@openclaw/codex 2026.9.4 → 2026.9.6

package/dist/{plan-7uG-Fp36.js → .setup/plan-CN3VwfNU.mjs}

@@ -1,6 +1,6 @@
-import { c as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-oL4Na1ZG.js";
-import "./config-oIORaQ5T.js";
-import { a as exists, c as sanitizeName, n as discoverCodexSource, o as readJsonObject, r as hasCodexSource, s as resolveHomePath, t as codexPluginMigrationSubscriptionWarning } from "./source-CElXU0Oy.js";
+import { c as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-BoRei8Z4.mjs";
+import "./config-BoTP_mrL.mjs";
+import { c as sanitizeName, i as hasCodexSource, n as defaultCodexHome, o as exists, r as discoverCodexSource, s as readJsonObject, t as codexPluginMigrationSubscriptionWarning } from "./source-CUzJq5WN.mjs";
 import { asBoolean, asOptionalRecord, isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash } from "node:crypto";
 import { runCommandBuffered } from "openclaw/plugin-sdk/process-runtime";
@@ -9,11 +9,58 @@ import fs from "node:fs/promises";
 import { canonicalPathFromExistingAncestor, isPathInside } from "openclaw/plugin-sdk/file-access-runtime";
 import { readSecretFile } from "openclaw/plugin-sdk/secret-file";
 import { fileURLToPath } from "node:url";
-import { loadAuthProfileStoreWithoutExternalProfiles, resolveAgentConfig, resolveAgentWorkspaceDir, resolveDefaultAgentId } from "openclaw/plugin-sdk/agent-runtime";
-import { extractErrorCode } from "openclaw/plugin-sdk/security-runtime";
+import { loadAuthProfileStoreWithoutExternalProfiles } from "openclaw/plugin-sdk/agent-runtime";
 import { applyAuthProfileConfig, buildApiKeyCredential, buildOauthProviderAuthResult, buildOpenAICodexCredentialExtra, hasUsableOAuthCredential, resolveOpenAICodexAuthIdentity, resolveOpenAICodexImportProfileName, updateAuthProfileStoreWithLock } from "openclaw/plugin-sdk/provider-auth";
+import { extractErrorCode } from "openclaw/plugin-sdk/security-runtime";
 import { MIGRATION_REASON_TARGET_EXISTS, createMigrationItem, createMigrationManualItem, hasMigrationConfigPatchConflict, markMigrationItemConflict, markMigrationItemError, markMigrationItemSkipped, mergeMigrationConfigValue, readMigrationConfigPath, resolveMigrationConfigRuntime, summarizeMigrationItems } from "openclaw/plugin-sdk/migration";
+import { resolvePlannedMigrationTargets } from "openclaw/plugin-sdk/migration-runtime";
 import { decodeOpenAICodexJwtPayload } from "openclaw/plugin-sdk/provider-oauth-runtime";
+//#region extensions/codex/src/migration/auth-profile-target.ts
+const OPENAI_PROVIDER_ID$1 = "openai";
+const LEGACY_CODEX_PROFILE_ID = "openai:default";
+function findMatchingOAuthProfile(store, credential) {
+	const subject = oauthSubject(credential);
+	if (!subject) return;
+	for (const [profileId, existing] of Object.entries(store.profiles)) {
+		if (existing.type !== "oauth" || existing.provider !== credential.provider) continue;
+		const previous = oauthSubject(existing);
+		if (previous?.accountId === subject.accountId && previous.userId === subject.userId) return profileId;
+	}
+}
+function oauthSubject(credential) {
+	const claims = decodeOpenAICodexJwtPayload(credential.access)?.["https://api.openai.com/auth"];
+	if (!isRecord(claims)) return;
+	const accountId = normalizeOptionalString(claims.chatgpt_account_id);
+	const userId = normalizeOptionalString(claims.chatgpt_user_id) ?? normalizeOptionalString(claims.user_id);
+	return accountId && userId ? {
+		accountId,
+		userId
+	} : void 0;
+}
+function findMatchingApiKeyProfile(store, provider, key) {
+	for (const [profileId, existing] of Object.entries(store.profiles)) if (existing.type === "api_key" && existing.provider === provider && existing.key === key) return profileId;
+}
+function itemProfileTarget(credential, store, ctx, source) {
+	if (credential.kind === "oauth") {
+		const profile = credential.result.profiles[0];
+		const matched = profile?.credential.type === "oauth" ? findMatchingOAuthProfile(store, profile.credential) : void 0;
+		if (matched) return {
+			profileId: matched,
+			matchedExisting: true
+		};
+		const legacyProfile = ctx.config.auth?.profiles?.[LEGACY_CODEX_PROFILE_ID];
+		return {
+			profileId: legacyProfile?.provider === OPENAI_PROVIDER_ID$1 && legacyProfile.mode === "oauth" && source.codexHome === defaultCodexHome() && profile?.credential.type === "oauth" && oauthSubject(profile.credential) !== void 0 && !Object.entries(store.profiles).some(([id, existing]) => id !== "openai:default" && existing.type === "oauth" && existing.provider === OPENAI_PROVIDER_ID$1) ? LEGACY_CODEX_PROFILE_ID : credential.profileId,
+			matchedExisting: false
+		};
+	}
+	const matched = findMatchingApiKeyProfile(store, credential.provider, credential.key);
+	return {
+		profileId: matched ?? credential.profileId,
+		matchedExisting: Boolean(matched)
+	};
+}
+//#endregion
 //#region extensions/codex/src/migration/cli-credentials.ts
 /** Explicit migration reads the storage selected by the native credential owner. */
 async function readAuthFile(home) {
@@ -45,15 +92,16 @@ async function readDirectKeyring(home, signal) {
 		return;
 	}
 }
-async function readSelectedCredentialStorage(options, requireApiKey) {
+async function readCodexCliCredentialsAsync(options) {
 	options.signal?.throwIfAborted();
+	if (!options.allowKeychainPrompt) return;
 	const home = await fs.realpath(options.codexHome).catch(() => path.resolve(options.codexHome));
-	const { CodexAppServerClient } = await import("./client-B57KWPQx.js").then((n) => n.n);
-	const { resolveManagedCodexPackageEntrypoint, resolveManagedCodexNativeCommand } = await import("./managed-binary-D22rNEcR.js").then((n) => n.n);
+	const { CodexAppServerClient } = await import("./client-Cs08OXVQ.mjs").then((n) => n.n);
+	const { resolveManagedCodexPackageEntrypoint, resolveManagedCodexNativeCommand } = await import("./managed-binary-BnshlFag.mjs").then((n) => n.n);
 	const launcher = resolveManagedCodexPackageEntrypoint(path.dirname(fileURLToPath(import.meta.url)));
 	const command = launcher ? resolveManagedCodexNativeCommand(launcher) : void 0;
 	if (!command) return;
-	const signal = AbortSignal.any([AbortSignal.timeout(options.allowKeychainPrompt && process.platform === "darwin" ? 6e4 : 5e3), ...options.signal ? [options.signal] : []]);
+	const signal = AbortSignal.any([AbortSignal.timeout(process.platform === "darwin" ? 6e4 : 5e3), ...options.signal ? [options.signal] : []]);
 	const client = await CodexAppServerClient.start({
 		transport: "stdio",
 		command,
@@ -75,7 +123,7 @@ async function readSelectedCredentialStorage(options, requireApiKey) {
 	signal.addEventListener("abort", abort, { once: true });
 	let credential;
 	try {
-		credential = await readNativeCredential(client, home, requireApiKey, options, signal);
+		credential = await readNativeCredential(client, home, options, signal);
 	} catch {}
 	signal.removeEventListener("abort", abort);
 	const closed = await client.closeAndWait({
@@ -86,15 +134,11 @@ async function readSelectedCredentialStorage(options, requireApiKey) {
 	options.signal?.throwIfAborted();
 	return credential;
 }
-async function readNativeCredential(client, home, requireApiKey, options, signal) {
+async function readNativeCredential(client, home, options, signal) {
 	signal.throwIfAborted();
 	await client.initialize();
 	if (client.getRuntimeIdentity()?.codexHome !== home) return;
 	const revision = client.getModelCatalogRevision();
-	if (requireApiKey) {
-		const account = await client.request("account/read", { refreshToken: false }, { signal });
-		if (asOptionalRecord(account.account)?.type !== "apiKey" || account.requiresOpenaiAuth !== true) return;
-	}
 	const configured = await client.request("config/read", {
 		includeLayers: false,
 		cwd: home
@@ -102,7 +146,7 @@ async function readNativeCredential(client, home, requireApiKey, options, signal
 	const mode = (await client.request("configRequirements/read", {}, { signal })).requirements?.cli_auth_credentials_store ?? configured.config.cli_auth_credentials_store ?? "file";
 	let record;
 	if (mode === "file") record = await readAuthFile(home);
-	else if ((mode === "keyring" || mode === "auto") && process.platform === "darwin" && options.allowKeychainPrompt) {
+	else if ((mode === "keyring" || mode === "auto") && process.platform === "darwin") {
 		let cursor;
 		let encrypted;
 		do {
@@ -121,7 +165,18 @@ async function readNativeCredential(client, home, requireApiKey, options, signal
 		record = await readDirectKeyring(home, signal);
 	}
 	signal.throwIfAborted();
-	return !client.getCloseError() && client.getModelCatalogRevision() === revision ? record : void 0;
+	if (!record) return;
+	const oauth = options.credentialKind === "api_key" ? void 0 : parseOAuthCredential(record);
+	let apiKey = options.credentialKind === "oauth" ? void 0 : parseApiKeyCredential(record);
+	if (apiKey) {
+		const account = await client.request("account/read", { refreshToken: false }, { signal }).catch(() => void 0);
+		if (account?.account?.type !== "apiKey" || !account.requiresOpenaiAuth) apiKey = void 0;
+	}
+	signal.throwIfAborted();
+	return !client.getCloseError() && client.getModelCatalogRevision() === revision ? {
+		...oauth ? { oauth } : {},
+		...apiKey ? { apiKey } : {}
+	} : void 0;
 }
 function jwtExpiry(token) {
 	try {
@@ -131,10 +186,9 @@ function jwtExpiry(token) {
 		return;
 	}
 }
-async function readCodexCliCredentialsAsync(options) {
-	const data = await readSelectedCredentialStorage(options, false);
-	const mode = typeof data?.auth_mode === "string" ? data.auth_mode.toLowerCase() : void 0;
-	if (!data || mode !== void 0 && mode !== "chatgpt" && mode !== "chatgptauthtokens") return;
+function parseOAuthCredential(data) {
+	const mode = typeof data.auth_mode === "string" ? data.auth_mode.toLowerCase() : void 0;
+	if (mode !== void 0 && mode !== "chatgpt" && mode !== "chatgptauthtokens") return;
 	const tokens = asOptionalRecord(data.tokens);
 	if (typeof tokens?.access_token !== "string" || !tokens.access_token || typeof tokens.refresh_token !== "string" || !tokens.refresh_token) return;
 	const lastRefresh = typeof data.last_refresh === "string" ? Date.parse(data.last_refresh) : NaN;
@@ -148,10 +202,9 @@ async function readCodexCliCredentialsAsync(options) {
 		...typeof tokens.id_token === "string" ? { idToken: tokens.id_token } : {}
 	};
 }
-async function readCodexCliActiveApiKeyAsync(options) {
-	const data = await readSelectedCredentialStorage(options, true);
-	const mode = typeof data?.auth_mode === "string" ? data.auth_mode.toLowerCase() : void 0;
-	if (!data || mode !== void 0 && mode !== "apikey" && mode !== "api_key") return;
+function parseApiKeyCredential(data) {
+	const mode = typeof data.auth_mode === "string" ? data.auth_mode.toLowerCase() : void 0;
+	if (mode !== void 0 && mode !== "apikey" && mode !== "api_key") return;
 	const key = typeof data.OPENAI_API_KEY === "string" ? data.OPENAI_API_KEY.trim() : "";
 	return key ? {
 		type: "api_key",
@@ -164,7 +217,7 @@ async function readCodexCliActiveApiKeyAsync(options) {
 const OPENAI_PROVIDER_ID = "openai";
 const OPENAI_OAUTH_ITEM_ID = "auth:openai";
 const OPENAI_API_KEY_ITEM_ID = "auth:openai:api-key";
-const OPENAI_CODEX_DEFAULT_MODEL = "openai/gpt-5.6-sol";
+const OPENAI_CODEX_DEFAULT_MODEL = "openai/gpt-6-astra";
 const CODEX_IMPORT_DISPLAY_NAME = "Codex import";
 const CODEX_REASON_AUTH_NOT_SELECTED = "auth credential migration not selected";
 const CODEX_REASON_AUTH_PROFILE_EXISTS = "auth profile exists";
@@ -199,13 +252,7 @@ async function readModelRefs(source) {
 	refs.add(OPENAI_CODEX_DEFAULT_MODEL);
 	return [...refs].toSorted();
 }
-async function buildCodexOAuthCredential(source, includeConfigPatch, options) {
-	const credential = await readCodexCliCredentialsAsync({
-		codexHome: source.codexHome,
-		allowKeychainPrompt: options.allowKeychainPrompt,
-		...options.signal ? { signal: options.signal } : {}
-	});
-	if (!credential) return null;
+async function buildCodexOAuthCredential(source, credential, includeConfigPatch) {
 	const identity = resolveOpenAICodexAuthIdentity({
 		access: credential.access,
 		accountId: credential.accountId
@@ -235,62 +282,19 @@ async function buildCodexOAuthCredential(source, includeConfigPatch, options) {
 		result
 	} : null;
 }
-async function buildCodexApiKeyCredential(source, allowKeychainPrompt, signal) {
-	const credential = await readCodexCliActiveApiKeyAsync({
+async function readCodexAuthCredentials(source, options) {
+	const credentials = await readCodexCliCredentialsAsync({
 		codexHome: source.codexHome,
-		allowKeychainPrompt,
-		...signal ? { signal } : {}
+		credentialKind: options.credentialKind,
+		allowKeychainPrompt: options.allowKeychainPrompt,
+		...options.signal ? { signal: options.signal } : {}
 	});
-	if (!credential) return null;
-	return {
+	return [credentials?.oauth ? await buildCodexOAuthCredential(source, credentials.oauth, options.includeConfigPatch) : null, credentials?.apiKey ? {
 		kind: "api_key",
 		provider: OPENAI_PROVIDER_ID,
 		profileId: "openai:codex-import",
-		key: credential.key
-	};
-}
-async function readCodexAuthCredentials(source, options) {
-	return [options.credentialKind === "api_key" ? null : await buildCodexOAuthCredential(source, options.includeConfigPatch, {
-		allowKeychainPrompt: options.allowKeychainPrompt,
-		...options.signal ? { signal: options.signal } : {}
-	}), options.credentialKind === "oauth" ? null : await buildCodexApiKeyCredential(source, options.allowKeychainPrompt, options.signal)].filter((entry) => entry !== null);
-}
-function findMatchingOAuthProfile(store, credential) {
-	const subject = oauthSubject(credential);
-	if (!subject) return;
-	for (const [profileId, existing] of Object.entries(store.profiles)) {
-		if (existing.type !== "oauth" || existing.provider !== credential.provider) continue;
-		const previous = oauthSubject(existing);
-		if (previous?.accountId === subject.accountId && previous.userId === subject.userId) return profileId;
-	}
-}
-function oauthSubject(credential) {
-	const claims = decodeOpenAICodexJwtPayload(credential.access)?.["https://api.openai.com/auth"];
-	if (!isRecord(claims)) return;
-	const accountId = normalizeOptionalString(claims.chatgpt_account_id);
-	const userId = normalizeOptionalString(claims.chatgpt_user_id) ?? normalizeOptionalString(claims.user_id);
-	return accountId && userId ? {
-		accountId,
-		userId
-	} : void 0;
-}
-function findMatchingApiKeyProfile(store, provider, key) {
-	for (const [profileId, existing] of Object.entries(store.profiles)) if (existing.type === "api_key" && existing.provider === provider && existing.key === key) return profileId;
-}
-function itemProfileTarget(credential, store) {
-	if (credential.kind === "oauth") {
-		const profile = credential.result.profiles[0];
-		const matched = profile?.credential.type === "oauth" ? findMatchingOAuthProfile(store, profile.credential) : void 0;
-		return {
-			profileId: matched ?? credential.profileId,
-			matchedExisting: Boolean(matched)
-		};
-	}
-	const matched = findMatchingApiKeyProfile(store, credential.provider, credential.key);
-	return {
-		profileId: matched ?? credential.profileId,
-		matchedExisting: Boolean(matched)
-	};
+		key: credentials.apiKey.key
+	} : null].filter((entry) => entry !== null);
 }
 function replaceConfigDraft(draft, next) {
 	for (const key of Object.keys(draft)) delete draft[key];
@@ -357,7 +361,8 @@ function resolveCodexConfigPatchMode(ctx) {
 	return mode === "none" || mode === "return" ? mode : "apply";
 }
 function allowCodexKeychainPrompt(ctx) {
-	return ctx.providerOptions?.allowKeychainPrompt === true;
+	const explicit = ctx.providerOptions?.allowKeychainPrompt;
+	return typeof explicit === "boolean" ? explicit : ctx.includeSecrets === true;
 }
 function resolveRequestedCredentialKind(ctx) {
 	const kind = ctx.providerOptions?.credentialKind;
@@ -408,36 +413,36 @@ function applyCredentialConfig(config, credential, profileId) {
 }
 async function buildCodexAuthItems(params) {
 	const configPatchMode = resolveCodexConfigPatchMode(params.ctx);
+	const allowKeychainPrompt = allowCodexKeychainPrompt(params.ctx);
 	const credentials = await readCodexAuthCredentials(params.source, {
 		credentialKind: resolveRequestedCredentialKind(params.ctx),
 		includeConfigPatch: configPatchMode !== "none",
-		allowKeychainPrompt: allowCodexKeychainPrompt(params.ctx),
+		allowKeychainPrompt,
 		signal: params.ctx.signal
 	});
 	if (credentials.length === 0) {
 		const requestedKind = resolveRequestedCredentialKind(params.ctx);
-		if (!requestedKind) return [];
-		const credentialKind = requestedKind;
-		return [createMigrationItem({
-			id: credentialKind === "oauth" ? OPENAI_OAUTH_ITEM_ID : OPENAI_API_KEY_ITEM_ID,
+		if (!requestedKind && allowKeychainPrompt) return [];
+		return (requestedKind ? [requestedKind] : ["oauth", "api_key"]).map((credentialKind) => createMigrationItem({
+			id: credentialKind === "api_key" ? OPENAI_API_KEY_ITEM_ID : OPENAI_OAUTH_ITEM_ID,
 			kind: "auth",
 			action: "skip",
 			source: params.source.codexHome,
 			status: "skipped",
 			sensitive: true,
-			reason: CODEX_REASON_AUTH_STORAGE_NOT_IMPORTABLE,
-			message: "No supported Codex credential could be imported. Continue with sign-in to connect OpenClaw.",
+			reason: allowKeychainPrompt ? CODEX_REASON_AUTH_STORAGE_NOT_IMPORTABLE : void 0,
+			message: allowKeychainPrompt ? "No supported Codex credential could be imported. Continue with sign-in to connect OpenClaw." : "Codex credentials have not been inspected. Confirm credential import to check the current Codex sign-in.",
 			details: {
 				provider: OPENAI_PROVIDER_ID,
 				credentialKind,
 				credentialImportUnavailable: true
 			}
-		})];
+		}));
 	}
 	const store = loadAuthProfileStoreWithoutExternalProfiles(params.targets.agentDir);
 	const skipped = !params.ctx.includeSecrets;
 	return credentials.map((credential) => {
-		const { profileId, matchedExisting } = itemProfileTarget(credential, store);
+		const { profileId, matchedExisting } = itemProfileTarget(credential, store, params.ctx, params.source);
 		const existing = store.profiles[profileId];
 		const configProfile = authProfileConfigForCredential(credential, profileId);
 		const configConflict = configProfile ? hasAuthProfileConfigConflict(params.ctx.config, configProfile, Boolean(params.ctx.overwrite)) : false;
@@ -459,13 +464,31 @@ async function buildCodexAuthItems(params) {
 				sourceProfileId: credential.profileId,
 				sourceCredentialFingerprint: sourceCredentialFingerprint(credential),
 				sourceKind: "codex-native-selected-storage",
+				...profileId === "openai:default" && !matchedExisting ? { legacyNativeHome: params.source.codexHome } : {},
 				credentialKind: credential.kind,
 				credentialImportUnavailable: unavailable
 			}
 		});
 	});
 }
-async function applyCodexAuthItems(params) {
+function createCodexAuthItemApplier(params) {
+	const { items, ...context } = params;
+	const selectedKinds = new Set(items.filter((item) => item.kind === "auth" && item.status === "planned").map((item) => item.details?.credentialKind));
+	const selectedKind = selectedKinds.size === 1 ? selectedKinds.values().next().value : void 0;
+	let snapshot;
+	const readCredentials = () => snapshot ??= readCodexAuthCredentials(context.source, {
+		credentialKind: selectedKind === "oauth" || selectedKind === "api_key" ? selectedKind : void 0,
+		includeConfigPatch: resolveCodexConfigPatchMode(context.ctx) !== "none",
+		allowKeychainPrompt: allowCodexKeychainPrompt(context.ctx),
+		signal: context.ctx.signal
+	});
+	return (item) => applyCodexAuthItem({
+		...context,
+		item,
+		readCredentials
+	});
+}
+async function applyCodexAuthItem(params) {
 	const { ctx, item, source, targets } = params;
 	if (item.status !== "planned") return [item];
 	const profileId = typeof item.details?.profileId === "string" ? item.details.profileId : "";
@@ -474,14 +497,13 @@ async function applyCodexAuthItems(params) {
 	const credentialKind = item.details?.credentialKind;
 	if (!profileId || !provider || credentialKind !== "oauth" && credentialKind !== "api_key") return [markMigrationItemError(item, CODEX_REASON_MISSING_AUTH_METADATA)];
 	const configPatchMode = resolveCodexConfigPatchMode(ctx);
-	const credential = (await readCodexAuthCredentials(source, {
-		credentialKind,
-		includeConfigPatch: configPatchMode !== "none",
-		allowKeychainPrompt: allowCodexKeychainPrompt(ctx),
-		signal: ctx.signal
-	})).find((candidate) => candidate.provider === provider && candidate.kind === credentialKind && (!sourceProfileId || candidate.profileId === sourceProfileId));
+	ctx.signal?.throwIfAborted();
+	const credentials = await params.readCredentials();
+	ctx.signal?.throwIfAborted();
+	const credential = credentials.find((candidate) => candidate.provider === provider && candidate.kind === credentialKind && (!sourceProfileId || candidate.profileId === sourceProfileId));
 	if (!credential) return [markMigrationItemSkipped(item, CODEX_REASON_AUTH_NO_LONGER_PRESENT)];
 	if (item.details?.sourceCredentialFingerprint !== sourceCredentialFingerprint(credential)) return [markMigrationItemSkipped(item, CODEX_REASON_AUTH_NO_LONGER_PRESENT)];
+	if (item.details?.legacyNativeHome !== void 0 && (item.details.legacyNativeHome !== source.codexHome || source.codexHome !== defaultCodexHome())) return [markMigrationItemSkipped(item, CODEX_REASON_AUTH_NO_LONGER_PRESENT)];
 	ctx.signal?.throwIfAborted();
 	const oauthProfile = credential.kind === "oauth" ? credential.result.profiles[0] : void 0;
 	const oauthCredential = oauthProfile?.credential.type === "oauth" ? oauthProfile.credential : void 0;
@@ -497,9 +519,14 @@ async function applyCodexAuthItems(params) {
 		stateDir: ctx.stateDir,
 		updater: (freshStore) => {
 			ctx.signal?.throwIfAborted();
-			const existing = freshStore.profiles[profileId];
+			const effectiveStore = loadAuthProfileStoreWithoutExternalProfiles(targets.agentDir);
+			if (item.details?.legacyNativeHome !== void 0 && itemProfileTarget(credential, effectiveStore, ctx, source).profileId !== profileId) {
+				conflicted = true;
+				return false;
+			}
+			const existing = effectiveStore.profiles[profileId];
 			if (!ctx.overwrite && existing) {
-				if ((credential.kind === "oauth" ? findMatchingOAuthProfile(freshStore, oauthCredential) : findMatchingApiKeyProfile(freshStore, credential.provider, credential.key)) === profileId) {
+				if ((credential.kind === "oauth" ? findMatchingOAuthProfile(effectiveStore, oauthCredential) : findMatchingApiKeyProfile(effectiveStore, credential.provider, credential.key)) === profileId) {
 					unusable = existing.type === "oauth" && !hasUsableOAuthCredential(existing);
 					return false;
 				}
@@ -519,7 +546,7 @@ async function applyCodexAuthItems(params) {
 	});
 	if (conflicted) return [markMigrationItemConflict(item, CODEX_REASON_AUTH_PROFILE_EXISTS)];
 	if (unusable) return [markMigrationItemSkipped(item, CODEX_REASON_AUTH_PROFILE_UNUSABLE)];
-	if (!store?.profiles[profileId]) return [markMigrationItemError(item, CODEX_REASON_AUTH_PROFILE_WRITE_FAILED)];
+	if (!store || !loadAuthProfileStoreWithoutExternalProfiles(targets.agentDir).profiles[profileId]) return [markMigrationItemError(item, CODEX_REASON_AUTH_PROFILE_WRITE_FAILED)];
 	const configResult = configPatchMode !== "apply" ? "unavailable" : await applyCodexAuthConfig(ctx, credential, profileId);
 	if (configResult === "conflict") return [markMigrationItemConflict(item, CODEX_REASON_AUTH_PROFILE_EXISTS)];
 	const migratedItem = {
@@ -564,18 +591,6 @@ function buildCodexAuthConfigPatchItems(ctx, item, credential, profileId) {
 	return items;
 }
 //#endregion
-//#region extensions/codex/src/migration/targets.ts
-function resolveCodexMigrationTargets(ctx) {
-	const cfg = ctx.config;
-	const agentId = ctx.targetAgentId ?? resolveDefaultAgentId(cfg);
-	const workspaceDir = resolveAgentWorkspaceDir(cfg, agentId);
-	const configuredAgentDir = resolveAgentConfig(cfg, agentId)?.agentDir?.trim();
-	return {
-		workspaceDir,
-		agentDir: ctx.runtime?.agent?.resolveAgentDir(cfg, agentId) ?? (configuredAgentDir ? resolveHomePath(configuredAgentDir) : void 0) ?? path.join(ctx.stateDir, "agents", agentId, "agent")
-	};
-}
-//#endregion
 //#region extensions/codex/src/migration/plan.ts
 const CODEX_PLUGIN_CONFIG_ITEM_ID = "config:codex-plugins";
 const CODEX_PLUGIN_CONFIG_PATH = [
@@ -880,7 +895,7 @@ function buildPluginConfigItem(ctx, pluginItems) {
 	});
 }
 async function buildCodexMigrationPlan(ctx) {
-	const targets = resolveCodexMigrationTargets(ctx);
+	const targets = resolvePlannedMigrationTargets(ctx);
 	const memoryOnly = ctx.itemKinds !== void 0 && ctx.itemKinds.length > 0 && ctx.itemKinds.every((kind) => kind === "memory");
 	const authOnly = ctx.itemKinds !== void 0 && ctx.itemKinds.length > 0 && ctx.itemKinds.every((kind) => kind === "auth");
 	const source = await discoverCodexSource({
@@ -922,7 +937,6 @@ async function buildCodexMigrationPlan(ctx) {
 		}));
 	}
 	const warnings = [
-		...!ctx.includeSecrets && items.some((item) => item.kind === "auth") ? ["Auth credentials were detected but skipped. Re-run interactively or pass --include-secrets to import supported credentials."] : [],
 		...items.some((item) => item.status === "conflict") ? ["Conflicts were found. Re-run with --overwrite to replace conflicting migration targets after item-level backups."] : [],
 		...source.pluginDiscoveryError ? [`Codex app-server plugin inventory discovery failed: ${source.pluginDiscoveryError}. Cached plugin bundles, if any, are advisory only.`] : [],
 		...source.plugins.some((plugin) => plugin.migrationBlock?.code === "codex_subscription_required") ? [codexPluginMigrationSubscriptionWarning()] : []
@@ -944,4 +958,4 @@ async function buildCodexMigrationPlan(ctx) {
 	};
 }
 //#endregion
-export { CODEX_PLUGIN_CONFIG_ITEM_ID, CODEX_PLUGIN_CONFIG_PATH, buildCodexMigrationPlan, buildCodexPluginsConfigValue, hasCodexPluginConfigConflict, applyCodexAuthItems as n, resolveCodexConfigPatchMode as r, readCodexPluginMigrationConfigEntry, resolveCodexMigrationTargets as t };
+export { CODEX_PLUGIN_CONFIG_ITEM_ID, CODEX_PLUGIN_CONFIG_PATH, buildCodexMigrationPlan, buildCodexPluginsConfigValue, hasCodexPluginConfigConflict, resolveCodexConfigPatchMode as n, readCodexPluginMigrationConfigEntry, createCodexAuthItemApplier as t };

package/dist/{plugin-activation-BYQculil.js → .setup/plugin-activation-DT3MNtqj.mjs}

@@ -1,6 +1,6 @@
-import { c as CODEX_PLUGINS_MARKETPLACE_NAME, i as pluginReadParams, n as isOpenAiCuratedMarketplace, r as isOpenAiCuratedMarketplaceName, t as findCodexMarketplacePluginSummary } from "./plugin-inventory-oL4Na1ZG.js";
-import { t as CodexAppServerRpcError } from "./rpc-error-ttN_QjEm.js";
-import "./config-oIORaQ5T.js";
+import { c as CODEX_PLUGINS_MARKETPLACE_NAME, i as pluginReadParams, n as isOpenAiCuratedMarketplace, r as isOpenAiCuratedMarketplaceName, t as findCodexMarketplacePluginSummary } from "./plugin-inventory-BoRei8Z4.mjs";
+import { o as CodexAppServerRpcError } from "./timeout-C910MdAB.mjs";
+import "./config-BoTP_mrL.mjs";
 import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 //#region extensions/codex/src/app-server/plugin-activation.ts
 /**
@@ -45,7 +45,6 @@ async function ensureCodexPluginActivation(params) {
 			diagnostics: [{ message: `Codex plugin install failed: ${coerceErrorMessage(error)}` }]
 		};
 	}
-	if (params.metadataCache && params.appCacheKey) params.metadataCache.invalidate(params.appCacheKey);
 	const refreshDiagnostics = [];
 	let refreshFailed = false;
 	try {
@@ -53,6 +52,7 @@ async function ensureCodexPluginActivation(params) {
 			request: params.request,
 			appCache: params.appCache,
 			appCacheKey: params.appCacheKey,
+			appInventoryCacheKey: params.appInventoryCacheKey,
 			configCwd: params.configCwd,
 			metadataCache: params.metadataCache,
 			deferAppInventoryRefresh: params.deferAppInventoryRefresh,
@@ -74,25 +74,16 @@ async function ensureCodexPluginActivation(params) {
 		diagnostics: [...refreshDiagnostics, ...installResponse.appsNeedingAuth.map((app) => ({ message: `${app.name} requires app authentication before plugin tools are exposed.` }))]
 	};
 }
-/** Forces Codex plugin, skill, hook, MCP, and app inventory refreshes after activation. */
+/** Refreshes OpenClaw inventories after Codex installs a plugin. */
 async function refreshCodexPluginRuntimeState(params) {
 	const diagnostics = [];
+	if (params.appCacheKey) params.metadataCache?.invalidate(params.appCacheKey);
 	await listCuratedCodexPluginMetadata(params, { forceRefetch: true });
-	await params.request("skills/list", {
-		cwds: params.configCwd ? [params.configCwd] : [],
-		forceReload: true
-	});
-	try {
-		await params.request("hooks/list", { cwds: params.configCwd ? [params.configCwd] : [] });
-	} catch (error) {
-		diagnostics.push({ message: `Codex hooks refresh skipped: ${coerceErrorMessage(error)}` });
-	}
-	await params.request("config/mcpServer/reload", void 0);
 	if (params.appCache && params.appCacheKey) try {
 		await refreshCodexAppRuntimeState({
 			...params,
 			appCache: params.appCache,
-			appCacheKey: params.appCacheKey
+			appCacheKey: params.appInventoryCacheKey ?? params.appCacheKey
 		});
 	} catch (error) {
 		diagnostics.push({ message: `Codex app inventory refresh skipped: ${coerceErrorMessage(error)}` });