@openclaw/codex 2026.9.7 → 2026.10.1-beta.1

package/dist/.setup/session-binding-record-Oe9L-CNY.mjs

@@ -1,375 +0,0 @@
-import { d as CODEX_PLUGIN_MARKETPLACE_NAME_PATTERN, r as normalizeCodexServiceTier } from "./config-utils-D0CXecki.mjs";
-import { a as matchesCodexNativeSubagentSubmissionOwner, h as codexNativeSubagentHistoryConnectionFingerprint, r as readNativePendingAssignments, s as readCodexNativeSubagentSubmissions, t as matchesNativeAssignmentLifecycle } from "./native-subagent-pending-assignments-DwkCzLvD.mjs";
-import { asOptionalRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { createHash } from "node:crypto";
-import { isDeepStrictEqual } from "node:util";
-import { AgentHarnessPreflightError } from "openclaw/plugin-sdk/agent-harness-registration";
-import { resolveSessionAgentIdsStrict } from "openclaw/plugin-sdk/agent-scope-runtime";
-import { z } from "zod";
-//#region extensions/codex/src/app-server/session-binding-record.ts
-/** Canonical binding codec and synchronous generation-aware reads; no lifecycle or auth loading. */
-/** Resolves the same agent scope OpenClaw uses for transcript/session ownership. */
-function sessionBindingIdentity(params) {
-	const { sessionAgentId } = resolveSessionAgentIdsStrict(params);
-	const sessionKey = params.sessionKey?.trim();
-	return {
-		kind: "session",
-		agentId: sessionAgentId,
-		sessionId: params.sessionId,
-		...sessionKey ? { sessionKey } : {}
-	};
-}
-const optionalStringSchema = z.string().optional().catch(void 0);
-const optionalBooleanSchema = z.boolean().optional().catch(void 0);
-const optionalNonBlankStringSchema = z.string().refine((value) => Boolean(value.trim())).optional().catch(void 0);
-const optionalTimestampSchema = z.string().refine((value) => Number.isFinite(Date.parse(value))).optional().catch(void 0);
-const pendingSupervisionBranchSchema = z.object({
-	sourceThreadId: z.string().trim().min(1),
-	connectionFingerprint: z.string().trim().min(1).optional(),
-	lastTurnId: z.string().trim().min(1).optional(),
-	cleanupThreadIds: z.array(z.string().trim().min(1)).max(2).optional()
-}).strict().superRefine((pending, context) => {
-	const cleanupThreadIds = pending.cleanupThreadIds ?? [];
-	if (new Set(cleanupThreadIds).size !== cleanupThreadIds.length) context.addIssue({
-		code: "custom",
-		message: "pending supervision cleanup thread ids must be unique"
-	});
-	if (cleanupThreadIds.includes(pending.sourceThreadId)) context.addIssue({
-		code: "custom",
-		message: "pending supervision cleanup cannot target its source"
-	});
-});
-const contextEngineProjectionSchema = z.object({
-	schemaVersion: z.literal(1),
-	mode: z.literal("thread_bootstrap"),
-	epoch: z.string().refine((value) => Boolean(value.trim())),
-	fingerprint: optionalStringSchema
-}).strict();
-const contextEngineSchema = z.object({
-	schemaVersion: z.literal(1),
-	engineId: z.string(),
-	policyFingerprint: z.string(),
-	projection: contextEngineProjectionSchema.optional().catch(void 0)
-}).strict();
-const destructiveApprovalModeSchema = z.enum([
-	"allow",
-	"deny",
-	"auto",
-	"ask"
-]).optional().catch(void 0);
-const accountAppPolicyEntrySchema = z.object({
-	source: z.literal("account"),
-	appName: z.string(),
-	allowDestructiveActions: z.boolean(),
-	allowOpenWorld: z.boolean().optional(),
-	destructiveApprovalMode: destructiveApprovalModeSchema,
-	mcpServerNames: z.array(z.string())
-}).strict();
-const pluginAppPolicyEntrySchema = z.object({
-	source: z.literal("plugin").optional(),
-	configKey: z.string(),
-	marketplaceName: z.string().regex(CODEX_PLUGIN_MARKETPLACE_NAME_PATTERN),
-	pluginName: z.string(),
-	allowDestructiveActions: z.boolean(),
-	allowOpenWorld: z.boolean().optional(),
-	destructiveApprovalMode: destructiveApprovalModeSchema,
-	mcpServerNames: z.array(z.string())
-}).strict();
-const pluginAppPolicyContextSchema = z.object({
-	fingerprint: z.string(),
-	apps: z.record(z.string(), z.union([accountAppPolicyEntrySchema, pluginAppPolicyEntrySchema])),
-	pluginAppIds: z.record(z.string(), z.array(z.string())).default({})
-}).strict();
-const legacyAppPolicyEntrySchema = z.union([accountAppPolicyEntrySchema.strip(), pluginAppPolicyEntrySchema.strip()]);
-const threadBindingSchema = z.object({
-	threadId: z.string().refine((value) => Boolean(value.trim())),
-	clientId: optionalStringSchema,
-	cwd: z.string(),
-	rolloutPath: optionalNonBlankStringSchema,
-	connectionScope: z.literal("supervision").optional(),
-	supervisionSourceThreadId: z.string().trim().min(1).optional(),
-	authProfileId: optionalStringSchema,
-	agentWorkspaceDeveloperInstructions: optionalStringSchema,
-	model: optionalStringSchema,
-	preserveNativeModel: z.literal(true).optional().catch(void 0),
-	pendingSupervisionBranch: pendingSupervisionBranchSchema.optional(),
-	pendingResumeConfiguration: z.literal(true).optional(),
-	modelProvider: z.string().transform((value) => value.trim()).pipe(z.string().min(1)).optional().catch(void 0),
-	approvalPolicy: z.preprocess((value) => value === "on-failure" ? "on-request" : value, z.enum([
-		"never",
-		"on-request",
-		"untrusted"
-	]).optional()).catch(void 0),
-	sandbox: z.enum([
-		"read-only",
-		"workspace-write",
-		"danger-full-access"
-	]).optional().catch(void 0),
-	serviceTier: z.preprocess(normalizeCodexServiceTier, z.custom((value) => typeof value === "string").optional()).optional().catch(void 0),
-	networkProxyProfileName: optionalStringSchema,
-	networkProxyConfigFingerprint: optionalStringSchema,
-	dynamicToolsFingerprint: optionalStringSchema,
-	dynamicToolsContainDeferred: optionalBooleanSchema,
-	webSearchThreadConfigFingerprint: optionalStringSchema,
-	nativeSkillIsolationFingerprint: optionalStringSchema,
-	userMcpServersFingerprint: optionalStringSchema,
-	mcpServersFingerprint: optionalStringSchema,
-	configuredMcpOwnershipVersion: z.literal(1).optional().catch(void 0),
-	ringZeroConfigFingerprint: optionalStringSchema,
-	ringZeroClientInstanceId: optionalStringSchema,
-	/** Durable fact preventing a later unrestricted turn from widening this thread. */
-	nativeToolPolicyRestricted: z.literal(true).optional().catch(void 0),
-	nativeHookRelayGeneration: optionalNonBlankStringSchema,
-	appServerRuntimeFingerprint: optionalStringSchema,
-	pluginAppsFingerprint: optionalStringSchema,
-	pluginAppsInputFingerprint: optionalStringSchema,
-	pluginAppPolicyContext: pluginAppPolicyContextSchema.optional().catch(void 0),
-	contextEngine: contextEngineSchema.optional().catch(void 0),
-	environmentSelectionFingerprint: optionalStringSchema,
-	conversationStartId: optionalStringSchema,
-	conversationSourceTransferComplete: z.literal(true).optional().catch(void 0),
-	historyCoveredThrough: optionalTimestampSchema,
-	continuityCalibration: z.object({
-		promptChars: z.number().int().positive(),
-		inputTokens: z.number().int().positive()
-	}).optional().catch(void 0)
-}).superRefine((binding, context) => {
-	if (binding.connectionScope === "supervision") {
-		if (!binding.supervisionSourceThreadId) context.addIssue({
-			code: "custom",
-			message: "supervision connection ownership requires its native source thread id"
-		});
-		if (binding.preserveNativeModel !== true) context.addIssue({
-			code: "custom",
-			message: "supervision connection ownership requires native model ownership"
-		});
-		if (binding.conversationSourceTransferComplete !== true) context.addIssue({
-			code: "custom",
-			message: "supervision connection ownership requires a completed source transfer"
-		});
-		if (!binding.pendingSupervisionBranch && (!binding.model?.trim() || !binding.modelProvider)) context.addIssue({
-			code: "custom",
-			message: "materialized supervision bindings require a native model and provider"
-		});
-	}
-	if (binding.supervisionSourceThreadId && binding.connectionScope !== "supervision") context.addIssue({
-		code: "custom",
-		message: "a supervision source thread id requires supervision connection ownership"
-	});
-	if (!binding.pendingSupervisionBranch) return;
-	if (binding.threadId !== binding.pendingSupervisionBranch.sourceThreadId) context.addIssue({
-		code: "custom",
-		message: "pending supervision source must match the provisional thread binding"
-	});
-	if (binding.supervisionSourceThreadId !== binding.pendingSupervisionBranch.sourceThreadId) context.addIssue({
-		code: "custom",
-		message: "pending supervision source must match its durable source identity"
-	});
-	if (binding.preserveNativeModel !== true) context.addIssue({
-		code: "custom",
-		message: "pending supervision bindings must defer model selection to Codex App Server"
-	});
-	if (binding.connectionScope !== "supervision") context.addIssue({
-		code: "custom",
-		message: "pending supervision bindings require supervision connection ownership"
-	});
-});
-function matchesPendingSupervisionBranch(binding, expected) {
-	const pending = binding?.pendingSupervisionBranch;
-	const cleanup = pending?.cleanupThreadIds ?? [];
-	const expectedCleanup = expected.cleanupThreadIds ?? [];
-	return binding?.threadId === expected.sourceThreadId && pending?.sourceThreadId === expected.sourceThreadId && pending.connectionFingerprint === expected.connectionFingerprint && pending.lastTurnId === expected.lastTurnId && cleanup.length === expectedCleanup.length && cleanup.every((threadId, index) => threadId === expectedCleanup[index]);
-}
-const bindingLeaseSchema = z.object({
-	token: z.string().refine((value) => Boolean(value.trim())),
-	expiresAt: z.number().finite()
-});
-const storedSessionIdSchema = z.string().transform((value) => value.trim()).pipe(z.string().min(1)).optional().catch(void 0);
-const storedBindingSchema = z.discriminatedUnion("state", [z.object({
-	version: z.literal(1),
-	state: z.literal("active"),
-	binding: threadBindingSchema,
-	sessionId: storedSessionIdSchema,
-	lease: bindingLeaseSchema.optional().catch(void 0),
-	nativeSubagentSubmissions: z.unknown().optional(),
-	nativeSubagentAssignments: z.unknown().optional(),
-	nativeSubagentTaskImport: z.unknown().optional()
-}), z.object({
-	version: z.literal(1),
-	state: z.literal("cleared"),
-	sessionId: storedSessionIdSchema,
-	lease: bindingLeaseSchema.optional().catch(void 0),
-	retired: z.literal(true).optional().catch(void 0),
-	nativeSubagentTaskImport: z.unknown().optional()
-})]);
-/** Stable plugin-state key for one current binding owner. */
-function bindingStoreKey(identity) {
-	if (identity.kind === "session") {
-		const rawAgentId = identity.agentId.trim();
-		const sessionId = identity.sessionId.trim();
-		if (!rawAgentId) throw new Error("Codex app-server binding requires an agent id");
-		if (!sessionId) throw new Error("Codex app-server binding requires a session id");
-		const agentId = resolveSessionAgentIdsStrict({ agentId: rawAgentId }).sessionAgentId;
-		const sessionKey = identity.sessionKey?.trim();
-		if (sessionKey) return `session-key:${agentId}:${createHash("sha256").update(sessionKey).digest("base64url")}`;
-		return `session:${agentId}:${sessionId}`;
-	}
-	const bindingId = identity.bindingId.trim();
-	if (!bindingId) throw new Error("Codex app-server conversation binding requires a binding id");
-	return `conversation:${bindingId}`;
-}
-function readStoredCodexAppServerBinding(value) {
-	const result = storedBindingSchema.safeParse(value);
-	if (!result.success) return;
-	return stripUndefinedValue(result.data);
-}
-function ownsStoredSessionGeneration(identity, current) {
-	return identity.kind !== "session" || !current?.sessionId || current.sessionId === identity.sessionId;
-}
-function validateBindingForWrite(binding) {
-	const validated = readCodexAppServerThreadBinding(binding);
-	if (!validated) throw new Error("Invalid Codex app-server thread binding");
-	return stripUndefinedBinding(validated);
-}
-/** Parses stored or shipped sidecar data into the current domain value. */
-function readCodexAppServerThreadBinding(value) {
-	const result = threadBindingSchema.safeParse(value);
-	if (!result.success) return;
-	return result.data;
-}
-function stripUndefinedBinding(binding) {
-	return stripUndefinedValue(binding);
-}
-function stripUndefinedValue(value) {
-	if (Array.isArray(value)) return value.map(stripUndefinedValue);
-	if (!value || typeof value !== "object") return value;
-	return Object.fromEntries(Object.entries(value).filter(([, entry]) => entry !== void 0).map(([key, entry]) => [key, stripUndefinedValue(entry)]));
-}
-function readCodexBindingTimestamp(value) {
-	return optionalTimestampSchema.parse(value);
-}
-/** The same physical-generation check serves execution and read-only projections. */
-function readCurrentCodexAppServerBinding(state, identity) {
-	const key = bindingStoreKey(identity);
-	return decodeCurrentCodexAppServerBinding(key, state.lookup(key), identity);
-}
-function decodeCurrentCodexAppServerBinding(key, raw, identity) {
-	const stored = readStoredCodexAppServerBinding(raw);
-	if (raw !== void 0 && !stored) throw new Error(`Invalid Codex app-server binding row: ${key}`);
-	return stored?.state === "active" && ownsStoredSessionGeneration(identity, stored) ? stored.binding : void 0;
-}
-/** Consume synchronously so each list phase acquires fresh binding authority. */
-function* readCurrentCodexAppServerBindings(state, identities) {
-	let keys;
-	if (state.lookupMany && identities.length > 1 && identities.length <= 1e4) try {
-		keys = identities.map(bindingStoreKey);
-	} catch {}
-	if (!keys || !state.lookupMany) {
-		for (const identity of identities) yield readCurrentCodexAppServerBinding(state, identity);
-		return;
-	}
-	const values = state.lookupMany(keys);
-	for (let index = 0; index < identities.length; index++) {
-		const value = values[index];
-		if (!value.ok) throw value.error;
-		yield decodeCurrentCodexAppServerBinding(keys[index], value.value, identities[index]);
-	}
-}
-function matchesCodexNativeSubagentSubmissionBinding(binding, owner) {
-	return binding.threadId === owner.parentThreadId && !binding.pendingSupervisionBranch && codexNativeSubagentHistoryConnectionFingerprint(binding) === owner.connectionFingerprint;
-}
-/** Unknown metadata stays opaque through ordinary binding writes. */
-function preserveCodexNativeSubagentSubmissions(currentBinding, nextBinding, value) {
-	return currentBinding.threadId === nextBinding.threadId && codexNativeSubagentHistoryConnectionFingerprint(currentBinding) === codexNativeSubagentHistoryConnectionFingerprint(nextBinding) && isDeepStrictEqual(currentBinding.pendingSupervisionBranch, nextBinding.pendingSupervisionBranch) ? value : void 0;
-}
-function readCurrentCodexNativeSubagentSubmissions(state, identity, owner) {
-	const key = bindingStoreKey(identity);
-	const raw = state.lookup(key);
-	const stored = readStoredCodexAppServerBinding(raw);
-	if (raw !== void 0 && !stored) throw new Error(`Invalid Codex app-server binding row: ${key}`);
-	if (stored?.state !== "active" || !ownsStoredSessionGeneration(identity, stored) || identity.kind === "session" && owner.sessionId !== identity.sessionId || !matchesCodexNativeSubagentSubmissionBinding(stored.binding, owner)) return [];
-	const submissions = readCodexNativeSubagentSubmissions(stored.nativeSubagentSubmissions);
-	return submissions && matchesCodexNativeSubagentSubmissionOwner(submissions.owner, owner) ? submissions.receipts : [];
-}
-function readCurrentNativePendingAssignments(state, identity, owner) {
-	const key = bindingStoreKey(identity);
-	const raw = state.lookup(key);
-	const stored = readStoredCodexAppServerBinding(raw);
-	if (raw !== void 0 && !stored) throw new Error(`Invalid Codex app-server binding row: ${key}`);
-	if (stored?.state !== "active" || !ownsStoredSessionGeneration(identity, stored) || identity.kind === "session" && owner.sessionId !== identity.sessionId || !matchesCodexNativeSubagentSubmissionBinding(stored.binding, owner)) return [];
-	return (readNativePendingAssignments(stored.nativeSubagentAssignments)?.assignments ?? []).filter((entry) => matchesNativeAssignmentLifecycle(entry.owner, owner));
-}
-function preserveNativeTaskImport(current) {
-	return current?.nativeSubagentTaskImport !== void 0 ? { nativeSubagentTaskImport: current.nativeSubagentTaskImport } : {};
-}
-/** Preserve inventory through native rotation, never across a connection-policy change. */
-function preserveNativePendingAssignments(current, next, value) {
-	return codexNativeSubagentHistoryConnectionFingerprint(current) === codexNativeSubagentHistoryConnectionFingerprint(next) && isDeepStrictEqual(current.pendingSupervisionBranch, next.pendingSupervisionBranch) ? value : void 0;
-}
-var CodexSupervisionBindingReplacementError = class extends Error {
-	constructor(threadId, operation) {
-		super(`Refusing to replace supervised Codex thread ${threadId} while ${operation}; its native user-home connection and model ownership must be preserved`);
-		this.name = "CodexSupervisionBindingReplacementError";
-	}
-};
-function assertCodexBindingMayBeReplaced(binding, operation, expected) {
-	if (expected) throw new AgentHarnessPreflightError(`Codex native model ownership prevents ${operation}. Continue or compact the original session in its native runtime, or create a new chat with a concrete model; the original binding was preserved.`);
-	if (binding?.connectionScope === "supervision") throw new CodexSupervisionBindingReplacementError(binding.threadId, operation);
-}
-function readPluginAppPolicyContext(value, bindingSchemaVersion) {
-	const record = asOptionalRecord(value);
-	if (!record || typeof record.fingerprint !== "string") return;
-	const apps = asOptionalRecord(record.apps);
-	if (!apps) return;
-	const parsedApps = {};
-	for (const [appId, rawEntry] of Object.entries(apps)) {
-		const entry = asOptionalRecord(rawEntry);
-		if (!entry) return;
-		const destructiveApprovalMode = readDestructiveApprovalMode(entry.destructiveApprovalMode, bindingSchemaVersion);
-		if ("appId" in entry || destructiveApprovalMode === "invalid") return;
-		const parsed = legacyAppPolicyEntrySchema.safeParse({
-			...entry,
-			destructiveApprovalMode
-		});
-		if (!parsed.success) return;
-		const validated = parsed.data;
-		const policy = {
-			allowDestructiveActions: validated.allowDestructiveActions,
-			...validated.allowOpenWorld !== void 0 ? { allowOpenWorld: validated.allowOpenWorld } : {},
-			...destructiveApprovalMode ? { destructiveApprovalMode } : {},
-			mcpServerNames: validated.mcpServerNames
-		};
-		if (validated.source === "account") parsedApps[appId] = {
-			source: "account",
-			appName: validated.appName,
-			...policy
-		};
-		else parsedApps[appId] = {
-			configKey: validated.configKey,
-			marketplaceName: validated.marketplaceName,
-			pluginName: validated.pluginName,
-			...policy
-		};
-	}
-	const parsedPluginAppIds = {};
-	if (record.pluginAppIds !== void 0 && (!record.pluginAppIds || typeof record.pluginAppIds !== "object" || Array.isArray(record.pluginAppIds))) return;
-	if (record.pluginAppIds && typeof record.pluginAppIds === "object") for (const [configKey, appIds] of Object.entries(record.pluginAppIds)) {
-		if (!Array.isArray(appIds) || appIds.some((appId) => typeof appId !== "string")) return;
-		parsedPluginAppIds[configKey] = appIds;
-	}
-	return {
-		fingerprint: record.fingerprint,
-		apps: parsedApps,
-		pluginAppIds: parsedPluginAppIds
-	};
-}
-function readDestructiveApprovalMode(value, bindingSchemaVersion) {
-	if (value === void 0) return;
-	if (value === "allow" || value === "deny") return value;
-	if (value === "auto") return bindingSchemaVersion === 1 ? "allow" : "auto";
-	if (value === "ask" && bindingSchemaVersion === 2) return "ask";
-	if (value === "on-request" && bindingSchemaVersion === 1) return "auto";
-	return "invalid";
-}
-//#endregion
-export { readStoredCodexAppServerBinding as _, matchesPendingSupervisionBranch as a, validateBindingForWrite as b, preserveNativePendingAssignments as c, readCodexBindingTimestamp as d, readCurrentCodexAppServerBinding as f, readPluginAppPolicyContext as g, readCurrentNativePendingAssignments as h, matchesCodexNativeSubagentSubmissionBinding as i, preserveNativeTaskImport as l, readCurrentCodexNativeSubagentSubmissions as m, assertCodexBindingMayBeReplaced as n, ownsStoredSessionGeneration as o, readCurrentCodexAppServerBindings as p, bindingStoreKey as r, preserveCodexNativeSubagentSubmissions as s, CodexSupervisionBindingReplacementError as t, readCodexAppServerThreadBinding as u, sessionBindingIdentity as v, stripUndefinedBinding as y };