@openclaw/codex 2026.9.2 → 2026.9.4

package/dist/plugin-activation-BYQculil.js

@@ -0,0 +1,138 @@
+import { c as CODEX_PLUGINS_MARKETPLACE_NAME, i as pluginReadParams, n as isOpenAiCuratedMarketplace, r as isOpenAiCuratedMarketplaceName, t as findCodexMarketplacePluginSummary } from "./plugin-inventory-oL4Na1ZG.js";
+import { t as CodexAppServerRpcError } from "./rpc-error-ttN_QjEm.js";
+import "./config-oIORaQ5T.js";
+import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
+//#region extensions/codex/src/app-server/plugin-activation.ts
+/**
+* Activates legacy curated Codex plugins while requiring owner-managed
+* installation for every other marketplace.
+*/
+/** Activates legacy curated plugins without granting install authority to other marketplaces. */
+async function ensureCodexPluginActivation(params) {
+	if (params.identity.marketplaceName === "workspace-directory") return activationFailure(params.identity, "disabled", { message: "workspace-directory plugins must be installed and enabled outside OpenClaw before use." });
+	if (!isOpenAiCuratedMarketplaceName(params.identity.marketplaceName)) {
+		const target = params.identity.pluginName.endsWith(`@${params.identity.marketplaceName}`) ? params.identity.pluginName : `${params.identity.pluginName}@${params.identity.marketplaceName}`;
+		return activationFailure(params.identity, "disabled", { message: `${params.identity.marketplaceName} plugins must be installed and enabled by an owner before use. Run /codex plugins install ${target}.` });
+	}
+	const listed = await listCuratedCodexPluginMetadata(params);
+	const resolved = findCodexMarketplacePluginSummary(listed, params.identity.marketplaceName, params.identity.pluginName);
+	if (!resolved) {
+		if (!listed.marketplaces.some((marketplace) => isOpenAiCuratedMarketplace(marketplace))) return activationFailure(params.identity, "marketplace_missing", { message: `Codex marketplace ${CODEX_PLUGINS_MARKETPLACE_NAME} was not found.` });
+		return activationFailure(params.identity, "plugin_missing", { message: `${params.identity.pluginName} was not found in ${CODEX_PLUGINS_MARKETPLACE_NAME}.` });
+	}
+	if (resolved.marketplace.remoteMarketplaceName && !resolved.summary.remotePluginId) return activationFailure(params.identity, "plugin_missing", { message: `${params.identity.pluginName} detail unavailable: Codex did not return a remote plugin id.` });
+	if (resolved.summary.availability === "DISABLED_BY_ADMIN" || resolved.summary.installPolicy === "NOT_AVAILABLE") return activationFailure(params.identity, "disabled", { message: `${params.identity.pluginName} was disabled or made unavailable by its marketplace administrator.` });
+	if (resolved.summary.installed && resolved.summary.enabled && !params.installEvenIfActive) return {
+		identity: params.identity,
+		ok: true,
+		reason: "already_active",
+		installAttempted: false,
+		marketplace: resolved.marketplace,
+		diagnostics: []
+	};
+	const remotePluginId = resolved.marketplace.remoteMarketplaceName ? resolved.summary.remotePluginId : void 0;
+	let installResponse;
+	try {
+		installResponse = await params.request("plugin/install", pluginReadParams(resolved.marketplace, remotePluginId ?? params.identity.pluginName));
+	} catch (error) {
+		if (!(error instanceof CodexAppServerRpcError) || error.code !== -32600 || !remotePluginId || error.message !== `remote plugin ${remotePluginId} is disabled by admin` && error.message !== `remote plugin ${remotePluginId} is not available for install`) throw error;
+		return {
+			identity: params.identity,
+			ok: false,
+			reason: "install_failed",
+			installAttempted: true,
+			marketplace: resolved.marketplace,
+			diagnostics: [{ message: `Codex plugin install failed: ${coerceErrorMessage(error)}` }]
+		};
+	}
+	if (params.metadataCache && params.appCacheKey) params.metadataCache.invalidate(params.appCacheKey);
+	const refreshDiagnostics = [];
+	let refreshFailed = false;
+	try {
+		const refreshResult = await refreshCodexPluginRuntimeState({
+			request: params.request,
+			appCache: params.appCache,
+			appCacheKey: params.appCacheKey,
+			configCwd: params.configCwd,
+			metadataCache: params.metadataCache,
+			deferAppInventoryRefresh: params.deferAppInventoryRefresh,
+			targetAppIds: params.targetAppIds
+		});
+		refreshDiagnostics.push(...refreshResult.diagnostics);
+	} catch (error) {
+		refreshFailed = true;
+		refreshDiagnostics.push({ message: `Codex plugin runtime refresh failed after install: ${coerceErrorMessage(error)}` });
+	}
+	const authRequired = installResponse.appsNeedingAuth.length > 0;
+	return {
+		identity: params.identity,
+		ok: !authRequired && !refreshFailed,
+		reason: refreshFailed ? "refresh_failed" : authRequired ? "auth_required" : resolved.summary.installed && resolved.summary.enabled ? "already_active" : "installed",
+		installAttempted: true,
+		marketplace: resolved.marketplace,
+		installResponse,
+		diagnostics: [...refreshDiagnostics, ...installResponse.appsNeedingAuth.map((app) => ({ message: `${app.name} requires app authentication before plugin tools are exposed.` }))]
+	};
+}
+/** Forces Codex plugin, skill, hook, MCP, and app inventory refreshes after activation. */
+async function refreshCodexPluginRuntimeState(params) {
+	const diagnostics = [];
+	await listCuratedCodexPluginMetadata(params, { forceRefetch: true });
+	await params.request("skills/list", {
+		cwds: params.configCwd ? [params.configCwd] : [],
+		forceReload: true
+	});
+	try {
+		await params.request("hooks/list", { cwds: params.configCwd ? [params.configCwd] : [] });
+	} catch (error) {
+		diagnostics.push({ message: `Codex hooks refresh skipped: ${coerceErrorMessage(error)}` });
+	}
+	await params.request("config/mcpServer/reload", void 0);
+	if (params.appCache && params.appCacheKey) try {
+		await refreshCodexAppRuntimeState({
+			...params,
+			appCache: params.appCache,
+			appCacheKey: params.appCacheKey
+		});
+	} catch (error) {
+		diagnostics.push({ message: `Codex app inventory refresh skipped: ${coerceErrorMessage(error)}` });
+	}
+	return { diagnostics };
+}
+/** Refreshes hosted app tools without reloading unrelated active threads. */
+async function refreshCodexAppRuntimeState(params) {
+	params.appCache.invalidate(params.appCacheKey, "Codex plugin app inventory refresh requested", void 0, params.targetAppIds);
+	if (params.deferAppInventoryRefresh) return;
+	const request = async (method, requestParams) => await params.request(method, requestParams);
+	await params.appCache.refreshNow({
+		key: params.appCacheKey,
+		request,
+		forceRefetch: true,
+		targetAppIds: params.targetAppIds
+	});
+}
+async function listCuratedCodexPluginMetadata(params, options = {}) {
+	const requestParams = {
+		...params.configCwd ? { cwds: [params.configCwd] } : {},
+		...options.forceRefetch ? { forceRefetch: true } : {}
+	};
+	if (!params.metadataCache || !params.appCacheKey) return await params.request("plugin/list", requestParams);
+	return (await params.metadataCache.load({
+		appCacheKey: params.appCacheKey,
+		queryKind: "curated-global",
+		requestParams,
+		request: async (method, listedParams) => await params.request(method, listedParams),
+		cacheable: (response) => response.marketplaces.some((marketplace) => isOpenAiCuratedMarketplace(marketplace))
+	})).response;
+}
+function activationFailure(identity, reason, diagnostic, extraDiagnostics = []) {
+	return {
+		identity,
+		ok: false,
+		reason,
+		installAttempted: false,
+		diagnostics: [diagnostic, ...extraDiagnostics]
+	};
+}
+//#endregion
+export { refreshCodexAppRuntimeState as n, refreshCodexPluginRuntimeState as r, ensureCodexPluginActivation as t };

package/dist/{thread-resume-BLgqkUc1.js → plugin-app-cache-key-d0eKxy7b.js}

@@ -1,14 +1,11 @@
-import { M as resolveCodexAppServerHomeDir, N as resolveCodexAppServerLocalHomeDir, P as resolveCodexAppServerUserHomeDir } from "./config-CyapYSji.js";
-import { H as isCodexAppServerOverloadError, M as isCodexAppServerStartupError, U as isCodexAppServerPrewriteRequestCancellationError, q as CodexAppServerRpcError, tt as assertCodexThreadResumeResponse, u as isCodexAppServerStartSelectionChangedError } from "./shared-client-CKhX2kFt.js";
-import { d as unsubscribeCodexThreadBestEffort, i as assertCodexThreadResumeSubscription, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-Bp1ZOnk2.js";
-import { t as CodexAppServerScopedRequestRejectedError } from "./request-C8H22rPi.js";
+import { c as resolveCodexAppServerLocalHomeDir, l as resolveCodexAppServerUserHomeDir, s as resolveCodexAppServerHomeDir } from "./protocol-5bh1G-H7.js";
 import { createRequire } from "node:module";
 import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash } from "node:crypto";
+import { OPENCLAW_VERSION, embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-registration";
 import { isFutureDateTimestampMs, resolveDateTimestampMs, resolveExpiresAtMsFromDurationMs } from "openclaw/plugin-sdk/number-runtime";
-import { readPluginPackageVersion } from "openclaw/plugin-sdk/extension-shared";
-import { OPENCLAW_VERSION, embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
+import { readPluginPackageVersion } from "openclaw/plugin-sdk/extension-shared";
 //#region extensions/codex/src/app-server/app-inventory-cache.ts
 /**
 * Process-local cache for Codex app-server app inventories, keyed by runtime
@@ -427,49 +424,4 @@ function fingerprintCodexPluginAppCacheCredentials(startOptions) {
 	return `sha256:${hash.digest("hex")}`;
 }
 //#endregion
-//#region extensions/codex/src/app-server/thread-resume.ts
-/** Owns Codex thread/resume subscription safety. */
-/** Resumes one thread, releasing or isolating every possible native subscription. */
-async function resumeCodexAppServerThread(params) {
-	const threadId = params.request.threadId;
-	let response;
-	let ownershipRejected = false;
-	const assertCurrent = params.assertCurrent && (() => {
-		try {
-			params.assertCurrent?.();
-		} catch (error) {
-			ownershipRejected = true;
-			throw error;
-		}
-	});
-	try {
-		response = assertCodexThreadResumeResponse(await (params.requestResume ? params.requestResume(params.request) : params.client.request("thread/resume", params.request, {
-			...params.timeoutMs !== void 0 ? { timeoutMs: params.timeoutMs } : {},
-			...params.signal ? { signal: params.signal } : {},
-			assertCurrent
-		})));
-		assertCodexThreadResumeSubscription(threadId, response.thread.id);
-	} catch (error) {
-		if (ownershipRejected || isCodexAppServerStartSelectionChangedError(error) || isCodexAppServerStartupError(error) || error instanceof CodexAppServerScopedRequestRejectedError || isCodexAppServerPrewriteRequestCancellationError(error) || isCodexAppServerOverloadError(error)) throw error;
-		if (error instanceof CodexAppServerRpcError) {
-			if (await unsubscribeCodexThreadBestEffort(params.client, {
-				threadId,
-				timeoutMs: 5e3,
-				assertCurrent: params.assertCurrent
-			}).catch(() => false)) {
-				params.onSubscriptionReleased?.();
-				throw error;
-			}
-		}
-		try {
-			await params.abandonClient();
-		} catch (abandonError) {
-			throw new CodexAppServerUnsafeSubscriptionError(`Codex thread/resume client could not be retired for ${threadId}`, { cause: abandonError });
-		}
-		if (error instanceof CodexAppServerUnsafeSubscriptionError) throw error;
-		throw new CodexAppServerUnsafeSubscriptionError(error instanceof Error ? error.message : `Codex thread/resume outcome is indeterminate for ${threadId}`, { cause: error });
-	}
-	return response;
-}
-//#endregion
-export { replaceCodexCatalogConnectionHomes as a, defaultCodexAppInventoryCache as c, buildCodexPluginAppCacheKey as i, serializeCodexAppInventoryError as l, buildCodexAppServerConnectionFingerprint as n, resolveCodexCatalogConnectionHome as o, buildCodexAppServerRuntimeFingerprint as r, CodexAppInventoryCache as s, resumeCodexAppServerThread as t };
+export { resolveCodexCatalogConnectionHome as a, serializeCodexAppInventoryError as c, replaceCodexCatalogConnectionHomes as i, buildCodexAppServerRuntimeFingerprint as n, CodexAppInventoryCache as o, buildCodexPluginAppCacheKey as r, defaultCodexAppInventoryCache as s, buildCodexAppServerConnectionFingerprint as t };

package/dist/{plugin-approval-roundtrip-aQVdyL5g.js → plugin-approval-roundtrip-Bz3FT8W5.js}

@@ -1,4 +1,4 @@
-import { N as resolveCodexGatewayTimeoutWithGraceMs } from "./shared-client-CKhX2kFt.js";
+import { P as resolveCodexGatewayTimeoutWithGraceMs } from "./shared-client-CscigXXL.js";
 import { isApprovalNotFoundError, toErrorObject } from "openclaw/plugin-sdk/error-runtime";
 import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 //#region extensions/codex/src/app-server/plugin-approval-roundtrip.ts

package/dist/plugin-inventory-oL4Na1ZG.js

@@ -0,0 +1,328 @@
+import { S as resolveCodexPluginsPolicy } from "./protocol-5bh1G-H7.js";
+import "./config-oIORaQ5T.js";
+import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
+//#region extensions/codex/src/app-server/config-contracts.ts
+const CODEX_PLUGINS_MARKETPLACE_NAME = "openai-curated";
+const CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME = "workspace-directory";
+//#endregion
+//#region extensions/codex/src/app-server/plugin-inventory.ts
+/**
+* Reads Codex plugin marketplace state and app inventory to decide which
+* plugin-owned apps can be exposed to a native Codex thread.
+*/
+const CODEX_PLUGINS_REMOTE_MARKETPLACE_NAME = `${CODEX_PLUGINS_MARKETPLACE_NAME}-remote`;
+const CODEX_PLUGINS_API_MARKETPLACE_NAME = "openai-api-curated";
+/** Reads configured Codex plugin state and maps owned apps to readiness diagnostics. */
+async function readCodexPluginInventory(params) {
+	const policy = params.policy ?? resolveCodexPluginsPolicy(params.pluginConfig);
+	if (!policy.enabled) return {
+		policy,
+		records: [],
+		diagnostics: [{
+			code: "disabled",
+			message: "Native Codex plugin support is disabled."
+		}]
+	};
+	const appInventory = readCachedAppInventory(params);
+	const installedPlugins = await readInstalledCodexPluginMetadata({
+		...params,
+		policy
+	});
+	const pluginCatalogs = /* @__PURE__ */ new Map();
+	const diagnostics = [];
+	const records = [];
+	if (appInventory?.state === "missing") diagnostics.push({
+		code: "app_inventory_missing",
+		message: "Cached Codex app inventory is missing; plugin apps are excluded for this setup."
+	});
+	else if (appInventory?.state === "stale") diagnostics.push({
+		code: "app_inventory_stale",
+		message: "Cached Codex app inventory is stale; using stale app readiness and refreshing."
+	});
+	for (const pluginPolicy of policy.pluginPolicies) {
+		if (!pluginPolicy.enabled && !policy.allowAllPlugins) continue;
+		let listed = installedPlugins;
+		let resolvedPlugin = findConfiguredMarketplacePlugin(listed, pluginPolicy);
+		if (!resolvedPlugin && pluginPolicy.enabled && pluginPolicy.marketplaceName !== "workspace-directory") {
+			const requestParams = buildPluginCatalogRequestParams(params, pluginPolicy.marketplaceName);
+			const catalogKey = JSON.stringify([requestParams, pluginMetadataCatalogScope(pluginPolicy.marketplaceName)]);
+			let catalog = pluginCatalogs.get(catalogKey);
+			if (!catalog) {
+				catalog = listCodexPluginMetadata(params, pluginPolicy.marketplaceName);
+				pluginCatalogs.set(catalogKey, catalog);
+			}
+			listed = await catalog;
+			resolvedPlugin = findConfiguredMarketplacePlugin(listed, pluginPolicy);
+		}
+		if (!listed.marketplaces.some((marketplace) => marketplaceMatchesConfiguredName(marketplace, pluginPolicy.marketplaceName))) {
+			diagnostics.push({
+				code: "marketplace_missing",
+				plugin: pluginPolicy,
+				message: `Codex marketplace ${pluginPolicy.marketplaceName} was not found.`
+			});
+			continue;
+		}
+		if (!resolvedPlugin) {
+			diagnostics.push({
+				code: "plugin_missing",
+				plugin: pluginPolicy,
+				message: `${pluginPolicy.pluginName} was not found in ${pluginPolicy.marketplaceName}.`
+			});
+			continue;
+		}
+		const { summary } = resolvedPlugin;
+		const unavailableByMarketplacePolicy = summary.availability === "DISABLED_BY_ADMIN" || summary.installPolicy === "NOT_AVAILABLE";
+		if (unavailableByMarketplacePolicy) {
+			diagnostics.push({
+				code: "plugin_disabled",
+				plugin: pluginPolicy,
+				message: `${pluginPolicy.pluginName} is unavailable in ${pluginPolicy.marketplaceName}.`
+			});
+			if (!summary.installed) continue;
+		}
+		const detail = await readPluginDetail(params, marketplaceRef(resolvedPlugin.marketplace, pluginPolicy.marketplaceName), pluginPolicy, summary, diagnostics);
+		const ownedAppIds = detail?.apps.map((app) => app.id).filter(Boolean).toSorted() ?? [];
+		const appOwnership = resolveAppOwnership({
+			detail,
+			appInventory,
+			summary
+		});
+		if (appOwnership === "ambiguous") diagnostics.push({
+			code: "app_ownership_ambiguous",
+			plugin: pluginPolicy,
+			message: `${pluginPolicy.pluginName} has only display-name app matches; apps are not exposed until ownership is stable.`
+		});
+		if (summary.installed && !summary.enabled) diagnostics.push({
+			code: "plugin_disabled",
+			plugin: pluginPolicy,
+			message: `${pluginPolicy.pluginName} is installed in Codex but disabled.`
+		});
+		const apps = resolveOwnedApps({
+			pluginPolicy,
+			detail,
+			appInventory
+		});
+		records.push({
+			policy: pluginPolicy,
+			summary,
+			...detail ? { detail } : {},
+			activationRequired: pluginPolicy.enabled && (unavailableByMarketplacePolicy || !summary.installed || !summary.enabled),
+			authRequired: apps.some((app) => app.needsAuth || !app.accessible),
+			appOwnership,
+			ownedAppIds,
+			apps
+		});
+	}
+	return {
+		policy,
+		records,
+		diagnostics,
+		...appInventory ? { appInventory } : {}
+	};
+}
+/** Finds a configured plugin only in its authorized marketplace identity. */
+function findCodexMarketplacePluginSummary(listed, marketplaceName, pluginName) {
+	const resolved = findConfiguredMarketplacePlugin(listed, {
+		marketplaceName,
+		pluginName
+	});
+	return resolved ? {
+		marketplace: marketplaceRef(resolved.marketplace, marketplaceName),
+		summary: resolved.summary
+	} : void 0;
+}
+/** Builds plugin/read or plugin/install params from a marketplace reference. */
+function pluginReadParams(marketplace, pluginName) {
+	return {
+		...marketplace.path ? { marketplacePath: marketplace.path } : {},
+		...marketplace.remoteMarketplaceName ? { remoteMarketplaceName: marketplace.remoteMarketplaceName } : {},
+		pluginName
+	};
+}
+/** Returns configured plugin keys whose current metadata may still recover. */
+function resolveRecoverableCodexPluginConfigKeys(params) {
+	return params.policy.pluginPolicies.filter((pluginPolicy) => pluginPolicy.enabled && !isSettledMissingPluginPolicy({
+		pluginPolicy,
+		metadataCache: params.metadataCache,
+		appCacheKey: params.appCacheKey,
+		configCwd: params.configCwd
+	})).map((pluginPolicy) => pluginPolicy.configKey).toSorted();
+}
+async function listCodexPluginMetadata(params, marketplaceName) {
+	const requestParams = buildPluginCatalogRequestParams(params, marketplaceName);
+	if (!params.metadataCache || !params.appCacheKey) return await params.request("plugin/list", requestParams);
+	return (await params.metadataCache.load({
+		appCacheKey: params.appCacheKey,
+		queryKind: "curated-global",
+		requestParams,
+		catalogScope: pluginMetadataCatalogScope(marketplaceName),
+		request: async (method, listedParams) => await params.request(method, listedParams),
+		cacheable: (response) => response.marketplaces.some((marketplace) => marketplaceMatchesConfiguredName(marketplace, marketplaceName))
+	})).response;
+}
+async function readInstalledCodexPluginMetadata(params) {
+	const requestParams = params.configCwd ? { cwds: [params.configCwd] } : {};
+	if (!params.metadataCache || !params.appCacheKey) return await params.request("plugin/installed", requestParams);
+	return (await params.metadataCache.load({
+		appCacheKey: params.appCacheKey,
+		queryKind: "installed",
+		requestParams,
+		request: async (method, installedParams) => await params.request(method, installedParams),
+		cacheable: (response) => params.policy.pluginPolicies.every((pluginPolicy) => {
+			if (!pluginPolicy.enabled && !params.policy.allowAllPlugins) return true;
+			return Boolean(findConfiguredMarketplacePlugin(response, pluginPolicy));
+		})
+	})).response;
+}
+function isSettledMissingPluginPolicy(params) {
+	const queryKind = params.pluginPolicy.marketplaceName === "workspace-directory" ? "installed" : "curated-global";
+	const requestParams = queryKind === "installed" ? params.configCwd ? { cwds: [params.configCwd] } : {} : buildPluginCatalogRequestParams(params, params.pluginPolicy.marketplaceName);
+	const listed = params.metadataCache.read(params.appCacheKey, queryKind, requestParams, queryKind === "curated-global" ? pluginMetadataCatalogScope(params.pluginPolicy.marketplaceName) : void 0)?.response;
+	if (!listed) return false;
+	return !findConfiguredMarketplacePlugin(listed, params.pluginPolicy);
+}
+function pluginMetadataCatalogScope(marketplaceName) {
+	return isOpenAiCuratedMarketplaceName(marketplaceName) ? void 0 : marketplaceName;
+}
+function buildPluginCatalogRequestParams(params, marketplaceName) {
+	const marketplaceKinds = marketplaceName === "created-by-me-remote" ? ["created-by-me-remote"] : marketplaceName.startsWith("workspace-shared-with-me") ? ["shared-with-me"] : void 0;
+	return {
+		...params.configCwd ? { cwds: [params.configCwd] } : {},
+		...marketplaceKinds ? { marketplaceKinds: [...marketplaceKinds] } : {}
+	};
+}
+function readCachedAppInventory(params) {
+	if (!params.appCache || !params.appCacheKey) return;
+	const request = async (method, requestParams) => await params.request(method, requestParams);
+	return params.appCache.read({
+		key: params.appCacheKey,
+		request,
+		nowMs: params.nowMs,
+		suppressRefresh: params.suppressAppInventoryRefresh
+	});
+}
+async function readPluginDetail(params, marketplace, pluginPolicy, summary, diagnostics) {
+	if (params.readPluginDetails === false) return;
+	if (marketplace.remoteMarketplaceName && !summary.remotePluginId) {
+		diagnostics.push({
+			code: "plugin_detail_unavailable",
+			plugin: pluginPolicy,
+			message: `${pluginPolicy.pluginName} detail unavailable: Codex did not return a remote plugin id.`
+		});
+		return;
+	}
+	try {
+		return (await params.request("plugin/read", pluginReadParams(marketplace, marketplace.remoteMarketplaceName && summary.remotePluginId ? summary.remotePluginId : pluginPolicy.pluginName))).plugin;
+	} catch (error) {
+		diagnostics.push({
+			code: "plugin_detail_unavailable",
+			plugin: pluginPolicy,
+			message: `${pluginPolicy.pluginName} detail unavailable: ${error instanceof Error ? error.message : String(error)}`
+		});
+		return;
+	}
+}
+function resolveAppOwnership(params) {
+	if (params.detail && params.detail.apps.length > 0) return "proven";
+	return (params.appInventory?.snapshot?.apps ?? []).filter((app) => app.pluginDisplayNames.some((displayName) => displayName === params.summary.name)).length > 0 ? "ambiguous" : "none";
+}
+function resolveOwnedApps(params) {
+	const detailApps = params.detail?.apps ?? [];
+	if (detailApps.length === 0) return [];
+	if (params.appInventory?.state === "missing") {
+		embeddedAgentLog.warn("codex plugin inventory missing app inventory for detail apps", {
+			configKey: params.pluginPolicy.configKey,
+			pluginName: params.pluginPolicy.pluginName,
+			appIds: detailApps.map((app) => app.id).toSorted()
+		});
+		return [];
+	}
+	const appInfoById = new Map((params.appInventory?.snapshot?.apps ?? []).map((app) => [app.id, app]));
+	return detailApps.map((app) => {
+		const info = appInfoById.get(app.id);
+		if (!info) return {
+			id: app.id,
+			name: app.name,
+			accessible: false,
+			enabled: false,
+			needsAuth: true
+		};
+		return Object.assign({
+			id: app.id,
+			name: app.name,
+			accessible: info.isAccessible,
+			enabled: info.isEnabled,
+			needsAuth: !info.isAccessible
+		}, resolveOwnedAppApprovalOverrideKeys(info));
+	}).toSorted((left, right) => left.id.localeCompare(right.id));
+}
+/** Returns current tool keys whose overrides could bypass the requested reviewer. */
+function resolveOwnedAppApprovalOverrideKeys(app) {
+	if (!app.toolSummaries) return {};
+	const appName = app.name.trim();
+	const appNameLower = appName.toLowerCase();
+	const keys = app.toolSummaries.filter((tool) => !tool.isReadOnly).flatMap((tool) => resolveAppToolConfigKeys({
+		appName,
+		appNameLower,
+		tool
+	}));
+	return { approvalOverrideToolConfigKeys: Array.from(new Set(keys)).toSorted() };
+}
+function resolveAppToolConfigKeys(params) {
+	const keys = [params.tool.name];
+	if (params.tool.title) keys.push(params.tool.title);
+	if (params.appName) keys.push(`${params.appName}_${params.tool.name}`);
+	if (params.appNameLower && params.appNameLower !== params.appName) keys.push(`${params.appNameLower}_${params.tool.name}`);
+	return keys;
+}
+function findPluginSummary(marketplace, pluginName) {
+	const exact = marketplace.plugins.find((plugin) => plugin.id === pluginName || plugin.id === `${pluginName}@${marketplace.name}`);
+	if (exact) return exact;
+	const matches = marketplace.plugins.filter((plugin) => plugin.name === pluginName || pluginNameFromPluginId(plugin.id, marketplace.name) === pluginName);
+	return matches.length === 1 ? matches[0] : void 0;
+}
+function findConfiguredMarketplacePlugin(listed, plugin) {
+	if (plugin.marketplaceName === "workspace-directory") return findWorkspaceMarketplacePlugin(listed, plugin.pluginName);
+	for (const marketplace of listed.marketplaces) {
+		if (!marketplaceMatchesConfiguredName(marketplace, plugin.marketplaceName)) continue;
+		const summary = findPluginSummary(marketplace, plugin.pluginName);
+		if (summary) return {
+			marketplace,
+			summary
+		};
+	}
+}
+function marketplaceMatchesConfiguredName(marketplace, configuredMarketplaceName) {
+	return isOpenAiCuratedMarketplaceName(configuredMarketplaceName) ? isOpenAiCuratedMarketplace(marketplace) : marketplace.name === configuredMarketplaceName;
+}
+function findWorkspaceMarketplacePlugin(listed, pluginName) {
+	const marketplace = listed.marketplaces.find((entry) => entry.name === CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME);
+	const summary = marketplace?.plugins.find((plugin) => plugin.id === pluginName);
+	return marketplace && summary ? {
+		marketplace,
+		summary
+	} : void 0;
+}
+function pluginNameFromPluginId(pluginId, marketplaceName) {
+	const trimmed = pluginId.trim();
+	if (!trimmed) return;
+	const marketplaceSuffix = `@${marketplaceName}`;
+	return (trimmed.endsWith(marketplaceSuffix) ? trimmed.slice(0, -marketplaceSuffix.length) : trimmed).split("/").at(-1)?.trim() || void 0;
+}
+function marketplaceRef(marketplace, name) {
+	return {
+		name,
+		...marketplace.path ? { path: marketplace.path } : {},
+		...!marketplace.path ? { remoteMarketplaceName: marketplace.name } : {}
+	};
+}
+/** True for any supported OpenAI curated marketplace wire name, matching Codex's own curated predicate. */
+function isOpenAiCuratedMarketplace(marketplace) {
+	return isOpenAiCuratedMarketplaceName(marketplace.name);
+}
+/** True for all Codex wire aliases of the same OpenAI-curated catalog. */
+function isOpenAiCuratedMarketplaceName(marketplaceName) {
+	return marketplaceName === "openai-curated" || marketplaceName === CODEX_PLUGINS_REMOTE_MARKETPLACE_NAME || marketplaceName === CODEX_PLUGINS_API_MARKETPLACE_NAME;
+}
+//#endregion
+export { readCodexPluginInventory as a, CODEX_PLUGINS_MARKETPLACE_NAME as c, pluginReadParams as i, CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME as l, isOpenAiCuratedMarketplace as n, resolveOwnedAppApprovalOverrideKeys as o, isOpenAiCuratedMarketplaceName as r, resolveRecoverableCodexPluginConfigKeys as s, findCodexMarketplacePluginSummary as t };