@openclaw/codex 2026.8.1-beta.3 → 2026.8.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (69) hide show
  1. package/dist/api.js +5 -6
  2. package/dist/{attempt-client-cleanup-URjUlCHg.js → attempt-client-cleanup-CpVfwctT.js} +47 -5
  3. package/dist/{auth-binding-B4FfbcCg.js → auth-binding-Ds_QVm-X.js} +18 -3
  4. package/dist/{binding-connection-DAvZwp96.js → binding-connection-CF7BmrDk.js} +2 -2
  5. package/dist/{bounded-turn-4BjrZEwW.js → bounded-turn-DRC3hcjm.js} +16 -20
  6. package/dist/{capabilities-CH3K57v4.js → capabilities-D6m_TdVy.js} +1 -1
  7. package/dist/cli-metadata.js +1 -1
  8. package/dist/{command-formatters-D0nZ3qtd.js → command-formatters--UToCokS.js} +4 -3
  9. package/dist/{command-handlers-DC86lgT4.js → command-handlers-CLFx2Ypa.js} +114 -79
  10. package/dist/{compact-COqgBRny.js → compact-5xqW1oCh.js} +13 -12
  11. package/dist/{config-CpNeo5AE.js → config-CcYL77O6.js} +350 -288
  12. package/dist/{conversation-binding-data-CW2GuupV.js → conversation-binding-data-BiodpIzq.js} +2 -1
  13. package/dist/doctor-contract-api.js +121 -16
  14. package/dist/{dynamic-tools-fJZhl4CE.js → dynamic-tools-BmeXjwNZ.js} +243 -1002
  15. package/dist/{effective-mcp-catalog-4YKn51aG.js → effective-mcp-catalog-XXQKgK1U.js} +2 -2
  16. package/dist/{event-projector-assistant-message-BwxV4d6N.js → event-projector-assistant-message-C5-Ds8mA.js} +18 -1
  17. package/dist/{event-projector-usage-CLwNEJqW.js → event-projector-usage-B2r5vhWH.js} +9 -14
  18. package/dist/{harness-DoKQcF8n.js → harness-BgeB7LnD.js} +42 -52
  19. package/dist/harness.js +1 -1
  20. package/dist/index.js +308 -306
  21. package/dist/{isolated-completion-DPMtlH9r.js → isolated-completion-CxTus3vZ.js} +4 -4
  22. package/dist/launch-args-sXOAg0SX.js +84 -0
  23. package/dist/{managed-binary-By4FZC6i.js → managed-binary-ZkGodW19.js} +43 -7
  24. package/dist/media-understanding-provider.js +1 -1
  25. package/dist/model-catalog-DULBcniB.js +101 -0
  26. package/dist/{models-CZw1wClT.js → models-DaWfETQk.js} +27 -29
  27. package/dist/{native-subagent-monitor-GGq3RnOo.js → native-subagent-monitor-vXYUZH37.js} +226 -129
  28. package/dist/{node-exec-server.runtime-Bsu1LdFZ.js → node-exec-server.runtime-DirKVZ5h.js} +9 -6
  29. package/dist/{plugin-approval-roundtrip-C75Yiiwc.js → plugin-approval-roundtrip-CCWQGlAI.js} +2 -1
  30. package/dist/{plugin-marketplace-discovery-CSWDkMrP.js → plugin-marketplace-discovery-BXjIFEiw.js} +38 -46
  31. package/dist/{plugin-metadata-cache-BXH5NF-4.js → plugin-metadata-cache-DQQm4gWT.js} +163 -136
  32. package/dist/{protocol-validators-VAVyEnDp.js → protocol-validators-Bg5rpNxk.js} +148 -5
  33. package/dist/{rate-limits-BI1dMHDG.js → rate-limits-BqHEHXQJ.js} +3 -2
  34. package/dist/{sandbox-guard-C1qEeZ5C.js → request-BWxweEdK.js} +183 -2
  35. package/dist/{run-attempt-BV3HzuCf.js → run-attempt-BVLE4Gbi.js} +706 -517
  36. package/dist/{runtime-artifact-BvyT1uyd.js → runtime-artifact-D9pYp4zL.js} +3 -3
  37. package/dist/{session-binding-BTrLf9Qm.js → session-binding-D0zinCP1.js} +195 -122
  38. package/dist/{session-catalog-ezP_UcRM.js → session-catalog-eMhVm0Ql.js} +448 -313
  39. package/dist/session-catalog-home-id-Dt2GiG5o.js +112 -0
  40. package/dist/{session-cli-B1hKvfkI.js → session-cli-B2lyjJA0.js} +1 -1
  41. package/dist/session-history-C5J1AKzG.js +87 -0
  42. package/dist/session-permission-policy-ScnAyG90.js +160 -0
  43. package/dist/session-retirement-CtUtUTr9.js +90 -0
  44. package/dist/{session-upstream-marker-D_2npHlA.js → session-upstream-marker-gqrYIRHk.js} +2 -3
  45. package/dist/settled-turn-context-Bk3IUwod.js +290 -0
  46. package/dist/settled-turn-finalizer-BXLN9PfJ.js +104 -0
  47. package/dist/{shared-client-Dw-rzii0.js → shared-client-B1tT5U6r.js} +1738 -806
  48. package/dist/{side-question-DbXkJZzg.js → side-question-CZ-mCw-t.js} +76 -43
  49. package/dist/{thread-lifecycle-DKdrnTMX.js → thread-lifecycle-CGGKP720.js} +991 -455
  50. package/dist/{thread-ownership-i2NBwDUL.js → thread-ownership-RkaoZCmQ.js} +18 -8
  51. package/dist/{plugin-app-cache-key-DMNQ8Zi8.js → thread-resume-BFt1-ZDa.js} +55 -8
  52. package/dist/{transcript-mirror-BU0_LKAL.js → transcript-mirror-1ep4XjzF.js} +124 -18
  53. package/dist/transport-stdio-NT_Dpd9V.js +724 -0
  54. package/dist/{upstream-prompt-provenance-CFmsKwr9.js → upstream-prompt-provenance-LphB8slG.js} +8 -4
  55. package/dist/{upstream-session-fork-BDVJCLAD.js → upstream-session-fork-Dc8BFExw.js} +76 -90
  56. package/dist/{usage-9dKJCgcy.js → usage-DUhd58gI.js} +3 -3
  57. package/dist/{web-search-provider.runtime-DCdx4DGu.js → web-search-provider.runtime-BEmlE7ov.js} +3 -3
  58. package/openclaw.plugin.json +19 -1
  59. package/package.json +8 -8
  60. package/dist/app-server-policy-bg5QPSVP.js +0 -25
  61. package/dist/command-rpc-xUIIonsO.js +0 -90
  62. package/dist/incognito-session-ET_ufDH-.js +0 -2
  63. package/dist/model-catalog-CmGoqVKB.js +0 -48
  64. package/dist/request-DSK0W6YI.js +0 -157
  65. package/dist/session-catalog-home-id-BNwAJ9D7.js +0 -18
  66. package/dist/session-retirement-CE4iMiLh.js +0 -36
  67. package/dist/settled-turn-finalizer-Dx1onIqg.js +0 -328
  68. package/dist/thread-resume-CdJk2Ehf.js +0 -30
  69. package/dist/transport-stdio-DhoGy33Z.js +0 -99
package/dist/api.js CHANGED
@@ -1,16 +1,15 @@
1
- import { a as resolveCodexAppServerStartOptionsForAgent, i as resolveCodexAppServerRuntimeOptions } from "./config-CpNeo5AE.js";
2
- import { a as CODEX_APP_SERVER_VERSION, n as resolveManagedCodexAppServerStartOptions, r as resolveManagedCodexNativeCommand, t as isManagedCodexDesktopCommand } from "./managed-binary-By4FZC6i.js";
1
+ import { a as resolveCodexAppServerStartOptionsForAgent, i as resolveCodexAppServerRuntimeOptions } from "./config-CcYL77O6.js";
2
+ import { a as CODEX_APP_SERVER_VERSION, n as resolveManagedCodexAppServerStartOptions, r as resolveManagedCodexNativeCommand, t as isManagedCodexDesktopCommand } from "./managed-binary-ZkGodW19.js";
3
3
  import path from "node:path";
4
4
  import { resolveDefaultModelForAgent } from "openclaw/plugin-sdk/agent-runtime";
5
5
  import { listAgentIds as listAgentIds$1, resolveAgentDir as resolveAgentDir$1 } from "openclaw/plugin-sdk/agent-scope-runtime";
6
6
  import { execFile } from "node:child_process";
7
7
  import { fileURLToPath } from "node:url";
8
8
  import { resolveEffectiveAgentRuntime } from "openclaw/plugin-sdk/command-auth-native";
9
- import { getHealthCheck } from "openclaw/plugin-sdk/health";
10
9
  //#region extensions/codex/src/doctor.ts
11
10
  const CODEX_MANAGED_APP_SERVER_CHECK_ID = "codex/managed-app-server";
12
11
  const CODEX_VERSION_TIMEOUT_MS = 5e3;
13
- const CODEX_VERSION_MAX_BUFFER_BYTES = 64 * 1024;
12
+ const CODEX_VERSION_MAX_BUFFER_BYTES = 65536;
14
13
  function managedCodexFinding(params) {
15
14
  return {
16
15
  checkId: CODEX_MANAGED_APP_SERVER_CHECK_ID,
@@ -117,7 +116,7 @@ function createCodexManagedAppServerHealthCheck(params) {
117
116
  })];
118
117
  }
119
118
  const detectedVersion = parseCodexVersion(`${output.stdout}\n${output.stderr}`);
120
- if (detectedVersion !== "0.149.1") return [managedCodexFinding({
119
+ if (detectedVersion !== "0.151.0") return [managedCodexFinding({
121
120
  message: detectedVersion ? `Managed Codex app-server version mismatch: expected ${CODEX_APP_SERVER_VERSION}, detected ${detectedVersion}.` : `Managed Codex app-server did not report a parseable version; expected ${CODEX_APP_SERVER_VERSION}.`,
122
121
  path: nativeCommand,
123
122
  requirement: `the exact OpenClaw-pinned Codex version ${CODEX_APP_SERVER_VERSION}`,
@@ -128,7 +127,7 @@ function createCodexManagedAppServerHealthCheck(params) {
128
127
  };
129
128
  }
130
129
  function registerCodexManagedAppServerDoctorChecks$1(host, deps) {
131
- if (getHealthCheck("codex/managed-app-server")) return;
130
+ if (host.getHealthCheck("codex/managed-app-server")) return;
132
131
  host.registerHealthCheck(createCodexManagedAppServerHealthCheck({
133
132
  pluginRoot: host.pluginRoot,
134
133
  deps
@@ -1,4 +1,4 @@
1
- import { B as CodexAppServerRpcError, X as unsubscribeCodexAppServerLiveThread, p as retireSharedCodexAppServerClientIfCurrent, ut as isJsonObject } from "./shared-client-Dw-rzii0.js";
1
+ import { $ as CodexAppServerRpcError, Ht as isJsonObject, wt as unsubscribeCodexAppServerLiveThread, y as retireSharedCodexAppServerClientIfCurrent } from "./shared-client-B1tT5U6r.js";
2
2
  import { asFiniteNumber, normalizeOptionalString, normalizeOptionalString as normalizeOptionalString$1, readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
3
3
  import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
4
4
  import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
@@ -259,6 +259,7 @@ var CodexProjectionDiagnostics = class {
259
259
  //#region extensions/codex/src/app-server/turn-router.ts
260
260
  /** Keyed routing for all turn traffic on one shared Codex app-server client. */
261
261
  const DEFAULT_PREBIND_NOTIFICATION_LIMIT = 256;
262
+ const DEFAULT_GLOBAL_WARNING_LIMIT = 32;
262
263
  const CODEX_APP_SERVER_NATIVE_TURN_WAIT_TIMEOUT_MS = 3e4;
263
264
  const routers = /* @__PURE__ */ new WeakMap();
264
265
  /** Returns the sole router installed on a physical app-server client. */
@@ -272,6 +273,7 @@ function getCodexAppServerTurnRouter(client) {
272
273
  var ClientTurnRouter = class {
273
274
  constructor(client) {
274
275
  this.routes = /* @__PURE__ */ new Map();
276
+ this.globalWarnings = [];
275
277
  this.nativeTurnCompletionWatchers = /* @__PURE__ */ new Map();
276
278
  this.disposed = false;
277
279
  client.addNotificationHandler((notification) => this.routeNotification(notification));
@@ -290,7 +292,11 @@ var ClientTurnRouter = class {
290
292
  ended: createDeferred(),
291
293
  activated: createDeferred(),
292
294
  gate: "open",
293
- pending: [],
295
+ pending: this.globalWarnings.map((notification) => ({
296
+ notification,
297
+ receivedAtMs: Date.now(),
298
+ scope: { threadId }
299
+ })),
294
300
  notificationTail: Promise.resolve(),
295
301
  completedNativeTurnIds: /* @__PURE__ */ new Set(),
296
302
  ignoredTurnNotificationKeys: /* @__PURE__ */ new Set()
@@ -412,6 +418,15 @@ var ClientTurnRouter = class {
412
418
  routeNotification(notification) {
413
419
  if (this.disposed) return;
414
420
  const scope = readScope(notification.params);
421
+ if (!scope.threadId && (notification.method === "configWarning" || notification.method === "warning")) {
422
+ if (this.globalWarnings.length === DEFAULT_GLOBAL_WARNING_LIMIT) this.globalWarnings.shift();
423
+ this.globalWarnings.push(notification);
424
+ for (const route of this.routes.values()) {
425
+ this.bufferNotification(route, notification, { threadId: route.threadId }, Date.now());
426
+ if (route.gate === "bound") this.flushNotifications(route);
427
+ }
428
+ return Promise.all([...this.routes.values()].map((route) => route.notificationTail)).then(() => void 0);
429
+ }
415
430
  const watchers = scope.threadId ? this.nativeTurnCompletionWatchers.get(scope.threadId) : void 0;
416
431
  const route = scope.threadId ? this.routes.get(scope.threadId) : void 0;
417
432
  if (!watchers && !route) return;
@@ -489,6 +504,10 @@ var ClientTurnRouter = class {
489
504
  const handler = route.handlers?.onNotification;
490
505
  if (!handler) return;
491
506
  for (const pending of route.pending.splice(0)) {
507
+ if (route.gate !== "bound" && (pending.notification.method === "configWarning" || pending.notification.method === "warning" && !readScope(pending.notification.params).threadId)) {
508
+ route.pending.push(pending);
509
+ continue;
510
+ }
492
511
  if (route.gate === "bound" && pending.scope.turnId && pending.scope.turnId !== route.turnId) {
493
512
  this.warnDroppedStaleTurnNotification(route, pending.notification, pending.scope);
494
513
  continue;
@@ -541,7 +560,7 @@ var ClientTurnRouter = class {
541
560
  await Promise.race([route.notificationTail, route.ended.promise]);
542
561
  }
543
562
  async drainNotifications(route) {
544
- await route.notificationTail;
563
+ await Promise.race([route.notificationTail, route.ended.promise]);
545
564
  }
546
565
  release(route, error = /* @__PURE__ */ new Error("codex app-server thread route is released")) {
547
566
  if (route.released) return;
@@ -677,12 +696,35 @@ async function interruptCodexTurnAndWaitBestEffort(client, params) {
677
696
  completion?.cancel();
678
697
  }
679
698
  }
699
+ /** Stops native terminals on the cancelled thread without retiring peer threads. */
700
+ async function terminateCodexBackgroundTerminals(client, threadId) {
701
+ const options = {
702
+ timeoutMs: CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS,
703
+ signal: AbortSignal.timeout(CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS)
704
+ };
705
+ try {
706
+ const { data } = await client.request("thread/backgroundTerminals/list", { threadId }, options);
707
+ for (const { processId } of data) await client.request("thread/backgroundTerminals/terminate", {
708
+ threadId,
709
+ processId
710
+ }, options);
711
+ if (data.length > 0) {
712
+ if ((await client.request("thread/backgroundTerminals/list", {
713
+ threadId,
714
+ limit: 1
715
+ }, options)).data.length > 0) throw new Error("native background terminals remain running");
716
+ }
717
+ } catch (cause) {
718
+ throw new Error("Codex background-terminal cleanup failed; inspect the thread's running terminals before starting more work.", { cause });
719
+ }
720
+ }
680
721
  /** Unsubscribes from a thread while swallowing cleanup-only failures. */
681
722
  async function unsubscribeCodexThreadBestEffort(client, params) {
682
723
  try {
683
- await unsubscribeCodexAppServerLiveThread(client, params.threadId, params.timeoutMs);
724
+ await unsubscribeCodexAppServerLiveThread(client, params.threadId, params.timeoutMs, params.assertCurrent);
684
725
  return true;
685
726
  } catch (error) {
727
+ params.assertCurrent?.();
686
728
  embeddedAgentLog.debug("codex app-server thread unsubscribe cleanup failed", {
687
729
  threadId: params.threadId,
688
730
  error
@@ -732,4 +774,4 @@ async function retireCodexAppServerClientAfterTimedOutTurn(client, params) {
732
774
  });
733
775
  }
734
776
  //#endregion
735
- export { shouldSynthesizeToolProgressForItem as A, readNullableString as B, isSideEffectingNativeToolItem as C, itemTitle as D, itemStatus as E, readItem as F, readItemString as I, readNonEmptyString as L, normalizeOptionalString$1 as M, readCodexErrorNotificationMessage as N, shouldClearTerminalPresentationForNativeItem as O, readHookOutputEntries as P, readNonEmptyStringArray as R, isNonSuccessItemStatus as S, itemName as T, splitPlanText as V, readCodexNotificationTurnId as _, closeCodexStartupClientBestEffort as a, auditNativeToolUnfinishedStatus as b, isCodexAppServerUnsafeSubscriptionError as c, unsubscribeCodexThreadBestEffort as d, CODEX_APP_SERVER_NATIVE_TURN_WAIT_TIMEOUT_MS as f, readCodexNotificationThreadId as g, isCodexNotificationForTurn as h, assertCodexThreadResumeSubscription as i, extractRawAssistantText as j, shouldRecordNativeToolTranscript as k, retireCodexAppServerClientAfterTimedOutTurn as l, CodexProjectionDiagnostics as m, CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS as n, interruptCodexTurnAndWaitBestEffort as o, getCodexAppServerTurnRouter as p, CodexAppServerUnsafeSubscriptionError as r, isCodexAlreadyTerminalInterruptError as s, CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS as t, retireUnsafeCodexTurnClientBestEffort as u, auditNativeToolName as v, itemKind as w, isMutatingNativeToolItem as x, auditNativeToolTerminalStatus as y, readNonNegativeInteger as z };
777
+ export { shouldRecordNativeToolTranscript as A, readNonNegativeInteger as B, isNonSuccessItemStatus as C, itemStatus as D, itemName as E, readHookOutputEntries as F, splitPlanText as H, readItem as I, readItemString as L, extractRawAssistantText as M, normalizeOptionalString$1 as N, itemTitle as O, readCodexErrorNotificationMessage as P, readNonEmptyString as R, isMutatingNativeToolItem as S, itemKind as T, readNullableString as V, readCodexNotificationThreadId as _, closeCodexStartupClientBestEffort as a, auditNativeToolTerminalStatus as b, isCodexAppServerUnsafeSubscriptionError as c, terminateCodexBackgroundTerminals as d, unsubscribeCodexThreadBestEffort as f, isCodexNotificationForTurn as g, CodexProjectionDiagnostics as h, assertCodexThreadResumeSubscription as i, shouldSynthesizeToolProgressForItem as j, shouldClearTerminalPresentationForNativeItem as k, retireCodexAppServerClientAfterTimedOutTurn as l, getCodexAppServerTurnRouter as m, CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS as n, interruptCodexTurnAndWaitBestEffort as o, CODEX_APP_SERVER_NATIVE_TURN_WAIT_TIMEOUT_MS as p, CodexAppServerUnsafeSubscriptionError as r, isCodexAlreadyTerminalInterruptError as s, CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS as t, retireUnsafeCodexTurnClientBestEffort as u, readCodexNotificationTurnId as v, isSideEffectingNativeToolItem as w, auditNativeToolUnfinishedStatus as x, auditNativeToolName as y, readNonEmptyStringArray as z };
@@ -1,6 +1,7 @@
1
1
  import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
2
2
  import { fingerprintResolvedAuthProfileCredential } from "openclaw/plugin-sdk/agent-harness-runtime";
3
3
  import { resolveApiKeyForProfile } from "openclaw/plugin-sdk/agent-runtime";
4
+ import { resolveOpenAICodexAuthIdentity } from "openclaw/plugin-sdk/provider-auth";
4
5
  //#region extensions/codex/src/app-server/auth-binding.ts
5
6
  var auth_binding_exports = /* @__PURE__ */ __exportAll({
6
7
  fingerprintCodexAppServerAuthBinding: () => fingerprintCodexAppServerAuthBinding,
@@ -26,14 +27,28 @@ function withMaterializedCredential(params) {
26
27
  /** Resolves one forwarded profile once so attestation and execution share exact material. */
27
28
  async function prepareCodexAppServerAuthBinding(params) {
28
29
  const credential = params.authProfileStore.profiles[params.authProfileId];
29
- if (!credential || credential.type === "oauth") return;
30
+ if (!credential) return;
31
+ if (credential.type === "oauth") {
32
+ const fingerprint = fingerprintResolvedAuthProfileCredential({
33
+ profileId: params.authProfileId,
34
+ credential: {
35
+ ...credential,
36
+ accountId: resolveOpenAICodexAuthIdentity(credential).accountId
37
+ },
38
+ resolvedAuth: void 0
39
+ });
40
+ return fingerprint ? {
41
+ fingerprint,
42
+ authProfileStore: structuredClone(params.authProfileStore)
43
+ } : void 0;
44
+ }
30
45
  const resolved = await resolveApiKeyForProfile({
31
46
  cfg: params.config,
32
47
  store: params.authProfileStore,
33
48
  profileId: params.authProfileId,
34
49
  agentDir: params.agentDir
35
50
  });
36
- if (!resolved?.apiKey) throw new Error(`Codex could not resolve auth profile "${params.authProfileId}".`);
51
+ if (!resolved?.apiKey) throw new Error(`Codex could not resolve auth profile "${params.authProfileId}". Repair or replace its credential or SecretRef, then retry.`);
37
52
  const fingerprint = fingerprintResolvedAuthProfileCredential({
38
53
  profileId: params.authProfileId,
39
54
  credential,
@@ -44,7 +59,7 @@ async function prepareCodexAppServerAuthBinding(params) {
44
59
  mode: credential.type === "api_key" ? "api-key" : "token"
45
60
  }
46
61
  });
47
- if (!fingerprint) throw new Error(`Codex could not attest auth profile "${params.authProfileId}".`);
62
+ if (!fingerprint) throw new Error(`Codex could not attest auth profile "${params.authProfileId}". Re-select the OpenAI profile and retry.`);
48
63
  return {
49
64
  fingerprint,
50
65
  authProfileStore: withMaterializedCredential({
@@ -1,5 +1,5 @@
1
- import { h as readCodexPluginConfig, i as resolveCodexAppServerRuntimeOptions, s as resolveCodexSupervisionAppServerRuntimeOptions } from "./config-CpNeo5AE.js";
2
- import { a as resolveCodexCatalogConnectionHome, t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-DMNQ8Zi8.js";
1
+ import { T as readCodexPluginConfig, i as resolveCodexAppServerRuntimeOptions, s as resolveCodexSupervisionAppServerRuntimeOptions } from "./config-CcYL77O6.js";
2
+ import { n as buildCodexAppServerConnectionFingerprint, o as resolveCodexCatalogConnectionHome } from "./thread-resume-BFt1-ZDa.js";
3
3
  //#region extensions/codex/src/app-server/binding-connection.ts
4
4
  /** Requires the native model pair after a supervised pending branch has materialized. */
5
5
  function requireCodexSupervisionModelSelection(binding) {
@@ -1,10 +1,11 @@
1
- import { i as resolveCodexAppServerRuntimeOptions } from "./config-CpNeo5AE.js";
2
- import { V as createCodexElicitationResponse, s as isCodexAppServerStartSelectionChangedError, ut as isJsonObject } from "./shared-client-Dw-rzii0.js";
3
- import { _ as readCodexNotificationTurnId, a as closeCodexStartupClientBestEffort, o as interruptCodexTurnAndWaitBestEffort, t as CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS } from "./attempt-client-cleanup-URjUlCHg.js";
4
- import { b as isTerminalTurnStatus, n as normalizeCodexResponseTokenUsage, x as readCodexNotificationItem, y as isRetryableErrorNotification } from "./event-projector-usage-CLwNEJqW.js";
5
- import { a as assertCodexThreadStartResponse, c as readCodexErrorNotification, o as assertCodexTurnStartResponse, u as readCodexTurnCompletedNotification } from "./protocol-validators-VAVyEnDp.js";
6
- import { r as readModelListResult } from "./models-CZw1wClT.js";
7
- import { Z as mergeCodexThreadConfigs, c as buildCodexRingZeroThreadConfigPatch, l as buildCodexRuntimeThreadConfig, o as assertCodexManagedRequirementsDoNotOverrideToolPolicy, s as attestCodexRestrictedToolSurfaceMcpServersDisabled, u as readCodexInheritedMcpServerNames } from "./thread-lifecycle-DKdrnTMX.js";
1
+ import { n as readCodexAppServerConfigOptions } from "./launch-args-sXOAg0SX.js";
2
+ import { i as resolveCodexAppServerRuntimeOptions } from "./config-CcYL77O6.js";
3
+ import { Ht as isJsonObject, et as createCodexElicitationResponse, u as isCodexAppServerStartSelectionChangedError } from "./shared-client-B1tT5U6r.js";
4
+ import { c as assertCodexTurnStartResponse, f as readCodexTurnCompletedNotification, s as assertCodexThreadStartResponse, u as readCodexErrorNotification } from "./protocol-validators-Bg5rpNxk.js";
5
+ import { a as closeCodexStartupClientBestEffort, o as interruptCodexTurnAndWaitBestEffort, t as CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS, v as readCodexNotificationTurnId } from "./attempt-client-cleanup-CpVfwctT.js";
6
+ import { b as isTerminalTurnStatus, n as normalizeCodexResponseTokenUsage, x as readCodexNotificationItem, y as isRetryableErrorNotification } from "./event-projector-usage-B2r5vhWH.js";
7
+ import { r as readModelListResult } from "./models-DaWfETQk.js";
8
+ import { _ as buildCodexRingZeroThreadConfigPatch, g as attestCodexRestrictedToolSurfaceMcpServersDisabled, h as assertCodexManagedRequirementsDoNotOverrideToolPolicy, ot as mergeCodexThreadConfigs, v as buildCodexRuntimeThreadConfig, y as readCodexInheritedMcpServerNames } from "./thread-lifecycle-CGGKP720.js";
8
9
  import { readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
9
10
  import fs from "node:fs/promises";
10
11
  import path from "node:path";
@@ -65,11 +66,7 @@ async function runBoundedCodexAppServerTurnInWorkspace(params, appServer, worksp
65
66
  const timeoutMs = deadline - Date.now();
66
67
  if (timeoutMs <= 0) throw timeoutError;
67
68
  const agentDir = params.agentDir?.trim() || void 0;
68
- const isolatedStartOptions = workspace.codexHome ? buildPrivateCodexAppServerStartOptions(appServer.start, workspace.codexHome) : appServer.start;
69
- const startOptions = workspace.codexHome && params.preparedAuth ? {
70
- ...isolatedStartOptions,
71
- homeScope: "agent"
72
- } : isolatedStartOptions;
69
+ const startOptions = workspace.codexHome ? buildPrivateCodexAppServerStartOptions(appServer.start, workspace.codexHome) : appServer.start;
73
70
  const ownsClient = !params.options.clientFactory;
74
71
  const authSelection = params.preparedAuth ? { preparedAuth: params.preparedAuth } : { authProfileId: params.profile };
75
72
  const client = params.options.clientFactory ? await params.options.clientFactory({
@@ -80,7 +77,7 @@ async function runBoundedCodexAppServerTurnInWorkspace(params, appServer, worksp
80
77
  config: params.config,
81
78
  timeoutMs,
82
79
  ...params.signal ? { abandonSignal: params.signal } : {}
83
- }) : await import("./shared-client-Dw-rzii0.js").then((n) => n.m).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
80
+ }) : await import("./shared-client-B1tT5U6r.js").then((n) => n.x).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
84
81
  startOptions,
85
82
  timeoutMs,
86
83
  ...authSelection,
@@ -204,10 +201,7 @@ function resolveBoundedThreadConfig(params, workspace, inheritedMcpServerNames)
204
201
  return mergeCodexThreadConfigs(privateConfig, CODEX_SETTLED_FINALIZER_THREAD_CONFIG, buildCodexRingZeroThreadConfigPatch({ toolsAllow: ["openclaw"] }, true, inheritedMcpServerNames)) ?? privateConfig;
205
202
  }
206
203
  function buildPrivateCodexAppServerStartOptions(start, codexHome) {
207
- const providerArgs = start.args.flatMap((arg, index) => {
208
- const override = arg === "-c" || arg === "--config" ? start.args[index + 1] : arg.startsWith("--config=") ? arg.slice(9) : void 0;
209
- return override && /^\s*(?:openai_base_url|model_catalog_json)\s*=/u.test(override) ? ["-c", override] : [];
210
- });
204
+ const providerArgs = readCodexAppServerConfigOptions(start.args).flatMap(({ name, value }) => (name === "-c" || name === "--config") && value && /^\s*(?:openai_base_url|model_catalog_json)\s*=/u.test(value) ? ["-c", value] : []);
211
205
  const privateEnv = Object.fromEntries(Object.entries(start.env ?? {}).filter(([name]) => name.trim().toUpperCase() !== CODEX_APP_SERVER_ARGS_ENV_KEY));
212
206
  const clearEnv = (start.clearEnv ?? []).filter((name) => {
213
207
  const normalized = name.trim().toUpperCase();
@@ -215,6 +209,7 @@ function buildPrivateCodexAppServerStartOptions(start, codexHome) {
215
209
  });
216
210
  return {
217
211
  ...start,
212
+ homeScope: "agent",
218
213
  args: [
219
214
  "app-server",
220
215
  ...providerArgs,
@@ -246,14 +241,15 @@ function createCodexBoundedApprovalHandler(taskLabel) {
246
241
  };
247
242
  }
248
243
  async function resolveCodexBoundedTurnModel(params) {
249
- const listed = readModelListResult(await params.client.request("model/list", {
244
+ const result = await params.client.request("model/list", {
250
245
  limit: null,
251
246
  cursor: null,
252
- includeHidden: false
247
+ includeHidden: params.selection.mode === "required"
253
248
  }, {
254
249
  timeoutMs: Math.min(params.timeoutMs, 5e3),
255
250
  signal: params.signal
256
- })).models;
251
+ });
252
+ const listed = readModelListResult(result).models;
257
253
  if (params.selection.mode === "live-default") {
258
254
  const supported = listed.filter((entry) => params.requiredModalities.every((modality) => entry.inputModalities.includes(modality)));
259
255
  const selected = supported.find((entry) => entry.isDefault) ?? supported[0];
@@ -1,4 +1,4 @@
1
- import { B as CodexAppServerRpcError } from "./shared-client-Dw-rzii0.js";
1
+ import { $ as CodexAppServerRpcError } from "./shared-client-B1tT5U6r.js";
2
2
  //#region extensions/codex/src/app-server/capabilities.ts
3
3
  /**
4
4
  * Capability helpers for optional Codex app-server control-plane methods.
@@ -2,7 +2,7 @@ import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
2
2
  //#region extensions/codex/cli-metadata.ts
3
3
  function registerCodexCliMetadata(api) {
4
4
  api.registerCli(async ({ program }) => {
5
- const { registerCodexSessionCli } = await import("./session-cli-B1hKvfkI.js");
5
+ const { registerCodexSessionCli } = await import("./session-cli-B2lyjJA0.js");
6
6
  registerCodexSessionCli(program);
7
7
  }, { descriptors: [{
8
8
  name: "codex",
@@ -1,5 +1,5 @@
1
- import { ut as isJsonObject } from "./shared-client-Dw-rzii0.js";
2
- import { c as summarizeCodexRateLimits, o as summarizeCodexAccountRateLimits, r as hasCodexRateLimitSnapshots } from "./rate-limits-BI1dMHDG.js";
1
+ import { Ht as isJsonObject } from "./shared-client-B1tT5U6r.js";
2
+ import { c as summarizeCodexRateLimits, o as summarizeCodexAccountRateLimits, r as hasCodexRateLimitSnapshots } from "./rate-limits-BqHEHXQJ.js";
3
3
  import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
4
4
  //#region extensions/codex/src/command-formatters.ts
5
5
  /**
@@ -118,7 +118,8 @@ function formatSkills(response) {
118
118
  return lines.join("\n");
119
119
  }
120
120
  function formatCodexSkillEntry(entry) {
121
- return `\`${formatCodexDisplayText(normalizeOptionalString((isJsonObject(entry) ? entry : {}).name) ?? "<unknown>")}\``;
121
+ const record = isJsonObject(entry) ? entry : {};
122
+ return `\`${formatCodexDisplayText(normalizeOptionalString(record.name) ?? "<unknown>")}\``;
122
123
  }
123
124
  const CODEX_RESUME_SAFE_THREAD_ID_PATTERN = /^[A-Za-z0-9._:-]+$/;
124
125
  function formatCodexResumeHint(threadId) {