@openclaw/codex 2026.9.4 → 2026.9.6

package/dist/media-understanding-provider.js

@@ -6,7 +6,7 @@ import { validateJsonSchemaValue } from "openclaw/plugin-sdk/json-schema-runtime
 * structured extraction turns.
 */
 const CODEX_MEDIA_PROVIDER_ID = "codex";
-const DEFAULT_CODEX_IMAGE_MODEL = "gpt-5.6-sol";
+const DEFAULT_CODEX_IMAGE_MODEL = "gpt-6-astra";
 const DEFAULT_CODEX_IMAGE_PROMPT = "Describe the image.";
 /**
 * Builds the media-understanding provider that delegates image tasks to an
@@ -43,7 +43,7 @@ async function describeCodexImages(req, options) {
 	const model = req.model.trim();
 	if (!model) throw new Error("Codex image understanding requires model id.");
 	req.signal?.throwIfAborted();
-	const { runBoundedCodexAppServerTurn } = await import("./bounded-turn-C_Hneydj.js");
+	const { runBoundedCodexAppServerTurn } = await import("./.setup/bounded-turn-B2HScEgT.mjs");
 	req.signal?.throwIfAborted();
 	const { text } = await runBoundedCodexAppServerTurn({
 		config: req.cfg,
@@ -83,7 +83,7 @@ async function extractCodexStructured(req, options) {
 	if (req.input.length === 0) throw new Error("Codex structured extraction requires at least one input.");
 	if (!req.input.some((entry) => entry.type === "image")) throw new Error("Codex structured extraction requires at least one image input.");
 	req.signal?.throwIfAborted();
-	const { runBoundedCodexAppServerTurn } = await import("./bounded-turn-C_Hneydj.js");
+	const { runBoundedCodexAppServerTurn } = await import("./.setup/bounded-turn-B2HScEgT.mjs");
 	req.signal?.throwIfAborted();
 	const { text } = await runBoundedCodexAppServerTurn({
 		config: req.cfg,

package/dist/migration-provider-api.js

@@ -1,2 +1,2 @@
-import { t as buildCodexMigrationProvider } from "./provider-MQ8PVkuE.js";
+import { t as buildCodexMigrationProvider } from "./.setup/provider-BOsxQHOM.mjs";
 export { buildCodexMigrationProvider as buildMigrationProvider };

package/dist/native-tool-policy.js

@@ -0,0 +1,12 @@
+//#region extensions/codex/native-tool-policy.ts
+/** Capabilities exposed together by Codex native code mode. */
+const CODEX_NATIVE_TOOL_REQUIREMENTS = [
+	"exec",
+	"process",
+	"read",
+	"write",
+	"edit",
+	"apply_patch"
+];
+//#endregion
+export { CODEX_NATIVE_TOOL_REQUIREMENTS };

package/dist/provider-discovery.js

@@ -0,0 +1,18 @@
+//#region extensions/codex/provider-discovery.ts
+const codexProviderDiscovery = {
+	id: "codex",
+	label: "Codex",
+	auth: [],
+	prepareSyntheticAuth: async ({ config, provider, env, signal, pluginRoot }) => {
+		if (provider !== "codex") return;
+		const { probeCodexNativeAuth } = await import("./.setup/native-auth-rWbGbMn3.mjs");
+		return await probeCodexNativeAuth({
+			config,
+			env,
+			signal,
+			pluginRoot
+		});
+	}
+};
+//#endregion
+export { codexProviderDiscovery as default };

package/dist/session-history-worker-runtime.js

@@ -1,23 +1,45 @@
-import { n as codexHistoryRejectionReason } from "./history-rejection-B4nOXNXF.js";
-import { n as runCodexHistoryWorkerInput, t as codexHistoryWorkerUrl } from "./session-history.worker-BeK1YOyT.js";
-import { n as resolveCodexHistoryTarget } from "./session-history-Cz-tOOYj.js";
-import { WorkerTaskPool } from "openclaw/plugin-sdk/process-runtime";
+import { n as codexHistoryRejectionReason } from "./.setup/history-rejection-B4nOXNXF.mjs";
+import { t as runCodexHistoryWorkerInput } from "./.setup/session-history.worker-CaCh0xF_.mjs";
+import { n as resolveCodexHistoryTarget } from "./.setup/session-history-BrqhSCf9.mjs";
+import { WorkerTaskPool, resolveRuntimeWorkerArgv, resolveRuntimeWorkerUrl } from "openclaw/plugin-sdk/process-runtime";
 import { isIncognitoSessionKey } from "openclaw/plugin-sdk/session-key-runtime";
+import { fileURLToPath } from "node:url";
 import { SessionTranscriptReadFenceError, captureCodexSessionTranscriptReadAdmission, validateCodexSessionTranscriptContextVersion, validateCodexSessionTranscriptReadAdmission } from "openclaw/plugin-sdk/codex-session-transcript-runtime";
 //#region extensions/codex/session-history-worker-runtime.ts
+const codexHistoryWorkerEntrypoint = {
+	currentModuleUrl: import.meta.url,
+	sourceWorkerName: "session-history.worker",
+	distWorkerPath: "extensions/codex/session-history.worker.js",
+	package: {
+		name: "@openclaw/codex",
+		distWorkerPath: "session-history.worker.js"
+	}
+};
+function resolveCodexHistoryWorkerUrl() {
+	const sourceUrl = resolveRuntimeWorkerUrl(codexHistoryWorkerEntrypoint);
+	if (!(/\.[cm]?ts$/u.test(sourceUrl.pathname) && (typeof process.versions.bun === "string" || resolveRuntimeWorkerArgv(sourceUrl).length === 1))) return sourceUrl;
+	return resolveRuntimeWorkerUrl({
+		...codexHistoryWorkerEntrypoint,
+		root: fileURLToPath(new URL("../..", import.meta.url))
+	});
+}
 const historyReads = new WorkerTaskPool({
-	workerUrl: codexHistoryWorkerUrl,
+	workerUrl: resolveCodexHistoryWorkerUrl(),
 	maxWorkers: 1
 });
-async function readHistory(target, operation, admission, signal) {
+async function projectCodexSettledHistoryInWorker(target, signal) {
 	signal?.throwIfAborted();
-	const resolved = resolveCodexHistoryTarget(target, admission);
-	const receipt = admission ?? (resolved.kind === "sqlite" ? captureCodexSessionTranscriptReadAdmission(resolved.target) : void 0);
+	const resolved = resolveCodexHistoryTarget(target);
+	const receipt = resolved.kind === "sqlite" ? captureCodexSessionTranscriptReadAdmission(resolved.target) : void 0;
 	const input = {
-		...operation,
 		target: resolved,
 		sessionId: target.sessionId,
-		...receipt ? { admission: { ...receipt } } : {}
+		...receipt ? { admission: { ...receipt } } : {},
+		evidence: {
+			mirroredMessages: target.mirroredMessages,
+			settledMessages: target.settledMessages,
+			turnId: target.turnId
+		}
 	};
 	const result = resolved.kind === "sqlite" && isIncognitoSessionKey(resolved.target.sessionKey) ? await runCodexHistoryWorkerInput(input) : await historyReads.run(input, {
 		timeoutMs: 6e4,
@@ -29,32 +51,11 @@ async function readHistory(target, operation, admission, signal) {
 		else validateCodexSessionTranscriptContextVersion(resolved.target, result.version);
 	} catch (error) {
 		return {
-			...result,
-			result: {
-				status: "rejected",
-				reason: error instanceof SessionTranscriptReadFenceError ? "snapshot_invalidated" : codexHistoryRejectionReason(error)
-			}
+			status: "rejected",
+			reason: error instanceof SessionTranscriptReadFenceError ? "snapshot_invalidated" : codexHistoryRejectionReason(error)
 		};
 	}
-	return result;
-}
-async function readCodexHistoryMessagesInWorker(target, admission, signal) {
-	const result = await readHistory(target, { kind: "messages" }, admission, signal);
-	return result.kind === "messages" && result.result.status === "ok" ? result.result.value : void 0;
-}
-async function projectCodexSettledHistoryInWorker(target, signal) {
-	const result = await readHistory(target, {
-		kind: "settled",
-		evidence: {
-			mirroredMessages: target.mirroredMessages,
-			settledMessages: target.settledMessages,
-			turnId: target.turnId
-		}
-	}, void 0, signal);
-	return result.kind === "settled" ? result.result : {
-		status: "rejected",
-		reason: "history_read_failed"
-	};
+	return result.result;
 }
 //#endregion
-export { projectCodexSettledHistoryInWorker, readCodexHistoryMessagesInWorker };
+export { projectCodexSettledHistoryInWorker };

package/dist/session-history.worker.js

@@ -1,2 +1,2 @@
-import { n as runCodexHistoryWorkerInput, t as codexHistoryWorkerUrl } from "./session-history.worker-BeK1YOyT.js";
-export { codexHistoryWorkerUrl, runCodexHistoryWorkerInput };
+import { t as runCodexHistoryWorkerInput } from "./.setup/session-history.worker-CaCh0xF_.mjs";
+export { runCodexHistoryWorkerInput };

package/dist/web-search-contract-api.js

@@ -1,4 +1,4 @@
-import { t as createCodexWebSearchProviderBase } from "./web-search-provider.shared-BrZmlqyR.js";
+import { t as createCodexWebSearchProviderBase } from "./.setup/web-search-provider.shared-BrZmlqyR.mjs";
 //#region extensions/codex/web-search-contract-api.ts
 function createCodexWebSearchProvider() {
 	return {