fix(codex): unblock Computer Use after plugin install (#126699)

* fix(codex): release config fence before readiness probe

* chore(codex): upgrade managed app-server to 0.148.0
This commit is contained in:
Peter Steinberger
2026-08-20 08:26:41 -07:00
committed by GitHub
parent eb84b56766
commit 02c08bba71
35 changed files with 319 additions and 123 deletions
+1 -1
View File
@@ -258,7 +258,7 @@ reconciliation so OpenClaw does not override that selection.
## Remote marketplaces
Remote marketplace support was introduced in Codex 0.146.1 and remains
available in OpenClaw's pinned Codex 0.147.0. OpenClaw passes the opaque remote
available in OpenClaw's pinned Codex 0.148.0. OpenClaw passes the opaque remote
plugin ID returned by Codex to `plugin/read` and `plugin/install`; a
human-readable plugin name is not a valid substitute.
+13 -17
View File
@@ -172,7 +172,7 @@ flags, and plugin allow/deny references into this block. Explicit canonical
## App-server transport
For ordinary harness turns, OpenClaw starts the managed Codex binary shipped
with the official plugin (currently `@openai/codex` `0.147.0`):
with the official plugin (currently `@openai/codex` `0.148.0`):
```bash
codex app-server --listen stdio://
@@ -317,8 +317,8 @@ If the normal app-server runtime would be `danger-full-access`, enabling
permission profile instead. Codex-managed network enforcement is sandboxed
networking, so a full-access profile would not protect outbound traffic.
The plugin ships Codex app-server `0.147.0` and accepts external versions at or
above that minimum. Older, malformed, and unversioned handshakes are rejected.
The plugin ships Codex app-server `0.148.0` and accepts external versions at or
above `0.147.0`. Older, malformed, and unversioned handshakes are rejected.
Build metadata does not affect SemVer precedence. The same minimum applies to
explicit custom executables, remote app-servers, and macOS desktop binaries;
admission is not readiness proof.
@@ -446,7 +446,7 @@ The stable default is fail-closed: active OpenClaw sandboxing disables native
Codex execution surfaces that would otherwise run from the Codex app-server
host. Use `appServer.experimental.sandboxExecServer: true` only when you want
to try Codex's remote environment support with OpenClaw's sandbox backend.
This preview path uses the pinned Codex `0.147.0` app-server.
This preview path uses the pinned Codex `0.148.0` app-server.
```json5
{
@@ -746,21 +746,17 @@ response remains authoritative even if it contains no visible models; HTTP
`401` and `403` return an empty catalog rather than exposing fallback models.
<Note>
The current bundled harness is `@openai/codex` `0.147.0`. A live `model/list`
probe against the official `0.147.0` app-server returned these public picker
The current bundled harness is `@openai/codex` `0.148.0`. A live `model/list`
probe against the official `0.148.0` app-server returned these public picker
rows:
| Model id | Input modalities | Reasoning efforts |
| --------------- | ---------------- | ------------------------------- |
| `gpt-5.5` | text, image | low, medium, high, xhigh |
| `gpt-5.6` | text, image | low, medium, high, xhigh, ultra |
| `gpt-5.6-luna` | text, image | low, medium, high, xhigh, ultra |
| `gpt-5.6-terra` | text, image | low, medium, high, xhigh, ultra |
| `gpt-5.6-sol` | text, image | low, medium, high, xhigh, ultra |
| `gpt-5.4` | text, image | low, medium, high, xhigh |
| `gpt-5.4-mini` | text, image | low, medium, high, xhigh |
| `gpt-5.3-codex` | text, image | low, medium, high, xhigh |
| `gpt-5.2` | text, image | low, medium, high, xhigh |
| Model id | Input modalities | Reasoning efforts |
| --------------- | ---------------- | ------------------------------------ |
| `gpt-5.6-sol` | text, image | low, medium, high, xhigh, max, ultra |
| `gpt-5.6-terra` | text, image | low, medium, high, xhigh, max, ultra |
| `gpt-5.6-luna` | text, image | low, medium, high, xhigh, max |
| `gpt-5.5` | text, image | low, medium, high, xhigh |
| `gpt-5.2` | text, image | low, medium, high, xhigh |
Available model IDs, input modalities, and reasoning efforts remain
account-scoped. Run `/codex models` after starting or upgrading the gateway to
+6 -6
View File
@@ -89,12 +89,12 @@ channel is the communication surface.
- The official `@openclaw/codex` plugin installed. Include `codex` in
`plugins.allow` if your config uses an allowlist.
- Codex app-server `0.147.0` or newer. The plugin still ships and manages the
exact `@openai/codex` `0.147.0` artifact, so a `codex` command on `PATH` does
not affect normal startup. Explicit custom, remote, and macOS desktop-owned
app-servers must report valid SemVer at or above that managed baseline.
Newer versions initialize with a warning; acceptance permits an attempt and
is not readiness or capability proof.
- Codex app-server `0.147.0` or newer. The plugin ships and manages the exact
`@openai/codex` `0.148.0` artifact, so a `codex` command on `PATH` does not
affect normal startup. Explicit custom, remote, and macOS desktop-owned
app-servers must report valid SemVer at or above the supported minimum.
Versions newer than the managed artifact initialize with a warning;
acceptance permits an attempt and is not readiness or capability proof.
- Node.js on the remote Codex app-server host when `remoteWorkspaceRoot` is set
and cross-machine workspace attachments must be transferred.
- Codex auth through `openclaw models auth login --provider openai`, an
+2 -2
View File
@@ -23,8 +23,8 @@ working.
- `plugins.entries.codex.enabled` is `true`.
- `plugins.entries.codex.config.codexPlugins.enabled` is `true`.
- Codex app-server reports version `0.147.0` or newer. The official plugin
still ships `@openai/codex` `0.147.0`; accepted external versions remain
subject to normal startup and capability validation.
ships `@openai/codex` `0.148.0`; accepted external versions remain subject to
normal startup and capability validation.
- The target Codex app-server can see the expected marketplace, plugin, and
app inventory.
- Migration supports only `openai-curated` plugins that it observed as