@openclaw/codex 2026.9.8 → 2026.10.1-beta.1

package/dist/.setup/{native-subagent-pending-assignments-DwkCzLvD.mjs → native-subagent-pending-assignments-BDqhOdJp.mjs}

@@ -49,10 +49,6 @@ function assertHistoryOwnerMatchesRegistration(saved, current, parentThreadId, r
 }
 //#endregion
 //#region extensions/codex/src/app-server/native-subagent-assignment.ts
-/**
-* Shared identifiers for Codex native subagent execution and completion receipts.
-*/
-/** Run ID prefix for native child thread assignments. */
 const CODEX_NATIVE_SUBAGENT_RUN_ID_PREFIX = "codex-thread:";
 /** Initial assignments use the thread locator; follow-ups belong to a native turn. */
 function codexNativeSubagentRunId(threadId, turnId) {

package/dist/.setup/{native-task-assignments-DMQ0g3hu.mjs → native-task-assignments-C6KVqiN1.mjs}

@@ -1,13 +1,10 @@
-import { _ as readCodexNativeSubagentHistoryOwner, h as codexNativeSubagentHistoryConnectionFingerprint, r as readNativePendingAssignments, u as readCodexNativeSubagentRunId } from "./native-subagent-pending-assignments-DwkCzLvD.mjs";
-import { _ as readStoredCodexAppServerBinding, r as bindingStoreKey } from "./session-binding-record-Oe9L-CNY.mjs";
-import { n as CODEX_APP_SERVER_BINDING_NAMESPACE, t as CODEX_APP_SERVER_BINDING_MAX_ENTRIES } from "./session-binding-meta-B7aEMU7g.mjs";
+import { _ as readCodexNativeSubagentHistoryOwner, h as codexNativeSubagentHistoryConnectionFingerprint, r as readNativePendingAssignments, u as readCodexNativeSubagentRunId } from "./native-subagent-pending-assignments-BDqhOdJp.mjs";
+import { i as CODEX_APP_SERVER_BINDING_NAMESPACE, r as CODEX_APP_SERVER_BINDING_MAX_ENTRIES } from "./session-binding-meta-Lkm5Lpf4.mjs";
 import { isDeepStrictEqual } from "node:util";
 import { z } from "zod";
 import path from "node:path";
 import fs from "node:fs/promises";
 import { extractErrorCode } from "openclaw/plugin-sdk/error-runtime";
-import { getSessionEntry, resolveStorePath } from "openclaw/plugin-sdk/session-store-runtime";
-import { executeSqliteQuerySync, getNodeSqliteKysely, openNodeSqliteDatabase, prepareSqliteReadOnlyLocation, tableExists } from "openclaw/plugin-sdk/sqlite-runtime";
 //#region extensions/codex/src/migration/native-task-assignments.ts
 const importSchema = z.object({
 	version: z.literal(1),
@@ -39,6 +36,8 @@ async function inspect(params) {
 		if (extractErrorCode(error) === "ENOENT") return [];
 		throw error;
 	}
+	const { bindingStoreKey, readStoredCodexAppServerBinding } = await import("./session-binding-record-BZB8RgcF.mjs").then((n) => n.h);
+	const { executeSqliteQuerySync, getNodeSqliteKysely, openNodeSqliteDatabase, prepareSqliteReadOnlyLocation, tableExists } = await import("openclaw/plugin-sdk/sqlite-runtime");
 	const snapshot = await prepareSqliteReadOnlyLocation(source, { preserveSourceArtifacts: true });
 	try {
 		const db = openNodeSqliteDatabase(snapshot.location, { readOnly: true });
@@ -82,7 +81,7 @@ async function inspect(params) {
 		await snapshot.cleanupAsync();
 	}
 }
-function prepareAssignment(task, stored, params) {
+function prepareAssignment(task, stored, params, { getSessionEntry, resolveStorePath }) {
 	const identity = taskIdentity(task);
 	const native = readCodexNativeSubagentRunId(task.run_id ?? void 0);
 	const detail = task.detail_json ? JSON.parse(task.detail_json) : {};
@@ -134,6 +133,8 @@ const codexNativeTaskAssignmentMigration = {
 			changes: [],
 			warnings
 		};
+		const { bindingStoreKey, readStoredCodexAppServerBinding } = await import("./session-binding-record-BZB8RgcF.mjs").then((n) => n.h);
+		const sessionStore = await import("openclaw/plugin-sdk/session-store-runtime");
 		let imported = 0;
 		const store = params.context.openPluginStateKeyedStore({
 			namespace: CODEX_APP_SERVER_BINDING_NAMESPACE,
@@ -155,7 +156,7 @@ const codexNativeTaskAssignmentMigration = {
 				taskIds: []
 			} : importSchema.parse(stored.nativeSubagentTaskImport);
 			if (marker.taskIds.includes(task.task_id)) continue;
-			const assignment = prepareAssignment(task, stored, params);
+			const assignment = prepareAssignment(task, stored, params, sessionStore);
 			if (stored.state !== "active" || observed.value?.state !== "active") continue;
 			const assignments = readNativePendingAssignments(stored.nativeSubagentAssignments)?.assignments ?? [];
 			const existing = assignments.find((value) => value.runId === assignment.runId);
@@ -173,7 +174,7 @@ const codexNativeTaskAssignmentMigration = {
 				}
 			};
 			if ((await store.withCurrent({ assertCurrent: () => {
-				prepareAssignment(task, stored, params);
+				prepareAssignment(task, stored, params, sessionStore);
 			} }).compareAndApply(key, observed.comparison, {
 				operation: "update",
 				action: "set",

package/dist/.setup/{node-cli-sessions-HC4W6FLI.mjs → node-cli-sessions-B5oNDkUS.mjs}

@@ -1,18 +1,18 @@
-import { A as unwrapNodeInvokePayload, x as readBoundedOptionalString } from "./session-catalog-parsing-CPGaPYr-.mjs";
+import { A as unwrapNodeInvokePayload, x as readBoundedOptionalString } from "./session-catalog-parsing-B-qWJh2x.mjs";
 import { r as resolveCodexAppServerUserHomeDir } from "./auth-start-options-BPIPeEX8.mjs";
-import { o as formatCodexDisplayText } from "./command-formatters-R3ckE3Co.mjs";
+import { o as formatCodexDisplayText } from "./command-formatters-DV3DHhdr.mjs";
 import { t as codexCatalogHomeId } from "./session-catalog-home-id-vlih0B_g.mjs";
-import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { runCommandBuffered, withCommandProcessScope } from "openclaw/plugin-sdk/process-runtime";
+import { asNonArrayRecord, isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { timestampMsToIsoString } from "openclaw/plugin-sdk/number-runtime";
 import { materializeWindowsSpawnProgram, resolveWindowsSpawnProgram } from "openclaw/plugin-sdk/windows-spawn";
+import { runCommandBuffered, withCommandProcessScope } from "openclaw/plugin-sdk/process-runtime";
 import path from "node:path";
 import fs from "node:fs/promises";
-import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
 import process from "node:process";
+import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
 import { parseAgentSessionKey } from "openclaw/plugin-sdk/routing";
 import { resolvePreferredOpenClawTmpDir } from "openclaw/plugin-sdk/temp-path";
-import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
+import { safeParseJson, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 //#region extensions/codex/src/jsonl-lines.ts
 const JSONL_STREAM_THRESHOLD_BYTES = 4194304;
 const JSONL_READ_CHUNK_BYTES = 1048576;
@@ -187,7 +187,7 @@ async function resumeCodexCliSessionOnNode(params) {
 	let catalogAgentId;
 	let catalogHomeId;
 	if (params.sessionKey) {
-		const { adoptionSessionKeyRest, CODEX_NODE_SESSION_KEY_PREFIX, readNodeSessionMarker } = await import("./session-catalog-node-adoption-DgXvSGu0.mjs");
+		const { adoptionSessionKeyRest, CODEX_NODE_SESSION_KEY_PREFIX, readNodeSessionMarker } = await import("./session-catalog-node-adoption-7-WEQTB1.mjs");
 		const entry = params.runtime.agent.session.getSessionEntry({
 			sessionKey: params.sessionKey,
 			readConsistency: "latest"
@@ -387,10 +387,10 @@ async function readSessionFileSummary(file) {
 	let messageCount = 0;
 	const result = await visitJsonlLines(file, (line) => {
 		const parsed = parseJsonRecord(line.trim());
-		if (typeof parsed.timestamp === "string" && parsed.timestamp.trim()) updatedAt = parsed.timestamp.trim();
+		updatedAt = normalizeOptionalString(parsed.timestamp) ?? updatedAt;
 		if (parsed.type === "session_meta" && isRecord(parsed.payload)) {
-			if (typeof parsed.payload.id === "string" && parsed.payload.id.trim()) sessionId = parsed.payload.id.trim();
-			if (typeof parsed.payload.cwd === "string" && parsed.payload.cwd.trim()) cwd = parsed.payload.cwd.trim();
+			sessionId = normalizeOptionalString(parsed.payload.id) ?? sessionId;
+			cwd = normalizeOptionalString(parsed.payload.cwd) ?? cwd;
 			return;
 		}
 		const messageText = readResponseItemMessageText(parsed);
@@ -475,13 +475,7 @@ function parseCodexCliSessionsListResult(raw) {
 	};
 }
 function parseJsonRecord(paramsJSON) {
-	if (!paramsJSON?.trim()) return {};
-	try {
-		const parsed = JSON.parse(paramsJSON);
-		return isRecord(parsed) ? parsed : {};
-	} catch {
-		return {};
-	}
+	return asNonArrayRecord(safeParseJson(paramsJSON ?? ""));
 }
 async function readFileMtimeIso(file) {
 	try {

package/dist/.setup/{node-exec-server.runtime-BgBfWQqo.mjs → node-exec-server.runtime-0xSEjKYt.mjs}

@@ -1,5 +1,5 @@
-import { i as resolveManagedCodexNativeCommand, r as resolveManagedCodexAppServerStartOptions, t as isManagedCodexDesktopCommand } from "./managed-binary-kiWRhNRE.mjs";
-import { a as closeCodexAppServerTransportAndWait, t as createStdioTransport } from "./transport-stdio-Bdegpn2V.mjs";
+import { i as resolveManagedCodexNativeCommand, r as resolveManagedCodexAppServerStartOptions, t as isManagedCodexDesktopCommand } from "./managed-binary-C1VFoVPf.mjs";
+import { a as closeCodexAppServerTransportAndWait, t as createStdioTransport } from "./transport-stdio-a0HDa2Mj.mjs";
 import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { stripVTControlCharacters } from "node:util";
 import { killProcessTree } from "openclaw/plugin-sdk/process-runtime";

package/dist/.setup/{plan-DPdMk1Oy.mjs → plan-CUHSIOep.mjs}

@@ -1,7 +1,7 @@
-import { u as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-Cky2XJUw.mjs";
 import { t as isOnlyMigrationKind } from "./scope-DOC1Xjc8.mjs";
-import "./config-DKhXquav.mjs";
-import { i as hasCodexSource, n as defaultCodexHome, o as readJsonObject, r as discoverCodexSource, s as sanitizeName, t as codexPluginMigrationSubscriptionWarning } from "./source-CJis_1EF.mjs";
+import { l as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-Bf0_piTw.mjs";
+import "./config-0Gxk3_eq.mjs";
+import { i as hasCodexSource, n as defaultCodexHome, o as readJsonObject, r as discoverCodexSource, s as sanitizeName, t as codexPluginMigrationSubscriptionWarning } from "./source-DH70LqN0.mjs";
 import { asBoolean, asOptionalRecord, isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash } from "node:crypto";
 import { runCommandBuffered } from "openclaw/plugin-sdk/process-runtime";
@@ -13,19 +13,23 @@ import { fileURLToPath } from "node:url";
 import { loadAuthProfileStoreWithoutExternalProfiles } from "openclaw/plugin-sdk/agent-runtime";
 import { applyAuthProfileConfig, buildApiKeyCredential, buildOauthProviderAuthResult, buildOpenAICodexCredentialExtra, hasUsableOAuthCredential, resolveOpenAICodexAuthIdentity, resolveOpenAICodexImportProfileName, updateAuthProfileStoreWithLock } from "openclaw/plugin-sdk/provider-auth";
 import { extractErrorCode, pathExists } from "openclaw/plugin-sdk/security-runtime";
-import { MIGRATION_REASON_TARGET_EXISTS, createMigrationItem, createMigrationManualItem, hasMigrationConfigPatchConflict, markMigrationItemConflict, markMigrationItemError, markMigrationItemSkipped, mergeMigrationConfigValue, readMigrationConfigPath, resolveMigrationConfigRuntime, summarizeMigrationItems } from "openclaw/plugin-sdk/migration";
+import { MIGRATION_REASON_TARGET_EXISTS, createMigrationItem, createMigrationManualItem, markMigrationItemConflict, markMigrationItemError, markMigrationItemSkipped, mergeMigrationConfigValue, readMigrationConfigPath, resolveMigrationConfigRuntime, summarizeMigrationItems } from "openclaw/plugin-sdk/migration";
 import { resolvePlannedMigrationTargets } from "openclaw/plugin-sdk/migration-runtime";
 import { decodeOpenAICodexJwtPayload as decodeOpenAICodexJwtPayload$1 } from "openclaw/plugin-sdk/provider-oauth-runtime";
 //#region extensions/codex/src/migration/auth-profile-target.ts
 const OPENAI_PROVIDER_ID$1 = "openai";
 const LEGACY_CODEX_PROFILE_ID = "openai:default";
-function findMatchingOAuthProfile(store, credential) {
-	const subject = oauthSubject(credential);
-	if (!subject) return;
+function findMatchingAuthProfile(store, credential) {
+	const subject = credential.kind === "oauth" ? oauthSubject(credential.credential) : void 0;
+	const provider = credential.kind === "oauth" ? credential.credential.provider : credential.provider;
+	if (credential.kind === "oauth" && !subject) return;
 	for (const [profileId, existing] of Object.entries(store.profiles)) {
-		if (existing.type !== "oauth" || existing.provider !== credential.provider) continue;
-		const previous = oauthSubject(existing);
-		if (previous?.accountId === subject.accountId && previous.userId === subject.userId) return profileId;
+		if (existing.provider !== provider) continue;
+		if (credential.kind === "api_key" && existing.type === "api_key" && existing.key === credential.key) return profileId;
+		if (subject && existing.type === "oauth") {
+			const previous = oauthSubject(existing);
+			if (previous?.accountId === subject.accountId && previous.userId === subject.userId) return profileId;
+		}
 	}
 }
 function oauthSubject(credential) {
@@ -38,24 +42,19 @@ function oauthSubject(credential) {
 		userId
 	} : void 0;
 }
-function findMatchingApiKeyProfile(store, provider, key) {
-	for (const [profileId, existing] of Object.entries(store.profiles)) if (existing.type === "api_key" && existing.provider === provider && existing.key === key) return profileId;
-}
 function itemProfileTarget(credential, store, ctx, source) {
+	const matched = findMatchingAuthProfile(store, credential);
+	if (matched) return {
+		profileId: matched,
+		matchedExisting: true
+	};
 	if (credential.kind === "oauth") {
-		const profile = credential.result.profiles[0];
-		const matched = profile?.credential.type === "oauth" ? findMatchingOAuthProfile(store, profile.credential) : void 0;
-		if (matched) return {
-			profileId: matched,
-			matchedExisting: true
-		};
 		const legacyProfile = ctx.config.auth?.profiles?.[LEGACY_CODEX_PROFILE_ID];
 		return {
-			profileId: legacyProfile?.provider === OPENAI_PROVIDER_ID$1 && legacyProfile.mode === "oauth" && source.codexHome === defaultCodexHome() && profile?.credential.type === "oauth" && oauthSubject(profile.credential) !== void 0 && !Object.entries(store.profiles).some(([id, existing]) => id !== "openai:default" && existing.type === "oauth" && existing.provider === OPENAI_PROVIDER_ID$1) ? LEGACY_CODEX_PROFILE_ID : credential.profileId,
+			profileId: legacyProfile?.provider === OPENAI_PROVIDER_ID$1 && legacyProfile.mode === "oauth" && source.codexHome === defaultCodexHome() && oauthSubject(credential.credential) !== void 0 && !Object.entries(store.profiles).some(([id, existing]) => id !== "openai:default" && existing.type === "oauth" && existing.provider === OPENAI_PROVIDER_ID$1) ? LEGACY_CODEX_PROFILE_ID : credential.profileId,
 			matchedExisting: false
 		};
 	}
-	const matched = findMatchingApiKeyProfile(store, credential.provider, credential.key);
 	return {
 		profileId: matched ?? credential.profileId,
 		matchedExisting: Boolean(matched)
@@ -97,8 +96,8 @@ async function readCodexCliCredentialsAsync(options) {
 	options.signal?.throwIfAborted();
 	if (!options.allowKeychainPrompt) return;
 	const home = await fs.realpath(options.codexHome).catch(() => path.resolve(options.codexHome));
-	const { CodexAppServerClient } = await import("./client-qyUBJlGZ.mjs").then((n) => n.n);
-	const { resolveManagedCodexPackageEntrypoint, resolveManagedCodexNativeCommand } = await import("./managed-binary-kiWRhNRE.mjs").then((n) => n.n);
+	const { CodexAppServerClient } = await import("./client-CBzEVDyb.mjs").then((n) => n.n);
+	const { resolveManagedCodexPackageEntrypoint, resolveManagedCodexNativeCommand } = await import("./managed-binary-C1VFoVPf.mjs").then((n) => n.n);
 	const launcher = resolveManagedCodexPackageEntrypoint(path.dirname(fileURLToPath(import.meta.url)));
 	const command = launcher ? resolveManagedCodexNativeCommand(launcher) : void 0;
 	if (!command) return;
@@ -228,13 +227,12 @@ function authItemId(credential) {
 	return credential.kind === "oauth" ? OPENAI_OAUTH_ITEM_ID : OPENAI_API_KEY_ITEM_ID;
 }
 function sourceCredentialFingerprint(credential) {
-	const profile = credential.kind === "oauth" ? credential.result.profiles[0]?.credential : void 0;
-	const source = credential.kind === "api_key" ? credential.key : profile?.type === "oauth" ? [
-		profile.access,
-		profile.refresh,
-		profile.accountId,
-		profile.idToken
-	] : void 0;
+	const source = credential.kind === "api_key" ? credential.key : [
+		credential.credential.access,
+		credential.credential.refresh,
+		credential.credential.accountId,
+		credential.credential.idToken
+	];
 	return createHash("sha256").update(JSON.stringify([credential.kind, source])).digest("hex");
 }
 async function readModelRefs(source) {
@@ -272,11 +270,12 @@ async function buildCodexOAuthCredential(source, credential, includeConfigPatch)
 		configPatch
 	});
 	const profile = result.profiles[0];
-	return profile ? {
+	return profile?.credential.type === "oauth" ? {
 		kind: "oauth",
 		provider: OPENAI_PROVIDER_ID,
 		profileId: profile.profileId,
-		result
+		credential: profile.credential,
+		configPatch: result.configPatch
 	} : null;
 }
 async function readCodexAuthCredentials(source, options) {
@@ -345,14 +344,13 @@ function authProfileConfigForCredential(credential, profileId) {
 		mode: "api_key",
 		displayName: CODEX_IMPORT_DISPLAY_NAME
 	};
-	const profile = credential.result.profiles[0];
-	if (!profile || profile.credential.type !== "oauth") return null;
+	const profile = credential.credential;
 	return {
 		profileId,
-		provider: profile.credential.provider,
+		provider: profile.provider,
 		mode: "oauth",
-		...profile.credential.email ? { email: profile.credential.email } : {},
-		...profile.credential.displayName ? { displayName: profile.credential.displayName } : {}
+		...profile.email ? { email: profile.email } : {},
+		...profile.displayName ? { displayName: profile.displayName } : {}
 	};
 }
 async function applyCodexAuthProfileConfig(ctx, profile, applyConfig) {
@@ -373,10 +371,8 @@ async function applyCodexAuthProfileConfig(ctx, profile, applyConfig) {
 	}
 }
 function applyCredentialConfig(config, credential, profileId) {
-	let next = credential.kind === "oauth" ? mergeMigrationConfigValue(config, credential.result.configPatch) : config;
-	const profile = authProfileConfigForCredential(credential, profileId);
-	if (profile) next = applyAuthProfileConfig(next, {
-		...profile,
+	const next = applyAuthProfileConfig(credential.kind === "oauth" ? mergeMigrationConfigValue(config, credential.configPatch) : config, {
+		...authProfileConfigForCredential(credential, profileId),
 		preferProfileFirst: false
 	});
 	return credential.kind === "oauth" ? applyDefaultModelIfMissing(next) : next;
@@ -415,7 +411,7 @@ async function buildCodexAuthItems(params) {
 		const { profileId, matchedExisting } = itemProfileTarget(credential, store, params.ctx, params.source);
 		const existing = store.profiles[profileId];
 		const configProfile = authProfileConfigForCredential(credential, profileId);
-		const configConflict = configProfile ? hasAuthProfileConfigConflict(params.ctx.config, configProfile, Boolean(params.ctx.overwrite)) : false;
+		const configConflict = hasAuthProfileConfigConflict(params.ctx.config, configProfile, Boolean(params.ctx.overwrite));
 		const conflict = (existing && !matchedExisting && !params.ctx.overwrite || configConflict) && !skipped;
 		const unavailable = !skipped && !conflict && !params.ctx.overwrite && existing?.type === "oauth" && !hasUsableOAuthCredential(existing);
 		return createMigrationItem({
@@ -474,11 +470,7 @@ async function applyCodexAuthItem(params) {
 	if (!credential || item.details?.sourceCredentialFingerprint !== sourceCredentialFingerprint(credential)) return [markMigrationItemSkipped(item, CODEX_REASON_AUTH_NO_LONGER_PRESENT)];
 	if (item.details?.legacyNativeHome !== void 0 && (item.details.legacyNativeHome !== source.codexHome || source.codexHome !== defaultCodexHome())) return [markMigrationItemSkipped(item, CODEX_REASON_AUTH_NO_LONGER_PRESENT)];
 	ctx.signal?.throwIfAborted();
-	const oauthProfile = credential.kind === "oauth" ? credential.result.profiles[0] : void 0;
-	const oauthCredential = oauthProfile?.credential.type === "oauth" ? oauthProfile.credential : void 0;
-	if (credential.kind === "oauth" && !oauthCredential) return [markMigrationItemError(item, CODEX_REASON_MISSING_AUTH_METADATA)];
 	const configProfile = authProfileConfigForCredential(credential, profileId);
-	if (!configProfile) return [markMigrationItemError(item, CODEX_REASON_MISSING_AUTH_METADATA)];
 	if (hasCurrentAuthProfileConfigConflict(ctx, configProfile)) return [markMigrationItemConflict(item, CODEX_REASON_AUTH_PROFILE_EXISTS)];
 	let conflicted = false;
 	let unusable = false;
@@ -495,18 +487,15 @@ async function applyCodexAuthItem(params) {
 			}
 			const existing = effectiveStore.profiles[profileId];
 			if (!ctx.overwrite && existing) {
-				if ((credential.kind === "oauth" ? findMatchingOAuthProfile(effectiveStore, oauthCredential) : findMatchingApiKeyProfile(effectiveStore, credential.provider, credential.key)) === profileId) {
+				if (findMatchingAuthProfile(effectiveStore, credential) === profileId) {
 					unusable = existing.type === "oauth" && !hasUsableOAuthCredential(existing);
 					return false;
 				}
 				conflicted = true;
 				return false;
 			}
-			freshStore.profiles[profileId] = credential.kind === "oauth" ? {
-				...oauthCredential,
-				displayName: CODEX_IMPORT_DISPLAY_NAME
-			} : {
-				...buildApiKeyCredential(credential.provider, credential.key),
+			freshStore.profiles[profileId] = {
+				...credential.kind === "oauth" ? credential.credential : buildApiKeyCredential(credential.provider, credential.key),
 				displayName: CODEX_IMPORT_DISPLAY_NAME
 			};
 			wrote = true;
@@ -563,22 +552,23 @@ const CODEX_PLUGIN_CONFIG_PATH = [
 	"entries",
 	"codex"
 ];
-const CODEX_PLUGIN_ENABLED_PATH = [
-	"plugins",
-	"entries",
-	"codex",
-	"enabled"
-];
+const CODEX_PLUGIN_ENABLED_PATH = [...CODEX_PLUGIN_CONFIG_PATH, "enabled"];
 const CODEX_PLUGIN_NATIVE_CONFIG_PATH = [
-	"plugins",
-	"entries",
-	"codex",
+	...CODEX_PLUGIN_CONFIG_PATH,
 	"config",
 	"codexPlugins"
 ];
 const MIGRATION_REASON_PLUGIN_EXISTS = "plugin exists";
 const CODEX_PLUGIN_SOURCE_APP_VERIFICATION_UNVERIFIED = "not_run";
 const MIGRATION_REASON_TARGET_NOT_REGULAR = "target is not a regular file";
+function pluginConfigValue(entry) {
+	return {
+		enabled: entry.enabled,
+		marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
+		pluginName: entry.pluginName,
+		...entry.allowDestructiveActions ? { allow_destructive_actions: entry.allowDestructiveActions } : {}
+	};
+}
 async function lstatIfExists(filePath) {
 	try {
 		return await fs.lstat(filePath);
@@ -705,12 +695,12 @@ function buildPluginItems(ctx, plugins) {
 		if (plugin.migratable && plugin.marketplaceName === "openai-curated" && plugin.pluginName) {
 			const configKey = plugin.pluginName;
 			const allowDestructiveActions = readExistingPluginAllowDestructiveActions(existingPluginEntries[configKey], plugin.pluginName);
-			const plannedEntry = {
+			const plannedEntry = pluginConfigValue({
+				configKey,
 				enabled: true,
-				marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
 				pluginName: plugin.pluginName,
-				...allowDestructiveActions ? { allow_destructive_actions: allowDestructiveActions } : {}
-			};
+				allowDestructiveActions
+			});
 			const conflict = !ctx.overwrite && hasExistingCodexPluginEntry(existingPluginEntries, configKey, plugin.pluginName, plannedEntry);
 			items.push(createMigrationItem({
 				id: `plugin:${configKey}`,
@@ -735,15 +725,18 @@ function buildPluginItems(ctx, plugins) {
 			continue;
 		}
 		manualIndex += 1;
+		const manualItem = {
+			id: `plugin:${sanitizeName(plugin.name) || sanitizeName(path.basename(plugin.source))}:${manualIndex}`,
+			source: plugin.source,
+			message: plugin.message ?? `Codex native plugin "${plugin.name}" was found but not activated automatically.`
+		};
 		if (plugin.migrationBlock && plugin.pluginName) {
 			items.push(createMigrationItem({
-				id: `plugin:${sanitizeName(plugin.name) || sanitizeName(path.basename(plugin.source))}:${manualIndex}`,
+				...manualItem,
 				kind: "manual",
 				action: "manual",
-				source: plugin.source,
 				status: "skipped",
 				reason: plugin.migrationBlock.code,
-				message: plugin.message ?? `Codex native plugin "${plugin.name}" was found but not activated automatically.`,
 				details: {
 					pluginName: plugin.pluginName,
 					marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
@@ -754,9 +747,7 @@ function buildPluginItems(ctx, plugins) {
 			continue;
 		}
 		items.push(createMigrationManualItem({
-			id: `plugin:${sanitizeName(plugin.name) || sanitizeName(path.basename(plugin.source))}:${manualIndex}`,
-			source: plugin.source,
-			message: plugin.message ?? `Codex native plugin "${plugin.name}" was found but not activated automatically.`,
+			...manualItem,
 			recommendation: "Review the plugin bundle first, then install trusted compatible plugins with openclaw plugins install <path> --force."
 		}));
 	}
@@ -775,9 +766,6 @@ function readCodexPluginMigrationConfigEntry(item, enabled) {
 		...allowDestructiveActions === "auto" || allowDestructiveActions === "ask" ? { allowDestructiveActions } : {}
 	};
 }
-function readExistingAllowDestructiveActions(config) {
-	return normalizeExistingAllowDestructiveActions(readMigrationConfigPath(config, [...CODEX_PLUGIN_NATIVE_CONFIG_PATH, "allow_destructive_actions"]));
-}
 function normalizeExistingAllowDestructiveActions(value) {
 	if (value === "auto" || value === "on-request") return "auto";
 	if (value === "ask") return "ask";
@@ -796,18 +784,13 @@ function readExistingPluginPolicyRepairs(config) {
 function buildCodexPluginsConfigValue(entries, config) {
 	const plugins = {
 		...readExistingPluginPolicyRepairs(config),
-		...Object.fromEntries(entries.toSorted((a, b) => a.configKey.localeCompare(b.configKey)).map((entry) => [entry.configKey, {
-			enabled: entry.enabled,
-			marketplaceName: CODEX_PLUGINS_MARKETPLACE_NAME,
-			pluginName: entry.pluginName,
-			...entry.allowDestructiveActions ? { allow_destructive_actions: entry.allowDestructiveActions } : {}
-		}]))
+		...Object.fromEntries(entries.toSorted((a, b) => a.configKey.localeCompare(b.configKey)).map((entry) => [entry.configKey, pluginConfigValue(entry)]))
 	};
 	return {
 		enabled: true,
 		config: { codexPlugins: {
 			enabled: true,
-			allow_destructive_actions: readExistingAllowDestructiveActions(config) ?? true,
+			allow_destructive_actions: normalizeExistingAllowDestructiveActions(readMigrationConfigPath(config, [...CODEX_PLUGIN_NATIVE_CONFIG_PATH, "allow_destructive_actions"])) ?? true,
 			plugins
 		} }
 	};
@@ -815,8 +798,7 @@ function buildCodexPluginsConfigValue(entries, config) {
 function hasCodexPluginConfigConflict(config, value) {
 	const enabled = readMigrationConfigPath(config, CODEX_PLUGIN_ENABLED_PATH);
 	if (enabled !== void 0 && enabled !== true) return true;
-	const nativeConfig = value.config?.codexPlugins;
-	if (!isRecord(nativeConfig)) return hasMigrationConfigPatchConflict(config, CODEX_PLUGIN_NATIVE_CONFIG_PATH, nativeConfig);
+	const nativeConfig = value.config.codexPlugins;
 	const existingNativeConfig = readMigrationConfigPath(config, CODEX_PLUGIN_NATIVE_CONFIG_PATH);
 	if (existingNativeConfig === void 0) return false;
 	if (!isRecord(existingNativeConfig)) return true;
@@ -824,12 +806,8 @@ function hasCodexPluginConfigConflict(config, value) {
 	const allowDestructiveActions = nativeConfig.allow_destructive_actions;
 	const existingAllowDestructiveActions = normalizeExistingAllowDestructiveActions(existingNativeConfig.allow_destructive_actions);
 	if (existingNativeConfig.allow_destructive_actions !== void 0 && existingAllowDestructiveActions !== allowDestructiveActions) return true;
-	const plugins = nativeConfig.plugins;
-	if (!isRecord(plugins)) return false;
-	return Object.entries(plugins).some(([configKey, plugin]) => {
-		if (!isRecord(plugin)) return existingNativeConfig[configKey] !== void 0;
-		return hasExistingCodexPluginEntry(readExistingCodexPluginEntries(config), configKey, typeof plugin.pluginName === "string" ? plugin.pluginName : configKey, plugin);
-	});
+	const existingEntries = readExistingCodexPluginEntries(config);
+	return Object.entries(nativeConfig.plugins).some(([configKey, plugin]) => hasExistingCodexPluginEntry(existingEntries, configKey, typeof plugin.pluginName === "string" ? plugin.pluginName : configKey, plugin));
 }
 function buildPluginConfigItem(ctx, pluginItems) {
 	const entries = pluginItems.filter((item) => item.status === "planned").map((item) => readCodexPluginMigrationConfigEntry(item, true)).filter((entry) => entry !== void 0);

package/dist/.setup/{plugin-activation-cNHRfaxU.mjs → plugin-activation-BcyBv8PG.mjs}

@@ -1,6 +1,6 @@
-import { i as listCodexPluginMetadata, n as isOpenAiCuratedMarketplace, o as pluginReadParams, r as isOpenAiCuratedMarketplaceName, t as findCodexMarketplacePluginSummary, u as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-Cky2XJUw.mjs";
-import { n as CodexAppServerRpcError } from "./rpc-error-BlD2vuzn.mjs";
-import "./config-DKhXquav.mjs";
+import { r as CodexAppServerRpcError } from "./rpc-error-hmWM21RB.mjs";
+import { a as pluginReadParams, l as CODEX_PLUGINS_MARKETPLACE_NAME, n as isOpenAiCuratedMarketplaceName, r as listCodexPluginMetadata, t as findCodexMarketplacePluginSummary } from "./plugin-inventory-Bf0_piTw.mjs";
+import "./config-0Gxk3_eq.mjs";
 import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 //#region extensions/codex/src/app-server/plugin-activation.ts
 /** Activates legacy curated plugins without granting install authority to other marketplaces. */
@@ -13,7 +13,7 @@ async function ensureCodexPluginActivation(params) {
 	const listed = await listCodexPluginMetadata(params, CODEX_PLUGINS_MARKETPLACE_NAME);
 	const resolved = findCodexMarketplacePluginSummary(listed, params.identity.marketplaceName, params.identity.pluginName);
 	if (!resolved) {
-		if (!listed.marketplaces.some((marketplace) => isOpenAiCuratedMarketplace(marketplace))) return activationFailure(params.identity, "marketplace_missing", { message: `Codex marketplace ${CODEX_PLUGINS_MARKETPLACE_NAME} was not found.` });
+		if (!listed.marketplaces.some((marketplace) => isOpenAiCuratedMarketplaceName(marketplace.name))) return activationFailure(params.identity, "marketplace_missing", { message: `Codex marketplace ${CODEX_PLUGINS_MARKETPLACE_NAME} was not found.` });
 		return activationFailure(params.identity, "plugin_missing", { message: `${params.identity.pluginName} was not found in ${CODEX_PLUGINS_MARKETPLACE_NAME}.` });
 	}
 	if (resolved.marketplace.remoteMarketplaceName && !resolved.summary.remotePluginId) return activationFailure(params.identity, "plugin_missing", { message: `${params.identity.pluginName} detail unavailable: Codex did not return a remote plugin id.` });

package/dist/.setup/{plugin-app-cache-key-BL9B5H0L.mjs → plugin-app-cache-key-BW8rd98k.mjs}

@@ -50,11 +50,12 @@ var CodexAppInventoryCache = class {
 		}
 		const state = entry.invalidated || !isFutureDateTimestampMs(entry.expiresAtMs, { nowMs }) ? "stale" : "fresh";
 		const refreshScheduled = state === "fresh" && !params.forceRefetch ? false : this.scheduleRefresh(params);
+		const { invalidated: _invalidated, invalidatedAppIds: _invalidatedAppIds, ...snapshot } = entry;
 		return {
 			state,
 			key: params.key,
 			revision: entry.revision,
-			snapshot: stripEntryState(entry),
+			snapshot,
 			refreshScheduled,
 			...entry.lastError ? { diagnostic: entry.lastError } : {}
 		};
@@ -91,9 +92,6 @@ var CodexAppInventoryCache = class {
 		this.diagnostics.clear();
 		this.revision = 0;
 	}
-	getRevision() {
-		return this.revision;
-	}
 	scheduleRefresh(params) {
 		this.refreshNow(params).catch(() => void 0);
 		return true;
@@ -153,13 +151,15 @@ var CodexAppInventoryCache = class {
 			}
 			return snapshot;
 		} catch (error) {
-			const diagnostic = {
-				message: sanitizeErrorMessage(error instanceof Error ? error.message : String(error)),
-				atMs: nowMs
-			};
-			this.diagnostics.set(params.key, diagnostic);
-			const entry = this.entries.get(params.key);
-			if (entry) entry.lastError = diagnostic;
+			if (this.refreshTokens.get(params.key) === refreshToken) {
+				const diagnostic = {
+					message: sanitizeErrorMessage(error instanceof Error ? error.message : String(error)),
+					atMs: nowMs
+				};
+				this.diagnostics.set(params.key, diagnostic);
+				const entry = this.entries.get(params.key);
+				if (entry) entry.lastError = diagnostic;
+			}
 			embeddedAgentLog.warn("codex app inventory refresh failed", {
 				forceRefetch: params.forceRefetch === true,
 				keyFingerprint: fingerprintInventoryCacheKey(params.key),
@@ -275,10 +275,6 @@ async function readInstalledApps(request, options) {
 		installedApps: apps
 	};
 }
-function stripEntryState(entry) {
-	const { invalidated: _invalidated, invalidatedAppIds: _invalidatedAppIds, ...snapshot } = entry;
-	return snapshot;
-}
 function fingerprintInventoryCacheKey(key) {
 	let hash = 0;
 	for (let index = 0; index < key.length; index += 1) hash = hash * 31 + key.charCodeAt(index) >>> 0;