@openclaw/codex 2026.9.5 → 2026.9.6

package/dist/.setup/launch-args-DbFCehO7.mjs

@@ -0,0 +1,196 @@
+import { createRequire } from "node:module";
+import path from "node:path";
+//#region extensions/codex/src/app-server/launch-args.ts
+const CODEX_VALUE_OPTIONS = /* @__PURE__ */ new Set([
+	"-m",
+	"--model",
+	"--local-provider",
+	"-p",
+	"--profile",
+	"-s",
+	"--sandbox",
+	"-a",
+	"--ask-for-approval",
+	"-C",
+	"--cd",
+	"--add-dir",
+	"--remote",
+	"--remote-auth-token-env",
+	"-c",
+	"--config",
+	"--enable",
+	"--disable",
+	"--listen",
+	"--sock",
+	"--code-mode-host",
+	"--ws-auth",
+	"--ws-token-file",
+	"--ws-token-sha256",
+	"--ws-shared-secret-file",
+	"--ws-issuer",
+	"--ws-audience",
+	"--ws-max-clock-skew-seconds"
+]);
+/** One tokenization owner for launch, turn policy, reviewer trust, and private turns. */
+function readCodexArgs(args) {
+	const tokens = [];
+	let nativeSubcommand = false;
+	let end = 0;
+	for (const [index, arg] of args.entries()) {
+		if (index < end) continue;
+		end = index + 1;
+		const attached = /^(--[^=]+)=([\s\S]*)$/u.exec(arg) ?? /^(-[cmpisaC])=?([\s\S]+)$/u.exec(arg);
+		const name = attached?.[1] ?? arg;
+		let value = attached?.[2];
+		if (name === "-i" || name === "--image") while (args[end]?.startsWith("-") === false) end += 1;
+		else if (!attached && CODEX_VALUE_OPTIONS.has(name)) {
+			value = args[end];
+			if (value !== void 0) end += 1;
+		}
+		tokens.push({
+			index,
+			end,
+			name,
+			value
+		});
+		if (name === "app-server") nativeSubcommand = true;
+		if (name === "--" && nativeSubcommand) break;
+	}
+	return tokens;
+}
+/** Uses the native CLI configuration for status without starting its transport. */
+function buildCodexLoginStatusArgs(args) {
+	const options = /* @__PURE__ */ new Set([
+		"-c",
+		"--config",
+		"-p",
+		"--profile",
+		"--enable",
+		"--disable"
+	]);
+	const tokens = readCodexArgs(args);
+	const subcommandIndex = tokens.findLast(({ name }) => name === "app-server")?.index ?? -1;
+	const prefix = subcommandIndex < 0 ? [] : args.slice(0, subcommandIndex);
+	const configArgs = tokens.filter(({ index, name }) => index > subcommandIndex && options.has(name)).flatMap(({ index, end }) => args.slice(index, end));
+	return [
+		...prefix,
+		...configArgs,
+		"login",
+		"status"
+	];
+}
+function readCodexAppServerConfigOptions(args) {
+	return readCodexArgs(args).filter(({ name }) => name === "-c" || name === "--config" || name === "-p" || name === "--profile");
+}
+const NODE_LAUNCH_VALUE_OPTIONS = /* @__PURE__ */ new Set([
+	"-r",
+	"--require",
+	"--import",
+	"--loader",
+	"--experimental-loader",
+	"--max-old-space-size",
+	"--max-semi-space-size",
+	"--stack-size"
+]);
+const NODE_LAUNCH_FLAGS = /* @__PURE__ */ new Set([
+	"--enable-source-maps",
+	"--no-warnings",
+	"--trace-warnings",
+	"--trace-uncaught",
+	"--no-deprecation",
+	"--trace-deprecation",
+	"--experimental-strip-types",
+	"--experimental-transform-types",
+	"--no-experimental-strip-types",
+	"--use-strict",
+	"--expose-gc"
+]);
+function resolveNodeLauncherModule(value, option, cwd) {
+	if (path.isAbsolute(value)) return value;
+	if (/^\.{1,2}[\\/]/u.test(value)) return path.resolve(cwd, value);
+	if (option === "-r" || option === "--require") return createRequire(path.join(cwd, "openclaw-codex-launcher.cjs")).resolve(value);
+	if (/^(?:file|data|node):/u.test(value)) return value;
+	throw new Error("Private Codex turns require an absolute or relative file path for ESM preloads");
+}
+/** Separates a supported launcher from native flags before a private turn sanitizes them. */
+function resolveCodexPrivateLauncher(params) {
+	const launcherArgs = [];
+	let nativeArgs = [...params.args];
+	const executable = params.command.split(/[\\/]/u).at(-1)?.toLowerCase();
+	if (executable && [
+		"node",
+		"node.exe",
+		"nodejs",
+		"nodejs.exe"
+	].includes(executable)) {
+		let index = 0;
+		while (params.args[index]?.startsWith("-")) {
+			const raw = params.args[index];
+			index += 1;
+			if (raw === "--") {
+				launcherArgs.push(raw);
+				break;
+			}
+			const attached = /^(--[^=]+)=([\s\S]*)$/u.exec(raw) ?? /^(-r)([\s\S]+)$/u.exec(raw);
+			const name = attached?.[1] ?? raw;
+			const normalizedName = name.replaceAll("_", "-");
+			if (NODE_LAUNCH_VALUE_OPTIONS.has(normalizedName)) {
+				const value = attached?.[2] ?? params.args[index++];
+				if (value === void 0 || !value.trim()) throw new Error("Private Codex turns received a Node launcher option without its value");
+				const moduleOption = [
+					"-r",
+					"--require",
+					"--import",
+					"--loader",
+					"--experimental-loader"
+				].includes(normalizedName);
+				if (attached && !moduleOption) launcherArgs.push(raw);
+				else launcherArgs.push(name, moduleOption ? resolveNodeLauncherModule(value, normalizedName, path.resolve(params.cwd)) : value);
+			} else if (!attached && NODE_LAUNCH_FLAGS.has(name)) launcherArgs.push(raw);
+			else throw new Error(`Private Codex turns cannot isolate unsupported Node launcher option ${name}`);
+		}
+		const script = params.args[index];
+		if (!script) throw new Error("Private Codex turns require a Node wrapper script");
+		launcherArgs.push(path.resolve(params.cwd, script));
+		nativeArgs = params.args.slice(index + 1);
+		if (!readCodexArgs(nativeArgs).some(({ name }) => name === "app-server")) throw new Error("Private Codex turns require a native app-server command after the Node wrapper");
+	}
+	if (executable && /^(?:(?:ba|da|z|fi)?sh|python(?:\d+(?:\.\d+)*)?|ruby|perl|cmd|powershell|pwsh)(?:\.exe)?$/u.test(executable)) throw new Error("Private Codex turns cannot isolate inline or interpreted wrappers; use a Node script or a directly executable wrapper");
+	const tokens = readCodexArgs(nativeArgs);
+	const serverIndex = tokens.findLast(({ name }) => name === "app-server")?.index ?? nativeArgs.length;
+	if (tokens.some(({ index, name }) => index < serverIndex && (!name.startsWith("-") || name === "--"))) throw new Error("Private Codex turns cannot isolate this launcher prefix; use a Node script or a directly executable wrapper");
+	return {
+		launcherArgs,
+		nativeArgs
+	};
+}
+/** The stdio proxy forwards to an external server; it does not own that runtime. */
+function isCodexAppServerProxyLaunch(args) {
+	const tokens = readCodexArgs(args);
+	const server = tokens.findLastIndex(({ name }) => name === "app-server");
+	return server >= 0 && tokens.slice(server + 1).find(({ name }) => !name.startsWith("-"))?.name === "proxy";
+}
+/** Keeps Codex overrides in one CLI scope without rewriting raw TOML or wrapper prefixes. */
+function normalizeCodexAppServerArgs(rawArgs, enforcedOverride) {
+	const tokens = readCodexArgs(rawArgs);
+	const subcommandIndex = tokens.findLast(({ name }) => name === "app-server")?.index ?? -1;
+	const prefix = subcommandIndex < 0 ? [...rawArgs] : rawArgs.slice(0, subcommandIndex);
+	const suffix = [];
+	if (subcommandIndex >= 0) for (const token of tokens) {
+		if (token.index <= subcommandIndex) continue;
+		if (token.name === "--") {
+			suffix.push(...rawArgs.slice(token.index));
+			break;
+		}
+		(token.name === "-c" || token.name === "--config" ? prefix : suffix).push(...rawArgs.slice(token.index, token.end));
+	}
+	if (enforcedOverride && !(prefix.at(-2) === "-c" && prefix.at(-1) === enforcedOverride)) prefix.push("-c", enforcedOverride);
+	const normalized = subcommandIndex < 0 ? prefix : [
+		...prefix,
+		"app-server",
+		...suffix
+	];
+	return normalized.length === rawArgs.length && normalized.every((arg, index) => arg === rawArgs[index]) ? rawArgs : normalized;
+}
+//#endregion
+export { resolveCodexPrivateLauncher as a, readCodexAppServerConfigOptions as i, isCodexAppServerProxyLaunch as n, normalizeCodexAppServerArgs as r, buildCodexLoginStatusArgs as t };

package/dist/.setup/{managed-binary-DP6Rib3P.mjs → managed-binary-BnshlFag.mjs}

@@ -1,5 +1,4 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
-import { n as MANAGED_CODEX_APP_SERVER_PACKAGE } from "./version-CoqzXPgK.mjs";
 import { createRequire } from "node:module";
 import { constants, existsSync, realpathSync } from "node:fs";
 import path from "node:path";
@@ -43,6 +42,17 @@ function resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath(params = {}
 	return candidates.find((candidate) => pathExists(candidate));
 }
 //#endregion
+//#region extensions/codex/src/app-server/version.ts
+/**
+* Version and package pins for the managed Codex app-server runtime.
+*/
+/** Exact Codex app-server version shipped by the OpenClaw Codex bridge. */
+const CODEX_APP_SERVER_VERSION = "0.155.1";
+/** Inclusive runtime compatibility floor for external app-server binaries. */
+const MIN_SUPPORTED_CODEX_APP_SERVER_VERSION = "0.149.0";
+/** npm package name for the managed Codex app-server binary. */
+const MANAGED_CODEX_APP_SERVER_PACKAGE = "@openai/codex";
+//#endregion
 //#region extensions/codex/src/app-server/managed-binary.ts
 /**
 * Resolves the managed Codex app-server binary shipped with or installed beside
@@ -160,6 +170,7 @@ function resolvePackageJsonFromRoot(packageName, root) {
 function resolveManagedCodexAppServerCommandCandidates(pluginRoot, platform, managedCommandOrder) {
 	const packageCommand = resolveManagedCodexPackageEntrypoint(pluginRoot);
 	const packageCommandPaths = packageCommand ? [packageCommand] : [];
+	if (managedCommandOrder === "package-only") return packageCommandPaths;
 	const desktopCommandPaths = resolveMacOSDesktopCodexAppServerCommandCandidates(platform);
 	return managedCommandOrder === "desktop-first" ? [...desktopCommandPaths, ...packageCommandPaths] : [...packageCommandPaths, ...desktopCommandPaths];
 }
@@ -192,4 +203,4 @@ async function commandPathExists(filePath, platform) {
 	}
 }
 //#endregion
-export { resolvePackagedCodexNativeCommand as a, resolveMacOSDesktopCodexAppPathCandidates as c, resolveManagedCodexNativeCommand as i, resolveMacOSDesktopCodexBundledMarketplaceCandidates as l, managed_binary_exports as n, setManagedCodexPluginRoot as o, resolveManagedCodexAppServerStartOptions as r, resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath as s, isManagedCodexDesktopCommand as t, resolveMacOSDesktopCodexComputerUseServiceAppCandidates as u };
+export { resolvePackagedCodexNativeCommand as a, MIN_SUPPORTED_CODEX_APP_SERVER_VERSION as c, resolveMacOSDesktopCodexBundledMarketplaceCandidates as d, resolveMacOSDesktopCodexComputerUseServiceAppCandidates as f, resolveManagedCodexNativeCommand as i, resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath as l, managed_binary_exports as n, setManagedCodexPluginRoot as o, resolveManagedCodexAppServerStartOptions as r, CODEX_APP_SERVER_VERSION as s, isManagedCodexDesktopCommand as t, resolveMacOSDesktopCodexAppPathCandidates as u };

package/dist/.setup/{model-catalog-DkvUuBey.mjs → model-catalog-CfXJf9Ay.mjs}

@@ -1,13 +1,12 @@
-import { r as buildCodexRuntimeModelParams } from "./harness-rxaaoN-o.mjs";
-import { m as isJsonObject } from "./config-security-BRQ2mgW9.mjs";
+import { r as buildCodexRuntimeModelParams } from "./harness-a_MsE4-_.mjs";
 import { d as readCodexPluginConfig } from "./config-parsing-CcB9iPoq.mjs";
-import { n as isCodexAppServerProxyLaunch } from "./launch-args-DnMak49W.mjs";
-import { o as withCodexAppServerJsonClient } from "./request-BioXJLYa.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-CeAhl_h4.mjs";
+import { n as isCodexAppServerProxyLaunch } from "./launch-args-DbFCehO7.mjs";
+import { o as withCodexAppServerJsonClient } from "./request-D2L0zMrq.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-C8Rw1m1m.mjs";
 import { a as resolveCodexAppServerAuthProfileStore, r as resolveCodexAppServerAuthProfileId } from "./auth-profile-WqZtZfXN.mjs";
-import { r as captureSharedCodexAppServerCatalogLifetime } from "./shared-client-BpTtuLQ5.mjs";
-import { t as listAllCodexAppServerModels } from "./models-BDFgm_G-.mjs";
-import { probeCodexNativeAuth } from "./native-auth-BLZGqFjw.mjs";
+import { r as captureSharedCodexAppServerCatalogLifetime } from "./shared-client-DA4VR4Eb.mjs";
+import { t as listAllCodexAppServerModels } from "./models-KnqBv0hE.mjs";
+import { probeCodexNativeAuth } from "./native-auth-rWbGbMn3.mjs";
 //#region extensions/codex/src/app-server/model-catalog.ts
 const DEFAULT_MODEL_DISCOVERY_TIMEOUT_MS = 2500;
 const INPUT_TYPES = /* @__PURE__ */ new Set([
@@ -107,11 +106,11 @@ function createCodexAppServerModelCatalog(runtime) {
 					method: "account/read",
 					requestParams: { refreshToken: false }
 				});
-				const observedType = isJsonObject(account.account) ? account.account.type : void 0;
+				const observedType = account.account?.type;
 				return {
 					models,
 					isCurrent,
-					accountType: account.requiresOpenaiAuth === true ? observedType === "apiKey" || observedType === "chatgpt" ? observedType : void 0 : void 0
+					accountType: account.requiresOpenaiAuth ? observedType === "apiKey" || observedType === "chatgpt" ? observedType : void 0 : void 0
 				};
 			});
 			if (disposed || observations.get(key) !== observation || !result.isCurrent()) return [];

package/dist/.setup/{models-BDFgm_G-.mjs → models-KnqBv0hE.mjs}

@@ -1,4 +1,4 @@
-import { h as assertCodexModelListResponse } from "./client-vXs2929Q.mjs";
+import { g as assertCodexModelListResponse } from "./client-Cs08OXVQ.mjs";
 import { normalizeOptionalString, uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
 //#region extensions/codex/src/app-server/models.ts
 /**
@@ -37,8 +37,8 @@ async function withCodexAppServerModelRequest(options, run) {
 	if (options.request) return await run(options.request);
 	const timeoutMs = options.timeoutMs ?? 2500;
 	const useSharedClient = options.sharedClient !== false;
-	const { createIsolatedCodexAppServerClient, getLeasedSharedCodexAppServerClient, releaseLeasedSharedCodexAppServerClient } = await import("./shared-client-BpTtuLQ5.mjs").then((n) => n.y);
-	const { requestCodexAppServerClientJson } = await import("./request-BioXJLYa.mjs").then((n) => n.a);
+	const { createIsolatedCodexAppServerClient, getLeasedSharedCodexAppServerClient, releaseLeasedSharedCodexAppServerClient } = await import("./shared-client-DA4VR4Eb.mjs").then((n) => n.y);
+	const { requestCodexAppServerClientJson } = await import("./request-D2L0zMrq.mjs").then((n) => n.a);
 	const client = await (useSharedClient ? getLeasedSharedCodexAppServerClient : createIsolatedCodexAppServerClient)({
 		startOptions: options.startOptions,
 		timeoutMs,

package/dist/.setup/{native-auth-BLZGqFjw.mjs → native-auth-rWbGbMn3.mjs}

@@ -1,8 +1,8 @@
 import { d as readCodexPluginConfig } from "./config-parsing-CcB9iPoq.mjs";
-import { n as isCodexAppServerProxyLaunch, t as buildCodexLoginStatusArgs } from "./launch-args-DnMak49W.mjs";
-import { r as resolveManagedCodexAppServerStartOptions } from "./managed-binary-DP6Rib3P.mjs";
-import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-Cmx94Oiy.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-CeAhl_h4.mjs";
+import { n as isCodexAppServerProxyLaunch, t as buildCodexLoginStatusArgs } from "./launch-args-DbFCehO7.mjs";
+import { r as resolveManagedCodexAppServerStartOptions } from "./managed-binary-BnshlFag.mjs";
+import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-h2VHOskC.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-C8Rw1m1m.mjs";
 import { runUtf8CommandWithTimeout } from "openclaw/plugin-sdk/process-runtime";
 import { materializeWindowsSpawnProgram, resolveWindowsSpawnProgram } from "openclaw/plugin-sdk/windows-spawn";
 //#region extensions/codex/src/app-server/native-auth.ts

package/dist/.setup/{native-subagent-history-YXaL6dMd.mjs → native-subagent-history-0nYYgo0k.mjs}

@@ -1,11 +1,12 @@
-import { S as readCodexNativeSubagentHistoryOwner, p as sessionBindingIdentity, y as codexNativeSubagentHistoryConnectionFingerprint } from "./session-binding-record-TH3xA0zj.mjs";
-import { t as readCodexThreadHistoryPage } from "./thread-history-page-BTx-4xsg.mjs";
+import { C as readCodexNativeSubagentHistoryOwner, b as codexNativeSubagentHistoryConnectionFingerprint, m as sessionBindingIdentity } from "./session-binding-record-BGoz8wOK.mjs";
+import { t as readCodexThreadHistoryPage } from "./thread-history-page-DoVpnHim.mjs";
+import { l as itemStatus } from "./event-projector-items-C6L_5ZiT.mjs";
 import { r as readMirrorIdentity } from "./upstream-prompt-provenance-LphB8slG.mjs";
-import { r as projectCodexThreadHistoryItem } from "./transcript-history-projection-DHNBDhCU.mjs";
-import { n as buildCodexAppServerRuntimeFingerprint, t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-BOxKP7db.mjs";
-import { i as resolveCodexBindingAppServerConnection } from "./binding-connection-Bm38niE8.mjs";
-import { c as getLeasedSharedCodexAppServerClient, h as releaseLeasedSharedCodexAppServerClient } from "./shared-client-BpTtuLQ5.mjs";
-import { a as readCodexNativeSubagentRunId, f as itemToolArgs, h as itemTranscriptResultText } from "./native-subagent-task-ids-DsuOonKv.mjs";
+import { r as projectCodexThreadHistoryItem } from "./transcript-history-projection-ZZpkFkJ_.mjs";
+import { n as buildCodexAppServerRuntimeFingerprint, t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-B2CsSdnV.mjs";
+import { i as resolveCodexBindingAppServerConnection } from "./binding-connection-ThoatDcb.mjs";
+import { c as getLeasedSharedCodexAppServerClient, h as releaseLeasedSharedCodexAppServerClient } from "./shared-client-DA4VR4Eb.mjs";
+import { a as readCodexNativeSubagentRunId, f as itemToolArgs, g as projectCodexToolActivity, h as itemTranscriptResultText } from "./native-subagent-task-ids-wb8CKZGN.mjs";
 import { resolveAgentDir } from "openclaw/plugin-sdk/agent-runtime";
 import { getSessionEntry, resolveStorePath } from "openclaw/plugin-sdk/session-store-runtime";
 //#region extensions/codex/src/app-server/native-subagent-history.ts
@@ -115,16 +116,28 @@ async function readCodexNativeSubagentHistory(params, options) {
 			cursor: params.cursor,
 			limit: Math.max(1, Math.floor(Math.min(params.limit, 200) / 2))
 		}, {
-			project: (entries) => entries.map((entry) => projectCodexThreadHistoryItem(thread, entry, taskHistoryToolItems).map((message) => {
-				const messageIdentity = readMirrorIdentity(message);
-				if (!messageIdentity) throw new Error("Subagent history message is missing its native identity.");
-				return Object.assign(message, { messageId: JSON.stringify([threadId, messageIdentity]) });
-			})),
+			project: (entries) => entries.map((entry) => {
+				const item = projectCodexToolActivity(entry.item, itemStatus(entry.item) === "running" ? "start" : "result");
+				const messages = projectCodexThreadHistoryItem(thread, entry, taskHistoryToolItems).map((message) => {
+					const messageIdentity = readMirrorIdentity(message);
+					if (!messageIdentity) throw new Error("Subagent history message is missing its native identity.");
+					return Object.assign(message, { messageId: JSON.stringify([threadId, messageIdentity]) });
+				});
+				return {
+					messages,
+					activity: item ? messages.map(({ messageId }) => ({
+						messageId,
+						items: item.hideFromChannelProgress ? [] : [item]
+					})) : []
+				};
+			}),
 			fits: (result) => Buffer.byteLength(JSON.stringify(result), "utf8") <= 524288
 		});
 		assertCurrent();
+		const rows = page.items.toReversed();
 		return {
-			messages: page.items.toReversed().flat(),
+			messages: rows.flatMap((row) => row.messages),
+			activity: rows.flatMap((row) => row.activity),
 			...page.nextCursor ? { nextCursor: page.nextCursor } : {}
 		};
 	} finally {