@openclaw/codex 2026.8.1-beta.2 → 2026.8.1-beta.3

package/dist/{thread-ownership-6kOQHlyC.js → thread-ownership-i2NBwDUL.js}

@@ -1,5 +1,5 @@
-import { K as releaseCodexAppServerLiveThread, W as isCodexAppServerLiveThreadClaimed, d as retainSharedCodexAppServerClientByInstanceId, q as retainCodexAppServerLiveThread } from "./shared-client-kIBbGjk4.js";
-import { a as closeCodexStartupClientBestEffort, d as unsubscribeCodexThreadBestEffort, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-DMLXUfa8.js";
+import { J as releaseCodexAppServerLiveThread, K as isCodexAppServerLiveThreadClaimed, Y as retainCodexAppServerLiveThread, d as retainSharedCodexAppServerClientByInstanceId } from "./shared-client-Dw-rzii0.js";
+import { a as closeCodexStartupClientBestEffort, d as unsubscribeCodexThreadBestEffort, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-URjUlCHg.js";
 import { KeyedAsyncQueue } from "openclaw/plugin-sdk/keyed-async-queue";
 //#region extensions/codex/src/app-server/thread-ownership.ts
 const nativeThreadOwners = new KeyedAsyncQueue();

package/dist/{thread-resume-CPrJNQVM.js → thread-resume-CdJk2Ehf.js}

@@ -1,6 +1,6 @@
-import { F as isCodexAppServerPrewriteRequestCancellationError, s as isCodexAppServerStartSelectionChangedError, z as CodexAppServerRpcError } from "./shared-client-kIBbGjk4.js";
-import { i as assertCodexThreadResumeSubscription, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-DMLXUfa8.js";
-import { i as assertCodexThreadResumeResponse } from "./protocol-validators-B4F7L8Rf.js";
+import { B as CodexAppServerRpcError, F as isCodexAppServerPrewriteRequestCancellationError, s as isCodexAppServerStartSelectionChangedError } from "./shared-client-Dw-rzii0.js";
+import { i as assertCodexThreadResumeSubscription, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-URjUlCHg.js";
+import { i as assertCodexThreadResumeResponse } from "./protocol-validators-VAVyEnDp.js";
 //#region extensions/codex/src/app-server/thread-resume.ts
 /** Owns Codex thread/resume subscription safety. */
 /** Resumes one thread and retires the physical client when acceptance is indeterminate. */

package/dist/{transcript-mirror-B9gGgnJS.js → transcript-mirror-BU0_LKAL.js}

@@ -1,7 +1,8 @@
-import { i as readUpstreamUserText, n as attachUpstreamUserText, r as readMirrorIdentity, t as attachCodexMirrorIdentity } from "./upstream-prompt-provenance-ClRBije0.js";
-import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { i as readUpstreamUserText, n as attachUpstreamUserText, r as readMirrorIdentity, t as attachCodexMirrorIdentity } from "./upstream-prompt-provenance-CFmsKwr9.js";
+import { asOptionalRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { embeddedAgentLog, formatErrorMessage, projectAgentHarnessTranscriptMessageForDisplay, runAgentHarnessBeforeMessageWriteHook } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { createHash } from "node:crypto";
+import { truncateUtf8Prefix } from "openclaw/plugin-sdk/text-utility-runtime";
 import { withCodexSessionTranscriptMirrorWriteLock } from "openclaw/plugin-sdk/codex-session-transcript-runtime";
 import { publishSessionTranscriptUpdateByIdentity } from "openclaw/plugin-sdk/session-transcript-runtime";
 import { Buffer } from "node:buffer";
@@ -27,16 +28,6 @@ const CODEX_HISTORY_ZERO_USAGE = {
 		total: 0
 	}
 };
-function isUtf8ContinuationByte(byte) {
-	return byte !== void 0 && (byte & 192) === 128;
-}
-function truncateUtf8Prefix(value, maxBytes) {
-	const bytes = Buffer.from(value);
-	if (bytes.byteLength <= maxBytes) return value;
-	let end = Math.max(0, maxBytes);
-	while (end > 0 && isUtf8ContinuationByte(bytes[end])) end -= 1;
-	return bytes.subarray(0, end).toString("utf8");
-}
 function normalizeImportedHistoryText(value) {
 	if (typeof value !== "string") return;
 	const text = value.trim();
@@ -183,35 +174,46 @@ function projectBoundedCodexVisibleSessionHistory(entries) {
 const MIRROR_ORIGIN_META_KEY = "mirrorOrigin";
 const MIRROR_SOURCE_FINGERPRINT_META_KEY = "mirrorSourceFingerprint";
 const CODEX_APP_SERVER_MIRROR_ORIGIN = "codex-app-server";
+const CODEX_META_KEY = "__openclaw";
 function attachCodexMirrorAttestation(message, sourceFingerprint) {
-	const record = message;
-	const existing = record["__openclaw"];
+	const existing = CODEX_META_KEY in message ? message[CODEX_META_KEY] : void 0;
 	const baseMeta = existing && typeof existing === "object" && !Array.isArray(existing) ? existing : {};
 	return {
-		...record,
-		__openclaw: {
+		...message,
+		[CODEX_META_KEY]: {
 			...baseMeta,
 			[MIRROR_ORIGIN_META_KEY]: CODEX_APP_SERVER_MIRROR_ORIGIN,
 			...sourceFingerprint ? { [MIRROR_SOURCE_FINGERPRINT_META_KEY]: sourceFingerprint } : {}
 		}
 	};
 }
+function attachCodexMirrorRunId(message, runId, terminal = false) {
+	const { runTerminal: _staleTerminal, ...current } = asOptionalRecord(CODEX_META_KEY in message ? message[CODEX_META_KEY] : void 0) ?? {};
+	return {
+		...message,
+		[CODEX_META_KEY]: {
+			...current,
+			runId,
+			...terminal ? { runTerminal: true } : {}
+		}
+	};
+}
 function readCodexMirrorSourceFingerprint(message) {
-	const meta = message["__openclaw"];
+	const meta = CODEX_META_KEY in message ? message[CODEX_META_KEY] : void 0;
 	if (!meta || typeof meta !== "object" || Array.isArray(meta)) return;
 	const value = meta[MIRROR_SOURCE_FINGERPRINT_META_KEY];
 	return typeof value === "string" && value ? value : void 0;
 }
 function serializeCodexMirrorSourceEvidence(message) {
-	const record = message;
+	const content = "content" in message ? message.content : void 0;
 	return JSON.stringify({
 		role: message.role,
-		content: record.content,
+		content,
 		...message.role === "user" ? { upstreamUserText: readUpstreamUserText(message) } : {},
 		...message.role === "toolResult" ? {
-			toolCallId: record.toolCallId,
-			toolName: record.toolName,
-			isError: record.isError === true
+			toolCallId: message.toolCallId,
+			toolName: message.toolName,
+			isError: message.isError
 		} : {}
 	});
 }
@@ -247,7 +249,7 @@ function buildFromPrepared(params, preparedUserMessage) {
 		...senderUsername ? { senderUsername } : {},
 		...senderE164 ? { senderE164 } : {},
 		...senderLabel ? { senderLabel } : {},
-		...preparedUserMessage ? preparedUserMessage : { content: params.prompt }
+		...preparedUserMessage ?? { content: params.transcriptPrompt ?? params.prompt }
 	};
 }
 function buildCodexUserPromptMessage(params) {
@@ -310,6 +312,12 @@ async function mirrorBestEffort(params) {
 			cwd: params.cwd,
 			messages,
 			idempotencyScope: `codex-app-server:${params.threadId}`,
+			runId: params.params.runId,
+			runMirrorIdentityPrefix: `${params.turnId}:`,
+			terminalAssistantOwner: {
+				mirrorIdentity: `${params.turnId}:assistant`,
+				runId: params.params.runId
+			},
 			config: params.params.config
 		});
 		for (const receipt of mirrorResult.userMessageReceipts) try {
@@ -327,8 +335,9 @@ async function mirrorBestEffort(params) {
 			return identity !== void 0 && readCodexMirrorSourceFingerprint(message) === expectedFingerprints.get(identity);
 		});
 		const assistantMirrorIdentity = `${params.turnId}:assistant`;
-		const assistantTranscriptOwned = mirrorResult.assistantMirrorIdentitiesOwned.includes(assistantMirrorIdentity);
-		const assistantTranscriptIdempotencyKey = normalizeOptionalString((assistantTranscriptOwned ? mirroredMessages.find((message) => readMirrorIdentity(message) === assistantMirrorIdentity) : void 0)?.idempotencyKey);
+		const assistantTranscriptMessage = mirroredMessages.find((message) => readMirrorIdentity(message) === assistantMirrorIdentity);
+		const assistantTranscriptOwned = Boolean(assistantTranscriptMessage && mirrorResult.assistantMirrorIdentitiesOwned.includes(assistantMirrorIdentity));
+		const assistantTranscriptIdempotencyKey = normalizeOptionalString(assistantTranscriptMessage?.idempotencyKey);
 		const terminalMessage = mirroredMessages.at(-1);
 		const terminalMirrorIdentity = terminalMessage ? readMirrorIdentity(terminalMessage) : void 0;
 		const terminalAnchor = (terminalMirrorIdentity ? mirrorResult.anchorsByMirrorIdentity.get(terminalMirrorIdentity) : void 0) ?? params.params.userTurnTranscriptRecorder?.getAdmissionReceipt();
@@ -391,6 +400,8 @@ async function mirrorPromptAtTurnStartBestEffort(params) {
 				cwd: params.cwd,
 				messages: [userPromptMessage],
 				idempotencyScope: `codex-app-server:${params.threadId}`,
+				runId: params.params.runId,
+				runMirrorIdentityPrefix: `${params.turnId}:`,
 				config: params.params.config
 			});
 			for (const receipt of mirrorResult.userMessageReceipts) params.notifyUserMessagePersisted(receipt.message, receipt.anchor);
@@ -431,7 +442,7 @@ async function mirror(params) {
 		const sourceFingerprint = fingerprintCodexMirrorSourceMessage(message);
 		return {
 			dedupeIdentity,
-			idempotencyKey: (message.role === "user" ? normalizeOptionalString(message.idempotencyKey) : void 0) ?? (params.idempotencyScope ? `${params.idempotencyScope}:${dedupeIdentity}` : void 0),
+			idempotencyKey: (message.role === "user" ? normalizeOptionalString("idempotencyKey" in message ? message.idempotencyKey : void 0) : void 0) ?? (params.idempotencyScope ? `${params.idempotencyScope}:${dedupeIdentity}` : void 0),
 			message,
 			sourceFingerprint
 		};
@@ -450,8 +461,12 @@ async function mirror(params) {
 		const nextUserMessagesPresent = [];
 		const mirrorFacts = await transcript.readMessageFacts({ idempotencyKeys: candidateIdempotencyKeys });
 		for (const { dedupeIdentity, idempotencyKey, message, sourceFingerprint } of candidates) {
+			const mirrorIdentity = readMirrorIdentity(message);
+			const ownsRun = Boolean(params.runId && (!params.runMirrorIdentityPrefix || mirrorIdentity?.startsWith(params.runMirrorIdentityPrefix)));
+			const terminalOwner = params.terminalAssistantOwner;
+			const ownsTerminal = Boolean(ownsRun && terminalOwner && mirrorIdentity === terminalOwner.mirrorIdentity);
 			const transcriptMessage = {
-				...attachCodexMirrorAttestation(message, sourceFingerprint),
+				...attachCodexMirrorAttestation(ownsRun && params.runId ? attachCodexMirrorRunId(message, params.runId, ownsTerminal) : message, sourceFingerprint),
 				...idempotencyKey ? { idempotencyKey } : {}
 			};
 			if (idempotencyKey && mirrorFacts.existingIdempotencyKeys.has(idempotencyKey)) {
@@ -484,8 +499,8 @@ async function mirror(params) {
 				...attachCodexMirrorAttestation(nextMessage, sourceFingerprint),
 				idempotencyKey
 			} : attachCodexMirrorAttestation(nextMessage, sourceFingerprint);
-			const mirrorIdentity = readMirrorIdentity(message);
 			if (mirrorIdentity) messageToAppend = attachCodexMirrorIdentity(messageToAppend, mirrorIdentity);
+			if (ownsRun && params.runId) messageToAppend = attachCodexMirrorRunId(messageToAppend, params.runId, ownsTerminal);
 			messageToAppend = projectAgentHarnessTranscriptMessageForDisplay({
 				hidden: message.display === false,
 				message: messageToAppend
@@ -530,6 +545,8 @@ async function mirror(params) {
 		};
 	});
 	for (const update of appendedUpdates) try {
+		const terminalOwner = params.terminalAssistantOwner;
+		const terminalRunId = update.message.role === "assistant" && terminalOwner && readMirrorIdentity(update.message) === terminalOwner.mirrorIdentity ? terminalOwner.runId : void 0;
 		await publishSessionTranscriptUpdateByIdentity({
 			...transcriptTarget,
 			update: {
@@ -537,6 +554,7 @@ async function mirror(params) {
 				message: update.message,
 				messageId: update.messageId,
 				...update.messageSeq !== void 0 ? { messageSeq: update.messageSeq } : {},
+				...terminalRunId ? { runId: terminalRunId } : {},
 				sessionKey: transcriptTarget.sessionKey
 			}
 		});

package/dist/{transport-stdio-DIImwDVS.js → transport-stdio-DhoGy33Z.js}

@@ -75,8 +75,8 @@ function copySafeEnvironmentEntries(target, source) {
 	}
 }
 /** Spawns the Codex app-server process and returns the shared transport interface. */
-function createStdioTransport(options) {
-	const env = resolveCodexAppServerSpawnEnv(options);
+function createStdioTransport(options, baseEnv = process.env) {
+	const env = resolveCodexAppServerSpawnEnv(options, baseEnv);
 	const invocation = resolveCodexAppServerSpawnInvocation(options, {
 		platform: process.platform,
 		env,

package/dist/{upstream-prompt-provenance-ClRBije0.js → upstream-prompt-provenance-CFmsKwr9.js}

@@ -1,12 +1,12 @@
+import { asOptionalRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 //#region extensions/codex/src/app-server/upstream-prompt-provenance.ts
 const UPSTREAM_USER_TEXT_META_KEY = "upstreamUserText";
 const MIRROR_IDENTITY_META_KEY = "mirrorIdentity";
+const CODEX_META_KEY = "__openclaw";
 function attachCodexMirrorIdentity(message, identity) {
-	const record = message;
-	const existing = record["__openclaw"];
-	const baseMeta = existing && typeof existing === "object" && !Array.isArray(existing) ? existing : {};
+	const baseMeta = asOptionalRecord(CODEX_META_KEY in message ? message[CODEX_META_KEY] : void 0) ?? {};
 	return {
-		...record,
+		...message,
 		__openclaw: {
 			...baseMeta,
 			[MIRROR_IDENTITY_META_KEY]: identity
@@ -14,17 +14,15 @@ function attachCodexMirrorIdentity(message, identity) {
 	};
 }
 function readMirrorIdentity(message) {
-	const meta = message["__openclaw"];
-	if (!meta || typeof meta !== "object" || Array.isArray(meta)) return;
-	const id = meta[MIRROR_IDENTITY_META_KEY];
+	const record = asOptionalRecord(CODEX_META_KEY in message ? message[CODEX_META_KEY] : void 0);
+	if (!record) return;
+	const id = record[MIRROR_IDENTITY_META_KEY];
 	return typeof id === "string" && id ? id : void 0;
 }
 function attachUpstreamUserText(message, text) {
-	const record = message;
-	const existing = record["__openclaw"];
-	const baseMeta = existing && typeof existing === "object" && !Array.isArray(existing) ? existing : {};
+	const baseMeta = asOptionalRecord(CODEX_META_KEY in message ? message[CODEX_META_KEY] : void 0) ?? {};
 	return {
-		...record,
+		...message,
 		__openclaw: {
 			...baseMeta,
 			[UPSTREAM_USER_TEXT_META_KEY]: text
@@ -32,9 +30,9 @@ function attachUpstreamUserText(message, text) {
 	};
 }
 function readUpstreamUserText(message) {
-	const meta = message?.["__openclaw"];
-	if (!meta || typeof meta !== "object" || Array.isArray(meta)) return;
-	const text = meta[UPSTREAM_USER_TEXT_META_KEY];
+	const record = asOptionalRecord(message && CODEX_META_KEY in message ? message[CODEX_META_KEY] : void 0);
+	if (!record) return;
+	const text = record[UPSTREAM_USER_TEXT_META_KEY];
 	return typeof text === "string" && text ? text : void 0;
 }
 //#endregion

package/dist/{upstream-session-fork-CE-_LdnP.js → upstream-session-fork-BDVJCLAD.js}

@@ -1,7 +1,7 @@
-import { d as sessionBindingIdentity } from "./session-binding-DPxIvMgE.js";
-import { r as assertCodexThreadForkResponse } from "./protocol-validators-B4F7L8Rf.js";
+import { d as sessionBindingIdentity } from "./session-binding-BTrLf9Qm.js";
+import { r as assertCodexThreadForkResponse } from "./protocol-validators-VAVyEnDp.js";
 import { t as isIncognitoSessionKey } from "./incognito-session-ET_ufDH-.js";
-import { i as createImportedCodexSession, n as codexUpstreamBaseline, t as codexLastTerminalTurnId } from "./session-upstream-marker-CrIFX06J.js";
+import { i as createImportedCodexSession, n as codexUpstreamBaseline, t as codexLastTerminalTurnId } from "./session-upstream-marker-D_2npHlA.js";
 import { isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { readVisibleSessionTranscriptMessageEntries } from "openclaw/plugin-sdk/session-transcript-runtime";
 import { deleteSessionUpstreamLink, upsertSessionUpstreamLink } from "openclaw/plugin-sdk/session-catalog";
@@ -171,7 +171,14 @@ function normalizeTurnId(value) {
 }
 async function forkCodexUpstreamSession(params, options) {
 	try {
-		return await options.control.withPinnedConnection(async (control) => {
+		const sourceFingerprint = params.upstream.kind === "codex-app-server" ? readConnectionFingerprint(params.upstream.ref) : void 0;
+		const requestControl = sourceFingerprint ? options.controlFactory.forUpstream(params.source.agentId, sourceFingerprint) : void 0;
+		if (!sourceFingerprint || !requestControl) return {
+			status: "failed",
+			code: "upstream-unavailable",
+			message: "This Codex thread is not available on the current connection. Reconnect to its host and try again."
+		};
+		return await requestControl.withPinnedConnection(async (control) => {
 			const incognito = isIncognitoSessionKey(params.targetKey);
 			const clientId = control.clientId?.trim();
 			if (incognito && !clientId) throw new Error("Incognito Codex forks require the live pinned app-server client");
@@ -185,8 +192,7 @@ async function forkCodexUpstreamSession(params, options) {
 				if (linked) deleteSessionUpstreamLink(params.targetKey, params.source.agentId);
 				await control.archiveThread(forkedThreadId).catch(() => void 0);
 			};
-			const sourceFingerprint = readConnectionFingerprint(params.upstream.ref);
-			if (params.upstream.kind !== "codex-app-server" || !sourceFingerprint || sourceFingerprint !== control.connectionFingerprint) return {
+			if (sourceFingerprint !== control.connectionFingerprint) return {
 				status: "failed",
 				code: "upstream-unavailable",
 				message: "This Codex thread is not available on the current connection. Reconnect to its host and try again."

package/dist/{usage-CHlV0e-o.js → usage-9dKJCgcy.js}

@@ -1,6 +1,6 @@
-import { g as resolveCodexAppServerRuntimeOptions } from "./session-binding-DPxIvMgE.js";
-import { t as buildCodexAppServerUsageSnapshot } from "./rate-limits-DZXmOL8-.js";
-import { t as readCodexAppServerUsage } from "./request-BRl5_UfX.js";
+import { i as resolveCodexAppServerRuntimeOptions } from "./config-CpNeo5AE.js";
+import { t as buildCodexAppServerUsageSnapshot } from "./rate-limits-BI1dMHDG.js";
+import { t as readCodexAppServerUsage } from "./request-DSK0W6YI.js";
 import { CODEX_APP_SERVER_AUTH_MARKER } from "openclaw/plugin-sdk/agent-runtime";
 //#region extensions/codex/src/app-server/usage.ts
 /** Handles the synthetic usage credential for a Codex-backed OpenAI route. */

package/dist/{web-search-provider.runtime-DRw2Vl42.js → web-search-provider.runtime-DCdx4DGu.js}

@@ -1,6 +1,6 @@
-import { ct as isJsonObject } from "./shared-client-kIBbGjk4.js";
-import { d as buildCodexNativeWebSearchThreadConfig } from "./thread-lifecycle-Bu1BTDXr.js";
-import { t as runBoundedCodexAppServerTurn } from "./bounded-turn-qgZmzy_4.js";
+import { ut as isJsonObject } from "./shared-client-Dw-rzii0.js";
+import { d as buildCodexNativeWebSearchThreadConfig } from "./thread-lifecycle-DKdrnTMX.js";
+import { t as runBoundedCodexAppServerTurn } from "./bounded-turn-4BjrZEwW.js";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { readStringParam, resolveSearchTimeoutSeconds, wrapWebContent } from "openclaw/plugin-sdk/provider-web-search";
 //#region extensions/codex/src/web-search-provider.runtime.ts

package/openclaw.plugin.json

@@ -16,6 +16,13 @@
   ],
   "name": "Codex",
   "description": "Codex app-server harness and native session catalog.",
+  "cliCommands": [
+    {
+      "name": "codex",
+      "description": "Inspect and branch from Codex sessions through the Gateway",
+      "hasSubcommands": true
+    }
+  ],
   "contracts": {
     "mediaUnderstandingProviders": ["codex"],
     "migrationProviders": ["codex"],
@@ -45,6 +52,7 @@
     "onConfigPaths": [
       "plugins.entries.codex.config.appServer.transport",
       "plugins.entries.codex.config.sessionCatalog.enabled",
+      "plugins.entries.codex.config.sessionCatalog.homes",
       "plugins.entries.codex.config.supervision.enabled"
     ]
   },
@@ -73,7 +81,24 @@
         "type": "object",
         "additionalProperties": false,
         "properties": {
-          "enabled": { "type": "boolean", "default": true }
+          "enabled": { "type": "boolean", "default": true },
+          "homes": {
+            "type": "array",
+            "items": {
+              "anyOf": [
+                { "type": "string", "minLength": 1, "pattern": "\\S" },
+                {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "required": ["path"],
+                  "properties": {
+                    "path": { "type": "string", "minLength": 1, "pattern": "\\S" },
+                    "label": { "type": "string", "minLength": 1, "pattern": "\\S" }
+                  }
+                }
+              ]
+            }
+          }
         }
       },
       "discovery": {
@@ -392,6 +417,11 @@
       "label": "Discover Codex Sessions",
       "help": "List native Codex sessions in the sidebar from this Gateway and eligible paired nodes."
     },
+    "sessionCatalog.homes": {
+      "label": "Additional Codex Homes",
+      "help": "Existing local Codex home directories to include in native session discovery. String paths use the canonical directory basename as their label; object entries can override it with label. Paths are canonicalized and deduplicated. Requires appServer.transport=stdio and a Gateway restart.",
+      "advanced": true
+    },
     "codexDynamicToolsLoading": {
       "label": "Dynamic Tools Loading",
       "help": "Use searchable to defer OpenClaw dynamic tools behind Codex tool search, or direct to expose them in the initial context.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/codex",
-  "version": "2026.8.1-beta.2",
+  "version": "2026.8.1-beta.3",
   "description": "OpenClaw Codex app-server harness and native session supervision plugin.",
   "repository": {
     "type": "git",
@@ -8,7 +8,8 @@
   },
   "type": "module",
   "dependencies": {
-    "@openai/codex": "0.147.0",
+    "@openai/codex": "0.149.1",
+    "semver": "7.8.5",
     "smol-toml": "1.7.1",
     "typebox": "1.3.6",
     "ws": "8.21.1",
@@ -35,10 +36,10 @@
       ]
     },
     "compat": {
-      "pluginApi": ">=2026.8.1-beta.2"
+      "pluginApi": ">=2026.8.1-beta.3"
     },
     "build": {
-      "openclawVersion": "2026.8.1-beta.2"
+      "openclawVersion": "2026.8.1-beta.3"
     },
     "release": {
       "publishToClawHub": true,
@@ -58,7 +59,7 @@
     "README.md"
   ],
   "peerDependencies": {
-    "openclaw": ">=2026.8.1-beta.2"
+    "openclaw": ">=2026.8.1-beta.3"
   },
   "peerDependenciesMeta": {
     "openclaw": {

package/dist/app-server-policy-zcBDc1JU.js

@@ -1,49 +0,0 @@
-import { k as canUseCodexModelBackedApprovalsReviewerForModel } from "./session-binding-DPxIvMgE.js";
-//#region extensions/codex/src/app-server/app-server-policy.ts
-/**
-* Policy promotion for Codex app-server runs that can safely use OpenClaw tool
-* approvals.
-*/
-/**
-* Promotes implicit `never` approval policy to `untrusted` only when runtime
-* requirements allow OpenClaw to handle tool approvals.
-*/
-function resolveCodexAppServerForOpenClawToolPolicy(params) {
-	if (!params.shouldPromote || !params.canUseUntrustedApprovalPolicy || params.appServer.approvalPolicy !== "never") return params.appServer;
-	const explicitMode = params.execPolicy?.mode === "full" || params.pluginConfig.appServer?.mode !== void 0 || isCodexAppServerPolicyMode(params.env.OPENCLAW_CODEX_APP_SERVER_MODE);
-	const explicitApprovalPolicy = params.pluginConfig.appServer?.approvalPolicy !== void 0 || isConfiguredCodexAppServerApprovalPolicy(params.env.OPENCLAW_CODEX_APP_SERVER_APPROVAL_POLICY) || params.appServer.approvalPolicySource === "requirements";
-	if (explicitMode || explicitApprovalPolicy) return params.appServer;
-	return {
-		...params.appServer,
-		approvalPolicy: "untrusted"
-	};
-}
-function resolveCodexAppServerForModelProvider(params) {
-	const explicitProvider = normalizeModelBackedReviewerProvider(params.provider);
-	if (!isCodexModelBackedApprovalsReviewer(params.appServer.approvalsReviewer) || canUseCodexModelBackedApprovalsReviewerForModel({
-		modelProvider: explicitProvider,
-		model: params.model,
-		config: params.config,
-		env: params.env,
-		agentDir: params.agentDir,
-		codexConfigToml: params.codexConfigToml
-	})) return params.appServer;
-	return {
-		...params.appServer,
-		approvalsReviewer: "user"
-	};
-}
-function isCodexAppServerPolicyMode(value) {
-	return value === "guardian" || value === "yolo";
-}
-function isConfiguredCodexAppServerApprovalPolicy(value) {
-	return value === "never" || value === "on-request" || value === "on-failure" || value === "untrusted";
-}
-function isCodexModelBackedApprovalsReviewer(value) {
-	return value === "auto_review" || value === "guardian_subagent";
-}
-function normalizeModelBackedReviewerProvider(provider) {
-	return provider?.trim().toLowerCase() || void 0;
-}
-//#endregion
-export { resolveCodexAppServerForOpenClawToolPolicy as n, resolveCodexAppServerForModelProvider as t };