@openclaw/codex 2026.7.2-beta.5 → 2026.7.33

package/dist/app-server-policy-BmDgseo_.js

@@ -1,49 +0,0 @@
-import { b as canUseCodexModelBackedApprovalsReviewerForModel } from "./session-binding-DlVQ-Pxs.js";
-//#region extensions/codex/src/app-server/app-server-policy.ts
-/**
-* Policy promotion for Codex app-server runs that can safely use OpenClaw tool
-* approvals.
-*/
-/**
-* Promotes implicit `never` approval policy to `untrusted` only when runtime
-* requirements allow OpenClaw to handle tool approvals.
-*/
-function resolveCodexAppServerForOpenClawToolPolicy(params) {
-	if (!params.shouldPromote || !params.canUseUntrustedApprovalPolicy || params.appServer.approvalPolicy !== "never") return params.appServer;
-	const explicitMode = params.execPolicy?.mode === "full" || params.pluginConfig.appServer?.mode !== void 0 || isCodexAppServerPolicyMode(params.env.OPENCLAW_CODEX_APP_SERVER_MODE);
-	const explicitApprovalPolicy = params.pluginConfig.appServer?.approvalPolicy !== void 0 || isConfiguredCodexAppServerApprovalPolicy(params.env.OPENCLAW_CODEX_APP_SERVER_APPROVAL_POLICY) || params.appServer.approvalPolicySource === "requirements";
-	if (explicitMode || explicitApprovalPolicy) return params.appServer;
-	return {
-		...params.appServer,
-		approvalPolicy: "untrusted"
-	};
-}
-function resolveCodexAppServerForModelProvider(params) {
-	const explicitProvider = normalizeModelBackedReviewerProvider(params.provider);
-	if (!isCodexModelBackedApprovalsReviewer(params.appServer.approvalsReviewer) || canUseCodexModelBackedApprovalsReviewerForModel({
-		modelProvider: explicitProvider,
-		model: params.model,
-		config: params.config,
-		env: params.env,
-		agentDir: params.agentDir,
-		codexConfigToml: params.codexConfigToml
-	})) return params.appServer;
-	return {
-		...params.appServer,
-		approvalsReviewer: "user"
-	};
-}
-function isCodexAppServerPolicyMode(value) {
-	return value === "guardian" || value === "yolo";
-}
-function isConfiguredCodexAppServerApprovalPolicy(value) {
-	return value === "never" || value === "on-request" || value === "on-failure" || value === "untrusted";
-}
-function isCodexModelBackedApprovalsReviewer(value) {
-	return value === "auto_review" || value === "guardian_subagent";
-}
-function normalizeModelBackedReviewerProvider(provider) {
-	return provider?.trim().toLowerCase() || void 0;
-}
-//#endregion
-export { resolveCodexAppServerForOpenClawToolPolicy as n, resolveCodexAppServerForModelProvider as t };

package/dist/attempt-client-cleanup-Ia52yRWc.js

@@ -1,127 +0,0 @@
-import { f as retireSharedCodexAppServerClientIfCurrent, n as clearSharedCodexAppServerClientIfCurrentAndUnclaimed, t as clearSharedCodexAppServerClientIfCurrent } from "./shared-client-BVKE40c-.js";
-import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
-//#region extensions/codex/src/app-server/attempt-client-cleanup.ts
-/**
-* Best-effort cleanup helpers for Codex app-server startup attempts and turns.
-*/
-/** Timeout for best-effort app-server turn interruption during cleanup. */
-const CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS = 5e3;
-/** Timeout for best-effort thread unsubscribe during cleanup. */
-const CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS = 5e3;
-/** Raised when a thread subscription may be live on a client OpenClaw no longer controls. */
-var CodexAppServerUnsafeSubscriptionError = class extends Error {
-	constructor(message, options) {
-		super(message, options);
-		this.name = "CodexAppServerUnsafeSubscriptionError";
-	}
-};
-function isCodexAppServerUnsafeSubscriptionError(error) {
-	return error instanceof CodexAppServerUnsafeSubscriptionError;
-}
-/** Asserts Codex resumed the exact thread this attempt subscribed to. */
-function assertCodexThreadResumeSubscription(requestedThreadId, returnedThreadId) {
-	if (returnedThreadId !== requestedThreadId) throw new CodexAppServerUnsafeSubscriptionError(`Codex thread/resume returned ${returnedThreadId} for ${requestedThreadId}`);
-}
-async function closeClientAndWaitIfAvailable(client) {
-	const closeable = client;
-	if (typeof closeable.closeAndWait === "function") {
-		await closeable.closeAndWait();
-		return;
-	}
-	closeable.close?.();
-}
-async function closeCodexStartupClientBestEffort(client) {
-	if (!client) return;
-	const unclaimedSharedClient = clearSharedCodexAppServerClientIfCurrentAndUnclaimed(client);
-	if (unclaimedSharedClient.closed) {
-		await closeClientAndWaitIfAvailable(client);
-		return;
-	}
-	if (unclaimedSharedClient.found) {
-		if (retireSharedCodexAppServerClientIfCurrent(client)?.closed) await closeClientAndWaitIfAvailable(client);
-		return;
-	}
-	const retiredSharedClient = retireSharedCodexAppServerClientIfCurrent(client);
-	if (retiredSharedClient) {
-		if (retiredSharedClient.closed) await closeClientAndWaitIfAvailable(client);
-		return;
-	}
-	if (clearSharedCodexAppServerClientIfCurrent(client)) {
-		await closeClientAndWaitIfAvailable(client);
-		return;
-	}
-	await closeClientAndWaitIfAvailable(client);
-}
-/** Sends a turn interrupt without blocking abort cleanup on app-server errors. */
-function interruptCodexTurnBestEffort(client, params) {
-	interruptCodexTurnAndWaitBestEffort(client, params);
-}
-/** Sends a bounded turn interrupt and waits for Codex to confirm terminal abort handling. */
-async function interruptCodexTurnAndWaitBestEffort(client, params) {
-	const requestOptions = params.timeoutMs && Number.isFinite(params.timeoutMs) && params.timeoutMs > 0 ? { timeoutMs: params.timeoutMs } : void 0;
-	const requestParams = {
-		threadId: params.threadId,
-		turnId: params.turnId
-	};
-	try {
-		await (requestOptions ? client.request("turn/interrupt", requestParams, requestOptions) : client.request("turn/interrupt", requestParams));
-	} catch (error) {
-		embeddedAgentLog.debug("codex app-server turn interrupt failed during abort", { error });
-	}
-}
-/** Unsubscribes from a thread while swallowing cleanup-only failures. */
-async function unsubscribeCodexThreadBestEffort(client, params) {
-	try {
-		await client.request("thread/unsubscribe", { threadId: params.threadId }, { timeoutMs: params.timeoutMs });
-		return true;
-	} catch (error) {
-		embeddedAgentLog.debug("codex app-server thread unsubscribe cleanup failed", {
-			threadId: params.threadId,
-			error
-		});
-		return false;
-	}
-}
-/**
-* Retires the shared client after a timed-out turn so later runs do not reuse a
-* potentially wedged app-server connection.
-*/
-async function retireCodexAppServerClientAfterTimedOutTurn(client, params) {
-	const retiredSharedClient = retireSharedCodexAppServerClientIfCurrent(client, { failActiveLeases: params.suspectPhysicalClient });
-	const detachedSharedClient = Boolean(retiredSharedClient);
-	if (!(params.suspectPhysicalClient && (retiredSharedClient?.closed ?? false))) {
-		interruptCodexTurnBestEffort(client, {
-			threadId: params.threadId,
-			turnId: params.turnId,
-			timeoutMs: CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS
-		});
-		await unsubscribeCodexThreadBestEffort(client, {
-			threadId: params.threadId,
-			timeoutMs: CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS
-		});
-	}
-	let closedClient = retiredSharedClient?.closed ?? false;
-	if (!detachedSharedClient) {
-		const close = client.close;
-		if (typeof close === "function") try {
-			close.call(client);
-			closedClient = true;
-		} catch (error) {
-			embeddedAgentLog.debug("codex app-server client close failed during timeout cleanup", {
-				threadId: params.threadId,
-				turnId: params.turnId,
-				error
-			});
-		}
-	}
-	embeddedAgentLog.warn("codex app-server client retired after timed-out turn", {
-		threadId: params.threadId,
-		turnId: params.turnId,
-		reason: params.reason,
-		detachedSharedClient,
-		closedClient,
-		activeSharedClientLeases: retiredSharedClient?.activeLeases ?? 0
-	});
-}
-//#endregion
-export { closeCodexStartupClientBestEffort as a, isCodexAppServerUnsafeSubscriptionError as c, assertCodexThreadResumeSubscription as i, retireCodexAppServerClientAfterTimedOutTurn as l, CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS as n, interruptCodexTurnAndWaitBestEffort as o, CodexAppServerUnsafeSubscriptionError as r, interruptCodexTurnBestEffort as s, CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS as t, unsubscribeCodexThreadBestEffort as u };

package/dist/auth-binding-B4FfbcCg.js

@@ -1,62 +0,0 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { fingerprintResolvedAuthProfileCredential } from "openclaw/plugin-sdk/agent-harness-runtime";
-import { resolveApiKeyForProfile } from "openclaw/plugin-sdk/agent-runtime";
-//#region extensions/codex/src/app-server/auth-binding.ts
-var auth_binding_exports = /* @__PURE__ */ __exportAll({
-	fingerprintCodexAppServerAuthBinding: () => fingerprintCodexAppServerAuthBinding,
-	prepareCodexAppServerAuthBinding: () => prepareCodexAppServerAuthBinding
-});
-function withMaterializedCredential(params) {
-	const store = structuredClone(params.store);
-	if (params.credential.type === "api_key") {
-		const { keyRef: _keyRef, ...credential } = params.credential;
-		store.profiles[params.profileId] = {
-			...credential,
-			key: params.value
-		};
-	} else if (params.credential.type === "token") {
-		const { tokenRef: _tokenRef, ...credential } = params.credential;
-		store.profiles[params.profileId] = {
-			...credential,
-			token: params.value
-		};
-	}
-	return store;
-}
-/** Resolves one forwarded profile once so attestation and execution share exact material. */
-async function prepareCodexAppServerAuthBinding(params) {
-	const credential = params.authProfileStore.profiles[params.authProfileId];
-	if (!credential || credential.type === "oauth") return;
-	const resolved = await resolveApiKeyForProfile({
-		cfg: params.config,
-		store: params.authProfileStore,
-		profileId: params.authProfileId,
-		agentDir: params.agentDir
-	});
-	if (!resolved?.apiKey) throw new Error(`Codex could not resolve auth profile "${params.authProfileId}".`);
-	const fingerprint = fingerprintResolvedAuthProfileCredential({
-		profileId: params.authProfileId,
-		credential,
-		resolvedAuth: {
-			apiKey: resolved.apiKey,
-			profileId: params.authProfileId,
-			source: `profile:${params.authProfileId}`,
-			mode: credential.type === "api_key" ? "api-key" : "token"
-		}
-	});
-	if (!fingerprint) throw new Error(`Codex could not attest auth profile "${params.authProfileId}".`);
-	return {
-		fingerprint,
-		authProfileStore: withMaterializedCredential({
-			store: params.authProfileStore,
-			profileId: params.authProfileId,
-			credential,
-			value: resolved.apiKey
-		})
-	};
-}
-async function fingerprintCodexAppServerAuthBinding(params) {
-	return (await prepareCodexAppServerAuthBinding(params))?.fingerprint;
-}
-//#endregion
-export { prepareCodexAppServerAuthBinding as n, auth_binding_exports as t };

package/dist/capabilities-BHRSI6Cn.js

@@ -1,36 +0,0 @@
-import { _ as CodexAppServerRpcError } from "./shared-client-BVKE40c-.js";
-//#region extensions/codex/src/app-server/capabilities.ts
-/**
-* Capability helpers for optional Codex app-server control-plane methods.
-*/
-/** Known app-server methods used by OpenClaw control surfaces. */
-const CODEX_CONTROL_METHODS = {
-	account: "account/read",
-	compact: "thread/compact/start",
-	feedback: "feedback/upload",
-	forkThread: "thread/fork",
-	listMcpServers: "mcpServerStatus/list",
-	listSkills: "skills/list",
-	listThreads: "thread/list",
-	listThreadTurns: "thread/turns/list",
-	readThread: "thread/read",
-	rateLimits: "account/rateLimits/read",
-	archiveThread: "thread/archive",
-	renameThread: "thread/name/set",
-	resumeThread: "thread/resume",
-	review: "review/start",
-	unarchiveThread: "thread/unarchive",
-	getThreadGoal: "thread/goal/get",
-	setThreadGoal: "thread/goal/set",
-	clearThreadGoal: "thread/goal/clear"
-};
-/** Formats unsupported control calls differently from ordinary RPC failures. */
-function describeControlFailure(error) {
-	if (isUnsupportedControlError(error)) return "unsupported by this Codex app-server";
-	return error instanceof Error ? error.message : String(error);
-}
-function isUnsupportedControlError(error) {
-	return error instanceof CodexAppServerRpcError && error.code === -32601;
-}
-//#endregion
-export { describeControlFailure as n, CODEX_CONTROL_METHODS as t };

package/dist/cli-metadata.js

@@ -1,20 +0,0 @@
-import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
-//#region extensions/codex/cli-metadata.ts
-function registerCodexCliMetadata(api) {
-	api.registerCli(async ({ program }) => {
-		const { registerCodexSessionCli } = await import("./session-cli-CqZ0Fp2a.js");
-		registerCodexSessionCli(program);
-	}, { descriptors: [{
-		name: "codex",
-		description: "Inspect and branch from Codex sessions through the Gateway",
-		hasSubcommands: true
-	}] });
-}
-var cli_metadata_default = definePluginEntry({
-	id: "codex",
-	name: "Codex",
-	description: "Codex app-server harness and native session supervision.",
-	register: registerCodexCliMetadata
-});
-//#endregion
-export { cli_metadata_default as default, registerCodexCliMetadata };