e1b8150a06
fix(codex): let owners install plugins from discovered marketplaces ( #122389 )
...
* fix(codex): allow owner-approved marketplace plugins
* fix(codex): preserve marketplace validation and remove unused exports
* docs(codex): clarify already-installed plugin authorization
2026-08-12 20:29:40 +00:00
b080dd1e76
refactor: consolidate coercion contracts ( #122458 )
...
* refactor: consolidate coercion contracts
Centralize exact string, record, numeric, date, Boolean, argument, and structured-error coercions while preserving call-site semantics.
Migrate canonical-name collisions and deprecated internal SDK bypasses, deleting 55 net production/tooling lines. Expand declaration ownership enforcement to 101 allowed helpers and add a narrow export-completeness audit.
* fix: preserve standalone script coercions
Keep copied Control UI tooling self-contained and retain the trusted release harness module-relative source seam when the harness runs against an old target cwd.
2026-08-11 23:26:37 -07:00
bb873c8806
fix(cron): preserve Codex app authority
2026-08-11 04:47:10 -05:00
45dd558d92
fix(codex): prevent session handoffs and native tasks from losing thread ownership ( #120740 )
...
* fix(codex): preserve thread ownership across session lifecycles
* test(codex): keep canonical context-engine session fixtures
* fix(codex): fence replacement thread rollback by ownership
* fix(codex): fence thread handoffs by physical client ownership
* fix(codex): derive conversation privacy from its source session
* fix(codex): claim active native subagents at their lifecycle owner
* fix(codex): preserve conversation ownership when detach fails
* fix(codex): fence stale native child close notifications
* fix(codex): preserve active child ownership during rollback
* test(codex): keep lifecycle fixtures aligned with public contracts
* fix(codex): preserve rollback failure causes across ownership recovery
* fix(codex): retain aggregate rollback causes through lint analysis
* fix(codex): release native children when idle retention fails
2026-08-08 16:20:16 -07:00
a00438a867
fix(codex): restore connected apps for token-authenticated runs ( #115075 )
...
* fix(codex): restore connected apps for token-authenticated runs
* fix(codex): keep app inventory protocol types private
* fix(codex): align native runtime with Codex 0.146.0
Co-authored-by: Steven Lee <stevenlee@openai.com >
* fix(codex): clean up latest app-server integration
Co-authored-by: Steven Lee <stevenlee@openai.com >
* fix(codex): keep internal protocol types private
* fix(ci): repair current main Codex landing gates
* fix(ci): format inherited code mode matrix
* fix(codex): reconcile native app-server contracts with main
Prepare a verified GitHub-hosted mainline merge while preserving the reviewed Codex 0.146.0 fixes and canonical OpenAI authentication.
Co-authored-by: Steven Lee <stevenlee@openai.com >
* fix(codex): keep QA evidence in its owning plugin
Resolve the current-main Code Mode test rename without resurrecting the retired core test path.
Co-authored-by: Steven Lee <stevenlee@openai.com >
* fix(codex): enforce canonical OpenAI app-server auth
Reject retired provider aliases without runtime compatibility, direct operators to the doctor migration, and remove the redundant OpenAI API-key predicate.
Co-authored-by: Steven Lee <stevenlee@openai.com >
* chore(codex): reconcile latest main dependency graph
Preserve current main dependency changes while preparing the original Codex PR for an ancestry-preserving signed mainline merge.
Co-authored-by: Steven Lee <stevenlee@openai.com >
* fix(codex): unify bundled Codex 0.146 runtimes
Keep the ACP adapter on the same 0.146.0 Codex release as the managed runtime, remove obsolete 0.145.0 platform artifacts and unused semver compatibility, and preserve the latest main dependency upgrades.
Co-authored-by: Steven Lee <stevenlee@openai.com >
---------
Co-authored-by: Peter Steinberger <peter@steipete.me >
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-29 06:21:25 -04:00
310396f1e1
fix(codex): enable configured apps in service sessions ( #115433 )
...
* fix(codex): attest configured plugin apps before turns
* fix(codex): tighten plugin thread config
* fix(codex): expose account app admission wrapper
2026-07-28 22:39:20 -07:00
9d4610cbd1
fix(codex): settle plugin activation, align plugin/list with codex 0.144, bound discovery per turn ( #108311 )
...
* fix(codex): settle plugin activation, align plugin/list with codex 0.144, bound discovery per turn
- plugin/list curated queries omit cwds and marketplaceKinds (0.144 semantics:
explicit kinds disable the automatic global remote catalog; cwds:[] never
suppressed it), and the missing-marketplace check recognizes the current
openai-curated-remote wire name via the shared predicate (#107305 )
- curated plugin/list snapshots settle in a process-local metadata cache
(coalesced, invalidated on install/identity change/restart, 1h freshness
window matching the app-inventory cache) so a missing marketplace or plugin
no longer re-runs blocking discovery RPCs on every embedded-Codex turn;
fail-open local-only responses (upstream warns without a load error when the
remote catalog fetch fails) are never cached, and workspace-directory
queries stay live because external activation has no invalidation signal
- the whole plugin-config build shares one bounded startup deadline with
remaining-budget propagation per RPC and a deny-all apps fallback, so a hung
plugin/list cannot consume the turn (#107305 )
- guarded thread requests (start/resume/fork under the native-config fence)
must carry a finite timeout or abort signal, closing the unbounded-fence-hold
window for raw callers (#106719 hardening)
* chore(codex): keep plugin metadata types and deadline builder module-local
Deadline behavior tests exercise the production provider composition instead
of a test-only export.
2026-07-15 06:40:29 -07:00
26210c1600
refactor: remove browser and codex dead exports ( #105867 )
...
* refactor(browser): collapse Playwright export paths
* refactor(browser): remove dead plugin exports
* refactor(codex): remove dead app-server exports
* refactor(codex): remove remaining dead exports
* test(codex): use canonical private-type owners
* test(browser): isolate proxy startup state
* test(browser): remove stale chrome imports
* refactor(codex): privatize remaining helpers
* chore(deadcode): refresh export baseline after rebase
* refactor(browser): finish canonical helper ownership
* refactor: fix dead-export cleanup gates
* refactor(codex): keep runtime facades LOC-neutral
* chore(ci): refresh TypeScript LOC baseline
* chore(deadcode): refresh ratchets after rebase
* chore(ci): refresh LOC baseline after main advance
* chore(deadcode): align ratchets with latest main
2026-07-12 22:23:11 -07:00
7bf80dc2c6
chore(tooling): enforce formatting and refresh TypeScript checks ( #104239 )
...
* chore(tooling): enforce current formatter and refresh checks
* chore(tooling): keep release changelog formatter-owned
* chore(tooling): retain compatible Node type surface
* ci: enforce formatting for docs-only changes
* ci: isolate docs formatter check
* chore(tooling): apply updated lint and format rules
* chore(tooling): satisfy updated switch lint
* style(ui): apply Linux formatter layout
* test(doctor): match quiet local audio contribution
* test(doctor): assert quiet output only
* test(doctor): follow restored information contract
2026-07-11 01:09:51 -07:00
806a116f9d
Let owner-operated Codex agents use connected account apps ( #100973 )
...
* Allow connected Codex account apps
* Preserve explicit plugin app policy
* Refresh Codex documentation map
* Unify connected apps with Codex plugin policy
* Format Codex configuration reference
2026-07-06 12:31:45 -07:00
d9b5afad18
fix(codex): rename destructive approval mode to ask ( #98501 )
...
* fix(codex): rename destructive approval mode to ask
* fix(codex): keep ask reviewer app-scoped
* test: fix current-main CI regressions
2026-07-01 15:14:55 -07:00
58367137ea
fix(codex): keep plugin apps available when inventory is missing ( #98042 )
...
* fix(codex): refresh missing app inventory
* fix(codex): support remote curated plugins
* fix(codex): resolve plugins across curated marketplaces
* fix(codex): enable Guardian on first thread turn
2026-06-30 00:44:28 -07:00
389c355bcf
fix(codex): preserve per-app approval reviewer policy ( #97327 )
...
* fix(codex): version app inventory cache keys
* fix(codex): refresh and replay plugin app policy
* fix(codex): preserve user reviewer for plugin turns
* fix(codex): gate plugin reviewer from startup policy
* fix(codex): route app approvals to user reviewer
* fix(codex): prompt destructive app tools
* fix(codex): scope app approval reviewers
* test(codex): complete app policy fixture
* fix(codex): avoid pre-start app inventory gate
* Revert "fix(codex): prompt destructive app tools"
This reverts commit d1cb0d5ba8
2026-06-29 02:35:13 -07:00
c5d34c8376
feat(codex): add always plugin approval mode ( #97123 )
...
* feat(codex): add always plugin approval mode
* fix(codex): normalize plugin approval decisions
* fix(codex): fail closed on layered approval overrides
2026-06-27 01:19:00 -07:00
a6a4652c70
fix(codex): expose plugin apps after delayed inventory load ( #96872 )
...
* fix(codex): refresh missing plugin app inventory
* fix(codex): honor OpenClaw app enablement overrides
2026-06-25 21:10:02 -07:00
bc5081c587
feat(codex): support remote app-server plugins ( #94203 )
...
* feat(codex): support remote app-server plugins
* fix(codex): refresh remote plugin apps after install
* fix(codex): infer remote app-server topology
* docs(codex): document remote app-server plugin config
* fix(codex): remove remote mutation policy
* fix(codex): simplify remote workspace root
* docs(codex): fix remote app-server PR docs
2026-06-17 13:52:34 -07:00
e82d19fb06
feat(codex): add auto plugin approvals ( #92625 )
...
* feat(codex): add on-request plugin approvals
* feat(codex): rename plugin approval policy to auto
* fix(codex): update binding schema version callers
2026-06-14 18:00:38 -07:00
d99268ae51
docs: document codex plugin app config
2026-06-04 08:46:41 -04:00
f169e0aafd
fix(codex): guard against stale codex app snapshots leading to plugin invocation failure ( #83807 )
...
* feat(codex): add plugin enable disable list commands
* fix(codex): escape plugin management output
* test(codex): narrow plugin command coverage
* fix(codex): gate plugin management writes
* test(codex): type command plugin context
* fix(codex): recover plugin app bindings
* fix(codex): fail closed on missing app inventory
* fix(codex): restore plugin thread config log signal
* revert(codex): drop plugin management commands
* fix(codex): warn on missing plugin app inventory
* fix(codex): trim plugin binding debug logs
* fix(codex): restore thread lifecycle json import
* chore(codex): remove plugin app debug logs
* fix(codex): redact plugin thread config logs
2026-05-18 18:57:48 -07:00
cfc189de0a
fix(codex): auto-approve plugin read tools ( #80513 )
...
* fix(codex): auto-approve plugin read tools
* docs: add codex plugin approval changelog
2026-05-10 21:13:40 -07:00
a1ac559ed7
feat(codex): enable native plugin app support ( #78733 )
...
* feat(codex): add native plugin config schema
* feat(codex): add native plugin inventory activation
* feat(codex): configure native plugin apps for threads
* feat(codex): enforce plugin elicitation policy
* feat(codex): migrate native plugins
* docs(codex): document native plugin support
* fix(codex): harden plugin migration refresh
* fix(codex): satisfy plugin activation lint
* fix: stabilize codex plugin app config
* fix: address codex plugin review feedback
* fix: key codex plugin app cache by websocket credentials
* fix: keep codex plugin app fingerprints stable
* fix: refresh codex plugin cache test fixtures
* fix: refresh plugin app readiness after activation
* fix: support remote codex plugin activation
* fix: recover plugin app bindings after cache refresh
* fix: force codex app refresh after plugin activation
* fix: recover partial codex plugin app bindings
* fix: sync codex plugin selection config
* fix: keep codex plugin activation fail closed
* fix: align codex plugin protocol types with main
* fix: refresh partial codex plugin app bindings
* fix: key codex app cache by env api key
* fix: skip failed codex plugin migration config
* test: update codex prompt snapshots
* fix: fail closed on missing codex app inventory entries
* fix(codex): enforce native plugin policy gates
* fix(codex): normalize native plugin policy types
* fix(codex): fail closed on plugin refresh errors
* fix(codex): use native plugin destructive policy
* fix(codex): key plugin cache by api-key profiles
* fix(codex): drop unshipped plugin fingerprint compat
* fix(codex): let native app policy gate plugin tools
* fix(codex): allow open-world plugin app tools
* fix(codex): revalidate native plugin app bindings
* fix(codex): preserve plugin binding on recheck failure
* docs(codex): clarify plugin harness scope
* fix(codex): return activation report state exhaustively
* test(codex): refresh prompt snapshots after rebase
* fix(codex): match namespaced plugin ids
2026-05-07 17:20:28 -07:00
Kimi Yu