@openclaw/codex 2026.9.5 → 2026.9.7

package/dist/.setup/{config-security-BRQ2mgW9.mjs → config-security-CE-FcGw9.mjs}

@@ -1,12 +1,10 @@
-import { u as readNonEmptyString } from "./config-utils-DujwEnhg.mjs";
-import { t as DEFAULT_CODEX_APP_SERVER_NETWORK_PROXY_PROFILE_PREFIX } from "./config-parsing-CcB9iPoq.mjs";
-import { r as normalizeCodexAppServerArgs } from "./launch-args-DnMak49W.mjs";
-import { isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { l as readRecord, s as readNonEmptyString } from "./config-utils-D0CXecki.mjs";
+import { t as DEFAULT_CODEX_APP_SERVER_NETWORK_PROXY_PROFILE_PREFIX } from "./config-parsing-b088LyhT.mjs";
 import { createHash } from "node:crypto";
 import { AgentHarnessPreflightError } from "openclaw/plugin-sdk/agent-harness-registration";
+import { parse } from "smol-toml";
 import { readFileSync } from "node:fs";
-import path from "node:path";
-import { homedir, hostname } from "node:os";
+import { hostname } from "node:os";
 import { isLoopbackHost } from "openclaw/plugin-sdk/request-url";
 //#region extensions/codex/src/app-server/config-exec-policy.ts
 function selectForcedPromptingSandbox(params) {
@@ -68,129 +66,43 @@ function resolveCodexRequirementsPath(env, platform) {
 	return UNIX_CODEX_REQUIREMENTS_PATH;
 }
 function parseAllowedSandboxModesFromCodexRequirements(content, hostName) {
-	const remoteSandboxModes = parseMatchingRemoteSandboxModesFromCodexRequirements(content, hostName);
+	const requirements = parseCodexRequirements(content);
+	const remoteSandboxModes = parseMatchingRemoteSandboxModesFromCodexRequirements(requirements, hostName);
 	if (remoteSandboxModes !== void 0) return remoteSandboxModes;
-	return parseRequirementsSandboxModes(parseTopLevelRequirementsStringArray(content, "allowed_sandbox_modes"));
+	return parseRequirementsValues(requirements?.allowed_sandbox_modes, normalizeRequirementsSandboxMode);
 }
 function parseAllowedApprovalPoliciesFromCodexRequirements(content) {
-	const values = parseTopLevelRequirementsStringArray(content, "allowed_approval_policies");
-	if (values === void 0) return;
-	const normalizedPolicies = values.map((entry) => normalizeRequirementsApprovalPolicy(entry)).filter((entry) => entry !== void 0);
-	return normalizedPolicies.length > 0 ? new Set(normalizedPolicies) : void 0;
+	return parseRequirementsValues(parseCodexRequirements(content)?.allowed_approval_policies, normalizeRequirementsApprovalPolicy);
 }
 function parseAllowedApprovalsReviewersFromCodexRequirements(content) {
-	const values = parseTopLevelRequirementsStringArray(content, "allowed_approvals_reviewers");
-	if (values === void 0) return;
-	const normalizedReviewers = values.map((entry) => normalizeRequirementsApprovalsReviewer(entry)).filter((entry) => entry !== void 0);
-	return normalizedReviewers.length > 0 ? new Set(normalizedReviewers) : void 0;
+	return parseRequirementsValues(parseCodexRequirements(content)?.allowed_approvals_reviewers, (value) => resolveApprovalsReviewer(value.trim().toLowerCase()));
 }
-function parseMatchingRemoteSandboxModesFromCodexRequirements(content, hostName) {
+function parseMatchingRemoteSandboxModesFromCodexRequirements(requirements, hostName) {
 	const normalizedHostName = normalizeRequirementsHostName(hostName);
-	if (normalizedHostName === void 0) return;
-	for (const section of parseTomlArrayTableSections(content, "remote_sandbox_config")) {
-		const patterns = parseRequirementsStringArray(section, "hostname_patterns");
+	const remoteConfigs = requirements?.remote_sandbox_config;
+	if (normalizedHostName === void 0 || !Array.isArray(remoteConfigs)) return;
+	for (const section of remoteConfigs) {
+		const config = readRecord(section);
+		const patterns = readRequirementsStringArray(config?.hostname_patterns);
 		if (!patterns || !requirementsHostNameMatchesAnyPattern(normalizedHostName, patterns)) continue;
-		return parseRequirementsSandboxModes(parseRequirementsStringArray(section, "allowed_sandbox_modes"));
+		return parseRequirementsValues(config?.allowed_sandbox_modes, normalizeRequirementsSandboxMode);
 	}
 }
-function parseRequirementsSandboxModes(values) {
+function parseRequirementsValues(value, normalize) {
+	const values = readRequirementsStringArray(value);
 	if (values === void 0) return;
-	const normalizedModes = values.map((entry) => normalizeRequirementsSandboxMode(entry)).filter((entry) => entry !== void 0);
-	return normalizedModes.length > 0 ? new Set(normalizedModes) : void 0;
-}
-function parseTopLevelRequirementsStringArray(content, key) {
-	return parseRequirementsStringArray(stripTomlLineComments(content).slice(0, firstTomlTableOffset(content)), key);
-}
-function parseTomlStringValue(content, key) {
-	return parseTomlStringAssignmentValue(content, tomlDottedKeyPattern(key));
-}
-function parseInlineOpenAIModelProviderBaseUrl(content) {
-	return parseTomlStringAssignmentValue(content, `${tomlKeyPattern("model_providers")}\\s*=\\s*\\{[\\s\\S]*?${tomlKeyPattern("openai")}\\s*=\\s*\\{[\\s\\S]*?${tomlKeyPattern("base_url")}`);
-}
-function parseTomlStringAssignmentValue(content, keyPattern) {
-	const assignment = content.match(new RegExp(`(?:^|\\n)\\s*${keyPattern}\\s*=\\s*([^\\r\\n]*)`));
-	if (!assignment) return;
-	const rawValue = assignment[1]?.trimStart() ?? "";
-	if (rawValue.startsWith("\"\"\"") || rawValue.startsWith("'''")) return false;
-	const match = parseTomlStringAssignment(content, keyPattern);
-	return match ? match[1] ?? match[2] ?? "" : false;
-}
-function parseTomlStringAssignment(content, keyPattern) {
-	return content.match(new RegExp(`(?:^|\\n)\\s*${keyPattern}\\s*=\\s*(?:"([^"\\\\]*(?:\\\\.[^"\\\\]*)*)"|'([^']*)')`));
-}
-function tomlDottedKeyPattern(key) {
-	return key.split(".").map(tomlKeyPattern).join("\\s*\\.\\s*");
-}
-function tomlKeyPattern(key) {
-	const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-	return `(?:"${escaped}"|'${escaped}'|${escaped})`;
-}
-function parseRequirementsStringArray(content, key) {
-	const match = content.match(new RegExp(`(?:^|\\n)\\s*${key}\\s*=\\s*\\[([\\s\\S]*?)\\]`));
-	if (!match) return;
-	const arrayBody = match[1] ?? "";
-	const stringMatches = [...arrayBody.matchAll(/"([^"\\]*(?:\\.[^"\\]*)*)"|'([^']*)'/g)];
-	if (stringMatches.length === 0 && arrayBody.trim().length > 0) return;
-	return stringMatches.map((entry) => entry[1] ?? entry[2] ?? "");
-}
-function parseTomlTableSection(content, table) {
-	const strippedContent = stripTomlLineComments(content);
-	const tablePattern = tomlDottedKeyPattern(table);
-	const match = new RegExp(`^\\s*\\[\\s*${tablePattern}\\s*\\]\\s*$`, "m").exec(strippedContent);
-	if (!match) return;
-	const sectionStart = match.index + match[0].length;
-	const rest = strippedContent.slice(sectionStart);
-	const nextTableOffset = rest.search(/^\s*\[/m);
-	return nextTableOffset === -1 ? rest : rest.slice(0, nextTableOffset);
-}
-function parseTomlArrayTableSections(content, table) {
-	const strippedContent = stripTomlLineComments(content);
-	const escapedTable = table.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-	const headerPattern = new RegExp(`^\\s*\\[\\[\\s*${escapedTable}\\s*\\]\\]\\s*$`, "gm");
-	const sections = [];
-	for (let match = headerPattern.exec(strippedContent); match; match = headerPattern.exec(strippedContent)) {
-		const sectionStart = headerPattern.lastIndex;
-		const rest = strippedContent.slice(sectionStart);
-		const nextTableOffset = rest.search(/^\s*\[/m);
-		sections.push(nextTableOffset === -1 ? rest : rest.slice(0, nextTableOffset));
-	}
-	return sections;
-}
-function firstTomlTableOffset(content) {
-	return content.match(/^\s*\[[^\]\n]/m)?.index ?? content.length;
-}
-function stripTomlLineComments(value) {
-	let output = "";
-	let quote;
-	let escaped = false;
-	for (let index = 0; index < value.length; index += 1) {
-		const char = value[index] ?? "";
-		if (quote) {
-			output += char;
-			if (quote === "\"" && escaped) {
-				escaped = false;
-				continue;
-			}
-			if (quote === "\"" && char === "\\") {
-				escaped = true;
-				continue;
-			}
-			if (char === quote) quote = void 0;
-			continue;
-		}
-		if (char === "\"" || char === "'") {
-			quote = char;
-			output += char;
-			continue;
-		}
-		if (char === "#") {
-			while (index < value.length && value[index] !== "\n") index += 1;
-			if (value[index] === "\n") output += "\n";
-			continue;
-		}
-		output += char;
+	const normalized = values.map(normalize).filter((entry) => entry !== void 0);
+	return normalized.length > 0 ? new Set(normalized) : void 0;
+}
+function parseCodexRequirements(content) {
+	try {
+		return parse(content, { integersAsBigInt: true });
+	} catch {
+		return;
 	}
-	return output;
+}
+function readRequirementsStringArray(value) {
+	return Array.isArray(value) && value.every((entry) => typeof entry === "string") ? value : void 0;
 }
 function normalizeRequirementsSandboxMode(value) {
 	const compact = value.replace(/[\s_-]/g, "").toLowerCase();
@@ -222,9 +134,6 @@ function normalizeRequirementsApprovalPolicy(value) {
 	if (normalized === "untrusted") return normalized;
 	return resolveApprovalPolicy(normalized);
 }
-function normalizeRequirementsApprovalsReviewer(value) {
-	return resolveApprovalsReviewer(value.trim().toLowerCase());
-}
 function selectGuardianApprovalPolicy(allowedApprovalPolicies, execModeRequiringPromptingApprovals) {
 	if (allowedApprovalPolicies === void 0 || allowedApprovalPolicies.has("on-request")) return "on-request";
 	if (allowedApprovalPolicies.has("untrusted")) return "untrusted";
@@ -244,48 +153,11 @@ function selectUserApprovalsReviewer(allowedApprovalsReviewers, execModeRequirin
 	throw new Error(`tools.exec.mode=${execModeRequiringUserReviewer ?? "ask"} requires Codex app-server user approvals`);
 }
 //#endregion
-//#region extensions/codex/src/app-server/auth-start-options.ts
-const CODEX_APP_SERVER_HOME_DIRNAME = "codex-home";
-const CODEX_EPHEMERAL_AUTH_STORE_OVERRIDE = "cli_auth_credentials_store=\"ephemeral\"";
-function resolveCodexAppServerHomeDir(agentDir) {
-	if (!agentDir) throw new Error("Agent-scoped Codex requires an OpenClaw agent directory");
-	return path.join(path.resolve(agentDir), CODEX_APP_SERVER_HOME_DIRNAME);
-}
-/** Resolves the native user Codex home used by Desktop and the CLI. */
-function resolveCodexAppServerUserHomeDir(env = process.env, homedir$1 = homedir) {
-	const configured = normalizeOptionalString(env.CODEX_HOME);
-	return path.resolve(configured ?? path.join(homedir$1(), ".codex"));
-}
-/** Resolves the local CODEX_HOME used when starting one app-server connection. */
-function resolveCodexAppServerLocalHomeDir(startOptions, agentDir, env = process.env) {
-	const configured = startOptions.env?.CODEX_HOME;
-	if (configured?.trim()) return configured;
-	return startOptions.homeScope === "user" ? resolveCodexAppServerUserHomeDir(env) : resolveCodexAppServerHomeDir(agentDir);
-}
-/** Forces OpenClaw-owned Codex auth to remain process-local. */
-function withEphemeralCodexAuthStore(params) {
-	const { startOptions } = params;
-	if (!params.preparedAuth && params.authProfileId === null) return startOptions;
-	const args = normalizeCodexAppServerArgs(startOptions.args, CODEX_EPHEMERAL_AUTH_STORE_OVERRIDE);
-	return args === startOptions.args ? startOptions : {
-		...startOptions,
-		args
-	};
-}
-//#endregion
-//#region extensions/codex/src/app-server/protocol.ts
-/** Namespace Codex keeps directly model-visible without exposing it to Code Mode guests. */
-const CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE = "openclaw_direct";
-function flattenCodexDynamicToolFunctions(tools) {
-	return (tools ?? []).flatMap((tool) => tool.type === "namespace" ? tool.tools : [tool]);
-}
-/** Asserts the experimental beforeTurnId request field before it crosses the app-server boundary. */
-function assertCodexThreadForkParams(value) {
-	if (!isRecord(value) || typeof value.threadId !== "string" || !value.threadId.trim() || value.beforeTurnId !== void 0 && value.beforeTurnId !== null && typeof value.beforeTurnId !== "string") throw new Error("Invalid Codex app-server thread/fork params");
-	return value;
-}
-function isJsonObject(value) {
-	return isRecord(value);
+//#region extensions/codex/src/app-server/config-policy-json.ts
+function stringifyCodexPolicy(value) {
+	if (Array.isArray(value)) return `[${value.map((item) => stringifyCodexPolicy(item)).join(",")}]`;
+	if (value && typeof value === "object") return `{${Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${stringifyCodexPolicy(item)}`).join(",")}}`;
+	return JSON.stringify(value);
 }
 //#endregion
 //#region extensions/codex/src/app-server/config-security.ts
@@ -324,34 +196,26 @@ function resolveCodexAppServerNetworkProxy(config, sandbox) {
 	};
 	return { networkProxy: {
 		profileName,
-		configFingerprint: fingerprintCodexAppServerNetworkProxyConfigPatch(configPatch),
+		configFingerprint: createHash("sha256").update(stringifyCodexPolicy(configPatch)).digest("hex"),
 		configPatch
 	} };
 }
 function resolveNetworkProxyPermissionProfileName(config, profile) {
 	const explicitProfileName = readNonEmptyString(config.profileName);
 	if (explicitProfileName) return explicitProfileName;
-	const suffix = createHash("sha256").update(stableStringifyJson({
+	const suffix = createHash("sha256").update(stringifyCodexPolicy({
 		version: 1,
 		profile
 	})).digest("hex").slice(0, 16);
 	return `${DEFAULT_CODEX_APP_SERVER_NETWORK_PROXY_PROFILE_PREFIX}-${suffix}`;
 }
-function fingerprintCodexAppServerNetworkProxyConfigPatch(configPatch) {
-	return createHash("sha256").update(stableStringifyJson(configPatch)).digest("hex");
-}
 function normalizeNetworkProxyPermissionMap(value) {
-	const entries = Object.entries(value ?? {}).map(([key, permission]) => [key.trim(), permission]).filter(([key]) => key.length > 0);
+	const entries = Object.entries(value ?? {}).map(([key, permission]) => [key.trim(), permission === "none" ? "deny" : permission]).filter(([key]) => key.length > 0);
 	return entries.length > 0 ? Object.fromEntries(entries) : void 0;
 }
 function removeUndefinedJsonFields(value) {
 	return Object.fromEntries(Object.entries(value).filter((entry) => entry[1] !== void 0));
 }
-function stableStringifyJson(value) {
-	if (Array.isArray(value)) return `[${value.map((item) => stableStringifyJson(item)).join(",")}]`;
-	if (value && typeof value === "object") return `{${Object.entries(value).toSorted(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${stableStringifyJson(item)}`).join(",")}}`;
-	return JSON.stringify(value);
-}
 /** Explicit MCP prompting must bypass Codex's unconditional Never-policy approval. */
 function hasCodexMcpToolApprovalOverrides(servers, serverNames, projectedMcpServers) {
 	const modes = new Map(Object.entries(projectedMcpServers ?? {}).map(([name, server]) => [name, server.default_tools_approval_mode]));
@@ -368,44 +232,25 @@ function withMcpElicitationsApprovalPolicy(policy) {
 		...policy.granular,
 		mcp_elicitations: true
 	} };
-	if (policy === "never") return { granular: {
-		mcp_elicitations: true,
-		rules: false,
-		sandbox_approval: false,
-		request_permissions: false,
-		skill_approval: false
-	} };
+	const prompting = policy !== "never";
 	return { granular: {
 		mcp_elicitations: true,
-		rules: true,
-		sandbox_approval: true,
-		request_permissions: true,
-		skill_approval: true
+		rules: prompting,
+		sandbox_approval: prompting,
+		request_permissions: prompting,
+		skill_approval: prompting
 	} };
 }
 function resolveTransport(value) {
 	return value === "websocket" || value === "unix" ? value : "stdio";
 }
-function normalizeRemoteWorkspaceRoot(value) {
-	return readNonEmptyString(value);
-}
 function inferCodexAppServerConnectionClass(params) {
 	if (params.transport !== "websocket") return "local-loopback";
 	return params.url && isLoopbackWebSocketUrl(params.url) ? "local-loopback" : "remote";
 }
-function assertCodexAppServerConnectionClassConfig(params) {
-	if (params.connectionClass === "remote" && !hasIdentityBearingWebSocketAuth({
-		authToken: params.authToken,
-		headers: params.headers
-	})) throw new Error("remote Codex app-server WebSocket URLs require appServer.authToken or an Authorization header");
-}
 /** Applies the canonical remote-auth boundary to any Codex AppServer transport. */
 function assertCodexAppServerConnectionSecurity(params) {
-	assertCodexAppServerConnectionClassConfig({
-		connectionClass: inferCodexAppServerConnectionClass(params),
-		authToken: params.authToken,
-		headers: params.headers
-	});
+	if (inferCodexAppServerConnectionClass(params) === "remote" && !hasIdentityBearingWebSocketAuth(params)) throw new Error("remote Codex app-server WebSocket URLs require appServer.authToken or an Authorization header");
 }
 function isLoopbackWebSocketUrl(value) {
 	let parsed;
@@ -430,22 +275,13 @@ function resolveDefaultCodexAppServerPolicy(params) {
 		dangerFullAccessAllowed: true
 	};
 	const content = readCodexRequirementsToml(params);
-	if (content === void 0) {
-		if (!params.forceGuardian) return {
-			mode: "yolo",
-			dangerFullAccessAllowed: true
-		};
-		return {
-			mode: "guardian",
-			dangerFullAccessAllowed: true,
-			approvalPolicy: selectGuardianApprovalPolicy(void 0, params.execModeRequiringPromptingApprovals),
-			approvalsReviewer: params.forceUserReviewer ? selectUserApprovalsReviewer(void 0, params.execModeRequiringUserReviewer) : selectGuardianApprovalsReviewer(void 0, params.execModeRequiringPromptingApprovals === "auto" ? "auto" : void 0),
-			sandbox: selectGuardianSandbox(void 0)
-		};
-	}
-	const allowedSandboxModes = parseAllowedSandboxModesFromCodexRequirements(content, readNonEmptyString(params.hostName) ?? hostname());
-	const allowedApprovalPolicies = parseAllowedApprovalPoliciesFromCodexRequirements(content);
-	const allowedApprovalsReviewers = parseAllowedApprovalsReviewersFromCodexRequirements(content);
+	if (content === void 0 && !params.forceGuardian) return {
+		mode: "yolo",
+		dangerFullAccessAllowed: true
+	};
+	const allowedSandboxModes = content === void 0 ? void 0 : parseAllowedSandboxModesFromCodexRequirements(content, readNonEmptyString(params.hostName) ?? hostname());
+	const allowedApprovalPolicies = content === void 0 ? void 0 : parseAllowedApprovalPoliciesFromCodexRequirements(content);
+	const allowedApprovalsReviewers = content === void 0 ? void 0 : parseAllowedApprovalsReviewersFromCodexRequirements(content);
 	const yoloSandboxAllowed = allowedSandboxModes === void 0 || allowedSandboxModes.has("danger-full-access");
 	const yoloApprovalAllowed = allowedApprovalPolicies === void 0 || allowedApprovalPolicies.has("never") && !allowedApprovalPolicies.has("untrusted");
 	const yoloReviewerAllowed = allowedApprovalsReviewers === void 0 || allowedApprovalsReviewers.has("user");
@@ -462,4 +298,4 @@ function resolveDefaultCodexAppServerPolicy(params) {
 	};
 }
 //#endregion
-export { stripTomlLineComments as A, parseInlineOpenAIModelProviderBaseUrl as C, selectGuardianApprovalPolicy as D, readCodexRequirementsToml as E, resolveEffectiveOpenClawExecModeForCodexAppServer as F, resolveSandbox as I, selectForcedDangerFullAccessSandbox as L, resolveApprovalPolicy as M, resolveApprovalsReviewer as N, selectGuardianApprovalsReviewer as O, resolveCodexPolicyModeForOpenClawExecMode as P, selectForcedPromptingSandbox as R, parseAllowedSandboxModesFromCodexRequirements as S, parseTomlTableSection as T, resolveCodexAppServerUserHomeDir as _, resolveCodexAppServerNetworkProxy as a, parseAllowedApprovalPoliciesFromCodexRequirements as b, resolveTransport as c, CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE as d, assertCodexThreadForkParams as f, resolveCodexAppServerLocalHomeDir as g, resolveCodexAppServerHomeDir as h, normalizeRemoteWorkspaceRoot as i, assertCodexAppServerAllowedForOpenClawExecMode as j, selectUserApprovalsReviewer as k, shouldAutoApproveCodexAppServerApprovals as l, isJsonObject as m, hasCodexMcpToolApprovalOverrides as n, resolveDefaultCodexAppServerPolicy as o, flattenCodexDynamicToolFunctions as p, inferCodexAppServerConnectionClass as r, resolvePolicyMode as s, assertCodexAppServerConnectionSecurity as t, withMcpElicitationsApprovalPolicy as u, withEphemeralCodexAuthStore as v, parseTomlStringValue as w, parseAllowedApprovalsReviewersFromCodexRequirements as x, firstTomlTableOffset as y, selectGuardianSandbox as z };
+export { resolveSandbox as C, selectGuardianSandbox as E, resolveEffectiveOpenClawExecModeForCodexAppServer as S, selectForcedPromptingSandbox as T, selectUserApprovalsReviewer as _, resolveDefaultCodexAppServerPolicy as a, resolveApprovalsReviewer as b, shouldAutoApproveCodexAppServerApprovals as c, parseAllowedApprovalPoliciesFromCodexRequirements as d, parseAllowedApprovalsReviewersFromCodexRequirements as f, selectGuardianApprovalsReviewer as g, selectGuardianApprovalPolicy as h, resolveCodexAppServerNetworkProxy as i, withMcpElicitationsApprovalPolicy as l, readCodexRequirementsToml as m, hasCodexMcpToolApprovalOverrides as n, resolvePolicyMode as o, parseAllowedSandboxModesFromCodexRequirements as p, inferCodexAppServerConnectionClass as r, resolveTransport as s, assertCodexAppServerConnectionSecurity as t, stringifyCodexPolicy as u, assertCodexAppServerAllowedForOpenClawExecMode as v, selectForcedDangerFullAccessSandbox as w, resolveCodexPolicyModeForOpenClawExecMode as x, resolveApprovalPolicy as y };

package/dist/.setup/{config-utils-DujwEnhg.mjs → config-utils-D0CXecki.mjs}

@@ -1,6 +1,5 @@
-import { asOptionalRecord as readRecord, normalizeOptionalString as readNonEmptyString, parseBooleanValue } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { asOptionalRecord as readRecord, normalizeOptionalString as readNonEmptyString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHmac, randomBytes } from "node:crypto";
-import { resolvePositiveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
 import { splitCommandArgs } from "openclaw/plugin-sdk/process-runtime";
 import { normalizeResolvedSecretInputString } from "openclaw/plugin-sdk/secret-input";
 //#region extensions/codex/src/app-server/config-contracts.shared.ts
@@ -22,22 +21,13 @@ function normalizeCodexServiceTier(value) {
 function isCodexFastServiceTier(value) {
 	return normalizeCodexServiceTier(value) === "priority";
 }
-function normalizePositiveNumber(value, fallback) {
-	return resolvePositiveTimerTimeoutMs(value, fallback);
-}
 function normalizeHeaders(value) {
 	if (!value || typeof value !== "object" || Array.isArray(value)) return {};
-	return Object.fromEntries(Object.entries(value).map(([key, child]) => [key.trim(), normalizeCodexAppServerSecretInput({
+	return Object.fromEntries(Object.entries(value).map(([key, child]) => [key.trim(), normalizeResolvedSecretInputString({
 		value: child,
 		path: `plugins.entries.codex.config.appServer.headers.${key}`
 	})]).filter((entry) => Boolean(entry[0] && entry[1])));
 }
-function normalizeCodexAppServerSecretInput(params) {
-	return normalizeResolvedSecretInputString(params);
-}
-function readBooleanEnv(value) {
-	return parseBooleanValue(value);
-}
 function readExecSecurity(value) {
 	return value === "deny" || value === "allowlist" || value === "full" ? value : void 0;
 }
@@ -64,4 +54,4 @@ function getStartOptionsKeySecret() {
 	return globalState[START_OPTIONS_KEY_SECRET_SYMBOL];
 }
 //#endregion
-export { normalizeHeaders as a, readExecAsk as c, readNumberEnv as d, readRecord as f, normalizeCodexServiceTier as i, readExecSecurity as l, CODEX_PLUGIN_MARKETPLACE_NAME_PATTERN as m, isCodexFastServiceTier as n, normalizePositiveNumber as o, resolveArgs as p, normalizeCodexAppServerSecretInput as r, readBooleanEnv as s, hashSecretForKey as t, readNonEmptyString as u };
+export { readExecAsk as a, readNumberEnv as c, CODEX_PLUGIN_MARKETPLACE_NAME_PATTERN as d, normalizeHeaders as i, readRecord as l, isCodexFastServiceTier as n, readExecSecurity as o, normalizeCodexServiceTier as r, readNonEmptyString as s, hashSecretForKey as t, resolveArgs as u };