@openclaw/codex 2026.9.2 → 2026.9.4

package/dist/command-rpc-CR5EOEZX.js

@@ -0,0 +1,233 @@
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { o as isJsonObject } from "./protocol-5bh1G-H7.js";
+import { n as describeControlFailure, t as CODEX_CONTROL_METHODS } from "./capabilities-8vx68WLH.js";
+import { i as requestCodexAppServerJson, o as withCodexAppServerJsonClient } from "./request-B7hEkBGq.js";
+import "./config-oIORaQ5T.js";
+import { n as resolveCodexAppServerRuntimeOptions, r as resolveCodexSupervisionAppServerRuntimeOptions } from "./config-runtime-D0zGNIHu.js";
+import { r as prepareCodexAppServerAuthBinding } from "./auth-binding-CWlKVccJ.js";
+import { a as resolveCodexAppServerAuthProfileStore, r as resolveCodexAppServerAuthProfileId } from "./auth-profile-CwzO4_RG.js";
+import { tt as resolveCodexAppServerPreparedAuthHandoff } from "./shared-client-CscigXXL.js";
+import { a as closeCodexStartupClientBestEffort } from "./attempt-client-cleanup-DKHzbwt5.js";
+import { n as listCodexAppServerModels } from "./models-PCKOim-h.js";
+import { n as createCodexSessionGenerationSupersededError } from "./session-binding-CI8UuilT.js";
+import { t as resumeCodexAppServerThread } from "./thread-resume-DsDOZpFg.js";
+import { resolveAgentDir, resolveSessionAgentIdsStrict } from "openclaw/plugin-sdk/agent-scope-runtime";
+import { resolveAgentWorkspaceDir } from "openclaw/plugin-sdk/agent-runtime";
+import { prepareAgentRuntimeAuth } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { getSessionEntry, resolveStorePath } from "openclaw/plugin-sdk/session-store-runtime";
+import { resolveSessionModelRef } from "openclaw/plugin-sdk/model-session-runtime";
+import { resolveApiKeyForProvider } from "openclaw/plugin-sdk/provider-auth-runtime";
+//#region extensions/codex/src/command-rpc.ts
+var command_rpc_exports = /* @__PURE__ */ __exportAll({
+	codexControlRequest: () => codexControlRequest,
+	prepareCodexControlSessionAuth: () => prepareCodexControlSessionAuth,
+	readCodexStatusProbes: () => readCodexStatusProbes,
+	requestOptions: () => requestOptions,
+	safeCodexControlRequest: () => safeCodexControlRequest
+});
+/** Selects the same prepared auth partition as an admitted session turn. */
+async function prepareCodexControlSessionAuth(options, startOptions) {
+	if (!options.config || !options.sessionKey || !options.sessionId) {
+		if (options.onResponse) throw new Error("Codex control subscription requires admitted session authority.");
+		return {
+			authProfileId: options.authProfileId ?? void 0,
+			clientOptions: { authProfileId: options.authProfileId }
+		};
+	}
+	const config = options.config;
+	const { sessionAgentId } = resolveSessionAgentIdsStrict({
+		config,
+		sessionKey: options.sessionKey,
+		agentId: options.agentId
+	});
+	const agentDir = options.agentDir ?? resolveAgentDir(config, sessionAgentId);
+	const workspaceDir = resolveAgentWorkspaceDir(config, sessionAgentId);
+	const entry = getSessionEntry({
+		agentId: sessionAgentId,
+		storePath: options.storePath?.trim() || resolveStorePath(config.session?.store, { agentId: sessionAgentId }),
+		sessionKey: options.sessionKey,
+		hydrateSkillPromptRefs: false,
+		readConsistency: "latest"
+	});
+	if (entry?.sessionId !== options.sessionId) throw createCodexSessionGenerationSupersededError(options.sessionId);
+	if (options.authProfileId === null || startOptions.homeScope === "user") return {
+		authProfileId: options.authProfileId ?? void 0,
+		clientOptions: { authProfileId: options.authProfileId }
+	};
+	const model = resolveSessionModelRef(config, entry, sessionAgentId);
+	const authProfileId = entry?.authProfileOverride ?? options.authProfileId;
+	const store = resolveCodexAppServerAuthProfileStore({
+		agentDir,
+		config,
+		authProfileId
+	});
+	const { plan, attempts } = prepareAgentRuntimeAuth({
+		provider: model.provider,
+		modelId: model.model,
+		config,
+		agentDir,
+		workspaceDir,
+		authProfileStore: store,
+		sessionAuthProfileId: authProfileId,
+		sessionAuthProfileSource: entry?.authProfileOverrideSource,
+		harnessId: "codex",
+		harnessAuthBootstrap: "harness"
+	});
+	const route = plan.modelRoute;
+	const resolvedAuth = route ? await resolveApiKeyForProvider({
+		provider: route.provider,
+		modelId: route.modelId,
+		modelApi: route.api,
+		cfg: config,
+		agentDir,
+		workspaceDir,
+		store,
+		profileId: attempts[0]?.profileId,
+		lockedProfile: plan.forwardedAuthProfileSource === "user",
+		allowAuthProfileFallback: attempts[0]?.allowAuthProfileFallback,
+		skipSetupProviderFallback: true
+	}) : void 0;
+	const handoff = await resolveCodexAppServerPreparedAuthHandoff({
+		authRequirement: route?.authRequirement,
+		resolvedApiKey: resolvedAuth?.apiKey,
+		authProfileId: route ? plan.forwardedAuthProfileId : resolveCodexAppServerAuthProfileId({
+			authProfileId: plan.forwardedAuthProfileId,
+			store,
+			config
+		}),
+		authProfileStore: store,
+		agentDir,
+		homeScope: startOptions.homeScope ?? "agent",
+		config,
+		subscriptionProfileRequiredError: "Prepared Codex subscription route requires a forwarded OpenAI OAuth or token profile.",
+		subscriptionProfileUnusableError: "Prepared Codex subscription auth profile is unusable."
+	});
+	const binding = handoff.authProfileId ? await prepareCodexAppServerAuthBinding({
+		authProfileId: handoff.authProfileId,
+		authProfileStore: store,
+		agentDir,
+		config
+	}) : void 0;
+	return {
+		authProfileId: handoff.authProfileId,
+		clientOptions: {
+			...handoff.preparedAuth ? { preparedAuth: handoff.preparedAuth } : { authProfileId: handoff.authProfileId },
+			authRequirement: route?.authRequirement,
+			authProfileStore: binding?.authProfileStore ?? store,
+			authBindingFingerprint: binding?.fingerprint,
+			agentDir
+		}
+	};
+}
+function requestOptions(pluginConfig, limit, config, agentDir) {
+	const runtime = resolveCodexAppServerRuntimeOptions({ pluginConfig });
+	return {
+		limit,
+		timeoutMs: runtime.requestTimeoutMs,
+		startOptions: runtime.start,
+		config,
+		agentDir
+	};
+}
+async function codexControlRequest(pluginConfig, method, requestParams, options = {}) {
+	const runtime = options.startOptions ? resolveCodexSupervisionAppServerRuntimeOptions({ pluginConfig }) : resolveCodexAppServerRuntimeOptions({ pluginConfig });
+	const startOptions = options.startOptions ?? runtime.start;
+	const auth = options.onResponse ? await prepareCodexControlSessionAuth(options, startOptions) : {
+		authProfileId: options.authProfileId ?? void 0,
+		clientOptions: { authProfileId: options.authProfileId }
+	};
+	const controlRequestOptions = {
+		timeoutMs: options.timeoutMs ?? runtime.requestTimeoutMs,
+		assertCurrent: options.assertCurrent,
+		startOptions,
+		config: options.config,
+		sessionKey: options.sessionKey,
+		sessionId: options.sessionId,
+		agentDir: options.agentDir,
+		isolated: options.isolated,
+		...auth.clientOptions
+	};
+	if (options.onResponse || options.beforeRequest) return await withCodexAppServerJsonClient(controlRequestOptions, async (request, client, scope) => {
+		await options.beforeRequest?.(request, client, scope);
+		scope.assertCurrent();
+		let response;
+		if (method === "thread/resume") {
+			if (!isJsonObject(requestParams) || typeof requestParams.threadId !== "string") throw new Error("Codex thread/resume requires a thread id.");
+			response = await resumeCodexAppServerThread({
+				client,
+				request: {
+					...requestParams,
+					threadId: requestParams.threadId
+				},
+				requestResume: () => request({
+					method,
+					requestParams
+				}),
+				abandonClient: () => closeCodexStartupClientBestEffort(client)
+			});
+		} else response = await request({
+			method,
+			requestParams
+		});
+		await options.onResponse?.(response, client, {
+			authProfileId: auth.authProfileId,
+			assertCurrent: scope.assertCurrent
+		});
+		scope.assertCurrent();
+		return response;
+	});
+	return await requestCodexAppServerJson({
+		method,
+		requestParams,
+		...controlRequestOptions
+	});
+}
+async function safeCodexControlRequest(pluginConfig, method, requestParams, options = {}) {
+	return await safeValue(async () => await codexControlRequest(pluginConfig, method, requestParams, options));
+}
+async function safeCodexModelList(pluginConfig, limit, config, agentDir) {
+	return await safeValue(async () => await listCodexAppServerModels(requestOptions(pluginConfig, limit, config, agentDir)));
+}
+async function readCodexStatusProbes(pluginConfig, config, agentDir) {
+	const [models, account, limits, mcps, skills] = await Promise.all([
+		safeCodexModelList(pluginConfig, 20, config, agentDir),
+		safeCodexControlRequest(pluginConfig, CODEX_CONTROL_METHODS.account, { refreshToken: false }, {
+			config,
+			agentDir
+		}),
+		safeCodexControlRequest(pluginConfig, CODEX_CONTROL_METHODS.rateLimits, void 0, {
+			config,
+			agentDir
+		}),
+		safeCodexControlRequest(pluginConfig, CODEX_CONTROL_METHODS.listMcpServers, { limit: 100 }, {
+			config,
+			agentDir
+		}),
+		safeCodexControlRequest(pluginConfig, CODEX_CONTROL_METHODS.listSkills, {}, {
+			config,
+			agentDir
+		})
+	]);
+	return {
+		models,
+		account,
+		limits,
+		mcps,
+		skills
+	};
+}
+async function safeValue(read) {
+	try {
+		return {
+			ok: true,
+			value: await read()
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			error: describeControlFailure(error)
+		};
+	}
+}
+//#endregion
+export { requestOptions as a, readCodexStatusProbes as i, command_rpc_exports as n, safeCodexControlRequest as o, prepareCodexControlSessionAuth as r, codexControlRequest as t };

package/dist/{compact-Y_xBqrHN.js → compact-B_H3AOd7.js}

@@ -1,21 +1,26 @@
-import { l as sessionBindingIdentity } from "./session-binding-record-CyaXZvTe.js";
-import { B as isJsonObject } from "./config-CyapYSji.js";
-import { Mt as retainCodexAppServerLiveThread, U as isCodexAppServerPrewriteRequestCancellationError, c as getLeasedSharedCodexAppServerClient, h as releaseLeasedSharedCodexAppServerClient, q as CodexAppServerRpcError, wt as consumeCodexAppServerLiveThread } from "./shared-client-CKhX2kFt.js";
-import { l as resolveCodexSessionBinding, t as CODEX_APP_SERVER_BINDING_GUARDED_REQUEST_TIMEOUT_MS } from "./session-binding-4Ki04sW-.js";
-import { _ as readCodexNotificationTurnId, a as closeCodexStartupClientBestEffort, c as isCodexNoActiveTurnInterruptError, d as unsubscribeCodexThreadBestEffort, g as readCodexNotificationThreadId, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-Bp1ZOnk2.js";
-import { n as readCodexThreadContextSnapshot, u as readCodexNotificationItem } from "./event-projector-usage-ZqEVbAEY.js";
-import { t as resumeCodexAppServerThread } from "./thread-resume-BLgqkUc1.js";
-import { l as isIncognitoSessionKey, o as withCodexAppServerThreadMutation, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-CbucAmmp.js";
-import { r as assertCodexSupervisionThreadLineage, s as resolveCodexBindingAppServerConnection } from "./thread-policy-CTalhWFy.js";
-import { s as resolveCodexNativeExecutionBlock } from "./request-C8H22rPi.js";
+import { l as sessionBindingIdentity } from "./session-binding-record-Bcvslnhf.js";
+import { o as isJsonObject } from "./protocol-5bh1G-H7.js";
+import { u as isCodexAppServerPrewriteRequestCancellationError } from "./client-B57KWPQx.js";
+import { n as withCodexAppServerThreadMutation, t as isIncognitoSessionKey } from "./incognito-session-uhrBF6wJ.js";
+import { t as CodexAppServerRpcError } from "./rpc-error-ttN_QjEm.js";
+import { i as resolveCodexBindingAppServerConnection } from "./binding-connection-D3udKbIE.js";
+import { J as retainCodexAppServerLiveThread, R as consumeCodexAppServerLiveThread, c as getLeasedSharedCodexAppServerClient, h as releaseLeasedSharedCodexAppServerClient } from "./shared-client-CscigXXL.js";
+import { _ as readCodexNotificationTurnId, a as closeCodexStartupClientBestEffort, c as isCodexNoActiveTurnInterruptError, d as unsubscribeCodexThreadBestEffort, g as readCodexNotificationThreadId, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-DKHzbwt5.js";
+import { s as readCodexNotificationItem } from "./attempt-notifications-C9XufG6l.js";
+import { n as readCodexThreadContextSnapshot } from "./event-projector-usage-BfXmpOec.js";
+import { o as resolveCodexSessionBinding, t as CODEX_APP_SERVER_BINDING_GUARDED_REQUEST_TIMEOUT_MS } from "./session-binding-CI8UuilT.js";
+import { r as assertCodexSupervisionThreadLineage } from "./thread-policy-BuEQfE0g.js";
+import { t as resumeCodexAppServerThread } from "./thread-resume-DsDOZpFg.js";
+import { t as isSameCodexAppServerThreadOwner } from "./thread-ownership-BsDRTsyp.js";
 import { t as persistCodexContextCompactionActivity } from "./context-compaction-activity-CMla5FPJ.js";
+import { t as resolveCodexNativeExecutionBlock } from "./sandbox-guard-BxgyoM8M.js";
 import { asOptionalRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { resolveDefaultAgentId } from "openclaw/plugin-sdk/agent-scope-runtime";
+import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
+import { resolveAgentDir as resolveAgentDir$1 } from "openclaw/plugin-sdk/agent-runtime";
 import { embeddedAgentLog, resolveCompactionTimeoutMs } from "openclaw/plugin-sdk/agent-harness-runtime";
-import { resolveAgentDir as resolveAgentDir$2 } from "openclaw/plugin-sdk/agent-runtime";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { createDedupeCache } from "openclaw/plugin-sdk/dedupe-runtime";
 //#region extensions/codex/src/app-server/compact.ts
 const warnedIgnoredCompactionOverrides = createDedupeCache({
@@ -345,7 +350,7 @@ async function compactCodexNativeThread(params, options) {
 			authProfileId: requestedAuthProfileId ?? binding.authProfileId,
 			pluginConfig: options.pluginConfig,
 			config,
-			agentDir: resolveAgentDir$2(config, agentId)
+			agentDir: resolveAgentDir$1(config, agentId)
 		});
 	} catch (error) {
 		return {
@@ -409,7 +414,7 @@ async function compactCodexNativeThread(params, options) {
 						forceKillDelayMs: 250
 					});
 					if (appServer.start.transport === "stdio") {
-						if (transportStopped) return;
+						if (transportStopped.exited) return;
 						throw new Error("failed to stop unconfirmed codex app-server process");
 					}
 					if (usesSupervisionConnection) throw new Error("cannot detach an unconfirmed supervised codex thread");

package/dist/config-oIORaQ5T.js

@@ -0,0 +1,106 @@
+import { c as readExecAsk, f as readRecord, l as readExecSecurity } from "./config-utils-DujwEnhg.js";
+import { p as canUseCodexModelBackedApprovalsReviewerForModel$1 } from "./config-options-CXMq1T-C.js";
+import "./protocol-5bh1G-H7.js";
+import "./config-runtime-D0zGNIHu.js";
+import { resolveAgentConfig } from "openclaw/plugin-sdk/agent-scope-runtime";
+import { execPolicy } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { resolveExecApprovalsFromFile } from "openclaw/plugin-sdk/exec-approvals-runtime";
+import { resolveProviderIdForAuth } from "openclaw/plugin-sdk/provider-auth-aliases";
+//#region extensions/codex/src/app-server/config-exec-approvals.ts
+function resolveOpenClawExecPolicyFromConfig(params) {
+	const globalExec = readRecord(params.config?.tools?.exec);
+	const globalPolicy = applyOpenClawExecPolicyLayer(createDefaultOpenClawExecPolicy(), globalExec);
+	const agentId = params.agentId?.trim();
+	return applyOpenClawExecPolicyLayer(globalPolicy, agentId ? readRecord(resolveAgentConfig(params.config ?? {}, agentId)?.tools?.exec) : void 0);
+}
+function resolveOpenClawExecPolicyForCodexAppServer(params) {
+	if (params.permissionMode === "full") return {
+		...resolveOpenClawExecPolicyForMode("full"),
+		touched: true
+	};
+	const overridePolicy = applyOpenClawExecPolicyLayer(resolveOpenClawExecPolicyFromConfig({
+		config: params.config,
+		agentId: params.agentId
+	}), params.execOverrides);
+	return applyOpenClawExecApprovalFloors(overridePolicy, resolveOpenClawExecApprovalFloorsForCodexAppServer({
+		approvals: params.approvals,
+		agentId: params.agentId,
+		policy: overridePolicy
+	}));
+}
+function createDefaultOpenClawExecPolicy() {
+	return {
+		...resolveOpenClawExecPolicyForMode("full"),
+		touched: false
+	};
+}
+function applyOpenClawExecPolicyLayer(base, exec) {
+	if (!exec) return base;
+	const mode = readExecMode(exec.mode);
+	if (mode !== void 0) return {
+		...resolveOpenClawExecPolicyForMode(mode),
+		touched: true
+	};
+	const security = readExecSecurity(exec.security);
+	const ask = readExecAsk(exec.ask);
+	if (security === void 0 && ask === void 0) return base;
+	const nextSecurity = security ?? base.security;
+	const nextAsk = ask ?? base.ask;
+	return {
+		mode: execPolicy.resolveExecModePolicy({
+			security: nextSecurity,
+			ask: nextAsk
+		}).mode,
+		security: nextSecurity,
+		ask: nextAsk,
+		touched: true
+	};
+}
+function resolveOpenClawExecApprovalFloorsForCodexAppServer(params) {
+	if (!params.approvals) return;
+	return resolveExecApprovalsFromFile({
+		file: params.approvals,
+		agentId: params.agentId,
+		overrides: {
+			security: params.policy.security,
+			ask: params.policy.ask
+		}
+	}).agent;
+}
+function applyOpenClawExecApprovalFloors(base, approvalFloors) {
+	if (!approvalFloors) return base;
+	const nextSecurity = approvalFloors.security ? execPolicy.minSecurity(base.security, approvalFloors.security) : base.security;
+	const nextAsk = approvalFloors.ask ? execPolicy.maxAsk(base.ask, approvalFloors.ask) : base.ask;
+	if (nextSecurity === base.security && nextAsk === base.ask) return base;
+	return {
+		mode: execPolicy.resolveExecModePolicy({
+			security: nextSecurity,
+			ask: nextAsk
+		}).mode,
+		security: nextSecurity,
+		ask: nextAsk,
+		touched: true
+	};
+}
+function resolveOpenClawExecPolicyForMode(mode) {
+	const { security, ask } = execPolicy.resolveExecModePolicy({
+		mode,
+		security: "full",
+		ask: "off"
+	});
+	return {
+		mode,
+		security,
+		ask
+	};
+}
+function readExecMode(value) {
+	return value === "deny" || value === "allowlist" || value === "ask" || value === "auto" || value === "full" ? value : void 0;
+}
+//#endregion
+//#region extensions/codex/src/app-server/config-reviewer.ts
+function canUseCodexModelBackedApprovalsReviewerForModel(params) {
+	return canUseCodexModelBackedApprovalsReviewerForModel$1(params, resolveProviderIdForAuth);
+}
+//#endregion
+export { resolveOpenClawExecPolicyForCodexAppServer as n, canUseCodexModelBackedApprovalsReviewerForModel as t };