@openclaw/codex 2026.9.5 → 2026.9.7

package/dist/.setup/launch-args-DbFCehO7.mjs

@@ -0,0 +1,196 @@
+import { createRequire } from "node:module";
+import path from "node:path";
+//#region extensions/codex/src/app-server/launch-args.ts
+const CODEX_VALUE_OPTIONS = /* @__PURE__ */ new Set([
+	"-m",
+	"--model",
+	"--local-provider",
+	"-p",
+	"--profile",
+	"-s",
+	"--sandbox",
+	"-a",
+	"--ask-for-approval",
+	"-C",
+	"--cd",
+	"--add-dir",
+	"--remote",
+	"--remote-auth-token-env",
+	"-c",
+	"--config",
+	"--enable",
+	"--disable",
+	"--listen",
+	"--sock",
+	"--code-mode-host",
+	"--ws-auth",
+	"--ws-token-file",
+	"--ws-token-sha256",
+	"--ws-shared-secret-file",
+	"--ws-issuer",
+	"--ws-audience",
+	"--ws-max-clock-skew-seconds"
+]);
+/** One tokenization owner for launch, turn policy, reviewer trust, and private turns. */
+function readCodexArgs(args) {
+	const tokens = [];
+	let nativeSubcommand = false;
+	let end = 0;
+	for (const [index, arg] of args.entries()) {
+		if (index < end) continue;
+		end = index + 1;
+		const attached = /^(--[^=]+)=([\s\S]*)$/u.exec(arg) ?? /^(-[cmpisaC])=?([\s\S]+)$/u.exec(arg);
+		const name = attached?.[1] ?? arg;
+		let value = attached?.[2];
+		if (name === "-i" || name === "--image") while (args[end]?.startsWith("-") === false) end += 1;
+		else if (!attached && CODEX_VALUE_OPTIONS.has(name)) {
+			value = args[end];
+			if (value !== void 0) end += 1;
+		}
+		tokens.push({
+			index,
+			end,
+			name,
+			value
+		});
+		if (name === "app-server") nativeSubcommand = true;
+		if (name === "--" && nativeSubcommand) break;
+	}
+	return tokens;
+}
+/** Uses the native CLI configuration for status without starting its transport. */
+function buildCodexLoginStatusArgs(args) {
+	const options = /* @__PURE__ */ new Set([
+		"-c",
+		"--config",
+		"-p",
+		"--profile",
+		"--enable",
+		"--disable"
+	]);
+	const tokens = readCodexArgs(args);
+	const subcommandIndex = tokens.findLast(({ name }) => name === "app-server")?.index ?? -1;
+	const prefix = subcommandIndex < 0 ? [] : args.slice(0, subcommandIndex);
+	const configArgs = tokens.filter(({ index, name }) => index > subcommandIndex && options.has(name)).flatMap(({ index, end }) => args.slice(index, end));
+	return [
+		...prefix,
+		...configArgs,
+		"login",
+		"status"
+	];
+}
+function readCodexAppServerConfigOptions(args) {
+	return readCodexArgs(args).filter(({ name }) => name === "-c" || name === "--config" || name === "-p" || name === "--profile");
+}
+const NODE_LAUNCH_VALUE_OPTIONS = /* @__PURE__ */ new Set([
+	"-r",
+	"--require",
+	"--import",
+	"--loader",
+	"--experimental-loader",
+	"--max-old-space-size",
+	"--max-semi-space-size",
+	"--stack-size"
+]);
+const NODE_LAUNCH_FLAGS = /* @__PURE__ */ new Set([
+	"--enable-source-maps",
+	"--no-warnings",
+	"--trace-warnings",
+	"--trace-uncaught",
+	"--no-deprecation",
+	"--trace-deprecation",
+	"--experimental-strip-types",
+	"--experimental-transform-types",
+	"--no-experimental-strip-types",
+	"--use-strict",
+	"--expose-gc"
+]);
+function resolveNodeLauncherModule(value, option, cwd) {
+	if (path.isAbsolute(value)) return value;
+	if (/^\.{1,2}[\\/]/u.test(value)) return path.resolve(cwd, value);
+	if (option === "-r" || option === "--require") return createRequire(path.join(cwd, "openclaw-codex-launcher.cjs")).resolve(value);
+	if (/^(?:file|data|node):/u.test(value)) return value;
+	throw new Error("Private Codex turns require an absolute or relative file path for ESM preloads");
+}
+/** Separates a supported launcher from native flags before a private turn sanitizes them. */
+function resolveCodexPrivateLauncher(params) {
+	const launcherArgs = [];
+	let nativeArgs = [...params.args];
+	const executable = params.command.split(/[\\/]/u).at(-1)?.toLowerCase();
+	if (executable && [
+		"node",
+		"node.exe",
+		"nodejs",
+		"nodejs.exe"
+	].includes(executable)) {
+		let index = 0;
+		while (params.args[index]?.startsWith("-")) {
+			const raw = params.args[index];
+			index += 1;
+			if (raw === "--") {
+				launcherArgs.push(raw);
+				break;
+			}
+			const attached = /^(--[^=]+)=([\s\S]*)$/u.exec(raw) ?? /^(-r)([\s\S]+)$/u.exec(raw);
+			const name = attached?.[1] ?? raw;
+			const normalizedName = name.replaceAll("_", "-");
+			if (NODE_LAUNCH_VALUE_OPTIONS.has(normalizedName)) {
+				const value = attached?.[2] ?? params.args[index++];
+				if (value === void 0 || !value.trim()) throw new Error("Private Codex turns received a Node launcher option without its value");
+				const moduleOption = [
+					"-r",
+					"--require",
+					"--import",
+					"--loader",
+					"--experimental-loader"
+				].includes(normalizedName);
+				if (attached && !moduleOption) launcherArgs.push(raw);
+				else launcherArgs.push(name, moduleOption ? resolveNodeLauncherModule(value, normalizedName, path.resolve(params.cwd)) : value);
+			} else if (!attached && NODE_LAUNCH_FLAGS.has(name)) launcherArgs.push(raw);
+			else throw new Error(`Private Codex turns cannot isolate unsupported Node launcher option ${name}`);
+		}
+		const script = params.args[index];
+		if (!script) throw new Error("Private Codex turns require a Node wrapper script");
+		launcherArgs.push(path.resolve(params.cwd, script));
+		nativeArgs = params.args.slice(index + 1);
+		if (!readCodexArgs(nativeArgs).some(({ name }) => name === "app-server")) throw new Error("Private Codex turns require a native app-server command after the Node wrapper");
+	}
+	if (executable && /^(?:(?:ba|da|z|fi)?sh|python(?:\d+(?:\.\d+)*)?|ruby|perl|cmd|powershell|pwsh)(?:\.exe)?$/u.test(executable)) throw new Error("Private Codex turns cannot isolate inline or interpreted wrappers; use a Node script or a directly executable wrapper");
+	const tokens = readCodexArgs(nativeArgs);
+	const serverIndex = tokens.findLast(({ name }) => name === "app-server")?.index ?? nativeArgs.length;
+	if (tokens.some(({ index, name }) => index < serverIndex && (!name.startsWith("-") || name === "--"))) throw new Error("Private Codex turns cannot isolate this launcher prefix; use a Node script or a directly executable wrapper");
+	return {
+		launcherArgs,
+		nativeArgs
+	};
+}
+/** The stdio proxy forwards to an external server; it does not own that runtime. */
+function isCodexAppServerProxyLaunch(args) {
+	const tokens = readCodexArgs(args);
+	const server = tokens.findLastIndex(({ name }) => name === "app-server");
+	return server >= 0 && tokens.slice(server + 1).find(({ name }) => !name.startsWith("-"))?.name === "proxy";
+}
+/** Keeps Codex overrides in one CLI scope without rewriting raw TOML or wrapper prefixes. */
+function normalizeCodexAppServerArgs(rawArgs, enforcedOverride) {
+	const tokens = readCodexArgs(rawArgs);
+	const subcommandIndex = tokens.findLast(({ name }) => name === "app-server")?.index ?? -1;
+	const prefix = subcommandIndex < 0 ? [...rawArgs] : rawArgs.slice(0, subcommandIndex);
+	const suffix = [];
+	if (subcommandIndex >= 0) for (const token of tokens) {
+		if (token.index <= subcommandIndex) continue;
+		if (token.name === "--") {
+			suffix.push(...rawArgs.slice(token.index));
+			break;
+		}
+		(token.name === "-c" || token.name === "--config" ? prefix : suffix).push(...rawArgs.slice(token.index, token.end));
+	}
+	if (enforcedOverride && !(prefix.at(-2) === "-c" && prefix.at(-1) === enforcedOverride)) prefix.push("-c", enforcedOverride);
+	const normalized = subcommandIndex < 0 ? prefix : [
+		...prefix,
+		"app-server",
+		...suffix
+	];
+	return normalized.length === rawArgs.length && normalized.every((arg, index) => arg === rawArgs[index]) ? rawArgs : normalized;
+}
+//#endregion
+export { resolveCodexPrivateLauncher as a, readCodexAppServerConfigOptions as i, isCodexAppServerProxyLaunch as n, normalizeCodexAppServerArgs as r, buildCodexLoginStatusArgs as t };

package/dist/.setup/{managed-binary-DP6Rib3P.mjs → managed-binary-kiWRhNRE.mjs}

@@ -1,5 +1,4 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
-import { n as MANAGED_CODEX_APP_SERVER_PACKAGE } from "./version-CoqzXPgK.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-jo6H8dFr.mjs";
 import { createRequire } from "node:module";
 import { constants, existsSync, realpathSync } from "node:fs";
 import path from "node:path";
@@ -20,7 +19,10 @@ const MACOS_DESKTOP_CODEX_APP_PATH_CANDIDATES = [{
 	appServerCommandPath: "/Applications/Codex.app/Contents/Resources/codex",
 	bundledMarketplacePath: "/Applications/Codex.app/Contents/Resources/plugins/openai-bundled",
 	computerUseServiceAppPaths: ["/Applications/Codex.app/Contents/Resources/plugins/openai-bundled/plugins/computer-use/Codex Computer Use.app", "/Applications/Codex.app/Contents/Resources/cua_node/lib/node_modules/@oai/sky/Codex Computer Use.app"]
-}];
+}].flatMap((candidate) => [{
+	...candidate,
+	appServerCommandPath: path.join(candidate.appBundlePath, "Contents", "Resources", "codex-cli", "CodexCLI.app", "Contents", "MacOS", "codex")
+}, candidate]);
 function resolveMacOSDesktopCodexAppPathCandidates(platform = process.platform) {
 	return platform === "darwin" ? MACOS_DESKTOP_CODEX_APP_PATH_CANDIDATES : [];
 }
@@ -28,7 +30,7 @@ function resolveMacOSDesktopCodexAppServerCommandCandidates(platform = process.p
 	return resolveMacOSDesktopCodexAppPathCandidates(platform).map((candidate) => candidate.appServerCommandPath);
 }
 function resolveMacOSDesktopCodexBundledMarketplaceCandidates(platform = process.platform) {
-	return resolveMacOSDesktopCodexAppPathCandidates(platform).map((candidate) => candidate.bundledMarketplacePath);
+	return [...new Set(resolveMacOSDesktopCodexAppPathCandidates(platform).map((candidate) => candidate.bundledMarketplacePath))];
 }
 function resolveMacOSDesktopCodexComputerUseServiceAppCandidates(platform = process.platform, appServerCommand) {
 	if (platform !== "darwin") return [];
@@ -43,6 +45,13 @@ function resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath(params = {}
 	return candidates.find((candidate) => pathExists(candidate));
 }
 //#endregion
+//#region extensions/codex/src/app-server/version.ts
+/** Exact Codex app-server version shipped by the OpenClaw Codex bridge. */
+const CODEX_APP_SERVER_VERSION = "0.158.0";
+/** Inclusive runtime compatibility floor for external app-server binaries. */
+const MIN_SUPPORTED_CODEX_APP_SERVER_VERSION = "0.149.0";
+const MANAGED_CODEX_APP_SERVER_PACKAGE = "@openai/codex";
+//#endregion
 //#region extensions/codex/src/app-server/managed-binary.ts
 /**
 * Resolves the managed Codex app-server binary shipped with or installed beside
@@ -107,7 +116,7 @@ function isManagedCodexDesktopCommand(command, platform = process.platform) {
 	return platform === "darwin" && resolveMacOSDesktopCodexAppServerCommandCandidates(platform).some((candidate) => candidate === command);
 }
 function resolveManagedCodexPackageRootForCommand(command, platform) {
-	const pathApi = pathForPlatform(platform);
+	const pathApi = platform === "win32" ? path.win32 : path.posix;
 	const commandPaths = [command];
 	try {
 		commandPaths.unshift(realpathSync(command));
@@ -160,6 +169,7 @@ function resolvePackageJsonFromRoot(packageName, root) {
 function resolveManagedCodexAppServerCommandCandidates(pluginRoot, platform, managedCommandOrder) {
 	const packageCommand = resolveManagedCodexPackageEntrypoint(pluginRoot);
 	const packageCommandPaths = packageCommand ? [packageCommand] : [];
+	if (managedCommandOrder === "package-only") return packageCommandPaths;
 	const desktopCommandPaths = resolveMacOSDesktopCodexAppServerCommandCandidates(platform);
 	return managedCommandOrder === "desktop-first" ? [...desktopCommandPaths, ...packageCommandPaths] : [...packageCommandPaths, ...desktopCommandPaths];
 }
@@ -170,9 +180,6 @@ function resolveManagedCodexPackageEntrypoint(pluginRoot) {
 		return;
 	}
 }
-function pathForPlatform(platform) {
-	return platform === "win32" ? path.win32 : path.posix;
-}
 async function findManagedCodexAppServerCommandPaths(params) {
 	const commandPaths = [];
 	for (const commandPath of params.candidateCommandPaths) if (await params.pathExists(commandPath, params.platform)) commandPaths.push(commandPath);
@@ -192,4 +199,4 @@ async function commandPathExists(filePath, platform) {
 	}
 }
 //#endregion
-export { resolvePackagedCodexNativeCommand as a, resolveMacOSDesktopCodexAppPathCandidates as c, resolveManagedCodexNativeCommand as i, resolveMacOSDesktopCodexBundledMarketplaceCandidates as l, managed_binary_exports as n, setManagedCodexPluginRoot as o, resolveManagedCodexAppServerStartOptions as r, resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath as s, isManagedCodexDesktopCommand as t, resolveMacOSDesktopCodexComputerUseServiceAppCandidates as u };
+export { resolvePackagedCodexNativeCommand as a, MIN_SUPPORTED_CODEX_APP_SERVER_VERSION as c, resolveMacOSDesktopCodexBundledMarketplaceCandidates as d, resolveMacOSDesktopCodexComputerUseServiceAppCandidates as f, resolveManagedCodexNativeCommand as i, resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath as l, managed_binary_exports as n, setManagedCodexPluginRoot as o, resolveManagedCodexAppServerStartOptions as r, CODEX_APP_SERVER_VERSION as s, isManagedCodexDesktopCommand as t, resolveMacOSDesktopCodexAppPathCandidates as u };

package/dist/.setup/{model-catalog-DkvUuBey.mjs → model-catalog-PAuZgJC6.mjs}

@@ -1,15 +1,14 @@
-import { r as buildCodexRuntimeModelParams } from "./harness-rxaaoN-o.mjs";
-import { m as isJsonObject } from "./config-security-BRQ2mgW9.mjs";
-import { d as readCodexPluginConfig } from "./config-parsing-CcB9iPoq.mjs";
-import { n as isCodexAppServerProxyLaunch } from "./launch-args-DnMak49W.mjs";
-import { o as withCodexAppServerJsonClient } from "./request-BioXJLYa.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-CeAhl_h4.mjs";
-import { a as resolveCodexAppServerAuthProfileStore, r as resolveCodexAppServerAuthProfileId } from "./auth-profile-WqZtZfXN.mjs";
-import { r as captureSharedCodexAppServerCatalogLifetime } from "./shared-client-BpTtuLQ5.mjs";
-import { t as listAllCodexAppServerModels } from "./models-BDFgm_G-.mjs";
-import { probeCodexNativeAuth } from "./native-auth-BLZGqFjw.mjs";
+import { t as buildCodexRuntimeModelParams } from "./model-runtime-BdqzOMkU.mjs";
+import { d as readCodexPluginConfig } from "./config-parsing-b088LyhT.mjs";
+import { n as isCodexAppServerProxyLaunch } from "./launch-args-DbFCehO7.mjs";
+import { o as withCodexAppServerJsonClient } from "./request-BHZ1nz8d.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-C0NbLms1.mjs";
+import { a as resolveCodexAppServerAuthProfileStore, r as resolveCodexAppServerAuthProfileId } from "./auth-profile-B0okYl2D.mjs";
+import { r as captureSharedCodexAppServerCatalogLifetime } from "./shared-client-DqyTMYug.mjs";
+import { i as isCodexResponsesOAuthCredential } from "./responses-oauth-twnuTaAa.mjs";
+import { n as listAllCodexAppServerModels } from "./models-DHXZtVVk.mjs";
+import { probeCodexNativeAuth } from "./native-auth-CuG53tu4.mjs";
 //#region extensions/codex/src/app-server/model-catalog.ts
-const DEFAULT_MODEL_DISCOVERY_TIMEOUT_MS = 2500;
 const INPUT_TYPES = /* @__PURE__ */ new Set([
 	"text",
 	"image",
@@ -82,11 +81,12 @@ function createCodexAppServerModelCatalog(runtime) {
 				store: authProfileStore,
 				config: params.config
 			}) : void 0;
+			if (isCodexResponsesOAuthCredential(authProfileStore?.profiles[authProfileId ?? ""])) return [];
 			const usesNativeHome = ownsLocalProcess && options.start.homeScope === "user";
 			const native = usesNativeHome ? await probeCodexNativeAuth({ pluginConfig }) : void 0;
 			if (usesNativeHome && !native || disposed || observations.get(key) !== observation) return [];
 			const { start } = options;
-			const timeoutMs = discovery?.timeoutMs ?? DEFAULT_MODEL_DISCOVERY_TIMEOUT_MS;
+			const timeoutMs = discovery?.timeoutMs ?? 1e4;
 			const result = await withCodexAppServerJsonClient({
 				startOptions: start,
 				config: params.config,
@@ -107,11 +107,11 @@ function createCodexAppServerModelCatalog(runtime) {
 					method: "account/read",
 					requestParams: { refreshToken: false }
 				});
-				const observedType = isJsonObject(account.account) ? account.account.type : void 0;
+				const observedType = account.account?.type;
 				return {
 					models,
 					isCurrent,
-					accountType: account.requiresOpenaiAuth === true ? observedType === "apiKey" || observedType === "chatgpt" ? observedType : void 0 : void 0
+					accountType: account.requiresOpenaiAuth ? observedType === "apiKey" || observedType === "chatgpt" ? observedType : void 0 : void 0
 				};
 			});
 			if (disposed || observations.get(key) !== observation || !result.isCurrent()) return [];

package/dist/.setup/model-runtime-BdqzOMkU.mjs

@@ -0,0 +1,11 @@
+import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
+//#region extensions/codex/src/app-server/model-runtime.ts
+const CODEX_APP_SERVER_RUNTIME_MODEL_PARAM = "codexAppServerRuntimeModel";
+function buildCodexRuntimeModelParams(catalogId, runtimeModelId) {
+	return catalogId === runtimeModelId ? void 0 : { [CODEX_APP_SERVER_RUNTIME_MODEL_PARAM]: runtimeModelId };
+}
+function readCodexRuntimeModelId(model, fallbackId) {
+	return normalizeOptionalString(model?.params?.[CODEX_APP_SERVER_RUNTIME_MODEL_PARAM]) ?? model?.id ?? fallbackId;
+}
+//#endregion
+export { readCodexRuntimeModelId as n, buildCodexRuntimeModelParams as t };

package/dist/.setup/{models-BDFgm_G-.mjs → models-DHXZtVVk.mjs}

@@ -1,15 +1,10 @@
-import { h as assertCodexModelListResponse } from "./client-vXs2929Q.mjs";
-import { normalizeOptionalString, uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { g as assertCodexModelListResponse } from "./client-N0JpgSzF.mjs";
+import { normalizeOptionalString, normalizeUniqueTrimmedStringList } from "openclaw/plugin-sdk/string-coerce-runtime";
 //#region extensions/codex/src/app-server/models.ts
-/**
-* Lists and normalizes models exposed by the Codex app-server `model/list`
-* endpoint, including pagination and shared-client lease handling.
-*/
-/** Lists one Codex app-server model page using the configured auth/client options. */
+const DEFAULT_MODEL_DISCOVERY_TIMEOUT_MS = 1e4;
 async function listCodexAppServerModels(options = {}) {
 	return await withCodexAppServerModelRequest(options, async (request) => requestModelListPage(request, options));
 }
-/** Walks Codex app-server model pages until exhaustion or the max-page guard. */
 async function listAllCodexAppServerModels(options = {}) {
 	const maxPages = normalizeMaxPages(options.maxPages);
 	return await withCodexAppServerModelRequest(options, async (request) => {
@@ -35,10 +30,10 @@ async function listAllCodexAppServerModels(options = {}) {
 }
 async function withCodexAppServerModelRequest(options, run) {
 	if (options.request) return await run(options.request);
-	const timeoutMs = options.timeoutMs ?? 2500;
+	const timeoutMs = options.timeoutMs ?? 1e4;
 	const useSharedClient = options.sharedClient !== false;
-	const { createIsolatedCodexAppServerClient, getLeasedSharedCodexAppServerClient, releaseLeasedSharedCodexAppServerClient } = await import("./shared-client-BpTtuLQ5.mjs").then((n) => n.y);
-	const { requestCodexAppServerClientJson } = await import("./request-BioXJLYa.mjs").then((n) => n.a);
+	const { createIsolatedCodexAppServerClient, getLeasedSharedCodexAppServerClient, releaseLeasedSharedCodexAppServerClient } = await import("./shared-client-DqyTMYug.mjs").then((n) => n.v);
+	const { requestCodexAppServerClientJson } = await import("./request-BHZ1nz8d.mjs").then((n) => n.a);
 	const client = await (useSharedClient ? getLeasedSharedCodexAppServerClient : createIsolatedCodexAppServerClient)({
 		startOptions: options.startOptions,
 		timeoutMs,
@@ -69,7 +64,6 @@ async function requestModelListPage(request, options) {
 		}
 	}));
 }
-/** Parses a raw Codex app-server model/list response into OpenClaw's normalized shape. */
 function readModelListResult(value) {
 	const response = assertCodexModelListResponse(value);
 	const models = response.data.map((entry) => readCodexModel(entry));
@@ -91,17 +85,14 @@ function readCodexModel(value) {
 		hidden: value.hidden,
 		isDefault: value.isDefault,
 		inputModalities: value.inputModalities,
-		supportedReasoningEfforts: readReasoningEfforts(value.supportedReasoningEfforts),
+		serviceTiers: normalizeUniqueTrimmedStringList((value.serviceTiers ?? []).map((tier) => tier.id)),
+		supportedReasoningEfforts: normalizeUniqueTrimmedStringList(value.supportedReasoningEfforts.map((entry) => entry.reasoningEffort)),
 		...normalizeOptionalString(value.defaultReasoningEffort) ? { defaultReasoningEffort: normalizeOptionalString(value.defaultReasoningEffort) } : {},
 		...value.multiAgentVersion !== void 0 ? { multiAgentVersion: value.multiAgentVersion } : {}
 	};
 }
-function readReasoningEfforts(value) {
-	const efforts = value.map((entry) => normalizeOptionalString(entry.reasoningEffort)).filter((entry) => entry !== void 0);
-	return uniqueStrings(efforts);
-}
 function normalizeMaxPages(value) {
 	return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.floor(value) : 20;
 }
 //#endregion
-export { listCodexAppServerModels as n, readModelListResult as r, listAllCodexAppServerModels as t };
+export { readModelListResult as i, listAllCodexAppServerModels as n, listCodexAppServerModels as r, DEFAULT_MODEL_DISCOVERY_TIMEOUT_MS as t };

package/dist/.setup/{native-auth-BLZGqFjw.mjs → native-auth-CuG53tu4.mjs}

@@ -1,8 +1,8 @@
-import { d as readCodexPluginConfig } from "./config-parsing-CcB9iPoq.mjs";
-import { n as isCodexAppServerProxyLaunch, t as buildCodexLoginStatusArgs } from "./launch-args-DnMak49W.mjs";
-import { r as resolveManagedCodexAppServerStartOptions } from "./managed-binary-DP6Rib3P.mjs";
-import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-Cmx94Oiy.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-CeAhl_h4.mjs";
+import { d as readCodexPluginConfig } from "./config-parsing-b088LyhT.mjs";
+import { n as isCodexAppServerProxyLaunch, t as buildCodexLoginStatusArgs } from "./launch-args-DbFCehO7.mjs";
+import { r as resolveManagedCodexAppServerStartOptions } from "./managed-binary-kiWRhNRE.mjs";
+import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-Bdegpn2V.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-C0NbLms1.mjs";
 import { runUtf8CommandWithTimeout } from "openclaw/plugin-sdk/process-runtime";
 import { materializeWindowsSpawnProgram, resolveWindowsSpawnProgram } from "openclaw/plugin-sdk/windows-spawn";
 //#region extensions/codex/src/app-server/native-auth.ts

package/dist/.setup/{native-execution-policy-YBMHSzC4.mjs → native-execution-policy-BxZJy5mP.mjs}

@@ -1,6 +1,6 @@
 import { resolveAgentConfig, tryResolveDefaultAgentId } from "openclaw/plugin-sdk/agent-scope-runtime";
-import { getSessionEntry } from "openclaw/plugin-sdk/session-store-runtime";
 import { normalizeAgentId, parseAgentSessionKey } from "openclaw/plugin-sdk/routing";
+import { getSessionEntry } from "openclaw/plugin-sdk/session-store-runtime";
 import { resolveSandboxRuntimeStatus } from "openclaw/plugin-sdk/sandbox";
 //#region extensions/codex/src/app-server/native-execution-policy.ts
 /** Projects node execution ownership into the runtime tool factory options. */
@@ -37,29 +37,17 @@ function resolveCodexNativeExecutionPolicy(params) {
 		agentId: sandboxAgentId,
 		classificationAgentId: sandboxAgentId
 	}).sandboxed : false);
-	const agentExec = agentId ? resolvePolicyAgentExec({
-		config,
-		agentId
-	}) : void 0;
+	const agentExec = agentId ? resolveAgentConfig(config, agentId)?.tools?.exec : void 0;
 	const globalExec = config.tools?.exec;
 	const requestedExecHost = normalizeExecTarget(params.execOverrides?.host) ?? normalizeExecTarget(sessionEntry?.execHost) ?? normalizeExecTarget(agentExec?.host) ?? normalizeExecTarget(globalExec?.host) ?? "auto";
-	const effectiveExecHost = resolveEffectiveExecHost({
-		requestedExecHost,
-		sandboxAvailable
-	});
+	const effectiveExecHost = requestedExecHost === "auto" ? sandboxAvailable ? "sandbox" : "gateway" : requestedExecHost;
 	const node = params.execOverrides?.node ?? sessionEntry?.execNode ?? agentExec?.node ?? globalExec?.node;
-	if (effectiveExecHost !== "node") return {
-		nativeToolSurfaceAllowed: true,
-		requestedExecHost,
-		effectiveExecHost,
-		node
-	};
 	return {
-		nativeToolSurfaceAllowed: false,
+		nativeToolSurfaceAllowed: effectiveExecHost !== "node",
 		requestedExecHost,
 		effectiveExecHost,
 		node,
-		blockReason: "OpenClaw exec host=node is active for this session. Codex app-server native execution cannot route shell, filesystem, MCP, or app-backed work through the selected OpenClaw node."
+		...effectiveExecHost === "node" ? { blockReason: "OpenClaw exec host=node is active for this session. Codex app-server native execution cannot route shell, filesystem, MCP, or app-backed work through the selected OpenClaw node." } : {}
 	};
 }
 /** Formats the user-facing explanation shown when native tools are blocked by exec host=node. */
@@ -77,9 +65,6 @@ function resolvePolicyAgentId(params) {
 	if (sessionAgentId) return sessionAgentId;
 	return tryResolveDefaultAgentId(params.config);
 }
-function resolvePolicyAgentExec(params) {
-	return resolveAgentConfig(params.config, params.agentId)?.tools?.exec;
-}
 function parseAgentIdFromSessionKey(sessionKey) {
 	const raw = sessionKey?.trim();
 	if (!raw) return;
@@ -92,15 +77,9 @@ function shouldReadRuntimeSessionEntry(params) {
 	const explicitAgentId = normalizeAgentIdOrDefault(params.agentId);
 	if (!explicitAgentId) return true;
 	const sessionAgentId = parseAgentIdFromSessionKey(params.sessionKey);
-	if (!sessionAgentId) return isDefaultAgentSessionKeyForAgent({
-		config: params.config,
-		agentId: explicitAgentId
-	});
+	if (!sessionAgentId) return normalizeAgentId(explicitAgentId) === tryResolveDefaultAgentId(params.config);
 	return sessionAgentId === explicitAgentId;
 }
-function isDefaultAgentSessionKeyForAgent(params) {
-	return normalizeAgentId(params.agentId) === tryResolveDefaultAgentId(params.config);
-}
 function normalizeAgentIdOrDefault(value) {
 	const normalized = normalizeAgentId(value);
 	return normalized === "main" && !(value ?? "").trim() ? void 0 : normalized;
@@ -109,10 +88,6 @@ function normalizeExecTarget(value) {
 	const normalized = value?.trim().toLowerCase();
 	if (normalized === "auto" || normalized === "sandbox" || normalized === "gateway" || normalized === "node") return normalized;
 }
-function resolveEffectiveExecHost(params) {
-	if (params.requestedExecHost === "auto") return params.sandboxAvailable ? "sandbox" : "gateway";
-	return params.requestedExecHost;
-}
 function readRuntimeSessionEntryBestEffort(params) {
 	try {
 		return getSessionEntry({