feat(codex): add auto plugin approvals by kevinslin · Pull Request #92625 · openclaw/openclaw

kevinslin · 2026-06-13T07:37:47Z

Summary

Renames the Codex native plugin destructive approval setting from on-request to auto; the runtime schema no longer accepts on-request as a steady-state config value.
Routes allow_destructive_actions: "auto" Codex app-server elicitation approval requests through OpenClaw plugin approvals instead of auto-accepting or auto-denying them.
Keeps boolean true as auto-accept for safe schemas via the internal allow mode, so it no longer collides with approval-routed behavior.
Adds canonical repair paths for old shipped on-request values through Codex doctor config normalization, Codex migration planning/apply, and persisted app-server binding v1 normalization.
Updates Codex plugin docs, manifest schema/help, config parsing, migration defaults, and focused tests for true, false, and auto behavior.

Linked context

Requested by maintainer in this Codex session for Codex plugin MCP elicitations and the renamed auto config behavior.

Related local spec/work: Codex plugin elicitations to plugin approvals.

Real behavior proof (required for external PRs)

Behavior or issue addressed: Codex Google Calendar native plugin create_event approval elicitations surface as OpenClaw plugin approvals in Slack and proceed only after user approval.
Real environment tested: Local OpenClaw codex-dev profile, Slack channel delivery, native Codex Google Calendar connector, [email protected] calendar account.
Exact steps or command run after the approval-routing patch: pnpm openclaw --profile codex-dev gateway run --force --ws-log compact; then pnpm openclaw --profile codex-dev agent --agent dev --session-key agent:dev:codex-on-request-create-event-accessibility-1781275534 --channel slack --to U04HRD671T2 --message "Use Google Calendar create_event immediately: calendar_id primary, title 'Walk lobster', start_time '2026-06-12T23:30:00-07:00', end_time '2026-06-13T00:00:00-07:00', timezone_str 'America/Los_Angeles', attendees []." --reply-channel slack --reply-to U04HRD671T2 --thinking off --json --timeout 600
Evidence after fix: Slack posted Plugin approval required for approval ID plugin:516ce5b5-e027-4587-a6ee-847282bab742 with Allow Once, Allow Always, and Deny; after Allow Once, the Codex run completed with Created Walk lobster on your primary calendar for June 12, 2026, 11:30 PM to June 13, 2026, 12:00 AM Pacific. Event ID: 62gktmukfqoqjrfujljgg1bv8k. Google Calendar connector search returned event id 62gktmukfqoqjrfujljgg1bv8k, summary Walk lobster, start 2026-06-12T23:30:00-07:00, end 2026-06-13T00:00:00-07:00.
Observed result after fix: The Codex plugin write did not auto-run; it waited for Slack approval, then created the Calendar event after approval.
Current rename verification: the live proof above was captured before the operator-facing spelling changed from on-request to auto; current focused tests verify that auto selects approval-routed behavior and that old on-request persisted config/bindings are repaired into the canonical values.
What was not tested: Browser-side Google Calendar event detail page for [email protected]; Arc/Safari required Google re-auth for that account, so I stopped before entering credentials.
Proof limitations or environment constraints: Browser UI could not access the connector account without re-auth. The connector itself verified the created event by ID and time.
Before evidence: Earlier attempts without timely approval showed user rejected MCP tool call / expired approval and did not create an event.

Tests and validation

pnpm test extensions/codex/doctor-contract-api.test.ts extensions/codex/src/app-server/config.test.ts extensions/codex/src/app-server/plugin-thread-config.test.ts extensions/codex/src/app-server/elicitation-bridge.test.ts extensions/codex/src/app-server/session-binding.test.ts extensions/codex/src/migration/provider.test.ts extensions/codex/src/app-server/plugin-activation.test.ts - 7 files passed, 219 tests passed.
pnpm lint --threads=8
git diff --check
.agents/skills/autoreview/scripts/autoreview --mode local - clean, no accepted/actionable findings.
Live OpenClaw/Codex/Slack/Google Calendar proof described above.

Regression coverage was added around Codex app-server approval config parsing, elicitation bridge approval behavior, plugin thread config, session binding v1 normalization, doctor config repair, Codex migration repair, and plugin activation defaults.

Risk checklist

Did user-visible behavior change? (Yes/No)

Yes. Codex plugin MCP elicitations can ask the user through plugin approval UI when configured as auto.

Did config, environment, or migration behavior change? (Yes/No)

Yes. The Codex plugin approval-routed config value is now auto; old on-request values are repaired through doctor/migration/binding normalization rather than accepted as runtime config.

Did security, auth, secrets, network, or tool execution behavior change? (Yes/No)

Yes. Tool execution approval behavior changes for Codex native plugin MCP tools.

What is the highest-risk area?

Approval semantics around write-capable native plugin MCP tools and migration of existing approval-routed config.

How is that risk mitigated?

The new mode is explicit in config, focused unit tests cover the approval path and repair surfaces, autoreview is clean, and the Slack approval path was live-tested before the final config spelling rename.

Current review state

What is the next action?

Review and CI.

What is still waiting on author, maintainer, CI, or external proof?

CI is pending after the latest push.

Which bot or reviewer comments were addressed?

None yet.

clawsweeper · 2026-06-13T07:39:18Z

Codex review: needs maintainer review before merge. Reviewed June 14, 2026, 8:27 PM ET / 00:27 UTC.

Summary
Expands Codex native plugin destructive-action policy with auto, routes matching MCP elicitations through OpenClaw plugin approvals, and adds doctor, migration, session-binding, docs, and focused tests.

PR surface: Source +329, Tests +631, Docs +4. Total +964 across 20 files.

Reproducibility: not applicable. this is a feature PR, and current main lacks the approval-routed auto mode while the PR body supplies after-fix live proof.

Review metrics: 1 noteworthy metric.

Config and state surface changed: 1 existing config key expanded, 1 binding sidecar schema version bumped, 1 legacy value repaired. These surfaces affect upgrade behavior and operator expectations for Codex native plugin destructive-action approvals.

Stored data model
Persistent data-model change detected: database schema: extensions/codex/src/app-server/session-binding.test.ts, database schema: extensions/codex/src/app-server/session-binding.ts, database schema: extensions/codex/src/app-server/thread-lifecycle.ts, database schema: extensions/codex/src/commands.test.ts, migration/backfill/repair: extensions/codex/doctor-contract-api.test.ts, migration/backfill/repair: extensions/codex/doctor-contract-api.ts, and 10 more. Migration or upgrade compatibility proof is recorded; maintainers should verify it before merge.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

[P2] Maintainer should explicitly confirm the auto config/API and binding-sidecar upgrade semantics before merge.

Risk before merge

[P1] The PR adds a new value on an existing persisted Codex plugin policy key and bumps the app-server binding sidecar schema, so existing operators and upgrades depend on the maintainer accepting the compatibility contract.
[P1] The behavior controls approval semantics for write-capable native Codex plugin MCP tools; tests and live proof are strong, but the product/API decision should be explicit before merge.

Maintainer options:

Confirm the config and upgrade contract (recommended)
Maintainers can merge this after explicitly accepting auto as the permanent approval-routed value and carrying release/operator context for the legacy on-request repair path.
Pause for API redesign
If maintainers do not want a third value on codexPlugins.allow_destructive_actions, pause or close this branch and request a narrower design that keeps the public config shape unchanged.

Next step before merge

[P2] No mechanical repair is indicated; the next action is maintainer review of the config/API and upgrade semantics.

Security
Cleared: No concrete supply-chain or security-boundary regression was found; the security-sensitive approval path is explicit, fail-closed for unsupported schemas, and uses the existing plugin approval contract.

Review details

Best possible solution:

Land after maintainer explicitly accepts the auto config/API and upgrade behavior while preserving existing boolean semantics.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a feature PR, and current main lacks the approval-routed auto mode while the PR body supplies after-fix live proof.

Is this the best way to solve the issue?

Yes, pending maintainer confirmation: the implementation stays in the Codex plugin boundary and reuses the existing gateway plugin approval contract instead of adding a new core approval path.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 02acb0bd7455.

Label changes

Label justifications:

P2: This is a bounded Codex plugin feature with focused tests and live proof, but it is not an urgent production regression.
merge-risk: 🚨 compatibility: The PR changes persisted config and binding-sidecar semantics that existing Codex plugin setups may carry through upgrades.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body includes after-fix live output showing a Slack plugin approval for a Google Calendar write and the connector-created event after Allow Once; the later rename to auto is covered by focused tests.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes after-fix live output showing a Slack plugin approval for a Google Calendar write and the connector-created event after Allow Once; the later rename to auto is covered by focused tests.

Evidence reviewed

PR surface:

Source +329, Tests +631, Docs +4. Total +964 across 20 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	11	402	73	+329
Tests	8	634	3	+631
Docs	1	11	7	+4
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	20	1047	83	+964

What I checked:

Repository policy applied: Root and scoped policy were read fully; root AGENTS.md marks Codex contract inspection and config/default/migration changes as review-critical, while extensions/AGENTS.md keeps this work inside the plugin boundary. (AGENTS.md:9, 02acb0bd7455)
Live PR state: GitHub shows this PR open, mergeable, labeled maintainer, proof: sufficient, P2, and merge-risk: 🚨 compatibility; CI checks on head 0576424 were successful or skipped. (057642485191)
Current main lacks the requested mode: Current main keeps CodexPluginDestructivePolicy boolean-only and derives plugin behavior directly from allowDestructiveActions, so the PR is not already implemented on main. (extensions/codex/src/app-server/config.ts:70, 02acb0bd7455)
Current main auto-accepts safe plugin elicitations: Current main's plugin elicitation response only declines when allowDestructiveActions is false, otherwise it builds an accepted Codex response without routing through plugin approval UI. (extensions/codex/src/app-server/elicitation-bridge.ts:287, 02acb0bd7455)
Latest prerelease has boolean-only shipped behavior: The latest GitHub prerelease checked, v2026.6.8-beta.1 published 2026-06-14, still has boolean-only codexPlugins.allow_destructive_actions, so auto is not shipped in that release line. (extensions/codex/src/app-server/config.ts:70, 43d00c7724b5)
PR expands the config policy type: PR head changes CodexPluginDestructivePolicy to boolean | "auto", validates that literal in zod, and resolves auto to destructive access plus approval-routed mode while preserving boolean true/false semantics. (extensions/codex/src/app-server/config.ts:70, 057642485191)

Likely related people:

kevinslin: Prior merged history for the same Codex native plugin and elicitation paths includes enabling native plugin app support, connector approval matching, and computer-use elicitation bridging. (role: feature owner; confidence: high; commits: a1ac559ed7e6, d06e85b0aa09, 777a113973e9; files: extensions/codex/src/app-server/elicitation-bridge.ts, extensions/codex/src/app-server/plugin-thread-config.ts, extensions/codex/src/app-server/config.ts)
vincentkoc: Recent merged Codex app-server work touched approval, provider, and release-stabilization behavior near this surface. (role: recent area contributor; confidence: medium; commits: ac3cd1a0ca8c, b4cdd9211957, 8c802aa68351; files: extensions/codex/src/app-server/config.ts, extensions/codex/src/app-server/session-binding.ts, extensions/codex/src/app-server/elicitation-bridge.ts)
joshavant: Recent merged work on Codex session binding and context-engine compaction overlaps the binding sidecar compatibility surface changed by this PR. (role: adjacent session-state owner; confidence: medium; commits: a8d33f23a09d, 765477d77ae6, 80227005a016; files: extensions/codex/src/app-server/session-binding.ts)
steipete: Recent docs/config history for Codex plugin app configuration and large extension sources makes this person relevant for the public config/docs surface, though not the primary runtime owner. (role: recent docs/config contributor; confidence: medium; commits: d99268ae514a, 6868cde4d45f; files: docs/plugins/codex-native-plugins.md, extensions/codex/src/app-server/plugin-thread-config.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 853ce969bf

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

* feat(codex): add on-request plugin approvals * feat(codex): rename plugin approval policy to auto * fix(codex): update binding schema version callers

openclaw-barnacle Bot added docs Improvements or additions to documentation extensions: codex size: L maintainer Maintainer-authored PR labels Jun 13, 2026

chatgpt-codex-connector Bot reviewed Jun 13, 2026

View reviewed changes

Comment thread extensions/codex/src/app-server/elicitation-bridge.ts

kevinslin force-pushed the codex/codex-plugin-on-request-approvals branch from 853ce96 to 70ca0a2 Compare June 13, 2026 07:47

feat(codex): add on-request plugin approvals

25d9cb2

kevinslin force-pushed the codex/codex-plugin-on-request-approvals branch from 70ca0a2 to 25d9cb2 Compare June 13, 2026 07:50

feat(codex): rename plugin approval policy to auto

452862b

openclaw-barnacle Bot added size: XL and removed size: L labels Jun 15, 2026

kevinslin changed the title ~~feat(codex): add on-request plugin approvals~~ feat(codex): add auto plugin approvals Jun 15, 2026

fix(codex): update binding schema version callers

0576424

kevinslin merged commit e82d19f into main Jun 15, 2026
155 checks passed

kevinslin deleted the codex/codex-plugin-on-request-approvals branch June 15, 2026 01:00

github-actions Bot mentioned this pull request Jun 15, 2026

📡 Upstream Digest — 2026-06-15 02:54 UTC curtismercier/openclaw-mods#1081

Open

clawsweeper Bot mentioned this pull request Jun 15, 2026

[Regression] OpenClaw 2026.5.22: Codex app-server / plugin approval stalls cause interrupted turns and tool-execution timeouts in Nextcloud Talk agent sessions #86047

Closed

This was referenced Jun 19, 2026

doctor --fix migrates codex/gpt-5.5 to openai/gpt-5.5, then Codex app-server startup times out on 2026.6.1 #90881

Closed

Feature Request: Disable exec command credential masking / secret replacement #91138

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

feat(codex): add auto plugin approvals#92625

feat(codex): add auto plugin approvals#92625
kevinslin merged 3 commits into
mainfrom
codex/codex-plugin-on-request-approvals

kevinslin commented Jun 13, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jun 13, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

kevinslin commented Jun 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Linked context

Real behavior proof (required for external PRs)

Tests and validation

Risk checklist

Current review state

Uh oh!

clawsweeper Bot commented Jun 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

kevinslin commented Jun 13, 2026 •

edited

Loading

clawsweeper Bot commented Jun 13, 2026 •

edited

Loading