mlclaw 0.4.10 → 0.6.0

package/dist/mlclaw.mjs

@@ -8956,7 +8956,7 @@ import fs15 from "node:fs/promises";
 import { realpathSync } from "node:fs";
 import os8 from "node:os";
 import process4 from "node:process";
-import { createHash as createHash4, randomBytes, randomUUID as randomUUID2 } from "node:crypto";
+import { createHash as createHash4, randomBytes as randomBytes2, randomUUID as randomUUID2 } from "node:crypto";
 import { pathToFileURL as pathToFileURL2 } from "node:url";
 import { setTimeout as delay2 } from "node:timers/promises";
 
@@ -15383,9 +15383,9 @@ function nextLink(header) {
 
 // src/mlclaw/release-config.generated.ts
 var RELEASE_CONFIG = {
-  "packageVersion": "0.4.10",
+  "packageVersion": "0.6.0",
   "openclawVersion": "2026.7.1",
-  "brokerkitVersion": "hf-broker/v0.5.2",
+  "brokerkitVersion": "hf-broker/v0.6.2",
   "brokerkitPluginVersion": "0.4.1",
   "runtimeImageRepository": "ghcr.io/huggingface/mlclaw"
 };
@@ -15530,6 +15530,7 @@ RUN apt-get update \\
   && rm -rf /var/lib/apt/lists/*
 RUN python3 -m pip install --break-system-packages --no-cache-dir \\
   "huggingface_hub==1.19.0" \\
+  "hf-xet==1.5.2" \\
   "datasets==5.0.0" \\
   "safetensors==0.8.0" \\
   "fastapi==0.137.1" \\
@@ -15701,6 +15702,398 @@ async function assertNoLiveForeignLease(params) {
   );
 }
 
+// src/mlclaw/codex-auth.ts
+import { createCipheriv, createDecipheriv, hkdfSync, randomBytes } from "node:crypto";
+var CODEX_AUTH_OBJECT_BASENAME = ".mlclaw/codex-auth.enc";
+var CODEX_AUTH_REVOCATION_BASENAME = ".mlclaw/codex-auth.revoked";
+function codexAuthObjectPath(statePrefix) {
+  return `${normalizeBucketPrefix(statePrefix)}/${CODEX_AUTH_OBJECT_BASENAME}`;
+}
+function codexAuthRevocationObjectPath(statePrefix) {
+  return `${normalizeBucketPrefix(statePrefix)}/${CODEX_AUTH_REVOCATION_BASENAME}`;
+}
+function codexAuthContext(params) {
+  return compactContext({
+    ...params.deploymentId ? { deploymentId: params.deploymentId } : {},
+    ...params.bucket ? { bucket: params.bucket } : {},
+    statePrefix: normalizeBucketPrefix(params.statePrefix)
+  });
+}
+function encodeCodexAuthDocument(params) {
+  if (!params.authJson || typeof params.authJson !== "object" || Array.isArray(params.authJson)) {
+    throw new Error("Codex auth.json must contain a JSON object");
+  }
+  const authJson = params.authJson;
+  const authMode = typeof authJson.auth_mode === "string" ? authJson.auth_mode : void 0;
+  if (authMode && authMode !== "chatgpt") {
+    throw new Error("Codex auth.json is not a ChatGPT account login");
+  }
+  if (!authMode && !("tokens" in authJson)) {
+    throw new Error("Codex auth.json does not look like account credentials");
+  }
+  return {
+    version: 1,
+    kind: "codex-auth",
+    authJson,
+    updatedAt: params.now.toISOString()
+  };
+}
+function encryptCodexAuthDocument(params) {
+  const context = compactContext(params.context);
+  const key = deriveCodexAuthKey(params.secret);
+  const iv = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  cipher.setAAD(contextAad(context));
+  const plaintext = Buffer.from(JSON.stringify(params.document), "utf8");
+  const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+  const envelope = {
+    version: 1,
+    kind: "codex-auth",
+    algorithm: "aes-256-gcm",
+    context,
+    iv: iv.toString("base64url"),
+    tag: cipher.getAuthTag().toString("base64url"),
+    ciphertext: ciphertext.toString("base64url")
+  };
+  return `${JSON.stringify(envelope)}
+`;
+}
+function decryptCodexAuthDocument(params) {
+  const envelope = JSON.parse(params.encrypted);
+  if (envelope.version !== 1 || envelope.kind !== "codex-auth" || envelope.algorithm !== "aes-256-gcm" || !envelope.context || typeof envelope.context !== "object" || !envelope.iv || !envelope.tag || !envelope.ciphertext) {
+    throw new Error("invalid Codex auth envelope");
+  }
+  const context = compactContext(envelope.context);
+  assertContextMatches(context, params.expectedContext);
+  const key = deriveCodexAuthKey(params.secret);
+  const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(envelope.iv, "base64url"));
+  decipher.setAAD(contextAad(context));
+  decipher.setAuthTag(Buffer.from(envelope.tag, "base64url"));
+  const plaintext = Buffer.concat([decipher.update(Buffer.from(envelope.ciphertext, "base64url")), decipher.final()]);
+  return decodeCodexAuthDocument(JSON.parse(plaintext.toString("utf8")));
+}
+function decodeCodexAuthDocument(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("invalid Codex auth document");
+  }
+  const record2 = value;
+  if (record2.version !== 1 || record2.kind !== "codex-auth") {
+    throw new Error("invalid Codex auth document");
+  }
+  if (!record2.authJson || typeof record2.authJson !== "object" || Array.isArray(record2.authJson)) {
+    throw new Error("invalid Codex auth document");
+  }
+  const updatedAt = typeof record2.updatedAt === "string" ? record2.updatedAt : void 0;
+  if (!updatedAt || Number.isNaN(Date.parse(updatedAt))) {
+    throw new Error("invalid Codex auth document");
+  }
+  return {
+    version: 1,
+    kind: "codex-auth",
+    authJson: record2.authJson,
+    updatedAt
+  };
+}
+function deriveCodexAuthKey(secret) {
+  return Buffer.from(
+    hkdfSync("sha256", Buffer.from(secret, "utf8"), Buffer.alloc(0), Buffer.from("mlclaw:codex-auth:v1"), 32)
+  );
+}
+function compactContext(context) {
+  const statePrefix = normalizeBucketPrefix(context.statePrefix);
+  return {
+    ...context.deploymentId ? { deploymentId: context.deploymentId } : {},
+    ...context.bucket ? { bucket: context.bucket } : {},
+    statePrefix
+  };
+}
+function assertContextMatches(observed, expected) {
+  if (!expected) return;
+  const normalized = compactContext(expected);
+  for (const key of ["deploymentId", "bucket", "statePrefix"]) {
+    if (normalized[key] && observed[key] !== normalized[key]) {
+      throw new Error("Codex auth context does not match this deployment");
+    }
+  }
+}
+function contextAad(context) {
+  return Buffer.from(JSON.stringify(compactContext(context)), "utf8");
+}
+
+// src/mlclaw/openai-codex-device-auth.ts
+var OPENAI_AUTH_BASE_URL = "https://auth.openai.com";
+var OPENAI_CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+var OPENAI_CODEX_DEVICE_VERIFICATION_URL = `${OPENAI_AUTH_BASE_URL}/codex/device`;
+var OPENAI_CODEX_DEVICE_CALLBACK_URL = `${OPENAI_AUTH_BASE_URL}/deviceauth/callback`;
+var OPENAI_CODEX_DEVICE_TIMEOUT_MS = 15 * 6e4;
+var DEFAULT_POLL_INTERVAL_MS = 5e3;
+var MIN_POLL_INTERVAL_MS = 1e3;
+var MAX_RESPONSE_BYTES = 256 * 1024;
+var JWT_AUTH_CLAIM = "https://api.openai.com/auth";
+async function loginOpenAICodexDeviceCode(options) {
+  throwIfAborted(options.signal);
+  const fetchFn = options.fetchFn ?? fetch;
+  const now = options.now ?? Date.now;
+  const sleep = options.sleep ?? abortableSleep;
+  const device = await requestDeviceCode(fetchFn, options.signal);
+  await options.onVerification({
+    verificationUrl: OPENAI_CODEX_DEVICE_VERIFICATION_URL,
+    userCode: device.userCode,
+    expiresInMs: OPENAI_CODEX_DEVICE_TIMEOUT_MS
+  });
+  const authorization = await pollDeviceAuthorization({
+    fetchFn,
+    device,
+    now,
+    sleep,
+    ...options.signal ? { signal: options.signal } : {}
+  });
+  return await exchangeDeviceAuthorization(fetchFn, authorization, now, options.signal);
+}
+function codexAuthJsonFromOAuthCredential(credential, now) {
+  return {
+    auth_mode: "chatgpt",
+    OPENAI_API_KEY: null,
+    tokens: {
+      ...credential.idToken ? { id_token: credential.idToken } : {},
+      access_token: credential.access,
+      refresh_token: credential.refresh,
+      account_id: credential.accountId,
+      expires_at: credential.expires
+    },
+    last_refresh: now.toISOString()
+  };
+}
+async function requestDeviceCode(fetchFn, signal) {
+  const response = await fetchFn(`${OPENAI_AUTH_BASE_URL}/api/accounts/deviceauth/usercode`, {
+    method: "POST",
+    headers: requestHeaders("application/json"),
+    body: JSON.stringify({ client_id: OPENAI_CODEX_CLIENT_ID }),
+    ...signal ? { signal } : {}
+  });
+  const body = await readJsonObject(response);
+  if (!response.ok) {
+    throw responseError("OpenAI device code request failed", response, body);
+  }
+  const deviceAuthId = nonEmptyString(body.device_auth_id);
+  const userCode = nonEmptyString(body.user_code) ?? nonEmptyString(body.usercode);
+  const intervalMs = secondsToSafeMilliseconds(body.interval);
+  if (!deviceAuthId || !userCode) {
+    throw new Error("OpenAI device code response was missing required fields");
+  }
+  return {
+    deviceAuthId,
+    userCode,
+    intervalMs: Math.min(
+      OPENAI_CODEX_DEVICE_TIMEOUT_MS,
+      Math.max(MIN_POLL_INTERVAL_MS, intervalMs ?? DEFAULT_POLL_INTERVAL_MS)
+    )
+  };
+}
+async function pollDeviceAuthorization(params) {
+  const deadline = params.now() + OPENAI_CODEX_DEVICE_TIMEOUT_MS;
+  let intervalMs = params.device.intervalMs;
+  while (params.now() < deadline) {
+    throwIfAborted(params.signal);
+    const response = await params.fetchFn(`${OPENAI_AUTH_BASE_URL}/api/accounts/deviceauth/token`, {
+      method: "POST",
+      headers: requestHeaders("application/json"),
+      body: JSON.stringify({
+        device_auth_id: params.device.deviceAuthId,
+        user_code: params.device.userCode
+      }),
+      ...params.signal ? { signal: params.signal } : {}
+    });
+    const body = await readJsonObject(response);
+    if (response.ok) {
+      const authorizationCode = nonEmptyString(body.authorization_code);
+      const codeVerifier = nonEmptyString(body.code_verifier);
+      if (!authorizationCode || !codeVerifier) {
+        throw new Error("OpenAI device authorization response was missing required fields");
+      }
+      return { authorizationCode, codeVerifier };
+    }
+    const errorCode = oauthErrorCode(body);
+    if (response.status === 403 || response.status === 404 || errorCode === "deviceauth_authorization_pending") {
+      await params.sleep(Math.min(intervalMs, Math.max(0, deadline - params.now())), params.signal);
+      continue;
+    }
+    if (errorCode === "slow_down") {
+      intervalMs += 5e3;
+      await params.sleep(Math.min(intervalMs, Math.max(0, deadline - params.now())), params.signal);
+      continue;
+    }
+    throw responseError("OpenAI device authorization failed", response, body);
+  }
+  throw new Error("OpenAI device authorization timed out after 15 minutes");
+}
+async function exchangeDeviceAuthorization(fetchFn, authorization, now, signal) {
+  const response = await fetchFn(`${OPENAI_AUTH_BASE_URL}/oauth/token`, {
+    method: "POST",
+    headers: requestHeaders("application/x-www-form-urlencoded"),
+    body: new URLSearchParams({
+      grant_type: "authorization_code",
+      client_id: OPENAI_CODEX_CLIENT_ID,
+      code: authorization.authorizationCode,
+      code_verifier: authorization.codeVerifier,
+      redirect_uri: OPENAI_CODEX_DEVICE_CALLBACK_URL
+    }),
+    ...signal ? { signal } : {}
+  });
+  const body = await readJsonObject(response);
+  if (!response.ok) {
+    throw responseError("OpenAI device token exchange failed", response, body);
+  }
+  return credentialFromTokenResponse(body, now);
+}
+function requestHeaders(contentType) {
+  return {
+    "Content-Type": contentType,
+    originator: "mlclaw",
+    "User-Agent": "mlclaw"
+  };
+}
+async function readJsonObject(response) {
+  const text = await readResponseTextLimited(response);
+  if (!text) return {};
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw new Error("OpenAI OAuth response was not valid JSON");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("OpenAI OAuth response was not a JSON object");
+  }
+  return parsed;
+}
+async function readResponseTextLimited(response) {
+  const declaredLength = Number(response.headers.get("content-length"));
+  if (Number.isFinite(declaredLength) && declaredLength > MAX_RESPONSE_BYTES) {
+    await response.body?.cancel().catch(() => void 0);
+    throw new Error("OpenAI OAuth response exceeded the size limit");
+  }
+  if (!response.body) return "";
+  const reader = response.body.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      total += value.byteLength;
+      if (total > MAX_RESPONSE_BYTES) {
+        await reader.cancel().catch(() => void 0);
+        throw new Error("OpenAI OAuth response exceeded the size limit");
+      }
+      chunks.push(value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const merged = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    merged.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return new TextDecoder().decode(merged);
+}
+function responseError(prefix, response, body) {
+  const code = oauthErrorCode(body);
+  const safeCode = code ? sanitizeErrorText(code) : void 0;
+  return new Error(`${prefix} (HTTP ${response.status})${safeCode ? `: ${safeCode}` : ""}`);
+}
+function oauthErrorCode(body) {
+  const error = body.error;
+  if (typeof error === "string") return nonEmptyString(error);
+  if (error && typeof error === "object" && !Array.isArray(error)) {
+    return nonEmptyString(error.code);
+  }
+  return void 0;
+}
+function sanitizeErrorText(value) {
+  return value.replace(/[\u0000-\u001f\u007f-\u009f]/gu, " ").replace(/\s+/gu, " ").trim().slice(0, 500);
+}
+function credentialFromTokenResponse(body, now) {
+  const access = nonEmptyString(body.access_token);
+  const refresh = nonEmptyString(body.refresh_token);
+  const expiresInMs = secondsToSafeMilliseconds(body.expires_in);
+  if (!access || !refresh || expiresInMs === void 0) {
+    throw new Error("OpenAI token response was missing required fields");
+  }
+  const claims = accessTokenClaims(access);
+  const idToken = nonEmptyString(body.id_token);
+  return {
+    access,
+    refresh,
+    expires: now() + expiresInMs,
+    accountId: claims.accountId,
+    ...idToken ? { idToken } : {}
+  };
+}
+function accessTokenClaims(accessToken) {
+  const parts = accessToken.split(".");
+  if (parts.length !== 3 || !parts[1]) {
+    throw new Error("OpenAI access token was not a JWT");
+  }
+  let payload;
+  try {
+    payload = objectValue(JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8")), "access token JWT payload");
+  } catch {
+    throw new Error("OpenAI access token JWT was invalid");
+  }
+  const claim = payload[JWT_AUTH_CLAIM];
+  const accountId = claim && typeof claim === "object" && !Array.isArray(claim) ? nonEmptyString(claim.chatgpt_account_id) : void 0;
+  const expiresSeconds = finiteNonNegativeNumber(payload.exp);
+  if (!accountId) {
+    throw new Error("OpenAI access token did not contain a ChatGPT account ID");
+  }
+  if (expiresSeconds === void 0 || !Number.isSafeInteger(expiresSeconds * 1e3)) {
+    throw new Error("OpenAI access token did not contain a valid expiry");
+  }
+  return { accountId, expires: expiresSeconds * 1e3 };
+}
+function nonEmptyString(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function objectValue(value, label) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${label} was not an object`);
+  }
+  return value;
+}
+function finiteNonNegativeNumber(value) {
+  const number = typeof value === "string" && value.trim() ? Number(value) : value;
+  return typeof number === "number" && Number.isFinite(number) && number >= 0 ? number : void 0;
+}
+function secondsToSafeMilliseconds(value) {
+  const seconds = typeof value === "string" && value.trim() ? Number(value) : value;
+  if (typeof seconds !== "number" || !Number.isFinite(seconds) || seconds < 0) return void 0;
+  const milliseconds = Math.floor(seconds * 1e3);
+  return Number.isSafeInteger(milliseconds) ? milliseconds : void 0;
+}
+function throwIfAborted(signal) {
+  if (signal?.aborted) throw new Error("OpenAI device login cancelled");
+}
+async function abortableSleep(milliseconds, signal) {
+  throwIfAborted(signal);
+  await new Promise((resolve, reject) => {
+    const finish = () => {
+      signal?.removeEventListener("abort", abort);
+      resolve();
+    };
+    const timer = setTimeout(finish, milliseconds);
+    const abort = () => {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", abort);
+      reject(new Error("OpenAI device login cancelled"));
+    };
+    signal?.addEventListener("abort", abort, { once: true });
+    if (signal?.aborted) abort();
+  });
+}
+
 // src/mlclaw-space-runtime/model-default.ts
 var DEFAULT_MODEL_ID = "zai-org/GLM-5.2";
 var DEFAULT_MODEL_PROVIDER = "fireworks-ai";
@@ -20595,6 +20988,7 @@ function createRuntime(overrides = {}) {
     dockerRunner: overrides.dockerRunner ?? new CliDockerRunner(),
     podmanRunner: overrides.podmanRunner ?? new CliPodmanRunner(),
     tailscaleRunner: overrides.tailscaleRunner ?? new CliTailscaleRunner(),
+    codexDeviceLogin: overrides.codexDeviceLogin ?? loginOpenAICodexDeviceCode,
     configRoot: overrides.configRoot ?? defaultConfigRoot(overrides.env ?? process4.env),
     now: overrides.now ?? (() => /* @__PURE__ */ new Date()),
     sleep: overrides.sleep ?? delay2,
@@ -20642,6 +21036,16 @@ function createProgram(runtimeOverrides = {}) {
   credentials.command("repair").description("Replace and apply the dedicated HF Broker credential").argument("[agent]", "Agent name; inferred when exactly one deployment exists").option("--broker-hf-token-file <path>", "File containing MLCLAW_BROKER_HF_TOKEN=... or a raw token").action(async (agent, opts) => {
     await credentialsRepair(agent, opts, runtime);
   });
+  const codexCredentials = credentials.command("codex").description("Manage deployment-scoped OpenAI Codex account credentials");
+  codexCredentials.command("login").description("Connect a Codex ChatGPT account to one ML Claw deployment").argument("[agent]", "Agent name; inferred when exactly one deployment exists").action(async (agent) => {
+    await codexCredentialsLogin(agent, runtime);
+  });
+  codexCredentials.command("status").description("Show the Codex credential status for one ML Claw deployment").argument("[agent]", "Agent name; inferred when exactly one deployment exists").action(async (agent) => {
+    await codexCredentialsStatus(agent, runtime);
+  });
+  codexCredentials.command("logout").description("Remove Codex account credentials from one ML Claw deployment").argument("[agent]", "Agent name; inferred when exactly one deployment exists").action(async (agent) => {
+    await codexCredentialsLogout(agent, runtime);
+  });
   const gateway = program2.command("gateway").description("Operate a ML Claw gateway");
   gateway.command("start").argument("<agent>", "Agent name").option("--docker-context <name>", "Set Docker context only when the deployment has no pinned context").option("--local-port <port>", "Loopback port for the local gateway", parseLocalPort).option("--tailscale <off|direct|serve>", "Tailnet access mode", parseTailscaleMode).option("--tailscale-port <port>", "Tailnet listener or Serve HTTPS port", parseLocalPort).option("--no-pull", "Do not docker pull before starting a local gateway").option("--takeover", "Start even if another live runtime lease is present", false).action(async (agent, opts) => {
     await gatewayStart(agent, opts, runtime);
@@ -21342,14 +21746,14 @@ async function resolveBootstrapPlan(params) {
     existingSecrets,
     runtime
   });
-  const sessionSecret = existingSecrets.MLCLAW_SESSION_SECRET ?? randomBytes(48).toString("base64url");
+  const sessionSecret = existingSecrets.MLCLAW_SESSION_SECRET ?? randomBytes2(48).toString("base64url");
   const restoredCredentialKey = existingSecrets.MLCLAW_CREDENTIAL_KEY ?? runtime.env.MLCLAW_CREDENTIAL_KEY;
   if (existingManifest?.recoveredWithoutCredentialKey && !restoredCredentialKey) {
     throw new Error(
       "recovered deployment requires its existing MLCLAW_CREDENTIAL_KEY; restore it in the environment and rerun bootstrap"
     );
   }
-  const credentialKey = restoredCredentialKey ?? randomBytes(32).toString("base64url");
+  const credentialKey = restoredCredentialKey ?? randomBytes2(32).toString("base64url");
   const credentialKeySha256 = createHash4("sha256").update(credentialKey).digest("hex");
   if (existingManifest?.credentialKeySha256 && existingManifest.credentialKeySha256 !== credentialKeySha256) {
     throw new Error("MLCLAW_CREDENTIAL_KEY does not match the recovered deployment");
@@ -21447,6 +21851,7 @@ async function resolveBootstrapPlan(params) {
     gatewayLocation,
     localPort,
     runtimeId: gatewayLocation === "local" ? manifest.localRuntimeId : spaceRuntimeId(agentName),
+    deploymentId: manifest.deploymentId,
     ...bucketPrefix ? { bucketPrefix } : {},
     ...effectiveTelegramProxy ? { telegramProxy: effectiveTelegramProxy } : {},
     ...effectiveTelegramApiRoot ? { telegramApiRoot: effectiveTelegramApiRoot } : {},
@@ -21815,7 +22220,8 @@ async function stateAdopt(agent, opts, runtime) {
     OPENCLAW_MODEL: updated.model,
     MLCLAW_GATEWAY_LOCATION: updated.gatewayLocation,
     MLCLAW_RUNTIME_IMAGE: updated.runtimeImage,
-    MLCLAW_RUNTIME_ID: runtimeIdFor(updated)
+    MLCLAW_RUNTIME_ID: runtimeIdFor(updated),
+    MLCLAW_DEPLOYMENT_ID: updated.deploymentId
   };
   const reconciled = await reconcileManifest({
     manifest: updated,
@@ -21845,6 +22251,17 @@ async function stateAdopt(agent, opts, runtime) {
           });
         }
       }
+      if (bucketChanged) {
+        await assertLease();
+        await migrateCodexCredentialForBucketAdoption({
+          hub,
+          manifest: current,
+          targetBucket: updated.bucket,
+          statePrefix: bucketPrefix,
+          credentialKey: nonEmpty(secrets.MLCLAW_CREDENTIAL_KEY),
+          now: runtime.now()
+        });
+      }
       await assertLease();
       await writeLocalDeployment(runtime.configRoot, updated, updatedSecrets);
       if (updated.gatewayLocation === "local") {
@@ -21872,7 +22289,8 @@ async function stateAdopt(agent, opts, runtime) {
           OPENCLAW_LIVE_DIR: SPACE_LIVE_DIR,
           MLCLAW_RUNTIME_SETTINGS_FILE: `${SPACE_LIVE_DIR}/.mlclaw/settings.json`,
           MLCLAW_GATEWAY_LOCATION: "space",
-          MLCLAW_RUNTIME_ID: spaceRuntimeId(updated.agent)
+          MLCLAW_RUNTIME_ID: spaceRuntimeId(updated.agent),
+          MLCLAW_DEPLOYMENT_ID: updated.deploymentId
         },
         assertLease
       );
@@ -21901,6 +22319,8 @@ async function stateAdopt(agent, opts, runtime) {
         bucket,
         runtime.now()
       );
+      await assertLease();
+      await deleteCodexCredentialControlObjects(hub, manifest.pendingTombstoneBucket, bucketPrefix);
       const { pendingTombstoneBucket: _completed, ...completed } = manifest;
       await assertLease();
       await writeManifest(runtime.configRoot, completed);
@@ -21910,6 +22330,43 @@ async function stateAdopt(agent, opts, runtime) {
   updated = reconciled.manifest;
   runtime.stdout.log(`State bucket: ${bucket}`);
 }
+async function migrateCodexCredentialForBucketAdoption(params) {
+  const revoked = await codexCredentialIsRevoked(params.hub, params.manifest.bucket, params.statePrefix);
+  const encrypted = revoked ? void 0 : await readCodexCredentialBundle({
+    hub: params.hub,
+    manifest: params.manifest,
+    statePrefix: params.statePrefix
+  });
+  const targetManifest = { ...params.manifest, bucket: params.targetBucket };
+  if (encrypted) {
+    if (!params.credentialKey) {
+      throw new Error("cannot move Codex credentials without MLCLAW_CREDENTIAL_KEY");
+    }
+    const document = decryptCodexAuthDocument({
+      encrypted,
+      secret: params.credentialKey,
+      expectedContext: codexContextForManifest(params.manifest, params.statePrefix)
+    });
+    await writeCodexCredentialBundle({
+      manifest: targetManifest,
+      statePrefix: params.statePrefix,
+      credentialKey: params.credentialKey,
+      document,
+      hub: params.hub
+    });
+    await deleteCodexRevocationMarker(params.hub, params.targetBucket, params.statePrefix);
+    return;
+  }
+  if (revoked) {
+    await writeCodexRevocationMarker(params.hub, targetManifest, params.statePrefix, params.now);
+    await params.hub.bucket(params.targetBucket).deleteFiles([codexAuthObjectPath(params.statePrefix)]);
+    return;
+  }
+  await deleteCodexCredentialControlObjects(params.hub, params.targetBucket, params.statePrefix);
+}
+async function deleteCodexCredentialControlObjects(hub, bucket, statePrefix) {
+  await hub.bucket(bucket).deleteFiles([codexAuthObjectPath(statePrefix), codexAuthRevocationObjectPath(statePrefix)]);
+}
 async function inspectStateBucket(hub, bucket, bucketPrefix) {
   await hub.assertBucketAccessible(bucket);
   const client = hub.bucket(bucket);
@@ -21918,7 +22375,13 @@ async function inspectStateBucket(hub, bucket, bucketPrefix) {
   const prefix = normalizeBucketPrefix(bucketPrefix);
   const prefixWithSlash = `${prefix}/`;
   const manifestPath2 = `${prefixWithSlash}${SNAPSHOT_MANIFEST_REMOTE_NAME}`;
-  const payloadEntries = fileEntries.filter((entry) => !entry.path.startsWith(".mlclaw/"));
+  const prefixedControlPath = `${prefixWithSlash}.mlclaw/`;
+  const credentialPayloadPaths = new Set(
+    fileEntries.some((entry) => entry.path === DEPLOYMENT_PATH) ? [] : [codexAuthObjectPath(bucketPrefix)]
+  );
+  const payloadEntries = fileEntries.filter(
+    (entry) => !entry.path.startsWith(".mlclaw/") && (!entry.path.startsWith(prefixedControlPath) || credentialPayloadPaths.has(entry.path))
+  );
   const stateEntries = payloadEntries.filter(
     (entry) => entry.path === manifestPath2 || entry.path.startsWith(`${prefixWithSlash}snapshots/`) || entry.path.startsWith(`${prefixWithSlash}runtime/`)
   );
@@ -21983,6 +22446,7 @@ function deploymentSecrets(params) {
     MLCLAW_GATEWAY_LOCATION: params.gatewayLocation,
     MLCLAW_RUNTIME_IMAGE: params.runtimeImage,
     MLCLAW_RUNTIME_ID: params.runtimeId,
+    MLCLAW_DEPLOYMENT_ID: params.deploymentId,
     MLCLAW_SESSION_SECRET: params.sessionSecret,
     MLCLAW_CREDENTIAL_KEY: params.credentialKey,
     MLCLAW_OPENCLAW_PORT: String(DEFAULT_SPACE_OPENCLAW_PORT),
@@ -22143,6 +22607,7 @@ function spaceGatewayNeedsRepair(manifest, variables, runtime, allowedUsers) {
     MLCLAW_GATEWAY_LOCATION: "space",
     MLCLAW_RUNTIME_IMAGE: manifest.runtimeImage,
     MLCLAW_RUNTIME_ID: spaceRuntimeId(manifest.agent),
+    MLCLAW_DEPLOYMENT_ID: manifest.deploymentId,
     MLCLAW_ALLOWED_USERS: allowedUsers,
     MLCLAW_ADMINS: allowedUsers,
     MLCLAW_CANONICAL_SPACE_ID: DEFAULT_CANONICAL_TEMPLATE_SPACE,
@@ -22198,6 +22663,7 @@ async function deploySpaceGateway(params) {
       MLCLAW_GATEWAY_LOCATION: "space",
       MLCLAW_RUNTIME_IMAGE: spaceRuntimeRef,
       MLCLAW_RUNTIME_ID: spaceRuntimeId(manifest.agent),
+      MLCLAW_DEPLOYMENT_ID: manifest.deploymentId,
       MLCLAW_ALLOWED_USERS: params.allowedUsers,
       MLCLAW_ADMINS: params.allowedUsers,
       MLCLAW_CANONICAL_SPACE_ID: DEFAULT_CANONICAL_TEMPLATE_SPACE,
@@ -22236,7 +22702,7 @@ async function startLocalGateway(params) {
   }
   let secrets = await ensureDeploymentCredentialKey(runtime, manifest.agent);
   if (!secrets.MLCLAW_SESSION_SECRET) {
-    secrets = { ...secrets, MLCLAW_SESSION_SECRET: randomBytes(48).toString("base64url") };
+    secrets = { ...secrets, MLCLAW_SESSION_SECRET: randomBytes2(48).toString("base64url") };
     await writeSecretEnv(runtime.configRoot, manifest.agent, secrets);
   }
   const accessSecrets = localAccessSecrets(manifest.owner, localGatewayPort(manifest), secrets, manifest.networkAccess);
@@ -22637,7 +23103,8 @@ async function gatewayMigrate(agent, opts, runtime) {
           ...deploymentSecrets2,
           MLCLAW_GATEWAY_LOCATION: "space",
           MLCLAW_RUNTIME_IMAGE: updated.runtimeImage,
-          MLCLAW_RUNTIME_ID: spaceRuntimeId(agent)
+          MLCLAW_RUNTIME_ID: spaceRuntimeId(agent),
+          MLCLAW_DEPLOYMENT_ID: updated.deploymentId
         });
         await writeManifest(runtime.configRoot, updated);
       }
@@ -22688,6 +23155,7 @@ async function gatewayMigrate(agent, opts, runtime) {
           MLCLAW_GATEWAY_LOCATION: "local",
           MLCLAW_RUNTIME_IMAGE: updated.runtimeImage,
           MLCLAW_RUNTIME_ID: updated.localRuntimeId,
+          MLCLAW_DEPLOYMENT_ID: updated.deploymentId,
           ...localAccessSecrets(updated.owner, localGatewayPort(updated), secrets, updated.networkAccess)
         });
         await assertLease();
@@ -23163,7 +23631,7 @@ function nonEmpty(value) {
   return trimmed ? trimmed : void 0;
 }
 function newLocalRuntimeId(agent) {
-  return `local-${agent}-${randomBytes(8).toString("hex")}`;
+  return `local-${agent}-${randomBytes2(8).toString("hex")}`;
 }
 function runtimeIdFor(manifest) {
   return manifest.gatewayLocation === "local" ? manifest.localRuntimeId : spaceRuntimeId(manifest.agent);
@@ -23186,7 +23654,7 @@ async function handoffAndStopLocalGateway(params) {
   }
   await runner.disableRestart(containerName, connection);
   const handoffStartedAt = params.runtime.now();
-  const requestId = randomBytes(16).toString("hex");
+  const requestId = randomBytes2(16).toString("hex");
   await writeRuntimeHandoffRequest(
     params.hub,
     params.manifest.bucket,
@@ -23216,7 +23684,7 @@ async function handoffAndStopLocalGateway(params) {
 }
 async function disableAndPauseSpaceGateway(params) {
   const handoffStartedAt = params.runtime.now();
-  const requestId = randomBytes(16).toString("hex");
+  const requestId = randomBytes2(16).toString("hex");
   const shouldWaitForHandoff = await spaceGatewayShouldWaitForHandoff(params);
   if (!shouldWaitForHandoff) {
     await params.hub.addSpaceVariable(params.manifest.space, "MLCLAW_GATEWAY_DISABLED", "1");
@@ -23311,7 +23779,7 @@ async function ensureDeploymentCredentialKey(runtime, agent, existing) {
   }
   const updated = {
     ...secrets,
-    MLCLAW_CREDENTIAL_KEY: randomBytes(32).toString("base64url")
+    MLCLAW_CREDENTIAL_KEY: randomBytes2(32).toString("base64url")
   };
   await writeSecretEnv(runtime.configRoot, agent, updated);
   return updated;
@@ -23374,6 +23842,9 @@ async function update(repoId, opts, hub, hfToken, runtime) {
   }
   await hub.addSpaceVariable(repoId, "MLCLAW_GATEWAY_LOCATION", "space");
   await hub.addSpaceVariable(repoId, "MLCLAW_RUNTIME_ID", spaceRuntimeId(agentName));
+  if (localManifest) {
+    await hub.addSpaceVariable(repoId, "MLCLAW_DEPLOYMENT_ID", localManifest.deploymentId);
+  }
   await hub.addSpaceVariable(repoId, "MLCLAW_OPENCLAW_PORT", String(DEFAULT_SPACE_OPENCLAW_PORT));
   await hub.addSpaceVariable(repoId, "OPENCLAW_GATEWAY_PORT", String(DEFAULT_SPACE_OPENCLAW_PORT));
   const bucket = variables.get("OPENCLAW_HF_STATE_BUCKET")?.value;
@@ -23409,7 +23880,8 @@ async function reconcileUpdatedDeployment(localManifest, runtimeImage, hub, runt
         ...currentSecrets,
         MLCLAW_GATEWAY_LOCATION: "space",
         MLCLAW_RUNTIME_IMAGE: runtimeImage,
-        MLCLAW_RUNTIME_ID: spaceRuntimeId(manifest.agent)
+        MLCLAW_RUNTIME_ID: spaceRuntimeId(manifest.agent),
+        MLCLAW_DEPLOYMENT_ID: manifest.deploymentId
       });
     }
   });
@@ -23588,7 +24060,7 @@ async function doctor(repoId, opts, hub, runtime) {
   }
   if (!secrets.has("MLCLAW_SESSION_SECRET")) {
     if (fix) {
-      await hub.addSpaceSecret(repoId, "MLCLAW_SESSION_SECRET", randomBytes(48).toString("base64url"));
+      await hub.addSpaceSecret(repoId, "MLCLAW_SESSION_SECRET", randomBytes2(48).toString("base64url"));
       fixed.push("set secret MLCLAW_SESSION_SECRET");
     } else {
       issues.push("secret MLCLAW_SESSION_SECRET is missing");
@@ -23597,7 +24069,7 @@ async function doctor(repoId, opts, hub, runtime) {
   if (!secrets.has("MLCLAW_CREDENTIAL_KEY")) {
     if (fix) {
       const agent = variables.get("OPENCLAW_AGENT_NAME")?.value?.trim() || repoId.split("/")[1] || "openclaw";
-      const credentialKey = await manifestExists(runtime.configRoot, agent) ? requiredSecret(await ensureDeploymentCredentialKey(runtime, agent), "MLCLAW_CREDENTIAL_KEY") : randomBytes(32).toString("base64url");
+      const credentialKey = await manifestExists(runtime.configRoot, agent) ? requiredSecret(await ensureDeploymentCredentialKey(runtime, agent), "MLCLAW_CREDENTIAL_KEY") : randomBytes2(32).toString("base64url");
       await hub.addSpaceSecret(repoId, "MLCLAW_CREDENTIAL_KEY", credentialKey);
       fixed.push("set secret MLCLAW_CREDENTIAL_KEY");
     } else {
@@ -23916,6 +24388,106 @@ async function readOptionalRouterTokenFile(file) {
   const parsed = parseSecretEnv(raw);
   return nonEmpty(parsed.MLCLAW_ROUTER_TOKEN) ?? nonEmpty(parsed.HF_ROUTER_TOKEN) ?? nonEmpty(raw);
 }
+async function codexCredentialsLogin(requestedAgent, runtime) {
+  const manifest = await credentialManifest(requestedAgent, runtime);
+  await withDeploymentLock(runtime.configRoot, deploymentLockKey(manifest), async () => {
+    const current = await readManifest(runtime.configRoot, manifest.agent);
+    const secrets = await readSecretEnv(runtime.configRoot, current.agent);
+    const credentialKey = await verifiedDeploymentCredentialKey(current, secrets, runtime);
+    const statePrefix = persistedBucketPrefix(secrets);
+    const authJson = await runDirectCodexDeviceLogin(current, runtime);
+    const document = encodeCodexAuthDocument({ authJson, now: runtime.now() });
+    const token = await runtime.readToken(runtime.env);
+    const hub = runtime.hubFactory(token);
+    const control = await hub.deploymentControlStore(current.owner, current.deploymentId);
+    const operation = newOperation(current, runtime.now());
+    let lease = await acquireControlLease(control, current, operation, runtime.now());
+    let renewalError;
+    let renewal = Promise.resolve();
+    const renewalTimer = setInterval(() => {
+      renewal = renewal.then(async () => {
+        if (renewalError) return;
+        try {
+          lease = await renewControlLease(control, lease, runtime.now());
+        } catch (error) {
+          renewalError = error;
+        }
+      });
+    }, 45e3);
+    const assertLease = async () => {
+      await renewal;
+      if (renewalError) throw renewalError;
+      await assertControlLease(control, lease, runtime.now());
+      if (renewalError) throw renewalError;
+    };
+    try {
+      await assertLease();
+      await writeCodexCredentialBundle({ manifest: current, statePrefix, credentialKey, document, hub });
+      await assertLease();
+      await deleteCodexRevocationMarker(hub, current.bucket, statePrefix);
+      await assertLease();
+      await ensureRuntimeDeploymentId(current, secrets, hub, runtime, assertLease);
+      await assertLease();
+      await restartDeploymentForCredentialChange(current, runtime, hub, assertLease);
+    } finally {
+      clearInterval(renewalTimer);
+      await renewal;
+      await releaseControlLease(control, lease);
+    }
+    runtime.stdout.log(`Codex credentials connected: ${current.agent}`);
+  });
+}
+async function codexCredentialsStatus(requestedAgent, runtime) {
+  const manifest = await credentialManifest(requestedAgent, runtime);
+  const secrets = await readSecretEnv(runtime.configRoot, manifest.agent);
+  const credentialKey = await verifiedDeploymentCredentialKey(manifest, secrets, runtime);
+  const token = await runtime.readToken(runtime.env);
+  const hub = runtime.hubFactory(token);
+  const statePrefix = persistedBucketPrefix(secrets);
+  const revoked = await codexCredentialIsRevoked(hub, manifest.bucket, statePrefix);
+  const encrypted = revoked ? void 0 : await readCodexCredentialBundle({ hub, manifest, statePrefix });
+  if (!encrypted) {
+    runtime.stdout.log(`Agent: ${manifest.agent}`);
+    runtime.stdout.log("Codex account: not configured");
+    return;
+  }
+  const document = decryptCodexAuthDocument({
+    encrypted,
+    secret: credentialKey,
+    expectedContext: codexContextForManifest(manifest, statePrefix)
+  });
+  runtime.stdout.log(`Agent: ${manifest.agent}`);
+  runtime.stdout.log("Codex account: configured");
+  runtime.stdout.log(`Updated: ${document.updatedAt}`);
+  runtime.stdout.log(`Credential object: ${codexAuthObjectPath(statePrefix)}`);
+}
+async function codexCredentialsLogout(requestedAgent, runtime) {
+  const manifest = await credentialManifest(requestedAgent, runtime);
+  await withDeploymentLock(runtime.configRoot, deploymentLockKey(manifest), async () => {
+    const current = await readManifest(runtime.configRoot, manifest.agent);
+    const secrets = await readSecretEnv(runtime.configRoot, current.agent);
+    await verifiedDeploymentCredentialKey(current, secrets, runtime);
+    const statePrefix = persistedBucketPrefix(secrets);
+    const token = await runtime.readToken(runtime.env);
+    const hub = runtime.hubFactory(token);
+    const control = await hub.deploymentControlStore(current.owner, current.deploymentId);
+    const operation = newOperation(current, runtime.now());
+    const lease = await acquireControlLease(control, current, operation, runtime.now());
+    try {
+      await assertControlLease(control, lease, runtime.now());
+      await writeCodexRevocationMarker(hub, current, statePrefix, runtime.now());
+      await assertControlLease(control, lease, runtime.now());
+      await hub.bucket(current.bucket).deleteFiles([codexAuthObjectPath(statePrefix)]);
+      await assertControlLease(control, lease, runtime.now());
+      await restartDeploymentForCredentialChange(current, runtime, hub, async () => {
+        await assertControlLease(control, lease, runtime.now());
+      });
+    } finally {
+      await releaseControlLease(control, lease);
+    }
+    runtime.stdout.log(`Codex credentials removed: ${current.agent}`);
+  });
+}
 async function credentialsStatus(requestedAgent, runtime) {
   const manifest = await credentialManifest(requestedAgent, runtime);
   await verifiedStoredBrokerCredential(manifest, runtime);
@@ -24020,6 +24592,113 @@ async function credentialsRepair(requestedAgent, opts, runtime) {
     runtime.stdout.log(`HF Broker credential repaired: ${manifest.agent}`);
   });
 }
+async function verifiedDeploymentCredentialKey(manifest, secrets, runtime) {
+  if (manifest.recoveredWithoutCredentialKey) {
+    throw new Error(
+      `deployment ${manifest.agent} was recovered without its credential key; run bootstrap or repair from a machine that has the original key`
+    );
+  }
+  const credentialKey = nonEmpty(secrets.MLCLAW_CREDENTIAL_KEY);
+  if (!credentialKey) {
+    throw new Error(`deployment ${manifest.agent} has no MLCLAW_CREDENTIAL_KEY`);
+  }
+  const fingerprint = createHash4("sha256").update(credentialKey).digest("hex");
+  if (manifest.credentialKeySha256 && manifest.credentialKeySha256 !== fingerprint) {
+    throw new Error("local credential key fingerprint does not match the deployment manifest");
+  }
+  const token = await runtime.readToken(runtime.env);
+  const identity = await readDeploymentIdentity(runtime.hubFactory(token).bucket(manifest.bucket));
+  if (!identity) {
+    throw new Error(`bucket ${manifest.bucket} has no canonical deployment identity`);
+  }
+  if (identity.deploymentId !== manifest.deploymentId || identity.bucket !== manifest.bucket) {
+    throw new Error(`bucket ${manifest.bucket} belongs to another deployment`);
+  }
+  if (identity.credentialKeySha256 !== fingerprint) {
+    throw new Error("local credential key fingerprint does not match canonical deployment identity");
+  }
+  return credentialKey;
+}
+async function runDirectCodexDeviceLogin(manifest, runtime) {
+  runtime.stdout.log(`Connecting a ChatGPT account to deployment ${manifest.agent}.`);
+  const credential = await runtime.codexDeviceLogin({
+    onVerification: (verification) => printCodexDeviceVerification(verification, runtime)
+  });
+  return codexAuthJsonFromOAuthCredential(credential, runtime.now());
+}
+function printCodexDeviceVerification(verification, runtime) {
+  runtime.stdout.log(`Open: ${verification.verificationUrl}`);
+  runtime.stdout.log(`Code: ${verification.userCode}`);
+  runtime.stdout.log("Waiting for OpenAI authorization...");
+}
+function codexContextForManifest(manifest, statePrefix) {
+  return codexAuthContext({
+    deploymentId: manifest.deploymentId,
+    bucket: manifest.bucket,
+    ...statePrefix ? { statePrefix } : {}
+  });
+}
+async function writeCodexCredentialBundle(params) {
+  const encrypted = encryptCodexAuthDocument({
+    document: params.document,
+    secret: params.credentialKey,
+    context: codexContextForManifest(params.manifest, params.statePrefix)
+  });
+  await params.hub.bucket(params.manifest.bucket).uploadFiles([{ path: codexAuthObjectPath(params.statePrefix), content: new Blob([encrypted]) }]);
+}
+async function readCodexCredentialBundle(params) {
+  const blob = await params.hub.bucket(params.manifest.bucket).downloadFile(codexAuthObjectPath(params.statePrefix));
+  return blob ? await blob.text() : void 0;
+}
+async function codexCredentialIsRevoked(hub, bucket, statePrefix) {
+  return Boolean(await hub.bucket(bucket).downloadFile(codexAuthRevocationObjectPath(statePrefix)));
+}
+async function writeCodexRevocationMarker(hub, manifest, statePrefix, now) {
+  const content = new Blob([
+    `${JSON.stringify({
+      version: 1,
+      kind: "codex-auth-revocation",
+      deploymentId: manifest.deploymentId,
+      bucket: manifest.bucket,
+      statePrefix: normalizeBucketPrefix(statePrefix),
+      revokedAt: now.toISOString()
+    })}
+`
+  ]);
+  await hub.bucket(manifest.bucket).uploadFiles([{ path: codexAuthRevocationObjectPath(statePrefix), content }]);
+}
+async function deleteCodexRevocationMarker(hub, bucket, statePrefix) {
+  await hub.bucket(bucket).deleteFiles([codexAuthRevocationObjectPath(statePrefix)]);
+}
+async function ensureRuntimeDeploymentId(manifest, secrets, hub, runtime, assertLease) {
+  if (secrets.MLCLAW_DEPLOYMENT_ID === manifest.deploymentId) return;
+  if (manifest.gatewayLocation === "space") {
+    await assertLease();
+    await hub.addSpaceVariable(manifest.space, "MLCLAW_DEPLOYMENT_ID", manifest.deploymentId);
+    return;
+  }
+  await assertLease();
+  await writeSecretEnv(runtime.configRoot, manifest.agent, {
+    ...secrets,
+    MLCLAW_DEPLOYMENT_ID: manifest.deploymentId
+  });
+}
+async function restartDeploymentForCredentialChange(manifest, runtime, hub, assertLease) {
+  if (manifest.gatewayLocation === "space") {
+    await assertLease();
+    await hub.restartSpace(manifest.space, true);
+    runtime.stdout.log(`Space gateway restart requested: ${manifest.space}`);
+    return;
+  }
+  const runner = localRunnerFor(manifest, runtime);
+  const existing = await runner.inspect(containerNameFor(manifest.agent), localConnectionFor(manifest));
+  if (!existing?.running) {
+    runtime.stdout.log(`Local gateway is stopped; credentials will apply when ${manifest.agent} starts`);
+    return;
+  }
+  await assertLease();
+  await startLocalGateway({ manifest, runtime, pull: false, refresh: true, existing, assertLease });
+}
 async function credentialManifest(requestedAgent, runtime) {
   if (requestedAgent) return await readManifest(runtime.configRoot, requestedAgent);
   const manifests = await listManifests(runtime.configRoot);
@@ -24365,5 +25044,6 @@ export {
   TELEGRAM_SLEEP_TIME,
   createProgram,
   main,
-  mergeStateVolume
+  mergeStateVolume,
+  migrateCodexCredentialForBucketAdoption
 };