@openclaw/codex 2026.9.2 → 2026.9.4

package/dist/plan-7uG-Fp36.js

@@ -0,0 +1,947 @@
+import { c as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-oL4Na1ZG.js";
+import "./config-oIORaQ5T.js";
+import { a as exists, c as sanitizeName, n as discoverCodexSource, o as readJsonObject, r as hasCodexSource, s as resolveHomePath, t as codexPluginMigrationSubscriptionWarning } from "./source-CElXU0Oy.js";
+import { asBoolean, asOptionalRecord, isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { createHash } from "node:crypto";
+import { runCommandBuffered } from "openclaw/plugin-sdk/process-runtime";
+import path from "node:path";
+import fs from "node:fs/promises";
+import { canonicalPathFromExistingAncestor, isPathInside } from "openclaw/plugin-sdk/file-access-runtime";
+import { readSecretFile } from "openclaw/plugin-sdk/secret-file";
+import { fileURLToPath } from "node:url";
+import { loadAuthProfileStoreWithoutExternalProfiles, resolveAgentConfig, resolveAgentWorkspaceDir, resolveDefaultAgentId } from "openclaw/plugin-sdk/agent-runtime";
+import { extractErrorCode } from "openclaw/plugin-sdk/security-runtime";
+import { applyAuthProfileConfig, buildApiKeyCredential, buildOauthProviderAuthResult, buildOpenAICodexCredentialExtra, hasUsableOAuthCredential, resolveOpenAICodexAuthIdentity, resolveOpenAICodexImportProfileName, updateAuthProfileStoreWithLock } from "openclaw/plugin-sdk/provider-auth";
+import { MIGRATION_REASON_TARGET_EXISTS, createMigrationItem, createMigrationManualItem, hasMigrationConfigPatchConflict, markMigrationItemConflict, markMigrationItemError, markMigrationItemSkipped, mergeMigrationConfigValue, readMigrationConfigPath, resolveMigrationConfigRuntime, summarizeMigrationItems } from "openclaw/plugin-sdk/migration";
+import { decodeOpenAICodexJwtPayload } from "openclaw/plugin-sdk/provider-oauth-runtime";
+//#region extensions/codex/src/migration/cli-credentials.ts
+/** Explicit migration reads the storage selected by the native credential owner. */
+async function readAuthFile(home) {
+	try {
+		return asOptionalRecord(JSON.parse(await readSecretFile(path.join(home, "auth.json"), "Codex auth")));
+	} catch {
+		return;
+	}
+}
+async function readDirectKeyring(home, signal) {
+	const account = `cli|${createHash("sha256").update(home).digest("hex").slice(0, 16)}`;
+	const result = await runCommandBuffered([
+		"security",
+		"find-generic-password",
+		"-s",
+		"Codex Auth",
+		"-a",
+		account,
+		"-w"
+	], {
+		timeoutMs: 6e4,
+		maxCombinedOutputBytes: 16384,
+		signal
+	});
+	if (result.termination !== "exit" || result.code !== 0) return;
+	try {
+		return asOptionalRecord(JSON.parse(result.stdout.toString("utf8")));
+	} catch {
+		return;
+	}
+}
+async function readSelectedCredentialStorage(options, requireApiKey) {
+	options.signal?.throwIfAborted();
+	const home = await fs.realpath(options.codexHome).catch(() => path.resolve(options.codexHome));
+	const { CodexAppServerClient } = await import("./client-B57KWPQx.js").then((n) => n.n);
+	const { resolveManagedCodexPackageEntrypoint, resolveManagedCodexNativeCommand } = await import("./managed-binary-D22rNEcR.js").then((n) => n.n);
+	const launcher = resolveManagedCodexPackageEntrypoint(path.dirname(fileURLToPath(import.meta.url)));
+	const command = launcher ? resolveManagedCodexNativeCommand(launcher) : void 0;
+	if (!command) return;
+	const signal = AbortSignal.any([AbortSignal.timeout(options.allowKeychainPrompt && process.platform === "darwin" ? 6e4 : 5e3), ...options.signal ? [options.signal] : []]);
+	const client = await CodexAppServerClient.start({
+		transport: "stdio",
+		command,
+		commandSource: "resolved-managed",
+		args: ["app-server"],
+		cwd: home,
+		homeScope: "user",
+		env: { CODEX_HOME: home },
+		clearEnv: [
+			"OPENAI_API_KEY",
+			"CODEX_API_KEY",
+			"CODEX_ACCESS_TOKEN"
+		]
+	}, () => signal.throwIfAborted()).catch(() => {
+		options.signal?.throwIfAborted();
+	});
+	if (!client) return;
+	const abort = () => client.close();
+	signal.addEventListener("abort", abort, { once: true });
+	let credential;
+	try {
+		credential = await readNativeCredential(client, home, requireApiKey, options, signal);
+	} catch {}
+	signal.removeEventListener("abort", abort);
+	const closed = await client.closeAndWait({
+		forceKillDelayMs: 6e3,
+		exitTimeoutMs: 7e3
+	});
+	if (!closed.exited || closed.cleanup !== "closed") throw new Error("The Codex credential reader could not stop. No credential was imported.", { cause: options.signal?.reason });
+	options.signal?.throwIfAborted();
+	return credential;
+}
+async function readNativeCredential(client, home, requireApiKey, options, signal) {
+	signal.throwIfAborted();
+	await client.initialize();
+	if (client.getRuntimeIdentity()?.codexHome !== home) return;
+	const revision = client.getModelCatalogRevision();
+	if (requireApiKey) {
+		const account = await client.request("account/read", { refreshToken: false }, { signal });
+		if (asOptionalRecord(account.account)?.type !== "apiKey" || account.requiresOpenaiAuth !== true) return;
+	}
+	const configured = await client.request("config/read", {
+		includeLayers: false,
+		cwd: home
+	}, { signal });
+	const mode = (await client.request("configRequirements/read", {}, { signal })).requirements?.cli_auth_credentials_store ?? configured.config.cli_auth_credentials_store ?? "file";
+	let record;
+	if (mode === "file") record = await readAuthFile(home);
+	else if ((mode === "keyring" || mode === "auto") && process.platform === "darwin" && options.allowKeychainPrompt) {
+		let cursor;
+		let encrypted;
+		do {
+			const features = await client.request("experimentalFeature/list", {
+				limit: 100,
+				cursor
+			}, { signal });
+			const storage = features.data.find((feature) => feature.name === "secret_auth_storage");
+			if (storage) {
+				encrypted = storage.enabled;
+				break;
+			}
+			cursor = features.nextCursor ?? void 0;
+		} while (cursor);
+		if (encrypted !== false) return;
+		record = await readDirectKeyring(home, signal);
+	}
+	signal.throwIfAborted();
+	return !client.getCloseError() && client.getModelCatalogRevision() === revision ? record : void 0;
+}
+function jwtExpiry(token) {
+	try {
+		const exp = asOptionalRecord(JSON.parse(Buffer.from(token.split(".")[1] ?? "", "base64url").toString("utf8")))?.exp;
+		return typeof exp === "number" && Number.isFinite(exp) && exp > 0 ? exp * 1e3 : void 0;
+	} catch {
+		return;
+	}
+}
+async function readCodexCliCredentialsAsync(options) {
+	const data = await readSelectedCredentialStorage(options, false);
+	const mode = typeof data?.auth_mode === "string" ? data.auth_mode.toLowerCase() : void 0;
+	if (!data || mode !== void 0 && mode !== "chatgpt" && mode !== "chatgptauthtokens") return;
+	const tokens = asOptionalRecord(data.tokens);
+	if (typeof tokens?.access_token !== "string" || !tokens.access_token || typeof tokens.refresh_token !== "string" || !tokens.refresh_token) return;
+	const lastRefresh = typeof data.last_refresh === "string" ? Date.parse(data.last_refresh) : NaN;
+	return {
+		type: "oauth",
+		provider: "openai",
+		access: tokens.access_token,
+		refresh: tokens.refresh_token,
+		expires: jwtExpiry(tokens.access_token) ?? (Number.isFinite(lastRefresh) ? lastRefresh : Date.now()) + 36e5,
+		...typeof tokens.account_id === "string" ? { accountId: tokens.account_id } : {},
+		...typeof tokens.id_token === "string" ? { idToken: tokens.id_token } : {}
+	};
+}
+async function readCodexCliActiveApiKeyAsync(options) {
+	const data = await readSelectedCredentialStorage(options, true);
+	const mode = typeof data?.auth_mode === "string" ? data.auth_mode.toLowerCase() : void 0;
+	if (!data || mode !== void 0 && mode !== "apikey" && mode !== "api_key") return;
+	const key = typeof data.OPENAI_API_KEY === "string" ? data.OPENAI_API_KEY.trim() : "";
+	return key ? {
+		type: "api_key",
+		provider: "openai",
+		key
+	} : void 0;
+}
+//#endregion
+//#region extensions/codex/src/migration/auth.ts
+const OPENAI_PROVIDER_ID = "openai";
+const OPENAI_OAUTH_ITEM_ID = "auth:openai";
+const OPENAI_API_KEY_ITEM_ID = "auth:openai:api-key";
+const OPENAI_CODEX_DEFAULT_MODEL = "openai/gpt-5.6-sol";
+const CODEX_IMPORT_DISPLAY_NAME = "Codex import";
+const CODEX_REASON_AUTH_NOT_SELECTED = "auth credential migration not selected";
+const CODEX_REASON_AUTH_PROFILE_EXISTS = "auth profile exists";
+const CODEX_REASON_AUTH_PROFILE_UNUSABLE = "existing OAuth profile requires sign-in";
+const CODEX_REASON_AUTH_PROFILE_WRITE_FAILED = "failed to write auth profile";
+const CODEX_REASON_AUTH_NO_LONGER_PRESENT = "auth credential no longer present";
+const CODEX_REASON_MISSING_AUTH_METADATA = "missing auth metadata";
+const CODEX_REASON_AUTH_STORAGE_NOT_IMPORTABLE = "credential storage is not importable";
+var CodexAuthConfigConflict = class extends Error {};
+function authItemId(credential) {
+	return credential.kind === "oauth" ? OPENAI_OAUTH_ITEM_ID : OPENAI_API_KEY_ITEM_ID;
+}
+function sourceCredentialFingerprint(credential) {
+	const profile = credential.kind === "oauth" ? credential.result.profiles[0]?.credential : void 0;
+	const source = credential.kind === "api_key" ? credential.key : profile?.type === "oauth" ? [
+		profile.access,
+		profile.refresh,
+		profile.accountId,
+		profile.idToken
+	] : void 0;
+	return createHash("sha256").update(JSON.stringify([credential.kind, source])).digest("hex");
+}
+async function readModelRefs(source) {
+	const cache = await readJsonObject(source.modelsCachePath);
+	const models = Array.isArray(cache.models) ? cache.models : [];
+	const refs = /* @__PURE__ */ new Set();
+	for (const model of models) {
+		const slug = typeof model === "string" ? model.trim() : isRecord(model) ? normalizeOptionalString(model.slug) ?? normalizeOptionalString(model.id) ?? normalizeOptionalString(model.name) : void 0;
+		if (!slug) continue;
+		refs.add(`${OPENAI_PROVIDER_ID}/${slug}`);
+	}
+	refs.add(OPENAI_CODEX_DEFAULT_MODEL);
+	return [...refs].toSorted();
+}
+async function buildCodexOAuthCredential(source, includeConfigPatch, options) {
+	const credential = await readCodexCliCredentialsAsync({
+		codexHome: source.codexHome,
+		allowKeychainPrompt: options.allowKeychainPrompt,
+		...options.signal ? { signal: options.signal } : {}
+	});
+	if (!credential) return null;
+	const identity = resolveOpenAICodexAuthIdentity({
+		access: credential.access,
+		accountId: credential.accountId
+	});
+	const configPatch = includeConfigPatch ? { agents: { defaults: { models: Object.fromEntries((await readModelRefs(source)).map((modelRef) => [modelRef, {}])) } } } : {};
+	const result = buildOauthProviderAuthResult({
+		providerId: OPENAI_PROVIDER_ID,
+		defaultModel: OPENAI_CODEX_DEFAULT_MODEL,
+		access: credential.access,
+		refresh: credential.refresh,
+		expires: credential.expires,
+		email: identity.email,
+		profileName: resolveOpenAICodexImportProfileName(identity, "codex-import"),
+		displayName: CODEX_IMPORT_DISPLAY_NAME,
+		credentialExtra: buildOpenAICodexCredentialExtra({
+			accountId: identity.accountId,
+			chatgptPlanType: identity.chatgptPlanType,
+			idToken: credential.idToken
+		}),
+		configPatch
+	});
+	const profile = result.profiles[0];
+	return profile ? {
+		kind: "oauth",
+		provider: OPENAI_PROVIDER_ID,
+		profileId: profile.profileId,
+		result
+	} : null;
+}
+async function buildCodexApiKeyCredential(source, allowKeychainPrompt, signal) {
+	const credential = await readCodexCliActiveApiKeyAsync({
+		codexHome: source.codexHome,
+		allowKeychainPrompt,
+		...signal ? { signal } : {}
+	});
+	if (!credential) return null;
+	return {
+		kind: "api_key",
+		provider: OPENAI_PROVIDER_ID,
+		profileId: "openai:codex-import",
+		key: credential.key
+	};
+}
+async function readCodexAuthCredentials(source, options) {
+	return [options.credentialKind === "api_key" ? null : await buildCodexOAuthCredential(source, options.includeConfigPatch, {
+		allowKeychainPrompt: options.allowKeychainPrompt,
+		...options.signal ? { signal: options.signal } : {}
+	}), options.credentialKind === "oauth" ? null : await buildCodexApiKeyCredential(source, options.allowKeychainPrompt, options.signal)].filter((entry) => entry !== null);
+}
+function findMatchingOAuthProfile(store, credential) {
+	const subject = oauthSubject(credential);
+	if (!subject) return;
+	for (const [profileId, existing] of Object.entries(store.profiles)) {
+		if (existing.type !== "oauth" || existing.provider !== credential.provider) continue;
+		const previous = oauthSubject(existing);
+		if (previous?.accountId === subject.accountId && previous.userId === subject.userId) return profileId;
+	}
+}
+function oauthSubject(credential) {
+	const claims = decodeOpenAICodexJwtPayload(credential.access)?.["https://api.openai.com/auth"];
+	if (!isRecord(claims)) return;
+	const accountId = normalizeOptionalString(claims.chatgpt_account_id);
+	const userId = normalizeOptionalString(claims.chatgpt_user_id) ?? normalizeOptionalString(claims.user_id);
+	return accountId && userId ? {
+		accountId,
+		userId
+	} : void 0;
+}
+function findMatchingApiKeyProfile(store, provider, key) {
+	for (const [profileId, existing] of Object.entries(store.profiles)) if (existing.type === "api_key" && existing.provider === provider && existing.key === key) return profileId;
+}
+function itemProfileTarget(credential, store) {
+	if (credential.kind === "oauth") {
+		const profile = credential.result.profiles[0];
+		const matched = profile?.credential.type === "oauth" ? findMatchingOAuthProfile(store, profile.credential) : void 0;
+		return {
+			profileId: matched ?? credential.profileId,
+			matchedExisting: Boolean(matched)
+		};
+	}
+	const matched = findMatchingApiKeyProfile(store, credential.provider, credential.key);
+	return {
+		profileId: matched ?? credential.profileId,
+		matchedExisting: Boolean(matched)
+	};
+}
+function replaceConfigDraft(draft, next) {
+	for (const key of Object.keys(draft)) delete draft[key];
+	Object.assign(draft, next);
+}
+function existingAuthProfileConfigIsCompatible(existing, profile) {
+	if (existing.provider !== profile.provider || existing.mode !== profile.mode) return false;
+	if (existing.email && profile.email && existing.email !== profile.email) return false;
+	return true;
+}
+function hasAuthProfileConfigConflict(config, profile, overwrite) {
+	if (overwrite) return false;
+	const existing = config.auth?.profiles?.[profile.profileId];
+	return Boolean(existing && !existingAuthProfileConfigIsCompatible(existing, profile));
+}
+function hasCurrentAuthProfileConfigConflict(ctx, profile) {
+	let config = ctx.config;
+	try {
+		config = resolveMigrationConfigRuntime(ctx)?.current?.() ?? config;
+	} catch {}
+	return hasAuthProfileConfigConflict(config, profile, Boolean(ctx.overwrite));
+}
+function applyDefaultModelIfMissing(cfg) {
+	const currentModel = cfg.agents?.defaults?.model;
+	if (typeof currentModel === "string" ? currentModel : isRecord(currentModel) ? normalizeOptionalString(currentModel.primary) : void 0) return cfg;
+	return {
+		...cfg,
+		agents: {
+			...cfg.agents,
+			defaults: {
+				...cfg.agents?.defaults,
+				model: {
+					...isRecord(currentModel) ? currentModel : {},
+					primary: OPENAI_CODEX_DEFAULT_MODEL
+				}
+			}
+		}
+	};
+}
+function applyOAuthConfigToConfig(cfg, credential, profileId) {
+	let next = mergeMigrationConfigValue(cfg, credential.result.configPatch);
+	const profile = credential.result.profiles[0];
+	if (profile) next = applyAuthProfileConfig(next, {
+		profileId,
+		provider: profile.credential.provider,
+		mode: "oauth",
+		..."email" in profile.credential && profile.credential.email ? { email: profile.credential.email } : {},
+		..."displayName" in profile.credential && profile.credential.displayName ? { displayName: profile.credential.displayName } : {},
+		preferProfileFirst: false
+	});
+	return applyDefaultModelIfMissing(next);
+}
+function applyApiKeyConfigToConfig(cfg, credential, profileId) {
+	return applyAuthProfileConfig(cfg, {
+		profileId,
+		provider: credential.provider,
+		mode: "api_key",
+		displayName: CODEX_IMPORT_DISPLAY_NAME,
+		preferProfileFirst: false
+	});
+}
+function resolveCodexConfigPatchMode(ctx) {
+	const mode = ctx.providerOptions?.configPatchMode;
+	return mode === "none" || mode === "return" ? mode : "apply";
+}
+function allowCodexKeychainPrompt(ctx) {
+	return ctx.providerOptions?.allowKeychainPrompt === true;
+}
+function resolveRequestedCredentialKind(ctx) {
+	const kind = ctx.providerOptions?.credentialKind;
+	return kind === "oauth" || kind === "api_key" ? kind : void 0;
+}
+function authProfileConfigForCredential(credential, profileId) {
+	if (credential.kind === "api_key") return {
+		profileId,
+		provider: credential.provider,
+		mode: "api_key",
+		displayName: CODEX_IMPORT_DISPLAY_NAME
+	};
+	const profile = credential.result.profiles[0];
+	if (!profile || profile.credential.type !== "oauth") return null;
+	return {
+		profileId,
+		provider: profile.credential.provider,
+		mode: "oauth",
+		...profile.credential.email ? { email: profile.credential.email } : {},
+		...profile.credential.displayName ? { displayName: profile.credential.displayName } : {}
+	};
+}
+async function applyCodexAuthProfileConfig(ctx, profile, applyConfig) {
+	const configApi = resolveMigrationConfigRuntime(ctx);
+	if (!configApi?.current || !configApi.mutateConfigFile) return "unavailable";
+	try {
+		await configApi.mutateConfigFile({
+			base: "runtime",
+			afterWrite: { mode: "auto" },
+			mutate(draft) {
+				const current = draft;
+				if (hasAuthProfileConfigConflict(current, profile, Boolean(ctx.overwrite))) throw new CodexAuthConfigConflict();
+				replaceConfigDraft(draft, applyConfig(current));
+			}
+		});
+		return "configured";
+	} catch (error) {
+		return error instanceof CodexAuthConfigConflict ? "conflict" : "unavailable";
+	}
+}
+async function applyCodexAuthConfig(ctx, credential, profileId) {
+	const profile = authProfileConfigForCredential(credential, profileId);
+	if (!profile) return "unavailable";
+	return applyCodexAuthProfileConfig(ctx, profile, (config) => applyCredentialConfig(config, credential, profileId));
+}
+function applyCredentialConfig(config, credential, profileId) {
+	return credential.kind === "oauth" ? applyOAuthConfigToConfig(config, credential, profileId) : applyApiKeyConfigToConfig(config, credential, profileId);
+}
+async function buildCodexAuthItems(params) {
+	const configPatchMode = resolveCodexConfigPatchMode(params.ctx);
+	const credentials = await readCodexAuthCredentials(params.source, {
+		credentialKind: resolveRequestedCredentialKind(params.ctx),
+		includeConfigPatch: configPatchMode !== "none",
+		allowKeychainPrompt: allowCodexKeychainPrompt(params.ctx),
+		signal: params.ctx.signal
+	});
+	if (credentials.length === 0) {
+		const requestedKind = resolveRequestedCredentialKind(params.ctx);
+		if (!requestedKind) return [];
+		const credentialKind = requestedKind;
+		return [createMigrationItem({
+			id: credentialKind === "oauth" ? OPENAI_OAUTH_ITEM_ID : OPENAI_API_KEY_ITEM_ID,
+			kind: "auth",
+			action: "skip",
+			source: params.source.codexHome,
+			status: "skipped",
+			sensitive: true,
+			reason: CODEX_REASON_AUTH_STORAGE_NOT_IMPORTABLE,
+			message: "No supported Codex credential could be imported. Continue with sign-in to connect OpenClaw.",
+			details: {
+				provider: OPENAI_PROVIDER_ID,
+				credentialKind,
+				credentialImportUnavailable: true
+			}
+		})];
+	}
+	const store = loadAuthProfileStoreWithoutExternalProfiles(params.targets.agentDir);
+	const skipped = !params.ctx.includeSecrets;
+	return credentials.map((credential) => {
+		const { profileId, matchedExisting } = itemProfileTarget(credential, store);
+		const existing = store.profiles[profileId];
+		const configProfile = authProfileConfigForCredential(credential, profileId);
+		const configConflict = configProfile ? hasAuthProfileConfigConflict(params.ctx.config, configProfile, Boolean(params.ctx.overwrite)) : false;
+		const conflict = (existing && !matchedExisting && !params.ctx.overwrite || configConflict) && !skipped;
+		const unavailable = !skipped && !conflict && !params.ctx.overwrite && existing?.type === "oauth" && !hasUsableOAuthCredential(existing);
+		return createMigrationItem({
+			id: authItemId(credential),
+			kind: "auth",
+			action: skipped || unavailable ? "skip" : "create",
+			source: params.source.codexHome,
+			target: `${params.targets.agentDir}/openclaw-agent.sqlite#auth_profile_store:${profileId}`,
+			status: skipped || unavailable ? "skipped" : conflict ? "conflict" : "planned",
+			sensitive: true,
+			reason: skipped ? CODEX_REASON_AUTH_NOT_SELECTED : conflict ? CODEX_REASON_AUTH_PROFILE_EXISTS : unavailable ? CODEX_REASON_AUTH_PROFILE_UNUSABLE : void 0,
+			message: unavailable ? "The existing OpenAI sign-in needs to be renewed. Continue with sign-in." : credential.kind === "oauth" ? configPatchMode === "none" ? "Import Codex OAuth credentials." : "Import Codex OAuth credentials and configure OpenAI Codex models." : "Import Codex OpenAI API key.",
+			details: {
+				provider: credential.provider,
+				profileId,
+				sourceProfileId: credential.profileId,
+				sourceCredentialFingerprint: sourceCredentialFingerprint(credential),
+				sourceKind: "codex-native-selected-storage",
+				credentialKind: credential.kind,
+				credentialImportUnavailable: unavailable
+			}
+		});
+	});
+}
+async function applyCodexAuthItems(params) {
+	const { ctx, item, source, targets } = params;
+	if (item.status !== "planned") return [item];
+	const profileId = typeof item.details?.profileId === "string" ? item.details.profileId : "";
+	const provider = typeof item.details?.provider === "string" ? item.details.provider : "";
+	const sourceProfileId = typeof item.details?.sourceProfileId === "string" ? item.details.sourceProfileId : void 0;
+	const credentialKind = item.details?.credentialKind;
+	if (!profileId || !provider || credentialKind !== "oauth" && credentialKind !== "api_key") return [markMigrationItemError(item, CODEX_REASON_MISSING_AUTH_METADATA)];
+	const configPatchMode = resolveCodexConfigPatchMode(ctx);
+	const credential = (await readCodexAuthCredentials(source, {
+		credentialKind,
+		includeConfigPatch: configPatchMode !== "none",
+		allowKeychainPrompt: allowCodexKeychainPrompt(ctx),
+		signal: ctx.signal
+	})).find((candidate) => candidate.provider === provider && candidate.kind === credentialKind && (!sourceProfileId || candidate.profileId === sourceProfileId));
+	if (!credential) return [markMigrationItemSkipped(item, CODEX_REASON_AUTH_NO_LONGER_PRESENT)];
+	if (item.details?.sourceCredentialFingerprint !== sourceCredentialFingerprint(credential)) return [markMigrationItemSkipped(item, CODEX_REASON_AUTH_NO_LONGER_PRESENT)];
+	ctx.signal?.throwIfAborted();
+	const oauthProfile = credential.kind === "oauth" ? credential.result.profiles[0] : void 0;
+	const oauthCredential = oauthProfile?.credential.type === "oauth" ? oauthProfile.credential : void 0;
+	if (credential.kind === "oauth" && !oauthCredential) return [markMigrationItemError(item, CODEX_REASON_MISSING_AUTH_METADATA)];
+	const configProfile = authProfileConfigForCredential(credential, profileId);
+	if (!configProfile) return [markMigrationItemError(item, CODEX_REASON_MISSING_AUTH_METADATA)];
+	if (hasCurrentAuthProfileConfigConflict(ctx, configProfile)) return [markMigrationItemConflict(item, CODEX_REASON_AUTH_PROFILE_EXISTS)];
+	let conflicted = false;
+	let unusable = false;
+	let wrote = false;
+	const store = await updateAuthProfileStoreWithLock({
+		agentDir: targets.agentDir,
+		stateDir: ctx.stateDir,
+		updater: (freshStore) => {
+			ctx.signal?.throwIfAborted();
+			const existing = freshStore.profiles[profileId];
+			if (!ctx.overwrite && existing) {
+				if ((credential.kind === "oauth" ? findMatchingOAuthProfile(freshStore, oauthCredential) : findMatchingApiKeyProfile(freshStore, credential.provider, credential.key)) === profileId) {
+					unusable = existing.type === "oauth" && !hasUsableOAuthCredential(existing);
+					return false;
+				}
+				conflicted = true;
+				return false;
+			}
+			freshStore.profiles[profileId] = credential.kind === "oauth" ? {
+				...oauthCredential,
+				displayName: CODEX_IMPORT_DISPLAY_NAME
+			} : {
+				...buildApiKeyCredential(credential.provider, credential.key),
+				displayName: CODEX_IMPORT_DISPLAY_NAME
+			};
+			wrote = true;
+			return true;
+		}
+	});
+	if (conflicted) return [markMigrationItemConflict(item, CODEX_REASON_AUTH_PROFILE_EXISTS)];
+	if (unusable) return [markMigrationItemSkipped(item, CODEX_REASON_AUTH_PROFILE_UNUSABLE)];
+	if (!store?.profiles[profileId]) return [markMigrationItemError(item, CODEX_REASON_AUTH_PROFILE_WRITE_FAILED)];
+	const configResult = configPatchMode !== "apply" ? "unavailable" : await applyCodexAuthConfig(ctx, credential, profileId);
+	if (configResult === "conflict") return [markMigrationItemConflict(item, CODEX_REASON_AUTH_PROFILE_EXISTS)];
+	const migratedItem = {
+		...item,
+		status: "migrated",
+		details: {
+			...item.details,
+			wroteAuthProfile: wrote,
+			configUpdated: configResult === "configured",
+			...configPatchMode === "return" ? { configPatchReturned: true } : {}
+		}
+	};
+	return [migratedItem, ...configPatchMode === "return" ? buildCodexAuthConfigPatchItems(ctx, migratedItem, credential, profileId) : []];
+}
+function buildCodexAuthConfigPatchItems(ctx, item, credential, profileId) {
+	const next = applyCredentialConfig(ctx.config, credential, profileId);
+	const items = [];
+	if (next.auth) items.push(createMigrationItem({
+		id: `${item.id}:config:auth`,
+		kind: "config",
+		action: "merge",
+		status: "migrated",
+		target: "auth",
+		message: "Configure imported Codex auth profile.",
+		details: {
+			path: ["auth"],
+			value: next.auth
+		}
+	}));
+	if (next.agents?.defaults) items.push(createMigrationItem({
+		id: `${item.id}:config:agents-defaults`,
+		kind: "config",
+		action: "merge",
+		status: "migrated",
+		target: "agents.defaults",
+		message: "Configure imported Codex models.",
+		details: {
+			path: ["agents", "defaults"],
+			value: next.agents.defaults
+		}
+	}));
+	return items;
+}
+//#endregion
+//#region extensions/codex/src/migration/targets.ts
+function resolveCodexMigrationTargets(ctx) {
+	const cfg = ctx.config;
+	const agentId = ctx.targetAgentId ?? resolveDefaultAgentId(cfg);
+	const workspaceDir = resolveAgentWorkspaceDir(cfg, agentId);
+	const configuredAgentDir = resolveAgentConfig(cfg, agentId)?.agentDir?.trim();
+	return {
+		workspaceDir,
+		agentDir: ctx.runtime?.agent?.resolveAgentDir(cfg, agentId) ?? (configuredAgentDir ? resolveHomePath(configuredAgentDir) : void 0) ?? path.join(ctx.stateDir, "agents", agentId, "agent")
+	};
+}
+//#endregion
+//#region extensions/codex/src/migration/plan.ts
+const CODEX_PLUGIN_CONFIG_ITEM_ID = "config:codex-plugins";
+const CODEX_PLUGIN_CONFIG_PATH = [
+	"plugins",
+	"entries",
+	"codex"
+];
+const CODEX_PLUGIN_ENABLED_PATH = [
+	"plugins",
+	"entries",
+	"codex",
+	"enabled"
+];
+const CODEX_PLUGIN_NATIVE_CONFIG_PATH = [
+	"plugins",
+	"entries",
+	"codex",
+	"config",
+	"codexPlugins"
+];
+const MIGRATION_REASON_PLUGIN_EXISTS = "plugin exists";
+const CODEX_PLUGIN_SOURCE_APP_VERIFICATION_UNVERIFIED = "not_run";
+const MIGRATION_REASON_TARGET_NOT_REGULAR = "target is not a regular file";
+async function lstatIfExists(filePath) {
+	try {
+		return await fs.lstat(filePath);
+	} catch (error) {
+		const code = extractErrorCode(error);
+		if (code === "ENOENT" || code === "ENOTDIR") return;
+		throw error;
+	}
+}
+async function buildCodexMemoryItems(params) {
+	const items = [];
+	for (const memory of params.memoryFiles) {
+		const target = path.join(params.workspaceDir, "memory", "imports", "codex", path.basename(memory.path));
+		const targetStat = await lstatIfExists(target);
+		const targetNotRegular = targetStat !== void 0 && !targetStat.isFile();
+		if (!targetNotRegular) {
+			const [source, workspace, destination] = await Promise.all([
+				fs.realpath(path.dirname(memory.path)),
+				canonicalPathFromExistingAncestor(params.workspaceDir),
+				canonicalPathFromExistingAncestor(target)
+			]);
+			if (!isPathInside(workspace, destination)) throw new Error("Codex memory import destination must stay in the selected workspace.");
+			if (isPathInside(source, destination) || isPathInside(destination, source)) throw new Error("Codex memory source and OpenClaw import destination must be separate paths.");
+		}
+		const targetConflict = targetStat !== void 0 && !params.overwrite;
+		items.push(createMigrationItem({
+			id: memory.id,
+			kind: "memory",
+			action: "copy",
+			source: memory.path,
+			target,
+			status: targetNotRegular || targetConflict ? "conflict" : "planned",
+			reason: targetNotRegular ? MIGRATION_REASON_TARGET_NOT_REGULAR : targetConflict ? MIGRATION_REASON_TARGET_EXISTS : void 0,
+			message: "Copy consolidated Codex memory into the OpenClaw memory index.",
+			details: {
+				sourceType: "codex-memory",
+				sourceLabel: memory.label,
+				collectionId: "codex",
+				collectionLabel: "Codex",
+				relativePath: path.basename(memory.path)
+			}
+		}));
+	}
+	return items;
+}
+function uniqueSkillName(skill, counts) {
+	const base = sanitizeName(skill.name) || "codex-skill";
+	if ((counts.get(base) ?? 0) <= 1) return base;
+	const parent = sanitizeName(path.basename(path.dirname(skill.source)));
+	return sanitizeName([
+		"codex",
+		parent,
+		base
+	].filter(Boolean).join("-")) || base;
+}
+async function buildCodexSkillItems(params) {
+	const counts = /* @__PURE__ */ new Map();
+	for (const skill of params.skills) {
+		const base = sanitizeName(skill.name) || "codex-skill";
+		counts.set(base, (counts.get(base) ?? 0) + 1);
+	}
+	const planned = params.skills.map((skill) => {
+		const name = uniqueSkillName(skill, counts);
+		return {
+			skill,
+			name,
+			target: path.join(params.workspaceDir, "skills", name)
+		};
+	});
+	const resolvedCounts = planned.reduce((resolved, item) => {
+		resolved.set(item.name, (resolved.get(item.name) ?? 0) + 1);
+		return resolved;
+	}, /* @__PURE__ */ new Map());
+	return await Promise.all(planned.map(async (item) => {
+		const collision = (resolvedCounts.get(item.name) ?? 0) > 1;
+		const targetExists = await exists(item.target);
+		const conflict = collision || targetExists && !params.overwrite;
+		return createMigrationItem({
+			id: `skill:${item.name}`,
+			kind: "skill",
+			action: "copy",
+			source: item.skill.source,
+			target: item.target,
+			status: conflict ? "conflict" : "planned",
+			reason: collision ? `multiple Codex skills normalize to "${item.name}"` : conflict ? MIGRATION_REASON_TARGET_EXISTS : void 0,
+			message: `Copy ${item.skill.sourceLabel} into this OpenClaw agent workspace.`,
+			details: {
+				skillName: item.name,
+				sourceLabel: item.skill.sourceLabel
+			}
+		});
+	}));
+}
+function readExistingCodexPluginEntries(config) {
+	const entries = readMigrationConfigPath(config, [...CODEX_PLUGIN_NATIVE_CONFIG_PATH, "plugins"]);
+	return isRecord(entries) ? entries : {};
+}
+function hasExistingCodexPluginEntry(existingEntries, configKey, pluginName, nextEntry) {
+	const existingEntry = existingEntries[configKey];
+	if (existingEntry !== void 0) return !isLegacyDestructivePolicyRepair(existingEntry, nextEntry);
+	return Object.values(existingEntries).some((entry) => {
+		if (!isRecord(entry)) return false;
+		return entry.pluginName === pluginName;
+	});
+}
+function isLegacyDestructivePolicyRepair(existing, nextEntry) {
+	const existingEntry = isRecord(existing) ? existing : void 0;
+	if (existingEntry?.allow_destructive_actions !== "on-request" || nextEntry.allow_destructive_actions !== "auto") return false;
+	const normalizedExisting = {
+		...existingEntry,
+		allow_destructive_actions: "auto"
+	};
+	const normalizedEntries = Object.entries(normalizedExisting);
+	return normalizedEntries.length === Object.keys(nextEntry).length && normalizedEntries.every(([key, value]) => nextEntry[key] === value);
+}
+function readExistingPluginAllowDestructiveActions(existing, pluginName) {
+	const existingEntry = isRecord(existing) ? existing : void 0;
+	if (existingEntry?.pluginName !== pluginName) return;
+	const normalized = normalizeExistingAllowDestructiveActions(existingEntry.allow_destructive_actions);
+	return normalized === "auto" || normalized === "ask" ? normalized : void 0;
+}
+function buildPluginItems(ctx, plugins) {
+	const existingPluginEntries = readExistingCodexPluginEntries(ctx.config);
+	let manualIndex = 0;
+	const items = [];
+	for (const plugin of plugins) {
+		if (plugin.migratable && plugin.marketplaceName === "openai-curated" && plugin.pluginName) {
+			const configKey = plugin.pluginName;
+			const plannedEntry = {
+				enabled: true,
+				marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
+				pluginName: plugin.pluginName,
+				...(() => {
+					const allowDestructiveActions = readExistingPluginAllowDestructiveActions(existingPluginEntries[configKey], plugin.pluginName);
+					return allowDestructiveActions ? { allow_destructive_actions: allowDestructiveActions } : {};
+				})()
+			};
+			const conflict = !ctx.overwrite && hasExistingCodexPluginEntry(existingPluginEntries, configKey, plugin.pluginName, plannedEntry);
+			items.push(createMigrationItem({
+				id: `plugin:${configKey}`,
+				kind: "plugin",
+				action: "install",
+				status: conflict ? "conflict" : "planned",
+				reason: conflict ? MIGRATION_REASON_PLUGIN_EXISTS : void 0,
+				applyPhase: "after-promotion",
+				source: plugin.source,
+				target: `plugins.entries.codex.config.codexPlugins.plugins.${configKey}`,
+				message: `Install Codex plugin "${plugin.pluginName}" in the OpenClaw-managed Codex app-server runtime.`,
+				details: {
+					configKey,
+					marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
+					pluginName: plugin.pluginName,
+					sourceInstalled: plugin.installed === true,
+					sourceEnabled: plugin.enabled === true,
+					...plannedEntry.allow_destructive_actions === "auto" || plannedEntry.allow_destructive_actions === "ask" ? { allowDestructiveActions: plannedEntry.allow_destructive_actions } : {},
+					...plugin.apps && plugin.apps.length > 0 && !shouldVerifyPluginApps(ctx) ? { sourceAppVerification: CODEX_PLUGIN_SOURCE_APP_VERIFICATION_UNVERIFIED } : {}
+				}
+			}));
+			continue;
+		}
+		manualIndex += 1;
+		if (plugin.migrationBlock && plugin.pluginName) {
+			items.push(createMigrationItem({
+				id: `plugin:${sanitizeName(plugin.name) || sanitizeName(path.basename(plugin.source))}:${manualIndex}`,
+				kind: "manual",
+				action: "manual",
+				source: plugin.source,
+				status: "skipped",
+				reason: plugin.migrationBlock.code,
+				message: plugin.message ?? `Codex native plugin "${plugin.name}" was found but not activated automatically.`,
+				details: {
+					pluginName: plugin.pluginName,
+					marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
+					...plugin.migrationBlock.apps ? { apps: plugin.migrationBlock.apps } : {},
+					...plugin.migrationBlock.error ? { error: plugin.migrationBlock.error } : {}
+				}
+			}));
+			continue;
+		}
+		items.push(createMigrationManualItem({
+			id: `plugin:${sanitizeName(plugin.name) || sanitizeName(path.basename(plugin.source))}:${manualIndex}`,
+			source: plugin.source,
+			message: plugin.message ?? `Codex native plugin "${plugin.name}" was found but not activated automatically.`,
+			recommendation: "Review the plugin bundle first, then install trusted compatible plugins with openclaw plugins install <path> --force."
+		}));
+	}
+	return items;
+}
+function shouldVerifyPluginApps(ctx) {
+	return ctx.providerOptions?.verifyPluginApps === true;
+}
+function readCodexPluginMigrationConfigEntry(item, enabled) {
+	const configKey = item.details?.configKey;
+	const marketplaceName = item.details?.marketplaceName;
+	const pluginName = item.details?.pluginName;
+	if (item.kind !== "plugin" || item.action !== "install" || typeof configKey !== "string" || marketplaceName !== "openai-curated" || typeof pluginName !== "string") return;
+	const allowDestructiveActions = item.details?.allowDestructiveActions;
+	return {
+		configKey,
+		pluginName,
+		enabled,
+		...allowDestructiveActions === "auto" || allowDestructiveActions === "ask" ? { allowDestructiveActions } : {}
+	};
+}
+function readExistingAllowDestructiveActions(config) {
+	return normalizeExistingAllowDestructiveActions(readMigrationConfigPath(config, [...CODEX_PLUGIN_NATIVE_CONFIG_PATH, "allow_destructive_actions"]));
+}
+function normalizeExistingAllowDestructiveActions(value) {
+	if (value === "auto" || value === "on-request") return "auto";
+	if (value === "ask") return "ask";
+	return asBoolean(value);
+}
+function readExistingPluginPolicyRepairs(config) {
+	return Object.fromEntries(Object.entries(readExistingCodexPluginEntries(config)).flatMap(([configKey, entry]) => {
+		const pluginEntry = isRecord(entry) ? entry : void 0;
+		if (pluginEntry?.allow_destructive_actions !== "on-request") return [];
+		return [[configKey, {
+			...pluginEntry,
+			allow_destructive_actions: "auto"
+		}]];
+	}));
+}
+function buildCodexPluginsConfigValue(entries, config) {
+	const plugins = {
+		...readExistingPluginPolicyRepairs(config),
+		...Object.fromEntries(entries.toSorted((a, b) => a.configKey.localeCompare(b.configKey)).map((entry) => [entry.configKey, {
+			enabled: entry.enabled,
+			marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
+			pluginName: entry.pluginName,
+			...entry.allowDestructiveActions ? { allow_destructive_actions: entry.allowDestructiveActions } : {}
+		}]))
+	};
+	return {
+		enabled: true,
+		config: { codexPlugins: {
+			enabled: true,
+			allow_destructive_actions: readExistingAllowDestructiveActions(config) ?? true,
+			plugins
+		} }
+	};
+}
+function hasCodexPluginConfigConflict(config, value) {
+	const enabled = readMigrationConfigPath(config, CODEX_PLUGIN_ENABLED_PATH);
+	if (enabled !== void 0 && enabled !== true) return true;
+	const nativeConfig = value.config?.codexPlugins;
+	if (!isRecord(nativeConfig)) return hasMigrationConfigPatchConflict(config, CODEX_PLUGIN_NATIVE_CONFIG_PATH, nativeConfig);
+	const existingNativeConfig = readMigrationConfigPath(config, CODEX_PLUGIN_NATIVE_CONFIG_PATH);
+	if (existingNativeConfig === void 0) return false;
+	if (!isRecord(existingNativeConfig)) return true;
+	if (existingNativeConfig.enabled !== void 0 && existingNativeConfig.enabled !== true) return true;
+	const allowDestructiveActions = nativeConfig.allow_destructive_actions;
+	const existingAllowDestructiveActions = normalizeExistingAllowDestructiveActions(existingNativeConfig.allow_destructive_actions);
+	if (existingNativeConfig.allow_destructive_actions !== void 0 && existingAllowDestructiveActions !== allowDestructiveActions) return true;
+	const plugins = nativeConfig.plugins;
+	if (!isRecord(plugins)) return false;
+	return Object.entries(plugins).some(([configKey, plugin]) => {
+		if (!isRecord(plugin)) return existingNativeConfig[configKey] !== void 0;
+		return hasExistingCodexPluginEntry(readExistingCodexPluginEntries(config), configKey, typeof plugin.pluginName === "string" ? plugin.pluginName : configKey, plugin);
+	});
+}
+function buildPluginConfigItem(ctx, pluginItems) {
+	const entries = pluginItems.filter((item) => item.status === "planned").map((item) => readCodexPluginMigrationConfigEntry(item, true)).filter((entry) => entry !== void 0);
+	if (entries.length === 0) return;
+	const value = buildCodexPluginsConfigValue(entries, ctx.config);
+	const conflict = !ctx.overwrite && hasCodexPluginConfigConflict(ctx.config, value);
+	return createMigrationItem({
+		id: CODEX_PLUGIN_CONFIG_ITEM_ID,
+		kind: "config",
+		action: "merge",
+		target: "plugins.entries.codex.config.codexPlugins",
+		status: conflict ? "conflict" : "planned",
+		reason: conflict ? MIGRATION_REASON_TARGET_EXISTS : void 0,
+		applyPhase: "after-promotion",
+		message: "Enable OpenClaw's Codex plugin integration and record migrated source-installed curated plugins.",
+		details: {
+			path: [...CODEX_PLUGIN_CONFIG_PATH],
+			value
+		}
+	});
+}
+async function buildCodexMigrationPlan(ctx) {
+	const targets = resolveCodexMigrationTargets(ctx);
+	const memoryOnly = ctx.itemKinds !== void 0 && ctx.itemKinds.length > 0 && ctx.itemKinds.every((kind) => kind === "memory");
+	const authOnly = ctx.itemKinds !== void 0 && ctx.itemKinds.length > 0 && ctx.itemKinds.every((kind) => kind === "auth");
+	const source = await discoverCodexSource({
+		input: ctx.source,
+		memoryOnly,
+		authOnly,
+		evaluatePluginMigrationEligibility: !memoryOnly && !authOnly,
+		verifyPluginApps: shouldVerifyPluginApps(ctx)
+	});
+	if (!hasCodexSource(source) && !authOnly) throw new Error(`Codex state was not found at ${source.root}. Pass --from <path> if it lives elsewhere.`);
+	const items = [];
+	if (!authOnly) items.push(...await buildCodexMemoryItems({
+		memoryFiles: source.memoryFiles,
+		workspaceDir: targets.workspaceDir,
+		overwrite: ctx.overwrite
+	}));
+	if (!memoryOnly) items.push(...await buildCodexAuthItems({
+		ctx,
+		source,
+		targets
+	}));
+	if (!memoryOnly && !authOnly) {
+		items.push(...await buildCodexSkillItems({
+			skills: source.skills,
+			workspaceDir: targets.workspaceDir,
+			overwrite: ctx.overwrite
+		}));
+		const pluginItems = buildPluginItems(ctx, source.plugins);
+		items.push(...pluginItems);
+		const pluginConfigItem = buildPluginConfigItem(ctx, pluginItems);
+		if (pluginConfigItem) items.push(pluginConfigItem);
+		for (const archivePath of source.archivePaths) items.push(createMigrationItem({
+			id: archivePath.id,
+			kind: "archive",
+			action: "archive",
+			source: archivePath.path,
+			message: archivePath.message ?? "Archived in the migration report for manual review; not imported into live config.",
+			details: { archiveRelativePath: archivePath.relativePath }
+		}));
+	}
+	const warnings = [
+		...!ctx.includeSecrets && items.some((item) => item.kind === "auth") ? ["Auth credentials were detected but skipped. Re-run interactively or pass --include-secrets to import supported credentials."] : [],
+		...items.some((item) => item.status === "conflict") ? ["Conflicts were found. Re-run with --overwrite to replace conflicting migration targets after item-level backups."] : [],
+		...source.pluginDiscoveryError ? [`Codex app-server plugin inventory discovery failed: ${source.pluginDiscoveryError}. Cached plugin bundles, if any, are advisory only.`] : [],
+		...source.plugins.some((plugin) => plugin.migrationBlock?.code === "codex_subscription_required") ? [codexPluginMigrationSubscriptionWarning()] : []
+	];
+	return {
+		providerId: "codex",
+		source: source.root,
+		target: targets.workspaceDir,
+		summary: summarizeMigrationItems(items),
+		items,
+		warnings,
+		nextSteps: memoryOnly ? [] : ["Run openclaw doctor after applying the migration.", "Review skipped or auth-required Codex plugin/config/hook items before exposing them in OpenClaw sessions."],
+		metadata: {
+			agentDir: targets.agentDir,
+			codexHome: source.codexHome,
+			codexSkillsDir: source.codexSkillsDir,
+			personalAgentsSkillsDir: source.personalAgentsSkillsDir
+		}
+	};
+}
+//#endregion
+export { CODEX_PLUGIN_CONFIG_ITEM_ID, CODEX_PLUGIN_CONFIG_PATH, buildCodexMigrationPlan, buildCodexPluginsConfigValue, hasCodexPluginConfigConflict, applyCodexAuthItems as n, resolveCodexConfigPatchMode as r, readCodexPluginMigrationConfigEntry, resolveCodexMigrationTargets as t };