@openclaw/codex 2026.9.4 → 2026.9.6

package/dist/.setup/launch-args-DbFCehO7.mjs

@@ -0,0 +1,196 @@
+import { createRequire } from "node:module";
+import path from "node:path";
+//#region extensions/codex/src/app-server/launch-args.ts
+const CODEX_VALUE_OPTIONS = /* @__PURE__ */ new Set([
+	"-m",
+	"--model",
+	"--local-provider",
+	"-p",
+	"--profile",
+	"-s",
+	"--sandbox",
+	"-a",
+	"--ask-for-approval",
+	"-C",
+	"--cd",
+	"--add-dir",
+	"--remote",
+	"--remote-auth-token-env",
+	"-c",
+	"--config",
+	"--enable",
+	"--disable",
+	"--listen",
+	"--sock",
+	"--code-mode-host",
+	"--ws-auth",
+	"--ws-token-file",
+	"--ws-token-sha256",
+	"--ws-shared-secret-file",
+	"--ws-issuer",
+	"--ws-audience",
+	"--ws-max-clock-skew-seconds"
+]);
+/** One tokenization owner for launch, turn policy, reviewer trust, and private turns. */
+function readCodexArgs(args) {
+	const tokens = [];
+	let nativeSubcommand = false;
+	let end = 0;
+	for (const [index, arg] of args.entries()) {
+		if (index < end) continue;
+		end = index + 1;
+		const attached = /^(--[^=]+)=([\s\S]*)$/u.exec(arg) ?? /^(-[cmpisaC])=?([\s\S]+)$/u.exec(arg);
+		const name = attached?.[1] ?? arg;
+		let value = attached?.[2];
+		if (name === "-i" || name === "--image") while (args[end]?.startsWith("-") === false) end += 1;
+		else if (!attached && CODEX_VALUE_OPTIONS.has(name)) {
+			value = args[end];
+			if (value !== void 0) end += 1;
+		}
+		tokens.push({
+			index,
+			end,
+			name,
+			value
+		});
+		if (name === "app-server") nativeSubcommand = true;
+		if (name === "--" && nativeSubcommand) break;
+	}
+	return tokens;
+}
+/** Uses the native CLI configuration for status without starting its transport. */
+function buildCodexLoginStatusArgs(args) {
+	const options = /* @__PURE__ */ new Set([
+		"-c",
+		"--config",
+		"-p",
+		"--profile",
+		"--enable",
+		"--disable"
+	]);
+	const tokens = readCodexArgs(args);
+	const subcommandIndex = tokens.findLast(({ name }) => name === "app-server")?.index ?? -1;
+	const prefix = subcommandIndex < 0 ? [] : args.slice(0, subcommandIndex);
+	const configArgs = tokens.filter(({ index, name }) => index > subcommandIndex && options.has(name)).flatMap(({ index, end }) => args.slice(index, end));
+	return [
+		...prefix,
+		...configArgs,
+		"login",
+		"status"
+	];
+}
+function readCodexAppServerConfigOptions(args) {
+	return readCodexArgs(args).filter(({ name }) => name === "-c" || name === "--config" || name === "-p" || name === "--profile");
+}
+const NODE_LAUNCH_VALUE_OPTIONS = /* @__PURE__ */ new Set([
+	"-r",
+	"--require",
+	"--import",
+	"--loader",
+	"--experimental-loader",
+	"--max-old-space-size",
+	"--max-semi-space-size",
+	"--stack-size"
+]);
+const NODE_LAUNCH_FLAGS = /* @__PURE__ */ new Set([
+	"--enable-source-maps",
+	"--no-warnings",
+	"--trace-warnings",
+	"--trace-uncaught",
+	"--no-deprecation",
+	"--trace-deprecation",
+	"--experimental-strip-types",
+	"--experimental-transform-types",
+	"--no-experimental-strip-types",
+	"--use-strict",
+	"--expose-gc"
+]);
+function resolveNodeLauncherModule(value, option, cwd) {
+	if (path.isAbsolute(value)) return value;
+	if (/^\.{1,2}[\\/]/u.test(value)) return path.resolve(cwd, value);
+	if (option === "-r" || option === "--require") return createRequire(path.join(cwd, "openclaw-codex-launcher.cjs")).resolve(value);
+	if (/^(?:file|data|node):/u.test(value)) return value;
+	throw new Error("Private Codex turns require an absolute or relative file path for ESM preloads");
+}
+/** Separates a supported launcher from native flags before a private turn sanitizes them. */
+function resolveCodexPrivateLauncher(params) {
+	const launcherArgs = [];
+	let nativeArgs = [...params.args];
+	const executable = params.command.split(/[\\/]/u).at(-1)?.toLowerCase();
+	if (executable && [
+		"node",
+		"node.exe",
+		"nodejs",
+		"nodejs.exe"
+	].includes(executable)) {
+		let index = 0;
+		while (params.args[index]?.startsWith("-")) {
+			const raw = params.args[index];
+			index += 1;
+			if (raw === "--") {
+				launcherArgs.push(raw);
+				break;
+			}
+			const attached = /^(--[^=]+)=([\s\S]*)$/u.exec(raw) ?? /^(-r)([\s\S]+)$/u.exec(raw);
+			const name = attached?.[1] ?? raw;
+			const normalizedName = name.replaceAll("_", "-");
+			if (NODE_LAUNCH_VALUE_OPTIONS.has(normalizedName)) {
+				const value = attached?.[2] ?? params.args[index++];
+				if (value === void 0 || !value.trim()) throw new Error("Private Codex turns received a Node launcher option without its value");
+				const moduleOption = [
+					"-r",
+					"--require",
+					"--import",
+					"--loader",
+					"--experimental-loader"
+				].includes(normalizedName);
+				if (attached && !moduleOption) launcherArgs.push(raw);
+				else launcherArgs.push(name, moduleOption ? resolveNodeLauncherModule(value, normalizedName, path.resolve(params.cwd)) : value);
+			} else if (!attached && NODE_LAUNCH_FLAGS.has(name)) launcherArgs.push(raw);
+			else throw new Error(`Private Codex turns cannot isolate unsupported Node launcher option ${name}`);
+		}
+		const script = params.args[index];
+		if (!script) throw new Error("Private Codex turns require a Node wrapper script");
+		launcherArgs.push(path.resolve(params.cwd, script));
+		nativeArgs = params.args.slice(index + 1);
+		if (!readCodexArgs(nativeArgs).some(({ name }) => name === "app-server")) throw new Error("Private Codex turns require a native app-server command after the Node wrapper");
+	}
+	if (executable && /^(?:(?:ba|da|z|fi)?sh|python(?:\d+(?:\.\d+)*)?|ruby|perl|cmd|powershell|pwsh)(?:\.exe)?$/u.test(executable)) throw new Error("Private Codex turns cannot isolate inline or interpreted wrappers; use a Node script or a directly executable wrapper");
+	const tokens = readCodexArgs(nativeArgs);
+	const serverIndex = tokens.findLast(({ name }) => name === "app-server")?.index ?? nativeArgs.length;
+	if (tokens.some(({ index, name }) => index < serverIndex && (!name.startsWith("-") || name === "--"))) throw new Error("Private Codex turns cannot isolate this launcher prefix; use a Node script or a directly executable wrapper");
+	return {
+		launcherArgs,
+		nativeArgs
+	};
+}
+/** The stdio proxy forwards to an external server; it does not own that runtime. */
+function isCodexAppServerProxyLaunch(args) {
+	const tokens = readCodexArgs(args);
+	const server = tokens.findLastIndex(({ name }) => name === "app-server");
+	return server >= 0 && tokens.slice(server + 1).find(({ name }) => !name.startsWith("-"))?.name === "proxy";
+}
+/** Keeps Codex overrides in one CLI scope without rewriting raw TOML or wrapper prefixes. */
+function normalizeCodexAppServerArgs(rawArgs, enforcedOverride) {
+	const tokens = readCodexArgs(rawArgs);
+	const subcommandIndex = tokens.findLast(({ name }) => name === "app-server")?.index ?? -1;
+	const prefix = subcommandIndex < 0 ? [...rawArgs] : rawArgs.slice(0, subcommandIndex);
+	const suffix = [];
+	if (subcommandIndex >= 0) for (const token of tokens) {
+		if (token.index <= subcommandIndex) continue;
+		if (token.name === "--") {
+			suffix.push(...rawArgs.slice(token.index));
+			break;
+		}
+		(token.name === "-c" || token.name === "--config" ? prefix : suffix).push(...rawArgs.slice(token.index, token.end));
+	}
+	if (enforcedOverride && !(prefix.at(-2) === "-c" && prefix.at(-1) === enforcedOverride)) prefix.push("-c", enforcedOverride);
+	const normalized = subcommandIndex < 0 ? prefix : [
+		...prefix,
+		"app-server",
+		...suffix
+	];
+	return normalized.length === rawArgs.length && normalized.every((arg, index) => arg === rawArgs[index]) ? rawArgs : normalized;
+}
+//#endregion
+export { resolveCodexPrivateLauncher as a, readCodexAppServerConfigOptions as i, isCodexAppServerProxyLaunch as n, normalizeCodexAppServerArgs as r, buildCodexLoginStatusArgs as t };

package/dist/{managed-binary-D22rNEcR.js → .setup/managed-binary-BnshlFag.mjs}

@@ -1,5 +1,4 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { n as MANAGED_CODEX_APP_SERVER_PACKAGE } from "./version-omm6IPI3.js";
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
 import { createRequire } from "node:module";
 import { constants, existsSync, realpathSync } from "node:fs";
 import path from "node:path";
@@ -43,6 +42,17 @@ function resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath(params = {}
 	return candidates.find((candidate) => pathExists(candidate));
 }
 //#endregion
+//#region extensions/codex/src/app-server/version.ts
+/**
+* Version and package pins for the managed Codex app-server runtime.
+*/
+/** Exact Codex app-server version shipped by the OpenClaw Codex bridge. */
+const CODEX_APP_SERVER_VERSION = "0.155.1";
+/** Inclusive runtime compatibility floor for external app-server binaries. */
+const MIN_SUPPORTED_CODEX_APP_SERVER_VERSION = "0.149.0";
+/** npm package name for the managed Codex app-server binary. */
+const MANAGED_CODEX_APP_SERVER_PACKAGE = "@openai/codex";
+//#endregion
 //#region extensions/codex/src/app-server/managed-binary.ts
 /**
 * Resolves the managed Codex app-server binary shipped with or installed beside
@@ -160,6 +170,7 @@ function resolvePackageJsonFromRoot(packageName, root) {
 function resolveManagedCodexAppServerCommandCandidates(pluginRoot, platform, managedCommandOrder) {
 	const packageCommand = resolveManagedCodexPackageEntrypoint(pluginRoot);
 	const packageCommandPaths = packageCommand ? [packageCommand] : [];
+	if (managedCommandOrder === "package-only") return packageCommandPaths;
 	const desktopCommandPaths = resolveMacOSDesktopCodexAppServerCommandCandidates(platform);
 	return managedCommandOrder === "desktop-first" ? [...desktopCommandPaths, ...packageCommandPaths] : [...packageCommandPaths, ...desktopCommandPaths];
 }
@@ -192,4 +203,4 @@ async function commandPathExists(filePath, platform) {
 	}
 }
 //#endregion
-export { resolvePackagedCodexNativeCommand as a, resolveMacOSDesktopCodexAppPathCandidates as c, resolveManagedCodexNativeCommand as i, resolveMacOSDesktopCodexBundledMarketplaceCandidates as l, managed_binary_exports as n, setManagedCodexPluginRoot as o, resolveManagedCodexAppServerStartOptions as r, resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath as s, isManagedCodexDesktopCommand as t, resolveMacOSDesktopCodexComputerUseServiceAppCandidates as u };
+export { resolvePackagedCodexNativeCommand as a, MIN_SUPPORTED_CODEX_APP_SERVER_VERSION as c, resolveMacOSDesktopCodexBundledMarketplaceCandidates as d, resolveMacOSDesktopCodexComputerUseServiceAppCandidates as f, resolveManagedCodexNativeCommand as i, resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath as l, managed_binary_exports as n, setManagedCodexPluginRoot as o, resolveManagedCodexAppServerStartOptions as r, CODEX_APP_SERVER_VERSION as s, isManagedCodexDesktopCommand as t, resolveMacOSDesktopCodexAppPathCandidates as u };

package/dist/{managed-thread-store-D1t5jh3G.js → .setup/managed-thread-store-BMqgThVL.mjs}

@@ -28,10 +28,53 @@ function managedThreadStoreKey(sourceHomeId, threadId) {
 }
 /** Durable ownership index for Codex threads created by OpenClaw. */
 function createCodexManagedThreadStore(state) {
+	const byHome = /* @__PURE__ */ new Map();
+	const memberships = /* @__PURE__ */ new Map();
+	let hydration;
+	const remember = ({ sourceHomeId, threadId }) => {
+		const key = managedThreadStoreKey(sourceHomeId, threadId);
+		if (memberships.has(key)) return key;
+		memberships.set(key, {
+			sourceHomeId,
+			threadId
+		});
+		let ids = byHome.get(sourceHomeId);
+		if (!ids) {
+			ids = /* @__PURE__ */ new Set();
+			byHome.set(sourceHomeId, ids);
+		}
+		ids.add(threadId);
+		if (memberships.size > 2e4) {
+			const oldest = memberships.entries().next().value;
+			if (oldest) {
+				memberships.delete(oldest[0]);
+				const oldestHome = byHome.get(oldest[1].sourceHomeId);
+				oldestHome?.delete(oldest[1].threadId);
+				if (oldestHome?.size === 0) byHome.delete(oldest[1].sourceHomeId);
+			}
+		}
+		return key;
+	};
+	const snapshot = async () => {
+		hydration ??= state.entries().then((entries) => {
+			const marked = new Map(memberships);
+			memberships.clear();
+			byHome.clear();
+			for (const entry of entries.toSorted((a, b) => a.createdAt - b.createdAt)) {
+				const parsed = managedThreadSchema.safeParse(entry.value);
+				if (parsed.success) marked.delete(remember(parsed.data));
+			}
+			for (const membership of marked.values()) remember(membership);
+		}).catch((error) => {
+			hydration = void 0;
+			throw error;
+		});
+		await hydration;
+		return byHome;
+	};
 	return {
 		async has(sourceHomeId, threadId) {
-			const parsed = managedThreadSchema.safeParse(state.lookup(managedThreadStoreKey(sourceHomeId, threadId)));
-			return parsed.success && parsed.data.sourceHomeId === sourceHomeId && parsed.data.threadId === threadId;
+			return (await snapshot()).get(sourceHomeId)?.has(threadId) ?? false;
 		},
 		async mark(params) {
 			try {
@@ -42,24 +85,15 @@ function createCodexManagedThreadStore(state) {
 					threadId: params.threadId.trim(),
 					...params.rolloutPath?.trim() ? { rolloutPath: params.rolloutPath.trim() } : {}
 				});
-				state.registerIfAbsent(managedThreadStoreKey(value.sourceHomeId, value.threadId), value);
+				await state.registerIfAbsent(managedThreadStoreKey(value.sourceHomeId, value.threadId), value);
+				remember(value);
 				return true;
 			} catch (error) {
 				embeddedAgentLog.warn("failed to record Codex managed thread ownership", { error });
 				return false;
 			}
 		},
-		async snapshot() {
-			const byHome = /* @__PURE__ */ new Map();
-			for (const entry of state.entries()) {
-				const parsed = managedThreadSchema.safeParse(entry.value);
-				if (!parsed.success) continue;
-				const ids = byHome.get(parsed.data.sourceHomeId) ?? /* @__PURE__ */ new Set();
-				ids.add(parsed.data.threadId);
-				byHome.set(parsed.data.sourceHomeId, ids);
-			}
-			return byHome;
-		}
+		snapshot
 	};
 }
 //#endregion

package/dist/{model-catalog-Dq2n8f_p.js → .setup/model-catalog-CfXJf9Ay.mjs}

@@ -1,9 +1,12 @@
-import { r as buildCodexRuntimeModelParams } from "./harness-C7rRa7bm.js";
-import { o as isJsonObject, x as readCodexPluginConfig } from "./protocol-5bh1G-H7.js";
-import { o as withCodexAppServerJsonClient } from "./request-B7hEkBGq.js";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-D0zGNIHu.js";
-import { r as captureSharedCodexAppServerCatalogLifetime } from "./shared-client-CscigXXL.js";
-import { t as listAllCodexAppServerModels } from "./models-PCKOim-h.js";
+import { r as buildCodexRuntimeModelParams } from "./harness-a_MsE4-_.mjs";
+import { d as readCodexPluginConfig } from "./config-parsing-CcB9iPoq.mjs";
+import { n as isCodexAppServerProxyLaunch } from "./launch-args-DbFCehO7.mjs";
+import { o as withCodexAppServerJsonClient } from "./request-D2L0zMrq.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-C8Rw1m1m.mjs";
+import { a as resolveCodexAppServerAuthProfileStore, r as resolveCodexAppServerAuthProfileId } from "./auth-profile-WqZtZfXN.mjs";
+import { r as captureSharedCodexAppServerCatalogLifetime } from "./shared-client-DA4VR4Eb.mjs";
+import { t as listAllCodexAppServerModels } from "./models-KnqBv0hE.mjs";
+import { probeCodexNativeAuth } from "./native-auth-rWbGbMn3.mjs";
 //#region extensions/codex/src/app-server/model-catalog.ts
 const DEFAULT_MODEL_DISCOVERY_TIMEOUT_MS = 2500;
 const INPUT_TYPES = /* @__PURE__ */ new Set([
@@ -51,7 +54,10 @@ function createCodexAppServerModelCatalog(runtime) {
 		},
 		read(params, pluginConfig) {
 			const observation = scopes.get(params.config)?.get(scopeKey(params));
-			return !disposed && params.provider === "openai" && observation !== void 0 && observation.pluginConfig === pluginConfig && observation.models?.has(params.modelId) && observation.accountType && observation.isCurrent?.() ? { accountType: observation.accountType } : void 0;
+			return !disposed && params.provider === "openai" && observation !== void 0 && observation.pluginConfig === pluginConfig && observation.models?.has(params.modelId) && observation.accountType && observation.isCurrent?.() ? {
+				accountType: observation.accountType,
+				...observation.authMode ? { authMode: observation.authMode } : {}
+			} : void 0;
 		},
 		async load(params, pluginConfig) {
 			if (disposed) return [];
@@ -65,13 +71,30 @@ function createCodexAppServerModelCatalog(runtime) {
 			observations.set(key, observation);
 			const discovery = readCodexPluginConfig(pluginConfig).discovery;
 			if (discovery?.enabled === false) return [];
-			const { start } = resolveCodexAppServerRuntimeOptions({ pluginConfig });
+			const options = resolveCodexAppServerRuntimeOptions({ pluginConfig });
+			const ownsLocalProcess = options.start.transport === "stdio" && !isCodexAppServerProxyLaunch(options.start.args);
+			const authProfileStore = ownsLocalProcess && options.start.homeScope === "agent" ? resolveCodexAppServerAuthProfileStore({
+				agentDir: params.agentDir,
+				config: params.config
+			}) : void 0;
+			const authProfileId = authProfileStore ? resolveCodexAppServerAuthProfileId({
+				store: authProfileStore,
+				config: params.config
+			}) : void 0;
+			const usesNativeHome = ownsLocalProcess && options.start.homeScope === "user";
+			const native = usesNativeHome ? await probeCodexNativeAuth({ pluginConfig }) : void 0;
+			if (usesNativeHome && !native || disposed || observations.get(key) !== observation) return [];
+			const { start } = options;
 			const timeoutMs = discovery?.timeoutMs ?? DEFAULT_MODEL_DISCOVERY_TIMEOUT_MS;
 			const result = await withCodexAppServerJsonClient({
 				startOptions: start,
 				config: params.config,
 				agentDir: params.agentDir,
-				timeoutMs
+				timeoutMs,
+				...authProfileStore ? {
+					authProfileStore,
+					authProfileId
+				} : {}
 			}, async (request, client) => {
 				const isCurrent = captureSharedCodexAppServerCatalogLifetime(client);
 				const models = (await listAllCodexAppServerModels({
@@ -83,17 +106,18 @@ function createCodexAppServerModelCatalog(runtime) {
 					method: "account/read",
 					requestParams: { refreshToken: false }
 				});
-				const observedType = isJsonObject(account.account) ? account.account.type : void 0;
+				const observedType = account.account?.type;
 				return {
 					models,
 					isCurrent,
-					accountType: account.requiresOpenaiAuth === true ? observedType === "apiKey" || observedType === "chatgpt" ? observedType : void 0 : void 0
+					accountType: account.requiresOpenaiAuth ? observedType === "apiKey" || observedType === "chatgpt" ? observedType : void 0 : void 0
 				};
 			});
 			if (disposed || observations.get(key) !== observation || !result.isCurrent()) return [];
 			observation.models = new Set(result.models.map((model) => model.id));
-			observation.accountType = result.accountType;
+			observation.accountType = !usesNativeHome || native?.mode === "api-key" && result.accountType === "apiKey" || (native?.mode === "oauth" || native?.mode === "token") && result.accountType === "chatgpt" ? result.accountType : void 0;
 			observation.isCurrent = result.isCurrent;
+			observation.authMode = observation.accountType === "apiKey" ? "api_key" : observation.accountType === "chatgpt" && (native?.mode === "oauth" || native?.mode === "token") ? native.mode : void 0;
 			return codexAppServerModelsToCatalogEntries(result.models, runtime);
 		}
 	};

package/dist/{models-PCKOim-h.js → .setup/models-KnqBv0hE.mjs}

@@ -1,4 +1,4 @@
-import { h as assertCodexModelListResponse } from "./client-B57KWPQx.js";
+import { g as assertCodexModelListResponse } from "./client-Cs08OXVQ.mjs";
 import { normalizeOptionalString, uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
 //#region extensions/codex/src/app-server/models.ts
 /**
@@ -37,8 +37,8 @@ async function withCodexAppServerModelRequest(options, run) {
 	if (options.request) return await run(options.request);
 	const timeoutMs = options.timeoutMs ?? 2500;
 	const useSharedClient = options.sharedClient !== false;
-	const { createIsolatedCodexAppServerClient, getLeasedSharedCodexAppServerClient, releaseLeasedSharedCodexAppServerClient } = await import("./shared-client-CscigXXL.js").then((n) => n.y);
-	const { requestCodexAppServerClientJson } = await import("./request-B7hEkBGq.js").then((n) => n.a);
+	const { createIsolatedCodexAppServerClient, getLeasedSharedCodexAppServerClient, releaseLeasedSharedCodexAppServerClient } = await import("./shared-client-DA4VR4Eb.mjs").then((n) => n.y);
+	const { requestCodexAppServerClientJson } = await import("./request-D2L0zMrq.mjs").then((n) => n.a);
 	const client = await (useSharedClient ? getLeasedSharedCodexAppServerClient : createIsolatedCodexAppServerClient)({
 		startOptions: options.startOptions,
 		timeoutMs,

package/dist/.setup/native-auth-rWbGbMn3.mjs

@@ -0,0 +1,57 @@
+import { d as readCodexPluginConfig } from "./config-parsing-CcB9iPoq.mjs";
+import { n as isCodexAppServerProxyLaunch, t as buildCodexLoginStatusArgs } from "./launch-args-DbFCehO7.mjs";
+import { r as resolveManagedCodexAppServerStartOptions } from "./managed-binary-BnshlFag.mjs";
+import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-h2VHOskC.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-C8Rw1m1m.mjs";
+import { runUtf8CommandWithTimeout } from "openclaw/plugin-sdk/process-runtime";
+import { materializeWindowsSpawnProgram, resolveWindowsSpawnProgram } from "openclaw/plugin-sdk/windows-spawn";
+//#region extensions/codex/src/app-server/native-auth.ts
+const OPENAI_LOGIN_MODES = {
+	"Logged in using ChatGPT": "oauth",
+	"Logged in using access token": "token",
+	"Logged in using personal access token": "token"
+};
+/** Ask the selected native binary about its own store; retain no credential material. */
+async function probeCodexNativeAuth(params) {
+	params.signal?.throwIfAborted();
+	try {
+		const pluginConfig = readCodexPluginConfig(params.pluginConfig ?? params.config?.plugins?.entries?.codex?.config);
+		const options = resolveCodexAppServerRuntimeOptions({
+			pluginConfig,
+			env: params.env
+		});
+		if (options.start.transport !== "stdio" || options.start.homeScope !== "user" || isCodexAppServerProxyLaunch(options.start.args)) return;
+		const start = await resolveManagedCodexAppServerStartOptions(options.start, { pluginRoot: params.pluginRoot });
+		if (start.transport !== "stdio") return;
+		const env = resolveCodexAppServerSpawnEnv(start, params.env ?? process.env);
+		const invocation = materializeWindowsSpawnProgram(resolveWindowsSpawnProgram({
+			command: start.command,
+			env,
+			packageName: "@openai/codex"
+		}), buildCodexLoginStatusArgs(start.args));
+		const result = await runUtf8CommandWithTimeout([invocation.command, ...invocation.argv], {
+			baseEnv: env,
+			timeoutMs: 3e3,
+			signal: params.signal,
+			killProcessTree: true
+		});
+		params.signal?.throwIfAborted();
+		if (result.termination !== "exit" || result.code !== 0) return;
+		const line = `${result.stdout}\n${result.stderr}`.split("\n").map((value) => value.trim()).find((value) => value.startsWith("Logged in using "));
+		const mode = line?.startsWith("Logged in using an API key - ") ? "api-key" : line ? OPENAI_LOGIN_MODES[line] : void 0;
+		return mode ? {
+			apiKey: "codex-app-server",
+			source: "Codex native login",
+			mode,
+			nativeAuth: {
+				runtime: "codex",
+				mode
+			}
+		} : void 0;
+	} catch {
+		params.signal?.throwIfAborted();
+		return;
+	}
+}
+//#endregion
+export { probeCodexNativeAuth };

package/dist/{native-subagent-history-DjtPloaU.js → .setup/native-subagent-history-0nYYgo0k.mjs}

@@ -1,12 +1,12 @@
-import { l as sessionBindingIdentity } from "./session-binding-record-Bcvslnhf.js";
-import { t as readCodexThreadHistoryPage } from "./thread-history-page-D0JIp48V.js";
-import { r as readMirrorIdentity } from "./upstream-prompt-provenance-LphB8slG.js";
-import { r as projectCodexThreadHistoryItem } from "./transcript-history-projection-v17wXgdK.js";
-import { n as buildCodexAppServerRuntimeFingerprint, t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-d0eKxy7b.js";
-import { i as resolveCodexBindingAppServerConnection } from "./binding-connection-D3udKbIE.js";
-import { c as getLeasedSharedCodexAppServerClient, h as releaseLeasedSharedCodexAppServerClient } from "./shared-client-CscigXXL.js";
-import { c as itemToolArgs, d as itemTranscriptResultText, n as CODEX_NATIVE_SUBAGENT_RUN_ID_PREFIX } from "./native-subagent-task-ids-BzTdT0Uw.js";
-import { r as readCodexNativeSubagentHistoryOwner, t as codexNativeSubagentHistoryConnectionFingerprint } from "./native-subagent-history-owner-Pcp7JuVF.js";
+import { C as readCodexNativeSubagentHistoryOwner, b as codexNativeSubagentHistoryConnectionFingerprint, m as sessionBindingIdentity } from "./session-binding-record-BGoz8wOK.mjs";
+import { t as readCodexThreadHistoryPage } from "./thread-history-page-DoVpnHim.mjs";
+import { l as itemStatus } from "./event-projector-items-C6L_5ZiT.mjs";
+import { r as readMirrorIdentity } from "./upstream-prompt-provenance-LphB8slG.mjs";
+import { r as projectCodexThreadHistoryItem } from "./transcript-history-projection-ZZpkFkJ_.mjs";
+import { n as buildCodexAppServerRuntimeFingerprint, t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-B2CsSdnV.mjs";
+import { i as resolveCodexBindingAppServerConnection } from "./binding-connection-ThoatDcb.mjs";
+import { c as getLeasedSharedCodexAppServerClient, h as releaseLeasedSharedCodexAppServerClient } from "./shared-client-DA4VR4Eb.mjs";
+import { a as readCodexNativeSubagentRunId, f as itemToolArgs, g as projectCodexToolActivity, h as itemTranscriptResultText } from "./native-subagent-task-ids-wb8CKZGN.mjs";
 import { resolveAgentDir } from "openclaw/plugin-sdk/agent-runtime";
 import { getSessionEntry, resolveStorePath } from "openclaw/plugin-sdk/session-store-runtime";
 //#region extensions/codex/src/app-server/native-subagent-history.ts
@@ -26,7 +26,7 @@ async function readCodexNativeSubagentHistory(params, options) {
 	const { task, cfg } = params;
 	const sessionKey = task.requesterSessionKey;
 	const agentId = task.agentId;
-	const threadId = task.runId?.startsWith("codex-thread:") ? task.runId.slice(CODEX_NATIVE_SUBAGENT_RUN_ID_PREFIX.length) : void 0;
+	const threadId = readCodexNativeSubagentRunId(task.runId)?.threadId;
 	if (task.taskKind !== "codex-native" || !sessionKey || !agentId || !threadId) throw new Error("Subagent transcript owner is unavailable.");
 	const storePath = resolveStorePath(cfg.session?.store, { agentId });
 	const readSession = () => getSessionEntry({
@@ -59,10 +59,12 @@ async function readCodexNativeSubagentHistory(params, options) {
 		if (currentSession?.sessionId !== sessionId || currentSession?.lifecycleRevision !== lifecycleRevision || current?.threadId !== binding.threadId || current?.appServerRuntimeFingerprint !== binding.appServerRuntimeFingerprint || current?.connectionScope !== binding.connectionScope || current?.authProfileId !== binding.authProfileId) throw new Error("Subagent parent changed; refresh its transcript.");
 	};
 	const agentDir = resolveAgentDir(cfg, agentId);
-	const connection = resolveCodexBindingAppServerConnection({
+	const connection = await resolveCodexBindingAppServerConnection({
 		binding,
 		pluginConfig: options.pluginConfig,
 		agentDir,
+		config: cfg,
+		assertCurrent,
 		authProfileId: binding.authProfileId
 	});
 	const client = await getLeasedSharedCodexAppServerClient({
@@ -81,11 +83,16 @@ async function readCodexNativeSubagentHistory(params, options) {
 			runtimeIdentity: client.getRuntimeIdentity()
 		});
 		if (!binding.appServerRuntimeFingerprint || fingerprint !== binding.appServerRuntimeFingerprint) throw new Error("Subagent connection changed; reconnect its parent session.");
-		const { thread } = await client.request("thread/read", {
+		const read = async (method, request) => {
+			assertCurrent();
+			const result = await client.request(method, request, { assertCurrent });
+			assertCurrent();
+			return result;
+		};
+		const { thread } = await read("thread/read", {
 			threadId,
 			includeTurns: false
-		}, { assertCurrent });
-		assertCurrent();
+		});
 		if (thread.id !== threadId || threadId === historyParentThreadId) throw new Error("Subagent transcript does not belong to this parent session.");
 		const visited = /* @__PURE__ */ new Set([threadId]);
 		let ancestor = thread;
@@ -94,42 +101,43 @@ async function readCodexNativeSubagentHistory(params, options) {
 			if (parentId === historyParentThreadId) break;
 			if (!parentId || visited.has(parentId) || visited.size >= MAX_SUBAGENT_ANCESTRY_READS) throw new Error("Subagent transcript does not belong to this parent session.");
 			visited.add(parentId);
-			const response = await client.request("thread/read", {
+			const response = await read("thread/read", {
 				threadId: parentId,
 				includeTurns: false
-			}, { assertCurrent });
-			assertCurrent();
+			});
 			if (response.thread.id !== parentId) throw new Error("Subagent transcript does not belong to this parent session.");
 			ancestor = response.thread;
 		}
 		const page = await readCodexThreadHistoryPage({
-			listItemPage: async (request) => {
-				assertCurrent();
-				const result = await client.request("thread/items/list", request, { assertCurrent });
-				assertCurrent();
-				return result;
-			},
-			listTurnPage: async (request) => {
-				assertCurrent();
-				const result = await client.request("thread/turns/list", request, { assertCurrent });
-				assertCurrent();
-				return result;
-			}
+			listItemPage: (request) => read("thread/items/list", request),
+			listTurnPage: (request) => read("thread/turns/list", request)
 		}, thread, {
 			threadId,
 			cursor: params.cursor,
 			limit: Math.max(1, Math.floor(Math.min(params.limit, 200) / 2))
 		}, {
-			project: (entries) => entries.map((entry) => projectCodexThreadHistoryItem(thread, entry, taskHistoryToolItems).map((message) => {
-				const messageIdentity = readMirrorIdentity(message);
-				if (!messageIdentity) throw new Error("Subagent history message is missing its native identity.");
-				return Object.assign(message, { messageId: JSON.stringify([threadId, messageIdentity]) });
-			})),
+			project: (entries) => entries.map((entry) => {
+				const item = projectCodexToolActivity(entry.item, itemStatus(entry.item) === "running" ? "start" : "result");
+				const messages = projectCodexThreadHistoryItem(thread, entry, taskHistoryToolItems).map((message) => {
+					const messageIdentity = readMirrorIdentity(message);
+					if (!messageIdentity) throw new Error("Subagent history message is missing its native identity.");
+					return Object.assign(message, { messageId: JSON.stringify([threadId, messageIdentity]) });
+				});
+				return {
+					messages,
+					activity: item ? messages.map(({ messageId }) => ({
+						messageId,
+						items: item.hideFromChannelProgress ? [] : [item]
+					})) : []
+				};
+			}),
 			fits: (result) => Buffer.byteLength(JSON.stringify(result), "utf8") <= 524288
 		});
 		assertCurrent();
+		const rows = page.items.toReversed();
 		return {
-			messages: page.items.toReversed().flat(),
+			messages: rows.flatMap((row) => row.messages),
+			activity: rows.flatMap((row) => row.activity),
 			...page.nextCursor ? { nextCursor: page.nextCursor } : {}
 		};
 	} finally {