Files
Josh Avant 73a9eed95b refactor(audit): add canonical admitted-run context (#120534)
* feat(audit): carry canonical admitted execution context

* fix(agents): preserve admitted context across retries

* fix(worker): fence legacy launch dialect

* test(gateway): track approval temp dirs

* fix(plugin-sdk): preserve harness attempt compatibility

* fix: close delegated run authority at owner boundaries

* fix: internalize delegated authority validators

* refactor: split delegated authority proof surfaces

* refactor: centralize command admission identity

* test: claim runtime tool authority

* fix(gateway): keep lifecycle cleanup within static budgets

* fix(agents): revalidate harness policy authority

* fix(agents): fence awaited approval capability results

* test(copilot): supply required harness capability fixtures

* fix(agent): preserve scoped embedded run admission

* fix(agent): preserve keyless and worker authority

* test(agent): bind incomplete-turn authority

* docs: preserve execution authority invariants

* chore(plugin-sdk): regenerate API baseline

* fix(gateway): notify pending claim closure

* fix(gateway): revalidate delegated tool authority

* fix(plugin-sdk): keep source guard internal

* fix: close delegated authority races

* fix: revalidate delegated side effects

* fix: close harness authority projection gaps

* fix: align authority integration types

* fix: isolate settled harness finalization

* fix: fence recovery identity finalization

* fix: preserve committed session worktrees

* fix: preserve worker placement agent identity

* fix: fence active harness tool work

* fix(plugins): restore embedded run admission owner

* chore(plugin-sdk): compose integrated surface budgets

* fix(copilot): keep finalization attempt type internal

* fix(plugins): complete admission owner type imports

* test(harness): use settled finalization attempt shape

* fix(security): retain exact side-run and approval authority

* fix(security): preserve protected authority through terminal sweep

* fix(agents): follow moved recovery store owner

* fix(ci): align integrated authority owners with gates

* fix(plugins): distinguish embedded agent adapter export

* chore(plugin-sdk): regenerate API baseline after rolling integration

* refactor(gateway): keep session authority within owner budgets

* fix(gateway): keep session helpers private

* docs(plugin-sdk): name the V2 parameter subpath

* chore(integration): reconcile worker and SDK surfaces

* docs(plugin-sdk): require the V2 host API floor

* chore(plugin-sdk): regenerate after proxy-auth integration
2026-08-10 23:15:20 -05:00

105 lines
3.7 KiB
TypeScript

/**
* Test-only helpers for producing Codex app-server prompt snapshots and dynamic
* tool specs without starting a live app-server.
*/
import type {
AnyAgentTool,
EmbeddedRunAttemptParamsV2 as EmbeddedRunAttemptParams,
} from "openclaw/plugin-sdk/agent-harness-runtime";
import {
type CodexAppServerRuntimeOptions,
resolveCodexAppServerRuntimeOptions,
} from "./src/app-server/config.js";
import type { CodexPluginConfig } from "./src/app-server/config.js";
import { filterCodexDynamicTools } from "./src/app-server/dynamic-tool-profile.js";
import { createCodexDynamicToolBridge } from "./src/app-server/dynamic-tools.js";
import type { CodexDynamicToolSpec, JsonObject } from "./src/app-server/protocol.js";
import {
buildDeveloperInstructions,
buildThreadResumeParams,
buildThreadStartParams,
buildTurnStartParams,
} from "./src/app-server/thread-lifecycle.js";
export { CODEX_APP_SERVER_VERSION } from "./src/app-server/version.js";
type CodexHarnessPromptSnapshot = {
developerInstructions: string;
threadStartParams: ReturnType<typeof buildThreadStartParams>;
threadResumeParams: ReturnType<typeof buildThreadResumeParams>;
turnStartParams: ReturnType<typeof buildTurnStartParams>;
};
/** Resolves deterministic app-server options for prompt snapshot tests. */
export function resolveCodexPromptSnapshotAppServerOptions(
pluginConfig?: unknown,
): CodexAppServerRuntimeOptions {
return resolveCodexAppServerRuntimeOptions({
pluginConfig,
env: {},
requirementsToml: null,
});
}
/** Builds thread/resume/turn prompt payload snapshots for a Codex harness attempt. */
export function buildCodexHarnessPromptSnapshot(params: {
attempt: EmbeddedRunAttemptParams;
cwd: string;
threadId: string;
dynamicTools: CodexDynamicToolSpec[];
appServer: CodexAppServerRuntimeOptions;
config?: JsonObject;
promptText?: string;
developerInstructionAdditions?: string;
turnScopedDeveloperInstructions?: string;
}): CodexHarnessPromptSnapshot {
const developerInstructions = joinPresentSections(
buildDeveloperInstructions(params.attempt, {
dynamicTools: params.dynamicTools,
}),
params.developerInstructionAdditions,
);
return {
developerInstructions,
threadStartParams: buildThreadStartParams(params.attempt, {
cwd: params.cwd,
dynamicTools: params.dynamicTools,
appServer: params.appServer,
developerInstructions,
config: params.config,
}),
threadResumeParams: buildThreadResumeParams(params.attempt, {
threadId: params.threadId,
appServer: params.appServer,
developerInstructions,
config: params.config,
}),
turnStartParams: buildTurnStartParams(params.attempt, {
threadId: params.threadId,
cwd: params.cwd,
appServer: params.appServer,
promptText: params.promptText,
turnScopedDeveloperInstructions: params.turnScopedDeveloperInstructions,
}),
};
}
function joinPresentSections(...sections: Array<string | undefined>): string {
return sections.filter((section): section is string => Boolean(section?.trim())).join("\n\n");
}
/** Converts harness tools into Codex dynamic-tool specs for prompt snapshot tests. */
export function createCodexDynamicToolSpecsForPromptSnapshot(params: {
tools: AnyAgentTool[];
pluginConfig?: Pick<CodexPluginConfig, "codexDynamicToolsLoading" | "codexDynamicToolsExclude">;
directToolNames?: Iterable<string>;
}): CodexDynamicToolSpec[] {
const filteredTools = filterCodexDynamicTools(params.tools, params.pluginConfig ?? {});
return createCodexDynamicToolBridge({
tools: filteredTools,
signal: new AbortController().signal,
loading: params.pluginConfig?.codexDynamicToolsLoading ?? "searchable",
directToolNames: params.directToolNames,
}).specs;
}