@openclaw/codex 2026.9.5 → 2026.9.7

package/dist/.setup/{plan-xD7WKYTM.mjs → plan-Y-QIvrKB.mjs}

@@ -1,6 +1,7 @@
-import { c as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-DUle8DLz.mjs";
-import "./config-CedDWjM-.mjs";
-import { c as resolveHomePath, i as hasCodexSource, l as sanitizeName, n as defaultCodexHome, o as exists, r as discoverCodexSource, s as readJsonObject, t as codexPluginMigrationSubscriptionWarning } from "./source-Bjp4UQij.mjs";
+import { u as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-Cky2XJUw.mjs";
+import { t as isOnlyMigrationKind } from "./scope-DOC1Xjc8.mjs";
+import "./config-DKhXquav.mjs";
+import { i as hasCodexSource, n as defaultCodexHome, o as readJsonObject, r as discoverCodexSource, s as sanitizeName, t as codexPluginMigrationSubscriptionWarning } from "./source-CS_7GFJZ.mjs";
 import { asBoolean, asOptionalRecord, isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash } from "node:crypto";
 import { runCommandBuffered } from "openclaw/plugin-sdk/process-runtime";
@@ -9,11 +10,12 @@ import fs from "node:fs/promises";
 import { canonicalPathFromExistingAncestor, isPathInside } from "openclaw/plugin-sdk/file-access-runtime";
 import { readSecretFile } from "openclaw/plugin-sdk/secret-file";
 import { fileURLToPath } from "node:url";
-import { loadAuthProfileStoreWithoutExternalProfiles, resolveAgentConfig, resolveAgentWorkspaceDir, resolveDefaultAgentId } from "openclaw/plugin-sdk/agent-runtime";
+import { loadAuthProfileStoreWithoutExternalProfiles } from "openclaw/plugin-sdk/agent-runtime";
 import { applyAuthProfileConfig, buildApiKeyCredential, buildOauthProviderAuthResult, buildOpenAICodexCredentialExtra, hasUsableOAuthCredential, resolveOpenAICodexAuthIdentity, resolveOpenAICodexImportProfileName, updateAuthProfileStoreWithLock } from "openclaw/plugin-sdk/provider-auth";
-import { extractErrorCode } from "openclaw/plugin-sdk/security-runtime";
+import { extractErrorCode, pathExists } from "openclaw/plugin-sdk/security-runtime";
 import { MIGRATION_REASON_TARGET_EXISTS, createMigrationItem, createMigrationManualItem, hasMigrationConfigPatchConflict, markMigrationItemConflict, markMigrationItemError, markMigrationItemSkipped, mergeMigrationConfigValue, readMigrationConfigPath, resolveMigrationConfigRuntime, summarizeMigrationItems } from "openclaw/plugin-sdk/migration";
-import { decodeOpenAICodexJwtPayload } from "openclaw/plugin-sdk/provider-oauth-runtime";
+import { resolvePlannedMigrationTargets } from "openclaw/plugin-sdk/migration-runtime";
+import { decodeOpenAICodexJwtPayload as decodeOpenAICodexJwtPayload$1 } from "openclaw/plugin-sdk/provider-oauth-runtime";
 //#region extensions/codex/src/migration/auth-profile-target.ts
 const OPENAI_PROVIDER_ID$1 = "openai";
 const LEGACY_CODEX_PROFILE_ID = "openai:default";
@@ -27,7 +29,7 @@ function findMatchingOAuthProfile(store, credential) {
 	}
 }
 function oauthSubject(credential) {
-	const claims = decodeOpenAICodexJwtPayload(credential.access)?.["https://api.openai.com/auth"];
+	const claims = decodeOpenAICodexJwtPayload$1(credential.access)?.["https://api.openai.com/auth"];
 	if (!isRecord(claims)) return;
 	const accountId = normalizeOptionalString(claims.chatgpt_account_id);
 	const userId = normalizeOptionalString(claims.chatgpt_user_id) ?? normalizeOptionalString(claims.user_id);
@@ -91,15 +93,16 @@ async function readDirectKeyring(home, signal) {
 		return;
 	}
 }
-async function readSelectedCredentialStorage(options, requireApiKey) {
+async function readCodexCliCredentialsAsync(options) {
 	options.signal?.throwIfAborted();
+	if (!options.allowKeychainPrompt) return;
 	const home = await fs.realpath(options.codexHome).catch(() => path.resolve(options.codexHome));
-	const { CodexAppServerClient } = await import("./client-vXs2929Q.mjs").then((n) => n.n);
-	const { resolveManagedCodexPackageEntrypoint, resolveManagedCodexNativeCommand } = await import("./managed-binary-DP6Rib3P.mjs").then((n) => n.n);
+	const { CodexAppServerClient } = await import("./client-N0JpgSzF.mjs").then((n) => n.n);
+	const { resolveManagedCodexPackageEntrypoint, resolveManagedCodexNativeCommand } = await import("./managed-binary-kiWRhNRE.mjs").then((n) => n.n);
 	const launcher = resolveManagedCodexPackageEntrypoint(path.dirname(fileURLToPath(import.meta.url)));
 	const command = launcher ? resolveManagedCodexNativeCommand(launcher) : void 0;
 	if (!command) return;
-	const signal = AbortSignal.any([AbortSignal.timeout(options.allowKeychainPrompt && process.platform === "darwin" ? 6e4 : 5e3), ...options.signal ? [options.signal] : []]);
+	const signal = AbortSignal.any([AbortSignal.timeout(process.platform === "darwin" ? 6e4 : 5e3), ...options.signal ? [options.signal] : []]);
 	const client = await CodexAppServerClient.start({
 		transport: "stdio",
 		command,
@@ -121,7 +124,7 @@ async function readSelectedCredentialStorage(options, requireApiKey) {
 	signal.addEventListener("abort", abort, { once: true });
 	let credential;
 	try {
-		credential = await readNativeCredential(client, home, requireApiKey, options, signal);
+		credential = await readNativeCredential(client, home, options, signal);
 	} catch {}
 	signal.removeEventListener("abort", abort);
 	const closed = await client.closeAndWait({
@@ -132,15 +135,11 @@ async function readSelectedCredentialStorage(options, requireApiKey) {
 	options.signal?.throwIfAborted();
 	return credential;
 }
-async function readNativeCredential(client, home, requireApiKey, options, signal) {
+async function readNativeCredential(client, home, options, signal) {
 	signal.throwIfAborted();
 	await client.initialize();
 	if (client.getRuntimeIdentity()?.codexHome !== home) return;
 	const revision = client.getModelCatalogRevision();
-	if (requireApiKey) {
-		const account = await client.request("account/read", { refreshToken: false }, { signal });
-		if (asOptionalRecord(account.account)?.type !== "apiKey" || account.requiresOpenaiAuth !== true) return;
-	}
 	const configured = await client.request("config/read", {
 		includeLayers: false,
 		cwd: home
@@ -148,7 +147,7 @@ async function readNativeCredential(client, home, requireApiKey, options, signal
 	const mode = (await client.request("configRequirements/read", {}, { signal })).requirements?.cli_auth_credentials_store ?? configured.config.cli_auth_credentials_store ?? "file";
 	let record;
 	if (mode === "file") record = await readAuthFile(home);
-	else if ((mode === "keyring" || mode === "auto") && process.platform === "darwin" && options.allowKeychainPrompt) {
+	else if ((mode === "keyring" || mode === "auto") && process.platform === "darwin") {
 		let cursor;
 		let encrypted;
 		do {
@@ -167,20 +166,26 @@ async function readNativeCredential(client, home, requireApiKey, options, signal
 		record = await readDirectKeyring(home, signal);
 	}
 	signal.throwIfAborted();
-	return !client.getCloseError() && client.getModelCatalogRevision() === revision ? record : void 0;
+	if (!record) return;
+	const oauth = options.credentialKind === "api_key" ? void 0 : parseOAuthCredential(record);
+	let apiKey = options.credentialKind === "oauth" ? void 0 : parseApiKeyCredential(record);
+	if (apiKey) {
+		const account = await client.request("account/read", { refreshToken: false }, { signal }).catch(() => void 0);
+		if (account?.account?.type !== "apiKey" || !account.requiresOpenaiAuth) apiKey = void 0;
+	}
+	signal.throwIfAborted();
+	return !client.getCloseError() && client.getModelCatalogRevision() === revision ? {
+		...oauth ? { oauth } : {},
+		...apiKey ? { apiKey } : {}
+	} : void 0;
 }
 function jwtExpiry(token) {
-	try {
-		const exp = asOptionalRecord(JSON.parse(Buffer.from(token.split(".")[1] ?? "", "base64url").toString("utf8")))?.exp;
-		return typeof exp === "number" && Number.isFinite(exp) && exp > 0 ? exp * 1e3 : void 0;
-	} catch {
-		return;
-	}
+	const exp = decodeOpenAICodexJwtPayload$1(token)?.exp;
+	return typeof exp === "number" && Number.isFinite(exp) && exp > 0 ? exp * 1e3 : void 0;
 }
-async function readCodexCliCredentialsAsync(options) {
-	const data = await readSelectedCredentialStorage(options, false);
-	const mode = typeof data?.auth_mode === "string" ? data.auth_mode.toLowerCase() : void 0;
-	if (!data || mode !== void 0 && mode !== "chatgpt" && mode !== "chatgptauthtokens") return;
+function parseOAuthCredential(data) {
+	const mode = typeof data.auth_mode === "string" ? data.auth_mode.toLowerCase() : void 0;
+	if (mode !== void 0 && mode !== "chatgpt" && mode !== "chatgptauthtokens") return;
 	const tokens = asOptionalRecord(data.tokens);
 	if (typeof tokens?.access_token !== "string" || !tokens.access_token || typeof tokens.refresh_token !== "string" || !tokens.refresh_token) return;
 	const lastRefresh = typeof data.last_refresh === "string" ? Date.parse(data.last_refresh) : NaN;
@@ -194,10 +199,9 @@ async function readCodexCliCredentialsAsync(options) {
 		...typeof tokens.id_token === "string" ? { idToken: tokens.id_token } : {}
 	};
 }
-async function readCodexCliActiveApiKeyAsync(options) {
-	const data = await readSelectedCredentialStorage(options, true);
-	const mode = typeof data?.auth_mode === "string" ? data.auth_mode.toLowerCase() : void 0;
-	if (!data || mode !== void 0 && mode !== "apikey" && mode !== "api_key") return;
+function parseApiKeyCredential(data) {
+	const mode = typeof data.auth_mode === "string" ? data.auth_mode.toLowerCase() : void 0;
+	if (mode !== void 0 && mode !== "apikey" && mode !== "api_key") return;
 	const key = typeof data.OPENAI_API_KEY === "string" ? data.OPENAI_API_KEY.trim() : "";
 	return key ? {
 		type: "api_key",
@@ -245,13 +249,7 @@ async function readModelRefs(source) {
 	refs.add(OPENAI_CODEX_DEFAULT_MODEL);
 	return [...refs].toSorted();
 }
-async function buildCodexOAuthCredential(source, includeConfigPatch, options) {
-	const credential = await readCodexCliCredentialsAsync({
-		codexHome: source.codexHome,
-		allowKeychainPrompt: options.allowKeychainPrompt,
-		...options.signal ? { signal: options.signal } : {}
-	});
-	if (!credential) return null;
+async function buildCodexOAuthCredential(source, credential, includeConfigPatch) {
 	const identity = resolveOpenAICodexAuthIdentity({
 		access: credential.access,
 		accountId: credential.accountId
@@ -281,39 +279,28 @@ async function buildCodexOAuthCredential(source, includeConfigPatch, options) {
 		result
 	} : null;
 }
-async function buildCodexApiKeyCredential(source, allowKeychainPrompt, signal) {
-	const credential = await readCodexCliActiveApiKeyAsync({
+async function readCodexAuthCredentials(source, options) {
+	const credentials = await readCodexCliCredentialsAsync({
 		codexHome: source.codexHome,
-		allowKeychainPrompt,
-		...signal ? { signal } : {}
+		credentialKind: options.credentialKind,
+		allowKeychainPrompt: options.allowKeychainPrompt,
+		...options.signal ? { signal: options.signal } : {}
 	});
-	if (!credential) return null;
-	return {
+	return [credentials?.oauth ? await buildCodexOAuthCredential(source, credentials.oauth, options.includeConfigPatch) : null, credentials?.apiKey ? {
 		kind: "api_key",
 		provider: OPENAI_PROVIDER_ID,
 		profileId: "openai:codex-import",
-		key: credential.key
-	};
-}
-async function readCodexAuthCredentials(source, options) {
-	return [options.credentialKind === "api_key" ? null : await buildCodexOAuthCredential(source, options.includeConfigPatch, {
-		allowKeychainPrompt: options.allowKeychainPrompt,
-		...options.signal ? { signal: options.signal } : {}
-	}), options.credentialKind === "oauth" ? null : await buildCodexApiKeyCredential(source, options.allowKeychainPrompt, options.signal)].filter((entry) => entry !== null);
+		key: credentials.apiKey.key
+	} : null].filter((entry) => entry !== null);
 }
 function replaceConfigDraft(draft, next) {
 	for (const key of Object.keys(draft)) delete draft[key];
 	Object.assign(draft, next);
 }
-function existingAuthProfileConfigIsCompatible(existing, profile) {
-	if (existing.provider !== profile.provider || existing.mode !== profile.mode) return false;
-	if (existing.email && profile.email && existing.email !== profile.email) return false;
-	return true;
-}
 function hasAuthProfileConfigConflict(config, profile, overwrite) {
 	if (overwrite) return false;
 	const existing = config.auth?.profiles?.[profile.profileId];
-	return Boolean(existing && !existingAuthProfileConfigIsCompatible(existing, profile));
+	return Boolean(existing && (existing.provider !== profile.provider || existing.mode !== profile.mode || existing.email && profile.email && existing.email !== profile.email));
 }
 function hasCurrentAuthProfileConfigConflict(ctx, profile) {
 	let config = ctx.config;
@@ -339,34 +326,13 @@ function applyDefaultModelIfMissing(cfg) {
 		}
 	};
 }
-function applyOAuthConfigToConfig(cfg, credential, profileId) {
-	let next = mergeMigrationConfigValue(cfg, credential.result.configPatch);
-	const profile = credential.result.profiles[0];
-	if (profile) next = applyAuthProfileConfig(next, {
-		profileId,
-		provider: profile.credential.provider,
-		mode: "oauth",
-		..."email" in profile.credential && profile.credential.email ? { email: profile.credential.email } : {},
-		..."displayName" in profile.credential && profile.credential.displayName ? { displayName: profile.credential.displayName } : {},
-		preferProfileFirst: false
-	});
-	return applyDefaultModelIfMissing(next);
-}
-function applyApiKeyConfigToConfig(cfg, credential, profileId) {
-	return applyAuthProfileConfig(cfg, {
-		profileId,
-		provider: credential.provider,
-		mode: "api_key",
-		displayName: CODEX_IMPORT_DISPLAY_NAME,
-		preferProfileFirst: false
-	});
-}
 function resolveCodexConfigPatchMode(ctx) {
 	const mode = ctx.providerOptions?.configPatchMode;
 	return mode === "none" || mode === "return" ? mode : "apply";
 }
 function allowCodexKeychainPrompt(ctx) {
-	return ctx.providerOptions?.allowKeychainPrompt === true;
+	const explicit = ctx.providerOptions?.allowKeychainPrompt;
+	return typeof explicit === "boolean" ? explicit : ctx.includeSecrets === true;
 }
 function resolveRequestedCredentialKind(ctx) {
 	const kind = ctx.providerOptions?.credentialKind;
@@ -397,9 +363,8 @@ async function applyCodexAuthProfileConfig(ctx, profile, applyConfig) {
 			base: "runtime",
 			afterWrite: { mode: "auto" },
 			mutate(draft) {
-				const current = draft;
-				if (hasAuthProfileConfigConflict(current, profile, Boolean(ctx.overwrite))) throw new CodexAuthConfigConflict();
-				replaceConfigDraft(draft, applyConfig(current));
+				if (hasAuthProfileConfigConflict(draft, profile, Boolean(ctx.overwrite))) throw new CodexAuthConfigConflict();
+				replaceConfigDraft(draft, applyConfig(draft));
 			}
 		});
 		return "configured";
@@ -407,41 +372,42 @@ async function applyCodexAuthProfileConfig(ctx, profile, applyConfig) {
 		return error instanceof CodexAuthConfigConflict ? "conflict" : "unavailable";
 	}
 }
-async function applyCodexAuthConfig(ctx, credential, profileId) {
-	const profile = authProfileConfigForCredential(credential, profileId);
-	if (!profile) return "unavailable";
-	return applyCodexAuthProfileConfig(ctx, profile, (config) => applyCredentialConfig(config, credential, profileId));
-}
 function applyCredentialConfig(config, credential, profileId) {
-	return credential.kind === "oauth" ? applyOAuthConfigToConfig(config, credential, profileId) : applyApiKeyConfigToConfig(config, credential, profileId);
+	let next = credential.kind === "oauth" ? mergeMigrationConfigValue(config, credential.result.configPatch) : config;
+	const profile = authProfileConfigForCredential(credential, profileId);
+	if (profile) next = applyAuthProfileConfig(next, {
+		...profile,
+		preferProfileFirst: false
+	});
+	return credential.kind === "oauth" ? applyDefaultModelIfMissing(next) : next;
 }
 async function buildCodexAuthItems(params) {
 	const configPatchMode = resolveCodexConfigPatchMode(params.ctx);
+	const allowKeychainPrompt = allowCodexKeychainPrompt(params.ctx);
 	const credentials = await readCodexAuthCredentials(params.source, {
 		credentialKind: resolveRequestedCredentialKind(params.ctx),
 		includeConfigPatch: configPatchMode !== "none",
-		allowKeychainPrompt: allowCodexKeychainPrompt(params.ctx),
+		allowKeychainPrompt,
 		signal: params.ctx.signal
 	});
 	if (credentials.length === 0) {
 		const requestedKind = resolveRequestedCredentialKind(params.ctx);
-		if (!requestedKind) return [];
-		const credentialKind = requestedKind;
-		return [createMigrationItem({
-			id: credentialKind === "oauth" ? OPENAI_OAUTH_ITEM_ID : OPENAI_API_KEY_ITEM_ID,
+		if (!requestedKind && allowKeychainPrompt) return [];
+		return (requestedKind ? [requestedKind] : ["oauth", "api_key"]).map((credentialKind) => createMigrationItem({
+			id: credentialKind === "api_key" ? OPENAI_API_KEY_ITEM_ID : OPENAI_OAUTH_ITEM_ID,
 			kind: "auth",
 			action: "skip",
 			source: params.source.codexHome,
 			status: "skipped",
 			sensitive: true,
-			reason: CODEX_REASON_AUTH_STORAGE_NOT_IMPORTABLE,
-			message: "No supported Codex credential could be imported. Continue with sign-in to connect OpenClaw.",
+			reason: allowKeychainPrompt ? CODEX_REASON_AUTH_STORAGE_NOT_IMPORTABLE : void 0,
+			message: allowKeychainPrompt ? "No supported Codex credential could be imported. Continue with sign-in to connect OpenClaw." : "Codex credentials have not been inspected. Confirm credential import to check the current Codex sign-in.",
 			details: {
 				provider: OPENAI_PROVIDER_ID,
 				credentialKind,
 				credentialImportUnavailable: true
 			}
-		})];
+		}));
 	}
 	const store = loadAuthProfileStoreWithoutExternalProfiles(params.targets.agentDir);
 	const skipped = !params.ctx.includeSecrets;
@@ -475,7 +441,24 @@ async function buildCodexAuthItems(params) {
 		});
 	});
 }
-async function applyCodexAuthItems(params) {
+function createCodexAuthItemApplier(params) {
+	const { items, ...context } = params;
+	const selectedKinds = new Set(items.filter((item) => item.kind === "auth" && item.status === "planned").map((item) => item.details?.credentialKind));
+	const selectedKind = selectedKinds.size === 1 ? selectedKinds.values().next().value : void 0;
+	let snapshot;
+	const readCredentials = () => snapshot ??= readCodexAuthCredentials(context.source, {
+		credentialKind: selectedKind === "oauth" || selectedKind === "api_key" ? selectedKind : void 0,
+		includeConfigPatch: resolveCodexConfigPatchMode(context.ctx) !== "none",
+		allowKeychainPrompt: allowCodexKeychainPrompt(context.ctx),
+		signal: context.ctx.signal
+	});
+	return (item) => applyCodexAuthItem({
+		...context,
+		item,
+		readCredentials
+	});
+}
+async function applyCodexAuthItem(params) {
 	const { ctx, item, source, targets } = params;
 	if (item.status !== "planned") return [item];
 	const profileId = typeof item.details?.profileId === "string" ? item.details.profileId : "";
@@ -484,14 +467,11 @@ async function applyCodexAuthItems(params) {
 	const credentialKind = item.details?.credentialKind;
 	if (!profileId || !provider || credentialKind !== "oauth" && credentialKind !== "api_key") return [markMigrationItemError(item, CODEX_REASON_MISSING_AUTH_METADATA)];
 	const configPatchMode = resolveCodexConfigPatchMode(ctx);
-	const credential = (await readCodexAuthCredentials(source, {
-		credentialKind,
-		includeConfigPatch: configPatchMode !== "none",
-		allowKeychainPrompt: allowCodexKeychainPrompt(ctx),
-		signal: ctx.signal
-	})).find((candidate) => candidate.provider === provider && candidate.kind === credentialKind && (!sourceProfileId || candidate.profileId === sourceProfileId));
-	if (!credential) return [markMigrationItemSkipped(item, CODEX_REASON_AUTH_NO_LONGER_PRESENT)];
-	if (item.details?.sourceCredentialFingerprint !== sourceCredentialFingerprint(credential)) return [markMigrationItemSkipped(item, CODEX_REASON_AUTH_NO_LONGER_PRESENT)];
+	ctx.signal?.throwIfAborted();
+	const credentials = await params.readCredentials();
+	ctx.signal?.throwIfAborted();
+	const credential = credentials.find((candidate) => candidate.provider === provider && candidate.kind === credentialKind && (!sourceProfileId || candidate.profileId === sourceProfileId));
+	if (!credential || item.details?.sourceCredentialFingerprint !== sourceCredentialFingerprint(credential)) return [markMigrationItemSkipped(item, CODEX_REASON_AUTH_NO_LONGER_PRESENT)];
 	if (item.details?.legacyNativeHome !== void 0 && (item.details.legacyNativeHome !== source.codexHome || source.codexHome !== defaultCodexHome())) return [markMigrationItemSkipped(item, CODEX_REASON_AUTH_NO_LONGER_PRESENT)];
 	ctx.signal?.throwIfAborted();
 	const oauthProfile = credential.kind === "oauth" ? credential.result.profiles[0] : void 0;
@@ -536,7 +516,7 @@ async function applyCodexAuthItems(params) {
 	if (conflicted) return [markMigrationItemConflict(item, CODEX_REASON_AUTH_PROFILE_EXISTS)];
 	if (unusable) return [markMigrationItemSkipped(item, CODEX_REASON_AUTH_PROFILE_UNUSABLE)];
 	if (!store || !loadAuthProfileStoreWithoutExternalProfiles(targets.agentDir).profiles[profileId]) return [markMigrationItemError(item, CODEX_REASON_AUTH_PROFILE_WRITE_FAILED)];
-	const configResult = configPatchMode !== "apply" ? "unavailable" : await applyCodexAuthConfig(ctx, credential, profileId);
+	const configResult = configPatchMode !== "apply" ? "unavailable" : await applyCodexAuthProfileConfig(ctx, configProfile, (config) => applyCredentialConfig(config, credential, profileId));
 	if (configResult === "conflict") return [markMigrationItemConflict(item, CODEX_REASON_AUTH_PROFILE_EXISTS)];
 	const migratedItem = {
 		...item,
@@ -552,44 +532,28 @@ async function applyCodexAuthItems(params) {
 }
 function buildCodexAuthConfigPatchItems(ctx, item, credential, profileId) {
 	const next = applyCredentialConfig(ctx.config, credential, profileId);
-	const items = [];
-	if (next.auth) items.push(createMigrationItem({
-		id: `${item.id}:config:auth`,
+	return [{
+		suffix: "auth",
+		path: ["auth"],
+		value: next.auth,
+		message: "Configure imported Codex auth profile."
+	}, {
+		suffix: "agents-defaults",
+		path: ["agents", "defaults"],
+		value: next.agents?.defaults,
+		message: "Configure imported Codex models."
+	}].flatMap(({ suffix, path, value, message }) => value ? [createMigrationItem({
+		id: `${item.id}:config:${suffix}`,
 		kind: "config",
 		action: "merge",
 		status: "migrated",
-		target: "auth",
-		message: "Configure imported Codex auth profile.",
+		target: path.join("."),
+		message,
 		details: {
-			path: ["auth"],
-			value: next.auth
-		}
-	}));
-	if (next.agents?.defaults) items.push(createMigrationItem({
-		id: `${item.id}:config:agents-defaults`,
-		kind: "config",
-		action: "merge",
-		status: "migrated",
-		target: "agents.defaults",
-		message: "Configure imported Codex models.",
-		details: {
-			path: ["agents", "defaults"],
-			value: next.agents.defaults
+			path,
+			value
 		}
-	}));
-	return items;
-}
-//#endregion
-//#region extensions/codex/src/migration/targets.ts
-function resolveCodexMigrationTargets(ctx) {
-	const cfg = ctx.config;
-	const agentId = ctx.targetAgentId ?? resolveDefaultAgentId(cfg);
-	const workspaceDir = resolveAgentWorkspaceDir(cfg, agentId);
-	const configuredAgentDir = resolveAgentConfig(cfg, agentId)?.agentDir?.trim();
-	return {
-		workspaceDir,
-		agentDir: ctx.runtime?.agent?.resolveAgentDir(cfg, agentId) ?? (configuredAgentDir ? resolveHomePath(configuredAgentDir) : void 0) ?? path.join(ctx.stateDir, "agents", agentId, "agent")
-	};
+	})] : []);
 }
 //#endregion
 //#region extensions/codex/src/migration/plan.ts
@@ -690,7 +654,7 @@ async function buildCodexSkillItems(params) {
 	}, /* @__PURE__ */ new Map());
 	return await Promise.all(planned.map(async (item) => {
 		const collision = (resolvedCounts.get(item.name) ?? 0) > 1;
-		const targetExists = await exists(item.target);
+		const targetExists = await pathExists(item.target);
 		const conflict = collision || targetExists && !params.overwrite;
 		return createMigrationItem({
 			id: `skill:${item.name}`,
@@ -715,10 +679,7 @@ function readExistingCodexPluginEntries(config) {
 function hasExistingCodexPluginEntry(existingEntries, configKey, pluginName, nextEntry) {
 	const existingEntry = existingEntries[configKey];
 	if (existingEntry !== void 0) return !isLegacyDestructivePolicyRepair(existingEntry, nextEntry);
-	return Object.values(existingEntries).some((entry) => {
-		if (!isRecord(entry)) return false;
-		return entry.pluginName === pluginName;
-	});
+	return Object.values(existingEntries).some((entry) => isRecord(entry) && entry.pluginName === pluginName);
 }
 function isLegacyDestructivePolicyRepair(existing, nextEntry) {
 	const existingEntry = isRecord(existing) ? existing : void 0;
@@ -743,14 +704,12 @@ function buildPluginItems(ctx, plugins) {
 	for (const plugin of plugins) {
 		if (plugin.migratable && plugin.marketplaceName === "openai-curated" && plugin.pluginName) {
 			const configKey = plugin.pluginName;
+			const allowDestructiveActions = readExistingPluginAllowDestructiveActions(existingPluginEntries[configKey], plugin.pluginName);
 			const plannedEntry = {
 				enabled: true,
 				marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
 				pluginName: plugin.pluginName,
-				...(() => {
-					const allowDestructiveActions = readExistingPluginAllowDestructiveActions(existingPluginEntries[configKey], plugin.pluginName);
-					return allowDestructiveActions ? { allow_destructive_actions: allowDestructiveActions } : {};
-				})()
+				...allowDestructiveActions ? { allow_destructive_actions: allowDestructiveActions } : {}
 			};
 			const conflict = !ctx.overwrite && hasExistingCodexPluginEntry(existingPluginEntries, configKey, plugin.pluginName, plannedEntry);
 			items.push(createMigrationItem({
@@ -769,8 +728,8 @@ function buildPluginItems(ctx, plugins) {
 					pluginName: plugin.pluginName,
 					sourceInstalled: plugin.installed === true,
 					sourceEnabled: plugin.enabled === true,
-					...plannedEntry.allow_destructive_actions === "auto" || plannedEntry.allow_destructive_actions === "ask" ? { allowDestructiveActions: plannedEntry.allow_destructive_actions } : {},
-					...plugin.apps && plugin.apps.length > 0 && !shouldVerifyPluginApps(ctx) ? { sourceAppVerification: CODEX_PLUGIN_SOURCE_APP_VERIFICATION_UNVERIFIED } : {}
+					...allowDestructiveActions ? { allowDestructiveActions } : {},
+					...plugin.apps && plugin.apps.length > 0 && ctx.providerOptions?.verifyPluginApps !== true ? { sourceAppVerification: CODEX_PLUGIN_SOURCE_APP_VERIFICATION_UNVERIFIED } : {}
 				}
 			}));
 			continue;
@@ -803,9 +762,6 @@ function buildPluginItems(ctx, plugins) {
 	}
 	return items;
 }
-function shouldVerifyPluginApps(ctx) {
-	return ctx.providerOptions?.verifyPluginApps === true;
-}
 function readCodexPluginMigrationConfigEntry(item, enabled) {
 	const configKey = item.details?.configKey;
 	const marketplaceName = item.details?.marketplaceName;
@@ -896,15 +852,15 @@ function buildPluginConfigItem(ctx, pluginItems) {
 	});
 }
 async function buildCodexMigrationPlan(ctx) {
-	const targets = resolveCodexMigrationTargets(ctx);
-	const memoryOnly = ctx.itemKinds !== void 0 && ctx.itemKinds.length > 0 && ctx.itemKinds.every((kind) => kind === "memory");
-	const authOnly = ctx.itemKinds !== void 0 && ctx.itemKinds.length > 0 && ctx.itemKinds.every((kind) => kind === "auth");
+	const targets = resolvePlannedMigrationTargets(ctx);
+	const memoryOnly = isOnlyMigrationKind(ctx, "memory");
+	const authOnly = isOnlyMigrationKind(ctx, "auth");
 	const source = await discoverCodexSource({
 		input: ctx.source,
 		memoryOnly,
 		authOnly,
 		evaluatePluginMigrationEligibility: !memoryOnly && !authOnly,
-		verifyPluginApps: shouldVerifyPluginApps(ctx)
+		verifyPluginApps: ctx.providerOptions?.verifyPluginApps === true
 	});
 	if (!hasCodexSource(source) && !authOnly) throw new Error(`Codex state was not found at ${source.root}. Pass --from <path> if it lives elsewhere.`);
 	const items = [];
@@ -938,7 +894,6 @@ async function buildCodexMigrationPlan(ctx) {
 		}));
 	}
 	const warnings = [
-		...!ctx.includeSecrets && items.some((item) => item.kind === "auth") ? ["Auth credentials were detected but skipped. Re-run interactively or pass --include-secrets to import supported credentials."] : [],
 		...items.some((item) => item.status === "conflict") ? ["Conflicts were found. Re-run with --overwrite to replace conflicting migration targets after item-level backups."] : [],
 		...source.pluginDiscoveryError ? [`Codex app-server plugin inventory discovery failed: ${source.pluginDiscoveryError}. Cached plugin bundles, if any, are advisory only.`] : [],
 		...source.plugins.some((plugin) => plugin.migrationBlock?.code === "codex_subscription_required") ? [codexPluginMigrationSubscriptionWarning()] : []
@@ -960,4 +915,4 @@ async function buildCodexMigrationPlan(ctx) {
 	};
 }
 //#endregion
-export { CODEX_PLUGIN_CONFIG_ITEM_ID, CODEX_PLUGIN_CONFIG_PATH, buildCodexMigrationPlan, buildCodexPluginsConfigValue, hasCodexPluginConfigConflict, applyCodexAuthItems as n, resolveCodexConfigPatchMode as r, readCodexPluginMigrationConfigEntry, resolveCodexMigrationTargets as t };
+export { CODEX_PLUGIN_CONFIG_ITEM_ID, CODEX_PLUGIN_CONFIG_PATH, buildCodexMigrationPlan, buildCodexPluginsConfigValue, hasCodexPluginConfigConflict, resolveCodexConfigPatchMode as n, readCodexPluginMigrationConfigEntry, createCodexAuthItemApplier as t };

package/dist/.setup/{plugin-activation-r8nq5Jzp.mjs → plugin-activation-cNHRfaxU.mjs}

@@ -1,12 +1,8 @@
-import { c as CODEX_PLUGINS_MARKETPLACE_NAME, i as pluginReadParams, n as isOpenAiCuratedMarketplace, r as isOpenAiCuratedMarketplaceName, t as findCodexMarketplacePluginSummary } from "./plugin-inventory-DUle8DLz.mjs";
-import { i as CodexAppServerRpcError } from "./timeout-DZF05XrR.mjs";
-import "./config-CedDWjM-.mjs";
+import { i as listCodexPluginMetadata, n as isOpenAiCuratedMarketplace, o as pluginReadParams, r as isOpenAiCuratedMarketplaceName, t as findCodexMarketplacePluginSummary, u as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-Cky2XJUw.mjs";
+import { n as CodexAppServerRpcError } from "./rpc-error-BlD2vuzn.mjs";
+import "./config-DKhXquav.mjs";
 import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 //#region extensions/codex/src/app-server/plugin-activation.ts
-/**
-* Activates legacy curated Codex plugins while requiring owner-managed
-* installation for every other marketplace.
-*/
 /** Activates legacy curated plugins without granting install authority to other marketplaces. */
 async function ensureCodexPluginActivation(params) {
 	if (params.identity.marketplaceName === "workspace-directory") return activationFailure(params.identity, "disabled", { message: "workspace-directory plugins must be installed and enabled outside OpenClaw before use." });
@@ -14,7 +10,7 @@ async function ensureCodexPluginActivation(params) {
 		const target = params.identity.pluginName.endsWith(`@${params.identity.marketplaceName}`) ? params.identity.pluginName : `${params.identity.pluginName}@${params.identity.marketplaceName}`;
 		return activationFailure(params.identity, "disabled", { message: `${params.identity.marketplaceName} plugins must be installed and enabled by an owner before use. Run /codex plugins install ${target}.` });
 	}
-	const listed = await listCuratedCodexPluginMetadata(params);
+	const listed = await listCodexPluginMetadata(params, CODEX_PLUGINS_MARKETPLACE_NAME);
 	const resolved = findCodexMarketplacePluginSummary(listed, params.identity.marketplaceName, params.identity.pluginName);
 	if (!resolved) {
 		if (!listed.marketplaces.some((marketplace) => isOpenAiCuratedMarketplace(marketplace))) return activationFailure(params.identity, "marketplace_missing", { message: `Codex marketplace ${CODEX_PLUGINS_MARKETPLACE_NAME} was not found.` });
@@ -45,19 +41,10 @@ async function ensureCodexPluginActivation(params) {
 			diagnostics: [{ message: `Codex plugin install failed: ${coerceErrorMessage(error)}` }]
 		};
 	}
-	if (params.metadataCache && params.appCacheKey) params.metadataCache.invalidate(params.appCacheKey);
 	const refreshDiagnostics = [];
 	let refreshFailed = false;
 	try {
-		const refreshResult = await refreshCodexPluginRuntimeState({
-			request: params.request,
-			appCache: params.appCache,
-			appCacheKey: params.appCacheKey,
-			configCwd: params.configCwd,
-			metadataCache: params.metadataCache,
-			deferAppInventoryRefresh: params.deferAppInventoryRefresh,
-			targetAppIds: params.targetAppIds
-		});
+		const refreshResult = await refreshCodexPluginRuntimeState(params);
 		refreshDiagnostics.push(...refreshResult.diagnostics);
 	} catch (error) {
 		refreshFailed = true;
@@ -74,25 +61,15 @@ async function ensureCodexPluginActivation(params) {
 		diagnostics: [...refreshDiagnostics, ...installResponse.appsNeedingAuth.map((app) => ({ message: `${app.name} requires app authentication before plugin tools are exposed.` }))]
 	};
 }
-/** Forces Codex plugin, skill, hook, MCP, and app inventory refreshes after activation. */
 async function refreshCodexPluginRuntimeState(params) {
 	const diagnostics = [];
-	await listCuratedCodexPluginMetadata(params, { forceRefetch: true });
-	await params.request("skills/list", {
-		cwds: params.configCwd ? [params.configCwd] : [],
-		forceReload: true
-	});
-	try {
-		await params.request("hooks/list", { cwds: params.configCwd ? [params.configCwd] : [] });
-	} catch (error) {
-		diagnostics.push({ message: `Codex hooks refresh skipped: ${coerceErrorMessage(error)}` });
-	}
-	await params.request("config/mcpServer/reload", void 0);
+	if (params.appCacheKey) params.metadataCache?.invalidate(params.appCacheKey);
+	await listCodexPluginMetadata(params, CODEX_PLUGINS_MARKETPLACE_NAME, { forceRefetch: true });
 	if (params.appCache && params.appCacheKey) try {
 		await refreshCodexAppRuntimeState({
 			...params,
 			appCache: params.appCache,
-			appCacheKey: params.appCacheKey
+			appCacheKey: params.appInventoryCacheKey ?? params.appCacheKey
 		});
 	} catch (error) {
 		diagnostics.push({ message: `Codex app inventory refresh skipped: ${coerceErrorMessage(error)}` });
@@ -111,27 +88,13 @@ async function refreshCodexAppRuntimeState(params) {
 		targetAppIds: params.targetAppIds
 	});
 }
-async function listCuratedCodexPluginMetadata(params, options = {}) {
-	const requestParams = {
-		...params.configCwd ? { cwds: [params.configCwd] } : {},
-		...options.forceRefetch ? { forceRefetch: true } : {}
-	};
-	if (!params.metadataCache || !params.appCacheKey) return await params.request("plugin/list", requestParams);
-	return (await params.metadataCache.load({
-		appCacheKey: params.appCacheKey,
-		queryKind: "curated-global",
-		requestParams,
-		request: async (method, listedParams) => await params.request(method, listedParams),
-		cacheable: (response) => response.marketplaces.some((marketplace) => isOpenAiCuratedMarketplace(marketplace))
-	})).response;
-}
-function activationFailure(identity, reason, diagnostic, extraDiagnostics = []) {
+function activationFailure(identity, reason, diagnostic) {
 	return {
 		identity,
 		ok: false,
 		reason,
 		installAttempted: false,
-		diagnostics: [diagnostic, ...extraDiagnostics]
+		diagnostics: [diagnostic]
 	};
 }
 //#endregion