@openclaw/codex 2026.6.8 → 2026.6.9

package/dist/index.js

@@ -1,22 +1,23 @@
 import { createCodexAppServerAgentHarness } from "./harness.js";
-import { d as resolveCodexAppServerRuntimeOptions, t as CODEX_PLUGINS_MARKETPLACE_NAME, u as readCodexPluginConfig } from "./config-DJXpBkGf.js";
-import { t as buildCodexProvider } from "./provider-C5P6352f.js";
-import { C as defaultCodexAppInventoryCache, b as ensureCodexPluginActivation, x as pluginReadParams } from "./thread-lifecycle-cban34w3.js";
-import { buildCodexMediaUnderstandingProvider } from "./media-understanding-provider.js";
-import { r as describeControlFailure, t as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-kIqpGTQj.js";
-import { l as formatCodexDisplayText } from "./notification-correlation-BGoG0N90.js";
-import { a as getLeasedSharedCodexAppServerClient, d as resolveCodexAppServerAuthAccountCacheKey, m as resolveCodexAppServerFallbackApiKeyCacheKey, o as releaseLeasedSharedCodexAppServerClient, p as resolveCodexAppServerAuthProfileIdForAgent, r as clearSharedCodexAppServerClientIfCurrentAndWait } from "./shared-client-jFMumCOe.js";
-import { a as createCodexCliSessionNodeInvokePolicies, c as resolveCodexCliSessionForBindingOnNode, i as createCodexCliSessionNodeHostCommands, l as resumeCodexCliSessionOnNode, n as handleCodexConversationInboundClaim, s as listCodexCliSessionsOnNode, t as handleCodexConversationBindingResolved } from "./conversation-binding-CbnMilVW.js";
-import { t as requestCodexAppServerJson } from "./request-BxZ40QKY.js";
+import { F as ensureCodexPluginActivation, I as pluginReadParams, R as defaultCodexAppInventoryCache } from "./thread-lifecycle-DQyii5vp.js";
+import { d as resolveCodexAppServerRuntimeOptions, t as CODEX_PLUGINS_MARKETPLACE_NAME, u as readCodexPluginConfig } from "./config-CszD0vP3.js";
+import { t as buildCodexProvider } from "./provider-B-OHpbD3.js";
+import { t as buildCodexMediaUnderstandingProvider } from "./media-understanding-provider-Dmfg4tH_.js";
+import { i as describeControlFailure, n as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-vaZ_8Usz.js";
+import { a as formatCodexDisplayText } from "./app-server-policy-BPTiVNsW.js";
+import { a as getLeasedSharedCodexAppServerClient, d as resolveCodexAppServerAuthAccountCacheKey, m as resolveCodexAppServerFallbackApiKeyCacheKey, o as releaseLeasedSharedCodexAppServerClient, p as resolveCodexAppServerAuthProfileIdForAgent, r as clearSharedCodexAppServerClientIfCurrentAndWait } from "./shared-client-Dtx5i7Ez.js";
+import { a as createCodexCliSessionNodeInvokePolicies, c as resolveCodexCliSessionForBindingOnNode, i as createCodexCliSessionNodeHostCommands, l as resumeCodexCliSessionOnNode, n as handleCodexConversationInboundClaim, s as listCodexCliSessionsOnNode, t as handleCodexConversationBindingResolved } from "./conversation-binding-DbG2ZJQY.js";
+import { t as requestCodexAppServerJson } from "./request-Dcd452Nk.js";
+import { t as createCodexWebSearchProviderBase } from "./web-search-provider.shared-BrZmlqyR.js";
 import { mutateConfigFile } from "openclaw/plugin-sdk/config-mutation";
-import { resolveLivePluginConfigObject } from "openclaw/plugin-sdk/plugin-config-runtime";
+import { resolveLivePluginConfigObject, resolvePluginConfigObject } from "openclaw/plugin-sdk/plugin-config-runtime";
 import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
+import fs from "node:fs/promises";
+import path from "node:path";
 import { parseStrictNonNegativeInteger } from "openclaw/plugin-sdk/number-runtime";
+import { asBoolean, isRecord, normalizeOptionalString, uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
 import os from "node:os";
-import path from "node:path";
 import { loadAuthProfileStoreWithoutExternalProfiles, resolveAgentConfig, resolveAgentWorkspaceDir, resolveDefaultAgentId } from "openclaw/plugin-sdk/agent-runtime";
-import { asBoolean, isRecord, normalizeOptionalString, uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
-import fs from "node:fs/promises";
 import { applyAuthProfileConfig, buildApiKeyCredential, buildOauthProviderAuthResult, buildOpenAICodexCredentialExtra, readCodexCliCredentialsCached, resolveOpenAICodexAuthIdentity, resolveOpenAICodexImportProfileName, updateAuthProfileStoreWithLock } from "openclaw/plugin-sdk/provider-auth";
 import { pathExists } from "openclaw/plugin-sdk/security-runtime";
 import { MIGRATION_REASON_TARGET_EXISTS, applyMigrationManualItem, createMigrationItem, createMigrationManualItem, hasMigrationConfigPatchConflict, markMigrationItemConflict, markMigrationItemError, markMigrationItemSkipped, readMigrationConfigPath, summarizeMigrationItems, writeMigrationConfigPath } from "openclaw/plugin-sdk/migration";
@@ -51,7 +52,7 @@ async function handleCodexCommand(ctx, options = {}) {
 	}
 }
 async function loadDefaultCodexSubcommandHandler() {
-	const { handleCodexSubcommand } = await import("./command-handlers-DHecBkuc.js");
+	const { handleCodexSubcommand } = await import("./command-handlers-BaqM9s9b.js");
 	return handleCodexSubcommand;
 }
 //#endregion
@@ -931,13 +932,28 @@ function readExistingCodexPluginEntries(config) {
 	const entries = readMigrationConfigPath(config, [...CODEX_PLUGIN_NATIVE_CONFIG_PATH, "plugins"]);
 	return isRecord(entries) ? entries : {};
 }
-function hasExistingCodexPluginEntry(existingEntries, configKey, pluginName) {
-	if (existingEntries[configKey] !== void 0) return true;
+function hasExistingCodexPluginEntry(existingEntries, configKey, pluginName, nextEntry) {
+	const existingEntry = existingEntries[configKey];
+	if (existingEntry !== void 0) return !isLegacyDestructivePolicyRepair(existingEntry, nextEntry);
 	return Object.values(existingEntries).some((entry) => {
 		if (!isRecord(entry)) return false;
 		return entry.pluginName === pluginName;
 	});
 }
+function isLegacyDestructivePolicyRepair(existing, nextEntry) {
+	const existingEntry = isRecord(existing) ? existing : void 0;
+	if (existingEntry?.allow_destructive_actions !== "on-request" || nextEntry.allow_destructive_actions !== "auto") return false;
+	const normalizedExisting = {
+		...existingEntry,
+		allow_destructive_actions: "auto"
+	};
+	const normalizedEntries = Object.entries(normalizedExisting);
+	return normalizedEntries.length === Object.keys(nextEntry).length && normalizedEntries.every(([key, value]) => nextEntry[key] === value);
+}
+function isLegacyDestructivePolicyConfigEntryRepair(existing, pluginName) {
+	const existingEntry = isRecord(existing) ? existing : void 0;
+	return existingEntry?.allow_destructive_actions === "on-request" && existingEntry.pluginName === pluginName;
+}
 function buildPluginItems(ctx, plugins) {
 	const baseCounts = /* @__PURE__ */ new Map();
 	for (const plugin of plugins.filter((entry) => entry.migratable)) {
@@ -951,7 +967,13 @@ function buildPluginItems(ctx, plugins) {
 	for (const plugin of plugins) {
 		if (plugin.migratable && plugin.marketplaceName === "openai-curated" && plugin.pluginName) {
 			const configKey = uniquePluginConfigKey(plugin, baseCounts, usedCounts);
-			const conflict = !ctx.overwrite && hasExistingCodexPluginEntry(existingPluginEntries, configKey, plugin.pluginName);
+			const plannedEntry = {
+				enabled: true,
+				marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
+				pluginName: plugin.pluginName,
+				...isLegacyDestructivePolicyConfigEntryRepair(existingPluginEntries[configKey], plugin.pluginName) ? { allow_destructive_actions: "auto" } : {}
+			};
+			const conflict = !ctx.overwrite && hasExistingCodexPluginEntry(existingPluginEntries, configKey, plugin.pluginName, plannedEntry);
 			items.push(createMigrationItem({
 				id: `plugin:${configKey}`,
 				kind: "plugin",
@@ -967,6 +989,7 @@ function buildPluginItems(ctx, plugins) {
 					pluginName: plugin.pluginName,
 					sourceInstalled: plugin.installed === true,
 					sourceEnabled: plugin.enabled === true,
+					...plannedEntry.allow_destructive_actions === "auto" ? { allowDestructiveActions: "auto" } : {},
 					...plugin.apps && plugin.apps.length > 0 && !shouldVerifyPluginApps(ctx) ? { sourceAppVerification: CODEX_PLUGIN_SOURCE_APP_VERIFICATION_UNVERIFIED } : {}
 				}
 			}));
@@ -1012,18 +1035,37 @@ function readCodexPluginMigrationConfigEntry(item, enabled) {
 	return {
 		configKey,
 		pluginName,
-		enabled
+		enabled,
+		...item.details?.allowDestructiveActions === "auto" ? { allowDestructiveActions: "auto" } : {}
 	};
 }
 function readExistingAllowDestructiveActions(config) {
-	return asBoolean(readMigrationConfigPath(config, [...CODEX_PLUGIN_NATIVE_CONFIG_PATH, "allow_destructive_actions"]));
+	return normalizeExistingAllowDestructiveActions(readMigrationConfigPath(config, [...CODEX_PLUGIN_NATIVE_CONFIG_PATH, "allow_destructive_actions"]));
+}
+function normalizeExistingAllowDestructiveActions(value) {
+	return value === "auto" || value === "on-request" ? "auto" : asBoolean(value);
+}
+function readExistingPluginPolicyRepairs(config) {
+	if (config === void 0) return {};
+	return Object.fromEntries(Object.entries(readExistingCodexPluginEntries(config)).flatMap(([configKey, entry]) => {
+		const pluginEntry = isRecord(entry) ? entry : void 0;
+		if (pluginEntry?.allow_destructive_actions !== "on-request") return [];
+		return [[configKey, {
+			...pluginEntry,
+			allow_destructive_actions: "auto"
+		}]];
+	}));
 }
 function buildCodexPluginsConfigValue(entries, params = {}) {
-	const plugins = Object.fromEntries(entries.toSorted((a, b) => a.configKey.localeCompare(b.configKey)).map((entry) => [entry.configKey, {
-		enabled: entry.enabled,
-		marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
-		pluginName: entry.pluginName
-	}]));
+	const plugins = {
+		...readExistingPluginPolicyRepairs(params.config),
+		...Object.fromEntries(entries.toSorted((a, b) => a.configKey.localeCompare(b.configKey)).map((entry) => [entry.configKey, {
+			enabled: entry.enabled,
+			marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
+			pluginName: entry.pluginName,
+			...entry.allowDestructiveActions ? { allow_destructive_actions: entry.allowDestructiveActions } : {}
+		}]))
+	};
 	return {
 		enabled: true,
 		config: { codexPlugins: {
@@ -1043,12 +1085,13 @@ function hasCodexPluginConfigConflict(config, value) {
 	if (!isRecord(existingNativeConfig)) return true;
 	if (existingNativeConfig.enabled !== void 0 && existingNativeConfig.enabled !== true) return true;
 	const allowDestructiveActions = nativeConfig.allow_destructive_actions;
-	if (existingNativeConfig.allow_destructive_actions !== void 0 && existingNativeConfig.allow_destructive_actions !== allowDestructiveActions) return true;
+	const existingAllowDestructiveActions = normalizeExistingAllowDestructiveActions(existingNativeConfig.allow_destructive_actions);
+	if (existingNativeConfig.allow_destructive_actions !== void 0 && existingAllowDestructiveActions !== allowDestructiveActions) return true;
 	const plugins = nativeConfig.plugins;
 	if (!isRecord(plugins)) return false;
 	return Object.entries(plugins).some(([configKey, plugin]) => {
 		if (!isRecord(plugin)) return existingNativeConfig[configKey] !== void 0;
-		return hasExistingCodexPluginEntry(readExistingCodexPluginEntries(config), configKey, typeof plugin.pluginName === "string" ? plugin.pluginName : configKey);
+		return hasExistingCodexPluginEntry(readExistingCodexPluginEntries(config), configKey, typeof plugin.pluginName === "string" ? plugin.pluginName : configKey, plugin);
 	});
 }
 function buildPluginConfigItem(ctx, pluginItems) {
@@ -1429,7 +1472,8 @@ function readCodexPluginPolicy(item) {
 		marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
 		pluginName,
 		enabled: true,
-		allowDestructiveActions: true
+		allowDestructiveActions: true,
+		destructiveApprovalMode: "allow"
 	};
 }
 function codexPluginActivationReportState(result) {
@@ -1495,6 +1539,42 @@ function buildCodexMigrationProvider(params = {}) {
 	};
 }
 //#endregion
+//#region extensions/codex/src/web-search-provider.ts
+let codexWebSearchRuntimePromise;
+function loadCodexWebSearchRuntime() {
+	codexWebSearchRuntimePromise ??= import("./web-search-provider.runtime-BWG_oqLf.js");
+	return codexWebSearchRuntimePromise;
+}
+const CodexWebSearchSchema = {
+	type: "object",
+	properties: { query: {
+		type: "string",
+		description: "Search query. Include the desired region, time range, and constraints."
+	} },
+	required: ["query"],
+	additionalProperties: false
+};
+function createCodexWebSearchProvider(options = {}) {
+	return {
+		...createCodexWebSearchProviderBase(),
+		createTool: (ctx) => {
+			const nativeConfig = ctx.searchConfig?.openaiCodex;
+			if (nativeConfig && typeof nativeConfig === "object" && !Array.isArray(nativeConfig) && nativeConfig.enabled === false) return null;
+			return {
+				description: "Search the current web through Codex hosted search and return a grounded answer with source URLs.",
+				parameters: CodexWebSearchSchema,
+				execute: async (args, executionContext) => {
+					const { executeCodexWebSearchProviderTool } = await loadCodexWebSearchRuntime();
+					return await executeCodexWebSearchProviderTool(ctx, args, executionContext, {
+						pluginConfig: options.resolvePluginConfig?.() ?? resolvePluginConfigObject(ctx.config, "codex"),
+						clientFactory: options.clientFactory
+					});
+				}
+			};
+		}
+	};
+}
+//#endregion
 //#region extensions/codex/index.ts
 var codex_default = definePluginEntry({
 	id: "codex",
@@ -1506,6 +1586,7 @@ var codex_default = definePluginEntry({
 		api.registerAgentHarness(createCodexAppServerAgentHarness({ resolvePluginConfig: resolveCurrentPluginConfig }));
 		api.registerProvider(buildCodexProvider({ pluginConfig: api.pluginConfig }));
 		api.registerMediaUnderstandingProvider(buildCodexMediaUnderstandingProvider({ pluginConfig: api.pluginConfig }));
+		api.registerWebSearchProvider(createCodexWebSearchProvider({ resolvePluginConfig: resolveCurrentPluginConfig }));
 		api.registerMigrationProvider(buildCodexMigrationProvider({ runtime: api.runtime }));
 		for (const command of createCodexCliSessionNodeHostCommands()) api.registerNodeHostCommand(command);
 		for (const policy of createCodexCliSessionNodeInvokePolicies()) api.registerNodeInvokePolicy(policy);