@openclaw/codex 2026.9.5 → 2026.9.7

package/dist/.setup/{bounded-turn-BtlZcivC.mjs → bounded-turn-CbjoN2OW.mjs}

@@ -1,17 +1,80 @@
-import { i as readCodexAppServerConfigOptions } from "./launch-args-DnMak49W.mjs";
-import { C as readCodexErrorNotification, E as createCodexElicitationResponse, b as assertCodexThreadStartResponse, x as assertCodexTurnStartResponse } from "./client-vXs2929Q.mjs";
-import "./config-CedDWjM-.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-CeAhl_h4.mjs";
-import { u as isCodexAppServerStartSelectionChangedError } from "./shared-client-BpTtuLQ5.mjs";
-import { a as closeCodexStartupClientBestEffort, o as interruptCodexTurnAndWaitBestEffort, t as CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS } from "./attempt-client-cleanup-BpYKdTA0.mjs";
-import { t as CodexEphemeralTurn } from "./ephemeral-turn-R1gA8Sn6.mjs";
-import { r as readModelListResult } from "./models-BDFgm_G-.mjs";
-import { Ot as mergeCodexThreadConfigs, S as readCodexInheritedMcpServerNames, b as buildCodexRuntimeThreadConfig, q as attestCodexRestrictedToolSurfaceMcpServersDisabled, v as assertCodexManagedRequirementsDoNotOverrideToolPolicy, y as buildCodexRingZeroThreadConfigPatch } from "./thread-lifecycle-Cik28qWn.mjs";
-import { a as resolveCodexPromptError } from "./usage-limit-error-C0ow7DOc.mjs";
+import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
+import { a as resolveCodexPrivateLauncher, i as readCodexAppServerConfigOptions } from "./launch-args-DbFCehO7.mjs";
+import { d as readCodexEffectiveConfig } from "./config-options-CzyWLTJt.mjs";
+import "./config-DKhXquav.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-C0NbLms1.mjs";
+import { u as isCodexAppServerStartSelectionChangedError } from "./shared-client-DqyTMYug.mjs";
+import { S as assertCodexTurnStartResponse, T as readCodexErrorNotification, k as createCodexElicitationResponse, x as assertCodexThreadStartResponse } from "./client-N0JpgSzF.mjs";
+import { o as closeCodexStartupClientBestEffort, s as interruptCodexTurnAndWaitBestEffort, t as CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS } from "./attempt-client-cleanup-DOP-cW5j.mjs";
+import { t as CodexEphemeralTurn } from "./ephemeral-turn-CDsPJOa2.mjs";
+import { i as readModelListResult } from "./models-DHXZtVVk.mjs";
+import { R as attestCodexRestrictedToolSurfaceMcpServersDisabled, St as mergeCodexThreadConfigs, l as readCodexInheritedMcpServerNames, n as buildCodexRingZeroThreadConfigPatch, r as buildCodexRuntimeThreadConfig, t as assertCodexManagedRequirementsDoNotOverrideToolPolicy } from "./thread-requests-B_bRnMGN.mjs";
+import { S as resolveCodexAppServerReasoningEffort } from "./thread-lifecycle-DPflntEJ.mjs";
+import { a as resolveCodexPromptError } from "./usage-limit-error-QXerDo3i.mjs";
 import { resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
+import { parse } from "smol-toml";
 import path from "node:path";
 import fs from "node:fs/promises";
+import { canonicalPathFromExistingAncestor, isPathInside } from "openclaw/plugin-sdk/file-access-runtime";
 import { resolvePreferredOpenClawTmpDir, withTempWorkspace } from "openclaw/plugin-sdk/temp-path";
+//#region extensions/codex/src/app-server/bounded-hook-policy.ts
+function assertNoHookDeclarations(config) {
+	if (config.hooks === void 0) return;
+	if (!isJsonObject(config.hooks) || Object.entries(config.hooks).some(([event, value]) => event === "state" ? !isJsonObject(value) : !Array.isArray(value) || value.length > 0)) throw new Error("Codex private completion received unmanaged hook declarations");
+}
+async function assertPrivateLayerPath(value, root) {
+	if (typeof value !== "string" || !path.isAbsolute(value) || !isPathInside(root, await canonicalPathFromExistingAncestor(value))) throw new Error("Codex private completion inherited an external user or project config layer");
+}
+/** Proves hook discovery is confined to managed policy and this completion's private roots. */
+async function assertCodexPrivateHookIsolation(client, workspace, signal) {
+	signal?.throwIfAborted();
+	const [codexHome, cwd] = await Promise.all([fs.realpath(workspace.codexHome), fs.realpath(workspace.cwd)]);
+	const response = await readCodexEffectiveConfig(client, cwd, { signal });
+	const features = response.config.features;
+	if (!isJsonObject(features) || typeof features.hooks !== "boolean" || features.plugins !== false || !Array.isArray(response.config.project_root_markers) || response.config.project_root_markers.length !== 0) throw new Error("Codex private completion could not verify isolated hook discovery settings");
+	if (!Array.isArray(response.layers)) throw new Error("Codex private completion config/read omitted config layers");
+	let privateUserLayer = false;
+	for (const layer of response.layers) {
+		if (!isJsonObject(layer) || !isJsonObject(layer.name) || !isJsonObject(layer.config)) throw new Error("Codex private completion config/read returned invalid config layers");
+		switch (layer.name.type) {
+			case "user":
+				await assertPrivateLayerPath(layer.name.file, codexHome);
+				privateUserLayer = true;
+				break;
+			case "project":
+				await assertPrivateLayerPath(layer.name.dotCodexFolder, cwd);
+				break;
+			case "packagedDefaults":
+			case "sessionFlags":
+				assertNoHookDeclarations(layer.config);
+				break;
+			case "system":
+			case "mdm":
+			case "enterpriseManaged": break;
+			default: throw new Error("Codex private completion received an unsupported config layer");
+		}
+	}
+	if (!privateUserLayer) throw new Error("Codex private completion could not verify its private Codex home");
+	signal?.throwIfAborted();
+	if (!features.hooks) {
+		const requirementsResponse = await client.request("configRequirements/read", {}, { signal });
+		if (!isJsonObject(requirementsResponse) || !isJsonObject(requirementsResponse.requirements) || !isJsonObject(requirementsResponse.requirements.featureRequirements) || requirementsResponse.requirements.featureRequirements.hooks !== false) throw new Error("Codex private completion cannot disable hooks without a managed requirement");
+		return { activeManagedHooks: false };
+	}
+	const inventory = await client.request("hooks/list", { cwds: [cwd] }, { signal });
+	if (!isJsonObject(inventory) || !Array.isArray(inventory.data) || inventory.data.length !== 1 || inventory.nextCursor !== void 0 && inventory.nextCursor !== null) throw new Error("Codex private completion received an incomplete hook inventory");
+	const entry = inventory.data[0];
+	if (!isJsonObject(entry) || entry.cwd !== cwd || !Array.isArray(entry.hooks) || !Array.isArray(entry.errors) || entry.errors.length !== 0 || !Array.isArray(entry.warnings) || entry.warnings.length !== 0) throw new Error("Codex private completion could not verify its hook inventory");
+	let activeManagedHooks = false;
+	for (const hook of entry.hooks) {
+		if (!isJsonObject(hook) || typeof hook.key !== "string" || !hook.key.trim() || typeof hook.enabled !== "boolean" || typeof hook.isManaged !== "boolean") throw new Error("Codex private completion received invalid hook metadata");
+		if (hook.enabled && !hook.isManaged) throw new Error("Codex private completion cannot run unmanaged hooks");
+		activeManagedHooks ||= hook.enabled && hook.isManaged;
+	}
+	signal?.throwIfAborted();
+	return { activeManagedHooks };
+}
+//#endregion
 //#region extensions/codex/src/app-server/bounded-turn.ts
 const CODEX_APP_SERVER_ARGS_ENV_KEY = "OPENCLAW_CODEX_APP_SERVER_ARGS";
 const CODEX_BOUNDED_THREAD_CONFIG = {
@@ -26,6 +89,7 @@ const CODEX_BOUNDED_THREAD_CONFIG = {
 };
 const CODEX_PRIVATE_BOUNDED_THREAD_CONFIG = {
 	"features.hooks": false,
+	project_root_markers: [],
 	notify: []
 };
 const CODEX_SETTLED_FINALIZER_THREAD_CONFIG = {
@@ -68,7 +132,7 @@ async function runBoundedCodexAppServerTurnInWorkspace(params, appServer, worksp
 	if (timeoutMs <= 0) throw timeoutError;
 	params.assertCurrent?.();
 	const agentDir = params.agentDir?.trim() || void 0;
-	const startOptions = workspace.codexHome ? buildPrivateCodexAppServerStartOptions(appServer.start, workspace.codexHome) : appServer.start;
+	const startOptions = workspace.codexHome ? buildPrivateCodexAppServerStartOptions(appServer.start, workspace.codexHome, workspace.cwd, params.requireNoExternalCapabilities === true) : appServer.start;
 	const ownsClient = !params.options.clientFactory;
 	const clientOptions = {
 		startOptions,
@@ -80,7 +144,7 @@ async function runBoundedCodexAppServerTurnInWorkspace(params, appServer, worksp
 		assertCurrent: params.assertCurrent,
 		...params.signal ? { abandonSignal: params.signal } : {}
 	};
-	const client = params.options.clientFactory ? await params.options.clientFactory(clientOptions) : await import("./shared-client-BpTtuLQ5.mjs").then((n) => n.y).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
+	const client = params.options.clientFactory ? await params.options.clientFactory(clientOptions) : await import("./shared-client-DqyTMYug.mjs").then((n) => n.v).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
 		...clientOptions,
 		authProfileStore: params.authProfileStore
 	}));
@@ -107,7 +171,6 @@ async function runBoundedCodexAppServerTurnInWorkspace(params, appServer, worksp
 	if (remainingRunMs <= 0) abortRun(timeoutError);
 	const timeout = setTimeout(() => abortRun(timeoutError), Math.max(1, remainingRunMs));
 	timeout.unref?.();
-	let retrySelection = false;
 	const requestOptions = {
 		timeoutMs,
 		signal: abortController.signal,
@@ -122,11 +185,23 @@ async function runBoundedCodexAppServerTurnInWorkspace(params, appServer, worksp
 			...requestOptions
 		});
 		const inheritedMcpServerNames = params.requireNoExternalCapabilities ? await readCodexInheritedMcpServerNames(client, workspace.cwd, abortController.signal) : [];
-		if (params.requireNoExternalCapabilities) await assertCodexManagedRequirementsDoNotOverrideToolPolicy(client, { restrictedToolSurface: true }, abortController.signal);
-		const threadConfig = buildCodexRuntimeThreadConfig(resolveBoundedThreadConfig(params, workspace, inheritedMcpServerNames), { nativeCodeModeEnabled: false });
+		let enableManagedHooks = false;
+		if (params.requireNoExternalCapabilities) {
+			let privateManagedHooksPresent = false;
+			if (workspace.codexHome) privateManagedHooksPresent = (await assertCodexPrivateHookIsolation(client, {
+				codexHome: workspace.codexHome,
+				cwd: workspace.cwd
+			}, abortController.signal)).activeManagedHooks;
+			({enableManagedHooks} = await assertCodexManagedRequirementsDoNotOverrideToolPolicy(client, {
+				restrictedToolSurface: true,
+				allowConfiguredManagedHooks: workspace.codexHome !== void 0,
+				privateManagedHooksPresent
+			}, abortController.signal));
+		}
+		const threadConfig = buildCodexRuntimeThreadConfig(resolveBoundedThreadConfig(params, workspace, inheritedMcpServerNames, enableManagedHooks), { nativeCodeModeEnabled: false });
 		params.assertCurrent?.();
 		const thread = assertCodexThreadStartResponse(await client.request("thread/start", {
-			model: modelSelection.runtimeModelId,
+			model: modelSelection.model,
 			...params.modelProvider ? { modelProvider: params.modelProvider } : {},
 			cwd: workspace.cwd,
 			approvalPolicy: "on-request",
@@ -157,7 +232,11 @@ async function runBoundedCodexAppServerTurnInWorkspace(params, appServer, worksp
 				threadId: thread.thread.id,
 				input: params.input,
 				approvalPolicy: "on-request",
-				effort: "low"
+				effort: params.thinkLevel === void 0 ? "low" : resolveCodexAppServerReasoningEffort({
+					thinkLevel: params.thinkLevel,
+					modelId: modelSelection.model,
+					supportedReasoningEfforts: modelSelection.supportedReasoningEfforts
+				})
 			}, requestOptions));
 			activeTurnId = turn.turn.id;
 			if (abortController.signal.aborted) requestInterrupt();
@@ -171,17 +250,20 @@ async function runBoundedCodexAppServerTurnInWorkspace(params, appServer, worksp
 				throw failure instanceof Error ? failure : new Error(failure ?? `codex app-server ${params.taskLabel} turn failed`);
 			}
 			if (result.turn?.status !== "completed") throw new Error(`codex app-server ${params.taskLabel} turn ended with status ${result.turn?.status ?? "unknown"}`);
-			if (!result.text && !params.allowEmptyText) throw new Error(`Codex app-server ${params.taskLabel} turn returned no text.`);
+			const lastHookPrompt = enableManagedHooks ? result.items.findLastIndex((item) => item.type === "hookPrompt") : -1;
+			const text = lastHookPrompt < 0 ? result.text : result.items.slice(lastHookPrompt + 1).filter((item) => item.type === "agentMessage").map((item) => item.text?.trim()).filter(Boolean).join("\n\n");
+			if (!text && !params.allowEmptyText) throw new Error(`Codex app-server ${params.taskLabel} turn returned no text.`);
 			params.assertCurrent?.();
 			return {
-				text: result.text,
+				text,
 				items: result.items,
 				usage: result.usage,
-				model: modelSelection.catalogId,
+				model: modelSelection.id,
 				nativeSelection: {
 					model: thread.model,
 					modelProvider: thread.modelProvider
-				}
+				},
+				managedHooksEnabled: enableManagedHooks
 			};
 		} finally {
 			await interruptPromise;
@@ -189,28 +271,32 @@ async function runBoundedCodexAppServerTurnInWorkspace(params, appServer, worksp
 		}
 	} catch (error) {
 		if (abortController.signal.aborted) throw resolveCodexBoundedTurnAbortError(abortController.signal, params.taskLabel, timeoutError);
-		if (ownsClient && isCodexAppServerStartSelectionChangedError(error) && selectionAttempt === 0) retrySelection = true;
-		else throw error;
+		if (!ownsClient || !isCodexAppServerStartSelectionChangedError(error) || selectionAttempt !== 0) throw error;
 	} finally {
 		clearTimeout(timeout);
 		params.signal?.removeEventListener("abort", abortFromCaller);
 		await interruptPromise;
 		if (ownsClient) await closeCodexStartupClientBestEffort(client);
 	}
-	if (retrySelection) return await runBoundedCodexAppServerTurnInWorkspace(params, appServer, workspace, selectionAttempt + 1, {
+	return await runBoundedCodexAppServerTurnInWorkspace(params, appServer, workspace, selectionAttempt + 1, {
 		deadline,
 		timeoutMs: totalTimeoutMs
 	});
-	throw new Error("Codex bounded turn selection retry exited unexpectedly");
 }
-function resolveBoundedThreadConfig(params, workspace, inheritedMcpServerNames) {
+function resolveBoundedThreadConfig(params, workspace, inheritedMcpServerNames, enableManagedHooks) {
 	const boundedConfig = mergeCodexThreadConfigs(CODEX_BOUNDED_THREAD_CONFIG, params.threadConfig) ?? CODEX_BOUNDED_THREAD_CONFIG;
 	const privateConfig = workspace.codexHome ? mergeCodexThreadConfigs(boundedConfig, CODEX_PRIVATE_BOUNDED_THREAD_CONFIG) ?? boundedConfig : boundedConfig;
 	if (!params.requireNoExternalCapabilities) return privateConfig;
-	return mergeCodexThreadConfigs(privateConfig, CODEX_SETTLED_FINALIZER_THREAD_CONFIG, buildCodexRingZeroThreadConfigPatch({ toolsAllow: ["openclaw"] }, true, inheritedMcpServerNames)) ?? privateConfig;
+	return mergeCodexThreadConfigs(privateConfig, CODEX_SETTLED_FINALIZER_THREAD_CONFIG, buildCodexRingZeroThreadConfigPatch({ toolsAllow: ["openclaw"] }, true, inheritedMcpServerNames), enableManagedHooks ? { "features.hooks": true } : void 0) ?? privateConfig;
 }
-function buildPrivateCodexAppServerStartOptions(start, codexHome) {
-	const providerArgs = readCodexAppServerConfigOptions(start.args).flatMap(({ name, value }) => (name === "-c" || name === "--config") && value && /^\s*(?:openai_base_url|model_catalog_json)\s*=/u.test(value) ? ["-c", value] : []);
+function buildPrivateCodexAppServerStartOptions(start, codexHome, cwd, inspectManagedHooks) {
+	const launchCwd = start.cwd ?? process.cwd();
+	const { launcherArgs, nativeArgs } = resolveCodexPrivateLauncher({
+		command: start.command,
+		args: start.args,
+		cwd: launchCwd
+	});
+	const providerArgs = readCodexAppServerConfigOptions(nativeArgs).flatMap(({ name, value }) => (name === "-c" || name === "--config") && value && /^\s*(?:openai_base_url|model_catalog_json)\s*=/u.test(value) ? ["-c", resolvePrivateProviderOverride(value, launchCwd)] : []);
 	const privateEnv = Object.fromEntries(Object.entries(start.env ?? {}).filter(([name]) => name.trim().toUpperCase() !== CODEX_APP_SERVER_ARGS_ENV_KEY));
 	const clearEnv = (start.clearEnv ?? []).filter((name) => {
 		const normalized = name.trim().toUpperCase();
@@ -218,10 +304,21 @@ function buildPrivateCodexAppServerStartOptions(start, codexHome) {
 	});
 	return {
 		...start,
+		command: !path.isAbsolute(start.command) && /[\\/]/u.test(start.command) ? path.resolve(launchCwd, start.command) : start.command,
 		homeScope: "agent",
+		cwd,
 		args: [
+			...launcherArgs,
 			"app-server",
 			...providerArgs,
+			"-c",
+			"project_root_markers=[]",
+			...inspectManagedHooks ? [
+				"-c",
+				"features.hooks=true",
+				"-c",
+				"features.plugins=false"
+			] : [],
 			"--listen",
 			"stdio://"
 		],
@@ -232,6 +329,18 @@ function buildPrivateCodexAppServerStartOptions(start, codexHome) {
 		clearEnv: [...clearEnv, CODEX_APP_SERVER_ARGS_ENV_KEY]
 	};
 }
+function resolvePrivateProviderOverride(override, launchCwd) {
+	const separator = override.indexOf("=");
+	if (override.slice(0, separator).trim() !== "model_catalog_json") return override;
+	const rawPath = override.slice(separator + 1).trim();
+	let catalogPath;
+	try {
+		catalogPath = parse(`path = ${rawPath}`).path;
+	} catch {
+		catalogPath = rawPath;
+	}
+	return typeof catalogPath === "string" && catalogPath && !path.isAbsolute(catalogPath) ? `model_catalog_json=${JSON.stringify(path.resolve(launchCwd, catalogPath))}` : override;
+}
 function createCodexBoundedApprovalHandler(taskLabel) {
 	return (request) => {
 		if (request.method === "item/commandExecution/requestApproval" || request.method === "item/fileChange/requestApproval") return {
@@ -264,20 +373,14 @@ async function resolveCodexBoundedTurnModel(params) {
 		const supported = listed.filter((entry) => params.requiredModalities.every((modality) => entry.inputModalities.includes(modality)));
 		const selected = supported.find((entry) => entry.isDefault) ?? supported[0];
 		if (!selected) throw new Error(`Codex app-server has no model supporting ${params.requiredModalities.join(" and ")} input.`);
-		return {
-			catalogId: selected.id,
-			runtimeModelId: selected.model
-		};
+		return selected;
 	}
 	const model = params.selection.id;
 	const match = listed.find((entry) => entry.model === model || entry.id === model);
 	if (!match) throw new Error(`Codex app-server model not found: ${model}`);
 	if (params.requiredModalities.includes("image") && !match.inputModalities.includes("image")) throw new Error(`Codex app-server model does not support images: ${model}`);
 	if (params.requiredModalities.includes("text") && !match.inputModalities.includes("text")) throw new Error(`Codex app-server model does not support text: ${model}`);
-	return {
-		catalogId: match.id,
-		runtimeModelId: match.model
-	};
+	return match;
 }
 function resolveCodexBoundedTurnAbortError(signal, taskLabel, timeoutError) {
 	return signal.reason === timeoutError ? timeoutError : /* @__PURE__ */ new Error(`codex app-server ${taskLabel} turn aborted`);

package/dist/.setup/bounded-turn-isolation-B8K_ylqk.mjs

@@ -0,0 +1,14 @@
+import { d as readCodexPluginConfig } from "./config-parsing-b088LyhT.mjs";
+import { n as isCodexAppServerProxyLaunch } from "./launch-args-DbFCehO7.mjs";
+import { i as resolveCodexAppServerHomeScope } from "./config-options-CzyWLTJt.mjs";
+import "./config-DKhXquav.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-C0NbLms1.mjs";
+//#region extensions/codex/src/app-server/bounded-turn-isolation.ts
+function resolveCodexBoundedTurnIsolation(options) {
+	const pluginConfig = readCodexPluginConfig(options.pluginConfig);
+	const homeScope = resolveCodexAppServerHomeScope({ appServer: pluginConfig.appServer });
+	const { start } = resolveCodexAppServerRuntimeOptions({ pluginConfig: options.pluginConfig });
+	return start.transport === "stdio" && (homeScope === "agent" || options.requireIsolatedAuth === true) && !isCodexAppServerProxyLaunch(start.args) ? "private-stdio" : "configured-transport";
+}
+//#endregion
+export { resolveCodexBoundedTurnIsolation as t };

package/dist/.setup/{build-state-Xx9ybZqa.mjs → build-state-Da1_z0kd.mjs}

@@ -1,5 +1,5 @@
 //#region extensions/codex/package.json
-var version = "2026.9.5";
+var version = "2026.9.7";
 //#endregion
 //#region extensions/codex/src/build-state.ts
 /**

package/dist/.setup/{capabilities-_vXcZGSx.mjs → capabilities-B3WEZl4e.mjs}

@@ -1,9 +1,5 @@
-import { i as CodexAppServerRpcError } from "./timeout-DZF05XrR.mjs";
+import { n as CodexAppServerRpcError } from "./rpc-error-BlD2vuzn.mjs";
 //#region extensions/codex/src/app-server/capabilities.ts
-/**
-* Capability helpers for optional Codex app-server control-plane methods.
-*/
-/** Known app-server methods used by OpenClaw control surfaces. */
 const CODEX_CONTROL_METHODS = {
 	account: "account/read",
 	installedApps: "app/installed",
@@ -31,13 +27,9 @@ const CODEX_CONTROL_METHODS = {
 	setThreadGoal: "thread/goal/set",
 	clearThreadGoal: "thread/goal/clear"
 };
-/** Formats unsupported control calls differently from ordinary RPC failures. */
 function describeControlFailure(error) {
-	if (isUnsupportedControlError(error)) return "unsupported by this Codex app-server";
+	if (error instanceof CodexAppServerRpcError && error.code === -32601) return "unsupported by this Codex app-server";
 	return error instanceof Error ? error.message : String(error);
 }
-function isUnsupportedControlError(error) {
-	return error instanceof CodexAppServerRpcError && error.code === -32601;
-}
 //#endregion
 export { describeControlFailure as n, CODEX_CONTROL_METHODS as t };