@openclaw/codex 2026.9.3 → 2026.9.5

package/dist/{plugin-app-cache-key-CdSQzWyX.js → .setup/plugin-app-cache-key-BOxKP7db.mjs}

@@ -1,4 +1,4 @@
-import { c as resolveCodexAppServerLocalHomeDir, l as resolveCodexAppServerUserHomeDir, s as resolveCodexAppServerHomeDir } from "./protocol-CAAcVIKF.js";
+import { _ as resolveCodexAppServerUserHomeDir, g as resolveCodexAppServerLocalHomeDir, h as resolveCodexAppServerHomeDir } from "./config-security-BRQ2mgW9.mjs";
 import { createRequire } from "node:module";
 import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash } from "node:crypto";
@@ -6,6 +6,22 @@ import { OPENCLAW_VERSION, embeddedAgentLog } from "openclaw/plugin-sdk/agent-ha
 import { isFutureDateTimestampMs, resolveDateTimestampMs, resolveExpiresAtMsFromDurationMs } from "openclaw/plugin-sdk/number-runtime";
 import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import { readPluginPackageVersion } from "openclaw/plugin-sdk/extension-shared";
+//#region extensions/codex/src/app-server/app-identity.ts
+/**
+* Apps SDK manifests and installed Codex connections can name the same app
+* with asdk_app_ and legacy connector_ prefixes. Only the shared 128-bit ID
+* establishes equivalence; display names never establish app ownership.
+* Keep the installed ID for native config and calls. This comparison bridge
+* can retire when installed inventories consistently return Apps SDK IDs.
+*/
+function codexAppIdentityKey(id) {
+	return id.replace(/^connector_([a-f0-9]{32})$/, "asdk_app_$1");
+}
+/** Resolves a declared app against account-authorized runtime metadata. */
+function findCodexAppById(apps, id) {
+	return apps.find((app) => app.id === id) ?? apps.find((app) => codexAppIdentityKey(app.id) === codexAppIdentityKey(id));
+}
+//#endregion
 //#region extensions/codex/src/app-server/app-inventory-cache.ts
 /**
 * Process-local cache for Codex app-server app inventories, keyed by runtime
@@ -69,7 +85,7 @@ var CodexAppInventoryCache = class {
 		};
 		const entry = this.entries.get(key);
 		if (entry) {
-			const scope = invalidatedAppIds?.filter(Boolean) ?? [];
+			const scope = invalidatedAppIds?.filter(Boolean).map(codexAppIdentityKey) ?? [];
 			if (!entry.invalidated) entry.invalidatedAppIds = scope.length ? [...scope].toSorted() : void 0;
 			else if (entry.invalidatedAppIds && scope.length) entry.invalidatedAppIds = Array.from(/* @__PURE__ */ new Set([...entry.invalidatedAppIds, ...scope])).toSorted();
 			else entry.invalidatedAppIds = void 0;
@@ -106,7 +122,7 @@ var CodexAppInventoryCache = class {
 		const promise = this.refreshUncoalesced(params, refreshToken, previousRefresh);
 		const currentRefresh = {
 			promise,
-			targetAppIds: new Set(params.targetAppIds?.filter(Boolean) ?? [])
+			targetAppIds: new Set(params.targetAppIds?.filter(Boolean).map(codexAppIdentityKey) ?? [])
 		};
 		this.inFlight.set(params.key, currentRefresh);
 		try {
@@ -133,7 +149,7 @@ var CodexAppInventoryCache = class {
 				key: params.key,
 				apps: inventory.apps,
 				installedApps: inventory.installedApps,
-				...params.targetAppIds?.some(Boolean) ? { targetAppIds: Array.from(new Set(params.targetAppIds.filter(Boolean))).toSorted() } : {},
+				...params.targetAppIds?.some(Boolean) ? { targetAppIds: Array.from(new Set(params.targetAppIds.filter(Boolean).map(codexAppIdentityKey))).toSorted() } : {},
 				fetchedAtMs: nowMs,
 				expiresAtMs,
 				revision: this.revision
@@ -191,13 +207,13 @@ function resolvePublishedInventorySnapshot(existing, snapshot, nowMs) {
 }
 /** Replaces refreshed target rows in place, deletes vanished ones, appends new ones. */
 function mergeRefreshedRows(existingRows, refreshedRows, refreshedTargetIds) {
-	const refreshedById = new Map(refreshedRows.map((row) => [row.id, row]));
-	const existingIds = new Set(existingRows.map((row) => row.id));
+	const refreshedById = new Map(refreshedRows.map((row) => [codexAppIdentityKey(row.id), row]));
+	const existingIds = new Set(existingRows.map((row) => codexAppIdentityKey(row.id)));
 	return [...existingRows.flatMap((row) => {
-		if (!refreshedTargetIds.has(row.id)) return [row];
-		const refreshed = refreshedById.get(row.id);
+		if (!refreshedTargetIds.has(codexAppIdentityKey(row.id))) return [row];
+		const refreshed = refreshedById.get(codexAppIdentityKey(row.id));
 		return refreshed ? [refreshed] : [];
-	}), ...refreshedRows.filter((row) => !existingIds.has(row.id))];
+	}), ...refreshedRows.filter((row) => !existingIds.has(codexAppIdentityKey(row.id)))];
 }
 /**
 * A refresh retires exactly the invalidation scope it re-read: a complete
@@ -217,7 +233,7 @@ function resolveRemainingInvalidationScope(existing, snapshot) {
 }
 function doesInFlightRefreshCover(existing, params) {
 	if (existing.targetAppIds.size === 0) return true;
-	const requestedAppIds = new Set(params.targetAppIds?.filter(Boolean) ?? []);
+	const requestedAppIds = new Set(params.targetAppIds?.filter(Boolean).map(codexAppIdentityKey) ?? []);
 	return requestedAppIds.size > 0 && Array.from(requestedAppIds).every((appId) => existing.targetAppIds.has(appId));
 }
 /** Serializes a refresh failure without leaking large or sensitive error data. */
@@ -257,8 +273,8 @@ function normalizeRuntimeIdentityForCacheKey(value) {
 }
 async function readInstalledApps(request, options) {
 	const installed = await request("app/installed", { forceRefresh: options.forceRefresh });
-	const targetIds = new Set((options.targetAppIds ?? []).filter(Boolean));
-	const apps = targetIds.size === 0 ? installed.apps : installed.apps.filter((app) => targetIds.has(app.id));
+	const targetIds = new Set((options.targetAppIds ?? []).filter(Boolean).map(codexAppIdentityKey));
+	const apps = targetIds.size === 0 ? installed.apps : installed.apps.filter((app) => targetIds.has(codexAppIdentityKey(app.id)));
 	if (apps.length === 0) return {
 		apps: [],
 		installedApps: []
@@ -335,14 +351,6 @@ function isSensitiveErrorDataKey(key) {
 */
 const require = createRequire(import.meta.url);
 const CODEX_PLUGIN_VERSION = readPluginPackageVersion({ require });
-let catalogConnectionHomes = /* @__PURE__ */ new Map();
-function catalogConnectionHomeKey(fingerprint, agentDir) {
-	return `${agentDir ?? ""}\0${fingerprint}`;
-}
-/** Replaces the lifecycle-owned catalog connection snapshot used by supervised bindings. */
-function replaceCodexCatalogConnectionHomes(homes) {
-	catalogConnectionHomes = new Map(homes.map((home) => [catalogConnectionHomeKey(home.fingerprint, home.agentDir), home.codexHome]));
-}
 /** Builds the full app inventory cache key for Codex plugin/app discovery. */
 function buildCodexPluginAppCacheKey(params) {
 	return buildCodexAppInventoryCacheKey({
@@ -379,10 +387,6 @@ function buildCodexAppServerConnectionFingerprint(appServer, agentDir) {
 		cwd: appServer.start.cwd ?? null
 	});
 }
-/** Looks up a snapshotted catalog store without repeating filesystem discovery on a run. */
-function resolveCodexCatalogConnectionHome(fingerprint, agentDir) {
-	return catalogConnectionHomes.get(catalogConnectionHomeKey(fingerprint, agentDir));
-}
 function resolveCodexAppServerConnectionHome(start, agentDir) {
 	const configured = start.env?.CODEX_HOME?.trim();
 	if (configured) return configured;
@@ -424,4 +428,4 @@ function fingerprintCodexPluginAppCacheCredentials(startOptions) {
 	return `sha256:${hash.digest("hex")}`;
 }
 //#endregion
-export { resolveCodexCatalogConnectionHome as a, serializeCodexAppInventoryError as c, replaceCodexCatalogConnectionHomes as i, buildCodexAppServerRuntimeFingerprint as n, CodexAppInventoryCache as o, buildCodexPluginAppCacheKey as r, defaultCodexAppInventoryCache as s, buildCodexAppServerConnectionFingerprint as t };
+export { defaultCodexAppInventoryCache as a, findCodexAppById as c, CodexAppInventoryCache as i, buildCodexAppServerRuntimeFingerprint as n, serializeCodexAppInventoryError as o, buildCodexPluginAppCacheKey as r, codexAppIdentityKey as s, buildCodexAppServerConnectionFingerprint as t };

package/dist/{plugin-approval-roundtrip-DeW95wB5.js → .setup/plugin-approval-roundtrip-CjfzafAZ.mjs}

@@ -1,4 +1,4 @@
-import { A as resolveCodexGatewayTimeoutWithGraceMs } from "./shared-client-CVhez2Uo.js";
+import { it as resolveCodexGatewayTimeoutWithGraceMs } from "./shared-client-BpTtuLQ5.mjs";
 import { isApprovalNotFoundError, toErrorObject } from "openclaw/plugin-sdk/error-runtime";
 import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 //#region extensions/codex/src/app-server/plugin-approval-roundtrip.ts

package/dist/{plugin-inventory-CoRCzWW4.js → .setup/plugin-inventory-DUle8DLz.mjs}

@@ -1,7 +1,11 @@
-import { h as CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME, m as CODEX_PLUGINS_MARKETPLACE_NAME } from "./config-utils-C57JiJrU.js";
-import { S as resolveCodexPluginsPolicy } from "./protocol-CAAcVIKF.js";
-import "./config-JDfTI4VI.js";
+import { f as resolveCodexPluginsPolicy } from "./config-parsing-CcB9iPoq.mjs";
+import { c as findCodexAppById } from "./plugin-app-cache-key-BOxKP7db.mjs";
+import "./config-CedDWjM-.mjs";
 import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
+//#region extensions/codex/src/app-server/config-contracts.ts
+const CODEX_PLUGINS_MARKETPLACE_NAME = "openai-curated";
+const CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME = "workspace-directory";
+//#endregion
 //#region extensions/codex/src/app-server/plugin-inventory.ts
 /**
 * Reads Codex plugin marketplace state and app inventory to decide which
@@ -106,7 +110,7 @@ async function readCodexPluginInventory(params) {
 			activationRequired: pluginPolicy.enabled && (unavailableByMarketplacePolicy || !summary.installed || !summary.enabled),
 			authRequired: apps.some((app) => app.needsAuth || !app.accessible),
 			appOwnership,
-			ownedAppIds,
+			ownedAppIds: Array.from(/* @__PURE__ */ new Set([...ownedAppIds, ...apps.map((app) => app.id)])).toSorted(),
 			apps
 		});
 	}
@@ -234,9 +238,9 @@ function resolveOwnedApps(params) {
 		});
 		return [];
 	}
-	const appInfoById = new Map((params.appInventory?.snapshot?.apps ?? []).map((app) => [app.id, app]));
+	const appInfos = params.appInventory?.snapshot?.apps ?? [];
 	return detailApps.map((app) => {
-		const info = appInfoById.get(app.id);
+		const info = findCodexAppById(appInfos, app.id);
 		if (!info) return {
 			id: app.id,
 			name: app.name,
@@ -245,7 +249,7 @@ function resolveOwnedApps(params) {
 			needsAuth: true
 		};
 		return Object.assign({
-			id: app.id,
+			id: info.id,
 			name: app.name,
 			accessible: info.isAccessible,
 			enabled: info.isEnabled,
@@ -322,4 +326,4 @@ function isOpenAiCuratedMarketplaceName(marketplaceName) {
 	return marketplaceName === "openai-curated" || marketplaceName === CODEX_PLUGINS_REMOTE_MARKETPLACE_NAME || marketplaceName === CODEX_PLUGINS_API_MARKETPLACE_NAME;
 }
 //#endregion
-export { readCodexPluginInventory as a, pluginReadParams as i, isOpenAiCuratedMarketplace as n, resolveOwnedAppApprovalOverrideKeys as o, isOpenAiCuratedMarketplaceName as r, resolveRecoverableCodexPluginConfigKeys as s, findCodexMarketplacePluginSummary as t };
+export { readCodexPluginInventory as a, CODEX_PLUGINS_MARKETPLACE_NAME as c, pluginReadParams as i, CODEX_PLUGINS_WORKSPACE_MARKETPLACE_NAME as l, isOpenAiCuratedMarketplace as n, resolveOwnedAppApprovalOverrideKeys as o, isOpenAiCuratedMarketplaceName as r, resolveRecoverableCodexPluginConfigKeys as s, findCodexMarketplacePluginSummary as t };

package/dist/{plugin-marketplace-discovery-3akBizzF.js → .setup/plugin-marketplace-discovery-P-Vndfqq.mjs}

@@ -12,21 +12,26 @@ function canMutateCodexHost(ctx) {
 //#endregion
 //#region extensions/codex/src/plugin-marketplace-discovery.ts
 /** Read-only discovery of Codex-owned local, curated, and remote plugin marketplaces. */
-const PLUGIN_SEGMENT_PATTERN = /^[A-Za-z0-9_-]+$/;
-const MAX_PLUGIN_DESCRIPTION_LENGTH = 160;
+const PLUGIN_NAME_PATTERN = /^[A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+)*$/;
+const MARKETPLACE_NAME_PATTERN = /^[A-Za-z0-9_-]+$/;
+const MAX_PLUGIN_METADATA_LENGTH = 160;
 const SUPPLEMENTAL_MARKETPLACE_KINDS = [
 	"workspace-directory",
 	"shared-with-me",
 	"created-by-me-remote",
 	"vertical"
 ];
+function filterCodexMarketplacePlugins(plugins, query, marketplace) {
+	const normalizedQuery = query.trim().toLowerCase();
+	return plugins.filter((plugin) => (!marketplace || plugin.marketplaceName === marketplace) && (!normalizedQuery || `${plugin.id} ${plugin.displayName ?? ""} ${plugin.developerName ?? ""} ${plugin.description ?? ""}`.toLowerCase().includes(normalizedQuery)));
+}
 /** Validates the same identifier segments required by Codex's stable PluginId parser. */
 function parseCodexPluginMarketplaceId(value) {
 	const separator = value.lastIndexOf("@");
 	if (separator <= 0 || separator === value.length - 1) return;
 	const pluginName = value.slice(0, separator);
 	const marketplaceName = value.slice(separator + 1);
-	return PLUGIN_SEGMENT_PATTERN.test(pluginName) && PLUGIN_SEGMENT_PATTERN.test(marketplaceName) ? {
+	return PLUGIN_NAME_PATTERN.test(pluginName) && MARKETPLACE_NAME_PATTERN.test(marketplaceName) ? {
 		pluginName,
 		marketplaceName
 	} : void 0;
@@ -62,17 +67,21 @@ async function discoverCodexMarketplacePlugins(params) {
 	const discovered = /* @__PURE__ */ new Map();
 	const ambiguous = /* @__PURE__ */ new Set();
 	for (const marketplace of marketplaces) {
-		if (!PLUGIN_SEGMENT_PATTERN.test(marketplace.name)) continue;
+		if (!MARKETPLACE_NAME_PATTERN.test(marketplace.name)) continue;
 		for (const summary of marketplace.plugins) {
 			const pluginName = pluginSlug(summary, marketplace.name);
 			if (!pluginName) continue;
 			const id = `${pluginName}@${marketplace.name}`;
 			if (ambiguous.has(id)) continue;
 			const previous = discovered.get(id);
+			const pluginInterface = asOptionalRecord(summary.interface);
 			const next = {
 				id,
 				pluginName,
 				marketplaceName: marketplace.name,
+				displayName: boundedCatalogText(pluginInterface?.displayName) || void 0,
+				developerName: boundedCatalogText(pluginInterface?.developerName) || void 0,
+				description: boundedCatalogText(pluginInterface?.shortDescription) || boundedCatalogText(pluginInterface?.longDescription) || void 0,
 				installed: summary.installed,
 				enabled: summary.enabled,
 				available: summary.availability !== "DISABLED_BY_ADMIN" && summary.installPolicy !== "NOT_AVAILABLE",
@@ -85,8 +94,6 @@ async function discoverCodexMarketplacePlugins(params) {
 				} : {},
 				summaryId: summary.id
 			};
-			const description = pluginDescription(summary);
-			if (description) next.description = description;
 			if (previous && (previous.marketplacePath !== next.marketplacePath || previous.remotePluginId !== next.remotePluginId)) {
 				discovered.delete(id);
 				ambiguous.add(id);
@@ -114,21 +121,17 @@ function pluginSlug(summary, marketplaceName) {
 	const qualified = parseCodexPluginMarketplaceId(summary.id);
 	if (qualified?.marketplaceName === marketplaceName) return qualified.pluginName;
 	const identitySegment = summary.id.split("/").at(-1);
-	if (identitySegment && PLUGIN_SEGMENT_PATTERN.test(identitySegment)) return identitySegment;
-	return PLUGIN_SEGMENT_PATTERN.test(summary.name) ? summary.name : void 0;
-}
-function pluginDescription(summary) {
-	const description = asOptionalRecord(summary.interface)?.shortDescription;
-	if (typeof description !== "string") return;
-	return boundedCatalogText(description) || void 0;
+	if (identitySegment && PLUGIN_NAME_PATTERN.test(identitySegment)) return identitySegment;
+	return PLUGIN_NAME_PATTERN.test(summary.name) ? summary.name : void 0;
 }
 function boundedCatalogText(value) {
+	if (typeof value !== "string") return "";
 	let sanitized = "";
 	for (const character of value) {
 		const codePoint = character.codePointAt(0);
 		sanitized += codePoint !== void 0 && (codePoint <= 31 || codePoint >= 127 && codePoint <= 159) ? " " : character;
 	}
-	return sanitized.replace(/\s+/g, " ").trim().slice(0, MAX_PLUGIN_DESCRIPTION_LENGTH);
+	return sanitized.replace(/\s+/g, " ").trim().slice(0, MAX_PLUGIN_METADATA_LENGTH);
 }
 //#endregion
-export { CODEX_NATIVE_EXECUTION_AUTH_ERROR as a, CODEX_HOST_INSPECTION_AUTH_ERROR as i, parseCodexPluginMarketplaceId as n, canMutateCodexHost as o, CODEX_FULL_PERMISSIONS_AUTH_ERROR as r, hasCodexAdminScope as s, discoverCodexMarketplacePlugins as t };
+export { CODEX_HOST_INSPECTION_AUTH_ERROR as a, hasCodexAdminScope as c, CODEX_FULL_PERMISSIONS_AUTH_ERROR as i, filterCodexMarketplacePlugins as n, CODEX_NATIVE_EXECUTION_AUTH_ERROR as o, parseCodexPluginMarketplaceId as r, canMutateCodexHost as s, discoverCodexMarketplacePlugins as t };

package/dist/{plugin-metadata-cache-DgNfRAGA.js → .setup/plugin-metadata-cache-DsS5buNa.mjs}

@@ -1,12 +1,12 @@
-import { o as resolveCodexComputerUseConfig } from "./config-options-jnIFvwxD.js";
-import { s as resolveCodexAppServerHomeDir } from "./protocol-CAAcVIKF.js";
-import { c as isCodexAppServerIndeterminateTransportError, o as isCodexAppServerConnectionClosedError, s as isCodexAppServerIndeterminateRequestCancellationError } from "./client-BEKu4yDx.js";
-import { c as resolveMacOSDesktopCodexBundledMarketplaceCandidates, o as resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath, t as isManagedCodexDesktopCommand } from "./managed-binary-DrjjRRUD.js";
-import { n as describeControlFailure } from "./capabilities-BeqLPbtM.js";
-import { i as requestCodexAppServerJson } from "./request-CGvGOpeR.js";
-import "./config-JDfTI4VI.js";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-BWf6JLWG.js";
-import { $ as assertNotSymlink, Q as resolveCodexManagedBundledMarketplacePath, T as acquireCodexNativeConfigFence, Y as reconcileCodexComputerUseStartArtifacts, b as waitForCodexAppServerClientDesktopGenerationDrain, c as getLeasedSharedCodexAppServerClient, d as readCodexAppServerClientDesktopGeneration, g as resolveCodexNativeConfigFenceKey, h as releaseLeasedSharedCodexAppServerClient, p as readCodexAppServerClientProcessIdentity, t as assertCodexAppServerClientStartSelectionCurrent, u as isCodexAppServerStartSelectionChangedError } from "./shared-client-CVhez2Uo.js";
+import { h as resolveCodexAppServerHomeDir } from "./config-security-BRQ2mgW9.mjs";
+import { c as isCodexAppServerIndeterminateTransportError, o as isCodexAppServerConnectionClosedError, s as isCodexAppServerIndeterminateRequestCancellationError } from "./client-vXs2929Q.mjs";
+import { o as resolveCodexComputerUseConfig } from "./config-options-BsanJ8QG.mjs";
+import { l as resolveMacOSDesktopCodexBundledMarketplaceCandidates, s as resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath, t as isManagedCodexDesktopCommand } from "./managed-binary-DP6Rib3P.mjs";
+import { n as describeControlFailure } from "./capabilities-_vXcZGSx.mjs";
+import { i as requestCodexAppServerJson } from "./request-BioXJLYa.mjs";
+import "./config-CedDWjM-.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-CeAhl_h4.mjs";
+import { $ as assertNotSymlink, D as acquireCodexNativeConfigFence, Q as resolveCodexManagedBundledMarketplacePath, Y as reconcileCodexComputerUseStartArtifacts, b as waitForCodexAppServerClientDesktopGenerationDrain, c as getLeasedSharedCodexAppServerClient, d as readCodexAppServerClientDesktopGeneration, g as resolveCodexNativeConfigFenceKey, h as releaseLeasedSharedCodexAppServerClient, p as readCodexAppServerClientProcessIdentity, t as assertCodexAppServerClientStartSelectionCurrent, u as isCodexAppServerStartSelectionChangedError } from "./shared-client-BpTtuLQ5.mjs";
 import { existsSync } from "node:fs";
 import path from "node:path";
 import fs$1 from "node:fs/promises";
@@ -33,6 +33,9 @@ const COMPUTER_USE_MARKETPLACE_NAME_PRIORITY = [
 ];
 const COMPUTER_USE_LIVE_TEST_RETRY_COUNT = 1;
 const COMPUTER_USE_LIVE_TEST_THREAD_NAME = "OpenClaw Computer Use readiness probe";
+const COMPUTER_USE_LIST_APPS_TOOL = "list_apps";
+const COMPUTER_USE_UNIFIED_JS_TOOL = "js";
+const COMPUTER_USE_UNIFIED_JS_PROBE = "await cua.getState();";
 /** Reads Computer Use readiness without installing or mutating app-server state. */
 async function readCodexComputerUseStatus(params = {}) {
 	const config = resolveComputerUseConfig(params);
@@ -318,7 +321,8 @@ async function readComputerUseTools(params) {
 	params.releaseNativeConfigFence?.();
 	const { liveTest, repair } = await runCodexComputerUseLiveTest({
 		request: params.request,
-		config: params.config
+		config: params.config,
+		tools
 	});
 	const compatibilityStartupAllowed = !liveTest.ok && !params.config.strictReadiness;
 	return {
@@ -342,6 +346,7 @@ async function runCodexComputerUseLiveTest(params) {
 	const startedAt = Date.now();
 	let lastError;
 	let repair;
+	const probe = resolveComputerUseLiveTestProbe(params.tools);
 	for (let attempt = 0; attempt <= COMPUTER_USE_LIVE_TEST_RETRY_COUNT; attempt += 1) {
 		let threadId;
 		try {
@@ -350,12 +355,12 @@ async function runCodexComputerUseLiveTest(params) {
 				developerInstructions: COMPUTER_USE_LIVE_TEST_THREAD_NAME,
 				ephemeral: true
 			}, { timeoutMs: params.config.liveTestTimeoutMs })).thread.id;
-			await params.request("mcpServer/tool/call", {
+			if ((await params.request("mcpServer/tool/call", {
 				threadId,
 				server: params.config.mcpServerName,
-				tool: "list_apps",
-				arguments: {}
-			}, { timeoutMs: params.config.toolCallTimeoutMs });
+				tool: probe.tool,
+				arguments: probe.arguments
+			}, { timeoutMs: params.config.toolCallTimeoutMs })).isError === true) throw new Error(`Computer Use readiness tool ${params.config.mcpServerName}.${probe.tool} returned an error result`);
 			return {
 				liveTest: {
 					status: "passed",
@@ -395,6 +400,16 @@ async function runCodexComputerUseLiveTest(params) {
 		...repair ? { repair } : {}
 	};
 }
+function resolveComputerUseLiveTestProbe(tools) {
+	if (tools?.includes(COMPUTER_USE_UNIFIED_JS_TOOL) && !tools.includes(COMPUTER_USE_LIST_APPS_TOOL)) return {
+		tool: COMPUTER_USE_UNIFIED_JS_TOOL,
+		arguments: { code: COMPUTER_USE_UNIFIED_JS_PROBE }
+	};
+	return {
+		tool: COMPUTER_USE_LIST_APPS_TOOL,
+		arguments: {}
+	};
+}
 async function repairComputerUseMcpRuntime(request, config) {
 	try {
 		await request("config/mcpServer/reload", void 0, { timeoutMs: config.liveTestTimeoutMs });
@@ -445,6 +460,7 @@ async function resolveMarketplaceRef(params) {
 		candidates = await listComputerUseMarketplaceCandidates(params.request, params.config);
 	}
 	const waitUntil = marketplaceDiscoveryWaitUntil(params);
+	if (candidates.length === 0 && waitUntil > Date.now() && await codexNativePluginsDisabled(params.request)) return { message: "Codex native plugin support is disabled (features.plugins = false). Enable it in the Codex config, then run /codex computer-use install." };
 	while (candidates.length === 0) {
 		if (Date.now() >= waitUntil) break;
 		await delay(Math.min(CURATED_MARKETPLACE_POLL_INTERVAL_MS, waitUntil - Date.now()), params.signal);
@@ -477,6 +493,9 @@ async function migrateLegacyBundledMarketplaceSource(params) {
 async function listComputerUseMarketplaceCandidates(request, config) {
 	return findComputerUseMarketplaces(await request("plugin/list", { cwds: [] }), config.pluginName);
 }
+async function codexNativePluginsDisabled(request) {
+	return (await request("experimentalFeature/list", {})).data.find(({ name }) => name === "plugins")?.enabled === false;
+}
 function blockUnsafeAutoInstallStatus(config) {
 	if (!config.marketplaceSource) return;
 	return unavailableStatus(config, "auto_install_blocked", "Computer Use auto-install only uses marketplaces Codex app-server has already discovered. Run /codex computer-use install to install from a configured marketplace source.");

package/dist/{provider-capabilities-W4tfK5Y5.js → .setup/provider-capabilities-B8J4Dy-O.mjs}

@@ -1,5 +1,5 @@
-import { h as releaseLeasedSharedCodexAppServerClient } from "./shared-client-CVhez2Uo.js";
-import { st as normalizeCodexDynamicToolName } from "./thread-lifecycle-D1pzRwHB.js";
+import { h as releaseLeasedSharedCodexAppServerClient } from "./shared-client-BpTtuLQ5.mjs";
+import { lt as normalizeCodexDynamicToolName } from "./thread-lifecycle-Cik28qWn.mjs";
 import { pinExecToolTarget } from "openclaw/plugin-sdk/codex-mcp-projection";
 import { loadNodeExecAvailability } from "openclaw/plugin-sdk/node-selection-runtime";
 //#region extensions/codex/src/app-server/shell-dynamic-tools.ts

package/dist/.setup/provider-fFh_-VR3.mjs

@@ -0,0 +1,50 @@
+//#region extensions/codex/src/migration/provider.ts
+function isMemoryOnlyMigration(ctx) {
+	return Boolean(ctx.itemKinds && ctx.itemKinds.length > 0 && ctx.itemKinds.every((kind) => kind === "memory"));
+}
+function isAuthOnlyMigration(ctx) {
+	return Boolean(ctx.itemKinds && ctx.itemKinds.length > 0 && ctx.itemKinds.every((kind) => kind === "auth"));
+}
+function buildCodexMigrationProvider(params = {}) {
+	return {
+		id: "codex",
+		label: "Codex",
+		description: "Import Codex memory and skills while keeping Codex native plugins and hooks explicit.",
+		supportedItemKinds: ["memory", "auth"],
+		async detect(ctx) {
+			const { discoverCodexSource, hasCodexSource } = await import("./source-Bjp4UQij.mjs").then((n) => n.a);
+			const source = await discoverCodexSource({
+				input: ctx.source,
+				memoryOnly: isMemoryOnlyMigration(ctx),
+				authOnly: isAuthOnlyMigration(ctx)
+			});
+			const found = isMemoryOnlyMigration(ctx) ? source.memoryFiles.length > 0 : isAuthOnlyMigration(ctx) ? Boolean(source.authPath) : hasCodexSource(source);
+			return {
+				found,
+				source: source.root,
+				label: "Codex",
+				confidence: found ? source.confidence : "low",
+				message: found ? "Codex state found." : "Codex state not found."
+			};
+		},
+		async plan(ctx) {
+			const { buildCodexMigrationPlan } = await import("./plan-xD7WKYTM.mjs");
+			return buildCodexMigrationPlan(ctx);
+		},
+		deferredApply: { retrySafe: true },
+		prepareApply(ctx) {
+			if (isMemoryOnlyMigration(ctx) || isAuthOnlyMigration(ctx)) return;
+			return import("./apply-CJ0ZfmBG.mjs").then(({ prepareTargetCodexAppServer }) => prepareTargetCodexAppServer(ctx));
+		},
+		async apply(ctx, plan) {
+			const { applyCodexMigrationPlan } = await import("./apply-CJ0ZfmBG.mjs");
+			return await applyCodexMigrationPlan({
+				ctx,
+				plan,
+				runtime: params.runtime
+			});
+		}
+	};
+}
+//#endregion
+export { buildCodexMigrationProvider as t };