@openclaw/codex 2026.9.3 → 2026.9.4

package/dist/{plan-BMJdMOEF.js → plan-7uG-Fp36.js}

@@ -1,25 +1,192 @@
-import { m as CODEX_PLUGINS_MARKETPLACE_NAME } from "./config-utils-C57JiJrU.js";
-import "./config-JDfTI4VI.js";
-import { a as exists, c as sanitizeName, n as discoverCodexSource, o as readJsonObject, r as hasCodexSource, s as resolveHomePath, t as codexPluginMigrationSubscriptionWarning } from "./source-Da-h6f7e.js";
-import { asBoolean, isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { c as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-oL4Na1ZG.js";
+import "./config-oIORaQ5T.js";
+import { a as exists, c as sanitizeName, n as discoverCodexSource, o as readJsonObject, r as hasCodexSource, s as resolveHomePath, t as codexPluginMigrationSubscriptionWarning } from "./source-CElXU0Oy.js";
+import { asBoolean, asOptionalRecord, isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { createHash } from "node:crypto";
+import { runCommandBuffered } from "openclaw/plugin-sdk/process-runtime";
 import path from "node:path";
 import fs from "node:fs/promises";
 import { canonicalPathFromExistingAncestor, isPathInside } from "openclaw/plugin-sdk/file-access-runtime";
+import { readSecretFile } from "openclaw/plugin-sdk/secret-file";
+import { fileURLToPath } from "node:url";
 import { loadAuthProfileStoreWithoutExternalProfiles, resolveAgentConfig, resolveAgentWorkspaceDir, resolveDefaultAgentId } from "openclaw/plugin-sdk/agent-runtime";
 import { extractErrorCode } from "openclaw/plugin-sdk/security-runtime";
-import { applyAuthProfileConfig, buildApiKeyCredential, buildOauthProviderAuthResult, buildOpenAICodexCredentialExtra, readCodexCliCredentialsCached, resolveOpenAICodexAuthIdentity, resolveOpenAICodexImportProfileName, updateAuthProfileStoreWithLock } from "openclaw/plugin-sdk/provider-auth";
+import { applyAuthProfileConfig, buildApiKeyCredential, buildOauthProviderAuthResult, buildOpenAICodexCredentialExtra, hasUsableOAuthCredential, resolveOpenAICodexAuthIdentity, resolveOpenAICodexImportProfileName, updateAuthProfileStoreWithLock } from "openclaw/plugin-sdk/provider-auth";
 import { MIGRATION_REASON_TARGET_EXISTS, createMigrationItem, createMigrationManualItem, hasMigrationConfigPatchConflict, markMigrationItemConflict, markMigrationItemError, markMigrationItemSkipped, mergeMigrationConfigValue, readMigrationConfigPath, resolveMigrationConfigRuntime, summarizeMigrationItems } from "openclaw/plugin-sdk/migration";
+import { decodeOpenAICodexJwtPayload } from "openclaw/plugin-sdk/provider-oauth-runtime";
+//#region extensions/codex/src/migration/cli-credentials.ts
+/** Explicit migration reads the storage selected by the native credential owner. */
+async function readAuthFile(home) {
+	try {
+		return asOptionalRecord(JSON.parse(await readSecretFile(path.join(home, "auth.json"), "Codex auth")));
+	} catch {
+		return;
+	}
+}
+async function readDirectKeyring(home, signal) {
+	const account = `cli|${createHash("sha256").update(home).digest("hex").slice(0, 16)}`;
+	const result = await runCommandBuffered([
+		"security",
+		"find-generic-password",
+		"-s",
+		"Codex Auth",
+		"-a",
+		account,
+		"-w"
+	], {
+		timeoutMs: 6e4,
+		maxCombinedOutputBytes: 16384,
+		signal
+	});
+	if (result.termination !== "exit" || result.code !== 0) return;
+	try {
+		return asOptionalRecord(JSON.parse(result.stdout.toString("utf8")));
+	} catch {
+		return;
+	}
+}
+async function readSelectedCredentialStorage(options, requireApiKey) {
+	options.signal?.throwIfAborted();
+	const home = await fs.realpath(options.codexHome).catch(() => path.resolve(options.codexHome));
+	const { CodexAppServerClient } = await import("./client-B57KWPQx.js").then((n) => n.n);
+	const { resolveManagedCodexPackageEntrypoint, resolveManagedCodexNativeCommand } = await import("./managed-binary-D22rNEcR.js").then((n) => n.n);
+	const launcher = resolveManagedCodexPackageEntrypoint(path.dirname(fileURLToPath(import.meta.url)));
+	const command = launcher ? resolveManagedCodexNativeCommand(launcher) : void 0;
+	if (!command) return;
+	const signal = AbortSignal.any([AbortSignal.timeout(options.allowKeychainPrompt && process.platform === "darwin" ? 6e4 : 5e3), ...options.signal ? [options.signal] : []]);
+	const client = await CodexAppServerClient.start({
+		transport: "stdio",
+		command,
+		commandSource: "resolved-managed",
+		args: ["app-server"],
+		cwd: home,
+		homeScope: "user",
+		env: { CODEX_HOME: home },
+		clearEnv: [
+			"OPENAI_API_KEY",
+			"CODEX_API_KEY",
+			"CODEX_ACCESS_TOKEN"
+		]
+	}, () => signal.throwIfAborted()).catch(() => {
+		options.signal?.throwIfAborted();
+	});
+	if (!client) return;
+	const abort = () => client.close();
+	signal.addEventListener("abort", abort, { once: true });
+	let credential;
+	try {
+		credential = await readNativeCredential(client, home, requireApiKey, options, signal);
+	} catch {}
+	signal.removeEventListener("abort", abort);
+	const closed = await client.closeAndWait({
+		forceKillDelayMs: 6e3,
+		exitTimeoutMs: 7e3
+	});
+	if (!closed.exited || closed.cleanup !== "closed") throw new Error("The Codex credential reader could not stop. No credential was imported.", { cause: options.signal?.reason });
+	options.signal?.throwIfAborted();
+	return credential;
+}
+async function readNativeCredential(client, home, requireApiKey, options, signal) {
+	signal.throwIfAborted();
+	await client.initialize();
+	if (client.getRuntimeIdentity()?.codexHome !== home) return;
+	const revision = client.getModelCatalogRevision();
+	if (requireApiKey) {
+		const account = await client.request("account/read", { refreshToken: false }, { signal });
+		if (asOptionalRecord(account.account)?.type !== "apiKey" || account.requiresOpenaiAuth !== true) return;
+	}
+	const configured = await client.request("config/read", {
+		includeLayers: false,
+		cwd: home
+	}, { signal });
+	const mode = (await client.request("configRequirements/read", {}, { signal })).requirements?.cli_auth_credentials_store ?? configured.config.cli_auth_credentials_store ?? "file";
+	let record;
+	if (mode === "file") record = await readAuthFile(home);
+	else if ((mode === "keyring" || mode === "auto") && process.platform === "darwin" && options.allowKeychainPrompt) {
+		let cursor;
+		let encrypted;
+		do {
+			const features = await client.request("experimentalFeature/list", {
+				limit: 100,
+				cursor
+			}, { signal });
+			const storage = features.data.find((feature) => feature.name === "secret_auth_storage");
+			if (storage) {
+				encrypted = storage.enabled;
+				break;
+			}
+			cursor = features.nextCursor ?? void 0;
+		} while (cursor);
+		if (encrypted !== false) return;
+		record = await readDirectKeyring(home, signal);
+	}
+	signal.throwIfAborted();
+	return !client.getCloseError() && client.getModelCatalogRevision() === revision ? record : void 0;
+}
+function jwtExpiry(token) {
+	try {
+		const exp = asOptionalRecord(JSON.parse(Buffer.from(token.split(".")[1] ?? "", "base64url").toString("utf8")))?.exp;
+		return typeof exp === "number" && Number.isFinite(exp) && exp > 0 ? exp * 1e3 : void 0;
+	} catch {
+		return;
+	}
+}
+async function readCodexCliCredentialsAsync(options) {
+	const data = await readSelectedCredentialStorage(options, false);
+	const mode = typeof data?.auth_mode === "string" ? data.auth_mode.toLowerCase() : void 0;
+	if (!data || mode !== void 0 && mode !== "chatgpt" && mode !== "chatgptauthtokens") return;
+	const tokens = asOptionalRecord(data.tokens);
+	if (typeof tokens?.access_token !== "string" || !tokens.access_token || typeof tokens.refresh_token !== "string" || !tokens.refresh_token) return;
+	const lastRefresh = typeof data.last_refresh === "string" ? Date.parse(data.last_refresh) : NaN;
+	return {
+		type: "oauth",
+		provider: "openai",
+		access: tokens.access_token,
+		refresh: tokens.refresh_token,
+		expires: jwtExpiry(tokens.access_token) ?? (Number.isFinite(lastRefresh) ? lastRefresh : Date.now()) + 36e5,
+		...typeof tokens.account_id === "string" ? { accountId: tokens.account_id } : {},
+		...typeof tokens.id_token === "string" ? { idToken: tokens.id_token } : {}
+	};
+}
+async function readCodexCliActiveApiKeyAsync(options) {
+	const data = await readSelectedCredentialStorage(options, true);
+	const mode = typeof data?.auth_mode === "string" ? data.auth_mode.toLowerCase() : void 0;
+	if (!data || mode !== void 0 && mode !== "apikey" && mode !== "api_key") return;
+	const key = typeof data.OPENAI_API_KEY === "string" ? data.OPENAI_API_KEY.trim() : "";
+	return key ? {
+		type: "api_key",
+		provider: "openai",
+		key
+	} : void 0;
+}
+//#endregion
 //#region extensions/codex/src/migration/auth.ts
 const OPENAI_PROVIDER_ID = "openai";
+const OPENAI_OAUTH_ITEM_ID = "auth:openai";
+const OPENAI_API_KEY_ITEM_ID = "auth:openai:api-key";
 const OPENAI_CODEX_DEFAULT_MODEL = "openai/gpt-5.6-sol";
 const CODEX_IMPORT_DISPLAY_NAME = "Codex import";
 const CODEX_REASON_AUTH_NOT_SELECTED = "auth credential migration not selected";
 const CODEX_REASON_AUTH_PROFILE_EXISTS = "auth profile exists";
+const CODEX_REASON_AUTH_PROFILE_UNUSABLE = "existing OAuth profile requires sign-in";
 const CODEX_REASON_AUTH_PROFILE_WRITE_FAILED = "failed to write auth profile";
 const CODEX_REASON_AUTH_NO_LONGER_PRESENT = "auth credential no longer present";
 const CODEX_REASON_MISSING_AUTH_METADATA = "missing auth metadata";
-const CODEX_CONFIG_PATCH_MODE_RETURN = "return";
+const CODEX_REASON_AUTH_STORAGE_NOT_IMPORTABLE = "credential storage is not importable";
 var CodexAuthConfigConflict = class extends Error {};
+function authItemId(credential) {
+	return credential.kind === "oauth" ? OPENAI_OAUTH_ITEM_ID : OPENAI_API_KEY_ITEM_ID;
+}
+function sourceCredentialFingerprint(credential) {
+	const profile = credential.kind === "oauth" ? credential.result.profiles[0]?.credential : void 0;
+	const source = credential.kind === "api_key" ? credential.key : profile?.type === "oauth" ? [
+		profile.access,
+		profile.refresh,
+		profile.accountId,
+		profile.idToken
+	] : void 0;
+	return createHash("sha256").update(JSON.stringify([credential.kind, source])).digest("hex");
+}
 async function readModelRefs(source) {
 	const cache = await readJsonObject(source.modelsCachePath);
 	const models = Array.isArray(cache.models) ? cache.models : [];
@@ -32,19 +199,18 @@ async function readModelRefs(source) {
 	refs.add(OPENAI_CODEX_DEFAULT_MODEL);
 	return [...refs].toSorted();
 }
-async function buildCodexOAuthCredential(source) {
-	const credential = readCodexCliCredentialsCached({
+async function buildCodexOAuthCredential(source, includeConfigPatch, options) {
+	const credential = await readCodexCliCredentialsAsync({
 		codexHome: source.codexHome,
-		allowKeychainPrompt: false,
-		ttlMs: 0
+		allowKeychainPrompt: options.allowKeychainPrompt,
+		...options.signal ? { signal: options.signal } : {}
 	});
 	if (!credential) return null;
 	const identity = resolveOpenAICodexAuthIdentity({
 		access: credential.access,
 		accountId: credential.accountId
 	});
-	const modelRefs = await readModelRefs(source);
-	const configPatch = { agents: { defaults: { models: Object.fromEntries(modelRefs.map((modelRef) => [modelRef, {}])) } } };
+	const configPatch = includeConfigPatch ? { agents: { defaults: { models: Object.fromEntries((await readModelRefs(source)).map((modelRef) => [modelRef, {}])) } } } : {};
 	const result = buildOauthProviderAuthResult({
 		providerId: OPENAI_PROVIDER_ID,
 		defaultModel: OPENAI_CODEX_DEFAULT_MODEL,
@@ -69,27 +235,45 @@ async function buildCodexOAuthCredential(source) {
 		result
 	} : null;
 }
-async function buildCodexApiKeyCredential(source) {
-	const raw = await readJsonObject(source.authPath);
-	const key = normalizeOptionalString(raw.OPENAI_API_KEY);
-	if (!key) return null;
+async function buildCodexApiKeyCredential(source, allowKeychainPrompt, signal) {
+	const credential = await readCodexCliActiveApiKeyAsync({
+		codexHome: source.codexHome,
+		allowKeychainPrompt,
+		...signal ? { signal } : {}
+	});
+	if (!credential) return null;
 	return {
 		kind: "api_key",
 		provider: OPENAI_PROVIDER_ID,
 		profileId: "openai:codex-import",
-		key
+		key: credential.key
 	};
 }
-async function readCodexAuthCredentials(source) {
-	return [await buildCodexOAuthCredential(source), await buildCodexApiKeyCredential(source)].filter((entry) => entry !== null);
+async function readCodexAuthCredentials(source, options) {
+	return [options.credentialKind === "api_key" ? null : await buildCodexOAuthCredential(source, options.includeConfigPatch, {
+		allowKeychainPrompt: options.allowKeychainPrompt,
+		...options.signal ? { signal: options.signal } : {}
+	}), options.credentialKind === "oauth" ? null : await buildCodexApiKeyCredential(source, options.allowKeychainPrompt, options.signal)].filter((entry) => entry !== null);
 }
 function findMatchingOAuthProfile(store, credential) {
+	const subject = oauthSubject(credential);
+	if (!subject) return;
 	for (const [profileId, existing] of Object.entries(store.profiles)) {
 		if (existing.type !== "oauth" || existing.provider !== credential.provider) continue;
-		if (credential.accountId && existing.accountId === credential.accountId) return profileId;
-		if ((!credential.accountId || !existing.accountId) && credential.email && existing.email === credential.email) return profileId;
+		const previous = oauthSubject(existing);
+		if (previous?.accountId === subject.accountId && previous.userId === subject.userId) return profileId;
 	}
 }
+function oauthSubject(credential) {
+	const claims = decodeOpenAICodexJwtPayload(credential.access)?.["https://api.openai.com/auth"];
+	if (!isRecord(claims)) return;
+	const accountId = normalizeOptionalString(claims.chatgpt_account_id);
+	const userId = normalizeOptionalString(claims.chatgpt_user_id) ?? normalizeOptionalString(claims.user_id);
+	return accountId && userId ? {
+		accountId,
+		userId
+	} : void 0;
+}
 function findMatchingApiKeyProfile(store, provider, key) {
 	for (const [profileId, existing] of Object.entries(store.profiles)) if (existing.type === "api_key" && existing.provider === provider && existing.key === key) return profileId;
 }
@@ -168,8 +352,16 @@ function applyApiKeyConfigToConfig(cfg, credential, profileId) {
 		preferProfileFirst: false
 	});
 }
-function shouldReturnAuthConfigPatch(ctx) {
-	return ctx.providerOptions?.configPatchMode === CODEX_CONFIG_PATCH_MODE_RETURN;
+function resolveCodexConfigPatchMode(ctx) {
+	const mode = ctx.providerOptions?.configPatchMode;
+	return mode === "none" || mode === "return" ? mode : "apply";
+}
+function allowCodexKeychainPrompt(ctx) {
+	return ctx.providerOptions?.allowKeychainPrompt === true;
+}
+function resolveRequestedCredentialKind(ctx) {
+	const kind = ctx.providerOptions?.credentialKind;
+	return kind === "oauth" || kind === "api_key" ? kind : void 0;
 }
 function authProfileConfigForCredential(credential, profileId) {
 	if (credential.kind === "api_key") return {
@@ -215,32 +407,60 @@ function applyCredentialConfig(config, credential, profileId) {
 	return credential.kind === "oauth" ? applyOAuthConfigToConfig(config, credential, profileId) : applyApiKeyConfigToConfig(config, credential, profileId);
 }
 async function buildCodexAuthItems(params) {
-	const credentials = await readCodexAuthCredentials(params.source);
-	if (credentials.length === 0) return [];
+	const configPatchMode = resolveCodexConfigPatchMode(params.ctx);
+	const credentials = await readCodexAuthCredentials(params.source, {
+		credentialKind: resolveRequestedCredentialKind(params.ctx),
+		includeConfigPatch: configPatchMode !== "none",
+		allowKeychainPrompt: allowCodexKeychainPrompt(params.ctx),
+		signal: params.ctx.signal
+	});
+	if (credentials.length === 0) {
+		const requestedKind = resolveRequestedCredentialKind(params.ctx);
+		if (!requestedKind) return [];
+		const credentialKind = requestedKind;
+		return [createMigrationItem({
+			id: credentialKind === "oauth" ? OPENAI_OAUTH_ITEM_ID : OPENAI_API_KEY_ITEM_ID,
+			kind: "auth",
+			action: "skip",
+			source: params.source.codexHome,
+			status: "skipped",
+			sensitive: true,
+			reason: CODEX_REASON_AUTH_STORAGE_NOT_IMPORTABLE,
+			message: "No supported Codex credential could be imported. Continue with sign-in to connect OpenClaw.",
+			details: {
+				provider: OPENAI_PROVIDER_ID,
+				credentialKind,
+				credentialImportUnavailable: true
+			}
+		})];
+	}
 	const store = loadAuthProfileStoreWithoutExternalProfiles(params.targets.agentDir);
 	const skipped = !params.ctx.includeSecrets;
 	return credentials.map((credential) => {
 		const { profileId, matchedExisting } = itemProfileTarget(credential, store);
-		const targetExists = Boolean(store.profiles[profileId]);
+		const existing = store.profiles[profileId];
 		const configProfile = authProfileConfigForCredential(credential, profileId);
 		const configConflict = configProfile ? hasAuthProfileConfigConflict(params.ctx.config, configProfile, Boolean(params.ctx.overwrite)) : false;
-		const conflict = (targetExists && !matchedExisting && !params.ctx.overwrite || configConflict) && !skipped;
+		const conflict = (existing && !matchedExisting && !params.ctx.overwrite || configConflict) && !skipped;
+		const unavailable = !skipped && !conflict && !params.ctx.overwrite && existing?.type === "oauth" && !hasUsableOAuthCredential(existing);
 		return createMigrationItem({
-			id: `auth:${credential.provider}`,
+			id: authItemId(credential),
 			kind: "auth",
-			action: skipped ? "skip" : "create",
-			source: params.source.authPath,
+			action: skipped || unavailable ? "skip" : "create",
+			source: params.source.codexHome,
 			target: `${params.targets.agentDir}/openclaw-agent.sqlite#auth_profile_store:${profileId}`,
-			status: skipped ? "skipped" : conflict ? "conflict" : "planned",
+			status: skipped || unavailable ? "skipped" : conflict ? "conflict" : "planned",
 			sensitive: true,
-			reason: skipped ? CODEX_REASON_AUTH_NOT_SELECTED : conflict ? CODEX_REASON_AUTH_PROFILE_EXISTS : void 0,
-			message: credential.kind === "oauth" ? "Import Codex OAuth credentials and configure OpenAI Codex models." : "Import Codex OpenAI API key.",
+			reason: skipped ? CODEX_REASON_AUTH_NOT_SELECTED : conflict ? CODEX_REASON_AUTH_PROFILE_EXISTS : unavailable ? CODEX_REASON_AUTH_PROFILE_UNUSABLE : void 0,
+			message: unavailable ? "The existing OpenAI sign-in needs to be renewed. Continue with sign-in." : credential.kind === "oauth" ? configPatchMode === "none" ? "Import Codex OAuth credentials." : "Import Codex OAuth credentials and configure OpenAI Codex models." : "Import Codex OpenAI API key.",
 			details: {
 				provider: credential.provider,
 				profileId,
 				sourceProfileId: credential.profileId,
-				sourceKind: "codex-auth-json",
-				credentialKind: credential.kind
+				sourceCredentialFingerprint: sourceCredentialFingerprint(credential),
+				sourceKind: "codex-native-selected-storage",
+				credentialKind: credential.kind,
+				credentialImportUnavailable: unavailable
 			}
 		});
 	});
@@ -251,10 +471,18 @@ async function applyCodexAuthItems(params) {
 	const profileId = typeof item.details?.profileId === "string" ? item.details.profileId : "";
 	const provider = typeof item.details?.provider === "string" ? item.details.provider : "";
 	const sourceProfileId = typeof item.details?.sourceProfileId === "string" ? item.details.sourceProfileId : void 0;
-	if (!profileId || !provider) return [markMigrationItemError(item, CODEX_REASON_MISSING_AUTH_METADATA)];
-	const credential = (await readCodexAuthCredentials(source)).find((candidate) => candidate.provider === provider);
+	const credentialKind = item.details?.credentialKind;
+	if (!profileId || !provider || credentialKind !== "oauth" && credentialKind !== "api_key") return [markMigrationItemError(item, CODEX_REASON_MISSING_AUTH_METADATA)];
+	const configPatchMode = resolveCodexConfigPatchMode(ctx);
+	const credential = (await readCodexAuthCredentials(source, {
+		credentialKind,
+		includeConfigPatch: configPatchMode !== "none",
+		allowKeychainPrompt: allowCodexKeychainPrompt(ctx),
+		signal: ctx.signal
+	})).find((candidate) => candidate.provider === provider && candidate.kind === credentialKind && (!sourceProfileId || candidate.profileId === sourceProfileId));
 	if (!credential) return [markMigrationItemSkipped(item, CODEX_REASON_AUTH_NO_LONGER_PRESENT)];
-	if (credential.kind === "oauth" && sourceProfileId && credential.profileId !== sourceProfileId) return [markMigrationItemSkipped(item, CODEX_REASON_AUTH_NO_LONGER_PRESENT)];
+	if (item.details?.sourceCredentialFingerprint !== sourceCredentialFingerprint(credential)) return [markMigrationItemSkipped(item, CODEX_REASON_AUTH_NO_LONGER_PRESENT)];
+	ctx.signal?.throwIfAborted();
 	const oauthProfile = credential.kind === "oauth" ? credential.result.profiles[0] : void 0;
 	const oauthCredential = oauthProfile?.credential.type === "oauth" ? oauthProfile.credential : void 0;
 	if (credential.kind === "oauth" && !oauthCredential) return [markMigrationItemError(item, CODEX_REASON_MISSING_AUTH_METADATA)];
@@ -262,14 +490,19 @@ async function applyCodexAuthItems(params) {
 	if (!configProfile) return [markMigrationItemError(item, CODEX_REASON_MISSING_AUTH_METADATA)];
 	if (hasCurrentAuthProfileConfigConflict(ctx, configProfile)) return [markMigrationItemConflict(item, CODEX_REASON_AUTH_PROFILE_EXISTS)];
 	let conflicted = false;
+	let unusable = false;
 	let wrote = false;
 	const store = await updateAuthProfileStoreWithLock({
 		agentDir: targets.agentDir,
 		stateDir: ctx.stateDir,
 		updater: (freshStore) => {
+			ctx.signal?.throwIfAborted();
 			const existing = freshStore.profiles[profileId];
 			if (!ctx.overwrite && existing) {
-				if ((credential.kind === "oauth" ? findMatchingOAuthProfile(freshStore, oauthCredential) : findMatchingApiKeyProfile(freshStore, credential.provider, credential.key)) === profileId) return false;
+				if ((credential.kind === "oauth" ? findMatchingOAuthProfile(freshStore, oauthCredential) : findMatchingApiKeyProfile(freshStore, credential.provider, credential.key)) === profileId) {
+					unusable = existing.type === "oauth" && !hasUsableOAuthCredential(existing);
+					return false;
+				}
 				conflicted = true;
 				return false;
 			}
@@ -285,8 +518,9 @@ async function applyCodexAuthItems(params) {
 		}
 	});
 	if (conflicted) return [markMigrationItemConflict(item, CODEX_REASON_AUTH_PROFILE_EXISTS)];
+	if (unusable) return [markMigrationItemSkipped(item, CODEX_REASON_AUTH_PROFILE_UNUSABLE)];
 	if (!store?.profiles[profileId]) return [markMigrationItemError(item, CODEX_REASON_AUTH_PROFILE_WRITE_FAILED)];
-	const configResult = shouldReturnAuthConfigPatch(ctx) ? "unavailable" : await applyCodexAuthConfig(ctx, credential, profileId);
+	const configResult = configPatchMode !== "apply" ? "unavailable" : await applyCodexAuthConfig(ctx, credential, profileId);
 	if (configResult === "conflict") return [markMigrationItemConflict(item, CODEX_REASON_AUTH_PROFILE_EXISTS)];
 	const migratedItem = {
 		...item,
@@ -295,10 +529,10 @@ async function applyCodexAuthItems(params) {
 			...item.details,
 			wroteAuthProfile: wrote,
 			configUpdated: configResult === "configured",
-			...shouldReturnAuthConfigPatch(ctx) ? { configPatchReturned: true } : {}
+			...configPatchMode === "return" ? { configPatchReturned: true } : {}
 		}
 	};
-	return [migratedItem, ...shouldReturnAuthConfigPatch(ctx) ? buildCodexAuthConfigPatchItems(ctx, migratedItem, credential, profileId) : []];
+	return [migratedItem, ...configPatchMode === "return" ? buildCodexAuthConfigPatchItems(ctx, migratedItem, credential, profileId) : []];
 }
 function buildCodexAuthConfigPatchItems(ctx, item, credential, profileId) {
 	const next = applyCredentialConfig(ctx.config, credential, profileId);
@@ -648,25 +882,27 @@ function buildPluginConfigItem(ctx, pluginItems) {
 async function buildCodexMigrationPlan(ctx) {
 	const targets = resolveCodexMigrationTargets(ctx);
 	const memoryOnly = ctx.itemKinds !== void 0 && ctx.itemKinds.length > 0 && ctx.itemKinds.every((kind) => kind === "memory");
+	const authOnly = ctx.itemKinds !== void 0 && ctx.itemKinds.length > 0 && ctx.itemKinds.every((kind) => kind === "auth");
 	const source = await discoverCodexSource({
 		input: ctx.source,
 		memoryOnly,
-		evaluatePluginMigrationEligibility: !memoryOnly,
+		authOnly,
+		evaluatePluginMigrationEligibility: !memoryOnly && !authOnly,
 		verifyPluginApps: shouldVerifyPluginApps(ctx)
 	});
-	if (!hasCodexSource(source)) throw new Error(`Codex state was not found at ${source.root}. Pass --from <path> if it lives elsewhere.`);
+	if (!hasCodexSource(source) && !authOnly) throw new Error(`Codex state was not found at ${source.root}. Pass --from <path> if it lives elsewhere.`);
 	const items = [];
-	items.push(...await buildCodexMemoryItems({
+	if (!authOnly) items.push(...await buildCodexMemoryItems({
 		memoryFiles: source.memoryFiles,
 		workspaceDir: targets.workspaceDir,
 		overwrite: ctx.overwrite
 	}));
-	if (!memoryOnly) {
-		items.push(...await buildCodexAuthItems({
-			ctx,
-			source,
-			targets
-		}));
+	if (!memoryOnly) items.push(...await buildCodexAuthItems({
+		ctx,
+		source,
+		targets
+	}));
+	if (!memoryOnly && !authOnly) {
 		items.push(...await buildCodexSkillItems({
 			skills: source.skills,
 			workspaceDir: targets.workspaceDir,
@@ -708,4 +944,4 @@ async function buildCodexMigrationPlan(ctx) {
 	};
 }
 //#endregion
-export { CODEX_PLUGIN_CONFIG_ITEM_ID, CODEX_PLUGIN_CONFIG_PATH, buildCodexMigrationPlan, buildCodexPluginsConfigValue, hasCodexPluginConfigConflict, applyCodexAuthItems as n, readCodexPluginMigrationConfigEntry, resolveCodexMigrationTargets as t };
+export { CODEX_PLUGIN_CONFIG_ITEM_ID, CODEX_PLUGIN_CONFIG_PATH, buildCodexMigrationPlan, buildCodexPluginsConfigValue, hasCodexPluginConfigConflict, applyCodexAuthItems as n, resolveCodexConfigPatchMode as r, readCodexPluginMigrationConfigEntry, resolveCodexMigrationTargets as t };

package/dist/{plugin-activation-BQK-f5sV.js → plugin-activation-BYQculil.js}

@@ -1,7 +1,6 @@
-import { m as CODEX_PLUGINS_MARKETPLACE_NAME } from "./config-utils-C57JiJrU.js";
-import { r as CodexAppServerRpcError } from "./session-catalog-provenance-DkJHo735.js";
-import "./config-JDfTI4VI.js";
-import { i as pluginReadParams, n as isOpenAiCuratedMarketplace, r as isOpenAiCuratedMarketplaceName, t as findCodexMarketplacePluginSummary } from "./plugin-inventory-CoRCzWW4.js";
+import { c as CODEX_PLUGINS_MARKETPLACE_NAME, i as pluginReadParams, n as isOpenAiCuratedMarketplace, r as isOpenAiCuratedMarketplaceName, t as findCodexMarketplacePluginSummary } from "./plugin-inventory-oL4Na1ZG.js";
+import { t as CodexAppServerRpcError } from "./rpc-error-ttN_QjEm.js";
+import "./config-oIORaQ5T.js";
 import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 //#region extensions/codex/src/app-server/plugin-activation.ts
 /**
@@ -89,23 +88,29 @@ async function refreshCodexPluginRuntimeState(params) {
 		diagnostics.push({ message: `Codex hooks refresh skipped: ${coerceErrorMessage(error)}` });
 	}
 	await params.request("config/mcpServer/reload", void 0);
-	if (params.appCache && params.appCacheKey) {
-		params.appCache.invalidate(params.appCacheKey, "Codex plugin activation changed app inventory", void 0, params.targetAppIds);
-		if (params.deferAppInventoryRefresh) return { diagnostics };
-		const request = async (method, requestParams) => await params.request(method, requestParams);
-		try {
-			await params.appCache.refreshNow({
-				key: params.appCacheKey,
-				request,
-				forceRefetch: true,
-				targetAppIds: params.targetAppIds
-			});
-		} catch (error) {
-			diagnostics.push({ message: `Codex app inventory refresh skipped: ${coerceErrorMessage(error)}` });
-		}
+	if (params.appCache && params.appCacheKey) try {
+		await refreshCodexAppRuntimeState({
+			...params,
+			appCache: params.appCache,
+			appCacheKey: params.appCacheKey
+		});
+	} catch (error) {
+		diagnostics.push({ message: `Codex app inventory refresh skipped: ${coerceErrorMessage(error)}` });
 	}
 	return { diagnostics };
 }
+/** Refreshes hosted app tools without reloading unrelated active threads. */
+async function refreshCodexAppRuntimeState(params) {
+	params.appCache.invalidate(params.appCacheKey, "Codex plugin app inventory refresh requested", void 0, params.targetAppIds);
+	if (params.deferAppInventoryRefresh) return;
+	const request = async (method, requestParams) => await params.request(method, requestParams);
+	await params.appCache.refreshNow({
+		key: params.appCacheKey,
+		request,
+		forceRefetch: true,
+		targetAppIds: params.targetAppIds
+	});
+}
 async function listCuratedCodexPluginMetadata(params, options = {}) {
 	const requestParams = {
 		...params.configCwd ? { cwds: [params.configCwd] } : {},
@@ -130,4 +135,4 @@ function activationFailure(identity, reason, diagnostic, extraDiagnostics = [])
 	};
 }
 //#endregion
-export { refreshCodexPluginRuntimeState as n, ensureCodexPluginActivation as t };
+export { refreshCodexAppRuntimeState as n, refreshCodexPluginRuntimeState as r, ensureCodexPluginActivation as t };

package/dist/{plugin-app-cache-key-CdSQzWyX.js → plugin-app-cache-key-d0eKxy7b.js}

@@ -1,4 +1,4 @@
-import { c as resolveCodexAppServerLocalHomeDir, l as resolveCodexAppServerUserHomeDir, s as resolveCodexAppServerHomeDir } from "./protocol-CAAcVIKF.js";
+import { c as resolveCodexAppServerLocalHomeDir, l as resolveCodexAppServerUserHomeDir, s as resolveCodexAppServerHomeDir } from "./protocol-5bh1G-H7.js";
 import { createRequire } from "node:module";
 import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash } from "node:crypto";

package/dist/{plugin-approval-roundtrip-DeW95wB5.js → plugin-approval-roundtrip-Bz3FT8W5.js}

@@ -1,4 +1,4 @@
-import { A as resolveCodexGatewayTimeoutWithGraceMs } from "./shared-client-CVhez2Uo.js";
+import { P as resolveCodexGatewayTimeoutWithGraceMs } from "./shared-client-CscigXXL.js";
 import { isApprovalNotFoundError, toErrorObject } from "openclaw/plugin-sdk/error-runtime";
 import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 //#region extensions/codex/src/app-server/plugin-approval-roundtrip.ts

package/dist/{plugin-inventory-CoRCzWW4.js → plugin-inventory-oL4Na1ZG.js}

@@ -1,7 +1,10 @@
-import { h as CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME, m as CODEX_PLUGINS_MARKETPLACE_NAME } from "./config-utils-C57JiJrU.js";
-import { S as resolveCodexPluginsPolicy } from "./protocol-CAAcVIKF.js";
-import "./config-JDfTI4VI.js";
+import { S as resolveCodexPluginsPolicy } from "./protocol-5bh1G-H7.js";
+import "./config-oIORaQ5T.js";
 import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
+//#region extensions/codex/src/app-server/config-contracts.ts
+const CODEX_PLUGINS_MARKETPLACE_NAME = "openai-curated";
+const CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME = "workspace-directory";
+//#endregion
 //#region extensions/codex/src/app-server/plugin-inventory.ts
 /**
 * Reads Codex plugin marketplace state and app inventory to decide which
@@ -322,4 +325,4 @@ function isOpenAiCuratedMarketplaceName(marketplaceName) {
 	return marketplaceName === "openai-curated" || marketplaceName === CODEX_PLUGINS_REMOTE_MARKETPLACE_NAME || marketplaceName === CODEX_PLUGINS_API_MARKETPLACE_NAME;
 }
 //#endregion
-export { readCodexPluginInventory as a, pluginReadParams as i, isOpenAiCuratedMarketplace as n, resolveOwnedAppApprovalOverrideKeys as o, isOpenAiCuratedMarketplaceName as r, resolveRecoverableCodexPluginConfigKeys as s, findCodexMarketplacePluginSummary as t };
+export { readCodexPluginInventory as a, CODEX_PLUGINS_MARKETPLACE_NAME as c, pluginReadParams as i, CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME as l, isOpenAiCuratedMarketplace as n, resolveOwnedAppApprovalOverrideKeys as o, isOpenAiCuratedMarketplaceName as r, resolveRecoverableCodexPluginConfigKeys as s, findCodexMarketplacePluginSummary as t };