@openclaw/codex 2026.9.1 → 2026.9.3

package/dist/plan-BMJdMOEF.js

@@ -0,0 +1,711 @@
+import { m as CODEX_PLUGINS_MARKETPLACE_NAME } from "./config-utils-C57JiJrU.js";
+import "./config-JDfTI4VI.js";
+import { a as exists, c as sanitizeName, n as discoverCodexSource, o as readJsonObject, r as hasCodexSource, s as resolveHomePath, t as codexPluginMigrationSubscriptionWarning } from "./source-Da-h6f7e.js";
+import { asBoolean, isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
+import path from "node:path";
+import fs from "node:fs/promises";
+import { canonicalPathFromExistingAncestor, isPathInside } from "openclaw/plugin-sdk/file-access-runtime";
+import { loadAuthProfileStoreWithoutExternalProfiles, resolveAgentConfig, resolveAgentWorkspaceDir, resolveDefaultAgentId } from "openclaw/plugin-sdk/agent-runtime";
+import { extractErrorCode } from "openclaw/plugin-sdk/security-runtime";
+import { applyAuthProfileConfig, buildApiKeyCredential, buildOauthProviderAuthResult, buildOpenAICodexCredentialExtra, readCodexCliCredentialsCached, resolveOpenAICodexAuthIdentity, resolveOpenAICodexImportProfileName, updateAuthProfileStoreWithLock } from "openclaw/plugin-sdk/provider-auth";
+import { MIGRATION_REASON_TARGET_EXISTS, createMigrationItem, createMigrationManualItem, hasMigrationConfigPatchConflict, markMigrationItemConflict, markMigrationItemError, markMigrationItemSkipped, mergeMigrationConfigValue, readMigrationConfigPath, resolveMigrationConfigRuntime, summarizeMigrationItems } from "openclaw/plugin-sdk/migration";
+//#region extensions/codex/src/migration/auth.ts
+const OPENAI_PROVIDER_ID = "openai";
+const OPENAI_CODEX_DEFAULT_MODEL = "openai/gpt-5.6-sol";
+const CODEX_IMPORT_DISPLAY_NAME = "Codex import";
+const CODEX_REASON_AUTH_NOT_SELECTED = "auth credential migration not selected";
+const CODEX_REASON_AUTH_PROFILE_EXISTS = "auth profile exists";
+const CODEX_REASON_AUTH_PROFILE_WRITE_FAILED = "failed to write auth profile";
+const CODEX_REASON_AUTH_NO_LONGER_PRESENT = "auth credential no longer present";
+const CODEX_REASON_MISSING_AUTH_METADATA = "missing auth metadata";
+const CODEX_CONFIG_PATCH_MODE_RETURN = "return";
+var CodexAuthConfigConflict = class extends Error {};
+async function readModelRefs(source) {
+	const cache = await readJsonObject(source.modelsCachePath);
+	const models = Array.isArray(cache.models) ? cache.models : [];
+	const refs = /* @__PURE__ */ new Set();
+	for (const model of models) {
+		const slug = typeof model === "string" ? model.trim() : isRecord(model) ? normalizeOptionalString(model.slug) ?? normalizeOptionalString(model.id) ?? normalizeOptionalString(model.name) : void 0;
+		if (!slug) continue;
+		refs.add(`${OPENAI_PROVIDER_ID}/${slug}`);
+	}
+	refs.add(OPENAI_CODEX_DEFAULT_MODEL);
+	return [...refs].toSorted();
+}
+async function buildCodexOAuthCredential(source) {
+	const credential = readCodexCliCredentialsCached({
+		codexHome: source.codexHome,
+		allowKeychainPrompt: false,
+		ttlMs: 0
+	});
+	if (!credential) return null;
+	const identity = resolveOpenAICodexAuthIdentity({
+		access: credential.access,
+		accountId: credential.accountId
+	});
+	const modelRefs = await readModelRefs(source);
+	const configPatch = { agents: { defaults: { models: Object.fromEntries(modelRefs.map((modelRef) => [modelRef, {}])) } } };
+	const result = buildOauthProviderAuthResult({
+		providerId: OPENAI_PROVIDER_ID,
+		defaultModel: OPENAI_CODEX_DEFAULT_MODEL,
+		access: credential.access,
+		refresh: credential.refresh,
+		expires: credential.expires,
+		email: identity.email,
+		profileName: resolveOpenAICodexImportProfileName(identity, "codex-import"),
+		displayName: CODEX_IMPORT_DISPLAY_NAME,
+		credentialExtra: buildOpenAICodexCredentialExtra({
+			accountId: identity.accountId,
+			chatgptPlanType: identity.chatgptPlanType,
+			idToken: credential.idToken
+		}),
+		configPatch
+	});
+	const profile = result.profiles[0];
+	return profile ? {
+		kind: "oauth",
+		provider: OPENAI_PROVIDER_ID,
+		profileId: profile.profileId,
+		result
+	} : null;
+}
+async function buildCodexApiKeyCredential(source) {
+	const raw = await readJsonObject(source.authPath);
+	const key = normalizeOptionalString(raw.OPENAI_API_KEY);
+	if (!key) return null;
+	return {
+		kind: "api_key",
+		provider: OPENAI_PROVIDER_ID,
+		profileId: "openai:codex-import",
+		key
+	};
+}
+async function readCodexAuthCredentials(source) {
+	return [await buildCodexOAuthCredential(source), await buildCodexApiKeyCredential(source)].filter((entry) => entry !== null);
+}
+function findMatchingOAuthProfile(store, credential) {
+	for (const [profileId, existing] of Object.entries(store.profiles)) {
+		if (existing.type !== "oauth" || existing.provider !== credential.provider) continue;
+		if (credential.accountId && existing.accountId === credential.accountId) return profileId;
+		if ((!credential.accountId || !existing.accountId) && credential.email && existing.email === credential.email) return profileId;
+	}
+}
+function findMatchingApiKeyProfile(store, provider, key) {
+	for (const [profileId, existing] of Object.entries(store.profiles)) if (existing.type === "api_key" && existing.provider === provider && existing.key === key) return profileId;
+}
+function itemProfileTarget(credential, store) {
+	if (credential.kind === "oauth") {
+		const profile = credential.result.profiles[0];
+		const matched = profile?.credential.type === "oauth" ? findMatchingOAuthProfile(store, profile.credential) : void 0;
+		return {
+			profileId: matched ?? credential.profileId,
+			matchedExisting: Boolean(matched)
+		};
+	}
+	const matched = findMatchingApiKeyProfile(store, credential.provider, credential.key);
+	return {
+		profileId: matched ?? credential.profileId,
+		matchedExisting: Boolean(matched)
+	};
+}
+function replaceConfigDraft(draft, next) {
+	for (const key of Object.keys(draft)) delete draft[key];
+	Object.assign(draft, next);
+}
+function existingAuthProfileConfigIsCompatible(existing, profile) {
+	if (existing.provider !== profile.provider || existing.mode !== profile.mode) return false;
+	if (existing.email && profile.email && existing.email !== profile.email) return false;
+	return true;
+}
+function hasAuthProfileConfigConflict(config, profile, overwrite) {
+	if (overwrite) return false;
+	const existing = config.auth?.profiles?.[profile.profileId];
+	return Boolean(existing && !existingAuthProfileConfigIsCompatible(existing, profile));
+}
+function hasCurrentAuthProfileConfigConflict(ctx, profile) {
+	let config = ctx.config;
+	try {
+		config = resolveMigrationConfigRuntime(ctx)?.current?.() ?? config;
+	} catch {}
+	return hasAuthProfileConfigConflict(config, profile, Boolean(ctx.overwrite));
+}
+function applyDefaultModelIfMissing(cfg) {
+	const currentModel = cfg.agents?.defaults?.model;
+	if (typeof currentModel === "string" ? currentModel : isRecord(currentModel) ? normalizeOptionalString(currentModel.primary) : void 0) return cfg;
+	return {
+		...cfg,
+		agents: {
+			...cfg.agents,
+			defaults: {
+				...cfg.agents?.defaults,
+				model: {
+					...isRecord(currentModel) ? currentModel : {},
+					primary: OPENAI_CODEX_DEFAULT_MODEL
+				}
+			}
+		}
+	};
+}
+function applyOAuthConfigToConfig(cfg, credential, profileId) {
+	let next = mergeMigrationConfigValue(cfg, credential.result.configPatch);
+	const profile = credential.result.profiles[0];
+	if (profile) next = applyAuthProfileConfig(next, {
+		profileId,
+		provider: profile.credential.provider,
+		mode: "oauth",
+		..."email" in profile.credential && profile.credential.email ? { email: profile.credential.email } : {},
+		..."displayName" in profile.credential && profile.credential.displayName ? { displayName: profile.credential.displayName } : {},
+		preferProfileFirst: false
+	});
+	return applyDefaultModelIfMissing(next);
+}
+function applyApiKeyConfigToConfig(cfg, credential, profileId) {
+	return applyAuthProfileConfig(cfg, {
+		profileId,
+		provider: credential.provider,
+		mode: "api_key",
+		displayName: CODEX_IMPORT_DISPLAY_NAME,
+		preferProfileFirst: false
+	});
+}
+function shouldReturnAuthConfigPatch(ctx) {
+	return ctx.providerOptions?.configPatchMode === CODEX_CONFIG_PATCH_MODE_RETURN;
+}
+function authProfileConfigForCredential(credential, profileId) {
+	if (credential.kind === "api_key") return {
+		profileId,
+		provider: credential.provider,
+		mode: "api_key",
+		displayName: CODEX_IMPORT_DISPLAY_NAME
+	};
+	const profile = credential.result.profiles[0];
+	if (!profile || profile.credential.type !== "oauth") return null;
+	return {
+		profileId,
+		provider: profile.credential.provider,
+		mode: "oauth",
+		...profile.credential.email ? { email: profile.credential.email } : {},
+		...profile.credential.displayName ? { displayName: profile.credential.displayName } : {}
+	};
+}
+async function applyCodexAuthProfileConfig(ctx, profile, applyConfig) {
+	const configApi = resolveMigrationConfigRuntime(ctx);
+	if (!configApi?.current || !configApi.mutateConfigFile) return "unavailable";
+	try {
+		await configApi.mutateConfigFile({
+			base: "runtime",
+			afterWrite: { mode: "auto" },
+			mutate(draft) {
+				const current = draft;
+				if (hasAuthProfileConfigConflict(current, profile, Boolean(ctx.overwrite))) throw new CodexAuthConfigConflict();
+				replaceConfigDraft(draft, applyConfig(current));
+			}
+		});
+		return "configured";
+	} catch (error) {
+		return error instanceof CodexAuthConfigConflict ? "conflict" : "unavailable";
+	}
+}
+async function applyCodexAuthConfig(ctx, credential, profileId) {
+	const profile = authProfileConfigForCredential(credential, profileId);
+	if (!profile) return "unavailable";
+	return applyCodexAuthProfileConfig(ctx, profile, (config) => applyCredentialConfig(config, credential, profileId));
+}
+function applyCredentialConfig(config, credential, profileId) {
+	return credential.kind === "oauth" ? applyOAuthConfigToConfig(config, credential, profileId) : applyApiKeyConfigToConfig(config, credential, profileId);
+}
+async function buildCodexAuthItems(params) {
+	const credentials = await readCodexAuthCredentials(params.source);
+	if (credentials.length === 0) return [];
+	const store = loadAuthProfileStoreWithoutExternalProfiles(params.targets.agentDir);
+	const skipped = !params.ctx.includeSecrets;
+	return credentials.map((credential) => {
+		const { profileId, matchedExisting } = itemProfileTarget(credential, store);
+		const targetExists = Boolean(store.profiles[profileId]);
+		const configProfile = authProfileConfigForCredential(credential, profileId);
+		const configConflict = configProfile ? hasAuthProfileConfigConflict(params.ctx.config, configProfile, Boolean(params.ctx.overwrite)) : false;
+		const conflict = (targetExists && !matchedExisting && !params.ctx.overwrite || configConflict) && !skipped;
+		return createMigrationItem({
+			id: `auth:${credential.provider}`,
+			kind: "auth",
+			action: skipped ? "skip" : "create",
+			source: params.source.authPath,
+			target: `${params.targets.agentDir}/openclaw-agent.sqlite#auth_profile_store:${profileId}`,
+			status: skipped ? "skipped" : conflict ? "conflict" : "planned",
+			sensitive: true,
+			reason: skipped ? CODEX_REASON_AUTH_NOT_SELECTED : conflict ? CODEX_REASON_AUTH_PROFILE_EXISTS : void 0,
+			message: credential.kind === "oauth" ? "Import Codex OAuth credentials and configure OpenAI Codex models." : "Import Codex OpenAI API key.",
+			details: {
+				provider: credential.provider,
+				profileId,
+				sourceProfileId: credential.profileId,
+				sourceKind: "codex-auth-json",
+				credentialKind: credential.kind
+			}
+		});
+	});
+}
+async function applyCodexAuthItems(params) {
+	const { ctx, item, source, targets } = params;
+	if (item.status !== "planned") return [item];
+	const profileId = typeof item.details?.profileId === "string" ? item.details.profileId : "";
+	const provider = typeof item.details?.provider === "string" ? item.details.provider : "";
+	const sourceProfileId = typeof item.details?.sourceProfileId === "string" ? item.details.sourceProfileId : void 0;
+	if (!profileId || !provider) return [markMigrationItemError(item, CODEX_REASON_MISSING_AUTH_METADATA)];
+	const credential = (await readCodexAuthCredentials(source)).find((candidate) => candidate.provider === provider);
+	if (!credential) return [markMigrationItemSkipped(item, CODEX_REASON_AUTH_NO_LONGER_PRESENT)];
+	if (credential.kind === "oauth" && sourceProfileId && credential.profileId !== sourceProfileId) return [markMigrationItemSkipped(item, CODEX_REASON_AUTH_NO_LONGER_PRESENT)];
+	const oauthProfile = credential.kind === "oauth" ? credential.result.profiles[0] : void 0;
+	const oauthCredential = oauthProfile?.credential.type === "oauth" ? oauthProfile.credential : void 0;
+	if (credential.kind === "oauth" && !oauthCredential) return [markMigrationItemError(item, CODEX_REASON_MISSING_AUTH_METADATA)];
+	const configProfile = authProfileConfigForCredential(credential, profileId);
+	if (!configProfile) return [markMigrationItemError(item, CODEX_REASON_MISSING_AUTH_METADATA)];
+	if (hasCurrentAuthProfileConfigConflict(ctx, configProfile)) return [markMigrationItemConflict(item, CODEX_REASON_AUTH_PROFILE_EXISTS)];
+	let conflicted = false;
+	let wrote = false;
+	const store = await updateAuthProfileStoreWithLock({
+		agentDir: targets.agentDir,
+		stateDir: ctx.stateDir,
+		updater: (freshStore) => {
+			const existing = freshStore.profiles[profileId];
+			if (!ctx.overwrite && existing) {
+				if ((credential.kind === "oauth" ? findMatchingOAuthProfile(freshStore, oauthCredential) : findMatchingApiKeyProfile(freshStore, credential.provider, credential.key)) === profileId) return false;
+				conflicted = true;
+				return false;
+			}
+			freshStore.profiles[profileId] = credential.kind === "oauth" ? {
+				...oauthCredential,
+				displayName: CODEX_IMPORT_DISPLAY_NAME
+			} : {
+				...buildApiKeyCredential(credential.provider, credential.key),
+				displayName: CODEX_IMPORT_DISPLAY_NAME
+			};
+			wrote = true;
+			return true;
+		}
+	});
+	if (conflicted) return [markMigrationItemConflict(item, CODEX_REASON_AUTH_PROFILE_EXISTS)];
+	if (!store?.profiles[profileId]) return [markMigrationItemError(item, CODEX_REASON_AUTH_PROFILE_WRITE_FAILED)];
+	const configResult = shouldReturnAuthConfigPatch(ctx) ? "unavailable" : await applyCodexAuthConfig(ctx, credential, profileId);
+	if (configResult === "conflict") return [markMigrationItemConflict(item, CODEX_REASON_AUTH_PROFILE_EXISTS)];
+	const migratedItem = {
+		...item,
+		status: "migrated",
+		details: {
+			...item.details,
+			wroteAuthProfile: wrote,
+			configUpdated: configResult === "configured",
+			...shouldReturnAuthConfigPatch(ctx) ? { configPatchReturned: true } : {}
+		}
+	};
+	return [migratedItem, ...shouldReturnAuthConfigPatch(ctx) ? buildCodexAuthConfigPatchItems(ctx, migratedItem, credential, profileId) : []];
+}
+function buildCodexAuthConfigPatchItems(ctx, item, credential, profileId) {
+	const next = applyCredentialConfig(ctx.config, credential, profileId);
+	const items = [];
+	if (next.auth) items.push(createMigrationItem({
+		id: `${item.id}:config:auth`,
+		kind: "config",
+		action: "merge",
+		status: "migrated",
+		target: "auth",
+		message: "Configure imported Codex auth profile.",
+		details: {
+			path: ["auth"],
+			value: next.auth
+		}
+	}));
+	if (next.agents?.defaults) items.push(createMigrationItem({
+		id: `${item.id}:config:agents-defaults`,
+		kind: "config",
+		action: "merge",
+		status: "migrated",
+		target: "agents.defaults",
+		message: "Configure imported Codex models.",
+		details: {
+			path: ["agents", "defaults"],
+			value: next.agents.defaults
+		}
+	}));
+	return items;
+}
+//#endregion
+//#region extensions/codex/src/migration/targets.ts
+function resolveCodexMigrationTargets(ctx) {
+	const cfg = ctx.config;
+	const agentId = ctx.targetAgentId ?? resolveDefaultAgentId(cfg);
+	const workspaceDir = resolveAgentWorkspaceDir(cfg, agentId);
+	const configuredAgentDir = resolveAgentConfig(cfg, agentId)?.agentDir?.trim();
+	return {
+		workspaceDir,
+		agentDir: ctx.runtime?.agent?.resolveAgentDir(cfg, agentId) ?? (configuredAgentDir ? resolveHomePath(configuredAgentDir) : void 0) ?? path.join(ctx.stateDir, "agents", agentId, "agent")
+	};
+}
+//#endregion
+//#region extensions/codex/src/migration/plan.ts
+const CODEX_PLUGIN_CONFIG_ITEM_ID = "config:codex-plugins";
+const CODEX_PLUGIN_CONFIG_PATH = [
+	"plugins",
+	"entries",
+	"codex"
+];
+const CODEX_PLUGIN_ENABLED_PATH = [
+	"plugins",
+	"entries",
+	"codex",
+	"enabled"
+];
+const CODEX_PLUGIN_NATIVE_CONFIG_PATH = [
+	"plugins",
+	"entries",
+	"codex",
+	"config",
+	"codexPlugins"
+];
+const MIGRATION_REASON_PLUGIN_EXISTS = "plugin exists";
+const CODEX_PLUGIN_SOURCE_APP_VERIFICATION_UNVERIFIED = "not_run";
+const MIGRATION_REASON_TARGET_NOT_REGULAR = "target is not a regular file";
+async function lstatIfExists(filePath) {
+	try {
+		return await fs.lstat(filePath);
+	} catch (error) {
+		const code = extractErrorCode(error);
+		if (code === "ENOENT" || code === "ENOTDIR") return;
+		throw error;
+	}
+}
+async function buildCodexMemoryItems(params) {
+	const items = [];
+	for (const memory of params.memoryFiles) {
+		const target = path.join(params.workspaceDir, "memory", "imports", "codex", path.basename(memory.path));
+		const targetStat = await lstatIfExists(target);
+		const targetNotRegular = targetStat !== void 0 && !targetStat.isFile();
+		if (!targetNotRegular) {
+			const [source, workspace, destination] = await Promise.all([
+				fs.realpath(path.dirname(memory.path)),
+				canonicalPathFromExistingAncestor(params.workspaceDir),
+				canonicalPathFromExistingAncestor(target)
+			]);
+			if (!isPathInside(workspace, destination)) throw new Error("Codex memory import destination must stay in the selected workspace.");
+			if (isPathInside(source, destination) || isPathInside(destination, source)) throw new Error("Codex memory source and OpenClaw import destination must be separate paths.");
+		}
+		const targetConflict = targetStat !== void 0 && !params.overwrite;
+		items.push(createMigrationItem({
+			id: memory.id,
+			kind: "memory",
+			action: "copy",
+			source: memory.path,
+			target,
+			status: targetNotRegular || targetConflict ? "conflict" : "planned",
+			reason: targetNotRegular ? MIGRATION_REASON_TARGET_NOT_REGULAR : targetConflict ? MIGRATION_REASON_TARGET_EXISTS : void 0,
+			message: "Copy consolidated Codex memory into the OpenClaw memory index.",
+			details: {
+				sourceType: "codex-memory",
+				sourceLabel: memory.label,
+				collectionId: "codex",
+				collectionLabel: "Codex",
+				relativePath: path.basename(memory.path)
+			}
+		}));
+	}
+	return items;
+}
+function uniqueSkillName(skill, counts) {
+	const base = sanitizeName(skill.name) || "codex-skill";
+	if ((counts.get(base) ?? 0) <= 1) return base;
+	const parent = sanitizeName(path.basename(path.dirname(skill.source)));
+	return sanitizeName([
+		"codex",
+		parent,
+		base
+	].filter(Boolean).join("-")) || base;
+}
+async function buildCodexSkillItems(params) {
+	const counts = /* @__PURE__ */ new Map();
+	for (const skill of params.skills) {
+		const base = sanitizeName(skill.name) || "codex-skill";
+		counts.set(base, (counts.get(base) ?? 0) + 1);
+	}
+	const planned = params.skills.map((skill) => {
+		const name = uniqueSkillName(skill, counts);
+		return {
+			skill,
+			name,
+			target: path.join(params.workspaceDir, "skills", name)
+		};
+	});
+	const resolvedCounts = planned.reduce((resolved, item) => {
+		resolved.set(item.name, (resolved.get(item.name) ?? 0) + 1);
+		return resolved;
+	}, /* @__PURE__ */ new Map());
+	return await Promise.all(planned.map(async (item) => {
+		const collision = (resolvedCounts.get(item.name) ?? 0) > 1;
+		const targetExists = await exists(item.target);
+		const conflict = collision || targetExists && !params.overwrite;
+		return createMigrationItem({
+			id: `skill:${item.name}`,
+			kind: "skill",
+			action: "copy",
+			source: item.skill.source,
+			target: item.target,
+			status: conflict ? "conflict" : "planned",
+			reason: collision ? `multiple Codex skills normalize to "${item.name}"` : conflict ? MIGRATION_REASON_TARGET_EXISTS : void 0,
+			message: `Copy ${item.skill.sourceLabel} into this OpenClaw agent workspace.`,
+			details: {
+				skillName: item.name,
+				sourceLabel: item.skill.sourceLabel
+			}
+		});
+	}));
+}
+function readExistingCodexPluginEntries(config) {
+	const entries = readMigrationConfigPath(config, [...CODEX_PLUGIN_NATIVE_CONFIG_PATH, "plugins"]);
+	return isRecord(entries) ? entries : {};
+}
+function hasExistingCodexPluginEntry(existingEntries, configKey, pluginName, nextEntry) {
+	const existingEntry = existingEntries[configKey];
+	if (existingEntry !== void 0) return !isLegacyDestructivePolicyRepair(existingEntry, nextEntry);
+	return Object.values(existingEntries).some((entry) => {
+		if (!isRecord(entry)) return false;
+		return entry.pluginName === pluginName;
+	});
+}
+function isLegacyDestructivePolicyRepair(existing, nextEntry) {
+	const existingEntry = isRecord(existing) ? existing : void 0;
+	if (existingEntry?.allow_destructive_actions !== "on-request" || nextEntry.allow_destructive_actions !== "auto") return false;
+	const normalizedExisting = {
+		...existingEntry,
+		allow_destructive_actions: "auto"
+	};
+	const normalizedEntries = Object.entries(normalizedExisting);
+	return normalizedEntries.length === Object.keys(nextEntry).length && normalizedEntries.every(([key, value]) => nextEntry[key] === value);
+}
+function readExistingPluginAllowDestructiveActions(existing, pluginName) {
+	const existingEntry = isRecord(existing) ? existing : void 0;
+	if (existingEntry?.pluginName !== pluginName) return;
+	const normalized = normalizeExistingAllowDestructiveActions(existingEntry.allow_destructive_actions);
+	return normalized === "auto" || normalized === "ask" ? normalized : void 0;
+}
+function buildPluginItems(ctx, plugins) {
+	const existingPluginEntries = readExistingCodexPluginEntries(ctx.config);
+	let manualIndex = 0;
+	const items = [];
+	for (const plugin of plugins) {
+		if (plugin.migratable && plugin.marketplaceName === "openai-curated" && plugin.pluginName) {
+			const configKey = plugin.pluginName;
+			const plannedEntry = {
+				enabled: true,
+				marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
+				pluginName: plugin.pluginName,
+				...(() => {
+					const allowDestructiveActions = readExistingPluginAllowDestructiveActions(existingPluginEntries[configKey], plugin.pluginName);
+					return allowDestructiveActions ? { allow_destructive_actions: allowDestructiveActions } : {};
+				})()
+			};
+			const conflict = !ctx.overwrite && hasExistingCodexPluginEntry(existingPluginEntries, configKey, plugin.pluginName, plannedEntry);
+			items.push(createMigrationItem({
+				id: `plugin:${configKey}`,
+				kind: "plugin",
+				action: "install",
+				status: conflict ? "conflict" : "planned",
+				reason: conflict ? MIGRATION_REASON_PLUGIN_EXISTS : void 0,
+				applyPhase: "after-promotion",
+				source: plugin.source,
+				target: `plugins.entries.codex.config.codexPlugins.plugins.${configKey}`,
+				message: `Install Codex plugin "${plugin.pluginName}" in the OpenClaw-managed Codex app-server runtime.`,
+				details: {
+					configKey,
+					marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
+					pluginName: plugin.pluginName,
+					sourceInstalled: plugin.installed === true,
+					sourceEnabled: plugin.enabled === true,
+					...plannedEntry.allow_destructive_actions === "auto" || plannedEntry.allow_destructive_actions === "ask" ? { allowDestructiveActions: plannedEntry.allow_destructive_actions } : {},
+					...plugin.apps && plugin.apps.length > 0 && !shouldVerifyPluginApps(ctx) ? { sourceAppVerification: CODEX_PLUGIN_SOURCE_APP_VERIFICATION_UNVERIFIED } : {}
+				}
+			}));
+			continue;
+		}
+		manualIndex += 1;
+		if (plugin.migrationBlock && plugin.pluginName) {
+			items.push(createMigrationItem({
+				id: `plugin:${sanitizeName(plugin.name) || sanitizeName(path.basename(plugin.source))}:${manualIndex}`,
+				kind: "manual",
+				action: "manual",
+				source: plugin.source,
+				status: "skipped",
+				reason: plugin.migrationBlock.code,
+				message: plugin.message ?? `Codex native plugin "${plugin.name}" was found but not activated automatically.`,
+				details: {
+					pluginName: plugin.pluginName,
+					marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
+					...plugin.migrationBlock.apps ? { apps: plugin.migrationBlock.apps } : {},
+					...plugin.migrationBlock.error ? { error: plugin.migrationBlock.error } : {}
+				}
+			}));
+			continue;
+		}
+		items.push(createMigrationManualItem({
+			id: `plugin:${sanitizeName(plugin.name) || sanitizeName(path.basename(plugin.source))}:${manualIndex}`,
+			source: plugin.source,
+			message: plugin.message ?? `Codex native plugin "${plugin.name}" was found but not activated automatically.`,
+			recommendation: "Review the plugin bundle first, then install trusted compatible plugins with openclaw plugins install <path> --force."
+		}));
+	}
+	return items;
+}
+function shouldVerifyPluginApps(ctx) {
+	return ctx.providerOptions?.verifyPluginApps === true;
+}
+function readCodexPluginMigrationConfigEntry(item, enabled) {
+	const configKey = item.details?.configKey;
+	const marketplaceName = item.details?.marketplaceName;
+	const pluginName = item.details?.pluginName;
+	if (item.kind !== "plugin" || item.action !== "install" || typeof configKey !== "string" || marketplaceName !== "openai-curated" || typeof pluginName !== "string") return;
+	const allowDestructiveActions = item.details?.allowDestructiveActions;
+	return {
+		configKey,
+		pluginName,
+		enabled,
+		...allowDestructiveActions === "auto" || allowDestructiveActions === "ask" ? { allowDestructiveActions } : {}
+	};
+}
+function readExistingAllowDestructiveActions(config) {
+	return normalizeExistingAllowDestructiveActions(readMigrationConfigPath(config, [...CODEX_PLUGIN_NATIVE_CONFIG_PATH, "allow_destructive_actions"]));
+}
+function normalizeExistingAllowDestructiveActions(value) {
+	if (value === "auto" || value === "on-request") return "auto";
+	if (value === "ask") return "ask";
+	return asBoolean(value);
+}
+function readExistingPluginPolicyRepairs(config) {
+	return Object.fromEntries(Object.entries(readExistingCodexPluginEntries(config)).flatMap(([configKey, entry]) => {
+		const pluginEntry = isRecord(entry) ? entry : void 0;
+		if (pluginEntry?.allow_destructive_actions !== "on-request") return [];
+		return [[configKey, {
+			...pluginEntry,
+			allow_destructive_actions: "auto"
+		}]];
+	}));
+}
+function buildCodexPluginsConfigValue(entries, config) {
+	const plugins = {
+		...readExistingPluginPolicyRepairs(config),
+		...Object.fromEntries(entries.toSorted((a, b) => a.configKey.localeCompare(b.configKey)).map((entry) => [entry.configKey, {
+			enabled: entry.enabled,
+			marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
+			pluginName: entry.pluginName,
+			...entry.allowDestructiveActions ? { allow_destructive_actions: entry.allowDestructiveActions } : {}
+		}]))
+	};
+	return {
+		enabled: true,
+		config: { codexPlugins: {
+			enabled: true,
+			allow_destructive_actions: readExistingAllowDestructiveActions(config) ?? true,
+			plugins
+		} }
+	};
+}
+function hasCodexPluginConfigConflict(config, value) {
+	const enabled = readMigrationConfigPath(config, CODEX_PLUGIN_ENABLED_PATH);
+	if (enabled !== void 0 && enabled !== true) return true;
+	const nativeConfig = value.config?.codexPlugins;
+	if (!isRecord(nativeConfig)) return hasMigrationConfigPatchConflict(config, CODEX_PLUGIN_NATIVE_CONFIG_PATH, nativeConfig);
+	const existingNativeConfig = readMigrationConfigPath(config, CODEX_PLUGIN_NATIVE_CONFIG_PATH);
+	if (existingNativeConfig === void 0) return false;
+	if (!isRecord(existingNativeConfig)) return true;
+	if (existingNativeConfig.enabled !== void 0 && existingNativeConfig.enabled !== true) return true;
+	const allowDestructiveActions = nativeConfig.allow_destructive_actions;
+	const existingAllowDestructiveActions = normalizeExistingAllowDestructiveActions(existingNativeConfig.allow_destructive_actions);
+	if (existingNativeConfig.allow_destructive_actions !== void 0 && existingAllowDestructiveActions !== allowDestructiveActions) return true;
+	const plugins = nativeConfig.plugins;
+	if (!isRecord(plugins)) return false;
+	return Object.entries(plugins).some(([configKey, plugin]) => {
+		if (!isRecord(plugin)) return existingNativeConfig[configKey] !== void 0;
+		return hasExistingCodexPluginEntry(readExistingCodexPluginEntries(config), configKey, typeof plugin.pluginName === "string" ? plugin.pluginName : configKey, plugin);
+	});
+}
+function buildPluginConfigItem(ctx, pluginItems) {
+	const entries = pluginItems.filter((item) => item.status === "planned").map((item) => readCodexPluginMigrationConfigEntry(item, true)).filter((entry) => entry !== void 0);
+	if (entries.length === 0) return;
+	const value = buildCodexPluginsConfigValue(entries, ctx.config);
+	const conflict = !ctx.overwrite && hasCodexPluginConfigConflict(ctx.config, value);
+	return createMigrationItem({
+		id: CODEX_PLUGIN_CONFIG_ITEM_ID,
+		kind: "config",
+		action: "merge",
+		target: "plugins.entries.codex.config.codexPlugins",
+		status: conflict ? "conflict" : "planned",
+		reason: conflict ? MIGRATION_REASON_TARGET_EXISTS : void 0,
+		applyPhase: "after-promotion",
+		message: "Enable OpenClaw's Codex plugin integration and record migrated source-installed curated plugins.",
+		details: {
+			path: [...CODEX_PLUGIN_CONFIG_PATH],
+			value
+		}
+	});
+}
+async function buildCodexMigrationPlan(ctx) {
+	const targets = resolveCodexMigrationTargets(ctx);
+	const memoryOnly = ctx.itemKinds !== void 0 && ctx.itemKinds.length > 0 && ctx.itemKinds.every((kind) => kind === "memory");
+	const source = await discoverCodexSource({
+		input: ctx.source,
+		memoryOnly,
+		evaluatePluginMigrationEligibility: !memoryOnly,
+		verifyPluginApps: shouldVerifyPluginApps(ctx)
+	});
+	if (!hasCodexSource(source)) throw new Error(`Codex state was not found at ${source.root}. Pass --from <path> if it lives elsewhere.`);
+	const items = [];
+	items.push(...await buildCodexMemoryItems({
+		memoryFiles: source.memoryFiles,
+		workspaceDir: targets.workspaceDir,
+		overwrite: ctx.overwrite
+	}));
+	if (!memoryOnly) {
+		items.push(...await buildCodexAuthItems({
+			ctx,
+			source,
+			targets
+		}));
+		items.push(...await buildCodexSkillItems({
+			skills: source.skills,
+			workspaceDir: targets.workspaceDir,
+			overwrite: ctx.overwrite
+		}));
+		const pluginItems = buildPluginItems(ctx, source.plugins);
+		items.push(...pluginItems);
+		const pluginConfigItem = buildPluginConfigItem(ctx, pluginItems);
+		if (pluginConfigItem) items.push(pluginConfigItem);
+		for (const archivePath of source.archivePaths) items.push(createMigrationItem({
+			id: archivePath.id,
+			kind: "archive",
+			action: "archive",
+			source: archivePath.path,
+			message: archivePath.message ?? "Archived in the migration report for manual review; not imported into live config.",
+			details: { archiveRelativePath: archivePath.relativePath }
+		}));
+	}
+	const warnings = [
+		...!ctx.includeSecrets && items.some((item) => item.kind === "auth") ? ["Auth credentials were detected but skipped. Re-run interactively or pass --include-secrets to import supported credentials."] : [],
+		...items.some((item) => item.status === "conflict") ? ["Conflicts were found. Re-run with --overwrite to replace conflicting migration targets after item-level backups."] : [],
+		...source.pluginDiscoveryError ? [`Codex app-server plugin inventory discovery failed: ${source.pluginDiscoveryError}. Cached plugin bundles, if any, are advisory only.`] : [],
+		...source.plugins.some((plugin) => plugin.migrationBlock?.code === "codex_subscription_required") ? [codexPluginMigrationSubscriptionWarning()] : []
+	];
+	return {
+		providerId: "codex",
+		source: source.root,
+		target: targets.workspaceDir,
+		summary: summarizeMigrationItems(items),
+		items,
+		warnings,
+		nextSteps: memoryOnly ? [] : ["Run openclaw doctor after applying the migration.", "Review skipped or auth-required Codex plugin/config/hook items before exposing them in OpenClaw sessions."],
+		metadata: {
+			agentDir: targets.agentDir,
+			codexHome: source.codexHome,
+			codexSkillsDir: source.codexSkillsDir,
+			personalAgentsSkillsDir: source.personalAgentsSkillsDir
+		}
+	};
+}
+//#endregion
+export { CODEX_PLUGIN_CONFIG_ITEM_ID, CODEX_PLUGIN_CONFIG_PATH, buildCodexMigrationPlan, buildCodexPluginsConfigValue, hasCodexPluginConfigConflict, applyCodexAuthItems as n, readCodexPluginMigrationConfigEntry, resolveCodexMigrationTargets as t };