@openclaw/codex 2026.6.8 → 2026.6.9

package/dist/{config-DJXpBkGf.js → config-CszD0vP3.js}

@@ -1,12 +1,13 @@
+import path from "node:path";
 import { resolvePositiveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
-import { createHmac, randomBytes } from "node:crypto";
+import { normalizeTrimmedStringList } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { createHash, createHmac, randomBytes } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { hostname } from "node:os";
-import path from "node:path";
 import { resolveProviderIdForAuth } from "openclaw/plugin-sdk/agent-runtime";
 import { resolveExecApprovalsFromFile } from "openclaw/plugin-sdk/exec-approvals-runtime";
 import { normalizeAgentId } from "openclaw/plugin-sdk/routing";
-import { normalizeTrimmedStringList } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { buildSecretInputSchema, normalizeResolvedSecretInputString } from "openclaw/plugin-sdk/secret-input";
 import { detectWindowsSpawnCommandInlineArgs } from "openclaw/plugin-sdk/windows-spawn";
 import { z } from "zod";
 //#region extensions/codex/src/app-server/config.ts
@@ -19,12 +20,14 @@ const CODEX_CONFIG_TOML_FILENAME = "config.toml";
 const PLAIN_DECIMAL_NUMBER_RE = /^[+-]?(?:(?:\d+\.?\d*)|(?:\.\d+))$/;
 const CODEX_PLUGINS_MARKETPLACE_NAME = "openai-curated";
 function shouldAutoApproveCodexAppServerApprovals(appServer) {
-	return appServer.approvalPolicy === "never" && appServer.sandbox === "danger-full-access";
+	return appServer.networkProxy === void 0 && appServer.approvalPolicy === "never" && appServer.sandbox === "danger-full-access";
 }
 const DEFAULT_CODEX_COMPUTER_USE_PLUGIN_NAME = "computer-use";
 const DEFAULT_CODEX_COMPUTER_USE_MCP_SERVER_NAME = "computer-use";
 const DEFAULT_CODEX_COMPUTER_USE_MARKETPLACE_DISCOVERY_TIMEOUT_MS = 6e4;
+const DEFAULT_CODEX_APP_SERVER_NETWORK_PROXY_PROFILE_PREFIX = "openclaw-network";
 const codexAppServerTransportSchema = z.enum(["stdio", "websocket"]);
+const SecretInputSchema = buildSecretInputSchema();
 const codexAppServerPolicyModeSchema = z.enum(["yolo", "guardian"]);
 const codexAppServerApprovalPolicySchema = z.enum([
 	"never",
@@ -43,17 +46,37 @@ const codexAppServerApprovalsReviewerSchema = z.enum([
 	"guardian_subagent"
 ]);
 const codexDynamicToolsLoadingSchema = z.enum(["searchable", "direct"]);
+const codexPluginDestructivePolicySchema = z.union([z.boolean(), z.literal("auto")]);
 const codexAppServerServiceTierSchema = z.preprocess((value) => value === null ? null : normalizeCodexServiceTier(value), z.string().trim().min(1).nullable().optional()).optional();
 const codexAppServerExperimentalSchema = z.object({ sandboxExecServer: z.boolean().optional() }).strict();
+const codexAppServerRemoteWorkspaceRootSchema = z.string().trim().min(1);
+const codexAppServerNetworkProxyDomainPermissionSchema = z.enum(["allow", "deny"]);
+const codexAppServerNetworkProxyUnixSocketPermissionSchema = z.enum(["allow", "none"]);
+const codexAppServerNetworkProxySchema = z.object({
+	enabled: z.boolean().optional(),
+	profileName: z.string().trim().min(1).optional(),
+	baseProfile: z.enum(["read-only", "workspace"]).optional(),
+	mode: z.enum(["limited", "full"]).optional(),
+	domains: z.record(z.string(), codexAppServerNetworkProxyDomainPermissionSchema).optional(),
+	unixSockets: z.record(z.string(), codexAppServerNetworkProxyUnixSocketPermissionSchema).optional(),
+	proxyUrl: z.string().trim().min(1).optional(),
+	socksUrl: z.string().trim().min(1).optional(),
+	enableSocks5: z.boolean().optional(),
+	enableSocks5Udp: z.boolean().optional(),
+	allowUpstreamProxy: z.boolean().optional(),
+	allowLocalBinding: z.boolean().optional(),
+	dangerouslyAllowNonLoopbackProxy: z.boolean().optional(),
+	dangerouslyAllowAllUnixSockets: z.boolean().optional()
+}).strict();
 const codexPluginEntryConfigSchema = z.object({
 	enabled: z.boolean().optional(),
 	marketplaceName: z.literal(CODEX_PLUGINS_MARKETPLACE_NAME).optional(),
 	pluginName: z.string().trim().min(1).optional(),
-	allow_destructive_actions: z.boolean().optional()
+	allow_destructive_actions: codexPluginDestructivePolicySchema.optional()
 }).strict();
 const codexPluginsConfigSchema = z.object({
 	enabled: z.boolean().optional(),
-	allow_destructive_actions: z.boolean().optional(),
+	allow_destructive_actions: codexPluginDestructivePolicySchema.optional(),
 	plugins: z.record(z.string(), codexPluginEntryConfigSchema).optional()
 }).strict();
 const codexPluginConfigSchema = z.object({
@@ -80,9 +103,10 @@ const codexPluginConfigSchema = z.object({
 		command: z.string().optional(),
 		args: z.union([z.array(z.string()), z.string()]).optional(),
 		url: z.string().optional(),
-		authToken: z.string().optional(),
-		headers: z.record(z.string(), z.string()).optional(),
+		authToken: SecretInputSchema.optional(),
+		headers: z.record(z.string(), SecretInputSchema).optional(),
 		clearEnv: z.array(z.string()).optional(),
+		remoteWorkspaceRoot: codexAppServerRemoteWorkspaceRootSchema.optional(),
 		codeModeOnly: z.boolean().optional(),
 		requestTimeoutMs: z.number().positive().optional(),
 		turnCompletionIdleTimeoutMs: z.number().positive().optional(),
@@ -91,6 +115,7 @@ const codexPluginConfigSchema = z.object({
 		sandbox: codexAppServerSandboxSchema.optional(),
 		approvalsReviewer: codexAppServerApprovalsReviewerSchema.optional(),
 		serviceTier: codexAppServerServiceTierSchema,
+		networkProxy: codexAppServerNetworkProxySchema.optional(),
 		defaultWorkspaceDir: z.string().optional(),
 		experimental: codexAppServerExperimentalSchema.optional()
 	}).strict().optional()
@@ -120,21 +145,35 @@ function resolveCodexPluginsPolicy(pluginConfig) {
 	const config = readCodexPluginConfig(pluginConfig).codexPlugins;
 	const configured = config !== void 0;
 	const enabled = config?.enabled === true;
-	const allowDestructiveActions = config?.allow_destructive_actions ?? true;
+	const destructivePolicy = resolveCodexPluginDestructivePolicy(config?.allow_destructive_actions ?? true);
+	const pluginPolicies = Object.entries(config?.plugins ?? {}).flatMap(([configKey, entry]) => {
+		if (entry.marketplaceName !== "openai-curated" || !entry.pluginName) return [];
+		const entryDestructivePolicy = resolveCodexPluginDestructivePolicy(entry.allow_destructive_actions ?? config?.allow_destructive_actions ?? true);
+		return [{
+			configKey,
+			marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
+			pluginName: entry.pluginName,
+			enabled: enabled && entry.enabled !== false,
+			allowDestructiveActions: entryDestructivePolicy.allowDestructiveActions,
+			destructiveApprovalMode: entryDestructivePolicy.destructiveApprovalMode
+		}];
+	}).toSorted((left, right) => left.configKey.localeCompare(right.configKey));
 	return {
 		configured,
 		enabled,
-		allowDestructiveActions,
-		pluginPolicies: Object.entries(config?.plugins ?? {}).flatMap(([configKey, entry]) => {
-			if (entry.marketplaceName !== "openai-curated" || !entry.pluginName) return [];
-			return [{
-				configKey,
-				marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
-				pluginName: entry.pluginName,
-				enabled: enabled && entry.enabled !== false,
-				allowDestructiveActions: entry.allow_destructive_actions ?? allowDestructiveActions
-			}];
-		}).toSorted((left, right) => left.configKey.localeCompare(right.configKey))
+		allowDestructiveActions: destructivePolicy.allowDestructiveActions,
+		destructiveApprovalMode: destructivePolicy.destructiveApprovalMode,
+		pluginPolicies
+	};
+}
+function resolveCodexPluginDestructivePolicy(policy) {
+	if (policy === "auto") return {
+		allowDestructiveActions: true,
+		destructiveApprovalMode: "auto"
+	};
+	return {
+		allowDestructiveActions: policy,
+		destructiveApprovalMode: policy ? "allow" : "deny"
 	};
 }
 function resolveCodexAppServerRuntimeOptions(params = {}) {
@@ -152,8 +191,17 @@ function resolveCodexAppServerRuntimeOptions(params = {}) {
 	const args = resolveArgs(config.args, env.OPENCLAW_CODEX_APP_SERVER_ARGS);
 	const headers = normalizeHeaders(config.headers);
 	const clearEnv = normalizeStringList(config.clearEnv);
-	const authToken = readNonEmptyString(config.authToken);
+	const authToken = normalizeCodexAppServerSecretInput({
+		value: config.authToken,
+		path: "plugins.entries.codex.config.appServer.authToken"
+	});
 	const url = readNonEmptyString(config.url);
+	const connectionClass = inferCodexAppServerConnectionClass({
+		transport,
+		url
+	});
+	const remoteAppsSubstrate = "preconfigured";
+	const remoteWorkspaceRoot = normalizeRemoteWorkspaceRoot(config.remoteWorkspaceRoot);
 	const execMode = resolveEffectiveOpenClawExecModeForCodexAppServer({
 		execMode: params.execMode,
 		execPolicy: params.execPolicy
@@ -205,7 +253,13 @@ function resolveCodexAppServerRuntimeOptions(params = {}) {
 	} : void 0;
 	const policyMode = ignoreLegacyYoloPolicyMode ? normalizedPolicyMode : explicitPolicyMode ?? normalizedPolicyMode ?? defaultPolicy?.mode ?? "yolo";
 	const serviceTier = normalizeCodexServiceTier(config.serviceTier);
+	const resolvedSandbox = forcedPolicy?.sandbox ?? configuredSandbox ?? defaultPolicy?.sandbox ?? (policyMode === "guardian" ? "workspace-write" : "danger-full-access");
 	if (transport === "websocket" && !url) throw new Error("plugins.entries.codex.config.appServer.url is required when appServer.transport is websocket");
+	assertCodexAppServerConnectionClassConfig({
+		connectionClass,
+		authToken,
+		headers
+	});
 	const configApprovalPolicy = resolveApprovalPolicy(config.approvalPolicy);
 	const envApprovalPolicy = resolveApprovalPolicy(env.OPENCLAW_CODEX_APP_SERVER_APPROVAL_POLICY);
 	const approvalPolicy = configApprovalPolicy ?? envApprovalPolicy ?? defaultPolicy?.approvalPolicy ?? (policyMode === "guardian" ? "on-request" : "never");
@@ -225,15 +279,19 @@ function resolveCodexAppServerRuntimeOptions(params = {}) {
 			headers,
 			...transport === "stdio" && clearEnv.length > 0 ? { clearEnv } : {}
 		},
+		connectionClass,
+		remoteAppsSubstrate,
+		...remoteWorkspaceRoot ? { remoteWorkspaceRoot } : {},
 		codeModeOnly: config.codeModeOnly === true,
 		requestTimeoutMs: normalizePositiveNumber(config.requestTimeoutMs, 6e4),
 		turnCompletionIdleTimeoutMs: normalizePositiveNumber(config.turnCompletionIdleTimeoutMs, 6e4),
 		...config.postToolRawAssistantCompletionIdleTimeoutMs !== void 0 ? { postToolRawAssistantCompletionIdleTimeoutMs: normalizePositiveNumber(config.postToolRawAssistantCompletionIdleTimeoutMs, 6e4) } : {},
 		approvalPolicy: forcedPolicy?.approvalPolicy ?? approvalPolicy,
 		approvalPolicySource,
-		sandbox: forcedPolicy?.sandbox ?? configuredSandbox ?? defaultPolicy?.sandbox ?? (policyMode === "guardian" ? "workspace-write" : "danger-full-access"),
+		sandbox: resolvedSandbox,
 		approvalsReviewer: forcedPolicy?.approvalsReviewer ?? explicitApprovalsReviewer ?? defaultPolicy?.approvalsReviewer ?? (policyMode === "guardian" ? "auto_review" : "user"),
-		...serviceTier ? { serviceTier } : {}
+		...serviceTier ? { serviceTier } : {},
+		...resolveCodexAppServerNetworkProxy(config.networkProxy, resolvedSandbox)
 	};
 }
 function isCodexAppServerApprovalPolicyAllowedByRequirements(policy, params = {}) {
@@ -311,7 +369,7 @@ function codexAppServerStartOptionsKey(options, params = {}) {
 		args: options.args,
 		url: options.url ?? null,
 		authToken: hashSecretForKey(options.authToken, "authToken"),
-		headers: Object.entries(options.headers).toSorted(([left], [right]) => left.localeCompare(right)),
+		headers: Object.entries(options.headers).toSorted(([left], [right]) => left.localeCompare(right)).map(([key, value]) => [key, hashSecretForKey(value, `header:${key}`)]),
 		env: Object.entries(options.env ?? {}).toSorted(([left], [right]) => left.localeCompare(right)).map(([key, value]) => [key, hashSecretForKey(value, `env:${key}`)]),
 		clearEnv: [...options.clearEnv ?? []].toSorted(),
 		authProfileId: params.authProfileId ?? null,
@@ -333,6 +391,65 @@ function codexSandboxPolicyForTurn(mode, cwd) {
 		excludeSlashTmp: false
 	};
 }
+function resolveCodexAppServerNetworkProxy(config, sandbox) {
+	if (config?.enabled !== true) return {};
+	const fileSystemMode = config.baseProfile === "read-only" || !config.baseProfile && sandbox === "read-only" ? "read" : "write";
+	const networkConfig = removeUndefinedJsonFields({
+		enabled: true,
+		mode: config.mode,
+		domains: normalizeNetworkProxyPermissionMap(config.domains),
+		unix_sockets: normalizeNetworkProxyPermissionMap(config.unixSockets),
+		proxy_url: readNonEmptyString(config.proxyUrl),
+		socks_url: readNonEmptyString(config.socksUrl),
+		enable_socks5: config.enableSocks5,
+		enable_socks5_udp: config.enableSocks5Udp,
+		allow_upstream_proxy: config.allowUpstreamProxy,
+		allow_local_binding: config.allowLocalBinding,
+		dangerously_allow_non_loopback_proxy: config.dangerouslyAllowNonLoopbackProxy,
+		dangerously_allow_all_unix_sockets: config.dangerouslyAllowAllUnixSockets
+	});
+	const profile = {
+		filesystem: {
+			":minimal": "read",
+			":project_roots": { ".": fileSystemMode }
+		},
+		network: networkConfig
+	};
+	const profileName = resolveNetworkProxyPermissionProfileName(config, profile);
+	const configPatch = {
+		"features.network_proxy.enabled": true,
+		default_permissions: profileName,
+		permissions: { [profileName]: profile }
+	};
+	return { networkProxy: {
+		profileName,
+		configFingerprint: fingerprintCodexAppServerNetworkProxyConfigPatch(configPatch),
+		configPatch
+	} };
+}
+function resolveNetworkProxyPermissionProfileName(config, profile) {
+	const explicitProfileName = readNonEmptyString(config.profileName);
+	if (explicitProfileName) return explicitProfileName;
+	return `${DEFAULT_CODEX_APP_SERVER_NETWORK_PROXY_PROFILE_PREFIX}-${createHash("sha256").update(stableStringifyJson({
+		version: 1,
+		profile
+	})).digest("hex").slice(0, 16)}`;
+}
+function fingerprintCodexAppServerNetworkProxyConfigPatch(configPatch) {
+	return createHash("sha256").update(stableStringifyJson(configPatch)).digest("hex");
+}
+function normalizeNetworkProxyPermissionMap(value) {
+	const entries = Object.entries(value ?? {}).map(([key, permission]) => [key.trim(), permission]).filter(([key]) => key.length > 0);
+	return entries.length > 0 ? Object.fromEntries(entries) : void 0;
+}
+function removeUndefinedJsonFields(value) {
+	return Object.fromEntries(Object.entries(value).filter((entry) => entry[1] !== void 0));
+}
+function stableStringifyJson(value) {
+	if (Array.isArray(value)) return `[${value.map((item) => stableStringifyJson(item)).join(",")}]`;
+	if (value && typeof value === "object") return `{${Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${stableStringifyJson(item)}`).join(",")}}`;
+	return JSON.stringify(value);
+}
 function withMcpElicitationsApprovalPolicy(policy) {
 	if (typeof policy !== "string") return { granular: {
 		...policy.granular,
@@ -352,6 +469,34 @@ function withMcpElicitationsApprovalPolicy(policy) {
 function resolveTransport(value) {
 	return value === "websocket" ? "websocket" : "stdio";
 }
+function normalizeRemoteWorkspaceRoot(value) {
+	return readNonEmptyString(value);
+}
+function inferCodexAppServerConnectionClass(params) {
+	if (params.transport !== "websocket") return "local-loopback";
+	return params.url && isLoopbackWebSocketUrl(params.url) ? "local-loopback" : "remote";
+}
+function assertCodexAppServerConnectionClassConfig(params) {
+	if (params.connectionClass === "remote" && !hasIdentityBearingWebSocketAuth({
+		authToken: params.authToken,
+		headers: params.headers
+	})) throw new Error("remote Codex app-server WebSocket URLs require appServer.authToken or an Authorization header");
+}
+function isLoopbackWebSocketUrl(value) {
+	let parsed;
+	try {
+		parsed = new URL(value);
+	} catch {
+		return false;
+	}
+	if (parsed.protocol !== "ws:" && parsed.protocol !== "wss:") return false;
+	const host = parsed.hostname.toLowerCase();
+	return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]" || host.startsWith("127.");
+}
+function hasIdentityBearingWebSocketAuth(params) {
+	if (readNonEmptyString(params.authToken)) return true;
+	return Object.entries(params.headers).some(([key, value]) => key.trim().toLowerCase() === "authorization" && Boolean(readNonEmptyString(value)));
+}
 function resolvePolicyMode(value) {
 	return value === "guardian" || value === "yolo" ? value : void 0;
 }
@@ -880,7 +1025,13 @@ function normalizePositiveNumber(value, fallback) {
 }
 function normalizeHeaders(value) {
 	if (!value || typeof value !== "object" || Array.isArray(value)) return {};
-	return Object.fromEntries(Object.entries(value).map(([key, child]) => [key.trim(), readNonEmptyString(child)]).filter((entry) => Boolean(entry[0] && entry[1])));
+	return Object.fromEntries(Object.entries(value).map(([key, child]) => [key.trim(), normalizeCodexAppServerSecretInput({
+		value: child,
+		path: `plugins.entries.codex.config.appServer.headers.${key}`
+	})]).filter((entry) => Boolean(entry[0] && entry[1])));
+}
+function normalizeCodexAppServerSecretInput(params) {
+	return normalizeResolvedSecretInputString(params);
 }
 function normalizeStringList(value) {
 	return normalizeTrimmedStringList(value);