### Fixes

- Plugins/xAI: echo PKCE challenge fields during OAuth authorization-code token exchange for xAI token-endpoint compatibility. (#83499) Thanks @fuller-stack-dev.

- Codex app-server: hydrate current inbound image attachments before queued runs so Responses-backed agents receive Discord and other channel images as native vision input. Fixes #83466. Thanks @iannwu.

- Release stability: recover stale session diagnostics and Codex OAuth fallback state so stuck runs and reused refresh tokens clear without blocking follow-up work. (#83503) Thanks @100yenadmin.

- Codex app-server: preserve network access for sandboxed Codex code-mode turns when the OpenClaw sandbox allows outbound egress. Fixes #83347. Thanks @YusukeIt0.

import { describe, expect, it, vi } from "vitest";

import {

buildXaiOAuthAuthorizationCodeTokenBody,

buildXaiOAuthAuthorizeUrl,

fetchXaiOAuthDiscovery,

isTrustedXaiOAuthEndpoint,

expect(XAI_OAUTH_REDIRECT_URI).toContain(`:${XAI_OAUTH_CALLBACK_PORT}/`);

});

it("echoes PKCE challenge fields when exchanging authorization codes with xAI", () => {

expect(

buildXaiOAuthAuthorizationCodeTokenBody({

code: "AUTHCODE",

codeVerifier: "verifier-1",

codeChallenge: "challenge-1",

}),

).toEqual({

grant_type: "authorization_code",

code: "AUTHCODE",

redirect_uri: XAI_OAUTH_REDIRECT_URI,

client_id: XAI_OAUTH_CLIENT_ID,

code_verifier: "verifier-1",

code_challenge: "challenge-1",

code_challenge_method: "S256",

});

});

it("validates discovered endpoints before using them", async () => {

vi.stubEnv("OPENCLAW_VERSION", "2026.3.22");

const fetchImpl = vi.fn(async () =>

return url.toString();

}

export function buildXaiOAuthAuthorizationCodeTokenBody(params: {

code: string;

codeVerifier: string;

codeChallenge: string;

}): Record<string, string> {

return {

grant_type: "authorization_code",

code: params.code,

redirect_uri: XAI_OAUTH_REDIRECT_URI,

client_id: XAI_OAUTH_CLIENT_ID,

code_verifier: params.codeVerifier,

// xAI validates these PKCE fields again at token exchange for this client.

code_challenge: params.codeChallenge,

code_challenge_method: "S256",

};

}

function normalizeExpires(value: unknown, now: () => number): number | undefined {

const seconds =

typeof value === "number"

tokenEndpoint: discovery.tokenEndpoint,

context: "xAI OAuth token exchange",

requireRefreshToken: true,

body: {

grant_type: "authorization_code",

body: buildXaiOAuthAuthorizationCodeTokenBody({

code: callback.code,

redirect_uri: XAI_OAUTH_REDIRECT_URI,

client_id: XAI_OAUTH_CLIENT_ID,

code_verifier: pkce.verifier,

},

codeVerifier: pkce.verifier,

codeChallenge: pkce.challenge,

}),

});

const identity = resolveXaiOAuthIdentity(tokens);

progress.stop("xAI OAuth complete");