@openclaw/codex 2026.8.1-beta.2 → 2026.9.1-beta.1

package/dist/api.js

@@ -0,0 +1,147 @@
+import { a as resolveCodexAppServerStartOptionsForAgent, i as resolveCodexAppServerRuntimeOptions } from "./config-giW8X0QA.js";
+import { a as CODEX_APP_SERVER_VERSION, n as resolveManagedCodexAppServerStartOptions, r as resolveManagedCodexNativeCommand, t as isManagedCodexDesktopCommand } from "./managed-binary-DFYK4DWq.js";
+import path from "node:path";
+import { resolveDefaultModelForAgent } from "openclaw/plugin-sdk/agent-runtime";
+import { listAgentIds as listAgentIds$1, resolveAgentDir as resolveAgentDir$1 } from "openclaw/plugin-sdk/agent-scope-runtime";
+import { execFile } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { resolveEffectiveAgentRuntime } from "openclaw/plugin-sdk/command-auth-native";
+import { getHealthCheck } from "openclaw/plugin-sdk/health";
+//#region extensions/codex/src/doctor.ts
+const CODEX_MANAGED_APP_SERVER_CHECK_ID = "codex/managed-app-server";
+const CODEX_VERSION_TIMEOUT_MS = 5e3;
+const CODEX_VERSION_MAX_BUFFER_BYTES = 64 * 1024;
+function managedCodexFinding(params) {
+	return {
+		checkId: CODEX_MANAGED_APP_SERVER_CHECK_ID,
+		severity: "error",
+		source: "codex",
+		message: params.message,
+		...params.path ? { path: params.path } : {},
+		...params.requirement ? { requirement: params.requirement } : {},
+		...params.fixHint ? { fixHint: params.fixHint } : {}
+	};
+}
+function readErrorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+function parseCodexVersion(output) {
+	return /(?:^|\s)(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)(?:\s|$)/u.exec(output)?.[1];
+}
+function runVersionCommand(command) {
+	return new Promise((resolve, reject) => {
+		execFile(command, ["--version"], {
+			encoding: "utf8",
+			maxBuffer: CODEX_VERSION_MAX_BUFFER_BYTES,
+			timeout: CODEX_VERSION_TIMEOUT_MS,
+			windowsHide: true
+		}, (error, stdout, stderr) => {
+			if (error) {
+				reject(new Error(readErrorMessage(error), { cause: error }));
+				return;
+			}
+			resolve({
+				stdout,
+				stderr
+			});
+		});
+	});
+}
+function createCodexManagedAppServerHealthCheck(params) {
+	const resolveStartOptions = params.deps?.resolveStartOptions ?? resolveManagedCodexAppServerStartOptions;
+	const resolveAgentStartOptions = params.deps?.resolveAgentStartOptions ?? resolveCodexAppServerStartOptionsForAgent;
+	const isDesktopCommand = params.deps?.isDesktopCommand ?? isManagedCodexDesktopCommand;
+	const resolveNativeCommand = params.deps?.resolveNativeCommand ?? resolveManagedCodexNativeCommand;
+	const executeVersion = params.deps?.runVersionCommand ?? runVersionCommand;
+	return {
+		id: CODEX_MANAGED_APP_SERVER_CHECK_ID,
+		kind: "plugin",
+		description: "Verify the selected managed Codex app-server binary and pinned version.",
+		source: "codex",
+		defaultEnabled: false,
+		async detect(ctx) {
+			const pluginConfig = ctx.cfg.plugins?.entries?.codex?.config;
+			const start = resolveCodexAppServerRuntimeOptions({
+				pluginConfig,
+				env: ctx.env ?? process.env
+			}).start;
+			if (start.transport !== "stdio" || start.commandSource !== "managed") return [];
+			const env = ctx.env ?? process.env;
+			let resolved;
+			for (const agentId of listAgentIds$1(ctx.cfg)) {
+				const model = resolveDefaultModelForAgent({
+					cfg: ctx.cfg,
+					agentId
+				});
+				if (resolveEffectiveAgentRuntime({
+					cfg: ctx.cfg,
+					provider: model.provider,
+					modelId: model.model,
+					agentId
+				}) !== "codex") continue;
+				const agentStart = resolveAgentStartOptions({
+					startOptions: start,
+					agentDir: resolveAgentDir$1(ctx.cfg, agentId, env),
+					env
+				});
+				try {
+					resolved = await resolveStartOptions(agentStart, { pluginRoot: params.pluginRoot });
+				} catch (error) {
+					return [managedCodexFinding({
+						message: `Managed Codex app-server could not be resolved: ${readErrorMessage(error)}`,
+						path: params.pluginRoot,
+						requirement: `an executable Codex ${CODEX_APP_SERVER_VERSION} managed artifact`,
+						fixHint: "Reinstall the staged OpenClaw package with its @openai/codex platform dependency, then rerun the candidate check."
+					})];
+				}
+				if (!isDesktopCommand(resolved.command)) break;
+				resolved = void 0;
+			}
+			if (!resolved) return [];
+			const nativeCommand = resolveNativeCommand(resolved.command);
+			if (!nativeCommand) return [managedCodexFinding({
+				message: "Managed Codex app-server resolved a launcher without a native artifact.",
+				path: resolved.command,
+				requirement: `the platform-native Codex ${CODEX_APP_SERVER_VERSION} executable`,
+				fixHint: "Reinstall the staged OpenClaw package with the matching @openai/codex platform package, then rerun the candidate check."
+			})];
+			let output;
+			try {
+				output = await executeVersion(nativeCommand);
+			} catch (error) {
+				return [managedCodexFinding({
+					message: `Managed Codex app-server version check failed: ${readErrorMessage(error)}`,
+					path: nativeCommand,
+					requirement: `Codex ${CODEX_APP_SERVER_VERSION} must report its version within ${CODEX_VERSION_TIMEOUT_MS} ms`,
+					fixHint: "Repair or reinstall the staged OpenClaw package, then rerun the candidate check before cutover."
+				})];
+			}
+			const detectedVersion = parseCodexVersion(`${output.stdout}\n${output.stderr}`);
+			if (detectedVersion !== "0.150.1") return [managedCodexFinding({
+				message: detectedVersion ? `Managed Codex app-server version mismatch: expected ${CODEX_APP_SERVER_VERSION}, detected ${detectedVersion}.` : `Managed Codex app-server did not report a parseable version; expected ${CODEX_APP_SERVER_VERSION}.`,
+				path: nativeCommand,
+				requirement: `the exact OpenClaw-pinned Codex version ${CODEX_APP_SERVER_VERSION}`,
+				fixHint: "Reinstall the staged OpenClaw package so its managed @openai/codex dependency matches the pinned version, then rerun the candidate check."
+			})];
+			return [];
+		}
+	};
+}
+function registerCodexManagedAppServerDoctorChecks$1(host, deps) {
+	if (getHealthCheck("codex/managed-app-server")) return;
+	host.registerHealthCheck(createCodexManagedAppServerHealthCheck({
+		pluginRoot: host.pluginRoot,
+		deps
+	}));
+}
+//#endregion
+//#region extensions/codex/api.ts
+const CODEX_PLUGIN_ROOT = path.dirname(fileURLToPath(import.meta.url));
+function registerCodexManagedAppServerDoctorChecks(host) {
+	registerCodexManagedAppServerDoctorChecks$1({
+		...host,
+		pluginRoot: CODEX_PLUGIN_ROOT
+	});
+}
+//#endregion
+export { CODEX_MANAGED_APP_SERVER_CHECK_ID, registerCodexManagedAppServerDoctorChecks };

package/dist/{attempt-client-cleanup-DMLXUfa8.js → attempt-client-cleanup-bfsmcQ6m.js}

@@ -1,4 +1,4 @@
-import { J as unsubscribeCodexAppServerLiveThread, ct as isJsonObject, p as retireSharedCodexAppServerClientIfCurrent, z as CodexAppServerRpcError } from "./shared-client-kIBbGjk4.js";
+import { G as CodexAppServerRpcError, _ as retireSharedCodexAppServerClientIfCurrent, tt as unsubscribeCodexAppServerLiveThread, vt as isJsonObject } from "./shared-client-DKz23hHY.js";
 import { asFiniteNumber, normalizeOptionalString, normalizeOptionalString as normalizeOptionalString$1, readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
 import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
@@ -259,6 +259,7 @@ var CodexProjectionDiagnostics = class {
 //#region extensions/codex/src/app-server/turn-router.ts
 /** Keyed routing for all turn traffic on one shared Codex app-server client. */
 const DEFAULT_PREBIND_NOTIFICATION_LIMIT = 256;
+const DEFAULT_GLOBAL_WARNING_LIMIT = 32;
 const CODEX_APP_SERVER_NATIVE_TURN_WAIT_TIMEOUT_MS = 3e4;
 const routers = /* @__PURE__ */ new WeakMap();
 /** Returns the sole router installed on a physical app-server client. */
@@ -272,6 +273,7 @@ function getCodexAppServerTurnRouter(client) {
 var ClientTurnRouter = class {
 	constructor(client) {
 		this.routes = /* @__PURE__ */ new Map();
+		this.globalWarnings = [];
 		this.nativeTurnCompletionWatchers = /* @__PURE__ */ new Map();
 		this.disposed = false;
 		client.addNotificationHandler((notification) => this.routeNotification(notification));
@@ -290,7 +292,11 @@ var ClientTurnRouter = class {
 			ended: createDeferred(),
 			activated: createDeferred(),
 			gate: "open",
-			pending: [],
+			pending: this.globalWarnings.map((notification) => ({
+				notification,
+				receivedAtMs: Date.now(),
+				scope: { threadId }
+			})),
 			notificationTail: Promise.resolve(),
 			completedNativeTurnIds: /* @__PURE__ */ new Set(),
 			ignoredTurnNotificationKeys: /* @__PURE__ */ new Set()
@@ -412,6 +418,15 @@ var ClientTurnRouter = class {
 	routeNotification(notification) {
 		if (this.disposed) return;
 		const scope = readScope(notification.params);
+		if (!scope.threadId && (notification.method === "configWarning" || notification.method === "warning")) {
+			if (this.globalWarnings.length === DEFAULT_GLOBAL_WARNING_LIMIT) this.globalWarnings.shift();
+			this.globalWarnings.push(notification);
+			for (const route of this.routes.values()) {
+				this.bufferNotification(route, notification, { threadId: route.threadId }, Date.now());
+				if (route.gate === "bound") this.flushNotifications(route);
+			}
+			return Promise.all([...this.routes.values()].map((route) => route.notificationTail)).then(() => void 0);
+		}
 		const watchers = scope.threadId ? this.nativeTurnCompletionWatchers.get(scope.threadId) : void 0;
 		const route = scope.threadId ? this.routes.get(scope.threadId) : void 0;
 		if (!watchers && !route) return;
@@ -489,6 +504,10 @@ var ClientTurnRouter = class {
 		const handler = route.handlers?.onNotification;
 		if (!handler) return;
 		for (const pending of route.pending.splice(0)) {
+			if (route.gate !== "bound" && (pending.notification.method === "configWarning" || pending.notification.method === "warning" && !readScope(pending.notification.params).threadId)) {
+				route.pending.push(pending);
+				continue;
+			}
 			if (route.gate === "bound" && pending.scope.turnId && pending.scope.turnId !== route.turnId) {
 				this.warnDroppedStaleTurnNotification(route, pending.notification, pending.scope);
 				continue;

package/dist/{binding-connection-I5Bo-AsX.js → binding-connection-BMvPX73o.js}

@@ -1,5 +1,5 @@
-import { T as readCodexPluginConfig, g as resolveCodexAppServerRuntimeOptions, y as resolveCodexSupervisionAppServerRuntimeOptions } from "./session-binding-DPxIvMgE.js";
-import { t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-C3H2CVp6.js";
+import { h as readCodexPluginConfig, i as resolveCodexAppServerRuntimeOptions, s as resolveCodexSupervisionAppServerRuntimeOptions } from "./config-giW8X0QA.js";
+import { a as resolveCodexCatalogConnectionHome, t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-C1CAdfcP.js";
 //#region extensions/codex/src/app-server/binding-connection.ts
 /** Requires the native model pair after a supervised pending branch has materialized. */
 function requireCodexSupervisionModelSelection(binding) {
@@ -16,9 +16,21 @@ function resolveCodexBindingAppServerConnection(params) {
 	const { binding, authProfileId, ...runtimeParams } = params;
 	const usesSupervisionConnection = binding?.connectionScope === "supervision";
 	if (usesSupervisionConnection && readCodexPluginConfig(runtimeParams.pluginConfig).supervision?.enabled !== true) throw new Error("Codex supervision is disabled; refusing to open a native user-home supervised session");
-	const appServer = (usesSupervisionConnection ? resolveCodexSupervisionAppServerRuntimeOptions : resolveCodexAppServerRuntimeOptions)(runtimeParams);
+	let appServer = (usesSupervisionConnection ? resolveCodexSupervisionAppServerRuntimeOptions : resolveCodexAppServerRuntimeOptions)(runtimeParams);
 	if (usesSupervisionConnection) {
 		const persistedFingerprint = binding.pendingSupervisionBranch?.connectionFingerprint ?? binding.appServerRuntimeFingerprint;
+		const catalogHome = persistedFingerprint ? resolveCodexCatalogConnectionHome(persistedFingerprint, runtimeParams.agentDir) : void 0;
+		if (catalogHome) appServer = {
+			...appServer,
+			start: {
+				...appServer.start,
+				homeScope: "user",
+				env: {
+					...appServer.start.env,
+					CODEX_HOME: catalogHome
+				}
+			}
+		};
 		const currentFingerprint = buildCodexAppServerConnectionFingerprint(appServer, runtimeParams.agentDir);
 		if (!persistedFingerprint || persistedFingerprint !== currentFingerprint) throw new Error("Codex supervision connection changed; refusing to operate on its bound native thread");
 	}

package/dist/{bounded-turn-qgZmzy_4.js → bounded-turn-B7iBUcuP.js}

@@ -1,10 +1,10 @@
-import { g as resolveCodexAppServerRuntimeOptions } from "./session-binding-DPxIvMgE.js";
-import { ct as isJsonObject, s as isCodexAppServerStartSelectionChangedError } from "./shared-client-kIBbGjk4.js";
-import { _ as readCodexNotificationTurnId, a as closeCodexStartupClientBestEffort, o as interruptCodexTurnAndWaitBestEffort, t as CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS } from "./attempt-client-cleanup-DMLXUfa8.js";
-import { b as isTerminalTurnStatus, n as normalizeCodexResponseTokenUsage, x as readCodexNotificationItem, y as isRetryableErrorNotification } from "./event-projector-usage-e5huIQWu.js";
-import { a as assertCodexThreadStartResponse, c as readCodexErrorNotification, o as assertCodexTurnStartResponse, u as readCodexTurnCompletedNotification } from "./protocol-validators-B4F7L8Rf.js";
-import { r as readModelListResult } from "./models-BFlpn1Ex.js";
-import { W as mergeCodexThreadConfigs, c as buildCodexRingZeroThreadConfigPatch, l as buildCodexRuntimeThreadConfig, o as assertCodexRestrictedToolSurfaceHasNoManagedHooks, s as attestCodexRestrictedToolSurfaceMcpServersDisabled, u as readCodexInheritedMcpServerNames } from "./thread-lifecycle-Bu1BTDXr.js";
+import { i as resolveCodexAppServerRuntimeOptions } from "./config-giW8X0QA.js";
+import { K as createCodexElicitationResponse, c as isCodexAppServerStartSelectionChangedError, vt as isJsonObject } from "./shared-client-DKz23hHY.js";
+import { _ as readCodexNotificationTurnId, a as closeCodexStartupClientBestEffort, o as interruptCodexTurnAndWaitBestEffort, t as CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS } from "./attempt-client-cleanup-bfsmcQ6m.js";
+import { b as isTerminalTurnStatus, n as normalizeCodexResponseTokenUsage, x as readCodexNotificationItem, y as isRetryableErrorNotification } from "./event-projector-usage-Bk1I90Bg.js";
+import { a as assertCodexThreadStartResponse, c as readCodexErrorNotification, o as assertCodexTurnStartResponse, u as readCodexTurnCompletedNotification } from "./protocol-validators-VeJxxJ0U.js";
+import { r as readModelListResult } from "./models-TS3HBU-q.js";
+import { A as attestCodexRestrictedToolSurfaceMcpServersDisabled, M as buildCodexRuntimeThreadConfig, N as readCodexInheritedMcpServerNames, bt as mergeCodexThreadConfigs, j as buildCodexRingZeroThreadConfigPatch, k as assertCodexManagedRequirementsDoNotOverrideToolPolicy } from "./thread-lifecycle-L7oEkTlq.js";
 import { readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import fs from "node:fs/promises";
 import path from "node:path";
@@ -80,7 +80,7 @@ async function runBoundedCodexAppServerTurnInWorkspace(params, appServer, worksp
 		config: params.config,
 		timeoutMs,
 		...params.signal ? { abandonSignal: params.signal } : {}
-	}) : await import("./shared-client-kIBbGjk4.js").then((n) => n.m).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
+	}) : await import("./shared-client-DKz23hHY.js").then((n) => n.y).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
 		startOptions,
 		timeoutMs,
 		...authSelection,
@@ -115,7 +115,7 @@ async function runBoundedCodexAppServerTurnInWorkspace(params, appServer, worksp
 	timeout.unref?.();
 	let retrySelection = false;
 	try {
-		const model = await resolveCodexBoundedTurnModel({
+		const modelSelection = await resolveCodexBoundedTurnModel({
 			client,
 			selection: params.model,
 			requiredModalities: params.requiredModalities,
@@ -123,10 +123,10 @@ async function runBoundedCodexAppServerTurnInWorkspace(params, appServer, worksp
 			signal: abortController.signal
 		});
 		const inheritedMcpServerNames = params.requireNoExternalCapabilities ? await readCodexInheritedMcpServerNames(client, workspace.cwd, abortController.signal) : [];
-		if (params.requireNoExternalCapabilities) await assertCodexRestrictedToolSurfaceHasNoManagedHooks(client, abortController.signal);
+		if (params.requireNoExternalCapabilities) await assertCodexManagedRequirementsDoNotOverrideToolPolicy(client, { restrictedToolSurface: true }, abortController.signal);
 		const threadConfig = buildCodexRuntimeThreadConfig(resolveBoundedThreadConfig(params, workspace, inheritedMcpServerNames), { nativeCodeModeEnabled: false });
 		const thread = assertCodexThreadStartResponse(await client.request("thread/start", {
-			model,
+			model: modelSelection.runtimeModelId,
 			...params.modelProvider ? { modelProvider: params.modelProvider } : {},
 			cwd: workspace.cwd,
 			approvalPolicy: "on-request",
@@ -161,7 +161,7 @@ async function runBoundedCodexAppServerTurnInWorkspace(params, appServer, worksp
 				threadId: thread.thread.id,
 				input: params.input,
 				approvalPolicy: "on-request",
-				model,
+				model: modelSelection.runtimeModelId,
 				effort: "low"
 			}, {
 				timeoutMs,
@@ -174,7 +174,7 @@ async function runBoundedCodexAppServerTurnInWorkspace(params, appServer, worksp
 					signal: abortController.signal,
 					timeoutError
 				}),
-				model
+				model: modelSelection.catalogId
 			};
 		} finally {
 			await interruptPromise;
@@ -242,7 +242,7 @@ function createCodexBoundedApprovalHandler(taskLabel) {
 			decision: "decline",
 			reason: `OpenClaw Codex ${taskLabel} does not grant native approvals.`
 		};
-		if (request.method === "mcpServer/elicitation/request") return { action: "decline" };
+		if (request.method === "mcpServer/elicitation/request") return createCodexElicitationResponse("decline", null, { message: `OpenClaw Codex ${taskLabel} does not support interactive input.` });
 	};
 }
 async function resolveCodexBoundedTurnModel(params) {
@@ -258,14 +258,20 @@ async function resolveCodexBoundedTurnModel(params) {
 		const supported = listed.filter((entry) => params.requiredModalities.every((modality) => entry.inputModalities.includes(modality)));
 		const selected = supported.find((entry) => entry.isDefault) ?? supported[0];
 		if (!selected) throw new Error(`Codex app-server has no model supporting ${params.requiredModalities.join(" and ")} input.`);
-		return selected.model;
+		return {
+			catalogId: selected.id,
+			runtimeModelId: selected.model
+		};
 	}
 	const model = params.selection.id;
 	const match = listed.find((entry) => entry.model === model || entry.id === model);
 	if (!match) throw new Error(`Codex app-server model not found: ${model}`);
 	if (params.requiredModalities.includes("image") && !match.inputModalities.includes("image")) throw new Error(`Codex app-server model does not support images: ${model}`);
 	if (params.requiredModalities.includes("text") && !match.inputModalities.includes("text")) throw new Error(`Codex app-server model does not support text: ${model}`);
-	return model;
+	return {
+		catalogId: match.id,
+		runtimeModelId: match.model
+	};
 }
 function createCodexBoundedTurnCollector(threadId, taskLabel, allowEmptyText) {
 	let turnId;

package/dist/{capabilities-CybGI1oz.js → capabilities-BRMh0aIq.js}

@@ -1,4 +1,4 @@
-import { z as CodexAppServerRpcError } from "./shared-client-kIBbGjk4.js";
+import { G as CodexAppServerRpcError } from "./shared-client-DKz23hHY.js";
 //#region extensions/codex/src/app-server/capabilities.ts
 /**
 * Capability helpers for optional Codex app-server control-plane methods.

package/dist/cli-metadata.js

@@ -2,7 +2,7 @@ import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
 //#region extensions/codex/cli-metadata.ts
 function registerCodexCliMetadata(api) {
 	api.registerCli(async ({ program }) => {
-		const { registerCodexSessionCli } = await import("./session-cli-7hgXZDV7.js");
+		const { registerCodexSessionCli } = await import("./session-cli-DMc4oS2w.js");
 		registerCodexSessionCli(program);
 	}, { descriptors: [{
 		name: "codex",

package/dist/{command-formatters-B1AEz8ZA.js → command-formatters-DEsIufkt.js}

@@ -1,5 +1,5 @@
-import { ct as isJsonObject } from "./shared-client-kIBbGjk4.js";
-import { c as summarizeCodexRateLimits, o as summarizeCodexAccountRateLimits, r as hasCodexRateLimitSnapshots } from "./rate-limits-DZXmOL8-.js";
+import { vt as isJsonObject } from "./shared-client-DKz23hHY.js";
+import { c as summarizeCodexRateLimits, o as summarizeCodexAccountRateLimits, r as hasCodexRateLimitSnapshots } from "./rate-limits-C5_D8Gmb.js";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 //#region extensions/codex/src/command-formatters.ts
 /**

package/dist/{command-handlers-Db8pu_ds.js → command-handlers-D_-1_qRp.js}

@@ -1,28 +1,30 @@
-import { D as CODEX_PLUGINS_MARKETPLACE_NAME, P as isCodexFastServiceTier, c as reclaimCurrentCodexSessionGeneration, d as sessionBindingIdentity, g as resolveCodexAppServerRuntimeOptions, i as createCodexSessionGenerationSupersededError, n as assertCodexBindingMayBeReplaced, r as bindingStoreKey, s as normalizeCodexAppServerBindingModelProvider } from "./session-binding-DPxIvMgE.js";
-import { Q as resolveCodexAppServerAuthAccountCacheKey, V as consumeCodexAppServerLiveThread, a as getLeasedSharedCodexAppServerClient, ct as isJsonObject, et as resolveCodexAppServerAuthProfileIdForAgent, l as releaseLeasedSharedCodexAppServerClient, tt as resolveCodexAppServerFallbackApiKeyCacheKey } from "./shared-client-kIBbGjk4.js";
-import { i as assertCodexThreadResumeResponse } from "./protocol-validators-B4F7L8Rf.js";
-import { t as listAllCodexAppServerModels } from "./models-BFlpn1Ex.js";
-import { i as defaultCodexAppInventoryCache, r as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-C3H2CVp6.js";
-import { Y as isOpenAiCuratedMarketplaceName, q as refreshCodexPluginRuntimeState } from "./thread-lifecycle-Bu1BTDXr.js";
+import { N as isCodexFastServiceTier, _ as CODEX_PLUGINS_MARKETPLACE_NAME, i as resolveCodexAppServerRuntimeOptions } from "./config-giW8X0QA.js";
+import { J as consumeCodexAppServerLiveThread, ct as resolveCodexAppServerAuthAccountCacheKey, dt as resolveCodexAppServerFallbackApiKeyCacheKey, o as getLeasedSharedCodexAppServerClient, p as releaseLeasedSharedCodexAppServerClient, ut as resolveCodexAppServerAuthProfileIdForAgent, vt as isJsonObject } from "./shared-client-DKz23hHY.js";
+import { c as reclaimCurrentCodexSessionGeneration, d as sessionBindingIdentity, i as createCodexSessionGenerationSupersededError, n as assertCodexBindingMayBeReplaced, r as bindingStoreKey, s as normalizeCodexAppServerBindingModelProvider } from "./session-binding-Bcynfd-_.js";
+import { i as assertCodexThreadResumeResponse } from "./protocol-validators-VeJxxJ0U.js";
+import { t as listAllCodexAppServerModels } from "./models-TS3HBU-q.js";
+import { o as defaultCodexAppInventoryCache, r as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-C1CAdfcP.js";
+import { Ct as refreshCodexPluginRuntimeState, Tt as isOpenAiCuratedMarketplaceName } from "./thread-lifecycle-L7oEkTlq.js";
 import { t as isIncognitoSessionKey } from "./incognito-session-ET_ufDH-.js";
-import { t as CODEX_CONTROL_METHODS } from "./capabilities-CybGI1oz.js";
-import { s as summarizeCodexAccountUsage } from "./rate-limits-DZXmOL8-.js";
-import { a as formatComputerUseStatus, c as formatSkills, i as formatCodexStatus, l as formatThreads, n as formatAccount, o as formatList, r as formatCodexDisplayText, s as formatModels, t as buildHelp } from "./command-formatters-B1AEz8ZA.js";
-import { n as resolveCodexNativeExecutionBlock, r as resolveCodexNativeSandboxBlock } from "./sandbox-guard-Cmwc9eIk.js";
-import { a as rollbackCodexAppServerBindingSubscription, i as retireCodexConversationThreadBinding, n as releaseCodexAppServerBindingSubscription, o as withCodexConversationThreadActivity, r as retainCodexAppServerBindingSubscription, s as withExclusiveCodexAppServerThread, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-6kOQHlyC.js";
-import { a as parseCodexPermissionsModeArg, c as setCodexConversationModel, d as stopCodexConversationTurn, i as parseCodexFastModeArg, l as setCodexConversationPermissions, m as canMutateCodexHost, n as parseCodexPluginMarketplaceId, o as readCodexConversationActiveTurn, p as CODEX_NATIVE_EXECUTION_AUTH_ERROR, r as formatPermissionsMode, s as setCodexConversationFastMode, t as discoverCodexMarketplacePlugins, u as steerCodexConversationTurn } from "./plugin-marketplace-discovery-CzrGJdCR.js";
+import { t as CODEX_CONTROL_METHODS } from "./capabilities-BRMh0aIq.js";
+import { s as summarizeCodexAccountUsage } from "./rate-limits-C5_D8Gmb.js";
+import { a as formatComputerUseStatus, c as formatSkills, i as formatCodexStatus, l as formatThreads, n as formatAccount, o as formatList, r as formatCodexDisplayText, s as formatModels, t as buildHelp } from "./command-formatters-DEsIufkt.js";
+import { n as resolveCodexNativeExecutionBlock, r as resolveCodexNativeSandboxBlock } from "./sandbox-guard-kuWTn9C5.js";
+import { a as rollbackCodexAppServerBindingSubscription, i as retireCodexConversationThreadBinding, n as releaseCodexAppServerBindingSubscription, o as withCodexConversationThreadActivity, r as retainCodexAppServerBindingSubscription, s as withExclusiveCodexAppServerThread, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-DZeuKH1j.js";
+import { _ as hasCodexAdminScope, a as parseCodexPermissionsModeArg, c as setCodexConversationModel, d as stopCodexConversationTurn, g as canMutateCodexHost, h as CODEX_NATIVE_EXECUTION_AUTH_ERROR, i as parseCodexFastModeArg, l as setCodexConversationPermissions, m as CODEX_HOST_INSPECTION_AUTH_ERROR, n as parseCodexPluginMarketplaceId, o as readCodexConversationActiveTurn, p as CODEX_FULL_PERMISSIONS_AUTH_ERROR, r as formatPermissionsMode, s as setCodexConversationFastMode, t as discoverCodexMarketplacePlugins, u as steerCodexConversationTurn } from "./plugin-marketplace-discovery-B9DvaAG-.js";
 import { i as readCodexConversationBindingData, n as createCodexCliNodeConversationBindingData, o as resolveCodexDefaultWorkspaceDir, r as createCodexConversationBindingData } from "./conversation-binding-data-CW2GuupV.js";
-import { n as resolveCodexBindingAppServerConnection } from "./binding-connection-I5Bo-AsX.js";
-import { c as readCodexStatusProbes, l as requestOptions, p as formatCodexCliSessions, s as codexControlRequest, u as safeCodexControlRequest } from "./session-catalog-xwNi_SDM.js";
-import { i as readCodexComputerUseStatus, r as installCodexComputerUse, t as defaultCodexPluginMetadataCache } from "./plugin-metadata-cache-CNJPj4_b.js";
+import { n as resolveCodexBindingAppServerConnection } from "./binding-connection-BMvPX73o.js";
+import { l as formatCodexCliSessions } from "./session-catalog-DaLKVtpH.js";
+import { i as safeCodexControlRequest, n as readCodexStatusProbes, r as requestOptions, t as codexControlRequest } from "./command-rpc-CCeCkf_v.js";
+import { i as readCodexComputerUseStatus, r as installCodexComputerUse, t as defaultCodexPluginMetadataCache } from "./plugin-metadata-cache-CTCT3w5L.js";
 import { normalizeOptionalString, normalizeUniqueStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { parseStrictPositiveInteger } from "openclaw/plugin-sdk/number-runtime";
 import crypto from "node:crypto";
 import { ensureAuthProfileStore, findNormalizedProviderValue, resolveAgentDir, resolveAuthProfileEligibility, resolveAuthProfileOrder, resolveProfileUnusableUntilForDisplay, resolveSessionAgentIds } from "openclaw/plugin-sdk/agent-runtime";
-import { parseAgentSessionKey } from "openclaw/plugin-sdk/routing";
 import { getSessionEntry, resolveStorePath } from "openclaw/plugin-sdk/session-store-runtime";
 import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
+import { parseAgentSessionKey } from "openclaw/plugin-sdk/routing";
 import { MODEL_SELECTION_LOCKED_MESSAGE, isModelSelectionLocked, resolvePersistedSessionRuntimeId } from "openclaw/plugin-sdk/model-session-runtime";
 //#region extensions/codex/src/command-account.ts
 const OPENAI_PROVIDER_ID = "openai";
@@ -49,8 +51,8 @@ async function readCodexAccountAuthOverview(params) {
 		limits: params.limits,
 		now
 	});
-	const subscriptionProfileId = order.find((profileId) => isChatGptSubscriptionProfile(store.profiles[profileId]));
 	const activeIsSubscription = activeProfileId !== void 0 && isChatGptSubscriptionProfile(store.profiles[activeProfileId]);
+	const subscriptionProfileId = activeIsSubscription ? activeProfileId : order.find((profileId) => isChatGptSubscriptionProfile(store.profiles[profileId]));
 	const activeUsage = activeIsSubscription && params.limits.ok ? summarizeCodexAccountUsage(params.limits.value, now) : void 0;
 	const subscriptionUsage = subscriptionProfileId && (!activeIsSubscription || subscriptionProfileId !== activeProfileId) ? await readSubscriptionUsage({
 		...params,
@@ -155,13 +157,20 @@ function resolveLiveAccountProfileId(params) {
 	const type = normalizeOptionalString(account.type)?.toLowerCase();
 	if (type === "chatgpt") {
 		const email = normalizeOptionalString(account.email)?.toLowerCase();
-		const firstSubscription = params.order.find((profileId) => isChatGptSubscriptionProfile(params.store.profiles[profileId]));
-		if (!email) return firstSubscription;
-		return params.order.find((profileId) => {
-			const credential = params.store.profiles[profileId];
-			if (!credential || !isChatGptSubscriptionProfile(credential)) return false;
-			return (credential.email?.trim().toLowerCase() ?? extractEmailFromProfileId(profileId))?.toLowerCase() === email;
-		}) ?? firstSubscription;
+		const accountId = normalizeOptionalString(account.accountId ?? account.chatgptAccountId);
+		const subscriptionProfiles = params.order.filter((profileId) => isChatGptSubscriptionProfile(params.store.profiles[profileId]));
+		if (accountId) {
+			const exactWorkspace = subscriptionProfiles.find((profileId) => {
+				const credential = params.store.profiles[profileId];
+				return credential && "accountId" in credential && credential.accountId === accountId;
+			});
+			if (exactWorkspace) return exactWorkspace;
+		}
+		const matchingProfiles = email ? subscriptionProfiles.filter((profileId) => {
+			return (params.store.profiles[profileId]?.email?.trim().toLowerCase() ?? extractEmailFromProfileId(profileId))?.toLowerCase() === email;
+		}) : subscriptionProfiles;
+		const lastGood = params.store.lastGood?.[OPENAI_PROVIDER_ID];
+		return (lastGood && matchingProfiles.includes(lastGood) ? lastGood : void 0) ?? matchingProfiles[0] ?? subscriptionProfiles[0];
 	}
 	if (type === "apikey" || type === "api_key") return params.order.find((profileId) => params.store.profiles[profileId]?.type === "api_key");
 }
@@ -1487,13 +1496,23 @@ async function describeConversationBinding(deps, ctx) {
 	const identity = conversationBindingIdentity(data.bindingId);
 	const threadBinding = await deps.bindingStore.read(identity);
 	const active = deps.readCodexConversationActiveTurn(identity);
+	const sessionKey = ctx.sessionKey?.trim();
+	const { agentId } = resolveCodexConversationControlScope(ctx);
+	const sessionEntry = sessionKey ? getSessionEntry({
+		agentId,
+		storePath: resolveStorePath(ctx.config.session?.store, { agentId }),
+		sessionKey,
+		hydrateSkillPromptRefs: false,
+		readConsistency: "latest"
+	}) : void 0;
+	const permissionMode = !ctx.sessionId || sessionEntry?.sessionId === ctx.sessionId ? sessionEntry?.permissionMode : void 0;
 	return [
 		"Codex conversation binding:",
 		`- Thread: ${formatCodexDisplayText(threadBinding?.threadId ?? "unknown")}`,
 		`- Workspace: ${formatCodexDisplayText(data.workspaceDir)}`,
 		`- Model: ${formatCodexDisplayText(threadBinding?.model ?? "default")}`,
 		`- Fast: ${isCodexFastServiceTier(threadBinding?.serviceTier) ? "on" : "off"}`,
-		`- Permissions: ${threadBinding ? formatPermissionsMode(threadBinding) : "default"}`,
+		`- Permissions: ${formatPermissionsMode(permissionMode)}`,
 		`- Active run: ${formatCodexDisplayText(active ? active.turnId : "none")}`,
 		`- Binding: ${formatCodexDisplayText(data.bindingId)}`
 	].join("\n");
@@ -1820,9 +1839,9 @@ async function setConversationModel(deps, ctx, pluginConfig, args) {
 			hydrateSkillPromptRefs: false,
 			readConsistency: "latest"
 		}) : void 0;
-		const selectedModel = currentSession && currentSession.sessionId === ctx.sessionId ? currentSession.modelOverride : void 0;
+		const selectedModel = currentSession && currentSession.sessionId === ctx.sessionId ? currentSession.modelOverride ?? currentSession.model : void 0;
 		const binding = await deps.bindingStore.read(target.identity);
-		const activeModel = selectedModel ?? binding?.model;
+		const activeModel = target.identity.kind === "conversation" ? binding?.model : selectedModel ?? binding?.model;
 		return activeModel ? `Codex model: ${formatCodexDisplayText(activeModel)}` : "Usage: /codex model <model>";
 	}
 	return await deps.setCodexConversationModel({
@@ -1831,12 +1850,7 @@ async function setConversationModel(deps, ctx, pluginConfig, args) {
 		pluginConfig,
 		model: normalized,
 		agentDir: target.agentDir,
-		config: ctx.config,
-		...ctx.sessionId && ctx.sessionKey ? { session: {
-			agentId: target.agentId,
-			sessionId: ctx.sessionId,
-			sessionKey: ctx.sessionKey
-		} } : {}
+		config: ctx.config
 	});
 }
 async function setConversationFastMode(deps, ctx, args) {
@@ -1855,14 +1869,19 @@ async function setConversationFastMode(deps, ctx, args) {
 async function setConversationPermissions(deps, ctx, args) {
 	if (args.length > 1) return "Usage: /codex permissions [default|yolo|status]";
 	const target = await resolveControlTarget(ctx);
-	if (!target) return "Cannot set Codex permissions because this command did not include a stable binding identity.";
+	if (!target || !ctx.sessionId || !ctx.sessionKey) return "Cannot set Codex permissions because this command did not include a complete session identity.";
 	const value = args[0];
 	const parsed = parseCodexPermissionsModeArg(value);
 	if (value && !parsed && value.trim().toLowerCase() !== "status") return "Usage: /codex permissions [default|yolo|status]";
+	if (parsed === "yolo" && !hasCodexAdminScope(ctx)) return CODEX_FULL_PERMISSIONS_AUTH_ERROR;
 	return await deps.setCodexConversationPermissions({
-		identity: target.identity,
-		bindingStore: deps.bindingStore,
-		mode: parsed
+		mode: parsed,
+		config: ctx.config,
+		session: {
+			agentId: target.agentId,
+			sessionId: ctx.sessionId,
+			sessionKey: ctx.sessionKey
+		}
 	});
 }
 async function startThreadAction(deps, ctx, pluginConfig, kind, args) {
@@ -2276,6 +2295,14 @@ function formatPluginList(plugins, options = {}) {
 }
 //#endregion
 //#region extensions/codex/src/command-handlers.ts
+const CODEX_HOST_INSPECTION_SUBCOMMANDS = /* @__PURE__ */ new Set([
+	"account",
+	"mcp",
+	"sessions",
+	"skills",
+	"status",
+	"threads"
+]);
 async function handleCodexSubcommand(ctx, options) {
 	const deps = resolveCodexCommandDeps(options.deps);
 	const args = splitArgs(ctx.args);
@@ -2283,6 +2310,7 @@ async function handleCodexSubcommand(ctx, options) {
 	const [subcommand = "status", ...rest] = args;
 	const normalized = subcommand.toLowerCase();
 	if (normalized === "help") return { text: buildHelp() };
+	if (CODEX_HOST_INSPECTION_SUBCOMMANDS.has(normalized) && !canMutateCodexHost(ctx)) return { text: CODEX_HOST_INSPECTION_AUTH_ERROR };
 	if (CODEX_NATIVE_CONTROL_SUBCOMMANDS.has(normalized) && !returnsBeforeNativeCodexExecution(normalized, rest) && !isReadOnlyCodexGoalCommand(normalized, rest) && !canMutateCodexHost(ctx)) return { text: CODEX_NATIVE_EXECUTION_AUTH_ERROR };
 	const sandboxBlock = resolveCodexNativeCommandSandboxBlock(ctx, normalized, rest);
 	if (sandboxBlock) return { text: sandboxBlock };

package/dist/command-rpc-CCeCkf_v.js

@@ -0,0 +1,90 @@
+import { i as resolveCodexAppServerRuntimeOptions, s as resolveCodexSupervisionAppServerRuntimeOptions } from "./config-giW8X0QA.js";
+import { n as listCodexAppServerModels } from "./models-TS3HBU-q.js";
+import { n as describeControlFailure, t as CODEX_CONTROL_METHODS } from "./capabilities-BRMh0aIq.js";
+import { i as withCodexAppServerJsonClient, r as requestCodexAppServerJson } from "./request-DXXGHko0.js";
+//#region extensions/codex/src/command-rpc.ts
+function requestOptions(pluginConfig, limit, config, agentDir) {
+	const runtime = resolveCodexAppServerRuntimeOptions({ pluginConfig });
+	return {
+		limit,
+		timeoutMs: runtime.requestTimeoutMs,
+		startOptions: runtime.start,
+		config,
+		agentDir
+	};
+}
+async function codexControlRequest(pluginConfig, method, requestParams, options = {}) {
+	const runtime = options.startOptions ? resolveCodexSupervisionAppServerRuntimeOptions({ pluginConfig }) : resolveCodexAppServerRuntimeOptions({ pluginConfig });
+	const controlRequestOptions = {
+		timeoutMs: options.timeoutMs ?? runtime.requestTimeoutMs,
+		startOptions: options.startOptions ?? runtime.start,
+		config: options.config,
+		sessionKey: options.sessionKey,
+		sessionId: options.sessionId,
+		authProfileId: options.authProfileId,
+		agentDir: options.agentDir,
+		isolated: options.isolated
+	};
+	if (options.onResponse) return await withCodexAppServerJsonClient(controlRequestOptions, async (request, client) => {
+		const response = await request({
+			method,
+			requestParams
+		});
+		await options.onResponse(response, client);
+		return response;
+	});
+	return await requestCodexAppServerJson({
+		method,
+		requestParams,
+		...controlRequestOptions
+	});
+}
+async function safeCodexControlRequest(pluginConfig, method, requestParams, options = {}) {
+	return await safeValue(async () => await codexControlRequest(pluginConfig, method, requestParams, options));
+}
+async function safeCodexModelList(pluginConfig, limit, config, agentDir) {
+	return await safeValue(async () => await listCodexAppServerModels(requestOptions(pluginConfig, limit, config, agentDir)));
+}
+async function readCodexStatusProbes(pluginConfig, config, agentDir) {
+	const [models, account, limits, mcps, skills] = await Promise.all([
+		safeCodexModelList(pluginConfig, 20, config, agentDir),
+		safeCodexControlRequest(pluginConfig, CODEX_CONTROL_METHODS.account, { refreshToken: false }, {
+			config,
+			agentDir
+		}),
+		safeCodexControlRequest(pluginConfig, CODEX_CONTROL_METHODS.rateLimits, void 0, {
+			config,
+			agentDir
+		}),
+		safeCodexControlRequest(pluginConfig, CODEX_CONTROL_METHODS.listMcpServers, { limit: 100 }, {
+			config,
+			agentDir
+		}),
+		safeCodexControlRequest(pluginConfig, CODEX_CONTROL_METHODS.listSkills, {}, {
+			config,
+			agentDir
+		})
+	]);
+	return {
+		models,
+		account,
+		limits,
+		mcps,
+		skills
+	};
+}
+async function safeValue(read) {
+	try {
+		return {
+			ok: true,
+			value: await read()
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			error: describeControlFailure(error)
+		};
+	}
+}
+//#endregion
+export { safeCodexControlRequest as i, readCodexStatusProbes as n, requestOptions as r, codexControlRequest as t };