@openclaw/codex 2026.8.1-beta.3 → 2026.8.1

package/dist/doctor-contract-api.js

@@ -1,14 +1,113 @@
 import { n as CODEX_APP_SERVER_BINDING_NAMESPACE, t as CODEX_APP_SERVER_BINDING_MAX_ENTRIES } from "./session-binding-meta-B7aEMU7g.js";
-import { asNullableRecord, isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { asNullableRecord, asOptionalRecord, isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import fs from "node:fs/promises";
 import path from "node:path";
+import { createHash } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
-import { listAgentIds, resolveAgentDir, resolveSessionAgentIds } from "openclaw/plugin-sdk/agent-scope-runtime";
 import { pathExists } from "openclaw/plugin-sdk/security-runtime";
+import { listAgentIds, resolveAgentDir, resolveSessionAgentIdsStrict } from "openclaw/plugin-sdk/agent-scope-runtime";
 import { normalizeAgentId } from "openclaw/plugin-sdk/routing";
 import { canonicalPathFromExistingAncestor, isPathInside } from "openclaw/plugin-sdk/file-access-runtime";
+import { setImmediate } from "node:timers/promises";
 import { withFileLock } from "openclaw/plugin-sdk/file-lock";
 import { archiveLegacyStateSource, legacyStateFileExists } from "openclaw/plugin-sdk/runtime-doctor-migrations";
+//#region extensions/codex/src/migration/session-binding-orphans.ts
+const PAGE_SIZE = 512;
+const KEY_PREFIXES = ["session-key:", "session:"];
+function readBindingCandidate(row, prefix) {
+	const identity = /^([a-z0-9][a-z0-9_-]{0,63}):(.+)$/u.exec(row.key.slice(prefix.length));
+	if (!identity) return;
+	const agentId = identity[1];
+	const keyIdentity = identity[2];
+	const stored = asOptionalRecord(row.value);
+	const sessionId = typeof stored?.sessionId === "string" ? stored.sessionId.trim() : "";
+	const stable = prefix === "session-key:";
+	if (!stored || stored.version !== 1 || !sessionId || (stable ? !/^[A-Za-z0-9_-]{43}$/u.test(keyIdentity) : sessionId !== keyIdentity)) return;
+	if (stored.state === "cleared") {
+		if (stored.binding !== void 0 || stored.retired !== void 0 && stored.retired !== true) return;
+	} else if (stored.state === "active") {
+		const binding = asOptionalRecord(stored.binding);
+		if (!binding || typeof binding.threadId !== "string" || !binding.threadId.trim() || typeof binding.cwd !== "string" || binding.connectionScope !== void 0 || binding.supervisionSourceThreadId !== void 0 || binding.pendingSupervisionBranch !== void 0 || stored.retired !== void 0) return;
+	} else return;
+	if (stored.lease !== void 0) {
+		const lease = asOptionalRecord(stored.lease);
+		if (!lease || typeof lease.token !== "string" || !lease.token.trim() || typeof lease.expiresAt !== "number" || !Number.isFinite(lease.expiresAt) || lease.expiresAt > Date.now()) return;
+	}
+	return {
+		row,
+		agentId,
+		sessionId,
+		stable
+	};
+}
+async function* iterateOrphanBindingPages({ context }) {
+	const readPage = context.readPluginStateEntriesInKeyRange;
+	const readEvidence = context.readSessionIdentityEvidenceBatch;
+	if (!readPage || !readEvidence) return;
+	for (const prefix of KEY_PREFIXES) {
+		let after;
+		while (true) {
+			const rows = readPage(CODEX_APP_SERVER_BINDING_NAMESPACE, {
+				prefix,
+				...after ? { after } : {},
+				limit: PAGE_SIZE
+			});
+			if (rows.length === 0) break;
+			after = rows.at(-1)?.key;
+			const candidates = rows.flatMap((row) => {
+				const candidate = readBindingCandidate(row, prefix);
+				return candidate ? [candidate] : [];
+			});
+			if (candidates.length > 0) {
+				const identities = new Map(candidates.map(({ agentId, sessionId }) => [`${agentId}\0${sessionId}`, {
+					agentId,
+					sessionId
+				}]));
+				const evidence = new Map((await readEvidence([...identities.values()])).map((owner) => [`${owner.agentId}\0${owner.sessionId}`, owner]));
+				const stale = candidates.filter(({ row, agentId, sessionId, stable }) => {
+					const owner = evidence.get(`${agentId}\0${sessionId}`);
+					if (!owner || owner.state === "unknown") return false;
+					if (owner.state !== "current") return true;
+					if (!stable) return false;
+					const digest = createHash("sha256").update(owner.sessionKey).digest("base64url");
+					return row.key !== `session-key:${agentId}:${digest}`;
+				}).map(({ row }) => row);
+				if (stale.length > 0) yield stale;
+			}
+			if (rows.length < PAGE_SIZE) break;
+			await setImmediate();
+		}
+	}
+}
+const codexOrphanedSessionBindingMigration = {
+	id: "codex-app-server-orphaned-session-bindings",
+	label: "Codex app-server orphaned session bindings",
+	doctorOnly: true,
+	phase: "after-session-repair",
+	async detectLegacyState(params) {
+		for await (const _ of iterateOrphanBindingPages(params)) return { preview: ["- Codex app-server bindings: remove orphaned session ownership"] };
+		return null;
+	},
+	async migrateLegacyState(params) {
+		const remove = params.context.deletePluginStateEntriesIfUnchanged;
+		if (!remove) return {
+			changes: [],
+			warnings: ["Codex session binding repair requires locked SQLite maintenance ownership"]
+		};
+		let deleted = 0;
+		let changed = 0;
+		for await (const rows of iterateOrphanBindingPages(params)) {
+			const result = remove(CODEX_APP_SERVER_BINDING_NAMESPACE, rows);
+			deleted += result.deleted;
+			changed += result.changed;
+		}
+		return {
+			changes: deleted > 0 ? [`Removed ${deleted} orphaned Codex app-server session binding(s)`] : [],
+			warnings: changed > 0 ? [`Preserved ${changed} Codex app-server session binding(s) changed during repair`] : []
+		};
+	}
+};
+//#endregion
 //#region extensions/codex/src/migration/session-binding-sidecars.ts
 const LEGACY_BINDING_SUFFIX = ".codex-app-server.json";
 const CODEX_AGENT_HARNESS_ID = "codex";
@@ -43,7 +142,7 @@ async function collectSessionSurfaces(params) {
 	const agentsDir = path.join(params.stateDir, "agents");
 	for (const entry of await readDirectoryEntries(agentsDir)) {
 		if (!entry.isDirectory() || entry.isSymbolicLink()) continue;
-		const agentId = resolveSessionAgentIds({
+		const agentId = resolveSessionAgentIdsStrict({
 			agentId: entry.name,
 			config: params.config
 		}).sessionAgentId;
@@ -245,7 +344,7 @@ async function resolveLegacySessionFileLocator(sessionsDir, entry, sessionId) {
 	return candidate;
 }
 function tryResolveLegacyBindingOwnerAgentId(params) {
-	if (params.sessionKey.trim().toLowerCase().startsWith("agent:")) return resolveSessionAgentIds({
+	if (params.sessionKey.trim().toLowerCase().startsWith("agent:")) return resolveSessionAgentIdsStrict({
 		sessionKey: params.sessionKey,
 		config: params.config
 	}).sessionAgentId;
@@ -254,7 +353,7 @@ function tryResolveLegacyBindingOwnerAgentId(params) {
 	const systemAgentId = !storeAgentId && configuredAgentId ? normalizeAgentId(configuredAgentId) : void 0;
 	const fallbackAgentIds = systemAgentId && listAgentIds(params.config).includes(systemAgentId) ? [void 0, systemAgentId] : [void 0];
 	for (const fallbackAgentId of fallbackAgentIds) try {
-		return resolveSessionAgentIds({
+		return resolveSessionAgentIdsStrict({
 			sessionKey: params.sessionKey,
 			config: params.config,
 			...storeAgentId ? { agentId: storeAgentId } : fallbackAgentId ? { fallbackAgentId } : {}
@@ -293,7 +392,7 @@ async function migrateSource(source, candidates, params, store) {
 		return await withFileLock(source.sidecarPath, LEGACY_BINDING_LOCK_OPTIONS, async () => {
 			const [contents, stat] = await Promise.all([fs.readFile(source.sidecarPath, "utf8"), fs.stat(source.sidecarPath)]);
 			const raw = JSON.parse(contents);
-			const [{ bindingStoreKey, createStoredCodexAppServerBinding, normalizeStoredCodexAppServerBindingFingerprints, readStoredCodexAppServerBinding }, { legacyCodexConversationBindingId }] = await Promise.all([import("./session-binding-BTrLf9Qm.js").then((n) => n.f), import("./conversation-binding-data-CW2GuupV.js").then((n) => n.t)]);
+			const [{ bindingStoreKey, createStoredCodexAppServerBinding, normalizeStoredCodexAppServerBindingFingerprints, readStoredCodexAppServerBinding }, { legacyCodexConversationBindingId }] = await Promise.all([import("./session-binding-q2WSTVmC.js").then((n) => n.f), import("./conversation-binding-data-CW2GuupV.js").then((n) => n.t)]);
 			const agentId = owner?.agentId ?? (source.agentIds.size === 1 ? [...source.agentIds][0] : void 0);
 			const baseStored = createStoredCodexAppServerBinding(raw, {
 				now: stat.mtime.toISOString(),
@@ -478,7 +577,7 @@ function isSafeLegacySessionId(value) {
 	const trimmed = value.trim();
 	return trimmed.length > 0 && trimmed.length <= 255 && /^[A-Za-z0-9][A-Za-z0-9._:@-]*$/.test(trimmed);
 }
-const stateMigrations = [{
+const stateMigrations$1 = [{
 	id: "codex-app-server-sidecars-to-plugin-state",
 	label: "Codex app-server thread bindings",
 	async detectLegacyState(params) {
@@ -537,8 +636,9 @@ function hasLegacyPluginDestructivePolicy(value) {
 	const plugins = asNullableRecord(codexPlugins.plugins);
 	return Object.values(plugins ?? {}).some((plugin) => asNullableRecord(plugin)?.allow_destructive_actions === "on-request");
 }
-function hasRetiredOnFailureApprovalPolicy(value) {
-	return asNullableRecord(value)?.approvalPolicy === "on-failure";
+function hasRetiredApprovalPolicy(value) {
+	const approvalPolicy = asNullableRecord(value)?.approvalPolicy;
+	return approvalPolicy === "on-failure" || approvalPolicy === "untrusted";
 }
 /** Legacy Codex config keys that doctor should report or repair. */
 const legacyConfigRules = [
@@ -571,8 +671,8 @@ const legacyConfigRules = [
 			"config",
 			"appServer"
 		],
-		message: "plugins.entries.codex.config.appServer.approvalPolicy=\"on-failure\" was retired by Codex 0.143; use \"on-request\". Run \"openclaw doctor --fix\".",
-		match: hasRetiredOnFailureApprovalPolicy
+		message: "plugins.entries.codex.config.appServer.approvalPolicy values \"on-failure\" and \"untrusted\" are retired; use \"on-request\". Run \"openclaw doctor --fix\".",
+		match: hasRetiredApprovalPolicy
 	}
 ];
 /**
@@ -584,7 +684,7 @@ function normalizeCompatibilityConfig({ cfg }) {
 	const rawAppServer = asNullableRecord(rawPluginConfig?.appServer);
 	const shouldRemoveDynamicToolsProfile = rawPluginConfig !== null && hasRetiredDynamicToolsProfile(rawPluginConfig);
 	const shouldRewriteDestructivePolicy = hasLegacyPluginDestructivePolicy(rawCodexPlugins);
-	const shouldRewriteApprovalPolicy = hasRetiredOnFailureApprovalPolicy(rawAppServer);
+	const shouldRewriteApprovalPolicy = hasRetiredApprovalPolicy(rawAppServer);
 	if (!rawPluginConfig || !shouldRemoveDynamicToolsProfile && !shouldRewriteDestructivePolicy && !shouldRewriteApprovalPolicy) return {
 		config: cfg,
 		changes: []
@@ -612,13 +712,14 @@ function normalizeCompatibilityConfig({ cfg }) {
 	}
 	if (shouldRewriteApprovalPolicy) {
 		const nextAppServer = asNullableRecord(nextPluginConfig.appServer);
-		if (nextAppServer?.approvalPolicy === "on-failure") nextAppServer.approvalPolicy = "on-request";
-		changes.push("Renamed plugins.entries.codex.config.appServer.approvalPolicy=\"on-failure\" to \"on-request\".");
+		if (nextAppServer?.approvalPolicy === "on-failure" || nextAppServer?.approvalPolicy === "untrusted") nextAppServer.approvalPolicy = "on-request";
+		changes.push("Renamed retired plugins.entries.codex.config.appServer.approvalPolicy to \"on-request\".");
 	}
 	return {
 		config: nextConfig,
 		changes
 	};
 }
+const stateMigrations = [...stateMigrations$1, codexOrphanedSessionBindingMigration];
 //#endregion
 export { legacyConfigRules, normalizeCompatibilityConfig, stateMigrations };