Skip to content

fix(codex): update managed app-server to 0.144.3 [AI]#106098

Merged
steipete merged 2 commits into
mainfrom
codex/fix-stale-codex-runtime-pin
Jul 13, 2026
Merged

fix(codex): update managed app-server to 0.144.3 [AI]#106098
steipete merged 2 commits into
mainfrom
codex/fix-stale-codex-runtime-pin

Conversation

@steipete

@steipete steipete commented Jul 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

What Problem This Solves

The bundled Codex app-server was pinned to @openai/codex 0.144.1, whose backend requests are now rejected. This blocks the Codex plugin before the next OpenClaw release.

Why This Change Was Made

  • Pin the managed Codex runtime and every platform artifact to 0.144.3.
  • Regenerate the root pnpm lock and plugin npm shrinkwrap, including registry integrities.
  • Align the manifest assertion and harness reference version. The live 0.144.3 model/list catalog is unchanged, so the existing seven-row snapshot remains current.

Direct upstream source inspection confirms this is the correct owner boundary: Codex builds its backend User-Agent from CARGO_PKG_VERSION in codex-rs/login/src/auth/default_client.rs:141-164, then installs that value on authenticated backend requests in codex-rs/backend-client/src/client.rs:179-182,212-219. OpenClaw should therefore upgrade the managed package, not spoof a backend header. The 0.144.2-to-0.144.3 comparison has no app-server protocol, protocol, exec, login-user-agent, backend-client, or CLI contract changes; its relevant app-server runtime delta is the compatible persisted reasoning-effort resume fix in codex-rs/app-server/src/request_processors/thread_processor.rs:2785-2814.

User Impact

Codex harness requests use backend-visible version 0.144.3, restoring compatibility for the release. No OpenClaw API, config, protocol, or picker-catalog shape changes.

Evidence

  • Blacksmith Testbox tbx_01kxd5c8haz92bc9vfadvdfq7g: fresh isolated corepack pnpm --config.minimum-release-age=0 dlx @openai/[email protected] --version returned codex-cli 0.144.3.
  • Same Testbox: authenticated 0.144.3 app-server model/list succeeded; public picker rows exactly match docs/plugins/codex-harness-reference.md.
  • Same Testbox: corepack pnpm test extensions/codex passed 106 files and 2,490 tests.
  • Same Testbox: corepack pnpm deps:shrinkwrap:changed:check, selected-plugin npm release checks, and full corepack pnpm check:changed passed (run 29232316676).
  • Exact prepared-head CI is green at 92ed0c43a984be36d3a8b5e7b08eab38203cb54c (run 29234980974).
  • Fresh structured autoreview of prepared head 92ed0c43a98: no findings, patch correct at 0.97 confidence.

@steipete
steipete requested a review from a team as a code owner July 13, 2026 06:13
@openclaw-barnacle openclaw-barnacle Bot added docs Improvements or additions to documentation extensions: codex size: XS maintainer Maintainer-authored PR labels Jul 13, 2026
@github-actions

github-actions Bot commented Jul 13, 2026

Copy link
Copy Markdown
Contributor

Dependency Guard

This PR changes dependency-related files. Maintainers should confirm these changes are intentional.

Changed files:

  • extensions/codex/npm-shrinkwrap.json
  • extensions/codex/package.json
  • pnpm-lock.yaml

Maintainer follow-up:

  • Review whether the dependency changes are intentional.
  • Inspect resolved package deltas when lockfile, shrinkwrap, or workspace dependency policy changes are present.
  • Treat package-lock.json and npm-shrinkwrap.json diffs as security-review surfaces.
  • Run pnpm deps:changes:report -- --base-ref origin/main --markdown /tmp/dependency-changes.md --json /tmp/dependency-changes.json locally for detailed release-style evidence.

@github-actions github-actions Bot added the dependencies-changed PR changes dependency-related files label Jul 13, 2026
@github-actions

github-actions Bot commented Jul 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Dependency graph changes noted

This PR includes dependency graph changes. The dependency guard is informational because the PR author is a repository admin or a member of @openclaw/openclaw-secops.

  • Current SHA: 92ed0c43a984be36d3a8b5e7b08eab38203cb54c
  • Trusted actor: @steipete
  • Trusted role: pull request author; openclaw-secops

Security review is still recommended before merge when the dependency graph change is intentional.

@steipete
steipete force-pushed the codex/fix-stale-codex-runtime-pin branch from 77ea031 to d80fdfd Compare July 13, 2026 06:47
@steipete steipete self-assigned this Jul 13, 2026
@steipete
steipete force-pushed the codex/fix-stale-codex-runtime-pin branch from d80fdfd to 5eae6c0 Compare July 13, 2026 06:58
@clawsweeper

clawsweeper Bot commented Jul 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed July 13, 2026, 4:22 AM ET / 08:22 UTC.

Summary
The PR updates the managed Codex app-server and six platform artifacts from 0.144.1 to 0.144.3, then aligns the lockfiles, manifest assertion, and harness documentation.

PR surface: Source 0, Tests 0, Docs 0, Config 0, Other 0. Total 0 across 5 files.

Reproducibility: no. complete before-fix rejection transcript is included, so the failure is not independently reproduced here. The managed launch path and backend-visible version contract are source-reproducible, and the authenticated after-fix run strongly supports the report.

Review metrics: 1 noteworthy metric.

  • Managed executable pins: 1 package and 6 platform artifacts updated. These pins select the authenticated executable shipped by the bundled Codex plugin, so version and integrity consistency matter before release.

Merge readiness
Overall: 🦞 diamond lobster
Proof: 🦞 diamond lobster
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Risk before merge

  • [P1] The PR head is mergeable but behind the supplied current-main SHA, so maintainers should refresh the exact merged diff and required checks before landing; stale-base drift alone does not establish a patch defect.

Maintainer options:

  1. Decide the mitigation before merge
    Ship one consistent 0.144.3 managed-runtime pin across package metadata, platform artifacts, assertions, and documentation, without adding an OpenClaw request-header workaround.
  2. Pause or close
    Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

  • No automated repair is identified; the protected maintainer label requires a human to refresh the behind branch, confirm exact-head dependency checks, and decide when to land it.

Security
Cleared: The executable dependency update is intentional and consistently pinned, and direct upstream comparison shows the earlier Guardian policy change is reverted before 0.144.3.

Review details

Best possible solution:

Ship one consistent 0.144.3 managed-runtime pin across package metadata, platform artifacts, assertions, and documentation, without adding an OpenClaw request-header workaround.

Do we have a high-confidence way to reproduce the issue?

No complete before-fix rejection transcript is included, so the failure is not independently reproduced here. The managed launch path and backend-visible version contract are source-reproducible, and the authenticated after-fix run strongly supports the report.

Is this the best way to solve the issue?

Yes. Updating the owner-managed upstream executable is the narrowest maintainable fix; spoofing its backend identity in OpenClaw would duplicate upstream policy and create future compatibility drift.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against ffff72c43aed.

Label changes

Label changes:

  • add P1: The stale managed executable reportedly causes backend rejection and blocks the bundled Codex agent workflow before the next release.
  • add rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
  • remove P2: Current review triage priority is P1, so this older priority label is no longer current.
  • remove rating: 🐚 platinum hermit: Current PR rating is rating: 🦞 diamond lobster, so this older rating label is no longer current.
  • remove merge-risk: 🚨 security-boundary: Current PR review selected no merge-risk labels.

Label justifications:

  • P1: The stale managed executable reportedly causes backend rejection and blocks the bundled Codex agent workflow before the next release.
  • rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): Authenticated app-server output plus the full Codex plugin suite, shrinkwrap checks, and selected-package release validation convincingly demonstrate the updated runtime after the fix.
  • proof: sufficient: Contributor real behavior proof is sufficient. Authenticated app-server output plus the full Codex plugin suite, shrinkwrap checks, and selected-package release validation convincingly demonstrate the updated runtime after the fix.
Evidence reviewed

PR surface:

Source 0, Tests 0, Docs 0, Config 0, Other 0. Total 0 across 5 files.

View PR surface stats
Area Files Added Removed Net
Source 1 28 28 0
Tests 1 1 1 0
Docs 1 2 2 0
Config 1 1 1 0
Generated 0 0 0 0
Other 1 29 29 0
Total 5 61 61 0

What I checked:

Likely related people:

  • steipete: Recent repository history and discussion connect this person to Codex app-server repairs, live harness validation, and the dependency guard identifies an OpenClaw security-review role beyond authorship of this proposal. (github.com) (role: recent Codex runtime contributor and security reviewer; confidence: medium; commits: c22f414, 86f108401bcd, bd3f09e9696d; files: extensions/codex/src/app-server/run-attempt.ts, src/agents/harness-runtimes.ts, src/commands/doctor-gateway-services.ts)
  • duqaXxX: Introduced adjacent forced Codex runtime activation behavior, making them a useful secondary reviewer for bundled harness ownership and activation boundaries. (github.com) (role: adjacent Codex runtime contributor; confidence: medium; commits: 69ba924b530e; files: extensions/codex/openclaw.plugin.json, src/config/plugin-auto-enable.shared.ts, src/plugins/activation-planner.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.
Review history (1 earlier review cycle)
  • reviewed 2026-07-13T07:13:43.515Z sha ef869df :: needs maintainer review before merge. :: none

@steipete steipete mentioned this pull request Jul 13, 2026
Closed
@clawsweeper clawsweeper Bot added rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. P2 Normal backlog priority with limited blast radius. labels Jul 13, 2026
@steipete
steipete force-pushed the codex/fix-stale-codex-runtime-pin branch from 5eae6c0 to ef869df Compare July 13, 2026 07:08
@clawsweeper clawsweeper Bot added merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. proof: sufficient ClawSweeper judged the real behavior proof convincing. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. and removed status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. labels Jul 13, 2026
@steipete
steipete force-pushed the codex/fix-stale-codex-runtime-pin branch from ef869df to 90a3b91 Compare July 13, 2026 07:17
@steipete steipete changed the title fix(codex): unblock plugin checks after 0.144.2 [AI] fix(codex): update managed app-server to 0.144.3 [AI] Jul 13, 2026
@steipete
steipete force-pushed the codex/fix-stale-codex-runtime-pin branch 2 times, most recently from 4afab9b to 1e78507 Compare July 13, 2026 08:12
@steipete
steipete force-pushed the codex/fix-stale-codex-runtime-pin branch from 1e78507 to 92ed0c4 Compare July 13, 2026 08:18
@clawsweeper clawsweeper Bot added rating: 🦞 diamond lobster Very strong PR readiness with only minor maintainer review expected. and removed rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. labels Jul 13, 2026
@clawsweeper clawsweeper Bot added P1 High-priority user-facing bug, regression, or broken workflow. and removed P2 Normal backlog priority with limited blast radius. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. labels Jul 13, 2026
@steipete

steipete commented Jul 13, 2026

Copy link
Copy Markdown
Contributor Author

Land-ready at 92ed0c43a984be36d3a8b5e7b08eab38203cb54c.

  • Updated the managed Codex runtime and all six platform packages from 0.144.1 to 0.144.3; package manifest, pnpm lock, generated npm shrinkwrap, assertion, and harness docs agree.
  • Direct Codex source inspection found no app-server protocol, protocol, exec, backend-user-agent, or CLI contract change requiring OpenClaw compatibility code; 0.144.3 only carries a compatible persisted reasoning-effort resume fix on this path.
  • Blacksmith Testbox run 29232316676: 106 Codex test files / 2,490 tests, shrinkwrap and selected-plugin release checks, full changed gate, authenticated 0.144.3 model/list, and fresh isolated codex-cli 0.144.3 smoke all passed.
  • Exact-head hosted CI run 29234980974 is green.
  • Fresh final autoreview: no accepted or actionable findings; patch correct at 0.97 confidence.

@steipete
steipete merged commit 0bae4e0 into main Jul 13, 2026
127 of 134 checks passed
@steipete
steipete deleted the codex/fix-stale-codex-runtime-pin branch July 13, 2026 08:27
@steipete

steipete commented Jul 13, 2026

Copy link
Copy Markdown
Contributor Author

Merged via squash.

@steipete

steipete commented Jul 13, 2026

Copy link
Copy Markdown
Contributor Author

Land-ready verification for head 92ed0c43a984be36d3a8b5e7b08eab38203cb54c:

  • Best-fix judgment: yes. Upstream Codex derives the authenticated backend User-Agent from CARGO_PKG_VERSION (codex-rs/login/src/auth/default_client.rs:141-164) and installs it on backend requests (codex-rs/backend-client/src/client.rs:179-182,212-219). Updating the managed package is the owner-correct fix; OpenClaw should not spoof that header.
  • Upstream contract: rust-v0.144.2..rust-v0.144.3 has no app-server protocol, protocol, exec, login-user-agent, or backend-client changes. The relevant app-server delta is a compatible persisted reasoning-effort resume fix (codex-rs/app-server/src/request_processors/thread_processor.rs:2785-2814).
  • Testbox tbx_01kxd5c8haz92bc9vfadvdfq7g: explicit 0.144.3 binary reported codex-cli 0.144.3; authenticated app-server model/list succeeded and matched the documented seven public picker rows.
  • Testbox tbx_01kxd5c8haz92bc9vfadvdfq7g: pnpm test extensions/codex passed 106 files / 2,490 tests; all 77 shrinkwrap checks and the selected @openclaw/codex release preflight passed.
  • Exact-head hosted CI run 29234980974 passed 51 jobs with 10 skipped and no failures, including docs, lint, dependencies, shrinkwrap, build, plugin checks, and all compact Node shards.
  • Earlier Testbox tbx_01kxd4fbk29373gvfb50ma6dxn passed docs formatting, Markdown lint, MDX, link audit, and docs-map checks.
  • Two fresh autoreviews: no findings (0.99 local delta; 0.98 final branch).
  • Repo-native scripts/pr prepare-run 106098 passed in hosted_exact_or_recent_rebase mode and verified the remote PR head matches the prepared head.

@steipete

steipete commented Jul 13, 2026

Copy link
Copy Markdown
Contributor Author

Merged via squash.

@github-actions github-actions Bot mentioned this pull request Jul 13, 2026
Open
vincentkoc pushed a commit that referenced this pull request Jul 13, 2026
@steipete @vincentkoc
fix(codex): update managed app-server to 0.144.3 [AI] (#106098)
2d2ddc4 
* fix(codex): update managed app-server to 0.144.2

* fix(codex): update managed app-server to 0.144.3

(cherry picked from commit 0bae4e0)
wm0018 pushed a commit to wm0018/openclaw that referenced this pull request Jul 14, 2026
@steipete @wm0018
fix(codex): update managed app-server to 0.144.3 [AI] (openclaw#106098)
d519912 
* fix(codex): update managed app-server to 0.144.2

* fix(codex): update managed app-server to 0.144.3
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jul 14, 2026
@steipete
fix(codex): update managed app-server to 0.144.3 [AI] (openclaw#106098)
296613b 
* fix(codex): update managed app-server to 0.144.2

* fix(codex): update managed app-server to 0.144.3
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@steipete steipete

Labels

dependencies-changed PR changes dependency-related files docs Improvements or additions to documentation extensions: codex maintainer Maintainer-authored PR P1 High-priority user-facing bug, regression, or broken workflow. proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🦞 diamond lobster Very strong PR readiness with only minor maintainer review expected. size: XS status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@steipete