@openclaw/codex 2026.6.1 → 2026.6.5-beta.1

package/dist/client-factory-Bt49r45B.js

@@ -0,0 +1,17 @@
+//#region extensions/codex/src/app-server/client-factory.ts
+let sharedClientModulePromise = null;
+const loadSharedClientModule = async () => {
+	sharedClientModulePromise ??= import("./shared-client-xytpSKD0.js").then((n) => n.c);
+	return await sharedClientModulePromise;
+};
+/** Returns a leased shared client so startup can release ownership explicitly. */
+const defaultLeasedCodexAppServerClientFactory = (startOptions, authProfileId, agentDir, config, options) => loadSharedClientModule().then(({ getLeasedSharedCodexAppServerClient }) => getLeasedSharedCodexAppServerClient({
+	startOptions,
+	authProfileId,
+	agentDir,
+	config,
+	onStartedClient: options?.onStartedClient,
+	abandonSignal: options?.abandonSignal
+}));
+//#endregion
+export { defaultLeasedCodexAppServerClientFactory as t };

package/dist/{client-BnOmn0y-.js → client-kMCtlApt.js}

@@ -1,4 +1,4 @@
-import { d as resolveCodexAppServerRuntimeOptions } from "./config-AlzuNKCY.js";
+import { l as resolveCodexAppServerRuntimeOptions } from "./config-BT6SLiE6.js";
 import { materializeWindowsSpawnProgram, resolveWindowsSpawnProgram } from "openclaw/plugin-sdk/windows-spawn";
 import { OPENCLAW_VERSION, embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { createInterface } from "node:readline";
@@ -15,6 +15,10 @@ function isRpcResponse(message) {
 }
 //#endregion
 //#region extensions/codex/src/app-server/transport-stdio.ts
+/**
+* Creates and configures stdio-backed Codex app-server transports, including
+* Windows spawn normalization and environment filtering.
+*/
 const UNSAFE_ENVIRONMENT_KEYS = new Set([
 	"__proto__",
 	"constructor",
@@ -25,6 +29,7 @@ const DEFAULT_SPAWN_RUNTIME = {
 	env: process.env,
 	execPath: process.execPath
 };
+/** Resolves the concrete command/argv/shell settings used to spawn Codex app-server. */
 function resolveCodexAppServerSpawnInvocation(options, runtime = DEFAULT_SPAWN_RUNTIME) {
 	if (options.commandSource === "managed") throw new Error("Managed Codex app-server start options must be resolved before spawn.");
 	const resolved = materializeWindowsSpawnProgram(resolveWindowsSpawnProgram({
@@ -41,6 +46,7 @@ function resolveCodexAppServerSpawnInvocation(options, runtime = DEFAULT_SPAWN_R
 		windowsHide: resolved.windowsHide
 	};
 }
+/** Merges app-server environment overrides while honoring clearEnv and unsafe key filtering. */
 function resolveCodexAppServerSpawnEnv(options, baseEnv = process.env, platform = process.platform) {
 	const env = Object.create(null);
 	copySafeEnvironmentEntries(env, baseEnv);
@@ -66,6 +72,7 @@ function copySafeEnvironmentEntries(target, source) {
 		target[key] = value;
 	}
 }
+/** Spawns the Codex app-server process and returns the shared transport interface. */
 function createStdioTransport(options) {
 	const env = resolveCodexAppServerSpawnEnv(options);
 	const invocation = resolveCodexAppServerSpawnInvocation(options, {
@@ -87,6 +94,11 @@ function createStdioTransport(options) {
 }
 //#endregion
 //#region extensions/codex/src/app-server/transport-websocket.ts
+/**
+* Adapts a remote Codex app-server WebSocket endpoint to the shared stdio-like
+* transport interface.
+*/
+/** Opens a WebSocket app-server transport and maps newline-delimited frames to stdout/stdin. */
 function createWebSocketTransport(options) {
 	if (!options.url) throw new Error("codex app-server websocket transport requires plugins.entries.codex.config.appServer.url");
 	const events = new EventEmitter();
@@ -152,6 +164,7 @@ function websocketFrameToText(data) {
 }
 //#endregion
 //#region extensions/codex/src/app-server/transport.ts
+/** Starts graceful transport shutdown and schedules a force kill fallback. */
 function closeCodexAppServerTransport(child, options = {}) {
 	child.stdin.end?.();
 	child.stdin.destroy?.();
@@ -171,6 +184,7 @@ function closeCodexAppServerTransport(child, options = {}) {
 	child.stderr.unref?.();
 	child.stdin.unref?.();
 }
+/** Closes a transport and waits briefly for an exit event. */
 async function closeCodexAppServerTransportAndWait(child, options = {}) {
 	if (!hasCodexAppServerTransportExited(child)) closeCodexAppServerTransport(child, options);
 	return await waitForCodexAppServerTransportExit(child, options.exitTimeoutMs ?? 2e3);
@@ -206,17 +220,28 @@ function signalCodexAppServerTransport(child, signal) {
 }
 //#endregion
 //#region extensions/codex/src/app-server/version.ts
+/**
+* Version and package pins for the managed Codex app-server runtime.
+*/
+/** Minimum Codex app-server version supported by the OpenClaw Codex bridge. */
 const MIN_CODEX_APP_SERVER_VERSION = "0.125.0";
+/** Minimum Codex app-server version that supports sandbox exec-server environments. */
 const MIN_CODEX_SANDBOX_EXEC_SERVER_APP_SERVER_VERSION = "0.132.0";
+/** npm package name for the managed Codex app-server binary. */
 const MANAGED_CODEX_APP_SERVER_PACKAGE = "@openai/codex";
 //#endregion
 //#region extensions/codex/src/app-server/client.ts
+/**
+* JSON-RPC client for Codex app-server transports, including request/response
+* routing, notification fanout, server request handlers, and version checks.
+*/
 const CODEX_APP_SERVER_PARSE_LOG_MAX = 500;
 const CODEX_APP_SERVER_PARSE_BUFFER_MAX = 1e6;
 const CODEX_APP_SERVER_PARSE_BUFFER_MAX_LINES = 1e3;
 const CODEX_DYNAMIC_TOOL_SERVER_REQUEST_TIMEOUT_MS = 6e5;
 const CODEX_APP_SERVER_STDERR_TAIL_MAX = 2e3;
 const UNPAIRED_SURROGATE_RE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g;
+/** RPC error wrapper that preserves app-server error code and data. */
 var CodexAppServerRpcError = class extends Error {
 	constructor(error, method) {
 		super(formatCodexAppServerRpcErrorMessage(error, method));
@@ -241,10 +266,12 @@ function readCodexAppServerRpcReloginDetail(data) {
 function isJsonObject(value) {
 	return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
+/** Returns true for errors that mean the app-server transport is closed. */
 function isCodexAppServerConnectionClosedError(error) {
 	if (!(error instanceof Error)) return false;
 	return error.message === "codex app-server client is closed" || error.message.startsWith("codex app-server exited:");
 }
+/** Stateful app-server JSON-RPC client over stdio or websocket transport. */
 var CodexAppServerClient = class CodexAppServerClient {
 	constructor(child) {
 		this.pending = /* @__PURE__ */ new Map();
@@ -270,6 +297,7 @@ var CodexAppServerClient = class CodexAppServerClient {
 		});
 		child.stdin.on?.("error", (error) => this.closeWithError(error instanceof Error ? error : new Error(String(error))));
 	}
+	/** Starts a new app-server client using resolved runtime start options. */
 	static start(options) {
 		const defaults = resolveCodexAppServerRuntimeOptions().start;
 		const startOptions = {
@@ -281,9 +309,11 @@ var CodexAppServerClient = class CodexAppServerClient {
 		if (startOptions.transport === "websocket") return new CodexAppServerClient(createWebSocketTransport(startOptions));
 		return new CodexAppServerClient(createStdioTransport(startOptions));
 	}
+	/** Builds a client around a fake transport for tests. */
 	static fromTransportForTests(child) {
 		return new CodexAppServerClient(child);
 	}
+	/** Performs the app-server initialize handshake and validates protocol version. */
 	async initialize() {
 		if (this.initialized) return;
 		const response = await this.request("initialize", {
@@ -298,6 +328,7 @@ var CodexAppServerClient = class CodexAppServerClient {
 		this.notify("initialized");
 		this.initialized = true;
 	}
+	/** Returns the version detected during initialize. */
 	getServerVersion() {
 		return this.serverVersion;
 	}
@@ -361,34 +392,42 @@ var CodexAppServerClient = class CodexAppServerClient {
 			}
 		});
 	}
+	/** Sends a fire-and-forget JSON-RPC notification to the app-server. */
 	notify(method, params) {
 		this.writeMessage({
 			method,
 			params
 		});
 	}
+	/** Registers a handler for app-server requests sent back to OpenClaw. */
 	addRequestHandler(handler) {
 		this.requestHandlers.add(handler);
 		return () => this.requestHandlers.delete(handler);
 	}
+	/** Registers a notification handler and returns its disposer. */
 	addNotificationHandler(handler) {
 		this.notificationHandlers.add(handler);
 		return () => this.notificationHandlers.delete(handler);
 	}
+	/** Installs a lease-count provider used to route unscoped notifications. */
 	setActiveSharedLeaseCountProviderForUnscopedNotifications(provider) {
 		this.activeSharedLeaseCountProvider = provider;
 	}
+	/** Reads the active shared-client lease count when available. */
 	getActiveSharedLeaseCountForUnscopedNotifications() {
 		return this.activeSharedLeaseCountProvider?.();
 	}
+	/** Registers a close handler and returns its disposer. */
 	addCloseHandler(handler) {
 		this.closeHandlers.add(handler);
 		return () => this.closeHandlers.delete(handler);
 	}
+	/** Closes the transport without waiting for process/socket shutdown. */
 	close() {
 		if (!this.markClosed(/* @__PURE__ */ new Error("codex app-server client is closed"))) return;
 		closeCodexAppServerTransport(this.child);
 	}
+	/** Closes the transport and waits for shutdown according to transport policy. */
 	async closeAndWait(options) {
 		this.markClosed(/* @__PURE__ */ new Error("codex app-server client is closed"));
 		await closeCodexAppServerTransportAndWait(this.child, options);
@@ -600,9 +639,11 @@ function assertSupportedCodexAppServerVersion(response) {
 	if (compareCodexAppServerVersions(detectedVersion, "0.125.0") < 0) throw new Error(`Codex app-server ${MIN_CODEX_APP_SERVER_VERSION} or newer is required, but detected ${detectedVersion}. Update the configured Codex app-server binary, or remove custom command overrides to use the managed binary.`);
 	return detectedVersion;
 }
+/** Extracts the Codex version from the app-server initialize user-agent field. */
 function readCodexVersionFromUserAgent(userAgent) {
 	return (userAgent?.match(/^[^/]+\/(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)(?:[\s(]|$)/))?.[1];
 }
+/** Compares stable Codex app-server versions for protocol floor checks. */
 function compareCodexAppServerVersions(left, right) {
 	const leftVersion = parseVersionForComparison(left);
 	const rightVersion = parseVersionForComparison(right);
@@ -660,6 +701,7 @@ const CODEX_APP_SERVER_APPROVAL_REQUEST_METHODS = new Set([
 	"item/fileChange/requestApproval",
 	"item/permissions/requestApproval"
 ]);
+/** Returns true for app-server approval request methods OpenClaw can answer. */
 function isCodexAppServerApprovalRequest(method) {
 	return CODEX_APP_SERVER_APPROVAL_REQUEST_METHODS.has(method);
 }

package/dist/{command-handlers-VhJdcXcI.js → command-handlers-DMn2M7W7.js}

@@ -1,13 +1,13 @@
-import { d as resolveCodexAppServerRuntimeOptions, o as isCodexFastServiceTier } from "./config-AlzuNKCY.js";
-import { n as listCodexAppServerModels, t as listAllCodexAppServerModels } from "./models-DAJvlyJu.js";
-import { l as isJsonObject } from "./client-BnOmn0y-.js";
-import { a as readCodexAppServerBinding, s as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-DWiEGATW.js";
-import { i as describeControlFailure, r as CODEX_CONTROL_METHODS, t as requestCodexAppServerJson } from "./request-CPtFWp-f.js";
-import { a as buildHelp, c as formatCodexStatus, d as formatModels, f as formatSkills, l as formatComputerUseStatus, m as readString$1, o as formatAccount, p as formatThreads, s as formatCodexDisplayText, u as formatList, v as summarizeCodexAccountUsage } from "./notification-correlation-BykOI_jh.js";
-import { n as resolveCodexNativeExecutionBlock, r as resolveCodexNativeSandboxBlock } from "./sandbox-guard-DMCJlzmz.js";
-import { _ as steerCodexConversationTurn, b as readCodexConversationBindingData, d as parseCodexFastModeArg, f as parseCodexPermissionsModeArg, g as setCodexConversationPermissions, h as setCodexConversationModel, m as setCodexConversationFastMode, o as formatCodexCliSessions, p as readCodexConversationActiveTurn, r as startCodexConversationThread, u as formatPermissionsMode, v as stopCodexConversationTurn, x as resolveCodexDefaultWorkspaceDir, y as createCodexCliNodeConversationBindingData } from "./conversation-binding-CqVPKJPp.js";
-import { n as installCodexComputerUse, r as readCodexComputerUseStatus } from "./computer-use-DYLSxIfq.js";
-import { n as rememberCodexRateLimits } from "./rate-limit-cache-N66I-Rd7.js";
+import { a as isCodexFastServiceTier, l as resolveCodexAppServerRuntimeOptions } from "./config-BT6SLiE6.js";
+import { n as listCodexAppServerModels, t as listAllCodexAppServerModels } from "./models-DXorTaja.js";
+import { l as isJsonObject } from "./client-kMCtlApt.js";
+import { a as readCodexAppServerBinding, s as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-BgTv_YGm.js";
+import { i as describeControlFailure, r as CODEX_CONTROL_METHODS, t as requestCodexAppServerJson } from "./request-D64BfplD.js";
+import { a as buildHelp, c as formatCodexStatus, d as formatModels, f as formatSkills, l as formatComputerUseStatus, m as readString$1, o as formatAccount, p as formatThreads, s as formatCodexDisplayText, u as formatList, v as summarizeCodexAccountUsage } from "./notification-correlation-o8quHmTK.js";
+import { n as resolveCodexNativeExecutionBlock, r as resolveCodexNativeSandboxBlock } from "./sandbox-guard-C-Yv9uwY.js";
+import { _ as steerCodexConversationTurn, b as readCodexConversationBindingData, d as parseCodexFastModeArg, f as parseCodexPermissionsModeArg, g as setCodexConversationPermissions, h as setCodexConversationModel, m as setCodexConversationFastMode, o as formatCodexCliSessions, p as readCodexConversationActiveTurn, r as startCodexConversationThread, u as formatPermissionsMode, v as stopCodexConversationTurn, x as resolveCodexDefaultWorkspaceDir, y as createCodexCliNodeConversationBindingData } from "./conversation-binding-CzpvaBs1.js";
+import { n as installCodexComputerUse, r as readCodexComputerUseStatus } from "./computer-use-ClweWaMz.js";
+import { n as rememberCodexRateLimits } from "./rate-limit-cache-C7qmZ0Jh.js";
 import { parseStrictPositiveInteger } from "openclaw/plugin-sdk/number-runtime";
 import crypto from "node:crypto";
 import { normalizeOptionalString, normalizeUniqueStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";

package/dist/{compact-D1dSrNrT.js → compact-CwnPeYnM.js}

@@ -1,10 +1,18 @@
-import { d as resolveCodexAppServerRuntimeOptions } from "./config-AlzuNKCY.js";
-import { a as readCodexAppServerBinding } from "./session-binding-DWiEGATW.js";
-import { n as resolveCodexNativeExecutionBlock } from "./sandbox-guard-DMCJlzmz.js";
-import { t as defaultCodexAppServerClientFactory } from "./client-factory-3ykiiX2z.js";
+import { l as resolveCodexAppServerRuntimeOptions } from "./config-BT6SLiE6.js";
+import { a as readCodexAppServerBinding } from "./session-binding-BgTv_YGm.js";
+import { o as releaseLeasedSharedCodexAppServerClient } from "./shared-client-xytpSKD0.js";
+import { n as resolveCodexNativeExecutionBlock } from "./sandbox-guard-C-Yv9uwY.js";
+import { t as defaultLeasedCodexAppServerClientFactory } from "./client-factory-Bt49r45B.js";
 import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/compact.ts
+/**
+* Native Codex app-server compaction bridge for bound OpenClaw sessions.
+*/
 const warnedIgnoredCompactionOverrides = /* @__PURE__ */ new Set();
+/**
+* Starts native Codex compaction for a manually requested bound session, or
+* reports why Codex-owned automatic compaction should handle the trigger.
+*/
 async function maybeCompactCodexAppServerSession(params, options = {}) {
 	warnIfIgnoringOpenClawCompactionOverrides(params);
 	return compactCodexNativeThread(params, options);
@@ -109,7 +117,8 @@ async function compactCodexNativeThread(params, options = {}) {
 		compacted: false,
 		reason: "auth profile mismatch for session binding"
 	};
-	const client = await (options.clientFactory ?? defaultCodexAppServerClientFactory)(appServer.start, requestedAuthProfileId ?? binding.authProfileId, params.agentDir, params.config);
+	const shouldReleaseDefaultLease = !options.clientFactory;
+	const client = await (options.clientFactory ?? defaultLeasedCodexAppServerClientFactory)(appServer.start, requestedAuthProfileId ?? binding.authProfileId, params.agentDir, params.config);
 	try {
 		await client.request("thread/compact/start", { threadId: binding.threadId });
 		embeddedAgentLog.info("started codex app-server compaction", {
@@ -133,6 +142,8 @@ async function compactCodexNativeThread(params, options = {}) {
 			compacted: false,
 			reason: formatCompactionError(error)
 		};
+	} finally {
+		if (shouldReleaseDefaultLease) releaseLeasedSharedCodexAppServerClient(client);
 	}
 	const resultDetails = {
 		backend: "codex-app-server",

package/dist/{computer-use-DYLSxIfq.js → computer-use-ClweWaMz.js}

@@ -1,7 +1,11 @@
-import { d as resolveCodexAppServerRuntimeOptions, f as resolveCodexComputerUseConfig } from "./config-AlzuNKCY.js";
-import { i as describeControlFailure, t as requestCodexAppServerJson } from "./request-CPtFWp-f.js";
+import { l as resolveCodexAppServerRuntimeOptions, u as resolveCodexComputerUseConfig } from "./config-BT6SLiE6.js";
+import { i as describeControlFailure, t as requestCodexAppServerJson } from "./request-D64BfplD.js";
 import { existsSync } from "node:fs";
 //#region extensions/codex/src/app-server/computer-use.ts
+/**
+* Computer Use plugin/MCP readiness checks and optional install flow for Codex
+* app-server sessions.
+*/
 var CodexComputerUseSetupError = class extends Error {
 	constructor(status) {
 		super(status.message);
@@ -16,6 +20,7 @@ const COMPUTER_USE_MARKETPLACE_NAME_PRIORITY = [
 	"local"
 ];
 const DEFAULT_CODEX_BUNDLED_MARKETPLACE_PATH = "/Applications/Codex.app/Contents/Resources/plugins/openai-bundled";
+/** Reads Computer Use readiness without installing or mutating app-server state. */
 async function readCodexComputerUseStatus(params = {}) {
 	const config = resolveComputerUseConfig(params);
 	if (!config.enabled) return disabledStatus(config);
@@ -29,6 +34,10 @@ async function readCodexComputerUseStatus(params = {}) {
 		return unavailableStatus(config, "check_failed", `Computer Use check failed: ${describeControlFailure(error)}`);
 	}
 }
+/**
+* Ensures Computer Use is ready when enabled, optionally installing when config
+* allows safe auto-install.
+*/
 async function ensureCodexComputerUse(params = {}) {
 	const config = resolveComputerUseConfig(params);
 	if (!config.enabled) return disabledStatus(config);
@@ -52,6 +61,7 @@ async function ensureCodexComputerUse(params = {}) {
 	if (!status.ready) throw new CodexComputerUseSetupError(status);
 	return status;
 }
+/** Forces Computer Use plugin installation and returns the ready status. */
 async function installCodexComputerUse(params = {}) {
 	const config = resolveComputerUseConfig({
 		...params,

package/dist/{config-AlzuNKCY.js → config-BT6SLiE6.js}

@@ -13,15 +13,7 @@ const START_OPTIONS_KEY_SECRET = getStartOptionsKeySecret();
 const UNIX_CODEX_REQUIREMENTS_PATH = "/etc/codex/requirements.toml";
 const WINDOWS_CODEX_REQUIREMENTS_SUFFIX = "\\OpenAI\\Codex\\requirements.toml";
 const PLAIN_DECIMAL_NUMBER_RE = /^[+-]?(?:(?:\d+\.?\d*)|(?:\.\d+))$/;
-const CODEX_PLUGINS_MARKETPLACE_NAMES = [
-	"openai-curated",
-	"openai-bundled",
-	"openai-primary-runtime"
-];
 const CODEX_PLUGINS_MARKETPLACE_NAME = "openai-curated";
-function isCodexPluginsMarketplaceName(name) {
-	return name !== void 0 && CODEX_PLUGINS_MARKETPLACE_NAMES.includes(name);
-}
 function shouldAutoApproveCodexAppServerApprovals(appServer) {
 	return appServer.approvalPolicy === "never" && appServer.sandbox === "danger-full-access";
 }
@@ -51,7 +43,7 @@ const codexAppServerServiceTierSchema = z.preprocess((value) => value === null ?
 const codexAppServerExperimentalSchema = z.object({ sandboxExecServer: z.boolean().optional() }).strict();
 const codexPluginEntryConfigSchema = z.object({
 	enabled: z.boolean().optional(),
-	marketplaceName: z.enum(CODEX_PLUGINS_MARKETPLACE_NAMES).optional(),
+	marketplaceName: z.literal(CODEX_PLUGINS_MARKETPLACE_NAME).optional(),
 	pluginName: z.string().trim().min(1).optional(),
 	allow_destructive_actions: z.boolean().optional()
 }).strict();
@@ -130,10 +122,10 @@ function resolveCodexPluginsPolicy(pluginConfig) {
 		enabled,
 		allowDestructiveActions,
 		pluginPolicies: Object.entries(config?.plugins ?? {}).flatMap(([configKey, entry]) => {
-			if (!isCodexPluginsMarketplaceName(entry.marketplaceName) || !entry.pluginName) return [];
+			if (entry.marketplaceName !== "openai-curated" || !entry.pluginName) return [];
 			return [{
 				configKey,
-				marketplaceName: entry.marketplaceName,
+				marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
 				pluginName: entry.pluginName,
 				enabled: enabled && entry.enabled !== false,
 				allowDestructiveActions: entry.allow_destructive_actions ?? allowDestructiveActions
@@ -765,4 +757,4 @@ function splitShellWords(value) {
 	return words;
 }
 //#endregion
-export { isCodexAppServerApprovalPolicyAllowedByRequirements as a, isCodexSandboxExecServerEnabled as c, resolveCodexAppServerRuntimeOptions as d, resolveCodexComputerUseConfig as f, withMcpElicitationsApprovalPolicy as g, shouldAutoApproveCodexAppServerApprovals as h, codexSandboxPolicyForTurn as i, normalizeCodexServiceTier as l, resolveOpenClawExecPolicyForCodexAppServer as m, CODEX_PLUGINS_MARKETPLACE_NAMES as n, isCodexFastServiceTier as o, resolveCodexPluginsPolicy as p, codexAppServerStartOptionsKey as r, isCodexPluginsMarketplaceName as s, CODEX_PLUGINS_MARKETPLACE_NAME as t, readCodexPluginConfig as u };
+export { isCodexFastServiceTier as a, readCodexPluginConfig as c, resolveCodexPluginsPolicy as d, resolveOpenClawExecPolicyForCodexAppServer as f, isCodexAppServerApprovalPolicyAllowedByRequirements as i, resolveCodexAppServerRuntimeOptions as l, withMcpElicitationsApprovalPolicy as m, codexAppServerStartOptionsKey as n, isCodexSandboxExecServerEnabled as o, shouldAutoApproveCodexAppServerApprovals as p, codexSandboxPolicyForTurn as r, normalizeCodexServiceTier as s, CODEX_PLUGINS_MARKETPLACE_NAME as t, resolveCodexComputerUseConfig as u };

package/dist/{conversation-binding-CqVPKJPp.js → conversation-binding-CzpvaBs1.js}

@@ -1,11 +1,11 @@
-import { d as resolveCodexAppServerRuntimeOptions, i as codexSandboxPolicyForTurn, m as resolveOpenClawExecPolicyForCodexAppServer, o as isCodexFastServiceTier } from "./config-AlzuNKCY.js";
-import { l as isJsonObject } from "./client-BnOmn0y-.js";
-import { t as CODEX_NATIVE_PERSONALITY_NONE } from "./thread-lifecycle-6nrEQZMV.js";
-import { a as readCodexAppServerBinding, i as normalizeCodexAppServerBindingModelProvider, r as isCodexAppServerNativeAuthProfile, s as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-DWiEGATW.js";
-import { r as CODEX_CONTROL_METHODS } from "./request-CPtFWp-f.js";
-import { i as readCodexNotificationTurnId, r as readCodexNotificationThreadId, s as formatCodexDisplayText } from "./notification-correlation-BykOI_jh.js";
-import { a as releaseLeasedSharedCodexAppServerClient, f as resolveCodexAppServerAuthProfileIdForAgent, i as getLeasedSharedCodexAppServerClient } from "./shared-client-DUWLidr5.js";
-import { n as resolveCodexNativeExecutionBlock, r as resolveCodexNativeSandboxBlock } from "./sandbox-guard-DMCJlzmz.js";
+import { a as isCodexFastServiceTier, f as resolveOpenClawExecPolicyForCodexAppServer, l as resolveCodexAppServerRuntimeOptions, r as codexSandboxPolicyForTurn } from "./config-BT6SLiE6.js";
+import { l as isJsonObject } from "./client-kMCtlApt.js";
+import { t as CODEX_NATIVE_PERSONALITY_NONE } from "./thread-lifecycle-BJsazZ8j.js";
+import { a as readCodexAppServerBinding, i as normalizeCodexAppServerBindingModelProvider, r as isCodexAppServerNativeAuthProfile, s as writeCodexAppServerBinding, t as clearCodexAppServerBinding } from "./session-binding-BgTv_YGm.js";
+import { r as CODEX_CONTROL_METHODS } from "./request-D64BfplD.js";
+import { i as readCodexNotificationTurnId, r as readCodexNotificationThreadId, s as formatCodexDisplayText } from "./notification-correlation-o8quHmTK.js";
+import { a as getLeasedSharedCodexAppServerClient, o as releaseLeasedSharedCodexAppServerClient, p as resolveCodexAppServerAuthProfileIdForAgent } from "./shared-client-xytpSKD0.js";
+import { n as resolveCodexNativeExecutionBlock, r as resolveCodexNativeSandboxBlock } from "./sandbox-guard-C-Yv9uwY.js";
 import { resolveTimerTimeoutMs, timestampMsToIsoString } from "openclaw/plugin-sdk/number-runtime";
 import os from "node:os";
 import { loadExecApprovals } from "openclaw/plugin-sdk/exec-approvals-runtime";

package/dist/doctor-contract-api.js

@@ -5,6 +5,7 @@ function asRecord(value) {
 function hasRetiredDynamicToolsProfile(value) {
 	return Object.hasOwn(asRecord(value) ?? {}, "codexDynamicToolsProfile");
 }
+/** Legacy Codex config keys that doctor should report or repair. */
 const legacyConfigRules = [{
 	path: [
 		"plugins",
@@ -15,6 +16,9 @@ const legacyConfigRules = [{
 	message: "plugins.entries.codex.config.codexDynamicToolsProfile is retired; Codex app-server always keeps Codex-native workspace tools native. Run \"openclaw doctor --fix\".",
 	match: hasRetiredDynamicToolsProfile
 }];
+/**
+* Removes retired Codex plugin config keys while preserving unrelated config.
+*/
 function normalizeCompatibilityConfig({ cfg }) {
 	const rawPluginConfig = asRecord(asRecord(cfg.plugins?.entries?.codex)?.config);
 	if (!rawPluginConfig || !hasRetiredDynamicToolsProfile(rawPluginConfig)) return {
@@ -33,6 +37,7 @@ function normalizeCompatibilityConfig({ cfg }) {
 		changes: ["Removed retired plugins.entries.codex.config.codexDynamicToolsProfile; Codex app-server always keeps Codex-native workspace tools native."]
 	};
 }
+/** Session/auth ownership metadata used by doctor route-state checks. */
 const sessionRouteStateOwners = [{
 	id: "codex",
 	label: "Codex",

package/dist/harness.js

@@ -9,6 +9,10 @@ const CODEX_APP_SERVER_CONTEXT_ENGINE_HOST_CAPABILITIES = [
 	"runtime-llm-complete",
 	"thread-bootstrap-projection"
 ];
+/**
+* Creates the Codex app-server harness used for attempts, side questions,
+* compaction, reset, and disposal.
+*/
 function createCodexAppServerAgentHarness(options) {
 	const providerIds = new Set([...options?.providerIds ?? DEFAULT_CODEX_HARNESS_PROVIDER_IDS].map((id) => id.trim().toLowerCase()));
 	return {
@@ -28,31 +32,31 @@ function createCodexAppServerAgentHarness(options) {
 			};
 		},
 		runAttempt: async (params) => {
-			const { runCodexAppServerAttempt } = await import("./run-attempt-DM53zFlW.js");
+			const { runCodexAppServerAttempt } = await import("./run-attempt-B_6VkFQN.js");
 			return runCodexAppServerAttempt(params, {
 				pluginConfig: options?.resolvePluginConfig?.() ?? options?.pluginConfig,
 				nativeHookRelay: { enabled: true }
 			});
 		},
 		runSideQuestion: async (params) => {
-			const { runCodexAppServerSideQuestion } = await import("./side-question-dIZf9RBV.js");
+			const { runCodexAppServerSideQuestion } = await import("./side-question-BEpALo9c.js");
 			return runCodexAppServerSideQuestion(params, {
 				pluginConfig: options?.resolvePluginConfig?.() ?? options?.pluginConfig,
 				nativeHookRelay: { enabled: true }
 			});
 		},
 		compact: async (params) => {
-			const { maybeCompactCodexAppServerSession } = await import("./compact-D1dSrNrT.js");
+			const { maybeCompactCodexAppServerSession } = await import("./compact-CwnPeYnM.js");
 			return maybeCompactCodexAppServerSession(params, { pluginConfig: options?.resolvePluginConfig?.() ?? options?.pluginConfig });
 		},
 		reset: async (params) => {
 			if (params.sessionFile) {
-				const { clearCodexAppServerBinding } = await import("./session-binding-DWiEGATW.js").then((n) => n.o);
+				const { clearCodexAppServerBinding } = await import("./session-binding-BgTv_YGm.js").then((n) => n.o);
 				await clearCodexAppServerBinding(params.sessionFile);
 			}
 		},
 		dispose: async () => {
-			const { clearSharedCodexAppServerClientAndWait } = await import("./shared-client-DUWLidr5.js").then((n) => n.s);
+			const { clearSharedCodexAppServerClientAndWait } = await import("./shared-client-xytpSKD0.js").then((n) => n.c);
 			await clearSharedCodexAppServerClientAndWait();
 		}
 	};

package/dist/index.js

@@ -1,12 +1,12 @@
 import { createCodexAppServerAgentHarness } from "./harness.js";
-import { d as resolveCodexAppServerRuntimeOptions, s as isCodexPluginsMarketplaceName, t as CODEX_PLUGINS_MARKETPLACE_NAME, u as readCodexPluginConfig } from "./config-AlzuNKCY.js";
+import { c as readCodexPluginConfig, l as resolveCodexAppServerRuntimeOptions, t as CODEX_PLUGINS_MARKETPLACE_NAME } from "./config-BT6SLiE6.js";
 import { buildCodexProvider } from "./provider.js";
-import { v as ensureCodexPluginActivation, x as defaultCodexAppInventoryCache, y as pluginReadParams } from "./thread-lifecycle-6nrEQZMV.js";
+import { v as ensureCodexPluginActivation, x as defaultCodexAppInventoryCache, y as pluginReadParams } from "./thread-lifecycle-BJsazZ8j.js";
 import { buildCodexMediaUnderstandingProvider } from "./media-understanding-provider.js";
-import { i as describeControlFailure, n as buildCodexPluginAppCacheKey, t as requestCodexAppServerJson } from "./request-CPtFWp-f.js";
-import { s as formatCodexDisplayText } from "./notification-correlation-BykOI_jh.js";
-import { a as releaseLeasedSharedCodexAppServerClient, f as resolveCodexAppServerAuthProfileIdForAgent, i as getLeasedSharedCodexAppServerClient, n as clearSharedCodexAppServerClientIfCurrentAndWait, p as resolveCodexAppServerFallbackApiKeyCacheKey, u as resolveCodexAppServerAuthAccountCacheKey } from "./shared-client-DUWLidr5.js";
-import { a as createCodexCliSessionNodeInvokePolicies, c as resolveCodexCliSessionForBindingOnNode, i as createCodexCliSessionNodeHostCommands, l as resumeCodexCliSessionOnNode, n as handleCodexConversationInboundClaim, s as listCodexCliSessionsOnNode, t as handleCodexConversationBindingResolved } from "./conversation-binding-CqVPKJPp.js";
+import { i as describeControlFailure, n as buildCodexPluginAppCacheKey, t as requestCodexAppServerJson } from "./request-D64BfplD.js";
+import { s as formatCodexDisplayText } from "./notification-correlation-o8quHmTK.js";
+import { a as getLeasedSharedCodexAppServerClient, d as resolveCodexAppServerAuthAccountCacheKey, m as resolveCodexAppServerFallbackApiKeyCacheKey, o as releaseLeasedSharedCodexAppServerClient, p as resolveCodexAppServerAuthProfileIdForAgent, r as clearSharedCodexAppServerClientIfCurrentAndWait } from "./shared-client-xytpSKD0.js";
+import { a as createCodexCliSessionNodeInvokePolicies, c as resolveCodexCliSessionForBindingOnNode, i as createCodexCliSessionNodeHostCommands, l as resumeCodexCliSessionOnNode, n as handleCodexConversationInboundClaim, s as listCodexCliSessionsOnNode, t as handleCodexConversationBindingResolved } from "./conversation-binding-CzpvaBs1.js";
 import { mutateConfigFile } from "openclaw/plugin-sdk/config-mutation";
 import { resolveLivePluginConfigObject } from "openclaw/plugin-sdk/plugin-config-runtime";
 import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
@@ -22,6 +22,7 @@ import { archiveMigrationItem, copyMigrationFileItem, withCachedMigrationConfigR
 import { applyAuthProfileConfig, buildApiKeyCredential, buildOauthProviderAuthResult, buildOpenAICodexCredentialExtra, readCodexCliCredentialsCached, resolveOpenAICodexAuthIdentity, resolveOpenAICodexImportProfileName, updateAuthProfileStoreWithLock } from "openclaw/plugin-sdk/provider-auth";
 import { readJsonFileWithFallback } from "openclaw/plugin-sdk/json-store";
 //#region extensions/codex/src/commands.ts
+/** Creates the reserved `/codex` command definition exposed by the plugin. */
 function createCodexCommand(options) {
 	return {
 		name: "codex",
@@ -39,6 +40,7 @@ function createCodexCommand(options) {
 		handler: (ctx) => handleCodexCommand(ctx, options)
 	};
 }
+/** Dispatches a `/codex` command to the subcommand handler and formats failures for chat. */
 async function handleCodexCommand(ctx, options = {}) {
 	const { loadSubcommandHandler, ...subcommandOptions } = options;
 	try {
@@ -48,7 +50,7 @@ async function handleCodexCommand(ctx, options = {}) {
 	}
 }
 async function loadDefaultCodexSubcommandHandler() {
-	const { handleCodexSubcommand } = await import("./command-handlers-VhJdcXcI.js");
+	const { handleCodexSubcommand } = await import("./command-handlers-DMn2M7W7.js");
 	return handleCodexSubcommand;
 }
 //#endregion
@@ -1341,10 +1343,7 @@ async function requestTargetCodexAppServerJson(params) {
 function hasOpenAiCuratedMarketplace(response) {
 	if (!response || typeof response !== "object" || !("marketplaces" in response)) return false;
 	const marketplaces = response.marketplaces;
-	return Array.isArray(marketplaces) && marketplaces.some((marketplace) => {
-		if (!marketplace || typeof marketplace !== "object") return false;
-		return marketplace.name === "openai-curated";
-	});
+	return Array.isArray(marketplaces) && marketplaces.some((marketplace) => marketplace && typeof marketplace === "object" && marketplace.name === "openai-curated");
 }
 function targetCodexMarketplaceDiscoveryTimeoutMs(env = process.env) {
 	const configured = parseStrictNonNegativeInteger(env[TARGET_CODEX_MARKETPLACE_DISCOVERY_TIMEOUT_ENV]);
@@ -1423,10 +1422,10 @@ function readCodexPluginPolicy(item) {
 	const configKey = item.details?.configKey;
 	const marketplaceName = item.details?.marketplaceName;
 	const pluginName = item.details?.pluginName;
-	if (typeof configKey !== "string" || typeof marketplaceName !== "string" || !isCodexPluginsMarketplaceName(marketplaceName) || typeof pluginName !== "string") return;
+	if (typeof configKey !== "string" || marketplaceName !== "openai-curated" || typeof pluginName !== "string") return;
 	return {
 		configKey,
-		marketplaceName,
+		marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
 		pluginName,
 		enabled: true,
 		allowDestructiveActions: true

package/dist/media-understanding-provider.js

@@ -1,14 +1,22 @@
 import { CODEX_PROVIDER_ID, FALLBACK_CODEX_MODELS } from "./provider-catalog.js";
-import { d as resolveCodexAppServerRuntimeOptions } from "./config-AlzuNKCY.js";
-import { i as assertCodexTurnStartResponse, l as readCodexTurnCompletedNotification, o as readCodexErrorNotification, r as assertCodexThreadStartResponse } from "./protocol-validators-DIt7cXIp.js";
-import { i as readModelListResult } from "./models-DAJvlyJu.js";
-import { l as isJsonObject } from "./client-BnOmn0y-.js";
-import { r as buildCodexRuntimeThreadConfig } from "./thread-lifecycle-6nrEQZMV.js";
+import { l as resolveCodexAppServerRuntimeOptions } from "./config-BT6SLiE6.js";
+import { i as assertCodexTurnStartResponse, l as readCodexTurnCompletedNotification, o as readCodexErrorNotification, r as assertCodexThreadStartResponse } from "./protocol-validators-CIpP8IJ2.js";
+import { i as readModelListResult } from "./models-DXorTaja.js";
+import { l as isJsonObject } from "./client-kMCtlApt.js";
+import { r as buildCodexRuntimeThreadConfig } from "./thread-lifecycle-BJsazZ8j.js";
 import { validateJsonSchemaValue } from "openclaw/plugin-sdk/json-schema-runtime";
 import { resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
 //#region extensions/codex/media-understanding-provider.ts
+/**
+* Codex-backed media understanding provider for bounded image description and
+* structured extraction turns.
+*/
 const DEFAULT_CODEX_IMAGE_MODEL = FALLBACK_CODEX_MODELS.find((model) => model.inputModalities.includes("image"))?.id ?? FALLBACK_CODEX_MODELS[0]?.id;
 const DEFAULT_CODEX_IMAGE_PROMPT = "Describe the image.";
+/**
+* Builds the media-understanding provider that delegates image tasks to an
+* isolated Codex app-server session.
+*/
 function buildCodexMediaUnderstandingProvider(options = {}) {
 	return {
 		id: CODEX_PROVIDER_ID,
@@ -64,7 +72,7 @@ async function runBoundedCodexVisionTurn(params) {
 	const appServer = resolveCodexAppServerRuntimeOptions({ pluginConfig: params.options.pluginConfig });
 	const timeoutMs = resolveTimerTimeoutMs(params.timeoutMs, 100, 100);
 	const ownsClient = !params.options.clientFactory;
-	const client = params.options.clientFactory ? await params.options.clientFactory(appServer.start, params.profile) : await import("./shared-client-DUWLidr5.js").then((n) => n.s).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
+	const client = params.options.clientFactory ? await params.options.clientFactory(appServer.start, params.profile) : await import("./shared-client-xytpSKD0.js").then((n) => n.c).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
 		startOptions: appServer.start,
 		timeoutMs,
 		authProfileId: params.profile

package/dist/{models-DAJvlyJu.js → models-DXorTaja.js}

@@ -1,18 +1,24 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { s as readCodexModelListResponse } from "./protocol-validators-DIt7cXIp.js";
+import { s as readCodexModelListResponse } from "./protocol-validators-CIpP8IJ2.js";
 import { uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
 //#region extensions/codex/src/app-server/models.ts
+/**
+* Lists and normalizes models exposed by the Codex app-server `model/list`
+* endpoint, including pagination and shared-client lease handling.
+*/
 var models_exports = /* @__PURE__ */ __exportAll({
 	listAllCodexAppServerModels: () => listAllCodexAppServerModels,
 	listCodexAppServerModels: () => listCodexAppServerModels,
 	readModelListResult: () => readModelListResult
 });
+/** Lists one Codex app-server model page using the configured auth/client options. */
 async function listCodexAppServerModels(options = {}) {
 	return await withCodexAppServerModelClient(options, async ({ client, timeoutMs }) => requestModelListPage(client, {
 		...options,
 		timeoutMs
 	}));
 }
+/** Walks Codex app-server model pages until exhaustion or the max-page guard. */
 async function listAllCodexAppServerModels(options = {}) {
 	const maxPages = normalizeMaxPages(options.maxPages);
 	return await withCodexAppServerModelClient(options, async ({ client, timeoutMs }) => {
@@ -40,7 +46,7 @@ async function listAllCodexAppServerModels(options = {}) {
 async function withCodexAppServerModelClient(options, run) {
 	const timeoutMs = options.timeoutMs ?? 2500;
 	const useSharedClient = options.sharedClient !== false;
-	const { createIsolatedCodexAppServerClient, getLeasedSharedCodexAppServerClient, releaseLeasedSharedCodexAppServerClient } = await import("./shared-client-DUWLidr5.js").then((n) => n.s);
+	const { createIsolatedCodexAppServerClient, getLeasedSharedCodexAppServerClient, releaseLeasedSharedCodexAppServerClient } = await import("./shared-client-xytpSKD0.js").then((n) => n.c);
 	const client = useSharedClient ? await getLeasedSharedCodexAppServerClient({
 		startOptions: options.startOptions,
 		timeoutMs,
@@ -71,6 +77,7 @@ async function requestModelListPage(client, options) {
 		includeHidden: options.includeHidden ?? null
 	}, { timeoutMs: options.timeoutMs }));
 }
+/** Parses a raw Codex app-server model/list response into OpenClaw's normalized shape. */
 function readModelListResult(value) {
 	const response = readCodexModelListResponse(value);
 	if (!response) return { models: [] };