Skip to content

Let owner-operated Codex agents use connected account apps#100973

Merged
pash-openai merged 5 commits into
mainfrom
codex/allow-all-account-apps
Jul 6, 2026
Merged

Let owner-operated Codex agents use connected account apps#100973
pash-openai merged 5 commits into
mainfrom
codex/allow-all-account-apps

Conversation

@pash-openai

@pash-openai pash-openai commented Jul 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

OpenClaw's native Codex integration currently exposes connector apps only when an installed curated plugin proves ownership of them. That is a useful default for shared agents, but it also means an owner-operated agent cannot opt into apps already connected to its Codex account when those apps do not have a packaged plugin, such as ChatGPT Meetings.

This extends the existing codexPlugins policy with an explicit allow_all_plugins opt-in. When enabled, each new native Codex thread reads the complete account app inventory and snapshots every accessible app into the thread's explicit app allowlist. Inaccessible apps remain excluded, inventory failures fail closed, and explicit packaged-plugin policies still take precedence for overlapping app IDs.

Account apps reuse the existing global codexPlugins.allow_destructive_actions policy, including the existing auto and ask approval behavior. The resulting app policy is persisted with the thread so resumed and forked threads keep the same bounded connector set.

Live behavior was checked on the exact head d7b6123325dd7aeff6f72fc0a0d987e3d41c6291, built as the production Docker image and connected to an authenticated Codex app-server. A fresh OpenClaw session admitted ChatGPT Meetings from the complete account inventory without a packaged plugin, invoked codex_apps.chatgpt_meetings.find_all, and returned meeting metadata successfully. The persisted binding recorded the account-source app set with the existing ask destructive-action policy. A second, fresh container resumed the same OpenClaw and Codex session, answered from the prior turn with zero connector calls, and preserved the same app-policy binding.

@openclaw-barnacle openclaw-barnacle Bot added docs Improvements or additions to documentation gateway Gateway runtime extensions: codex size: L maintainer Maintainer-authored PR labels Jul 6, 2026
@pash-openai
pash-openai marked this pull request as ready for review July 6, 2026 15:18
chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Jul 6, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d28ce48144

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread extensions/codex/src/app-server/plugin-thread-config.ts Outdated
@clawsweeper

clawsweeper Bot commented Jul 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs real behavior proof before merge. Reviewed July 6, 2026, 11:47 AM ET / 15:47 UTC.

Summary
The PR adds an opt-in plugins.entries.codex.config.accountApps.mode: "all" policy for native Codex threads, snapshots accessible account apps into per-thread app config, persists the policy context, routes app approvals, and documents/tests the behavior.

PR surface: Source +256, Tests +376, Docs +51. Total +683 across 18 files.

Reproducibility: not applicable. This PR adds an opt-in Codex account-app capability rather than reporting a broken existing behavior. Source review traced the intended path, but no live after-fix proof is posted.

Review metrics: 2 noteworthy metrics.

  • New Codex Config Surface: 1 object added, 2 keys. accountApps.mode and accountApps.allow_destructive_actions create a new operator-facing policy surface for connected Codex account apps.
  • Persisted Policy Shape: 1 entry variant added. Session bindings now persist account-sourced app policy entries, so upgrade and resume behavior need maintainer-visible proof.

Stored data model
Persistent data-model change detected: serialized state: extensions/codex/src/app-server/session-binding.test.ts, serialized state: extensions/codex/src/app-server/session-binding.ts. Confirm migration or upgrade compatibility proof before merge.

Merge readiness
Overall: 🦪 silver shellfish
Proof: 🧂 unranked krab
Patch quality: 🐚 platinum hermit
Result: blocked until real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • [P1] Add redacted live Codex app-server proof for an accessible account app, including approval behavior and resumed-thread persistence.
  • [P1] Fix the stale plugin-only wording in docs/plugins/codex-native-plugins.md.
  • Get maintainer approval for the new account-wide connected-app config boundary.

Proof guidance:

  • [P1] Needs real behavior proof before merge: No PR body, comment, log, terminal output, or artifact shows the new account-app behavior in a real Codex setup; before merge, add redacted live output or logs showing inventory snapshot, app admission, approval handling, and resume behavior. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Risk before merge

  • [P1] No real behavior proof is posted for live app/list inventory, ChatGPT Meetings or another account app being admitted, approval routing, or resume/fork persistence.
  • [P1] The PR adds a security-sensitive Codex config surface that can expose every accessible connected account app for an authenticated account when explicitly enabled, so maintainer product/security approval is needed before merge.
  • [P1] One docs sentence still describes thread app config as plugin-owned-only, which conflicts with the new account-app path.

Maintainer options:

  1. Require Proof And Docs Before Merge (recommended)
    Update the stale thread-config docs and add redacted live Codex app-server proof showing account app snapshot, approval behavior, and resumed-thread persistence before merging.
  2. Accept The Explicit Owner Opt-In
    A maintainer may intentionally accept the security-sensitive account-wide app exposure because it is default-off and preserves plugin precedence.
  3. Pause For A Narrower Contract
    If account-wide exposure is too broad, pause this PR and pursue a narrower plugin/API or allowlist contract instead.

Next step before merge

  • [P1] This PR should stay in human review because it has a protected label, missing real behavior proof, and a new security-sensitive Codex config/product boundary.

Maintainer decision needed

  • Question: Should OpenClaw accept an explicit accountApps.mode: "all" Codex config that exposes every accessible connected Codex account app to owner-operated native Codex threads?
  • Rationale: The implementation is bounded and opt-in, but the permanent product/security boundary for account-wide connected apps cannot be decided from code review alone.
  • Likely owner: steipete — Recent shared native Codex thread work and docs ownership make this the best available routing point for the product/security call, with kevinslin as the code-path owner.
  • Options:
    • Accept After Proof And Docs (recommended): Approve the account-wide opt-in direction, then require redacted live Codex app proof and the stale docs sentence fix before merge.
    • Narrow To Packaged Plugins: Reject the account-wide mode for now and keep native app exposure limited to plugin-owned apps until a narrower package/API story exists.
    • Accept As Experimental Owner Policy: Allow the config under maintainer-owned experimental policy with explicit release notes and follow-up monitoring for account-app safety.

Security
Cleared: The diff adds an intentional, default-off connected-app exposure path; I found no supply-chain change or concrete security bypass beyond the maintainer decision needed for that new boundary.

Review findings

  • [P3] Update the thread app config docs for account apps — docs/plugins/codex-native-plugins.md:230-231
Review details

Best possible solution:

Land a maintainer-approved explicit opt-in that keeps default deny, plugin precedence, persisted thread allowlists, and docs/proof aligned before merge.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR adds an opt-in Codex account-app capability rather than reporting a broken existing behavior. Source review traced the intended path, but no live after-fix proof is posted.

Is this the best way to solve the issue?

Unclear until maintainer approval and proof: the implementation is in the right Codex plugin boundary and preserves fail-closed inventory, plugin precedence, and binding replay, but account-wide connected app exposure is a product/security decision.

Full review comments:

  • [P3] Update the thread app config docs for account apps — docs/plugins/codex-native-plugins.md:230-231
    The new section says accountApps.mode: "all" can admit connected account apps, but the Thread app config paragraph below still says only apps owned by enabled migrated plugins are enabled. That is now false for the documented configuration and can mislead operators about what the per-thread allowlist contains.
    Confidence: 0.88

Overall correctness: patch is correct
Overall confidence: 0.78

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 30e5dfcf0295.

Label changes

Label changes:

  • add P2: This is a normal-priority feature PR with bounded scope but meaningful Codex app exposure and config-surface impact.
  • add merge-risk: 🚨 compatibility: The PR adds operator config and persisted binding policy shape that must remain stable across setup, resume, and upgrade flows.
  • add merge-risk: 🚨 security-boundary: Merging enables a new opt-in path that can expose every accessible connected Codex account app and route destructive app approvals.
  • add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
  • add feature: ✨ showcase: ClawSweeper spotlight: unusually compelling feature idea for maintainer attention. The idea usefully unlocks already-connected Codex account apps for owner-operated agents without requiring a packaged plugin for every connector.
  • add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: No PR body, comment, log, terminal output, or artifact shows the new account-app behavior in a real Codex setup; before merge, add redacted live output or logs showing inventory snapshot, app admission, approval handling, and resume behavior. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Label justifications:

  • P2: This is a normal-priority feature PR with bounded scope but meaningful Codex app exposure and config-surface impact.
  • merge-risk: 🚨 security-boundary: Merging enables a new opt-in path that can expose every accessible connected Codex account app and route destructive app approvals.
  • merge-risk: 🚨 compatibility: The PR adds operator config and persisted binding policy shape that must remain stable across setup, resume, and upgrade flows.
  • rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
  • feature: ✨ showcase: ClawSweeper spotlight: unusually compelling feature idea for maintainer attention. The idea usefully unlocks already-connected Codex account apps for owner-operated agents without requiring a packaged plugin for every connector.
  • status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: No PR body, comment, log, terminal output, or artifact shows the new account-app behavior in a real Codex setup; before merge, add redacted live output or logs showing inventory snapshot, app admission, approval handling, and resume behavior. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed

PR surface:

Source +256, Tests +376, Docs +51. Total +683 across 18 files.

View PR surface stats
Area Files Added Removed Net
Source 8 306 50 +256
Tests 6 377 1 +376
Docs 4 59 8 +51
Config 0 0 0 0
Generated 0 0 0 0
Other 0 0 0 0
Total 18 742 59 +683

What I checked:

Likely related people:

  • kevinslin: Recent GitHub history shows repeated merged work on Codex plugin app policy, destructive approval modes, app inventory refresh, and binding recovery in the central files touched here. (role: recent feature owner; confidence: high; commits: d9b5afad180b, 58367137eac6, 389c355bcf3f; files: extensions/codex/src/app-server/plugin-thread-config.ts, extensions/codex/src/app-server/config.ts, docs/plugins/codex-native-plugins.md)
  • steipete: Recent history shows work on shared native Codex threads and source-grounded docs rewrites that overlap the owner-operated account context and docs surfaces changed by this PR. (role: recent adjacent owner; confidence: medium; commits: 3d6a2216ea77, f7d7148cf047, c52583a02270; files: extensions/codex/src/app-server/config.ts, extensions/codex/src/app-server/thread-lifecycle.ts, docs/plugins/codex-native-plugins.md)
  • vincentkoc: Recent thread-lifecycle and Codex app-server runtime commits touch binding rotation, transient search, and network proxy behavior adjacent to the resume and binding path reviewed here. (role: recent adjacent contributor; confidence: medium; commits: 5c3469549159, f1c44e2d6d7a, 2ca375fc1a7c; files: extensions/codex/src/app-server/thread-lifecycle.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@clawsweeper clawsweeper Bot added rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. feature: ✨ showcase ClawSweeper spotlight: unusually compelling feature idea for maintainer attention. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. P2 Normal backlog priority with limited blast radius. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. labels Jul 6, 2026
kevinlin-openai
kevinlin-openai reviewed Jul 6, 2026
View reviewed changes
Comment thread docs/gateway/configuration-reference.md Outdated
@pash-openai

pash-openai commented Jul 6, 2026

Copy link
Copy Markdown
Contributor Author

@clawsweeper re-review

@clawsweeper

clawsweeper Bot commented Jul 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@pash-openai
pash-openai merged commit 806a116 into main Jul 6, 2026
97 checks passed
@pash-openai
pash-openai deleted the codex/allow-all-account-apps branch July 6, 2026 19:31
@pash-openai

pash-openai commented Jul 6, 2026

Copy link
Copy Markdown
Contributor Author

Merged via squash.

@github-actions github-actions Bot mentioned this pull request Jul 6, 2026
Open
@steipete steipete mentioned this pull request Jul 6, 2026
Merged
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jul 7, 2026
@pash-openai
Let owner-operated Codex agents use connected account apps (openclaw#…
851a652 
…100973)

* Allow connected Codex account apps

* Preserve explicit plugin app policy

* Refresh Codex documentation map

* Unify connected apps with Codex plugin policy

* Format Codex configuration reference
giodl73-repo pushed a commit to giodl73-repo/openclaw that referenced this pull request Jul 8, 2026
@pash-openai @giodl73-repo
Let owner-operated Codex agents use connected account apps (openclaw#…
22bacd5 
…100973)

* Allow connected Codex account apps

* Preserve explicit plugin app policy

* Refresh Codex documentation map

* Unify connected apps with Codex plugin policy

* Format Codex configuration reference
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kevinlin-openai kevinlin-openai kevinlin-openai left review comments
@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments

Assignees

No one assigned

Labels

docs Improvements or additions to documentation extensions: codex feature: ✨ showcase ClawSweeper spotlight: unusually compelling feature idea for maintainer attention. gateway Gateway runtime maintainer Maintainer-authored PR merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. P2 Normal backlog priority with limited blast radius. rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. size: L status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@pash-openai @kevinlin-openai