mcpServerNames.some((serverName) => typeof serverName !== "string")) return;
+		parsedApps[appId] = {
+			configKey: entry.configKey,
+			marketplaceName: entry.marketplaceName,
+			pluginName: entry.pluginName,
+			allowDestructiveActions: entry.allowDestructiveActions,
+			mcpServerNames: entry.mcpServerNames
+		};
+	}
+	const parsedPluginAppIds = {};
+	const rawPluginAppIds = record.pluginAppIds;
+	if (rawPluginAppIds && (typeof rawPluginAppIds !== "object" || Array.isArray(rawPluginAppIds))) return;
+	if (rawPluginAppIds && typeof rawPluginAppIds === "object") for (const [configKey, appIds] of Object.entries(rawPluginAppIds)) {
+		if (!Array.isArray(appIds) || appIds.some((appId) => typeof appId !== "string")) return;
+		parsedPluginAppIds[configKey] = appIds;
+	}
+	return {
+		fingerprint: record.fingerprint,
+		apps: parsedApps,
+		pluginAppIds: parsedPluginAppIds
+	};
+}
 async function clearCodexAppServerBinding(sessionFile) {
 	try {
 		await fs.unlink(resolveCodexAppServerBindingPath(sessionFile));
@@ -124,10 +163,10 @@ function normalizeCodexAppServerBindingModelProvider(params) {
 function resolveCodexAppServerAuthProfileCredential(lookup) {
 	const authProfileId = lookup.authProfileId?.trim();
 	if (!authProfileId) return;
-	return (lookup.authProfileStore ?? loadCodexAppServerAuthProfileStore(lookup.agentDir)).profiles[authProfileId];
+	return (lookup.authProfileStore ?? loadCodexAppServerAuthProfileStore(lookup.agentDir, lookup.config)).profiles[authProfileId];
 }
-function loadCodexAppServerAuthProfileStore(agentDir) {
-	return ensureAuthProfileStore(agentDir?.trim() || resolveOpenClawAgentDir$1(), { allowKeychainPrompt: false });
+function loadCodexAppServerAuthProfileStore(agentDir, config) {
+	return ensureAuthProfileStore(agentDir?.trim() || resolveDefaultAgentDir(config ?? {}), { allowKeychainPrompt: false });
 }
 function isCodexAppServerNativeAuthProvider(params) {
 	const provider = params.provider?.trim();
@@ -140,7 +179,7 @@ function readSandboxMode(value) {
 	return value === "read-only" || value === "workspace-write" || value === "danger-full-access" ? value : void 0;
 }
 function readServiceTier(value) {
-	return value === "fast" || value === "flex" ? value : void 0;
+	return normalizeCodexServiceTier(value);
 }
 //#endregion
 export { session_binding_exports as a, readCodexAppServerBinding as i, isCodexAppServerNativeAuthProfile as n, writeCodexAppServerBinding as o, normalizeCodexAppServerBindingModelProvider as r, clearCodexAppServerBinding as t };

package/dist/{shared-client-Dfk3Enm-.js → shared-client-p-TvEiNL.js}

@@ -1,13 +1,14 @@
 import { t as __exportAll } from "./rolldown-runtime-DUslC3ob.js";
-import { i as resolveCodexAppServerRuntimeOptions, t as codexAppServerStartOptionsKey } from "./config-ByrA30No.js";
-import { a as MANAGED_CODEX_APP_SERVER_PACKAGE, o as resolveCodexAppServerSpawnEnv, t as CodexAppServerClient } from "./client-BGbqC7jk.js";
+import { n as codexAppServerStartOptionsKey, s as resolveCodexAppServerRuntimeOptions } from "./config-CT01BBDc.js";
+import { a as MANAGED_CODEX_APP_SERVER_PACKAGE, o as resolveCodexAppServerSpawnEnv, t as CodexAppServerClient } from "./client-CTzy3Y6M.js";
 import { createRequire } from "node:module";
+import { createHash } from "node:crypto";
+import { constants, readFileSync } from "node:fs";
 import fs, { access } from "node:fs/promises";
 import path from "node:path";
-import { ensureAuthProfileStore, loadAuthProfileStoreForSecretsRuntime, resolveApiKeyForProfile, resolveAuthProfileOrder, resolveOpenClawAgentDir, resolvePersistedAuthProfileOwnerAgentDir, resolveProviderIdForAuth, saveAuthProfileStore } from "openclaw/plugin-sdk/agent-runtime";
-import { resolveOpenClawAgentDir as resolveOpenClawAgentDir$1 } from "openclaw/plugin-sdk/provider-auth";
-import { constants, readFileSync } from "node:fs";
+import { ensureAuthProfileStore, loadAuthProfileStoreForSecretsRuntime, resolveApiKeyForProfile, resolveAuthProfileOrder, resolveDefaultAgentDir, resolvePersistedAuthProfileOwnerAgentDir, resolveProviderIdForAuth, saveAuthProfileStore } from "openclaw/plugin-sdk/agent-runtime";
 import { fileURLToPath } from "node:url";
+import { withTimeout } from "openclaw/plugin-sdk/security-runtime";
 //#region extensions/codex/src/app-server/auth-bridge.ts
 const CODEX_APP_SERVER_AUTH_PROVIDER = "openai-codex";
 const OPENAI_CODEX_DEFAULT_PROFILE_ID = "openai-codex:default";
@@ -41,13 +42,68 @@ function resolveCodexAppServerAuthProfileId(params) {
 	})[0]?.trim();
 }
 function resolveCodexAppServerAuthProfileIdForAgent(params) {
-	const store = ensureAuthProfileStore(params.agentDir?.trim() || resolveOpenClawAgentDir(), { allowKeychainPrompt: false });
+	const store = ensureAuthProfileStore(params.agentDir?.trim() || resolveDefaultAgentDir(params.config ?? {}), { allowKeychainPrompt: false });
 	return resolveCodexAppServerAuthProfileId({
 		authProfileId: params.authProfileId,
 		store,
 		config: params.config
 	});
 }
+async function resolveCodexAppServerAuthAccountCacheKey(params) {
+	const agentDir = params.agentDir?.trim() || resolveDefaultAgentDir(params.config ?? {});
+	const store = params.authProfileStore ?? ensureAuthProfileStore(agentDir, { allowKeychainPrompt: false });
+	const profileId = resolveCodexAppServerAuthProfileId({
+		authProfileId: params.authProfileId,
+		store,
+		config: params.config
+	});
+	if (!profileId) return;
+	const credential = store.profiles[profileId];
+	if (!credential || !isCodexAppServerAuthProvider(credential.provider, params.config)) return;
+	if (credential.type === "api_key") {
+		const apiKey = (await resolveApiKeyForProfile({
+			store,
+			profileId,
+			agentDir
+		}))?.apiKey?.trim();
+		return apiKey ? `${resolveChatgptAccountId(profileId, credential)}:${fingerprintApiKeyAuthProfileCacheKey(apiKey)}` : resolveChatgptAccountId(profileId, credential);
+	}
+	if (credential.type === "token") {
+		const accessToken = (await resolveApiKeyForProfile({
+			store,
+			profileId,
+			agentDir
+		}))?.apiKey?.trim();
+		return accessToken ? `${resolveChatgptAccountId(profileId, credential)}:${fingerprintTokenAuthProfileCacheKey(accessToken)}` : resolveChatgptAccountId(profileId, credential);
+	}
+	return resolveChatgptAccountId(profileId, credential);
+}
+function resolveCodexAppServerEnvApiKeyCacheKey(params) {
+	if (params.startOptions.transport !== "stdio") return;
+	const apiKey = readFirstNonEmptyEnvEntry(resolveCodexAppServerSpawnEnv(params.startOptions, params.baseEnv ?? process.env, params.platform ?? process.platform), CODEX_APP_SERVER_API_KEY_ENV_VARS);
+	if (!apiKey) return;
+	const hash = createHash("sha256");
+	hash.update("openclaw:codex:app-server-env-api-key:v1");
+	hash.update("\0");
+	hash.update(apiKey.key);
+	hash.update("\0");
+	hash.update(apiKey.value);
+	return `${apiKey.key}:sha256:${hash.digest("hex")}`;
+}
+function fingerprintApiKeyAuthProfileCacheKey(apiKey) {
+	const hash = createHash("sha256");
+	hash.update("openclaw:codex:app-server-auth-profile-api-key:v1");
+	hash.update("\0");
+	hash.update(apiKey);
+	return `api_key:sha256:${hash.digest("hex")}`;
+}
+function fingerprintTokenAuthProfileCacheKey(accessToken) {
+	const hash = createHash("sha256");
+	hash.update("openclaw:codex:app-server-auth-profile-token:v1");
+	hash.update("\0");
+	hash.update(accessToken);
+	return `token:sha256:${hash.digest("hex")}`;
+}
 function resolveCodexAppServerHomeDir(agentDir) {
 	return path.join(path.resolve(agentDir), CODEX_APP_SERVER_HOME_DIRNAME);
 }
@@ -157,6 +213,7 @@ async function resolveLoginParamsForCredential(profileId, credential, params) {
 		}))?.apiKey?.trim();
 		return accessToken ? buildChatgptAuthTokensParams(profileId, credential, accessToken) : void 0;
 	}
+	if (credential.type !== "oauth") return;
 	const resolvedCredential = await resolveOAuthCredentialForCodexAppServer(profileId, credential, {
 		agentDir: params.agentDir,
 		forceRefresh: params.forceOAuthRefresh,
@@ -214,9 +271,15 @@ function withClearedEnvironmentVariables(startOptions, envVars) {
 	};
 }
 function readFirstNonEmptyEnv(env, keys) {
+	return readFirstNonEmptyEnvEntry(env, keys)?.value;
+}
+function readFirstNonEmptyEnvEntry(env, keys) {
 	for (const key of keys) {
 		const value = env[key]?.trim();
-		if (value) return value;
+		if (value) return {
+			key,
+			value
+		};
 	}
 }
 function buildChatgptAuthTokensParams(profileId, credential, accessToken) {
@@ -339,16 +402,8 @@ async function commandPathExists(filePath, platform) {
 }
 //#endregion
 //#region extensions/codex/src/app-server/timeout.ts
-async function withTimeout(promise, timeoutMs, timeoutMessage) {
-	if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) return await promise;
-	let timeout;
-	try {
-		return await Promise.race([promise, new Promise((_, reject) => {
-			timeout = setTimeout(() => reject(new Error(timeoutMessage)), Math.max(1, timeoutMs));
-		})]);
-	} finally {
-		if (timeout) clearTimeout(timeout);
-	}
+async function withTimeout$1(promise, timeoutMs, timeoutMessage) {
+	return await withTimeout(promise, timeoutMs, { message: timeoutMessage });
 }
 //#endregion
 //#region extensions/codex/src/app-server/shared-client.ts
@@ -367,7 +422,7 @@ function getSharedCodexAppServerClientState() {
 }
 async function getSharedCodexAppServerClient(options) {
 	const state = getSharedCodexAppServerClientState();
-	const agentDir = options?.agentDir ?? resolveOpenClawAgentDir$1();
+	const agentDir = options?.agentDir ?? resolveDefaultAgentDir(options?.config ?? {});
 	const authProfileId = resolveCodexAppServerAuthProfileIdForAgent({
 		authProfileId: options?.authProfileId,
 		agentDir,
@@ -405,14 +460,14 @@ async function getSharedCodexAppServerClient(options) {
 		}
 	})());
 	try {
-		return await withTimeout(sharedPromise, options?.timeoutMs ?? 0, "codex app-server initialize timed out");
+		return await withTimeout$1(sharedPromise, options?.timeoutMs ?? 0, "codex app-server initialize timed out");
 	} catch (error) {
 		if (state.promise === sharedPromise && state.key === key) clearSharedCodexAppServerClient();
 		throw error;
 	}
 }
 async function createIsolatedCodexAppServerClient(options) {
-	const agentDir = options?.agentDir ?? resolveOpenClawAgentDir$1();
+	const agentDir = options?.agentDir ?? resolveDefaultAgentDir(options?.config ?? {});
 	const authProfileId = resolveCodexAppServerAuthProfileIdForAgent({
 		authProfileId: options?.authProfileId,
 		agentDir,
@@ -427,7 +482,7 @@ async function createIsolatedCodexAppServerClient(options) {
 	const client = CodexAppServerClient.start(startOptions);
 	const initialize = client.initialize();
 	try {
-		await withTimeout(initialize, options?.timeoutMs ?? 0, "codex app-server initialize timed out");
+		await withTimeout$1(initialize, options?.timeoutMs ?? 0, "codex app-server initialize timed out");
 		await applyCodexAppServerAuthProfile({
 			client,
 			agentDir,
@@ -476,4 +531,4 @@ function clearSharedClientIfCurrent(client) {
 	state.key = void 0;
 }
 //#endregion
-export { refreshCodexAppServerAuthTokens as a, withTimeout as i, getSharedCodexAppServerClient as n, resolveCodexAppServerAuthProfileId as o, shared_client_exports as r, resolveCodexAppServerAuthProfileIdForAgent as s, clearSharedCodexAppServerClientIfCurrent as t };
+export { refreshCodexAppServerAuthTokens as a, resolveCodexAppServerAuthProfileIdForAgent as c, withTimeout$1 as i, resolveCodexAppServerEnvApiKeyCacheKey as l, getSharedCodexAppServerClient as n, resolveCodexAppServerAuthAccountCacheKey as o, shared_client_exports as r, resolveCodexAppServerAuthProfileId as s, clearSharedCodexAppServerClientIfCurrent as t, resolveCodexAppServerHomeDir as u };

package/dist/test-api.js

@@ -1,10 +1,11 @@
-import { i as resolveCodexAppServerRuntimeOptions } from "./config-ByrA30No.js";
-import { a as buildTurnStartParams, c as createCodexDynamicToolBridge, i as buildThreadStartParams, l as applyCodexDynamicToolProfile, n as buildDeveloperInstructions, r as buildThreadResumeParams } from "./thread-lifecycle-CzllX4PU.js";
+import { s as resolveCodexAppServerRuntimeOptions } from "./config-CT01BBDc.js";
+import { a as buildTurnStartParams, d as createCodexDynamicToolBridge, f as filterCodexDynamicTools, i as buildThreadStartParams, n as buildDeveloperInstructions, r as buildThreadResumeParams } from "./thread-lifecycle-DtD_qoMW.js";
 //#region extensions/codex/test-api.ts
 function resolveCodexPromptSnapshotAppServerOptions(pluginConfig) {
 	return resolveCodexAppServerRuntimeOptions({
 		pluginConfig,
-		env: {}
+		env: {},
+		requirementsToml: null
 	});
 }
 function buildCodexHarnessPromptSnapshot(params) {
@@ -34,8 +35,10 @@ function buildCodexHarnessPromptSnapshot(params) {
 }
 function createCodexDynamicToolSpecsForPromptSnapshot(params) {
 	return createCodexDynamicToolBridge({
-		tools: applyCodexDynamicToolProfile(params.tools, params.pluginConfig ?? {}),
-		signal: new AbortController().signal
+		tools: filterCodexDynamicTools(params.tools, params.pluginConfig ?? {}),
+		signal: new AbortController().signal,
+		loading: params.pluginConfig?.codexDynamicToolsLoading ?? "searchable",
+		directToolNames: params.directToolNames
 	}).specs;
 }
 //#endregion