@openclaw/codex 2026.9.4 → 2026.9.5

package/dist/.setup/config-security-BRQ2mgW9.mjs

@@ -0,0 +1,465 @@
+import { u as readNonEmptyString } from "./config-utils-DujwEnhg.mjs";
+import { t as DEFAULT_CODEX_APP_SERVER_NETWORK_PROXY_PROFILE_PREFIX } from "./config-parsing-CcB9iPoq.mjs";
+import { r as normalizeCodexAppServerArgs } from "./launch-args-DnMak49W.mjs";
+import { isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { createHash } from "node:crypto";
+import { AgentHarnessPreflightError } from "openclaw/plugin-sdk/agent-harness-registration";
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { homedir, hostname } from "node:os";
+import { isLoopbackHost } from "openclaw/plugin-sdk/request-url";
+//#region extensions/codex/src/app-server/config-exec-policy.ts
+function selectForcedPromptingSandbox(params) {
+	if (params.configuredSandbox === "read-only" || params.defaultSandbox === "read-only") return "read-only";
+	return params.defaultSandbox ?? "workspace-write";
+}
+function selectForcedDangerFullAccessSandbox(params) {
+	if (params.configuredSandbox === "read-only") return "read-only";
+	if (params.defaultPolicy?.dangerFullAccessAllowed === false) {
+		if (params.openClawSandboxActive) return params.defaultPolicy.sandbox ?? "workspace-write";
+		throw new Error("legacy full exec security with ask requires Codex app-server danger-full-access");
+	}
+	return "danger-full-access";
+}
+function selectGuardianSandbox(allowedSandboxModes) {
+	if (allowedSandboxModes === void 0 || allowedSandboxModes.has("workspace-write")) return "workspace-write";
+	if (allowedSandboxModes.has("read-only")) return "read-only";
+	if (allowedSandboxModes.has("danger-full-access")) return "danger-full-access";
+	return "workspace-write";
+}
+function resolveApprovalPolicy(value) {
+	if (value === "untrusted") throw new Error("Codex app-server approval policy \"untrusted\" is retired; run \"openclaw doctor --fix\" and use \"on-request\".");
+	if (value === "on-failure") return "on-request";
+	return value === "on-request" || value === "never" ? value : void 0;
+}
+function resolveSandbox(value) {
+	return value === "read-only" || value === "workspace-write" || value === "danger-full-access" ? value : void 0;
+}
+function resolveApprovalsReviewer(value) {
+	return value === "auto_review" || value === "guardian_subagent" || value === "user" ? value : void 0;
+}
+function resolveEffectiveOpenClawExecModeForCodexAppServer(params) {
+	if (params.execPolicy?.touched === true) return params.execPolicy.mode;
+	return params.execMode;
+}
+function resolveCodexPolicyModeForOpenClawExecMode(mode) {
+	if (!mode || mode === "full") return;
+	return "guardian";
+}
+function assertCodexAppServerAllowedForOpenClawExecMode(mode) {
+	if (mode === "deny" || mode === "allowlist") throw new AgentHarnessPreflightError(`Codex app-server local execution is unavailable because effective tools.exec.mode=${mode}. Execution-host approvals are authoritative. For gateway turns, inspect them with \`openclaw approvals get --gateway\` and update that same target with \`openclaw approvals set --gateway --stdin\`; for local \`agent exec\`, omit \`--gateway\`. Intentionally align that host policy before retrying.`, { scope: "harness" });
+}
+//#endregion
+//#region extensions/codex/src/app-server/config-requirements.ts
+const UNIX_CODEX_REQUIREMENTS_PATH = "/etc/codex/requirements.toml";
+const WINDOWS_CODEX_REQUIREMENTS_SUFFIX = "\\OpenAI\\Codex\\requirements.toml";
+function readCodexRequirementsToml(params) {
+	if (params.requirementsToml !== void 0) return params.requirementsToml ?? void 0;
+	const requirementsPath = readNonEmptyString(params.requirementsPath) ?? resolveCodexRequirementsPath(params.env ?? process.env, params.platform ?? process.platform);
+	try {
+		if (params.readRequirementsFile) return params.readRequirementsFile(requirementsPath);
+		return readFileSync(requirementsPath, "utf8");
+	} catch {
+		return;
+	}
+}
+function resolveCodexRequirementsPath(env, platform) {
+	if (platform === "win32") return `${(readNonEmptyString(env.ProgramData) ?? "C:\\ProgramData").replace(/[\\/]+$/, "")}${WINDOWS_CODEX_REQUIREMENTS_SUFFIX}`;
+	return UNIX_CODEX_REQUIREMENTS_PATH;
+}
+function parseAllowedSandboxModesFromCodexRequirements(content, hostName) {
+	const remoteSandboxModes = parseMatchingRemoteSandboxModesFromCodexRequirements(content, hostName);
+	if (remoteSandboxModes !== void 0) return remoteSandboxModes;
+	return parseRequirementsSandboxModes(parseTopLevelRequirementsStringArray(content, "allowed_sandbox_modes"));
+}
+function parseAllowedApprovalPoliciesFromCodexRequirements(content) {
+	const values = parseTopLevelRequirementsStringArray(content, "allowed_approval_policies");
+	if (values === void 0) return;
+	const normalizedPolicies = values.map((entry) => normalizeRequirementsApprovalPolicy(entry)).filter((entry) => entry !== void 0);
+	return normalizedPolicies.length > 0 ? new Set(normalizedPolicies) : void 0;
+}
+function parseAllowedApprovalsReviewersFromCodexRequirements(content) {
+	const values = parseTopLevelRequirementsStringArray(content, "allowed_approvals_reviewers");
+	if (values === void 0) return;
+	const normalizedReviewers = values.map((entry) => normalizeRequirementsApprovalsReviewer(entry)).filter((entry) => entry !== void 0);
+	return normalizedReviewers.length > 0 ? new Set(normalizedReviewers) : void 0;
+}
+function parseMatchingRemoteSandboxModesFromCodexRequirements(content, hostName) {
+	const normalizedHostName = normalizeRequirementsHostName(hostName);
+	if (normalizedHostName === void 0) return;
+	for (const section of parseTomlArrayTableSections(content, "remote_sandbox_config")) {
+		const patterns = parseRequirementsStringArray(section, "hostname_patterns");
+		if (!patterns || !requirementsHostNameMatchesAnyPattern(normalizedHostName, patterns)) continue;
+		return parseRequirementsSandboxModes(parseRequirementsStringArray(section, "allowed_sandbox_modes"));
+	}
+}
+function parseRequirementsSandboxModes(values) {
+	if (values === void 0) return;
+	const normalizedModes = values.map((entry) => normalizeRequirementsSandboxMode(entry)).filter((entry) => entry !== void 0);
+	return normalizedModes.length > 0 ? new Set(normalizedModes) : void 0;
+}
+function parseTopLevelRequirementsStringArray(content, key) {
+	return parseRequirementsStringArray(stripTomlLineComments(content).slice(0, firstTomlTableOffset(content)), key);
+}
+function parseTomlStringValue(content, key) {
+	return parseTomlStringAssignmentValue(content, tomlDottedKeyPattern(key));
+}
+function parseInlineOpenAIModelProviderBaseUrl(content) {
+	return parseTomlStringAssignmentValue(content, `${tomlKeyPattern("model_providers")}\\s*=\\s*\\{[\\s\\S]*?${tomlKeyPattern("openai")}\\s*=\\s*\\{[\\s\\S]*?${tomlKeyPattern("base_url")}`);
+}
+function parseTomlStringAssignmentValue(content, keyPattern) {
+	const assignment = content.match(new RegExp(`(?:^|\\n)\\s*${keyPattern}\\s*=\\s*([^\\r\\n]*)`));
+	if (!assignment) return;
+	const rawValue = assignment[1]?.trimStart() ?? "";
+	if (rawValue.startsWith("\"\"\"") || rawValue.startsWith("'''")) return false;
+	const match = parseTomlStringAssignment(content, keyPattern);
+	return match ? match[1] ?? match[2] ?? "" : false;
+}
+function parseTomlStringAssignment(content, keyPattern) {
+	return content.match(new RegExp(`(?:^|\\n)\\s*${keyPattern}\\s*=\\s*(?:"([^"\\\\]*(?:\\\\.[^"\\\\]*)*)"|'([^']*)')`));
+}
+function tomlDottedKeyPattern(key) {
+	return key.split(".").map(tomlKeyPattern).join("\\s*\\.\\s*");
+}
+function tomlKeyPattern(key) {
+	const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+	return `(?:"${escaped}"|'${escaped}'|${escaped})`;
+}
+function parseRequirementsStringArray(content, key) {
+	const match = content.match(new RegExp(`(?:^|\\n)\\s*${key}\\s*=\\s*\\[([\\s\\S]*?)\\]`));
+	if (!match) return;
+	const arrayBody = match[1] ?? "";
+	const stringMatches = [...arrayBody.matchAll(/"([^"\\]*(?:\\.[^"\\]*)*)"|'([^']*)'/g)];
+	if (stringMatches.length === 0 && arrayBody.trim().length > 0) return;
+	return stringMatches.map((entry) => entry[1] ?? entry[2] ?? "");
+}
+function parseTomlTableSection(content, table) {
+	const strippedContent = stripTomlLineComments(content);
+	const tablePattern = tomlDottedKeyPattern(table);
+	const match = new RegExp(`^\\s*\\[\\s*${tablePattern}\\s*\\]\\s*$`, "m").exec(strippedContent);
+	if (!match) return;
+	const sectionStart = match.index + match[0].length;
+	const rest = strippedContent.slice(sectionStart);
+	const nextTableOffset = rest.search(/^\s*\[/m);
+	return nextTableOffset === -1 ? rest : rest.slice(0, nextTableOffset);
+}
+function parseTomlArrayTableSections(content, table) {
+	const strippedContent = stripTomlLineComments(content);
+	const escapedTable = table.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+	const headerPattern = new RegExp(`^\\s*\\[\\[\\s*${escapedTable}\\s*\\]\\]\\s*$`, "gm");
+	const sections = [];
+	for (let match = headerPattern.exec(strippedContent); match; match = headerPattern.exec(strippedContent)) {
+		const sectionStart = headerPattern.lastIndex;
+		const rest = strippedContent.slice(sectionStart);
+		const nextTableOffset = rest.search(/^\s*\[/m);
+		sections.push(nextTableOffset === -1 ? rest : rest.slice(0, nextTableOffset));
+	}
+	return sections;
+}
+function firstTomlTableOffset(content) {
+	return content.match(/^\s*\[[^\]\n]/m)?.index ?? content.length;
+}
+function stripTomlLineComments(value) {
+	let output = "";
+	let quote;
+	let escaped = false;
+	for (let index = 0; index < value.length; index += 1) {
+		const char = value[index] ?? "";
+		if (quote) {
+			output += char;
+			if (quote === "\"" && escaped) {
+				escaped = false;
+				continue;
+			}
+			if (quote === "\"" && char === "\\") {
+				escaped = true;
+				continue;
+			}
+			if (char === quote) quote = void 0;
+			continue;
+		}
+		if (char === "\"" || char === "'") {
+			quote = char;
+			output += char;
+			continue;
+		}
+		if (char === "#") {
+			while (index < value.length && value[index] !== "\n") index += 1;
+			if (value[index] === "\n") output += "\n";
+			continue;
+		}
+		output += char;
+	}
+	return output;
+}
+function normalizeRequirementsSandboxMode(value) {
+	const compact = value.replace(/[\s_-]/g, "").toLowerCase();
+	if (compact === "readonly") return "read-only";
+	if (compact === "workspacewrite") return "workspace-write";
+	if (compact === "dangerfullaccess") return "danger-full-access";
+}
+function normalizeRequirementsHostName(value) {
+	const normalized = value.trim().replace(/\.+$/g, "").toLowerCase();
+	return normalized.length > 0 ? normalized : void 0;
+}
+function requirementsHostNameMatchesAnyPattern(hostName, patterns) {
+	return patterns.some((pattern) => {
+		const normalizedPattern = normalizeRequirementsHostName(pattern);
+		return normalizedPattern !== void 0 && globPatternMatches(hostName, normalizedPattern);
+	});
+}
+function globPatternMatches(value, pattern) {
+	let regex = "^";
+	for (const char of pattern) if (char === "*") regex += ".*";
+	else if (char === "?") regex += ".";
+	else regex += char.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+	regex += "$";
+	return new RegExp(regex).test(value);
+}
+function normalizeRequirementsApprovalPolicy(value) {
+	const normalized = value.trim().toLowerCase();
+	if (normalized === "on-failure") return "on-request";
+	if (normalized === "untrusted") return normalized;
+	return resolveApprovalPolicy(normalized);
+}
+function normalizeRequirementsApprovalsReviewer(value) {
+	return resolveApprovalsReviewer(value.trim().toLowerCase());
+}
+function selectGuardianApprovalPolicy(allowedApprovalPolicies, execModeRequiringPromptingApprovals) {
+	if (allowedApprovalPolicies === void 0 || allowedApprovalPolicies.has("on-request")) return "on-request";
+	if (allowedApprovalPolicies.has("untrusted")) return "untrusted";
+	if (execModeRequiringPromptingApprovals) throw new Error(`tools.exec.mode=${execModeRequiringPromptingApprovals} requires Codex app-server prompting approvals`);
+	if (allowedApprovalPolicies.has("never")) return "never";
+	return "on-request";
+}
+function selectGuardianApprovalsReviewer(allowedApprovalsReviewers, execModeRequiringAutoReviewer) {
+	if (allowedApprovalsReviewers === void 0 || allowedApprovalsReviewers.has("auto_review")) return "auto_review";
+	if (allowedApprovalsReviewers.has("guardian_subagent")) return "guardian_subagent";
+	if (execModeRequiringAutoReviewer) throw new Error(`tools.exec.mode=${execModeRequiringAutoReviewer} requires Codex app-server auto approvals`);
+	if (allowedApprovalsReviewers.has("user")) return "user";
+	return "auto_review";
+}
+function selectUserApprovalsReviewer(allowedApprovalsReviewers, execModeRequiringUserReviewer) {
+	if (allowedApprovalsReviewers === void 0 || allowedApprovalsReviewers.has("user")) return "user";
+	throw new Error(`tools.exec.mode=${execModeRequiringUserReviewer ?? "ask"} requires Codex app-server user approvals`);
+}
+//#endregion
+//#region extensions/codex/src/app-server/auth-start-options.ts
+const CODEX_APP_SERVER_HOME_DIRNAME = "codex-home";
+const CODEX_EPHEMERAL_AUTH_STORE_OVERRIDE = "cli_auth_credentials_store=\"ephemeral\"";
+function resolveCodexAppServerHomeDir(agentDir) {
+	if (!agentDir) throw new Error("Agent-scoped Codex requires an OpenClaw agent directory");
+	return path.join(path.resolve(agentDir), CODEX_APP_SERVER_HOME_DIRNAME);
+}
+/** Resolves the native user Codex home used by Desktop and the CLI. */
+function resolveCodexAppServerUserHomeDir(env = process.env, homedir$1 = homedir) {
+	const configured = normalizeOptionalString(env.CODEX_HOME);
+	return path.resolve(configured ?? path.join(homedir$1(), ".codex"));
+}
+/** Resolves the local CODEX_HOME used when starting one app-server connection. */
+function resolveCodexAppServerLocalHomeDir(startOptions, agentDir, env = process.env) {
+	const configured = startOptions.env?.CODEX_HOME;
+	if (configured?.trim()) return configured;
+	return startOptions.homeScope === "user" ? resolveCodexAppServerUserHomeDir(env) : resolveCodexAppServerHomeDir(agentDir);
+}
+/** Forces OpenClaw-owned Codex auth to remain process-local. */
+function withEphemeralCodexAuthStore(params) {
+	const { startOptions } = params;
+	if (!params.preparedAuth && params.authProfileId === null) return startOptions;
+	const args = normalizeCodexAppServerArgs(startOptions.args, CODEX_EPHEMERAL_AUTH_STORE_OVERRIDE);
+	return args === startOptions.args ? startOptions : {
+		...startOptions,
+		args
+	};
+}
+//#endregion
+//#region extensions/codex/src/app-server/protocol.ts
+/** Namespace Codex keeps directly model-visible without exposing it to Code Mode guests. */
+const CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE = "openclaw_direct";
+function flattenCodexDynamicToolFunctions(tools) {
+	return (tools ?? []).flatMap((tool) => tool.type === "namespace" ? tool.tools : [tool]);
+}
+/** Asserts the experimental beforeTurnId request field before it crosses the app-server boundary. */
+function assertCodexThreadForkParams(value) {
+	if (!isRecord(value) || typeof value.threadId !== "string" || !value.threadId.trim() || value.beforeTurnId !== void 0 && value.beforeTurnId !== null && typeof value.beforeTurnId !== "string") throw new Error("Invalid Codex app-server thread/fork params");
+	return value;
+}
+function isJsonObject(value) {
+	return isRecord(value);
+}
+//#endregion
+//#region extensions/codex/src/app-server/config-security.ts
+function shouldAutoApproveCodexAppServerApprovals(appServer) {
+	return appServer.networkProxy === void 0 && appServer.approvalPolicy === "never" && appServer.sandbox === "danger-full-access";
+}
+function resolveCodexAppServerNetworkProxy(config, sandbox) {
+	if (config?.enabled !== true) return {};
+	const fileSystemMode = config.baseProfile === "read-only" || !config.baseProfile && sandbox === "read-only" ? "read" : "write";
+	const networkConfig = removeUndefinedJsonFields({
+		enabled: true,
+		mode: config.mode,
+		domains: normalizeNetworkProxyPermissionMap(config.domains),
+		unix_sockets: normalizeNetworkProxyPermissionMap(config.unixSockets),
+		proxy_url: readNonEmptyString(config.proxyUrl),
+		socks_url: readNonEmptyString(config.socksUrl),
+		enable_socks5: config.enableSocks5,
+		enable_socks5_udp: config.enableSocks5Udp,
+		allow_upstream_proxy: config.allowUpstreamProxy,
+		allow_local_binding: config.allowLocalBinding,
+		dangerously_allow_non_loopback_proxy: config.dangerouslyAllowNonLoopbackProxy,
+		dangerously_allow_all_unix_sockets: config.dangerouslyAllowAllUnixSockets
+	});
+	const profile = {
+		filesystem: {
+			":minimal": "read",
+			":project_roots": { ".": fileSystemMode }
+		},
+		network: networkConfig
+	};
+	const profileName = resolveNetworkProxyPermissionProfileName(config, profile);
+	const configPatch = {
+		"features.network_proxy.enabled": true,
+		default_permissions: profileName,
+		permissions: { [profileName]: profile }
+	};
+	return { networkProxy: {
+		profileName,
+		configFingerprint: fingerprintCodexAppServerNetworkProxyConfigPatch(configPatch),
+		configPatch
+	} };
+}
+function resolveNetworkProxyPermissionProfileName(config, profile) {
+	const explicitProfileName = readNonEmptyString(config.profileName);
+	if (explicitProfileName) return explicitProfileName;
+	const suffix = createHash("sha256").update(stableStringifyJson({
+		version: 1,
+		profile
+	})).digest("hex").slice(0, 16);
+	return `${DEFAULT_CODEX_APP_SERVER_NETWORK_PROXY_PROFILE_PREFIX}-${suffix}`;
+}
+function fingerprintCodexAppServerNetworkProxyConfigPatch(configPatch) {
+	return createHash("sha256").update(stableStringifyJson(configPatch)).digest("hex");
+}
+function normalizeNetworkProxyPermissionMap(value) {
+	const entries = Object.entries(value ?? {}).map(([key, permission]) => [key.trim(), permission]).filter(([key]) => key.length > 0);
+	return entries.length > 0 ? Object.fromEntries(entries) : void 0;
+}
+function removeUndefinedJsonFields(value) {
+	return Object.fromEntries(Object.entries(value).filter((entry) => entry[1] !== void 0));
+}
+function stableStringifyJson(value) {
+	if (Array.isArray(value)) return `[${value.map((item) => stableStringifyJson(item)).join(",")}]`;
+	if (value && typeof value === "object") return `{${Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${stableStringifyJson(item)}`).join(",")}}`;
+	return JSON.stringify(value);
+}
+/** Explicit MCP prompting must bypass Codex's unconditional Never-policy approval. */
+function hasCodexMcpToolApprovalOverrides(servers, serverNames, projectedMcpServers) {
+	const modes = new Map(Object.entries(projectedMcpServers ?? {}).map(([name, server]) => [name, server.default_tools_approval_mode]));
+	for (const name of serverNames ?? Object.keys(servers ?? {})) {
+		const server = servers?.[name];
+		const mode = server?.codex?.defaultToolsApprovalMode;
+		if (mode !== void 0 && (serverNames !== void 0 || server?.enabled !== false)) modes.set(name, mode);
+	}
+	return [...modes.values()].some((mode) => mode === "auto" || mode === "prompt");
+}
+function withMcpElicitationsApprovalPolicy(policy) {
+	if (policy === "untrusted") return policy;
+	if (typeof policy !== "string") return { granular: {
+		...policy.granular,
+		mcp_elicitations: true
+	} };
+	if (policy === "never") return { granular: {
+		mcp_elicitations: true,
+		rules: false,
+		sandbox_approval: false,
+		request_permissions: false,
+		skill_approval: false
+	} };
+	return { granular: {
+		mcp_elicitations: true,
+		rules: true,
+		sandbox_approval: true,
+		request_permissions: true,
+		skill_approval: true
+	} };
+}
+function resolveTransport(value) {
+	return value === "websocket" || value === "unix" ? value : "stdio";
+}
+function normalizeRemoteWorkspaceRoot(value) {
+	return readNonEmptyString(value);
+}
+function inferCodexAppServerConnectionClass(params) {
+	if (params.transport !== "websocket") return "local-loopback";
+	return params.url && isLoopbackWebSocketUrl(params.url) ? "local-loopback" : "remote";
+}
+function assertCodexAppServerConnectionClassConfig(params) {
+	if (params.connectionClass === "remote" && !hasIdentityBearingWebSocketAuth({
+		authToken: params.authToken,
+		headers: params.headers
+	})) throw new Error("remote Codex app-server WebSocket URLs require appServer.authToken or an Authorization header");
+}
+/** Applies the canonical remote-auth boundary to any Codex AppServer transport. */
+function assertCodexAppServerConnectionSecurity(params) {
+	assertCodexAppServerConnectionClassConfig({
+		connectionClass: inferCodexAppServerConnectionClass(params),
+		authToken: params.authToken,
+		headers: params.headers
+	});
+}
+function isLoopbackWebSocketUrl(value) {
+	let parsed;
+	try {
+		parsed = new URL(value);
+	} catch {
+		return false;
+	}
+	if (parsed.protocol !== "ws:" && parsed.protocol !== "wss:") return false;
+	return isLoopbackHost(parsed.hostname);
+}
+function hasIdentityBearingWebSocketAuth(params) {
+	if (readNonEmptyString(params.authToken)) return true;
+	return Object.entries(params.headers).some(([key, value]) => key.trim().toLowerCase() === "authorization" && Boolean(readNonEmptyString(value)));
+}
+function resolvePolicyMode(value) {
+	return value === "guardian" || value === "yolo" ? value : void 0;
+}
+function resolveDefaultCodexAppServerPolicy(params) {
+	if (params.transport !== "stdio") return {
+		mode: "yolo",
+		dangerFullAccessAllowed: true
+	};
+	const content = readCodexRequirementsToml(params);
+	if (content === void 0) {
+		if (!params.forceGuardian) return {
+			mode: "yolo",
+			dangerFullAccessAllowed: true
+		};
+		return {
+			mode: "guardian",
+			dangerFullAccessAllowed: true,
+			approvalPolicy: selectGuardianApprovalPolicy(void 0, params.execModeRequiringPromptingApprovals),
+			approvalsReviewer: params.forceUserReviewer ? selectUserApprovalsReviewer(void 0, params.execModeRequiringUserReviewer) : selectGuardianApprovalsReviewer(void 0, params.execModeRequiringPromptingApprovals === "auto" ? "auto" : void 0),
+			sandbox: selectGuardianSandbox(void 0)
+		};
+	}
+	const allowedSandboxModes = parseAllowedSandboxModesFromCodexRequirements(content, readNonEmptyString(params.hostName) ?? hostname());
+	const allowedApprovalPolicies = parseAllowedApprovalPoliciesFromCodexRequirements(content);
+	const allowedApprovalsReviewers = parseAllowedApprovalsReviewersFromCodexRequirements(content);
+	const yoloSandboxAllowed = allowedSandboxModes === void 0 || allowedSandboxModes.has("danger-full-access");
+	const yoloApprovalAllowed = allowedApprovalPolicies === void 0 || allowedApprovalPolicies.has("never") && !allowedApprovalPolicies.has("untrusted");
+	const yoloReviewerAllowed = allowedApprovalsReviewers === void 0 || allowedApprovalsReviewers.has("user");
+	if (!params.forceGuardian && yoloSandboxAllowed && yoloApprovalAllowed && yoloReviewerAllowed) return {
+		mode: "yolo",
+		dangerFullAccessAllowed: true
+	};
+	return {
+		mode: "guardian",
+		dangerFullAccessAllowed: yoloSandboxAllowed,
+		approvalPolicy: selectGuardianApprovalPolicy(allowedApprovalPolicies, params.execModeRequiringPromptingApprovals),
+		approvalsReviewer: params.forceUserReviewer ? selectUserApprovalsReviewer(allowedApprovalsReviewers, params.execModeRequiringUserReviewer) : selectGuardianApprovalsReviewer(allowedApprovalsReviewers, params.execModeRequiringPromptingApprovals === "auto" ? "auto" : void 0),
+		sandbox: selectGuardianSandbox(allowedSandboxModes)
+	};
+}
+//#endregion
+export { stripTomlLineComments as A, parseInlineOpenAIModelProviderBaseUrl as C, selectGuardianApprovalPolicy as D, readCodexRequirementsToml as E, resolveEffectiveOpenClawExecModeForCodexAppServer as F, resolveSandbox as I, selectForcedDangerFullAccessSandbox as L, resolveApprovalPolicy as M, resolveApprovalsReviewer as N, selectGuardianApprovalsReviewer as O, resolveCodexPolicyModeForOpenClawExecMode as P, selectForcedPromptingSandbox as R, parseAllowedSandboxModesFromCodexRequirements as S, parseTomlTableSection as T, resolveCodexAppServerUserHomeDir as _, resolveCodexAppServerNetworkProxy as a, parseAllowedApprovalPoliciesFromCodexRequirements as b, resolveTransport as c, CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE as d, assertCodexThreadForkParams as f, resolveCodexAppServerLocalHomeDir as g, resolveCodexAppServerHomeDir as h, normalizeRemoteWorkspaceRoot as i, assertCodexAppServerAllowedForOpenClawExecMode as j, selectUserApprovalsReviewer as k, shouldAutoApproveCodexAppServerApprovals as l, isJsonObject as m, hasCodexMcpToolApprovalOverrides as n, resolveDefaultCodexAppServerPolicy as o, flattenCodexDynamicToolFunctions as p, inferCodexAppServerConnectionClass as r, resolvePolicyMode as s, assertCodexAppServerConnectionSecurity as t, withMcpElicitationsApprovalPolicy as u, withEphemeralCodexAuthStore as v, parseTomlStringValue as w, parseAllowedApprovalsReviewersFromCodexRequirements as x, firstTomlTableOffset as y, selectGuardianSandbox as z };

package/dist/{conversation-binding-DsB4-O7U.js → .setup/conversation-binding-DhzrpTM6.mjs}

@@ -1,21 +1,21 @@
-import { l as sessionBindingIdentity, n as assertCodexBindingMayBeReplaced } from "./session-binding-record-Bcvslnhf.js";
-import { b as readCodexRequirementsToml, g as readCodexEffectiveConfig, n as codexSandboxPolicyForTurn } from "./config-options-CXMq1T-C.js";
-import { o as isJsonObject, x as readCodexPluginConfig } from "./protocol-5bh1G-H7.js";
-import { _ as assertCodexThreadAcceptsDirectInput, b as assertCodexThreadStartResponse, l as isCodexAppServerOverloadError, m as CodexThreadDirectInputError, s as isCodexAppServerIndeterminateRequestCancellationError } from "./client-B57KWPQx.js";
-import { o as resolveCodexDefaultWorkspaceDir } from "./conversation-binding-data-BiodpIzq.js";
-import { n as projectBoundedCodexVisibleSessionHistory } from "./transcript-history-projection-v17wXgdK.js";
-import { n as resolveOpenClawExecPolicyForCodexAppServer, t as canUseCodexModelBackedApprovalsReviewerForModel } from "./config-oIORaQ5T.js";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-D0zGNIHu.js";
-import { n as normalizeCodexAppServerBindingModelProvider, t as isCodexAppServerNativeAuthProfile } from "./auth-profile-CwzO4_RG.js";
-import { H as isCodexAppServerClientRuntimeLive, R as consumeCodexAppServerLiveThread, U as isCodexAppServerLiveThreadClaimed, V as hasCodexAppServerLiveThread, _ as retainSharedCodexAppServerClientByInstanceId, c as getLeasedSharedCodexAppServerClient, m as releaseCodexAppServerClientLease, q as releaseCodexAppServerLiveThread, x as withLeasedCodexAppServerClientStartSelectionRetry } from "./shared-client-CscigXXL.js";
-import { a as closeCodexStartupClientBestEffort, d as unsubscribeCodexThreadBestEffort, h as isCodexNotificationForTurn, l as retireUnsafeCodexTurnClientBestEffort, o as interruptCodexTurnAndWaitBestEffort, p as getCodexAppServerTurnRouter, s as isCodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-DKHzbwt5.js";
-import { n as isAssistantCommentaryCompletionNotification } from "./attempt-notifications-C9XufG6l.js";
-import { D as resolveCodexAppServerRequestModelSelection, Et as mergeCodexThreadConfigs, M as buildCodexProjectDocThreadConfig, T as CODEX_NATIVE_PERSONALITY_NONE, Tt as buildDisabledAppsConfigPatch } from "./thread-lifecycle-DXl1-I6b.js";
-import "./session-binding-CI8UuilT.js";
-import { t as resumeCodexAppServerThread } from "./thread-resume-DsDOZpFg.js";
-import { a as rollbackCodexAppServerBindingSubscription, n as releaseCodexAppServerBindingSubscription, r as retainCodexAppServerBindingSubscription, s as withExclusiveCodexAppServerThread, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-BsDRTsyp.js";
-import { a as resolveCodexAppServerForModelProvider, i as resolveCodexSessionPermissionCwd, n as applyCodexSessionPermissionPolicy, t as CODEX_SESSION_PERMISSION_EXEC_MODES } from "./session-permission-policy-BBmXA8Eg.js";
-import { u as trackCodexConversationActiveTurn } from "./conversation-control-CtUu1b3m.js";
+import { n as assertCodexBindingMayBeReplaced, p as sessionBindingIdentity } from "./session-binding-record-TH3xA0zj.mjs";
+import { E as readCodexRequirementsToml, m as isJsonObject } from "./config-security-BRQ2mgW9.mjs";
+import { d as readCodexPluginConfig } from "./config-parsing-CcB9iPoq.mjs";
+import { _ as assertCodexThreadAcceptsDirectInput, b as assertCodexThreadStartResponse, l as isCodexAppServerOverloadError, m as CodexThreadDirectInputError, s as isCodexAppServerIndeterminateRequestCancellationError } from "./client-vXs2929Q.mjs";
+import { d as readCodexEffectiveConfig, n as codexSandboxPolicyForTurn } from "./config-options-BsanJ8QG.mjs";
+import { o as resolveCodexDefaultWorkspaceDir } from "./conversation-binding-data-CrcyZk6O.mjs";
+import { n as projectBoundedCodexVisibleSessionHistory } from "./transcript-history-projection-DHNBDhCU.mjs";
+import { n as resolveOpenClawExecPolicyForCodexAppServer, t as canUseCodexModelBackedApprovalsReviewerForModel } from "./config-CedDWjM-.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-CeAhl_h4.mjs";
+import { n as normalizeCodexAppServerBindingModelProvider, t as isCodexAppServerNativeAuthProfile } from "./auth-profile-WqZtZfXN.mjs";
+import { I as hasCodexAppServerLiveThread, N as consumeCodexAppServerLiveThread, R as isCodexAppServerClientRuntimeLive, U as releaseCodexAppServerLiveThread, _ as retainSharedCodexAppServerClientByInstanceId, c as getLeasedSharedCodexAppServerClient, m as releaseCodexAppServerClientLease, x as withLeasedCodexAppServerClientStartSelectionRetry, z as isCodexAppServerLiveThreadClaimed } from "./shared-client-BpTtuLQ5.mjs";
+import { a as closeCodexStartupClientBestEffort, f as unsubscribeCodexThreadBestEffort, l as retireUnsafeCodexTurnClientBestEffort, m as getCodexAppServerTurnRouter, o as interruptCodexTurnAndWaitBestEffort, s as isCodexAppServerUnsafeSubscriptionError, v as isCodexNotificationForTurn } from "./attempt-client-cleanup-BpYKdTA0.mjs";
+import { Dt as buildDisabledAppsConfigPatch, E as CODEX_NATIVE_PERSONALITY_NONE, N as buildCodexProjectDocThreadConfig, O as resolveCodexAppServerRequestModelSelection, Ot as mergeCodexThreadConfigs } from "./thread-lifecycle-Cik28qWn.mjs";
+import "./session-binding-_0W_fHRr.mjs";
+import { t as resumeCodexAppServerThread } from "./thread-resume-BkNpj9Pz.mjs";
+import { a as rollbackCodexAppServerBindingSubscription, n as releaseCodexAppServerBindingSubscription, r as retainCodexAppServerBindingSubscription, s as withExclusiveCodexAppServerThread, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-skomxnIt.mjs";
+import { a as resolveCodexAppServerForModelProvider, i as resolveCodexSessionPermissionCwd, n as applyCodexSessionPermissionPolicy, t as CODEX_SESSION_PERMISSION_EXEC_MODES } from "./session-permission-policy-DhurXY0l.mjs";
+import { u as trackCodexConversationActiveTurn } from "./conversation-control-DN53ns41.mjs";
 import { asOptionalRecord, normalizeOptionalString, normalizeSingleOrTrimmedStringList } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { resolveSessionAgentIdsStrict } from "openclaw/plugin-sdk/agent-scope-runtime";
 import { resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
@@ -462,8 +462,7 @@ function createCodexConversationTurnCollector(threadId) {
 			if (item?.type === "agentMessage") {
 				const itemId = normalizeOptionalString(item.id) ?? normalizeOptionalString(params.itemId) ?? "assistant";
 				assistantTextByItem.delete(itemId);
-				if (isAssistantCommentaryCompletionNotification(notification)) return;
-				const text = readTextString(item, "text");
+				const text = readAssistantReplyText(item);
 				if (text?.trim()) assistantTextByItem.set(itemId, text);
 			}
 			return;
@@ -480,7 +479,7 @@ function createCodexConversationTurnCollector(threadId) {
 					if (!isJsonObject(item) || item.type !== "agentMessage") continue;
 					const itemId = normalizeOptionalString(item.id) ?? `assistant-${assistantTextByItem.size + 1}`;
 					assistantTextByItem.delete(itemId);
-					const text = item.phase === "commentary" ? void 0 : readTextString(item, "text");
+					const text = readAssistantReplyText(item);
 					if (text?.trim()) assistantTextByItem.set(itemId, text);
 				}
 			}
@@ -507,6 +506,9 @@ function createCodexConversationTurnCollector(threadId) {
 		}
 	};
 }
+function readAssistantReplyText(item) {
+	return item.phase === "commentary" || item.delivery === "async" ? void 0 : readTextString(item, "text");
+}
 function readTextString(record, key) {
 	const value = record?.[key];
 	return typeof value === "string" && value.length > 0 ? value : void 0;

package/dist/{conversation-binding-data-BiodpIzq.js → .setup/conversation-binding-data-CrcyZk6O.mjs}

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
 import { asOptionalRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash, randomUUID } from "node:crypto";
 import process from "node:process";

package/dist/{conversation-control-CtUu1b3m.js → .setup/conversation-control-DN53ns41.mjs}

@@ -1,12 +1,12 @@
-import { n as isCodexFastServiceTier } from "./config-utils-DujwEnhg.js";
-import { r as bindingStoreKey } from "./session-binding-record-Bcvslnhf.js";
-import { o as formatCodexDisplayText } from "./command-formatters-lxlkNZgU.js";
-import "./config-oIORaQ5T.js";
-import { i as resolveCodexBindingAppServerConnection } from "./binding-connection-D3udKbIE.js";
-import { n as normalizeCodexAppServerBindingModelProvider, t as isCodexAppServerNativeAuthProfile } from "./auth-profile-CwzO4_RG.js";
-import { c as getLeasedSharedCodexAppServerClient, h as releaseLeasedSharedCodexAppServerClient } from "./shared-client-CscigXXL.js";
-import { D as resolveCodexAppServerRequestModelSelection, k as resolveCodexBindingModelProviderFallback } from "./thread-lifecycle-DXl1-I6b.js";
-import "./session-binding-CI8UuilT.js";
+import { n as isCodexFastServiceTier } from "./config-utils-DujwEnhg.mjs";
+import { r as bindingStoreKey } from "./session-binding-record-TH3xA0zj.mjs";
+import { o as formatCodexDisplayText } from "./command-formatters-CGEkdawF.mjs";
+import { i as resolveCodexBindingAppServerConnection } from "./binding-connection-Bm38niE8.mjs";
+import "./config-CedDWjM-.mjs";
+import { n as normalizeCodexAppServerBindingModelProvider, t as isCodexAppServerNativeAuthProfile } from "./auth-profile-WqZtZfXN.mjs";
+import { c as getLeasedSharedCodexAppServerClient, h as releaseLeasedSharedCodexAppServerClient } from "./shared-client-BpTtuLQ5.mjs";
+import { A as resolveCodexBindingModelProviderFallback, O as resolveCodexAppServerRequestModelSelection } from "./thread-lifecycle-Cik28qWn.mjs";
+import "./session-binding-_0W_fHRr.mjs";
 import { resolveAgentDir } from "openclaw/plugin-sdk/agent-runtime";
 import { getSessionEntry, patchSessionEntry, resolveStorePath } from "openclaw/plugin-sdk/session-store-runtime";
 import { ModelSelectionLockedError, applyModelOverrideWithAuthProfileCompatibility } from "openclaw/plugin-sdk/model-session-runtime";
@@ -40,10 +40,12 @@ async function stopCodexConversationTurn(params) {
 		stopped: false,
 		message: "The active Codex run no longer matches this session binding."
 	};
-	const connection = resolveCodexBindingAppServerConnection({
+	const connection = await resolveCodexBindingAppServerConnection({
 		binding,
 		authProfileId: binding?.authProfileId,
-		pluginConfig: params.pluginConfig
+		pluginConfig: params.pluginConfig,
+		...lookup,
+		assertCurrent: params.assertCurrent
 	});
 	const runtime = connection.appServer;
 	const client = active.client ?? await getLeasedSharedCodexAppServerClient({
@@ -85,10 +87,12 @@ async function steerCodexConversationTurn(params) {
 		steered: false,
 		message: "The active Codex run no longer matches this session binding."
 	};
-	const connection = resolveCodexBindingAppServerConnection({
+	const connection = await resolveCodexBindingAppServerConnection({
 		binding,
 		authProfileId: binding?.authProfileId,
-		pluginConfig: params.pluginConfig
+		pluginConfig: params.pluginConfig,
+		...lookup,
+		assertCurrent: params.assertCurrent
 	});
 	const runtime = connection.appServer;
 	const client = active.client ?? await getLeasedSharedCodexAppServerClient({