@openclaw/codex 2026.9.6 → 2026.9.7

package/README.md

@@ -34,6 +34,8 @@ For a supervised branch, Codex App Server selects the snapshot fork's model and
 
 The visible-history mirror keeps at most 200 user or assistant messages, 512 KiB total, and 64 KiB per message. Image inputs become `[Image attachment]`; image data and local paths are not copied.
 
+Settled-turn finalization uses the same configured Codex App Server transport as the supervised conversation. Remote websocket App Server configurations stay on their configured transport. Managed user-home stdio launches running inside an Agent home, and not through the proxy launcher, use a private stdio side turn for native-tool isolation. The bounded finalizer preserves the selected model, provider, and native authorization returned by Codex, and rejects native tool evidence outside the finalization contract. It may mirror a final answer after completed tool work; it does not diagnose why a model omitted a visible final message.
+
 When settled-turn recovery rejects history, the `codex settled-turn finalization context capture failed` warning includes a stable `reason`, such as `item_limit`, `byte_limit`, `field_limit`, `unsupported_user_image`, or `snapshot_invalidated`. Unknown failures use `history_read_failed`. The warning excludes transcript content and exception text. Rejected history remains unavailable for finalization, and completed actions are never replayed.
 
 See the [Codex harness](https://docs.openclaw.ai/plugins/codex-harness) and [Codex supervision](https://docs.openclaw.ai/plugins/codex-supervision) guides.

package/dist/.setup/{account-usage-runtime-Eem_WGqY.mjs → account-usage-runtime-DFhbh1zz.mjs}

@@ -1,9 +1,9 @@
 import { n as isCodexAppServerProxyLaunch } from "./launch-args-DbFCehO7.mjs";
-import { t as buildCodexAppServerUsageSnapshot } from "./rate-limits-CMU3DUD0.mjs";
-import { n as readCodexAppServerUsage } from "./request-D2L0zMrq.mjs";
-import "./config-BoTP_mrL.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-C8Rw1m1m.mjs";
-import { a as resolveCodexAppServerAuthProfileStore } from "./auth-profile-WqZtZfXN.mjs";
+import { t as buildCodexAppServerUsageSnapshot } from "./rate-limits-B7-X2TgG.mjs";
+import { n as readCodexAppServerUsage } from "./request-BHZ1nz8d.mjs";
+import "./config-DKhXquav.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-C0NbLms1.mjs";
+import { a as resolveCodexAppServerAuthProfileStore } from "./auth-profile-B0okYl2D.mjs";
 import { isDeepStrictEqual } from "node:util";
 import { listAgentIds, resolveAgentDir } from "openclaw/plugin-sdk/agent-scope-runtime";
 import { z } from "zod";

package/dist/.setup/{apply-DDOi8uNx.mjs → apply-D3GcSoSa.mjs}

@@ -1,14 +1,14 @@
-import { c as CODEX_PLUGINS_MARKETPLACE_NAME, n as isOpenAiCuratedMarketplace } from "./plugin-inventory-BoRei8Z4.mjs";
-import { d as readCodexPluginConfig } from "./config-parsing-CcB9iPoq.mjs";
-import { s as resolveCodexAppServerFallbackApiKeyCacheKey } from "./auth-cache-key-B2mpaI9D.mjs";
-import { a as defaultCodexAppInventoryCache, r as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-B2CsSdnV.mjs";
-import { i as requestCodexAppServerJson } from "./request-D2L0zMrq.mjs";
-import "./config-BoTP_mrL.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-C8Rw1m1m.mjs";
-import { i as resolveCodexAppServerAuthProfileIdForAgent } from "./auth-profile-WqZtZfXN.mjs";
-import { X as resolveCodexAppServerAuthAccountCacheKey, c as getLeasedSharedCodexAppServerClient, h as releaseLeasedSharedCodexAppServerClient, o as clearSharedCodexAppServerClientIfCurrentAndWait } from "./shared-client-DA4VR4Eb.mjs";
-import { t as ensureCodexPluginActivation } from "./plugin-activation-DT3MNtqj.mjs";
-import { CODEX_PLUGIN_CONFIG_PATH, buildCodexMigrationPlan, buildCodexPluginsConfigValue, hasCodexPluginConfigConflict, n as resolveCodexConfigPatchMode, readCodexPluginMigrationConfigEntry, t as createCodexAuthItemApplier } from "./plan-CN3VwfNU.mjs";
+import { n as isOpenAiCuratedMarketplace, u as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-Cky2XJUw.mjs";
+import { d as readCodexPluginConfig } from "./config-parsing-b088LyhT.mjs";
+import { s as resolveCodexAppServerFallbackApiKeyCacheKey } from "./auth-cache-key-Dbvq-QgB.mjs";
+import { a as defaultCodexAppInventoryCache, r as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-BL9B5H0L.mjs";
+import { i as requestCodexAppServerJson } from "./request-BHZ1nz8d.mjs";
+import "./config-DKhXquav.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-C0NbLms1.mjs";
+import { i as resolveCodexAppServerAuthProfileIdForAgent } from "./auth-profile-B0okYl2D.mjs";
+import { c as getLeasedSharedCodexAppServerClient, et as resolveCodexAppServerAuthAccountCacheKey, h as releaseLeasedSharedCodexAppServerClient, o as clearSharedCodexAppServerClientIfCurrentAndWait } from "./shared-client-DqyTMYug.mjs";
+import { t as ensureCodexPluginActivation } from "./plugin-activation-cNHRfaxU.mjs";
+import { CODEX_PLUGIN_CONFIG_PATH, buildCodexMigrationPlan, buildCodexPluginsConfigValue, hasCodexPluginConfigConflict, n as resolveCodexConfigPatchMode, readCodexPluginMigrationConfigEntry, t as createCodexAuthItemApplier } from "./plan-Y-QIvrKB.mjs";
 import { uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { parseStrictNonNegativeInteger } from "openclaw/plugin-sdk/number-runtime";
 import path from "node:path";
@@ -24,7 +24,8 @@ function codexPluginActivationReportState(result) {
 			installed: true,
 			enabled: true
 		};
-		case "auth_required": return {
+		case "auth_required":
+		case "refresh_failed": return {
 			installed: true,
 			enabled: false
 		};
@@ -35,20 +36,9 @@ function codexPluginActivationReportState(result) {
 			installed: false,
 			enabled: false
 		};
-		case "refresh_failed": return {
-			installed: true,
-			enabled: false
-		};
 	}
 	return result.reason;
 }
-function sanitizeAppsNeedingAuth(apps) {
-	return apps.map((app) => ({
-		id: app.id,
-		name: app.name,
-		needsAuth: true
-	}));
-}
 //#endregion
 //#region extensions/codex/src/migration/apply.ts
 const CODEX_PLUGIN_AUTH_REQUIRED_REASON = "auth_required";
@@ -64,9 +54,6 @@ var CodexPluginConfigConflictError = class extends Error {
 		this.name = "CodexPluginConfigConflictError";
 	}
 };
-function shouldReturnCodexPluginConfigPatch(ctx) {
-	return resolveCodexConfigPatchMode(ctx) === "return";
-}
 function prepareTargetCodexAppServer(ctx) {
 	const appServer = resolveTargetCodexAppServer(ctx);
 	const targets = resolvePlannedMigrationTargets(ctx);
@@ -187,7 +174,11 @@ async function applyCodexPluginInstallItem(ctx, item) {
 			reason: CODEX_PLUGIN_AUTH_REQUIRED_REASON,
 			details: {
 				...baseDetails,
-				appsNeedingAuth: sanitizeAppsNeedingAuth(result.installResponse?.appsNeedingAuth ?? [])
+				appsNeedingAuth: (result.installResponse?.appsNeedingAuth ?? []).map(({ id, name }) => ({
+					id,
+					name,
+					needsAuth: true
+				}))
 			}
 		};
 		if (result.reason === "plugin_missing" || result.reason === "marketplace_missing") return {
@@ -207,7 +198,7 @@ async function applyCodexPluginInstallItem(ctx, item) {
 			details: baseDetails
 		};
 	} catch (error) {
-		if (isCodexPluginInventoryLoadError(error)) return {
+		if (coerceErrorMessage(error).includes("codex app-server plugin/list timed out")) return {
 			...item,
 			status: "warning",
 			reason: "plugin_inventory_unavailable",
@@ -230,9 +221,6 @@ async function applyCodexPluginInstallItem(ctx, item) {
 		};
 	}
 }
-function isCodexPluginInventoryLoadError(error) {
-	return coerceErrorMessage(error).includes("codex app-server plugin/list timed out");
-}
 function resolveTargetCodexAppServer(ctx) {
 	return resolveCodexAppServerRuntimeOptions({ pluginConfig: readCodexPluginConfig(ctx.config) });
 }
@@ -256,9 +244,7 @@ async function requestTargetCodexAppServerJson(params) {
 	return lastResponse;
 }
 function targetCodexMarketplaceDiscoveryTimeoutMs(env = process.env) {
-	const configured = parseStrictNonNegativeInteger(env[TARGET_CODEX_MARKETPLACE_DISCOVERY_TIMEOUT_ENV]);
-	if (configured !== void 0) return configured;
-	return TARGET_CODEX_MARKETPLACE_DISCOVERY_TIMEOUT_MS;
+	return parseStrictNonNegativeInteger(env[TARGET_CODEX_MARKETPLACE_DISCOVERY_TIMEOUT_ENV]) ?? TARGET_CODEX_MARKETPLACE_DISCOVERY_TIMEOUT_MS;
 }
 function isCodexPluginLoadWarningItem(item) {
 	return item.kind === "plugin" && item.action === "install" && item.status === "warning" && item.details?.warningReason === CODEX_PLUGIN_LOAD_WARNING;
@@ -285,7 +271,7 @@ async function buildTargetCodexPluginAppCacheKey(ctx) {
 	});
 }
 async function applyCodexPluginConfigItem(ctx, item, appliedItems) {
-	if (appliedItems.filter((candidate) => candidate.kind === "plugin" && candidate.action === "install" && readCodexPluginPolicy(candidate) !== void 0 && !isCodexPluginConfigTerminal(candidate)).length > 0) return {
+	if (appliedItems.some((candidate) => candidate.kind === "plugin" && candidate.action === "install" && readCodexPluginPolicy(candidate) !== void 0 && !isCodexPluginConfigTerminal(candidate))) return {
 		...item,
 		status: "warning",
 		reason: "selected Codex plugin activation is incomplete"
@@ -295,7 +281,7 @@ async function applyCodexPluginConfigItem(ctx, item, appliedItems) {
 		...markMigrationItemSkipped(item, "no selected Codex plugins"),
 		deferredCompletion: true
 	};
-	const returnPatch = shouldReturnCodexPluginConfigPatch(ctx);
+	const returnPatch = resolveCodexConfigPatchMode(ctx) === "return";
 	const configApi = resolveMigrationConfigRuntime(ctx);
 	const currentConfig = returnPatch ? ctx.config : configApi?.current?.();
 	if (!currentConfig) return markMigrationItemError(item, "config runtime unavailable");

package/dist/.setup/{attempt-client-cleanup-CEv1cKwF.mjs → attempt-client-cleanup-DOP-cW5j.mjs}

@@ -1,22 +1,132 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
-import { h as retireSharedCodexAppServerClientIfCurrent } from "./session-catalog-events-Bj6j94E_.mjs";
-import { n as waitForPromiseOrAbort, o as CodexAppServerRpcError, t as abortReason } from "./timeout-C910MdAB.mjs";
-import { h as unknownItemStatus } from "./event-projector-items-C6L_5ZiT.mjs";
-import { G as unsubscribeCodexAppServerLiveThread, rt as isCodexAppServerStartupError, u as isCodexAppServerStartSelectionChangedError } from "./shared-client-DA4VR4Eb.mjs";
-import { T as readCodexTurnCompletedNotification, a as isCodexAppServerBrokenPipeError, d as isCodexAppServerRequestTimeoutError, l as isCodexAppServerOverloadError } from "./client-Cs08OXVQ.mjs";
-import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { d as retireSharedCodexAppServerClientIfCurrent } from "./shared-client-lifecycle-DJIgqgMw.mjs";
+import { n as CodexAppServerRpcError } from "./rpc-error-BlD2vuzn.mjs";
+import { n as waitForPromiseOrAbort, t as abortReason } from "./timeout-CXOfNoaX.mjs";
+import { J as unsubscribeCodexAppServerLiveThread, ft as isCodexAppServerStartupError, u as isCodexAppServerStartSelectionChangedError } from "./shared-client-DqyTMYug.mjs";
+import { E as readCodexTurnCompletedNotification, a as isCodexAppServerBrokenPipeError, d as isCodexAppServerRequestTimeoutError, l as isCodexAppServerOverloadError } from "./client-N0JpgSzF.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-jo6H8dFr.mjs";
+import { normalizeOptionalString, readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { AsyncResource } from "node:async_hooks";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
 import { sanitizeTerminalText } from "openclaw/plugin-sdk/text-chunking";
 import { AgentHarnessPreflightError, embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { redactSensitiveText } from "openclaw/plugin-sdk/logging-core";
+//#region extensions/codex/src/app-server/event-projector-items.ts
+const itemStatuses = /* @__PURE__ */ new Map([
+	["completed", "completed"],
+	["failed", "failed"],
+	["error", "failed"],
+	["declined", "blocked"],
+	["inProgress", "running"],
+	["in_progress", "running"],
+	["running", "running"]
+]);
+const itemPresentations = /* @__PURE__ */ new Map([
+	["dynamicToolCall", {
+		kind: "tool",
+		title: "Tool"
+	}],
+	["mcpToolCall", {
+		kind: "tool",
+		title: "MCP tool",
+		projectedTool: true
+	}],
+	["commandExecution", {
+		kind: "command",
+		title: "Command",
+		toolName: "bash",
+		projectedTool: true
+	}],
+	["fileChange", {
+		kind: "patch",
+		title: "File change",
+		toolName: "apply_patch",
+		projectedTool: true
+	}],
+	["webSearch", {
+		kind: "search",
+		title: "Web search",
+		toolName: "web_search",
+		projectedTool: true
+	}],
+	["contextCompaction", {
+		kind: "analysis",
+		title: "Context compaction"
+	}],
+	["reasoning", {
+		kind: "analysis",
+		title: "Reasoning"
+	}]
+]);
+function matchesCodexSnapshotTurn(item, turnId) {
+	const itemTurnId = readStringField(item, "turnId");
+	return itemTurnId === void 0 || itemTurnId === turnId;
+}
+function itemKind(item) {
+	return itemPresentations.get(item.type)?.kind;
+}
+function itemTitle(item) {
+	return itemPresentations.get(item.type)?.title ?? item.type;
+}
+function itemStatus(item) {
+	return itemStatuses.get(readStringField(item, "status") ?? "") ?? "completed";
+}
+function unknownItemStatus(item) {
+	const status = readStringField(item, "status");
+	return status === void 0 || itemStatuses.has(status) ? void 0 : status;
+}
+function auditNativeToolTerminalStatus(item) {
+	if (item.type === "imageView" || item.type === "sleep") return "completed";
+	const status = itemStatuses.get(readStringField(item, "status") ?? "");
+	return status === void 0 || status === "running" ? "unknown" : status;
+}
+function auditNativeToolUnfinishedStatus(item) {
+	return item.type === "webSearch" || item.type === "imageGeneration" ? "unknown" : "failed";
+}
+function isNonSuccessItemStatus(status) {
+	return status === "failed" || status === "blocked";
+}
+function itemName(item) {
+	if (item.type === "dynamicToolCall" && typeof item.tool === "string") return item.tool;
+	if (item.type === "mcpToolCall" && typeof item.tool === "string") {
+		const server = typeof item.server === "string" ? item.server : void 0;
+		return server ? `${server}.${item.tool}` : item.tool;
+	}
+	return itemPresentations.get(item.type)?.toolName;
+}
+function auditNativeToolName(item) {
+	if (item.type === "dynamicToolCall") return;
+	const progressName = itemName(item);
+	if (progressName) return progressName;
+	if (item.type === "collabAgentToolCall") return typeof item.tool === "string" && item.tool.trim() ? `collab.${item.tool.trim()}` : "collab_agent";
+	if (item.type === "imageGeneration") return "image_generation";
+	if (item.type === "imageView") return "image_view";
+	if (item.type === "sleep") return "sleep";
+}
+function isSideEffectingNativeToolItem(item) {
+	return itemStatus(item) !== "blocked" && (isMutatingNativeToolItem(item) || item.type === "mcpToolCall");
+}
+function isProjectedNativeToolItem(item) {
+	return itemPresentations.get(item.type)?.projectedTool === true;
+}
+function isMutatingNativeToolItem(item) {
+	if (item.type === "commandExecution") return true;
+	return item.type === "fileChange" || item.type === "collabAgentToolCall" || item.type === "imageGeneration";
+}
+function shouldClearTerminalPresentationForNativeItem(item) {
+	switch (item.type) {
+		case "collabAgentToolCall":
+		case "commandExecution":
+		case "fileChange":
+		case "imageGeneration":
+		case "imageView":
+		case "mcpToolCall":
+		case "webSearch": return true;
+		default: return false;
+	}
+}
+//#endregion
 //#region extensions/codex/src/app-server/notification-correlation.ts
-/**
-* Correlates Codex app-server notifications with the active thread/turn so
-* projectors can ignore global or stale events without losing diagnostics.
-*/
-/** Returns true when a notification payload belongs to the exact active thread and turn. */
 function isCodexNotificationForTurn(value, threadId, turnId) {
 	if (!isJsonObject(value)) return false;
 	return readCodexNotificationThreadId(value) === threadId && readCodexNotificationTurnId(value) === turnId;
@@ -31,13 +141,8 @@ function readCodexNotificationThreadId(record) {
 	const thread = isJsonObject(record.thread) ? record.thread : void 0;
 	return normalizeOptionalString(record.threadId) ?? (thread ? normalizeOptionalString(thread.id) : void 0);
 }
-/** Reads a turn id from either top-level notification params or nested turn payloads. */
 function readCodexNotificationTurnId(record) {
-	return readNestedTurnId(record) ?? normalizeOptionalString(record.turnId);
-}
-function readNestedTurnId(record) {
-	const turn = record.turn;
-	return isJsonObject(turn) ? normalizeOptionalString(turn.id) : void 0;
+	return (isJsonObject(record.turn) ? normalizeOptionalString(record.turn.id) : void 0) ?? normalizeOptionalString(record.turnId);
 }
 //#endregion
 //#region extensions/codex/src/app-server/event-projector-diagnostics.ts
@@ -88,7 +193,6 @@ var CodexProjectionDiagnostics = class {
 };
 //#endregion
 //#region extensions/codex/src/app-server/turn-router.ts
-/** Keyed routing for all turn traffic on one shared Codex app-server client. */
 const DEFAULT_PREBIND_NOTIFICATION_LIMIT = 256;
 const DEFAULT_GLOBAL_WARNING_LIMIT = 32;
 const CODEX_APP_SERVER_NATIVE_TURN_WAIT_TIMEOUT_MS = 3e4;
@@ -96,7 +200,6 @@ const routers = /* @__PURE__ */ new WeakMap();
 function hasCodexAppServerSiblingRouteWork(client, threadId) {
 	return routers.get(client)?.hasSiblingWork(threadId) ?? false;
 }
-/** Returns the sole router installed on a physical app-server client. */
 function getCodexAppServerTurnRouter(client) {
 	const existing = routers.get(client);
 	if (existing) return existing;
@@ -167,15 +270,10 @@ var ClientTurnRouter = class {
 		this.assertActive();
 		const threadId = requireId(options.threadId, "thread id");
 		const turnId = requireId(options.turnId, "turn id");
-		if (options.signal?.aborted) return {
-			completion: Promise.resolve(false),
-			state: "unconfirmed",
-			settledSignal: AbortSignal.abort(),
-			cancel: () => {}
-		};
-		if (this.routes.get(threadId)?.completedNativeTurnIds.has(turnId)) return {
-			completion: Promise.resolve(true),
-			state: "confirmed",
+		const confirmed = !options.signal?.aborted && this.routes.get(threadId)?.completedNativeTurnIds.has(turnId) === true;
+		if (options.signal?.aborted || confirmed) return {
+			completion: Promise.resolve(confirmed),
+			state: confirmed ? "confirmed" : "unconfirmed",
 			settledSignal: AbortSignal.abort(),
 			cancel: () => {}
 		};
@@ -480,9 +578,6 @@ function requireId(value, label) {
 }
 //#endregion
 //#region extensions/codex/src/app-server/attempt-client-cleanup.ts
-/**
-* Best-effort cleanup helpers for Codex app-server startup attempts and turns.
-*/
 var attempt_client_cleanup_exports = /* @__PURE__ */ __exportAll({
 	CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS: () => CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS,
 	CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS: () => CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS,
@@ -497,9 +592,7 @@ var attempt_client_cleanup_exports = /* @__PURE__ */ __exportAll({
 	terminateCodexBackgroundTerminals: () => terminateCodexBackgroundTerminals,
 	unsubscribeCodexThreadBestEffort: () => unsubscribeCodexThreadBestEffort
 });
-/** Timeout for best-effort app-server turn interruption during cleanup. */
 const CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS = 5e3;
-/** Timeout for best-effort thread unsubscribe during cleanup. */
 const CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS = 5e3;
 const CODEX_NO_ACTIVE_TURN_ERROR_CODE = -32600;
 const CODEX_NO_ACTIVE_TURN_ERROR_MESSAGE = "no active turn to interrupt";
@@ -517,7 +610,6 @@ var CodexAppServerUnsafeSubscriptionError = class extends Error {
 function isCodexAppServerUnsafeSubscriptionError(error) {
 	return error instanceof CodexAppServerUnsafeSubscriptionError;
 }
-/** Asserts Codex resumed the exact thread this attempt subscribed to. */
 function assertCodexThreadResumeSubscription(requestedThreadId, returnedThreadId) {
 	if (returnedThreadId !== requestedThreadId) throw new CodexAppServerUnsafeSubscriptionError(`Codex thread/resume returned ${returnedThreadId} for ${requestedThreadId}`);
 }
@@ -616,7 +708,6 @@ async function terminateCodexBackgroundTerminals(client, threadId, oneShotCliRun
 		throw new Error("Codex background-terminal cleanup failed; inspect the thread's running terminals before starting more work.", { cause });
 	}
 }
-/** Unsubscribes from a thread while swallowing cleanup-only failures. */
 async function unsubscribeCodexThreadBestEffort(client, params) {
 	try {
 		await unsubscribeCodexAppServerLiveThread(client, params.threadId, params.timeoutMs, params.assertCurrent);
@@ -635,4 +726,4 @@ function shouldRetireCodexStartupClient(error, spawnedBy, signal) {
 	return !isCodexAppServerStartSelectionChangedError(error) && !isCodexAppServerOverloadError(error) && !(error instanceof AgentHarnessPreflightError && error.scope === void 0) && (isCodexAppServerBrokenPipeError(error) || !spawnedBy);
 }
 //#endregion
-export { CodexProjectionDiagnostics as _, attempt_client_cleanup_exports as a, readCodexNotificationTurnId as b, isCodexAppServerUnsafeSubscriptionError as c, shouldRetireCodexStartupClient as d, terminateCodexBackgroundTerminals as f, hasCodexAppServerSiblingRouteWork as g, getCodexAppServerTurnRouter as h, assertCodexThreadResumeSubscription as i, isCodexNoActiveTurnInterruptError as l, CODEX_APP_SERVER_NATIVE_TURN_WAIT_TIMEOUT_MS as m, CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS as n, closeCodexStartupClientBestEffort as o, unsubscribeCodexThreadBestEffort as p, CodexAppServerUnsafeSubscriptionError as r, interruptCodexTurnAndWaitBestEffort as s, CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS as t, retireUnsafeCodexTurnClientBestEffort as u, isCodexNotificationForTurn as v, readCodexNotificationThreadId as y };
+export { itemStatus as A, auditNativeToolUnfinishedStatus as C, isSideEffectingNativeToolItem as D, isProjectedNativeToolItem as E, matchesCodexSnapshotTurn as M, shouldClearTerminalPresentationForNativeItem as N, itemKind as O, unknownItemStatus as P, auditNativeToolTerminalStatus as S, isNonSuccessItemStatus as T, CodexProjectionDiagnostics as _, attempt_client_cleanup_exports as a, readCodexNotificationTurnId as b, isCodexAppServerUnsafeSubscriptionError as c, shouldRetireCodexStartupClient as d, terminateCodexBackgroundTerminals as f, hasCodexAppServerSiblingRouteWork as g, getCodexAppServerTurnRouter as h, assertCodexThreadResumeSubscription as i, itemTitle as j, itemName as k, isCodexNoActiveTurnInterruptError as l, CODEX_APP_SERVER_NATIVE_TURN_WAIT_TIMEOUT_MS as m, CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS as n, closeCodexStartupClientBestEffort as o, unsubscribeCodexThreadBestEffort as p, CodexAppServerUnsafeSubscriptionError as r, interruptCodexTurnAndWaitBestEffort as s, CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS as t, retireUnsafeCodexTurnClientBestEffort as u, isCodexNotificationForTurn as v, isMutatingNativeToolItem as w, auditNativeToolName as x, readCodexNotificationThreadId as y };

package/dist/.setup/attempt-workspace-context-C5HigshI.mjs

@@ -0,0 +1,164 @@
+import { r as flattenCodexDynamicToolFunctions } from "./protocol-CANUwXJ3.mjs";
+import { lt as isMessageOnlyCodexSourceReply } from "./thread-requests-B_bRnMGN.mjs";
+import path from "node:path";
+import { buildAgentWorkspaceInstructionSnapshot, buildBootstrapContextForFiles, embeddedAgentLog, prepareAgentWorkspaceContext } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { resolveAgentWorkspaceMemoryRouting, shouldIncludeAgentHarnessRuntimeContext } from "openclaw/plugin-sdk/agent-harness-attempt-runtime";
+import { resolveBootstrapFilesForPreparation } from "openclaw/plugin-sdk/codex-mcp-projection";
+//#region extensions/codex/src/app-server/attempt-workspace-context.ts
+const CODEX_NATIVE_PROJECT_DOC_BASENAMES = /* @__PURE__ */ new Set(["agents.md"]);
+const CODEX_MEMORY_CONTEXT_BASENAME = "memory.md";
+const CODEX_MEMORY_TOOL_NAMES = /* @__PURE__ */ new Set(["memory_search", "memory_get"]);
+const CODEX_BOOTSTRAP_CONTEXT_ORDER = /* @__PURE__ */ new Map([
+	["soul.md", 10],
+	["identity.md", 20],
+	["user.md", 30],
+	["bootstrap.md", 50],
+	["memory.md", 60]
+]);
+/** A child baseline reads the bounded workspace snapshot without invoking admission hooks. */
+async function prepareCodexWorkspaceDeveloperInstructions(params) {
+	if (isSameCodexWorkspacePath(params.workspaceDir, params.cwd)) return;
+	const files = await resolveBootstrapFilesForPreparation(params);
+	const contextFiles = buildBootstrapContextForFiles(files, {
+		config: params.config,
+		agentId: params.agentId
+	});
+	return buildAgentWorkspaceInstructionSnapshot(contextFiles, params.workspaceDir).instructions;
+}
+async function buildCodexWorkspaceBootstrapContext(params) {
+	const availableToolNames = new Set(flattenCodexDynamicToolFunctions(params.tools).map((tool) => normalizeCodexDynamicToolName(tool.name)));
+	const inheritsAgentWorkspace = (params.executionWorkspace ?? params.resolvedWorkspace) !== params.resolvedWorkspace;
+	const injectOpenClawContext = shouldIncludeAgentHarnessRuntimeContext(params.params);
+	const restrictedProjectDocNeedsOpenClawCarrier = params.params.pluginHarnessToolPolicyRestricted === true && !params.params.disableTools && !isMessageOnlyCodexSourceReply(params.params) && params.params.bootstrapContextMode !== "lightweight";
+	const includeAgentWorkspaceInstructions = injectOpenClawContext && !params.ringZeroActive && (inheritsAgentWorkspace || restrictedProjectDocNeedsOpenClawCarrier);
+	try {
+		const promptWorkspace = inheritsAgentWorkspace ? params.resolvedWorkspace : params.effectiveWorkspace;
+		const { memoryToolNames, memoryToolRouted } = resolveAgentWorkspaceMemoryRouting({
+			config: params.params.config,
+			agentId: params.params.agentId ?? params.sessionAgentId,
+			workspaceDir: promptWorkspace,
+			toolNames: availableToolNames
+		});
+		const prepared = await prepareAgentWorkspaceContext({
+			scope: "full",
+			workspaceDir: params.resolvedWorkspace,
+			config: params.params.config,
+			sessionKey: params.sessionKey,
+			sessionId: params.params.sessionId,
+			bootstrapUserProfileId: params.params.bootstrapUserProfileId,
+			chatType: params.params.chatType,
+			agentId: params.params.agentId ?? params.sessionAgentId,
+			warn: (message) => embeddedAgentLog.warn(message),
+			contextMode: params.params.bootstrapContextMode,
+			runKind: params.params.bootstrapContextRunKind,
+			memoryToolRouted,
+			onMemoryPreparationError: (error) => embeddedAgentLog.warn("failed to prepare codex memory recall instructions", { error }),
+			memoryTools: injectOpenClawContext ? {
+				toolNames: [...availableToolNames],
+				citationsMode: params.params.config?.memory?.citations,
+				sandboxed: params.sandboxed
+			} : void 0,
+			projectPath: (filePath) => remapCodexContextFilePath({
+				filePath,
+				sourceWorkspaceDir: params.resolvedWorkspace,
+				targetWorkspaceDir: promptWorkspace
+			}),
+			nativeProjectDocBasenames: CODEX_NATIVE_PROJECT_DOC_BASENAMES,
+			contextFileOrder: CODEX_BOOTSTRAP_CONTEXT_ORDER,
+			promptMemoryWorkspaceDir: params.effectiveWorkspace
+		});
+		const { bootstrapFiles, contextFiles, promptContextFiles, memoryReferenceFiles, memoryToolRoutedBootstrapFiles } = prepared;
+		return {
+			bootstrapFiles,
+			contextFiles,
+			inheritsAgentWorkspace,
+			promptContextFiles,
+			threadDeveloperInstructionFiles: includeAgentWorkspaceInstructions ? prepared.instructionSnapshot.files : [],
+			turnScopedDeveloperInstructionFiles: injectOpenClawContext ? prepared.personaFiles : [],
+			memoryReferenceFiles,
+			memoryToolRoutedBootstrapFiles,
+			memoryToolNames,
+			memoryToolRouted,
+			promptContext: renderCodexWorkspaceBootstrapPromptContext(promptContextFiles),
+			threadDeveloperInstructions: includeAgentWorkspaceInstructions ? params.agentWorkspaceDeveloperInstructions ?? prepared.instructionSnapshot.instructions : void 0,
+			turnScopedDeveloperInstructions: injectOpenClawContext ? prepared.personaInstructions : void 0,
+			memoryCollaborationInstructions: injectOpenClawContext ? renderCodexWorkspaceMemoryCollaborationInstructions({
+				files: memoryReferenceFiles,
+				toolNames: memoryToolNames,
+				memoryRecallInstructions: prepared.memoryRecallInstructions
+			}) : void 0
+		};
+	} catch (error) {
+		embeddedAgentLog.warn("failed to load codex workspace bootstrap instructions", { error });
+		return {
+			bootstrapFiles: [],
+			contextFiles: [],
+			inheritsAgentWorkspace,
+			threadDeveloperInstructions: includeAgentWorkspaceInstructions ? params.agentWorkspaceDeveloperInstructions : void 0
+		};
+	}
+}
+function renderCodexWorkspaceBootstrapPromptContext(contextFiles) {
+	if (contextFiles.length === 0) return;
+	const lines = [
+		"OpenClaw loaded these user-editable workspace files for the current turn. Codex loads project-local AGENTS.md natively. When execution uses another folder, OpenClaw supplies the agent workspace AGENTS.md as thread-level developer instructions. SOUL.md, IDENTITY.md, and USER.md are prepared separately from user input and are not repeated here.",
+		"",
+		"# Project Context",
+		"",
+		"The following project context files have been loaded:",
+		""
+	];
+	for (const file of contextFiles) lines.push(`## ${file.path}`, "", file.content, "");
+	return lines.join("\n").trim();
+}
+function renderCodexWorkspaceMemoryReference(params) {
+	if (params.files.length === 0) return;
+	const lines = [
+		"## OpenClaw Workspace Memory",
+		"",
+		`MEMORY.md exists in the active agent workspace as a memory file, not an instruction file. OpenClaw does not paste its contents into native Codex turns; use ${(params.toolNames?.length ? params.toolNames : Array.from(CODEX_MEMORY_TOOL_NAMES)).join(" or ")} when durable memory is relevant and the tools are available.`,
+		""
+	];
+	for (const file of params.files) lines.push(`- ${file.path}`);
+	return lines.join("\n").trim();
+}
+function renderCodexWorkspaceMemoryCollaborationInstructions(params) {
+	const sections = [params.memoryRecallInstructions ? [params.memoryRecallInstructions, renderCodexMemoryToolSearchBridge(params.toolNames)].filter(isNonEmptyString).join("\n").trim() : void 0, renderCodexWorkspaceMemoryReference(params)].filter(isNonEmptyString);
+	return sections.length > 0 ? sections.join("\n\n") : void 0;
+}
+function renderCodexMemoryToolSearchBridge(toolNames) {
+	const memoryToolNames = toolNames.map((name) => normalizeCodexDynamicToolName(name)).filter((name) => CODEX_MEMORY_TOOL_NAMES.has(name)).toSorted();
+	if (memoryToolNames.length === 0) return;
+	return `Codex may expose ${memoryToolNames.join(" and ")} as deferred tools. When the memory guidance above calls for memory recall, use an already-loaded memory tool directly. If the needed memory tool is deferred and not currently callable, use \`tool_search\` to load it, then call that memory tool.`;
+}
+function isSameCodexWorkspacePath(left, right) {
+	return path.resolve(left) === path.resolve(right);
+}
+/**
+* Remaps bootstrap file paths from the resolved workspace to the effective Codex
+* workspace while preserving platform path separators.
+*/
+function remapCodexContextFilePath(params) {
+	const relativePath = path.relative(params.sourceWorkspaceDir, params.filePath);
+	if (!relativePath || relativePath === ".." || relativePath.startsWith(`..${path.sep}`) || path.isAbsolute(relativePath) || params.sourceWorkspaceDir === params.targetWorkspaceDir) return params.filePath;
+	const targetUsesPosixSeparators = params.targetWorkspaceDir.includes("/") && !params.targetWorkspaceDir.includes("\\");
+	const normalizedRelativePath = targetUsesPosixSeparators ? relativePath.replaceAll("\\", "/") : relativePath.replaceAll("/", "\\");
+	return targetUsesPosixSeparators ? path.posix.join(params.targetWorkspaceDir, normalizedRelativePath) : path.win32.join(params.targetWorkspaceDir, normalizedRelativePath);
+}
+function normalizeCodexContextFilePath(filePath) {
+	return filePath.trim().replaceAll("\\", "/").toLowerCase();
+}
+function getCodexContextFileDisplayBasename(filePath) {
+	return filePath.trim().replaceAll("\\", "/").split("/").pop()?.trim() ?? "";
+}
+function getCodexContextFileBasename(filePath) {
+	return normalizeCodexContextFilePath(filePath).split("/").pop() ?? "";
+}
+function normalizeCodexDynamicToolName(name) {
+	return name.trim().toLowerCase();
+}
+function isNonEmptyString(value) {
+	return typeof value === "string" && value.length > 0;
+}
+//#endregion
+export { getCodexContextFileDisplayBasename as a, normalizeCodexDynamicToolName as c, getCodexContextFileBasename as i, prepareCodexWorkspaceDeveloperInstructions as l, CODEX_NATIVE_PROJECT_DOC_BASENAMES as n, isNonEmptyString as o, buildCodexWorkspaceBootstrapContext as r, normalizeCodexContextFilePath as s, CODEX_MEMORY_CONTEXT_BASENAME as t };

package/dist/.setup/{auth-binding-DhLWa_7K.mjs → auth-binding-BLWz7stm.mjs}

@@ -1,4 +1,5 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+import { i as isCodexResponsesOAuthCredential, o as resolveCodexResponsesOAuthProfileFingerprint } from "./responses-oauth-twnuTaAa.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-jo6H8dFr.mjs";
 import { resolveApiKeyForProfile } from "openclaw/plugin-sdk/agent-runtime";
 import { fingerprintResolvedAuthProfileCredential } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { resolveOpenAICodexAuthIdentity } from "openclaw/plugin-sdk/provider-auth";
@@ -29,6 +30,18 @@ async function prepareCodexAppServerAuthBinding(params) {
 	const credential = params.authProfileStore.profiles[params.authProfileId];
 	if (!credential) return;
 	if (credential.type === "oauth") {
+		if (isCodexResponsesOAuthCredential(credential)) {
+			const store = structuredClone(params.authProfileStore);
+			return {
+				fingerprint: await resolveCodexResponsesOAuthProfileFingerprint({
+					profileId: params.authProfileId,
+					store,
+					agentDir: params.agentDir,
+					config: params.config
+				}),
+				authProfileStore: store
+			};
+		}
 		const fingerprint = fingerprintResolvedAuthProfileCredential({
 			profileId: params.authProfileId,
 			credential: {