@openclaw/codex 2026.9.5 → 2026.9.6

package/dist/.setup/node-exec-server.runtime-BDwWXVpK.mjs

@@ -0,0 +1,247 @@
+import { i as resolveManagedCodexNativeCommand, r as resolveManagedCodexAppServerStartOptions, t as isManagedCodexDesktopCommand } from "./managed-binary-BnshlFag.mjs";
+import { a as closeCodexAppServerTransportAndWait, t as createStdioTransport } from "./transport-stdio-h2VHOskC.mjs";
+import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { stripVTControlCharacters } from "node:util";
+import { killProcessTree } from "openclaw/plugin-sdk/process-runtime";
+import path from "node:path";
+import { mkdir } from "node:fs/promises";
+import { once } from "node:events";
+import { resolvePreferredOpenClawTmpDir, tempWorkspace } from "openclaw/plugin-sdk/temp-path";
+import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
+import { StringDecoder } from "node:string_decoder";
+import { sanitizeEnvVars } from "openclaw/plugin-sdk/sandbox";
+//#region extensions/codex/src/node-exec-server.runtime.ts
+const MAX_CODEX_EXEC_SERVER_MESSAGE_BYTES = 67108864;
+const MAX_CODEX_EXEC_SERVER_STDERR_BYTES = 4096;
+const CODEX_EXEC_SERVER_READY_LINE = "codex_exec_server::server::transport: codex-exec-server listening on stdio";
+const CODEX_EXEC_SERVER_TERMINATION_GRACE_MS = 1e3;
+const CODEX_EXEC_SERVER_REAP_TIMEOUT_MS = 5e3;
+const NODE_EXEC_SERVER_PLATFORM_ENVIRONMENT = /^(?:SYSTEMROOT|WINDIR|COMSPEC|PATHEXT|TEMP|TMP|TMPDIR)$/iu;
+function validateNodeExecServerMessage(message) {
+	if (message.byteLength === 0 || message.byteLength > MAX_CODEX_EXEC_SERVER_MESSAGE_BYTES) throw new Error("Codex exec-server JSON-RPC message exceeds its 64 MiB limit.");
+	const encoded = Buffer.from(message.buffer, message.byteOffset, message.byteLength);
+	if (encoded.includes(10) || encoded.includes(13)) throw new Error("Codex exec-server JSON-RPC frames must contain exactly one message.");
+	let decoded;
+	try {
+		const text = new TextDecoder("utf-8", { fatal: true }).decode(encoded);
+		decoded = JSON.parse(text);
+	} catch {
+		throw new Error("Codex exec-server received malformed UTF-8 or JSON-RPC.");
+	}
+	if (!isRecord(decoded) || decoded.jsonrpc !== void 0 && decoded.jsonrpc !== "2.0" || typeof decoded.method !== "string" && !("id" in decoded && ("result" in decoded || "error" in decoded))) throw new Error("Codex exec-server received an invalid JSON-RPC message.");
+	return encoded;
+}
+function nodeExecServerAbortError(signal) {
+	return signal.reason instanceof Error ? signal.reason : /* @__PURE__ */ new Error("Codex node exec-server connection closed.");
+}
+function writeNodeExecServerMessage(child, message, signal) {
+	if (signal.aborted) throw nodeExecServerAbortError(signal);
+	const payload = Buffer.concat([message, Buffer.from("\n")]);
+	if (!child.stdin.write(payload)) return once(child.stdin, "drain", { signal }).then(() => void 0);
+}
+async function relayNodeExecServerOutput(child, send) {
+	let fragments = [];
+	let pendingBytes = 0;
+	for await (const rawChunk of child.stdout) {
+		const chunk = Buffer.isBuffer(rawChunk) ? rawChunk : Buffer.from(rawChunk);
+		let offset = 0;
+		while (offset < chunk.byteLength) {
+			const newline = chunk.indexOf(10, offset);
+			const fragment = chunk.subarray(offset, newline === -1 ? chunk.byteLength : newline);
+			const nextLength = pendingBytes + fragment.byteLength;
+			if (nextLength > 67108865) throw new Error("Codex exec-server stdout message exceeds its 64 MiB limit.");
+			if (fragment.byteLength > 0) fragments.push(fragment);
+			pendingBytes = nextLength;
+			if (newline === -1) {
+				if (pendingBytes > MAX_CODEX_EXEC_SERVER_MESSAGE_BYTES && fragment[fragment.byteLength - 1] !== 13) throw new Error("Codex exec-server stdout message exceeds its 64 MiB limit.");
+				break;
+			}
+			const trailing = fragments.at(-1);
+			if (trailing?.[trailing.byteLength - 1] === 13) {
+				pendingBytes -= 1;
+				if (trailing.byteLength === 1) fragments.pop();
+				else fragments[fragments.length - 1] = trailing.subarray(0, trailing.byteLength - 1);
+			}
+			const message = validateNodeExecServerMessage(fragments.length === 1 ? fragments[0] : Buffer.concat(fragments, pendingBytes));
+			fragments = [];
+			pendingBytes = 0;
+			await send(message);
+			offset = newline + 1;
+		}
+	}
+	if (pendingBytes > 0) throw new Error("Codex exec-server stdout ended with an unterminated JSON-RPC message.");
+}
+function createNodeExecServerProcessOwner(child, closed, releaseResources, activeProcesses) {
+	let termination;
+	let hasClosed = false;
+	const settled = closed.then(async () => {
+		hasClosed = true;
+		await termination?.catch(() => {});
+		await releaseResources();
+		activeProcesses.delete(terminate);
+	});
+	settled.catch(() => {});
+	const terminate = async () => {
+		if (!hasClosed) await (termination ??= (async () => {
+			if (process.platform === "win32" && child.pid) killProcessTree(child.pid, { graceMs: CODEX_EXEC_SERVER_TERMINATION_GRACE_MS });
+			const { exited } = await closeCodexAppServerTransportAndWait(child, {
+				forceKillDelayMs: CODEX_EXEC_SERVER_TERMINATION_GRACE_MS,
+				exitTimeoutMs: CODEX_EXEC_SERVER_REAP_TIMEOUT_MS
+			});
+			if (!exited) throw new Error("Codex node exec-server process tree did not terminate.");
+		})());
+		await settled;
+	};
+	activeProcesses.add(terminate);
+	return terminate;
+}
+/** Runs the one-connection paired-node exec-server after lightweight command admission. */
+async function runCodexNodeExecServer(params) {
+	const { io, workspace } = params;
+	const frames = io.frames;
+	const cwd = workspace.workspaceDir;
+	let writes;
+	let output;
+	let temporaryHome;
+	let unsubscribe;
+	const releaseResources = async () => {
+		try {
+			await Promise.allSettled([output, writes]);
+			await temporaryHome?.cleanup();
+		} finally {
+			workspace.release();
+		}
+	};
+	let close = releaseResources;
+	let rejectDisconnected;
+	const disconnected = new Promise((_resolve, reject) => {
+		rejectDisconnected = reject;
+	});
+	disconnected.catch(() => {});
+	const onAbort = () => {
+		const error = nodeExecServerAbortError(io.signal);
+		rejectDisconnected(error);
+	};
+	io.signal.addEventListener("abort", onAbort, { once: true });
+	try {
+		if (!frames) throw new Error("Codex node exec-server requires duplex frames.");
+		if (io.signal.aborted) throw nodeExecServerAbortError(io.signal);
+		temporaryHome = await tempWorkspace({
+			rootDir: resolvePreferredOpenClawTmpDir(),
+			prefix: "codex-node-exec-server-"
+		});
+		const { dir } = temporaryHome;
+		const codexHome = path.join(dir, ".codex");
+		await mkdir(codexHome, {
+			recursive: true,
+			mode: 448
+		});
+		const resolved = await resolveManagedCodexAppServerStartOptions({
+			transport: "stdio",
+			command: "codex",
+			commandSource: "managed",
+			managedCommandOrder: "package-first",
+			args: [
+				"exec-server",
+				"--listen",
+				"stdio"
+			],
+			headers: {}
+		});
+		const native = resolveManagedCodexNativeCommand(resolved.command);
+		if (!native || isManagedCodexDesktopCommand(resolved.command)) throw new Error("Codex node exec-server requires the pinned managed package binary.");
+		const baseEnv = sanitizeEnvVars(process.env, {
+			strictMode: true,
+			customAllowedPatterns: [NODE_EXEC_SERVER_PLATFORM_ENVIRONMENT]
+		}).allowed;
+		if (io.signal.aborted) throw nodeExecServerAbortError(io.signal);
+		params.assertExecAuthorized();
+		const nativeReady = createDeferred();
+		const exit = createDeferred();
+		let stderr = Buffer.alloc(0);
+		let startupSettled = false;
+		let pendingLine = "";
+		const decoder = new StringDecoder("utf8");
+		const child = await createStdioTransport({
+			transport: "stdio",
+			command: native,
+			commandSource: "resolved-managed",
+			args: resolved.args,
+			headers: {},
+			cwd,
+			env: {
+				HOME: workspace.homeDir ?? dir,
+				CODEX_HOME: codexHome,
+				RUST_LOG: "error,opentelemetry_sdk=off,opentelemetry_otlp=off,codex_exec_server::server::transport=info",
+				...process.platform === "win32" ? { USERPROFILE: workspace.homeDir ?? dir } : {}
+			},
+			clearEnv: ["NODE_OPTIONS"]
+		}, baseEnv, () => {
+			if (io.signal.aborted) throw nodeExecServerAbortError(io.signal);
+			params.assertExecAuthorized();
+		}, (spawned) => {
+			spawned.once("close", (code, signal) => exit.resolve({
+				code,
+				signal
+			}));
+			close = createNodeExecServerProcessOwner(spawned, exit.promise, releaseResources, params.activeProcesses);
+			output = relayNodeExecServerOutput(spawned, frames.send.bind(frames));
+			output.catch((error) => {
+				rejectDisconnected(error instanceof Error ? error : new Error(String(error)));
+			});
+			spawned.once("error", rejectDisconnected);
+			spawned.stdin.on("error", rejectDisconnected);
+			spawned.stderr.on("data", (chunk) => {
+				const next = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+				stderr = Buffer.concat([stderr, next.subarray(-4096)]).subarray(-4096);
+				if (startupSettled) return;
+				const lines = (pendingLine + decoder.write(next)).split("\n");
+				pendingLine = lines.pop();
+				for (const line of [...lines, pendingLine]) if (Buffer.byteLength(line, "utf8") > MAX_CODEX_EXEC_SERVER_STDERR_BYTES) {
+					startupSettled = true;
+					pendingLine = "";
+					rejectDisconnected(/* @__PURE__ */ new Error("Codex node startup diagnostic line exceeded 4 KiB."));
+					return;
+				}
+				if (lines.some((line) => stripVTControlCharacters(line).trimEnd().endsWith(CODEX_EXEC_SERVER_READY_LINE))) {
+					startupSettled = true;
+					pendingLine = "";
+					nativeReady.resolve();
+				}
+			});
+		});
+		const stopped = exit.promise.then((outcome) => {
+			const diagnostic = stderr.toString("utf8").trim();
+			throw new Error(`Codex node exec-server exited (code ${outcome.code ?? "none"}, signal ${outcome.signal ?? "none"})${diagnostic ? `: ${diagnostic}` : "."}`);
+		});
+		await Promise.race([
+			nativeReady.promise,
+			stopped,
+			disconnected
+		]);
+		if (io.signal.aborted) throw nodeExecServerAbortError(io.signal);
+		if (child.exitCode !== null || child.signalCode !== null) await stopped;
+		params.assertExecAuthorized();
+		unsubscribe = frames.onMessage((message) => {
+			const encoded = validateNodeExecServerMessage(message);
+			const operation = writes ? writes.then(() => writeNodeExecServerMessage(child, encoded, io.signal)) : writeNodeExecServerMessage(child, encoded, io.signal);
+			if (!operation) return;
+			const observed = operation.catch(() => {});
+			writes = observed;
+			observed.then(() => {
+				if (writes === observed) writes = void 0;
+			});
+			return operation;
+		});
+		return await Promise.race([stopped, disconnected]);
+	} finally {
+		io.signal.removeEventListener("abort", onAbort);
+		try {
+			unsubscribe?.();
+		} finally {
+			await close();
+		}
+	}
+}
+//#endregion
+export { runCodexNodeExecServer };

package/dist/.setup/{plan-xD7WKYTM.mjs → plan-CN3VwfNU.mjs}

@@ -1,6 +1,6 @@
-import { c as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-DUle8DLz.mjs";
-import "./config-CedDWjM-.mjs";
-import { c as resolveHomePath, i as hasCodexSource, l as sanitizeName, n as defaultCodexHome, o as exists, r as discoverCodexSource, s as readJsonObject, t as codexPluginMigrationSubscriptionWarning } from "./source-Bjp4UQij.mjs";
+import { c as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-BoRei8Z4.mjs";
+import "./config-BoTP_mrL.mjs";
+import { c as sanitizeName, i as hasCodexSource, n as defaultCodexHome, o as exists, r as discoverCodexSource, s as readJsonObject, t as codexPluginMigrationSubscriptionWarning } from "./source-CUzJq5WN.mjs";
 import { asBoolean, asOptionalRecord, isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash } from "node:crypto";
 import { runCommandBuffered } from "openclaw/plugin-sdk/process-runtime";
@@ -9,10 +9,11 @@ import fs from "node:fs/promises";
 import { canonicalPathFromExistingAncestor, isPathInside } from "openclaw/plugin-sdk/file-access-runtime";
 import { readSecretFile } from "openclaw/plugin-sdk/secret-file";
 import { fileURLToPath } from "node:url";
-import { loadAuthProfileStoreWithoutExternalProfiles, resolveAgentConfig, resolveAgentWorkspaceDir, resolveDefaultAgentId } from "openclaw/plugin-sdk/agent-runtime";
+import { loadAuthProfileStoreWithoutExternalProfiles } from "openclaw/plugin-sdk/agent-runtime";
 import { applyAuthProfileConfig, buildApiKeyCredential, buildOauthProviderAuthResult, buildOpenAICodexCredentialExtra, hasUsableOAuthCredential, resolveOpenAICodexAuthIdentity, resolveOpenAICodexImportProfileName, updateAuthProfileStoreWithLock } from "openclaw/plugin-sdk/provider-auth";
 import { extractErrorCode } from "openclaw/plugin-sdk/security-runtime";
 import { MIGRATION_REASON_TARGET_EXISTS, createMigrationItem, createMigrationManualItem, hasMigrationConfigPatchConflict, markMigrationItemConflict, markMigrationItemError, markMigrationItemSkipped, mergeMigrationConfigValue, readMigrationConfigPath, resolveMigrationConfigRuntime, summarizeMigrationItems } from "openclaw/plugin-sdk/migration";
+import { resolvePlannedMigrationTargets } from "openclaw/plugin-sdk/migration-runtime";
 import { decodeOpenAICodexJwtPayload } from "openclaw/plugin-sdk/provider-oauth-runtime";
 //#region extensions/codex/src/migration/auth-profile-target.ts
 const OPENAI_PROVIDER_ID$1 = "openai";
@@ -91,15 +92,16 @@ async function readDirectKeyring(home, signal) {
 		return;
 	}
 }
-async function readSelectedCredentialStorage(options, requireApiKey) {
+async function readCodexCliCredentialsAsync(options) {
 	options.signal?.throwIfAborted();
+	if (!options.allowKeychainPrompt) return;
 	const home = await fs.realpath(options.codexHome).catch(() => path.resolve(options.codexHome));
-	const { CodexAppServerClient } = await import("./client-vXs2929Q.mjs").then((n) => n.n);
-	const { resolveManagedCodexPackageEntrypoint, resolveManagedCodexNativeCommand } = await import("./managed-binary-DP6Rib3P.mjs").then((n) => n.n);
+	const { CodexAppServerClient } = await import("./client-Cs08OXVQ.mjs").then((n) => n.n);
+	const { resolveManagedCodexPackageEntrypoint, resolveManagedCodexNativeCommand } = await import("./managed-binary-BnshlFag.mjs").then((n) => n.n);
 	const launcher = resolveManagedCodexPackageEntrypoint(path.dirname(fileURLToPath(import.meta.url)));
 	const command = launcher ? resolveManagedCodexNativeCommand(launcher) : void 0;
 	if (!command) return;
-	const signal = AbortSignal.any([AbortSignal.timeout(options.allowKeychainPrompt && process.platform === "darwin" ? 6e4 : 5e3), ...options.signal ? [options.signal] : []]);
+	const signal = AbortSignal.any([AbortSignal.timeout(process.platform === "darwin" ? 6e4 : 5e3), ...options.signal ? [options.signal] : []]);
 	const client = await CodexAppServerClient.start({
 		transport: "stdio",
 		command,
@@ -121,7 +123,7 @@ async function readSelectedCredentialStorage(options, requireApiKey) {
 	signal.addEventListener("abort", abort, { once: true });
 	let credential;
 	try {
-		credential = await readNativeCredential(client, home, requireApiKey, options, signal);
+		credential = await readNativeCredential(client, home, options, signal);
 	} catch {}
 	signal.removeEventListener("abort", abort);
 	const closed = await client.closeAndWait({
@@ -132,15 +134,11 @@ async function readSelectedCredentialStorage(options, requireApiKey) {
 	options.signal?.throwIfAborted();
 	return credential;
 }
-async function readNativeCredential(client, home, requireApiKey, options, signal) {
+async function readNativeCredential(client, home, options, signal) {
 	signal.throwIfAborted();
 	await client.initialize();
 	if (client.getRuntimeIdentity()?.codexHome !== home) return;
 	const revision = client.getModelCatalogRevision();
-	if (requireApiKey) {
-		const account = await client.request("account/read", { refreshToken: false }, { signal });
-		if (asOptionalRecord(account.account)?.type !== "apiKey" || account.requiresOpenaiAuth !== true) return;
-	}
 	const configured = await client.request("config/read", {
 		includeLayers: false,
 		cwd: home
@@ -148,7 +146,7 @@ async function readNativeCredential(client, home, requireApiKey, options, signal
 	const mode = (await client.request("configRequirements/read", {}, { signal })).requirements?.cli_auth_credentials_store ?? configured.config.cli_auth_credentials_store ?? "file";
 	let record;
 	if (mode === "file") record = await readAuthFile(home);
-	else if ((mode === "keyring" || mode === "auto") && process.platform === "darwin" && options.allowKeychainPrompt) {
+	else if ((mode === "keyring" || mode === "auto") && process.platform === "darwin") {
 		let cursor;
 		let encrypted;
 		do {
@@ -167,7 +165,18 @@ async function readNativeCredential(client, home, requireApiKey, options, signal
 		record = await readDirectKeyring(home, signal);
 	}
 	signal.throwIfAborted();
-	return !client.getCloseError() && client.getModelCatalogRevision() === revision ? record : void 0;
+	if (!record) return;
+	const oauth = options.credentialKind === "api_key" ? void 0 : parseOAuthCredential(record);
+	let apiKey = options.credentialKind === "oauth" ? void 0 : parseApiKeyCredential(record);
+	if (apiKey) {
+		const account = await client.request("account/read", { refreshToken: false }, { signal }).catch(() => void 0);
+		if (account?.account?.type !== "apiKey" || !account.requiresOpenaiAuth) apiKey = void 0;
+	}
+	signal.throwIfAborted();
+	return !client.getCloseError() && client.getModelCatalogRevision() === revision ? {
+		...oauth ? { oauth } : {},
+		...apiKey ? { apiKey } : {}
+	} : void 0;
 }
 function jwtExpiry(token) {
 	try {
@@ -177,10 +186,9 @@ function jwtExpiry(token) {
 		return;
 	}
 }
-async function readCodexCliCredentialsAsync(options) {
-	const data = await readSelectedCredentialStorage(options, false);
-	const mode = typeof data?.auth_mode === "string" ? data.auth_mode.toLowerCase() : void 0;
-	if (!data || mode !== void 0 && mode !== "chatgpt" && mode !== "chatgptauthtokens") return;
+function parseOAuthCredential(data) {
+	const mode = typeof data.auth_mode === "string" ? data.auth_mode.toLowerCase() : void 0;
+	if (mode !== void 0 && mode !== "chatgpt" && mode !== "chatgptauthtokens") return;
 	const tokens = asOptionalRecord(data.tokens);
 	if (typeof tokens?.access_token !== "string" || !tokens.access_token || typeof tokens.refresh_token !== "string" || !tokens.refresh_token) return;
 	const lastRefresh = typeof data.last_refresh === "string" ? Date.parse(data.last_refresh) : NaN;
@@ -194,10 +202,9 @@ async function readCodexCliCredentialsAsync(options) {
 		...typeof tokens.id_token === "string" ? { idToken: tokens.id_token } : {}
 	};
 }
-async function readCodexCliActiveApiKeyAsync(options) {
-	const data = await readSelectedCredentialStorage(options, true);
-	const mode = typeof data?.auth_mode === "string" ? data.auth_mode.toLowerCase() : void 0;
-	if (!data || mode !== void 0 && mode !== "apikey" && mode !== "api_key") return;
+function parseApiKeyCredential(data) {
+	const mode = typeof data.auth_mode === "string" ? data.auth_mode.toLowerCase() : void 0;
+	if (mode !== void 0 && mode !== "apikey" && mode !== "api_key") return;
 	const key = typeof data.OPENAI_API_KEY === "string" ? data.OPENAI_API_KEY.trim() : "";
 	return key ? {
 		type: "api_key",
@@ -245,13 +252,7 @@ async function readModelRefs(source) {
 	refs.add(OPENAI_CODEX_DEFAULT_MODEL);
 	return [...refs].toSorted();
 }
-async function buildCodexOAuthCredential(source, includeConfigPatch, options) {
-	const credential = await readCodexCliCredentialsAsync({
-		codexHome: source.codexHome,
-		allowKeychainPrompt: options.allowKeychainPrompt,
-		...options.signal ? { signal: options.signal } : {}
-	});
-	if (!credential) return null;
+async function buildCodexOAuthCredential(source, credential, includeConfigPatch) {
 	const identity = resolveOpenAICodexAuthIdentity({
 		access: credential.access,
 		accountId: credential.accountId
@@ -281,25 +282,19 @@ async function buildCodexOAuthCredential(source, includeConfigPatch, options) {
 		result
 	} : null;
 }
-async function buildCodexApiKeyCredential(source, allowKeychainPrompt, signal) {
-	const credential = await readCodexCliActiveApiKeyAsync({
+async function readCodexAuthCredentials(source, options) {
+	const credentials = await readCodexCliCredentialsAsync({
 		codexHome: source.codexHome,
-		allowKeychainPrompt,
-		...signal ? { signal } : {}
+		credentialKind: options.credentialKind,
+		allowKeychainPrompt: options.allowKeychainPrompt,
+		...options.signal ? { signal: options.signal } : {}
 	});
-	if (!credential) return null;
-	return {
+	return [credentials?.oauth ? await buildCodexOAuthCredential(source, credentials.oauth, options.includeConfigPatch) : null, credentials?.apiKey ? {
 		kind: "api_key",
 		provider: OPENAI_PROVIDER_ID,
 		profileId: "openai:codex-import",
-		key: credential.key
-	};
-}
-async function readCodexAuthCredentials(source, options) {
-	return [options.credentialKind === "api_key" ? null : await buildCodexOAuthCredential(source, options.includeConfigPatch, {
-		allowKeychainPrompt: options.allowKeychainPrompt,
-		...options.signal ? { signal: options.signal } : {}
-	}), options.credentialKind === "oauth" ? null : await buildCodexApiKeyCredential(source, options.allowKeychainPrompt, options.signal)].filter((entry) => entry !== null);
+		key: credentials.apiKey.key
+	} : null].filter((entry) => entry !== null);
 }
 function replaceConfigDraft(draft, next) {
 	for (const key of Object.keys(draft)) delete draft[key];
@@ -366,7 +361,8 @@ function resolveCodexConfigPatchMode(ctx) {
 	return mode === "none" || mode === "return" ? mode : "apply";
 }
 function allowCodexKeychainPrompt(ctx) {
-	return ctx.providerOptions?.allowKeychainPrompt === true;
+	const explicit = ctx.providerOptions?.allowKeychainPrompt;
+	return typeof explicit === "boolean" ? explicit : ctx.includeSecrets === true;
 }
 function resolveRequestedCredentialKind(ctx) {
 	const kind = ctx.providerOptions?.credentialKind;
@@ -417,31 +413,31 @@ function applyCredentialConfig(config, credential, profileId) {
 }
 async function buildCodexAuthItems(params) {
 	const configPatchMode = resolveCodexConfigPatchMode(params.ctx);
+	const allowKeychainPrompt = allowCodexKeychainPrompt(params.ctx);
 	const credentials = await readCodexAuthCredentials(params.source, {
 		credentialKind: resolveRequestedCredentialKind(params.ctx),
 		includeConfigPatch: configPatchMode !== "none",
-		allowKeychainPrompt: allowCodexKeychainPrompt(params.ctx),
+		allowKeychainPrompt,
 		signal: params.ctx.signal
 	});
 	if (credentials.length === 0) {
 		const requestedKind = resolveRequestedCredentialKind(params.ctx);
-		if (!requestedKind) return [];
-		const credentialKind = requestedKind;
-		return [createMigrationItem({
-			id: credentialKind === "oauth" ? OPENAI_OAUTH_ITEM_ID : OPENAI_API_KEY_ITEM_ID,
+		if (!requestedKind && allowKeychainPrompt) return [];
+		return (requestedKind ? [requestedKind] : ["oauth", "api_key"]).map((credentialKind) => createMigrationItem({
+			id: credentialKind === "api_key" ? OPENAI_API_KEY_ITEM_ID : OPENAI_OAUTH_ITEM_ID,
 			kind: "auth",
 			action: "skip",
 			source: params.source.codexHome,
 			status: "skipped",
 			sensitive: true,
-			reason: CODEX_REASON_AUTH_STORAGE_NOT_IMPORTABLE,
-			message: "No supported Codex credential could be imported. Continue with sign-in to connect OpenClaw.",
+			reason: allowKeychainPrompt ? CODEX_REASON_AUTH_STORAGE_NOT_IMPORTABLE : void 0,
+			message: allowKeychainPrompt ? "No supported Codex credential could be imported. Continue with sign-in to connect OpenClaw." : "Codex credentials have not been inspected. Confirm credential import to check the current Codex sign-in.",
 			details: {
 				provider: OPENAI_PROVIDER_ID,
 				credentialKind,
 				credentialImportUnavailable: true
 			}
-		})];
+		}));
 	}
 	const store = loadAuthProfileStoreWithoutExternalProfiles(params.targets.agentDir);
 	const skipped = !params.ctx.includeSecrets;
@@ -475,7 +471,24 @@ async function buildCodexAuthItems(params) {
 		});
 	});
 }
-async function applyCodexAuthItems(params) {
+function createCodexAuthItemApplier(params) {
+	const { items, ...context } = params;
+	const selectedKinds = new Set(items.filter((item) => item.kind === "auth" && item.status === "planned").map((item) => item.details?.credentialKind));
+	const selectedKind = selectedKinds.size === 1 ? selectedKinds.values().next().value : void 0;
+	let snapshot;
+	const readCredentials = () => snapshot ??= readCodexAuthCredentials(context.source, {
+		credentialKind: selectedKind === "oauth" || selectedKind === "api_key" ? selectedKind : void 0,
+		includeConfigPatch: resolveCodexConfigPatchMode(context.ctx) !== "none",
+		allowKeychainPrompt: allowCodexKeychainPrompt(context.ctx),
+		signal: context.ctx.signal
+	});
+	return (item) => applyCodexAuthItem({
+		...context,
+		item,
+		readCredentials
+	});
+}
+async function applyCodexAuthItem(params) {
 	const { ctx, item, source, targets } = params;
 	if (item.status !== "planned") return [item];
 	const profileId = typeof item.details?.profileId === "string" ? item.details.profileId : "";
@@ -484,12 +497,10 @@ async function applyCodexAuthItems(params) {
 	const credentialKind = item.details?.credentialKind;
 	if (!profileId || !provider || credentialKind !== "oauth" && credentialKind !== "api_key") return [markMigrationItemError(item, CODEX_REASON_MISSING_AUTH_METADATA)];
 	const configPatchMode = resolveCodexConfigPatchMode(ctx);
-	const credential = (await readCodexAuthCredentials(source, {
-		credentialKind,
-		includeConfigPatch: configPatchMode !== "none",
-		allowKeychainPrompt: allowCodexKeychainPrompt(ctx),
-		signal: ctx.signal
-	})).find((candidate) => candidate.provider === provider && candidate.kind === credentialKind && (!sourceProfileId || candidate.profileId === sourceProfileId));
+	ctx.signal?.throwIfAborted();
+	const credentials = await params.readCredentials();
+	ctx.signal?.throwIfAborted();
+	const credential = credentials.find((candidate) => candidate.provider === provider && candidate.kind === credentialKind && (!sourceProfileId || candidate.profileId === sourceProfileId));
 	if (!credential) return [markMigrationItemSkipped(item, CODEX_REASON_AUTH_NO_LONGER_PRESENT)];
 	if (item.details?.sourceCredentialFingerprint !== sourceCredentialFingerprint(credential)) return [markMigrationItemSkipped(item, CODEX_REASON_AUTH_NO_LONGER_PRESENT)];
 	if (item.details?.legacyNativeHome !== void 0 && (item.details.legacyNativeHome !== source.codexHome || source.codexHome !== defaultCodexHome())) return [markMigrationItemSkipped(item, CODEX_REASON_AUTH_NO_LONGER_PRESENT)];
@@ -580,18 +591,6 @@ function buildCodexAuthConfigPatchItems(ctx, item, credential, profileId) {
 	return items;
 }
 //#endregion
-//#region extensions/codex/src/migration/targets.ts
-function resolveCodexMigrationTargets(ctx) {
-	const cfg = ctx.config;
-	const agentId = ctx.targetAgentId ?? resolveDefaultAgentId(cfg);
-	const workspaceDir = resolveAgentWorkspaceDir(cfg, agentId);
-	const configuredAgentDir = resolveAgentConfig(cfg, agentId)?.agentDir?.trim();
-	return {
-		workspaceDir,
-		agentDir: ctx.runtime?.agent?.resolveAgentDir(cfg, agentId) ?? (configuredAgentDir ? resolveHomePath(configuredAgentDir) : void 0) ?? path.join(ctx.stateDir, "agents", agentId, "agent")
-	};
-}
-//#endregion
 //#region extensions/codex/src/migration/plan.ts
 const CODEX_PLUGIN_CONFIG_ITEM_ID = "config:codex-plugins";
 const CODEX_PLUGIN_CONFIG_PATH = [
@@ -896,7 +895,7 @@ function buildPluginConfigItem(ctx, pluginItems) {
 	});
 }
 async function buildCodexMigrationPlan(ctx) {
-	const targets = resolveCodexMigrationTargets(ctx);
+	const targets = resolvePlannedMigrationTargets(ctx);
 	const memoryOnly = ctx.itemKinds !== void 0 && ctx.itemKinds.length > 0 && ctx.itemKinds.every((kind) => kind === "memory");
 	const authOnly = ctx.itemKinds !== void 0 && ctx.itemKinds.length > 0 && ctx.itemKinds.every((kind) => kind === "auth");
 	const source = await discoverCodexSource({
@@ -938,7 +937,6 @@ async function buildCodexMigrationPlan(ctx) {
 		}));
 	}
 	const warnings = [
-		...!ctx.includeSecrets && items.some((item) => item.kind === "auth") ? ["Auth credentials were detected but skipped. Re-run interactively or pass --include-secrets to import supported credentials."] : [],
 		...items.some((item) => item.status === "conflict") ? ["Conflicts were found. Re-run with --overwrite to replace conflicting migration targets after item-level backups."] : [],
 		...source.pluginDiscoveryError ? [`Codex app-server plugin inventory discovery failed: ${source.pluginDiscoveryError}. Cached plugin bundles, if any, are advisory only.`] : [],
 		...source.plugins.some((plugin) => plugin.migrationBlock?.code === "codex_subscription_required") ? [codexPluginMigrationSubscriptionWarning()] : []
@@ -960,4 +958,4 @@ async function buildCodexMigrationPlan(ctx) {
 	};
 }
 //#endregion
-export { CODEX_PLUGIN_CONFIG_ITEM_ID, CODEX_PLUGIN_CONFIG_PATH, buildCodexMigrationPlan, buildCodexPluginsConfigValue, hasCodexPluginConfigConflict, applyCodexAuthItems as n, resolveCodexConfigPatchMode as r, readCodexPluginMigrationConfigEntry, resolveCodexMigrationTargets as t };
+export { CODEX_PLUGIN_CONFIG_ITEM_ID, CODEX_PLUGIN_CONFIG_PATH, buildCodexMigrationPlan, buildCodexPluginsConfigValue, hasCodexPluginConfigConflict, resolveCodexConfigPatchMode as n, readCodexPluginMigrationConfigEntry, createCodexAuthItemApplier as t };

package/dist/.setup/{plugin-activation-r8nq5Jzp.mjs → plugin-activation-DT3MNtqj.mjs}

@@ -1,6 +1,6 @@
-import { c as CODEX_PLUGINS_MARKETPLACE_NAME, i as pluginReadParams, n as isOpenAiCuratedMarketplace, r as isOpenAiCuratedMarketplaceName, t as findCodexMarketplacePluginSummary } from "./plugin-inventory-DUle8DLz.mjs";
-import { i as CodexAppServerRpcError } from "./timeout-DZF05XrR.mjs";
-import "./config-CedDWjM-.mjs";
+import { c as CODEX_PLUGINS_MARKETPLACE_NAME, i as pluginReadParams, n as isOpenAiCuratedMarketplace, r as isOpenAiCuratedMarketplaceName, t as findCodexMarketplacePluginSummary } from "./plugin-inventory-BoRei8Z4.mjs";
+import { o as CodexAppServerRpcError } from "./timeout-C910MdAB.mjs";
+import "./config-BoTP_mrL.mjs";
 import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 //#region extensions/codex/src/app-server/plugin-activation.ts
 /**
@@ -45,7 +45,6 @@ async function ensureCodexPluginActivation(params) {
 			diagnostics: [{ message: `Codex plugin install failed: ${coerceErrorMessage(error)}` }]
 		};
 	}
-	if (params.metadataCache && params.appCacheKey) params.metadataCache.invalidate(params.appCacheKey);
 	const refreshDiagnostics = [];
 	let refreshFailed = false;
 	try {
@@ -53,6 +52,7 @@ async function ensureCodexPluginActivation(params) {
 			request: params.request,
 			appCache: params.appCache,
 			appCacheKey: params.appCacheKey,
+			appInventoryCacheKey: params.appInventoryCacheKey,
 			configCwd: params.configCwd,
 			metadataCache: params.metadataCache,
 			deferAppInventoryRefresh: params.deferAppInventoryRefresh,
@@ -74,25 +74,16 @@ async function ensureCodexPluginActivation(params) {
 		diagnostics: [...refreshDiagnostics, ...installResponse.appsNeedingAuth.map((app) => ({ message: `${app.name} requires app authentication before plugin tools are exposed.` }))]
 	};
 }
-/** Forces Codex plugin, skill, hook, MCP, and app inventory refreshes after activation. */
+/** Refreshes OpenClaw inventories after Codex installs a plugin. */
 async function refreshCodexPluginRuntimeState(params) {
 	const diagnostics = [];
+	if (params.appCacheKey) params.metadataCache?.invalidate(params.appCacheKey);
 	await listCuratedCodexPluginMetadata(params, { forceRefetch: true });
-	await params.request("skills/list", {
-		cwds: params.configCwd ? [params.configCwd] : [],
-		forceReload: true
-	});
-	try {
-		await params.request("hooks/list", { cwds: params.configCwd ? [params.configCwd] : [] });
-	} catch (error) {
-		diagnostics.push({ message: `Codex hooks refresh skipped: ${coerceErrorMessage(error)}` });
-	}
-	await params.request("config/mcpServer/reload", void 0);
 	if (params.appCache && params.appCacheKey) try {
 		await refreshCodexAppRuntimeState({
 			...params,
 			appCache: params.appCache,
-			appCacheKey: params.appCacheKey
+			appCacheKey: params.appInventoryCacheKey ?? params.appCacheKey
 		});
 	} catch (error) {
 		diagnostics.push({ message: `Codex app inventory refresh skipped: ${coerceErrorMessage(error)}` });

package/dist/.setup/{plugin-app-cache-key-BOxKP7db.mjs → plugin-app-cache-key-B2CsSdnV.mjs}

@@ -1,4 +1,4 @@
-import { _ as resolveCodexAppServerUserHomeDir, g as resolveCodexAppServerLocalHomeDir, h as resolveCodexAppServerHomeDir } from "./config-security-BRQ2mgW9.mjs";
+import { d as resolveCodexAppServerHomeDir, f as resolveCodexAppServerLocalHomeDir, p as resolveCodexAppServerUserHomeDir } from "./config-security-BEReZ6go.mjs";
 import { createRequire } from "node:module";
 import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash } from "node:crypto";
@@ -287,23 +287,7 @@ async function readInstalledApps(request, options) {
 	return {
 		apps: apps.flatMap((installedApp) => {
 			const metadata = metadataById.get(installedApp.id);
-			if (!metadata) return [];
-			return [{
-				id: installedApp.id,
-				name: metadata.name,
-				description: metadata.description ?? null,
-				logoUrl: metadata.iconUrl ?? null,
-				logoUrlDark: metadata.iconUrlDark ?? null,
-				distributionChannel: metadata.distributionChannel ?? null,
-				branding: null,
-				appMetadata: null,
-				labels: null,
-				installUrl: metadata.installUrl ?? null,
-				isAccessible: true,
-				isEnabled: installedApp.enabled,
-				pluginDisplayNames: metadata.pluginDisplayNames,
-				...metadata.toolSummaries ? { toolSummaries: metadata.toolSummaries } : {}
-			}];
+			return metadata ? [metadata] : [];
 		}),
 		installedApps: apps
 	};
@@ -388,7 +372,7 @@ function buildCodexAppServerConnectionFingerprint(appServer, agentDir) {
 	});
 }
 function resolveCodexAppServerConnectionHome(start, agentDir) {
-	const configured = start.env?.CODEX_HOME?.trim();
+	const configured = start.codexHome ?? start.env?.CODEX_HOME?.trim();
 	if (configured) return configured;
 	if (start.transport === "unix" && (!start.url || start.url === "unix://")) return resolveCodexAppServerUserHomeDir(start.env ?? process.env);
 	if (start.transport !== "stdio") return null;
@@ -407,7 +391,7 @@ function resolveCodexPluginAppCacheEndpoint(appServer) {
 }
 /** Resolves the CODEX_HOME value that scopes local app-server inventory. */
 function resolveCodexPluginAppCacheCodexHome(appServer, agentDir) {
-	const configuredCodexHome = appServer.start.env?.CODEX_HOME?.trim();
+	const configuredCodexHome = appServer.start.codexHome ?? appServer.start.env?.CODEX_HOME?.trim();
 	if (configuredCodexHome) return configuredCodexHome;
 	return appServer.start.transport === "stdio" && agentDir ? resolveCodexAppServerHomeDir(agentDir) : void 0;
 }