@okxweb3/a2a-node 0.2.2 → 0.2.3-beta-6f2a8ec2c7-260810184309

package/dist/index.js

@@ -3200,7 +3200,14 @@ function resolveCommandPath(command, env = process.env, platform = process.platf
 }
 function resolveCodexCommandPath(env = process.env, storedCommand, platform = process.platform, probe = probeCodexCommand) {
   if (platform !== "win32") {
-    return storedCommand && commandExists(storedCommand, env, platform) ? storedCommand : findExecutable("codex", env, platform);
+    if (storedCommand && commandExists(storedCommand, env, platform)) {
+      return storedCommand;
+    }
+    const onPath = findExecutable("codex", env, platform);
+    if (onPath) {
+      return onPath;
+    }
+    return collectCodexAppBundledCandidates(env, platform).find(isExecutable) ?? null;
   }
   for (const candidate of collectCodexCommandCandidates(env, storedCommand, platform)) {
     const result = probe(candidate, env, platform);
@@ -3225,6 +3232,9 @@ function collectCodexCommandCandidates(env = process.env, storedCommand, platfor
   }
   if (platform !== "win32") {
     add(findExecutable("codex", env, platform));
+    for (const candidate of collectCodexAppBundledCandidates(env, platform).filter(isExecutable)) {
+      add(candidate);
+    }
     return candidates;
   }
   for (const candidate of localAppDataCodexCandidates(env)) {
@@ -3246,6 +3256,87 @@ function collectCodexCommandCandidates(env = process.env, storedCommand, platfor
   }
   return candidates;
 }
+function collectCodexAppBundledCandidates(env = process.env, platform = process.platform) {
+  if (platform === "win32") {
+    return localAppDataCodexCandidates(env);
+  }
+  const roots = (env[CODEX_APP_DIRS_ENV] ?? "").split(import_node_path10.delimiter).filter(Boolean);
+  if (platform === "darwin") {
+    roots.push("/Applications", (0, import_node_path10.join)(env.HOME || (0, import_node_os5.homedir)(), "Applications"));
+  }
+  const candidates = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const root of roots) {
+    const candidate = (0, import_node_path10.join)(root, "Codex.app", "Contents", "Resources", "codex");
+    if (seen.has(candidate)) {
+      continue;
+    }
+    seen.add(candidate);
+    candidates.push(candidate);
+  }
+  return candidates;
+}
+function resolveCodexCommandCandidates(env = process.env, storedCommand, platform = process.platform) {
+  const candidates = [];
+  const seen = /* @__PURE__ */ new Set();
+  const add = (command, source) => {
+    if (!command || seen.has(command)) {
+      return;
+    }
+    seen.add(command);
+    candidates.push({ command, source });
+  };
+  add(env[CODEX_COMMAND_OVERRIDE_ENV], "explicit_override");
+  const appBundled = new Set(collectCodexAppBundledCandidates(env, platform));
+  for (const command of collectCodexCommandCandidates(env, storedCommand, platform)) {
+    if (storedCommand && command === storedCommand) {
+      add(command, "persisted");
+      continue;
+    }
+    add(command, appBundled.has(command) ? "app_bundled" : "path");
+  }
+  return candidates;
+}
+function resolveCodexCommandSource(env = process.env, storedCommand, platform = process.platform, probe = probeCodexCommand) {
+  const override = env[CODEX_COMMAND_OVERRIDE_ENV];
+  if (override) {
+    return commandExists(override, env, platform) ? { command: override, source: "explicit_override" } : null;
+  }
+  const resolved = resolveCodexCommandPath(env, storedCommand, platform, probe);
+  if (!resolved) {
+    return null;
+  }
+  return {
+    command: resolved,
+    source: classifyResolvedCodexCommand(resolved, storedCommand, env, platform)
+  };
+}
+function resolveAiProviderCommandWithSource(provider, env = process.env, storedCommand, platform = process.platform) {
+  const override = env[`OKX_A2A_AI_${provider.toUpperCase()}_COMMAND`];
+  if (override) {
+    return { command: override, source: "explicit_override" };
+  }
+  if (provider === "codex") {
+    const codex = resolveCodexCommandPath(env, storedCommand, platform);
+    if (codex) {
+      return { command: codex, source: classifyResolvedCodexCommand(codex, storedCommand, env, platform) };
+    }
+  }
+  if (storedCommand && commandExists(storedCommand, env, platform)) {
+    return { command: storedCommand, source: "persisted" };
+  }
+  const found = findExecutable(provider, env, platform);
+  return found ? { command: found, source: "path" } : { command: provider, source: null };
+}
+function classifyResolvedCodexCommand(resolved, storedCommand, env, platform) {
+  if (storedCommand && resolved === storedCommand) {
+    return "persisted";
+  }
+  if (collectCodexAppBundledCandidates(env, platform).includes(resolved)) {
+    return "app_bundled";
+  }
+  return "path";
+}
 function readAiProviderTimeoutMs(env = process.env) {
   const raw = env.OKX_A2A_AI_PROVIDER_TIMEOUT_MS ?? env.OKX_AGENT_TASK_AI_PROVIDER_TIMEOUT_MS;
   if (!raw) {
@@ -3417,7 +3508,7 @@ function isCodexCommand(command) {
 function isWindowsAppsPath(commandPath) {
   return /(?:^|[\\/])WindowsApps(?:[\\/]|$)/i.test(commandPath);
 }
-var import_node_fs7, import_node_os5, import_node_path10, DEFAULT_AI_PROVIDER_TIMEOUT_MS, CODEX_PROBE_TIMEOUT_MS;
+var import_node_fs7, import_node_os5, import_node_path10, DEFAULT_AI_PROVIDER_TIMEOUT_MS, CODEX_PROBE_TIMEOUT_MS, CODEX_APP_DIRS_ENV, CODEX_COMMAND_OVERRIDE_ENV;
 var init_ai_command = __esm({
   "src/ai-command.ts"() {
     "use strict";
@@ -3427,918 +3518,238 @@ var init_ai_command = __esm({
     init_win_spawn();
     DEFAULT_AI_PROVIDER_TIMEOUT_MS = null;
     CODEX_PROBE_TIMEOUT_MS = 1e4;
+    CODEX_APP_DIRS_ENV = "OKX_A2A_CODEX_APP_DIRS";
+    CODEX_COMMAND_OVERRIDE_ENV = "OKX_A2A_AI_CODEX_COMMAND";
   }
 });
 
-// src/ai-provider.ts
-function normalizeAiProvider(value) {
-  const normalized = value.trim().toLowerCase();
-  if (normalized === "codex") {
-    return "codex";
-  }
-  if (normalized === "claude" || normalized === "claude-code" || normalized === "claude_code") {
-    return "claude";
-  }
-  if (normalized === "hermes") {
-    return "hermes";
-  }
-  if (normalized === "openclaw") {
-    return "openclaw";
-  }
-  throw new Error(`Unsupported AI provider "${value}". Use one of: ${AI_PROVIDERS.join(", ")}.`);
-}
-function detectAiProviders(commandExists2 = commandExists, env = process.env) {
-  const codex = commandExists2(readProviderCommand("codex", env));
-  const claude = commandExists2(readProviderCommand("claude", env));
-  const hermes = commandExists2(readProviderCommand("hermes", env));
-  const openclaw = commandExists2(readProviderCommand("openclaw", env));
-  return {
-    codex,
-    claude,
-    hermes,
-    openclaw,
-    available: [
-      ...codex ? ["codex"] : [],
-      ...claude ? ["claude"] : [],
-      ...hermes ? ["hermes"] : [],
-      ...openclaw ? ["openclaw"] : []
-    ]
-  };
+// src/codex-readiness.ts
+function codexReadinessCacheKey(env = process.env, persistOverrideCommand = false) {
+  return `codex|${env[CODEX_COMMAND_OVERRIDE_ENV2] ?? ""}${persistOverrideCommand ? "|persist-override" : ""}`;
 }
-function detectCurrentAiProvider(env = process.env) {
-  const explicit = env.OKX_A2A_AI_PROVIDER ?? env.OKX_AGENT_TASK_AI_CLI;
-  if (explicit) {
-    return normalizeAiProvider(explicit);
-  }
-  const runtime = detectRuntime(env);
-  return runtime === "unknown" ? null : runtime;
-}
-function hasAiRuntimeMarker(env = process.env) {
-  return !!(detectGatewayInvocation(env) || env.CODEX_THREAD_ID || isTruthyRuntimeMarker(env.CODEX_SHELL) || env.CODEX_MANAGED_BY_NPM || isTruthyRuntimeMarker(env.CODEX_CI) || env.CLAUDE_SESSION_ID || isTruthyRuntimeMarker(env.CLAUDECODE) || env.CLAUDE_CODE_SESSION_ID || env.CLAUDE_PLUGIN_DATA || env.HERMES_SESSION_ID && !env.HERMES_DESKTOP_CWD || env.HERMES_SESSION_KEY || env.HERMES_FLOW_ID || env.OPENCLAW_SHELL || env.OPENCLAW_CLI);
-}
-function detectRuntime(env = process.env, options = {}) {
-  const gatewayInvocation = detectGatewayInvocation(env);
-  const strongMatches = [
-    ...gatewayInvocation ? [gatewayInvocation] : [],
-    ...env.CODEX_THREAD_ID || isTruthyRuntimeMarker(env.CODEX_SHELL) || env.CODEX_MANAGED_BY_NPM || isTruthyRuntimeMarker(env.CODEX_CI) ? ["codex"] : [],
-    ...env.CLAUDE_SESSION_ID || isTruthyRuntimeMarker(env.CLAUDECODE) || env.CLAUDE_CODE_SESSION_ID || env.CLAUDE_PLUGIN_DATA ? ["claude"] : [],
-    ...env.HERMES_SESSION_ID && !env.HERMES_DESKTOP_CWD || env.HERMES_SESSION_KEY || env.HERMES_FLOW_ID ? ["hermes"] : [],
-    ...env.OPENCLAW_SHELL || env.OPENCLAW_CLI ? ["openclaw"] : [],
-    ...hasOpenClawParentProcess(options.parentPid ?? process.ppid, options.readParentProcessCommand ?? readParentProcessCommand) ? ["openclaw"] : []
-  ];
-  const uniqueMatches = [...new Set(strongMatches)];
-  if (uniqueMatches.length === 1) {
-    return uniqueMatches[0];
+function buildCodexRecoveryGuidance(state, commandSource = null) {
+  if (state === "not_authenticated" && commandSource === "app_bundled") {
+    return { recoveryAction: "run_login", recoveryGuidance: CODEX_APP_BUNDLED_LOGIN_GUIDANCE };
   }
-  return "unknown";
+  return { ...CODEX_RECOVERY_BY_STATE[state] };
 }
-function detectGatewayInvocation(env = process.env) {
-  const context = (env.OKX_A2A_RUNTIME_CONTEXT ?? "").trim().toLowerCase();
-  if (context === "openclaw-gateway" || context === "gateway:openclaw") {
-    return "openclaw";
-  }
-  if (context === "hermes-gateway" || context === "gateway:hermes") {
-    return "hermes";
-  }
-  if (isTruthyRuntimeMarker(env._HERMES_GATEWAY)) {
-    return "hermes";
-  }
-  if ((env.OPENCLAW_SERVICE_KIND ?? "").trim().toLowerCase() === "gateway") {
-    return "openclaw";
-  }
-  if (!isTruthyRuntimeMarker(env.OKX_A2A_IN_GATEWAY)) {
-    return null;
-  }
-  const provider = env.OKX_A2A_GATEWAY_PROVIDER;
-  if (!provider) {
-    return null;
-  }
-  try {
-    const normalized = normalizeAiProvider(provider);
-    return normalized === "openclaw" || normalized === "hermes" ? normalized : null;
-  } catch {
-    return null;
-  }
+function codexCommandResolvesWithoutOverride(env, storedCommand, platform) {
+  const envWithoutOverride = { ...env };
+  delete envWithoutOverride[CODEX_COMMAND_OVERRIDE_ENV2];
+  return resolveCodexCommandSource(envWithoutOverride, storedCommand, platform) !== null;
 }
-function switchProvider(options) {
-  const runtime = detectRuntime(options.env ?? process.env, {
-    parentPid: options.parentPid,
-    readParentProcessCommand: options.readParentProcessCommand
-  });
-  if (runtime === "unknown") {
-    const stored = options.store.getDefaultAiProvider();
-    if (stored) {
-      return {
-        ok: true,
-        runtime: "unknown",
-        provider: stored,
-        previousProvider: stored,
-        changed: false,
-        action: "kept_existing",
-        userMessage: `No AI runtime detected for the current environment; keeping the existing default provider (${formatAiProviderDisplayName(stored)}).`
-      };
-    }
-    return {
-      ok: false,
-      runtime: "unknown",
-      reason: "unknown_runtime",
-      state: "blocked",
-      message: "Could not determine the current AI provider.",
-      userMessage: "Could not detect the current AI runtime and no default AI provider is configured. Run this from your AI environment (OpenClaw / Codex / Claude / Hermes), or set a provider manually: `okx-a2a ai-provider set --provider <codex|claude|hermes|openclaw>`."
+function probeCodexAuthStatus(command, env, platform, timeoutMs) {
+  return new Promise((resolvePromise) => {
+    let settled = false;
+    const settle = (result) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      resolvePromise(result);
     };
-  }
-  const previousProvider = options.store.getDefaultAiProvider();
-  const changed = previousProvider !== runtime;
-  options.store.setDefaultAiProvider(runtime);
-  return {
-    ok: true,
-    runtime,
-    provider: runtime,
-    previousProvider,
-    changed,
-    action: "switched",
-    userMessage: changed ? `Switched to ${formatAiProviderDisplayName(runtime)}\uFF5CNew tasks will be handled here; unfinished tasks should be continued in their original session` : ""
-  };
+    let child;
+    try {
+      child = spawnCompat(command, ["login", "status"], {
+        env,
+        stdio: ["ignore", "pipe", "pipe"],
+        windowsHide: true
+      });
+    } catch (error) {
+      settle({ ok: false, state: spawnErrorReadinessState(error) });
+      return;
+    }
+    child.stdout?.resume();
+    child.stderr?.resume();
+    const timer = setTimeout(() => {
+      killProcessTree(child, "SIGTERM", platform);
+      setTimeout(() => {
+        if (!child.killed || child.exitCode === null) {
+          killProcessTree(child, "SIGKILL", platform);
+        }
+      }, CODEX_PROBE_KILL_GRACE_MS).unref();
+      settle({ ok: false, state: "probe_timeout" });
+    }, timeoutMs);
+    timer.unref();
+    child.once("error", (error) => {
+      clearTimeout(timer);
+      settle({ ok: false, state: spawnErrorReadinessState(error) });
+    });
+    child.once("close", (code) => {
+      clearTimeout(timer);
+      settle(code === 0 ? { ok: true } : { ok: false, state: "not_authenticated" });
+    });
+  });
 }
-function formatAiProviderDisplayName(provider) {
-  if (provider === "openclaw") {
-    return "OpenClaw";
-  }
-  return `${provider.charAt(0).toUpperCase()}${provider.slice(1)}`;
+function readCachedCodexReadiness(options = {}) {
+  const env = options.env ?? process.env;
+  const nowMs = options.nowMs ?? Date.now;
+  const cached = readCacheEntry(options.cacheKey ?? codexReadinessCacheKey(env), nowMs());
+  return cached ? { ...cached, fromCache: true } : null;
 }
-function isTruthyRuntimeMarker(value) {
-  return value === "1" || value === "true" || value === "yes";
+function clearCodexReadinessCache() {
+  readinessCache.clear();
+  inFlightReadiness.clear();
 }
-function hasOpenClawParentProcess(parentPid, readParentProcessCommand2) {
-  let pid = parentPid;
-  for (let i = 0; i < 8; i++) {
-    if (!pid || pid <= 1) {
-      return false;
-    }
-    const processInfo = readParentProcessCommand2(pid);
-    if (!processInfo) {
-      return false;
+function checkCodexReadiness(options = {}) {
+  const env = options.env ?? process.env;
+  const nowMs = options.nowMs ?? Date.now;
+  const cacheKey2 = options.cacheKey ?? codexReadinessCacheKey(env, options.persistOverrideCommand === true);
+  if (!options.forceRefresh) {
+    const cached = readCacheEntry(cacheKey2, nowMs());
+    if (cached) {
+      return Promise.resolve({ ...cached, fromCache: true });
+    }
+    const inFlight = inFlightReadiness.get(cacheKey2);
+    if (inFlight) {
+      return inFlight;
     }
-    if (/openclaw/i.test(processInfo.command)) {
-      return true;
+  }
+  const pending = resolveCodexReadiness(options, env, cacheKey2, nowMs).finally(() => {
+    if (inFlightReadiness.get(cacheKey2) === pending) {
+      inFlightReadiness.delete(cacheKey2);
     }
-    if (!processInfo.parentPid || processInfo.parentPid === pid) {
-      return false;
+  });
+  inFlightReadiness.set(cacheKey2, pending);
+  return pending;
+}
+async function resolveCodexReadiness(options, env, cacheKey2, nowMs) {
+  try {
+    const platform = options.platform ?? process.platform;
+    const store = options.store ?? null;
+    const probeAuth = options.probeAuth ?? probeCodexAuthStatus;
+    const storedCommand = store ? store.getAiProviderCommand("codex") : null;
+    const candidate = resolveCodexCommandSource(env, storedCommand, platform);
+    if (!candidate) {
+      return storeCacheEntry(cacheKey2, nowMs, buildCodexReadinessResult("not_installed", null, null, false));
+    }
+    const probe = await probeAuth(candidate.command, env, platform, CODEX_AUTH_PROBE_TIMEOUT_MS);
+    if (!probe.ok) {
+      return storeCacheEntry(
+        cacheKey2,
+        nowMs,
+        buildCodexReadinessResult(probe.state, candidate.command, candidate.source, false)
+      );
     }
-    pid = processInfo.parentPid;
+    const commandPersisted = persistReadyCodexCommand(
+      candidate,
+      store,
+      options.persist,
+      options.persistOverrideCommand === true
+    );
+    return storeCacheEntry(
+      cacheKey2,
+      nowMs,
+      buildCodexReadinessResult("ready", candidate.command, candidate.source, commandPersisted)
+    );
+  } catch {
+    return storeCacheEntry(cacheKey2, nowMs, buildCodexReadinessResult("probe_failed", null, null, false));
   }
-  return false;
-}
-function readParentProcessCommand(pid) {
-  return readParentProcessCommandForPlatform(pid, process.platform);
 }
-function readParentProcessCommandForPlatform(pid, platform) {
-  if (platform === "win32") {
-    return readWindowsParentProcessCommand(pid);
+function persistReadyCodexCommand(candidate, store, persist, persistOverrideCommand) {
+  if (persist === false || !store) {
+    return false;
   }
-  const commandResult = (0, import_node_child_process5.spawnSync)("ps", ["-p", String(pid), "-o", "comm="], {
-    encoding: "utf8",
-    stdio: ["ignore", "pipe", "ignore"]
-  });
-  const parentResult = (0, import_node_child_process5.spawnSync)("ps", ["-p", String(pid), "-o", "ppid="], {
-    encoding: "utf8",
-    stdio: ["ignore", "pipe", "ignore"]
-  });
-  const command = typeof commandResult.stdout === "string" ? commandResult.stdout.trim() : "";
-  const parentPidRaw = typeof parentResult.stdout === "string" ? parentResult.stdout.trim() : "";
-  const parentPid = Number(parentPidRaw);
-  if (commandResult.status !== 0 || parentResult.status !== 0 || !command || !Number.isFinite(parentPid)) {
-    return null;
+  if (candidate.source === "explicit_override" && !persistOverrideCommand) {
+    return false;
   }
-  return { command, parentPid };
-}
-function buildWindowsParentProcessProbe(pid) {
-  if (!Number.isInteger(pid)) {
-    return null;
+  try {
+    store.setAiProviderCommand("codex", candidate.command);
+    return true;
+  } catch {
+    return false;
   }
+}
+function buildCodexReadinessResult(state, command, commandSource, commandPersisted) {
+  const { recoveryAction, recoveryGuidance } = buildCodexRecoveryGuidance(state, commandSource);
+  const ready = state === "ready";
   return {
-    command: "powershell.exe",
-    args: [
-      "-NoProfile",
-      "-NonInteractive",
-      "-Command",
-      `Get-CimInstance Win32_Process -Filter "ProcessId=${pid}" | Select-Object Name,ParentProcessId | ConvertTo-Json -Compress`
-    ]
+    provider: "codex",
+    ready,
+    state,
+    authenticated: ready,
+    command,
+    commandSource,
+    commandPersisted,
+    recoveryAction,
+    recoveryGuidance,
+    fromCache: false
   };
 }
-function parseWindowsParentProcessJson(stdout) {
-  const trimmed = stdout.trim();
-  if (!trimmed) {
-    return null;
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(trimmed);
-  } catch {
-    return null;
-  }
-  const record = Array.isArray(parsed) ? parsed[0] : parsed;
-  if (!record || typeof record !== "object") {
+function readCacheEntry(cacheKey2, atMs) {
+  const entry = readinessCache.get(cacheKey2);
+  if (!entry) {
     return null;
   }
-  const name = record.Name;
-  if (typeof name !== "string" || name.trim() === "") {
+  if (atMs >= entry.expiresAtMs) {
+    readinessCache.delete(cacheKey2);
     return null;
   }
-  const rawParentPid = Number(record.ParentProcessId);
-  const parentPid = Number.isInteger(rawParentPid) && rawParentPid > 0 ? rawParentPid : null;
-  return { command: name.trim(), parentPid };
+  return entry.result;
 }
-function readWindowsParentProcessCommand(pid) {
-  const probe = buildWindowsParentProcessProbe(pid);
-  if (!probe) {
-    logWinCompat(`${WIN_COMPAT_LOG_PREFIX} parent-process probe rejected non-integer pid=${String(pid)}`);
-    return null;
-  }
-  const result = (0, import_node_child_process5.spawnSync)(probe.command, probe.args, {
-    encoding: "utf8",
-    stdio: ["ignore", "pipe", "ignore"],
-    timeout: 5e3,
-    windowsHide: true
-  });
-  if (result.error) {
-    const spawnError = result.error;
-    logWinCompat(
-      `${WIN_COMPAT_LOG_PREFIX} parent-process probe failed pid=${pid} command=${probe.command} errorCode=${spawnError.code ?? "unknown"} error=${spawnError.message}`
-    );
-    return null;
-  }
-  if (result.status !== 0) {
-    logWinCompat(
-      `${WIN_COMPAT_LOG_PREFIX} parent-process probe exited pid=${pid} command=${probe.command} status=${String(result.status)} signal=${String(result.signal)}`
-    );
-    return null;
-  }
-  const stdout = typeof result.stdout === "string" ? result.stdout : "";
-  const parsed = parseWindowsParentProcessJson(stdout);
-  if (!parsed) {
-    logWinCompat(
-      `${WIN_COMPAT_LOG_PREFIX} parent-process probe unparsable output pid=${pid} stdout=${JSON.stringify(stdout.slice(0, 200))}`
-    );
-    return null;
-  }
-  if (process.env.OKX_A2A_WIN_COMPAT_VERBOSE === "1") {
-    logWinCompat(
-      `${WIN_COMPAT_LOG_PREFIX} parent-process probe pid=${pid} -> command=${parsed.command} parentPid=${parsed.parentPid ?? "null"}`
-    );
-  }
-  return parsed;
+function storeCacheEntry(cacheKey2, nowMs, result) {
+  readinessCache.set(cacheKey2, { result, expiresAtMs: nowMs() + CODEX_READINESS_CACHE_TTL_MS });
+  return result;
 }
-async function ensureDefaultAiProvider(options) {
-  const env = options.env ?? process.env;
-  const commandExists2 = options.commandExists ?? commandExists;
-  const detection = withStoredCodexAvailability(
-    detectAiProviders(commandExists2, env),
-    options.store,
-    commandExists2
-  );
-  if (options.requestedProvider) {
-    const provider = normalizeAiProvider(options.requestedProvider);
-    if (!options.allowUnavailableProvider) {
-      assertInstalled(provider, detection);
-    }
-    options.store.setDefaultAiProvider(provider);
-    return {
-      provider,
-      source: "requested",
-      message: isInstalled(provider, detection) ? `default AI provider set to ${provider}` : `default AI provider set to ${provider}; availability was not verified on PATH`
-    };
-  }
-  if (options.forcePrompt) {
-    const provider = await promptForAiProvider({
-      detection,
-      stdin: options.stdin,
-      stdout: options.stdout,
-      currentProvider: options.store.getDefaultAiProvider()
-    });
-    options.store.setDefaultAiProvider(provider);
-    return {
-      provider,
-      source: "detected",
-      message: `default AI provider set to ${provider}`
+function spawnErrorReadinessState(error) {
+  const code = error?.code;
+  return code === "ENOENT" ? "not_installed" : "probe_failed";
+}
+var CODEX_AUTH_PROBE_TIMEOUT_MS, CODEX_READINESS_CACHE_TTL_MS, CODEX_PROBE_KILL_GRACE_MS, CODEX_COMMAND_OVERRIDE_ENV2, CODEX_RECOVERY_BY_STATE, readinessCache, inFlightReadiness, CODEX_APP_BUNDLED_LOGIN_GUIDANCE;
+var init_codex_readiness = __esm({
+  "src/codex-readiness.ts"() {
+    "use strict";
+    init_ai_command();
+    init_win_spawn();
+    CODEX_AUTH_PROBE_TIMEOUT_MS = 1e4;
+    CODEX_READINESS_CACHE_TTL_MS = 6e4;
+    CODEX_PROBE_KILL_GRACE_MS = 5e3;
+    CODEX_COMMAND_OVERRIDE_ENV2 = "OKX_A2A_AI_CODEX_COMMAND";
+    CODEX_RECOVERY_BY_STATE = {
+      ready: { recoveryAction: "none", recoveryGuidance: "" },
+      not_installed: {
+        recoveryAction: "install_cli",
+        recoveryGuidance: "Codex was not found. Install the Codex CLI or the Codex desktop app, then run `okx-a2a setup`."
+      },
+      not_authenticated: {
+        recoveryAction: "run_login",
+        recoveryGuidance: "Codex is installed but not logged in. Run `codex login`, then retry."
+      },
+      probe_timeout: {
+        recoveryAction: "run_setup",
+        recoveryGuidance: `Codex did not report its login status within ${CODEX_AUTH_PROBE_TIMEOUT_MS}ms. Run \`okx-a2a setup\` to re-verify the Codex CLI.`
+      },
+      probe_failed: {
+        recoveryAction: "run_setup",
+        recoveryGuidance: "Codex readiness could not be verified. Run `okx-a2a setup` to re-verify the Codex CLI."
+      }
     };
+    readinessCache = /* @__PURE__ */ new Map();
+    inFlightReadiness = /* @__PURE__ */ new Map();
+    CODEX_APP_BUNDLED_LOGIN_GUIDANCE = "Codex was found in the Codex app bundle but is not logged in. Sign in from the Codex app, or run `okx-a2a setup --json` to re-verify Codex. `codex login` will not work: the bundled executable is not on PATH.";
   }
-  if (env.OKX_AGENT_TASK_AI_CLI) {
-    const provider = normalizeAiProvider(env.OKX_AGENT_TASK_AI_CLI);
-    if (!options.allowUnavailableProvider) {
-      assertInstalled(provider, detection);
+});
+
+// ../../node_modules/@sentry/utils/cjs/is.js
+var require_is = __commonJS({
+  "../../node_modules/@sentry/utils/cjs/is.js"(exports2) {
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    var objectToString = Object.prototype.toString;
+    function isError(wat) {
+      switch (objectToString.call(wat)) {
+        case "[object Error]":
+        case "[object Exception]":
+        case "[object DOMException]":
+          return true;
+        default:
+          return isInstanceOf(wat, Error);
+      }
     }
-    options.store.setDefaultAiProvider(provider);
-    return {
-      provider,
-      source: "env",
-      message: isInstalled(provider, detection) ? `default AI provider set to ${provider} from OKX_AGENT_TASK_AI_CLI` : `default AI provider set to ${provider} from OKX_AGENT_TASK_AI_CLI; availability was not verified on PATH`
-    };
-  }
-  if (env.OKX_A2A_AI_PROVIDER) {
-    const provider = normalizeAiProvider(env.OKX_A2A_AI_PROVIDER);
-    if (!options.allowUnavailableProvider) {
-      assertInstalled(provider, detection);
+    function isBuiltin(wat, className) {
+      return objectToString.call(wat) === `[object ${className}]`;
     }
-    return {
-      provider,
-      source: "env",
-      message: isInstalled(provider, detection) ? `AI provider resolved from OKX_A2A_AI_PROVIDER: ${provider}` : `AI provider resolved from OKX_A2A_AI_PROVIDER: ${provider}; availability was not verified on PATH`
-    };
-  }
-  const stored = options.store.getDefaultAiProvider();
-  if (stored && (options.allowUnavailableProvider || isInstalled(stored, detection))) {
-    return {
-      provider: stored,
-      source: "stored",
-      message: isInstalled(stored, detection) ? `default AI provider is ${stored}` : `default AI provider is ${stored}; availability was not verified on PATH`
-    };
-  }
-  if (stored) {
-    options.stderr?.write(
-      `[okx-agent-task] stored AI provider "${stored}" is not installed or not on PATH; selecting again.
-`
-    );
-  }
-  if (options.promptIfMissing) {
-    const provider = await promptForAiProvider({
-      detection,
-      stdin: options.stdin,
-      stdout: options.stdout,
-      currentProvider: stored ?? null
-    });
-    options.store.setDefaultAiProvider(provider);
-    return {
-      provider,
-      source: "detected",
-      message: `default AI provider set to ${provider}`
-    };
-  }
-  const current = detectCurrentAiProvider(env);
-  if (current && (options.allowUnavailableProvider || isInstalled(current, detection))) {
-    return {
-      provider: current,
-      source: "env",
-      message: isInstalled(current, detection) ? `AI provider resolved from current environment: ${current}` : `AI provider resolved from current environment: ${current}; availability was not verified on PATH`
-    };
-  }
-  if (detection.available.length === 0) {
-    throw new Error(
-      `No supported AI CLI found. Install one of: ${AI_PROVIDERS.join(", ")}.`
-    );
-  }
-  if (detection.available.length === 1) {
-    const provider = detection.available[0];
-    options.store.setDefaultAiProvider(provider);
-    return {
-      provider,
-      source: "detected",
-      message: `detected only ${provider}; default AI provider set to ${provider}`
-    };
-  }
-  throw new Error(
-    `Multiple AI CLIs are installed (${detection.available.join(", ")}) but no current AI environment was detected. Start the daemon from an AI session, pass --ai-provider <provider>, or set OKX_A2A_AI_PROVIDER.`
-  );
-}
-function resolveConfiguredAiProvider(options) {
-  const env = options.env ?? process.env;
-  const explicit = env.OKX_AGENT_TASK_AI_CLI ?? env.OKX_A2A_AI_PROVIDER;
-  if (explicit) {
-    return normalizeAiProvider(explicit);
-  }
-  return options.store.getDefaultAiProvider();
-}
-function resolveConfiguredAiProviderForJob(options) {
-  const jobId = normalizeOptionalJobId2(options.jobId);
-  if (jobId) {
-    const binding = options.store.getJobProviderBinding(jobId);
-    if (binding) {
-      bindHermesJobRouteFromEnvIfAvailable(options.store, {
-        jobId,
-        provider: binding.provider,
-        env: options.env
-      });
-      return binding.provider;
-    }
-  }
-  const provider = resolveConfiguredAiProvider({
-    store: options.store,
-    env: options.env
-  });
-  if (jobId && provider) {
-    return bindJobProviderWithRouteIfAvailable(options.store, {
-      jobId,
-      provider,
-      env: options.env
-    }).binding.provider;
-  }
-  return provider;
-}
-function bindJobProviderToCurrentDefaultIfMissing(options) {
-  const store = options.store ?? null;
-  const jobId = normalizeOptionalJobId2(options.jobId);
-  if (!store || !jobId) {
-    return null;
-  }
-  const existing = store.getJobProviderBinding(jobId);
-  if (existing) {
-    bindHermesJobRouteFromEnvIfAvailable(store, {
-      jobId,
-      provider: existing.provider,
-      env: options.env
-    });
-    return {
-      provider: existing.provider,
-      created: false
-    };
-  }
-  const provider = store.getDefaultAiProvider();
-  if (!provider) {
-    return null;
-  }
-  const result = bindJobProviderWithRouteIfAvailable(store, {
-    jobId,
-    provider,
-    env: options.env
-  });
-  return {
-    provider: result.binding.provider,
-    created: result.created
-  };
-}
-function bindJobProviderToCurrentRuntimeIfMissing(options) {
-  const store = options.store ?? null;
-  const jobId = normalizeOptionalJobId2(options.jobId);
-  if (!store || !jobId) {
-    return {
-      ok: false,
-      jobId: jobId ?? "",
-      provider: null,
-      currentProvider: null,
-      created: false,
-      binding: null,
-      reason: "missing_job_id"
-    };
-  }
-  const existing = store.getJobProviderBinding(jobId);
-  if (existing) {
-    const binding = bindHermesJobRouteFromEnvIfAvailable(store, {
-      jobId,
-      provider: existing.provider,
-      env: options.env
-    }) ?? existing;
-    return {
-      ok: true,
-      jobId,
-      provider: binding.provider,
-      currentProvider: null,
-      created: false,
-      binding,
-      reason: "already_bound"
-    };
-  }
-  const switched = switchProvider({ store, env: options.env ?? process.env });
-  if (!switched.ok || !switched.provider) {
-    return {
-      ok: false,
-      jobId,
-      provider: null,
-      currentProvider: null,
-      created: false,
-      binding: null,
-      reason: "unknown_runtime"
-    };
-  }
-  const currentProvider = switched.provider;
-  const result = bindJobProviderWithRouteIfAvailable(store, {
-    jobId,
-    provider: currentProvider,
-    env: options.env
-  });
-  return {
-    ok: true,
-    jobId,
-    provider: result.binding.provider,
-    currentProvider,
-    created: result.created,
-    binding: result.binding,
-    reason: result.created ? "created" : "already_bound"
-  };
-}
-function resolveAiProviderForDispatch(options) {
-  const env = options.env ?? process.env;
-  const commandExists2 = options.commandExists ?? commandExists;
-  const detection = withStoredCodexAvailability(
-    detectAiProviders(commandExists2, env),
-    options.store,
-    commandExists2
-  );
-  const jobId = normalizeOptionalJobId2(options.jobId);
-  if (jobId) {
-    const binding = options.store.getJobProviderBinding(jobId);
-    if (binding) {
-      assertInstalled(binding.provider, detection);
-      return binding.provider;
-    }
-  }
-  if (env.OKX_AGENT_TASK_AI_CLI) {
-    const provider = normalizeAiProvider(env.OKX_AGENT_TASK_AI_CLI);
-    assertInstalled(provider, detection);
-    return bindDispatchProviderIfNeeded(options.store, jobId, env, provider);
-  }
-  if (env.OKX_A2A_AI_PROVIDER) {
-    const provider = normalizeAiProvider(env.OKX_A2A_AI_PROVIDER);
-    assertInstalled(provider, detection);
-    return bindDispatchProviderIfNeeded(options.store, jobId, env, provider);
-  }
-  if (jobId) {
-    const stored2 = options.store.getDefaultAiProvider();
-    if (stored2) {
-      assertInstalled(stored2, detection);
-      return bindDispatchProviderIfNeeded(options.store, jobId, env, stored2);
-    }
-  }
-  const current = detectCurrentAiProvider(env);
-  if (current && isInstalled(current, detection)) {
-    return bindDispatchProviderIfNeeded(options.store, jobId, env, current);
-  }
-  if (options.sessionKey) {
-    const existing = options.store.listAiSessions(options.sessionKey).map((session) => session.provider).filter((provider) => isInstalled(provider, detection));
-    const unique = [...new Set(existing)];
-    if (unique.length === 1) {
-      return bindDispatchProviderIfNeeded(options.store, jobId, env, unique[0]);
-    }
-  }
-  const stored = options.store.getDefaultAiProvider();
-  if (stored) {
-    assertInstalled(stored, detection);
-    return bindDispatchProviderIfNeeded(options.store, jobId, env, stored);
-  }
-  if (detection.available.length === 1) {
-    return bindDispatchProviderIfNeeded(options.store, jobId, env, detection.available[0]);
-  }
-  if (detection.available.length > 1) {
-    throw new Error(
-      `Multiple AI CLIs are installed (${detection.available.join(", ")}) but no current AI environment was detected. Set OKX_A2A_AI_PROVIDER or pass --provider/--ai-provider for this run.`
-    );
-  }
-  throw new Error(`No supported AI CLI found. Install one of: ${AI_PROVIDERS.join(", ")}.`);
-}
-function bindDispatchProviderIfNeeded(store, jobId, env, provider) {
-  if (!jobId) {
-    return provider;
-  }
-  return bindJobProviderWithRouteIfAvailable(store, { jobId, provider, env }).binding.provider;
-}
-function withStoredCodexAvailability(detection, store, commandExists2) {
-  if (detection.codex) {
-    return detection;
-  }
-  const command = store.getAiProviderCommand("codex");
-  if (!command || !commandExists2(command)) {
-    return detection;
-  }
-  return {
-    ...detection,
-    codex: true,
-    available: detection.available.includes("codex") ? detection.available : ["codex", ...detection.available]
-  };
-}
-function bindJobProviderWithRouteIfAvailable(store, input) {
-  const result = store.bindJobProviderIfMissing({
-    jobId: input.jobId,
-    provider: input.provider
-  });
-  const routed = bindHermesJobRouteFromEnvIfAvailable(store, {
-    jobId: input.jobId,
-    provider: result.binding.provider,
-    env: input.env
-  });
-  return routed ? { ...result, binding: routed } : result;
-}
-function bindHermesJobRouteFromEnvIfAvailable(store, input) {
-  if (input.provider !== "hermes" || typeof store.upsertJobGatewayRoute !== "function") {
-    return null;
-  }
-  const route = currentHermesGatewayRouteFromEnv(input.env ?? process.env);
-  if (!route) {
-    return null;
-  }
-  return store.upsertJobGatewayRoute({
-    jobId: input.jobId,
-    provider: "hermes",
-    route
-  });
-}
-function currentHermesGatewayRouteFromEnv(env) {
-  const platform = normalizeOptionalText(env.OKX_A2A_CURRENT_GATEWAY_PLATFORM);
-  const chatId = normalizeOptionalText(env.OKX_A2A_CURRENT_GATEWAY_CHAT_ID);
-  const envGatewaySessionKey = normalizeOptionalText(env.OKX_A2A_CURRENT_GATEWAY_SESSION_KEY);
-  const parsedGatewaySession = parseHermesGatewaySessionKey(envGatewaySessionKey);
-  if (platform && chatId) {
-    const threadId = normalizeOptionalText(env.OKX_A2A_CURRENT_GATEWAY_THREAD_ID) ?? matchingParsedThreadId(parsedGatewaySession, { platform, chatId });
-    return buildHermesGatewayRoute({
-      platform,
-      chatId,
-      threadId,
-      sessionKey: envGatewaySessionKey
-    });
-  }
-  const sessionRoute = routeFromHermesSessionKey(env.HERMES_SESSION_KEY);
-  return sessionRoute ? buildHermesGatewayRoute(sessionRoute) : null;
-}
-function buildHermesGatewayRoute(input) {
-  const threadId = normalizeOptionalText(input.threadId) ?? "";
-  const sessionKey = normalizeOptionalText(input.sessionKey) ?? (threadId ? hermesThreadSessionKey(input.platform, input.chatId, threadId) : `agent:main:${input.platform}:dm:${encodeURIComponent(input.chatId)}`);
-  return {
-    platform: input.platform,
-    chatId: input.chatId,
-    chatName: "",
-    chatType: threadId ? "thread" : "dm",
-    threadId,
-    userId: "",
-    userName: "",
-    sessionKey,
-    gatewaySessionKey: sessionKey
-  };
-}
-function hermesThreadSessionKey(platform, chatId, threadId) {
-  const encodedChatId = encodeURIComponent(chatId);
-  const encodedThreadId = encodeURIComponent(threadId);
-  return platform === "telegram" ? `agent:main:${platform}:dm:${encodedChatId}:${encodedThreadId}` : `agent:main:${platform}:thread:${encodedChatId}:${encodedThreadId}`;
-}
-function routeFromHermesSessionKey(value) {
-  const sessionKey = normalizeOptionalText(value);
-  if (!sessionKey) {
-    return null;
-  }
-  const parsed = parseHermesGatewaySessionKey(sessionKey);
-  return parsed ? { ...parsed, sessionKey } : null;
-}
-function parseHermesGatewaySessionKey(sessionKey) {
-  const normalized = normalizeOptionalText(sessionKey);
-  if (!normalized) {
-    return null;
-  }
-  const parts = normalized.startsWith("agent:") ? normalized.split(":").slice(2) : normalized.split(":");
-  if (parts.length < 3) {
-    return null;
-  }
-  const [platform, scope, ...rest] = parts;
-  if (!platform || platform === "okx-a2a" || platform === "backup" || platform === "job") {
-    return null;
-  }
-  if (scope === "dm" && rest[0]) {
-    return {
-      platform,
-      chatId: safeDecodeURIComponent2(rest[0]),
-      ...platform === "telegram" && rest[1] ? { threadId: safeDecodeURIComponent2(rest.slice(1).join(":")) } : {}
-    };
-  }
-  if (scope === "thread" && rest[0] && rest[1]) {
-    return {
-      platform,
-      chatId: safeDecodeURIComponent2(rest[0]),
-      threadId: safeDecodeURIComponent2(rest.slice(1).join(":"))
-    };
-  }
-  return null;
-}
-function matchingParsedThreadId(parsed, expected) {
-  if (!parsed?.threadId) {
-    return null;
-  }
-  return parsed.platform === expected.platform && parsed.chatId === expected.chatId ? parsed.threadId : null;
-}
-function safeDecodeURIComponent2(value) {
-  try {
-    return decodeURIComponent(value);
-  } catch {
-    return value;
-  }
-}
-function normalizeOptionalJobId2(value) {
-  const normalized = value?.trim();
-  return normalized ? normalized : null;
-}
-function normalizeOptionalText(value) {
-  const normalized = value?.trim();
-  return normalized ? normalized : null;
-}
-function isInstalled(provider, detection) {
-  return detection.available.includes(provider);
-}
-function assertInstalled(provider, detection) {
-  if (!isInstalled(provider, detection)) {
-    throw new Error(`AI provider "${provider}" is not installed or not on PATH.`);
-  }
-}
-function readProviderCommand(provider, env) {
-  return env[`OKX_A2A_AI_${provider.toUpperCase()}_COMMAND`] ?? provider;
-}
-async function promptForAiProvider(options) {
-  const stdin = options.stdin ?? process.stdin;
-  const stdout = options.stdout ?? process.stdout;
-  if (!stdin.isTTY || !stdout.isTTY) {
-    throw new Error(
-      `No AI provider is configured. Run \`okx-a2a daemon start --ai-provider <${AI_PROVIDERS.join("|")}>\` or set OKX_A2A_AI_PROVIDER.`
-    );
-  }
-  stdout.write("AI provider is required before starting okx-a2a.\n");
-  stdout.write("Tip: if the selected AI provider is unavailable, task processing cannot proceed.\n\n");
-  if (options.currentProvider) {
-    stdout.write(`Current AI provider: ${options.currentProvider}
-
-`);
-  }
-  if (options.detection.available.length === 0) {
-    stdout.write("Supported AI providers:\n");
-    AI_PROVIDERS.forEach((provider, index2) => {
-      const status = isInstalled(provider, options.detection) ? "installed" : "not found on PATH";
-      stdout.write(`  ${index2 + 1}. ${provider} (${status})
-`);
-    });
-    stdout.write("\n");
-    throw new Error(`No supported AI CLI found. Install one of: ${AI_PROVIDERS.join(", ")}.`);
-  }
-  if (typeof stdin.setRawMode === "function") {
-    return promptForAiProviderWithArrows({
-      detection: options.detection,
-      stdin,
-      stdout,
-      currentProvider: options.currentProvider
-    });
-  }
-  stdout.write("Supported AI providers:\n");
-  AI_PROVIDERS.forEach((provider, index2) => {
-    const status = isInstalled(provider, options.detection) ? "installed" : "not found on PATH";
-    stdout.write(`  ${index2 + 1}. ${provider} (${status})
-`);
-  });
-  stdout.write("\n");
-  const rl = (0, import_promises6.createInterface)({ input: stdin, output: stdout });
-  try {
-    while (true) {
-      const answer = (await rl.question("Choose an installed AI provider by number or name: ")).trim();
-      const provider = parseProviderChoice(answer);
-      if (!provider) {
-        stdout.write(`Invalid choice. Use one of: ${AI_PROVIDERS.join(", ")}.
-`);
-        continue;
-      }
-      if (!isInstalled(provider, options.detection)) {
-        stdout.write(`"${provider}" is not installed or not on PATH. Choose an installed provider.
-`);
-        continue;
-      }
-      return provider;
-    }
-  } finally {
-    rl.close();
-  }
-}
-async function promptForAiProviderWithArrows(options) {
-  let selectedIndex = AI_PROVIDERS.findIndex((provider) => provider === options.currentProvider && isInstalled(provider, options.detection));
-  if (selectedIndex < 0) {
-    selectedIndex = AI_PROVIDERS.findIndex((provider) => isInstalled(provider, options.detection));
-  }
-  if (selectedIndex < 0) {
-    selectedIndex = 0;
-  }
-  let renderedLines = 0;
-  const render = (message) => {
-    if (renderedLines > 0) {
-      (0, import_node_readline.moveCursor)(options.stdout, 0, -renderedLines);
-      (0, import_node_readline.cursorTo)(options.stdout, 0);
-      (0, import_node_readline.clearScreenDown)(options.stdout);
-    }
-    const lines = [
-      "Use \u2191/\u2193 to move, Enter to confirm.",
-      "",
-      ...AI_PROVIDERS.map((provider, index2) => {
-        const selected = index2 === selectedIndex ? "\u276F" : " ";
-        const status = isInstalled(provider, options.detection) ? "installed" : "not found on PATH";
-        const current = provider === options.currentProvider ? ", current" : "";
-        return `${selected} ${provider} (${status}${current})`;
-      }),
-      ...message ? ["", message] : []
-    ];
-    options.stdout.write(`${lines.join("\n")}
-`);
-    renderedLines = lines.length;
-  };
-  (0, import_node_readline.emitKeypressEvents)(options.stdin);
-  options.stdin.setRawMode(true);
-  options.stdin.resume();
-  options.stdout.write("\x1B[?25l");
-  render();
-  return await new Promise((resolve11, reject) => {
-    const cleanup = () => {
-      options.stdin.off("keypress", onKeypress);
-      options.stdin.setRawMode(false);
-      options.stdin.pause();
-      options.stdout.write("\x1B[?25h");
-    };
-    const clearRendered = () => {
-      if (renderedLines > 0) {
-        (0, import_node_readline.moveCursor)(options.stdout, 0, -renderedLines);
-        (0, import_node_readline.cursorTo)(options.stdout, 0);
-        (0, import_node_readline.clearScreenDown)(options.stdout);
-      }
-    };
-    const finish = (provider) => {
-      cleanup();
-      clearRendered();
-      options.stdout.write(`Selected AI provider: ${provider}
-`);
-      resolve11(provider);
-    };
-    const onKeypress = (_str, key) => {
-      if (key.ctrl && key.name === "c") {
-        cleanup();
-        clearRendered();
-        options.stdout.write(
-          options.currentProvider ? `AI provider selection cancelled. Keeping current provider: ${options.currentProvider}
-` : "AI provider selection cancelled. No provider was configured.\n"
-        );
-        reject(new UserCancelledAiProviderSelectionError());
-        return;
-      }
-      if (key.name === "up") {
-        selectedIndex = (selectedIndex + AI_PROVIDERS.length - 1) % AI_PROVIDERS.length;
-        render();
-        return;
-      }
-      if (key.name === "down") {
-        selectedIndex = (selectedIndex + 1) % AI_PROVIDERS.length;
-        render();
-        return;
-      }
-      if (key.name === "return" || key.name === "enter") {
-        const provider = AI_PROVIDERS[selectedIndex];
-        if (!isInstalled(provider, options.detection)) {
-          render(`"${provider}" is not installed or not on PATH. Choose an installed provider.`);
-          return;
-        }
-        finish(provider);
-      }
-    };
-    options.stdin.on("keypress", onKeypress);
-  });
-}
-function parseProviderChoice(answer) {
-  if (!answer) {
-    return null;
-  }
-  const number = Number(answer);
-  if (Number.isInteger(number) && number >= 1 && number <= AI_PROVIDERS.length) {
-    return AI_PROVIDERS[number - 1];
-  }
-  try {
-    return normalizeAiProvider(answer);
-  } catch {
-    return null;
-  }
-}
-var import_node_child_process5, import_promises6, import_node_readline, AI_PROVIDERS, UserCancelledAiProviderSelectionError;
-var init_ai_provider = __esm({
-  "src/ai-provider.ts"() {
-    "use strict";
-    import_node_child_process5 = require("node:child_process");
-    import_promises6 = require("node:readline/promises");
-    import_node_readline = require("node:readline");
-    init_ai_command();
-    init_win_spawn();
-    AI_PROVIDERS = ["codex", "claude", "hermes", "openclaw"];
-    UserCancelledAiProviderSelectionError = class extends Error {
-      constructor() {
-        super("AI provider selection cancelled by user.");
-        this.name = "UserCancelledAiProviderSelectionError";
-      }
-    };
-  }
-});
-
-// ../../node_modules/@sentry/utils/cjs/is.js
-var require_is = __commonJS({
-  "../../node_modules/@sentry/utils/cjs/is.js"(exports2) {
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    var objectToString = Object.prototype.toString;
-    function isError(wat) {
-      switch (objectToString.call(wat)) {
-        case "[object Error]":
-        case "[object Exception]":
-        case "[object DOMException]":
-          return true;
-        default:
-          return isInstanceOf(wat, Error);
-      }
-    }
-    function isBuiltin(wat, className) {
-      return objectToString.call(wat) === `[object ${className}]`;
-    }
-    function isErrorEvent(wat) {
-      return isBuiltin(wat, "ErrorEvent");
+    function isErrorEvent(wat) {
+      return isBuiltin(wat, "ErrorEvent");
     }
     function isDOMError(wat) {
       return isBuiltin(wat, "DOMError");
@@ -6182,7 +5593,7 @@ var require_path = __commonJS({
       return outputParts.join("/");
     }
     function normalizePath(path2) {
-      const isPathAbsolute = isAbsolute3(path2);
+      const isPathAbsolute = isAbsolute4(path2);
       const trailingSlash = path2.slice(-1) === "/";
       let normalizedPath = normalizeArray(
         path2.split("/").filter((p) => !!p),
@@ -6196,7 +5607,7 @@ var require_path = __commonJS({
       }
       return (isPathAbsolute ? "/" : "") + normalizedPath;
     }
-    function isAbsolute3(path2) {
+    function isAbsolute4(path2) {
       return path2.charAt(0) === "/";
     }
     function join31(...args) {
@@ -6223,7 +5634,7 @@ var require_path = __commonJS({
     }
     exports2.basename = basename8;
     exports2.dirname = dirname9;
-    exports2.isAbsolute = isAbsolute3;
+    exports2.isAbsolute = isAbsolute4;
     exports2.join = join31;
     exports2.normalizePath = normalizePath;
     exports2.relative = relative;
@@ -19627,6 +19038,14 @@ var init_events = __esm({
       AI_RUN_STARTED: "AI run started",
       AI_RUN_COMPLETED: "AI run completed",
       AI_RUN_SKIPPED: "AI run skipped",
+      // Codex GUI runtime detection / binding checkpoints. All four are logger.info,
+      // so each one must also be listed in SENTRY_INFO_ALLOWLIST (index.ts): info()
+      // returns early for an unlisted event, which ships a checkpoint that emits
+      // nothing while every code path looks implemented.
+      RUNTIME_DETECTED: "Runtime detected",
+      PROVIDER_READINESS_CHECKED: "Provider readiness checked",
+      PROVIDER_SWITCHED: "Provider switched",
+      JOB_PROVIDER_BOUND: "Job provider bound",
       // Hermes user-channel delivery only. The node and openclaw user-channel hops
       // keep emitting USER_DISPATCHED / PROMPT_USER_CHECKPOINT — one name per
       // transport is the whole point of splitting the send events.
@@ -19907,23 +19326,23 @@ function appendActiveXmtpTestMetric(level, eventName, extra) {
   }
   try {
     const homeDir = resolveA2aTaskHome();
-    const testsDir = (0, import_node_path13.join)(homeDir, "xmtp-tests");
-    const activePath = (0, import_node_path13.join)(testsDir, "active.json");
-    if (!(0, import_node_fs9.existsSync)(activePath)) {
+    const testsDir = (0, import_node_path12.join)(homeDir, "xmtp-tests");
+    const activePath = (0, import_node_path12.join)(testsDir, "active.json");
+    if (!(0, import_node_fs8.existsSync)(activePath)) {
       return;
     }
-    const active = JSON.parse((0, import_node_fs9.readFileSync)(activePath, "utf8"));
+    const active = JSON.parse((0, import_node_fs8.readFileSync)(activePath, "utf8"));
     const runId = typeof active.runId === "string" ? active.runId : "";
     if (!RUN_ID_PATTERN.test(runId)) {
       return;
     }
-    const runDir = (0, import_node_path13.resolve)(testsDir, runId);
-    const root = `${(0, import_node_path13.resolve)(testsDir)}${import_node_path13.sep}`;
+    const runDir = (0, import_node_path12.resolve)(testsDir, runId);
+    const root = `${(0, import_node_path12.resolve)(testsDir)}${import_node_path12.sep}`;
     if (!runDir.startsWith(root)) {
       return;
     }
-    (0, import_node_fs9.appendFileSync)(
-      (0, import_node_path13.join)(runDir, "events.jsonl"),
+    (0, import_node_fs8.appendFileSync)(
+      (0, import_node_path12.join)(runDir, "events.jsonl"),
       `${JSON.stringify({
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
         level,
@@ -19937,12 +19356,12 @@ function appendActiveXmtpTestMetric(level, eventName, extra) {
   } catch {
   }
 }
-var import_node_fs9, import_node_path13, RUN_ID_PATTERN, XMTP_TEST_EVENTS;
+var import_node_fs8, import_node_path12, RUN_ID_PATTERN, XMTP_TEST_EVENTS;
 var init_xmtp_test_metrics = __esm({
   "../core/src/xmtp-test-metrics.ts"() {
     "use strict";
-    import_node_fs9 = require("node:fs");
-    import_node_path13 = require("node:path");
+    import_node_fs8 = require("node:fs");
+    import_node_path12 = require("node:path");
     init_a2a_paths();
     RUN_ID_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$/;
     XMTP_TEST_EVENTS = /* @__PURE__ */ new Set([
@@ -20027,7 +19446,15 @@ function classifyError(error, code) {
   if (normalizedCode === "ABORT_ERR" || name === "aborterror") {
     return "cancelled";
   }
-  if (name === "syntaxerror" || /(?:json|response).*(?:parse|invalid)/.test(message)) {
+  if (name === "syntaxerror") {
+    return "invalid_response";
+  }
+  if (/connection\s+(?:reset|closed|interrupted)|broken\s+pipe|unexpected\s+eof/.test(
+    message
+  )) {
+    return "connection_interrupted";
+  }
+  if (/(?:json|response).*(?:parse|invalid)/.test(message)) {
     return "invalid_response";
   }
   if (/session\s+(?:is\s+)?expired|login\s+expired/.test(message)) {
@@ -20182,6 +19609,9 @@ function applyFatalEventDefaults(event) {
   }
   return event;
 }
+function isInfoEventAllowlisted(name) {
+  return SENTRY_INFO_ALLOWLIST.has(name);
+}
 function agentExtras(identity) {
   return {
     walletAddress: identity.walletAddress || UNKNOWN_FIELD,
@@ -20321,6 +19751,7 @@ var init_sentry_logger = __esm({
       "releaseBase",
       "releaseChannel",
       "releaseCode",
+      "replayOutcome",
       "role",
       "runId",
       "runtimeContainer",
@@ -20387,6 +19818,13 @@ var init_sentry_logger = __esm({
       LogEvent.AI_RUN_STARTED,
       LogEvent.AI_RUN_COMPLETED,
       LogEvent.AI_RUN_SKIPPED,
+      // Codex runtime-binding checkpoints. Omitting any of these makes info() drop
+      // the event silently, so the whole FR-4 trace would look implemented in code
+      // and emit nothing in production.
+      LogEvent.RUNTIME_DETECTED,
+      LogEvent.PROVIDER_READINESS_CHECKED,
+      LogEvent.PROVIDER_SWITCHED,
+      LogEvent.JOB_PROVIDER_BOUND,
       LogEvent.USER_CHANNEL_MESSAGE_DELIVERED,
       LogEvent.SYSTEM_NOTIFICATION_RECEIVED,
       LogEvent.SYSTEM_NOTIFICATION_ROUTED,
@@ -20567,120 +20005,1637 @@ var init_sentry_logger = __esm({
         } catch {
         }
       }
-      async shutdown() {
-        try {
-          await Sentry.close(5e3);
-        } catch {
-          await Sentry.flush(5e3);
-        }
+      async shutdown() {
+        try {
+          await Sentry.close(5e3);
+        } catch {
+          await Sentry.flush(5e3);
+        }
+      }
+      flush() {
+        while (this.buffer.length > 0) {
+          const entry = this.buffer.shift();
+          if (entry.level === "info") {
+            this.captureInfo(entry.message, entry.extra ?? {});
+          } else {
+            this.captureError(entry.message, entry.error, entry.extra ?? {});
+          }
+        }
+      }
+      static sanitizeExtra(extra) {
+        return Object.fromEntries(
+          Object.entries(extra).filter(([, value]) => value !== void 0).filter(([key]) => !_SentryLogger.isBlockedExtraKey(key)).map(([key, value]) => [key, _SentryLogger.safeValueForKey(key, value)])
+        );
+      }
+      static isBlockedExtraKey(key) {
+        const lower = key.toLowerCase();
+        const normalized = _SentryLogger.normalizeSensitiveKey(key);
+        if (SENTRY_EXTRA_BLOCKLIST.has(lower) || SENTRY_EXTRA_BLOCKLIST.has(normalized)) {
+          return true;
+        }
+        if (_SentryLogger.isSafeMetricKey(normalized)) {
+          return false;
+        }
+        return SENTRY_EXTRA_BLOCKED_KEY_PARTS.some((needle) => normalized.includes(needle));
+      }
+      static isSafeMetricKey(normalized) {
+        return /(bytes|count|length|ms|size)$/.test(normalized);
+      }
+      static safeValueForKey(key, value) {
+        if (typeof value === "string" && SENTRY_FULL_STRING_EXTRA_KEYS.has(_SentryLogger.normalizeSensitiveKey(key))) {
+          return value;
+        }
+        return _SentryLogger.safeValue(value);
+      }
+      static normalizeSensitiveKey(key) {
+        return key.toLowerCase().replace(/[^a-z0-9]/g, "");
+      }
+      static safeValue(value) {
+        if (typeof value === "string") {
+          return value.length <= MAX_EXTRA_STRING_LENGTH ? value : `${value.slice(0, MAX_EXTRA_STRING_LENGTH)}...`;
+        }
+        if (value === null || value === void 0 || typeof value === "number" || typeof value === "boolean") {
+          return value;
+        }
+        if (typeof value === "bigint") {
+          return value.toString();
+        }
+        if (value instanceof Error) {
+          return {
+            name: value.name,
+            messageLength: value.message.length
+          };
+        }
+        if (Array.isArray(value)) {
+          return value.slice(0, 20).map((item) => _SentryLogger.safeValue(item));
+        }
+        if (typeof value === "object") {
+          return Object.fromEntries(
+            Object.entries(value).slice(0, 50).filter(([, item]) => item !== void 0).filter(([key]) => !_SentryLogger.isBlockedExtraKey(key)).map(([key, item]) => [key, _SentryLogger.safeValueForKey(key, item)])
+          );
+        }
+        const text = String(value);
+        return text.length <= MAX_EXTRA_STRING_LENGTH ? text : `${text.slice(0, MAX_EXTRA_STRING_LENGTH)}...`;
+      }
+      static tagValue(value) {
+        const text = String(value);
+        return text.length <= MAX_TAG_VALUE_LENGTH ? text : `${text.slice(0, MAX_TAG_VALUE_LENGTH)}...`;
+      }
+      static normalizeTagKey(key) {
+        return key.replace(/[^A-Za-z0-9_.:-]+/g, "_").slice(0, 32) || "unknown";
+      }
+      static applyDiagnostics(scope, eventName, extra) {
+        const enriched = { eventName, ...extra };
+        for (const [key, value] of Object.entries(enriched)) {
+          if (!SENTRY_TAG_KEYS.has(key)) {
+            continue;
+          }
+          scope.setTag(_SentryLogger.normalizeTagKey(key), _SentryLogger.tagValue(value));
+        }
+        const fingerprint = ["a2a", eventName];
+        for (const key of SENTRY_FINGERPRINT_KEYS) {
+          const value = enriched[key];
+          if (value) {
+            fingerprint.push(`${key}:${_SentryLogger.tagValue(value)}`);
+          }
+        }
+        scope.setFingerprint(fingerprint);
+      }
+      static toPascalCase(str) {
+        return str.split(/[\s:]+/).filter(Boolean).map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join("");
+      }
+      static createSentryEvent(eventName) {
+        const err = new Error(eventName);
+        err.name = _SentryLogger.toPascalCase(eventName);
+        err.stack = `${err.name}: ${eventName}`;
+        return err;
+      }
+    };
+    logger = SentryLogger.getInstance();
+    initLogger = (config) => {
+      return logger.init(config);
+    };
+    shutdown = () => {
+      return logger.shutdown();
+    };
+    UNKNOWN_FIELD = "unknown";
+  }
+});
+
+// src/ai-provider.ts
+function normalizeAiProvider(value) {
+  const normalized = value.trim().toLowerCase();
+  if (normalized === "codex") {
+    return "codex";
+  }
+  if (normalized === "claude" || normalized === "claude-code" || normalized === "claude_code") {
+    return "claude";
+  }
+  if (normalized === "hermes") {
+    return "hermes";
+  }
+  if (normalized === "openclaw") {
+    return "openclaw";
+  }
+  throw new Error(`Unsupported AI provider "${value}". Use one of: ${AI_PROVIDERS.join(", ")}.`);
+}
+function detectAiProviders(commandExists2 = commandExists, env = process.env) {
+  const codex = commandExists2(readProviderCommand("codex", env));
+  const claude = commandExists2(readProviderCommand("claude", env));
+  const hermes = commandExists2(readProviderCommand("hermes", env));
+  const openclaw = commandExists2(readProviderCommand("openclaw", env));
+  return {
+    codex,
+    claude,
+    hermes,
+    openclaw,
+    available: [
+      ...codex ? ["codex"] : [],
+      ...claude ? ["claude"] : [],
+      ...hermes ? ["hermes"] : [],
+      ...openclaw ? ["openclaw"] : []
+    ]
+  };
+}
+function detectCurrentAiProvider(env = process.env) {
+  const explicit = env.OKX_A2A_AI_PROVIDER ?? env.OKX_AGENT_TASK_AI_CLI;
+  if (explicit) {
+    return normalizeAiProvider(explicit);
+  }
+  const runtime = detectRuntime(env);
+  return runtime === "unknown" ? null : runtime;
+}
+function hasAiRuntimeMarker(env = process.env) {
+  return !!(detectGatewayInvocation(env) || env.CODEX_THREAD_ID || isTruthyRuntimeMarker(env.CODEX_SHELL) || env.CODEX_MANAGED_BY_NPM || isTruthyRuntimeMarker(env.CODEX_CI) || env.CLAUDE_SESSION_ID || isTruthyRuntimeMarker(env.CLAUDECODE) || env.CLAUDE_CODE_SESSION_ID || env.CLAUDE_PLUGIN_DATA || env.HERMES_SESSION_ID && !env.HERMES_DESKTOP_CWD || env.HERMES_SESSION_KEY || env.HERMES_FLOW_ID || env.OPENCLAW_SHELL || env.OPENCLAW_CLI);
+}
+function detectRuntime(env = process.env, options = {}) {
+  const gatewayInvocation = detectGatewayInvocation(env);
+  const strongMatches = [
+    ...gatewayInvocation ? [gatewayInvocation] : [],
+    ...env.CODEX_THREAD_ID || isTruthyRuntimeMarker(env.CODEX_SHELL) || env.CODEX_MANAGED_BY_NPM || isTruthyRuntimeMarker(env.CODEX_CI) ? ["codex"] : [],
+    ...env.CLAUDE_SESSION_ID || isTruthyRuntimeMarker(env.CLAUDECODE) || env.CLAUDE_CODE_SESSION_ID || env.CLAUDE_PLUGIN_DATA ? ["claude"] : [],
+    ...env.HERMES_SESSION_ID && !env.HERMES_DESKTOP_CWD || env.HERMES_SESSION_KEY || env.HERMES_FLOW_ID ? ["hermes"] : [],
+    ...env.OPENCLAW_SHELL || env.OPENCLAW_CLI ? ["openclaw"] : [],
+    ...hasOpenClawParentProcess(options.parentPid ?? process.ppid, options.readParentProcessCommand ?? readParentProcessCommand) ? ["openclaw"] : []
+  ];
+  const uniqueMatches = [...new Set(strongMatches)];
+  if (uniqueMatches.length === 1) {
+    return uniqueMatches[0];
+  }
+  return "unknown";
+}
+function detectGatewayInvocation(env = process.env) {
+  const context = (env.OKX_A2A_RUNTIME_CONTEXT ?? "").trim().toLowerCase();
+  if (context === "openclaw-gateway" || context === "gateway:openclaw") {
+    return "openclaw";
+  }
+  if (context === "hermes-gateway" || context === "gateway:hermes") {
+    return "hermes";
+  }
+  if (isTruthyRuntimeMarker(env._HERMES_GATEWAY)) {
+    return "hermes";
+  }
+  if ((env.OPENCLAW_SERVICE_KIND ?? "").trim().toLowerCase() === "gateway") {
+    return "openclaw";
+  }
+  if (!isTruthyRuntimeMarker(env.OKX_A2A_IN_GATEWAY)) {
+    return null;
+  }
+  const provider = env.OKX_A2A_GATEWAY_PROVIDER;
+  if (!provider) {
+    return null;
+  }
+  try {
+    const normalized = normalizeAiProvider(provider);
+    return normalized === "openclaw" || normalized === "hermes" ? normalized : null;
+  } catch {
+    return null;
+  }
+}
+function switchProvider(options) {
+  const runtime = detectRuntime(options.env ?? process.env, {
+    parentPid: options.parentPid,
+    readParentProcessCommand: options.readParentProcessCommand
+  });
+  if (runtime === "unknown") {
+    const stored = options.store.getDefaultAiProvider();
+    if (stored) {
+      return {
+        ok: true,
+        runtime: "unknown",
+        provider: stored,
+        previousProvider: stored,
+        changed: false,
+        action: "kept_existing",
+        userMessage: `No AI runtime detected for the current environment; keeping the existing default provider (${formatAiProviderDisplayName(stored)}).`
+      };
+    }
+    return {
+      ok: false,
+      runtime: "unknown",
+      reason: "unknown_runtime",
+      state: "blocked",
+      message: "Could not determine the current AI provider.",
+      userMessage: "Could not detect the current AI runtime and no default AI provider is configured. Run this from your AI environment (OpenClaw / Codex / Claude / Hermes), or set a provider manually: `okx-a2a ai-provider set --provider <codex|claude|hermes|openclaw>`."
+    };
+  }
+  const previousProvider = options.store.getDefaultAiProvider();
+  const changed = previousProvider !== runtime;
+  options.store.setDefaultAiProvider(runtime);
+  return {
+    ok: true,
+    runtime,
+    provider: runtime,
+    previousProvider,
+    changed,
+    action: "switched",
+    userMessage: changed ? `Switched to ${formatAiProviderDisplayName(runtime)}\uFF5CNew tasks will be handled here; unfinished tasks should be continued in their original session` : ""
+  };
+}
+function formatAiProviderDisplayName(provider) {
+  if (provider === "openclaw") {
+    return "OpenClaw";
+  }
+  return `${provider.charAt(0).toUpperCase()}${provider.slice(1)}`;
+}
+function isTruthyRuntimeMarker(value) {
+  return value === "1" || value === "true" || value === "yes";
+}
+function hasOpenClawParentProcess(parentPid, readParentProcessCommand2) {
+  let pid = parentPid;
+  for (let i = 0; i < 8; i++) {
+    if (!pid || pid <= 1) {
+      return false;
+    }
+    const processInfo = readParentProcessCommand2(pid);
+    if (!processInfo) {
+      return false;
+    }
+    if (/openclaw/i.test(processInfo.command)) {
+      return true;
+    }
+    if (!processInfo.parentPid || processInfo.parentPid === pid) {
+      return false;
+    }
+    pid = processInfo.parentPid;
+  }
+  return false;
+}
+function readParentProcessCommand(pid) {
+  return readParentProcessCommandForPlatform(pid, process.platform);
+}
+function readParentProcessCommandForPlatform(pid, platform) {
+  if (platform === "win32") {
+    return readWindowsParentProcessCommand(pid);
+  }
+  const commandResult = (0, import_node_child_process5.spawnSync)("ps", ["-p", String(pid), "-o", "comm="], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "ignore"]
+  });
+  const parentResult = (0, import_node_child_process5.spawnSync)("ps", ["-p", String(pid), "-o", "ppid="], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "ignore"]
+  });
+  const command = typeof commandResult.stdout === "string" ? commandResult.stdout.trim() : "";
+  const parentPidRaw = typeof parentResult.stdout === "string" ? parentResult.stdout.trim() : "";
+  const parentPid = Number(parentPidRaw);
+  if (commandResult.status !== 0 || parentResult.status !== 0 || !command || !Number.isFinite(parentPid)) {
+    return null;
+  }
+  return { command, parentPid };
+}
+function buildWindowsParentProcessProbe(pid) {
+  if (!Number.isInteger(pid)) {
+    return null;
+  }
+  return {
+    command: "powershell.exe",
+    args: [
+      "-NoProfile",
+      "-NonInteractive",
+      "-Command",
+      `Get-CimInstance Win32_Process -Filter "ProcessId=${pid}" | Select-Object Name,ParentProcessId | ConvertTo-Json -Compress`
+    ]
+  };
+}
+function parseWindowsParentProcessJson(stdout) {
+  const trimmed = stdout.trim();
+  if (!trimmed) {
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(trimmed);
+  } catch {
+    return null;
+  }
+  const record = Array.isArray(parsed) ? parsed[0] : parsed;
+  if (!record || typeof record !== "object") {
+    return null;
+  }
+  const name = record.Name;
+  if (typeof name !== "string" || name.trim() === "") {
+    return null;
+  }
+  const rawParentPid = Number(record.ParentProcessId);
+  const parentPid = Number.isInteger(rawParentPid) && rawParentPid > 0 ? rawParentPid : null;
+  return { command: name.trim(), parentPid };
+}
+function readWindowsParentProcessCommand(pid) {
+  const probe = buildWindowsParentProcessProbe(pid);
+  if (!probe) {
+    logWinCompat(`${WIN_COMPAT_LOG_PREFIX} parent-process probe rejected non-integer pid=${String(pid)}`);
+    return null;
+  }
+  const result = (0, import_node_child_process5.spawnSync)(probe.command, probe.args, {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "ignore"],
+    timeout: 5e3,
+    windowsHide: true
+  });
+  if (result.error) {
+    const spawnError = result.error;
+    logWinCompat(
+      `${WIN_COMPAT_LOG_PREFIX} parent-process probe failed pid=${pid} command=${probe.command} errorCode=${spawnError.code ?? "unknown"} error=${spawnError.message}`
+    );
+    return null;
+  }
+  if (result.status !== 0) {
+    logWinCompat(
+      `${WIN_COMPAT_LOG_PREFIX} parent-process probe exited pid=${pid} command=${probe.command} status=${String(result.status)} signal=${String(result.signal)}`
+    );
+    return null;
+  }
+  const stdout = typeof result.stdout === "string" ? result.stdout : "";
+  const parsed = parseWindowsParentProcessJson(stdout);
+  if (!parsed) {
+    logWinCompat(
+      `${WIN_COMPAT_LOG_PREFIX} parent-process probe unparsable output pid=${pid} stdout=${JSON.stringify(stdout.slice(0, 200))}`
+    );
+    return null;
+  }
+  if (process.env.OKX_A2A_WIN_COMPAT_VERBOSE === "1") {
+    logWinCompat(
+      `${WIN_COMPAT_LOG_PREFIX} parent-process probe pid=${pid} -> command=${parsed.command} parentPid=${parsed.parentPid ?? "null"}`
+    );
+  }
+  return parsed;
+}
+async function ensureDefaultAiProvider(options) {
+  const env = options.env ?? process.env;
+  const commandExists2 = options.commandExists ?? commandExists;
+  const detection = withStoredCodexAvailability(
+    detectAiProviders(commandExists2, env),
+    options.store,
+    commandExists2,
+    env
+  );
+  if (options.requestedProvider) {
+    const provider = normalizeAiProvider(options.requestedProvider);
+    if (!options.allowUnavailableProvider) {
+      assertInstalled(provider, detection);
+    }
+    options.store.setDefaultAiProvider(provider);
+    return {
+      provider,
+      source: "requested",
+      message: isInstalled(provider, detection) ? `default AI provider set to ${provider}` : `default AI provider set to ${provider}; availability was not verified on PATH`
+    };
+  }
+  if (options.forcePrompt) {
+    const provider = await promptForAiProvider({
+      detection,
+      stdin: options.stdin,
+      stdout: options.stdout,
+      currentProvider: options.store.getDefaultAiProvider()
+    });
+    options.store.setDefaultAiProvider(provider);
+    return {
+      provider,
+      source: "detected",
+      message: `default AI provider set to ${provider}`
+    };
+  }
+  if (env.OKX_AGENT_TASK_AI_CLI) {
+    const provider = normalizeAiProvider(env.OKX_AGENT_TASK_AI_CLI);
+    if (!options.allowUnavailableProvider) {
+      assertInstalled(provider, detection);
+    }
+    options.store.setDefaultAiProvider(provider);
+    return {
+      provider,
+      source: "env",
+      message: isInstalled(provider, detection) ? `default AI provider set to ${provider} from OKX_AGENT_TASK_AI_CLI` : `default AI provider set to ${provider} from OKX_AGENT_TASK_AI_CLI; availability was not verified on PATH`
+    };
+  }
+  if (env.OKX_A2A_AI_PROVIDER) {
+    const provider = normalizeAiProvider(env.OKX_A2A_AI_PROVIDER);
+    if (!options.allowUnavailableProvider) {
+      assertInstalled(provider, detection);
+    }
+    return {
+      provider,
+      source: "env",
+      message: isInstalled(provider, detection) ? `AI provider resolved from OKX_A2A_AI_PROVIDER: ${provider}` : `AI provider resolved from OKX_A2A_AI_PROVIDER: ${provider}; availability was not verified on PATH`
+    };
+  }
+  const stored = options.store.getDefaultAiProvider();
+  if (stored && (options.allowUnavailableProvider || isInstalled(stored, detection))) {
+    return {
+      provider: stored,
+      source: "stored",
+      message: isInstalled(stored, detection) ? `default AI provider is ${stored}` : `default AI provider is ${stored}; availability was not verified on PATH`
+    };
+  }
+  if (stored) {
+    options.stderr?.write(
+      `[okx-agent-task] stored AI provider "${stored}" is not installed or not on PATH; selecting again.
+`
+    );
+  }
+  if (options.promptIfMissing) {
+    const provider = await promptForAiProvider({
+      detection,
+      stdin: options.stdin,
+      stdout: options.stdout,
+      currentProvider: stored ?? null
+    });
+    options.store.setDefaultAiProvider(provider);
+    return {
+      provider,
+      source: "detected",
+      message: `default AI provider set to ${provider}`
+    };
+  }
+  const current = detectCurrentAiProvider(env);
+  if (current && (options.allowUnavailableProvider || isInstalled(current, detection))) {
+    return {
+      provider: current,
+      source: "env",
+      message: isInstalled(current, detection) ? `AI provider resolved from current environment: ${current}` : `AI provider resolved from current environment: ${current}; availability was not verified on PATH`
+    };
+  }
+  if (detection.available.length === 0) {
+    throw new Error(
+      `No supported AI CLI found. Install one of: ${AI_PROVIDERS.join(", ")}.`
+    );
+  }
+  if (detection.available.length === 1) {
+    const provider = detection.available[0];
+    options.store.setDefaultAiProvider(provider);
+    return {
+      provider,
+      source: "detected",
+      message: `detected only ${provider}; default AI provider set to ${provider}`
+    };
+  }
+  throw new Error(
+    `Multiple AI CLIs are installed (${detection.available.join(", ")}) but no current AI environment was detected. Start the daemon from an AI session, pass --ai-provider <provider>, or set OKX_A2A_AI_PROVIDER.`
+  );
+}
+function resolveConfiguredAiProvider(options) {
+  const env = options.env ?? process.env;
+  const explicit = env.OKX_AGENT_TASK_AI_CLI ?? env.OKX_A2A_AI_PROVIDER;
+  if (explicit) {
+    return normalizeAiProvider(explicit);
+  }
+  return options.store.getDefaultAiProvider();
+}
+function resolveConfiguredAiProviderForJob(options) {
+  const jobId = normalizeOptionalJobId2(options.jobId);
+  if (jobId) {
+    const binding = options.store.getJobProviderBinding(jobId);
+    if (binding) {
+      bindHermesJobRouteFromEnvIfAvailable(options.store, {
+        jobId,
+        provider: binding.provider,
+        env: options.env
+      });
+      return binding.provider;
+    }
+  }
+  const provider = resolveConfiguredAiProvider({
+    store: options.store,
+    env: options.env
+  });
+  if (jobId && provider) {
+    return bindJobProviderWithRouteIfAvailable(options.store, {
+      jobId,
+      provider,
+      env: options.env
+    }).binding.provider;
+  }
+  return provider;
+}
+function bindJobProviderToCurrentDefaultIfMissing(options) {
+  const store = options.store ?? null;
+  const jobId = normalizeOptionalJobId2(options.jobId);
+  if (!store || !jobId) {
+    return null;
+  }
+  const existing = store.getJobProviderBinding(jobId);
+  if (existing) {
+    bindHermesJobRouteFromEnvIfAvailable(store, {
+      jobId,
+      provider: existing.provider,
+      env: options.env
+    });
+    return {
+      provider: existing.provider,
+      created: false
+    };
+  }
+  const provider = store.getDefaultAiProvider();
+  if (!provider) {
+    return null;
+  }
+  const result = bindJobProviderWithRouteIfAvailable(store, {
+    jobId,
+    provider,
+    env: options.env
+  });
+  return {
+    provider: result.binding.provider,
+    created: result.created
+  };
+}
+function bindJobProviderToCurrentRuntimeIfMissing(options) {
+  const store = options.store ?? null;
+  const jobId = normalizeOptionalJobId2(options.jobId);
+  if (!store || !jobId) {
+    return {
+      ok: false,
+      jobId: jobId ?? "",
+      provider: null,
+      currentProvider: null,
+      created: false,
+      binding: null,
+      reason: "missing_job_id"
+    };
+  }
+  const existing = store.getJobProviderBinding(jobId);
+  if (existing) {
+    const binding = bindHermesJobRouteFromEnvIfAvailable(store, {
+      jobId,
+      provider: existing.provider,
+      env: options.env
+    }) ?? existing;
+    return {
+      ok: true,
+      jobId,
+      provider: binding.provider,
+      currentProvider: null,
+      created: false,
+      binding,
+      reason: "already_bound"
+    };
+  }
+  const switched = switchProvider({ store, env: options.env ?? process.env });
+  if (!switched.ok || !switched.provider) {
+    return {
+      ok: false,
+      jobId,
+      provider: null,
+      currentProvider: null,
+      created: false,
+      binding: null,
+      reason: "unknown_runtime"
+    };
+  }
+  const currentProvider = switched.provider;
+  const result = bindJobProviderWithRouteIfAvailable(store, {
+    jobId,
+    provider: currentProvider,
+    env: options.env
+  });
+  return {
+    ok: true,
+    jobId,
+    provider: result.binding.provider,
+    currentProvider,
+    created: result.created,
+    binding: result.binding,
+    reason: result.created ? "created" : "already_bound"
+  };
+}
+async function ensureProviderReadyForBinding(options) {
+  if (options.provider !== "codex") {
+    return notRequiredReadinessGate(options.provider);
+  }
+  const check = options.readiness ?? checkCodexReadiness;
+  const result = await check({
+    store: options.store ?? null,
+    env: options.env ?? process.env,
+    platform: options.platform,
+    persistOverrideCommand: options.persistOverrideCommand
+  });
+  return {
+    provider: "codex",
+    ready: result.ready,
+    state: result.state,
+    commandSource: result.commandSource,
+    commandPersisted: result.commandPersisted,
+    recoveryAction: result.recoveryAction,
+    recoveryGuidance: result.recoveryGuidance
+  };
+}
+async function switchProviderWithReadinessGateCore(options) {
+  const env = options.env ?? process.env;
+  const runtime = detectRuntime(env, {
+    parentPid: options.parentPid,
+    readParentProcessCommand: options.readParentProcessCommand
+  });
+  const delegate = () => switchProvider({
+    store: options.store,
+    env,
+    parentPid: options.parentPid,
+    readParentProcessCommand: options.readParentProcessCommand
+  });
+  if (runtime !== "codex") {
+    const result2 = delegate();
+    return {
+      result: result2.ok ? result2 : { ...result2, reasonCode: "runtime_undetectable" },
+      runtime,
+      readiness: null
+    };
+  }
+  const readiness = await ensureProviderReadyForBinding({
+    provider: "codex",
+    store: options.store,
+    env,
+    platform: options.platform,
+    readiness: options.readiness
+  });
+  if (!readiness.ready) {
+    const previousProvider = options.store.getDefaultAiProvider();
+    const keepingClause = previousProvider ? `keeping ${formatAiProviderDisplayName(previousProvider)} as the default provider` : "the default provider was not changed";
+    return {
+      result: {
+        ok: false,
+        runtime,
+        reason: "provider_not_ready",
+        reasonCode: "provider_not_ready",
+        state: "blocked",
+        message: `Codex is not ready (${readiness.state}); the default AI provider was not changed.`,
+        userMessage: `Codex is not ready (${readiness.state}); ${keepingClause}. ${readiness.recoveryGuidance}`,
+        previousProvider,
+        detectedProvider: "codex",
+        effectiveProvider: previousProvider,
+        readinessState: readiness.state,
+        commandSource: readiness.commandSource,
+        recoveryAction: readiness.recoveryAction,
+        recoveryGuidance: readiness.recoveryGuidance
+      },
+      runtime,
+      readiness
+    };
+  }
+  const result = delegate();
+  if (!result.ok) {
+    return { result, runtime, readiness };
+  }
+  return {
+    result: {
+      ...result,
+      detectedProvider: "codex",
+      effectiveProvider: result.provider,
+      readinessState: readiness.state,
+      commandSource: readiness.commandSource,
+      commandPersisted: readiness.commandPersisted
+    },
+    runtime,
+    readiness
+  };
+}
+function classifyJobBindingSource(env = process.env, options = {}) {
+  if (env.OKX_AGENT_TASK_AI_CLI ?? env.OKX_A2A_AI_PROVIDER) {
+    return "explicit_env";
+  }
+  return detectRuntime(env, options) === "unknown" ? "default_provider" : "current_runtime";
+}
+async function bindJobProviderToCurrentDefaultIfReady(options) {
+  const store = options.store ?? null;
+  const jobId = normalizeOptionalJobId2(options.jobId);
+  if (!store || !jobId) {
+    return null;
+  }
+  const existing = store.getJobProviderBinding(jobId);
+  if (existing) {
+    return alreadyBoundGateResult(store, jobId, existing.provider, options.env);
+  }
+  const provider = store.getDefaultAiProvider();
+  if (!provider) {
+    return null;
+  }
+  return await bindResolvedJobProviderIfReady({
+    store,
+    jobId,
+    provider,
+    bindingSource: "default_provider",
+    env: options.env,
+    platform: options.platform,
+    readiness: options.readiness
+  });
+}
+async function bindJobProviderToCurrentRuntimeIfReady(options) {
+  const store = options.store ?? null;
+  const jobId = normalizeOptionalJobId2(options.jobId);
+  if (!store || !jobId) {
+    return {
+      ok: false,
+      jobId: jobId ?? "",
+      provider: null,
+      currentProvider: null,
+      created: false,
+      degraded: false,
+      bindingSource: null,
+      readiness: null,
+      reason: "missing_job_id"
+    };
+  }
+  const existing = store.getJobProviderBinding(jobId);
+  if (existing) {
+    return alreadyBoundGateResult(store, jobId, existing.provider, options.env);
+  }
+  const env = options.env ?? process.env;
+  const explicit = env.OKX_AGENT_TASK_AI_CLI ?? env.OKX_A2A_AI_PROVIDER;
+  if (explicit) {
+    return await bindResolvedJobProviderIfReady({
+      store,
+      jobId,
+      provider: normalizeAiProvider(explicit),
+      bindingSource: "explicit_env",
+      env,
+      platform: options.platform,
+      readiness: options.readiness
+    });
+  }
+  const switched = await switchProviderWithReadinessGateCore({
+    store,
+    env,
+    platform: options.platform,
+    readiness: options.readiness
+  });
+  if (!switched.result.ok) {
+    const notReady = switched.result.reason === "provider_not_ready";
+    if (switched.readiness) {
+      logProviderReadinessChecked(jobId, switched.readiness);
+    }
+    return {
+      ok: false,
+      jobId,
+      provider: null,
+      currentProvider: switched.result.detectedProvider ?? null,
+      created: false,
+      degraded: notReady,
+      bindingSource: null,
+      readiness: switched.readiness,
+      reason: notReady ? "provider_not_ready" : "unknown_runtime"
+    };
+  }
+  return await bindResolvedJobProviderIfReady({
+    store,
+    jobId,
+    provider: switched.result.provider,
+    bindingSource: switched.runtime === "unknown" ? "default_provider" : "current_runtime",
+    env,
+    platform: options.platform,
+    readiness: options.readiness,
+    // Reuse the gate the switch already evaluated instead of probing twice.
+    gate: switched.readiness
+  });
+}
+function persistDefaultProviderIfChanged(store, provider) {
+  if (store.getDefaultAiProvider() === provider) {
+    return false;
+  }
+  store.setDefaultAiProvider(provider);
+  return true;
+}
+function resolveNewJobProviderCandidate(store, env) {
+  const explicit = env.OKX_AGENT_TASK_AI_CLI ?? env.OKX_A2A_AI_PROVIDER;
+  if (explicit) {
+    return { provider: normalizeAiProvider(explicit), bindingSource: "explicit_env" };
+  }
+  const stored = store.getDefaultAiProvider();
+  return stored ? { provider: stored, bindingSource: "default_provider" } : null;
+}
+async function bindNewJobProviderIfReady(options) {
+  const store = options.store ?? null;
+  const jobId = normalizeOptionalJobId2(options.jobId);
+  if (!store || !jobId) {
+    return null;
+  }
+  const existing = store.getJobProviderBinding(jobId);
+  if (existing) {
+    return alreadyBoundGateResult(store, jobId, existing.provider, options.env);
+  }
+  const env = options.env ?? process.env;
+  const candidate = resolveNewJobProviderCandidate(store, env);
+  if (!candidate) {
+    return null;
+  }
+  return await bindResolvedJobProviderIfReady({
+    store,
+    jobId,
+    provider: candidate.provider,
+    bindingSource: candidate.bindingSource,
+    env,
+    platform: options.platform,
+    readiness: options.readiness
+  });
+}
+async function persistCurrentRuntimeSelectionForNewJob(options) {
+  const store = options.store ?? null;
+  if (!store) {
+    return runtimeSelectionResult({ reason: "no_provider", ok: false });
+  }
+  const env = options.env ?? process.env;
+  const jobId = normalizeOptionalJobId2(options.jobId);
+  const previousProvider = store.getDefaultAiProvider();
+  if (jobId && store.getJobProviderBinding(jobId)) {
+    return runtimeSelectionResult({ reason: "already_bound", ok: true, previousProvider });
+  }
+  const explicit = env.OKX_AGENT_TASK_AI_CLI ?? env.OKX_A2A_AI_PROVIDER;
+  const explicitProvider = explicit ? normalizeAiProvider(explicit) : null;
+  let candidate = null;
+  let bindingSource = null;
+  if (explicitProvider) {
+    candidate = explicitProvider;
+    bindingSource = "explicit_env";
+  } else {
+    const runtime = detectRuntime(env, {
+      parentPid: options.parentPid,
+      readParentProcessCommand: options.readParentProcessCommand
+    });
+    if (runtime !== "unknown") {
+      candidate = runtime;
+      bindingSource = "current_runtime";
+    } else if (previousProvider === "codex") {
+      candidate = "codex";
+      bindingSource = "default_provider";
+    }
+  }
+  if (!candidate) {
+    return runtimeSelectionResult({ reason: "runtime_undetectable", ok: true, previousProvider });
+  }
+  if (candidate !== "codex") {
+    const changed2 = persistDefaultProviderIfChanged(store, candidate);
+    return runtimeSelectionResult({
+      reason: changed2 ? "persisted" : "unchanged",
+      ok: true,
+      provider: candidate,
+      previousProvider,
+      changed: changed2,
+      bindingSource
+    });
+  }
+  const readiness = await ensureProviderReadyForBinding({
+    provider: "codex",
+    store,
+    env,
+    platform: options.platform,
+    readiness: options.readiness,
+    // A validated override must be persisted here: this is exactly the case
+    // where it has to outlive the current process.
+    persistOverrideCommand: true
+  });
+  if (!readiness.ready) {
+    return runtimeSelectionResult({
+      reason: "provider_not_ready",
+      ok: false,
+      previousProvider,
+      bindingSource,
+      readiness,
+      userMessage: `Codex is not ready (${readiness.state}); the default AI provider was not changed. ${readiness.recoveryGuidance}`.trim()
+    });
+  }
+  const commandDurable = readiness.commandPersisted || codexCommandResolvesWithoutOverride(
+    env,
+    store.getAiProviderCommand("codex"),
+    options.platform ?? process.platform
+  );
+  if (!commandDurable) {
+    return runtimeSelectionResult({
+      reason: "command_not_durable",
+      ok: false,
+      previousProvider,
+      bindingSource,
+      readiness,
+      userMessage: "Codex is ready in this shell but only through OKX_A2A_AI_CODEX_COMMAND, which the background daemon does not inherit. The default AI provider was not changed. Run `okx-a2a setup --json` to persist a Codex command the daemon can resolve."
+    });
+  }
+  const changed = persistDefaultProviderIfChanged(store, "codex");
+  return runtimeSelectionResult({
+    reason: changed ? "persisted" : "unchanged",
+    ok: true,
+    provider: "codex",
+    previousProvider,
+    changed,
+    bindingSource,
+    readiness,
+    commandDurable: true
+  });
+}
+async function prepareAndBindCurrentRuntimeForNewJob(options) {
+  const store = options.store ?? null;
+  const jobId = normalizeOptionalJobId2(options.jobId);
+  if (!store || !jobId) {
+    return {
+      ok: false,
+      jobId: jobId ?? "",
+      provider: null,
+      currentProvider: null,
+      created: false,
+      degraded: false,
+      bindingSource: null,
+      readiness: null,
+      reason: "missing_job_id"
+    };
+  }
+  const existing = store.getJobProviderBinding(jobId);
+  if (existing) {
+    return alreadyBoundGateResult(store, jobId, existing.provider, options.env);
+  }
+  const selection = await persistCurrentRuntimeSelectionForNewJob({
+    store,
+    jobId,
+    env: options.env,
+    platform: options.platform,
+    readiness: options.readiness,
+    parentPid: options.parentPid,
+    readParentProcessCommand: options.readParentProcessCommand
+  });
+  if (selection.reason === "already_bound") {
+    const raced = store.getJobProviderBinding(jobId);
+    if (raced) {
+      return alreadyBoundGateResult(store, jobId, raced.provider, options.env);
+    }
+  }
+  if (!selection.ok) {
+    return {
+      ok: false,
+      jobId,
+      provider: null,
+      currentProvider: selection.previousProvider,
+      created: false,
+      degraded: true,
+      bindingSource: null,
+      readiness: selection.readiness,
+      reason: "provider_not_ready"
+    };
+  }
+  if (!selection.provider) {
+    return {
+      ok: false,
+      jobId,
+      provider: null,
+      currentProvider: selection.previousProvider,
+      created: false,
+      degraded: false,
+      bindingSource: null,
+      readiness: selection.readiness,
+      reason: "unknown_runtime"
+    };
+  }
+  return await bindResolvedJobProviderIfReady({
+    store,
+    jobId,
+    provider: normalizeAiProvider(selection.provider),
+    bindingSource: selection.bindingSource ?? "current_runtime",
+    env: options.env,
+    platform: options.platform,
+    readiness: options.readiness,
+    gate: selection.readiness
+  });
+}
+function runtimeSelectionResult(input) {
+  return {
+    ok: input.ok,
+    reason: input.reason,
+    provider: input.provider ?? null,
+    previousProvider: input.previousProvider ?? null,
+    changed: input.changed ?? false,
+    bindingSource: input.bindingSource ?? null,
+    readiness: input.readiness ?? null,
+    commandDurable: input.commandDurable ?? false,
+    userMessage: input.userMessage ?? ""
+  };
+}
+function notRequiredReadinessGate(provider) {
+  return {
+    provider,
+    ready: true,
+    state: "not_required",
+    commandSource: null,
+    commandPersisted: false,
+    recoveryAction: "none",
+    recoveryGuidance: ""
+  };
+}
+function alreadyBoundGateResult(store, jobId, provider, env) {
+  bindHermesJobRouteFromEnvIfAvailable(store, { jobId, provider, env });
+  return {
+    ok: true,
+    jobId,
+    provider,
+    currentProvider: null,
+    created: false,
+    degraded: false,
+    bindingSource: "existing_binding",
+    readiness: null,
+    reason: "already_bound"
+  };
+}
+async function bindResolvedJobProviderIfReady(input) {
+  const gate = input.gate ?? await ensureProviderReadyForBinding({
+    provider: input.provider,
+    store: input.store,
+    env: input.env,
+    platform: input.platform,
+    readiness: input.readiness
+  });
+  logProviderReadinessChecked(input.jobId, gate);
+  if (!gate.ready) {
+    return {
+      ok: false,
+      jobId: input.jobId,
+      provider: null,
+      currentProvider: input.provider,
+      created: false,
+      degraded: true,
+      bindingSource: null,
+      readiness: gate,
+      reason: "provider_not_ready"
+    };
+  }
+  const result = bindJobProviderWithRouteIfAvailable(input.store, {
+    jobId: input.jobId,
+    provider: input.provider,
+    env: input.env,
+    // The gate above just returned ready for this exact provider.
+    readinessVerified: true
+  });
+  const created = result.created;
+  if (created) {
+    logJobProviderBound(input.jobId, result.binding.provider, input.bindingSource, gate);
+  }
+  return {
+    ok: true,
+    jobId: input.jobId,
+    provider: result.binding.provider,
+    currentProvider: input.provider,
+    created,
+    degraded: false,
+    // A concurrent writer won the INSERT: report the row as pre-existing rather
+    // than claiming this call's candidate tier produced it.
+    bindingSource: created ? input.bindingSource : "existing_binding",
+    readiness: gate,
+    reason: created ? "created" : "already_bound"
+  };
+}
+function logProviderReadinessChecked(jobId, gate) {
+  if (gate.state === "not_required") {
+    return;
+  }
+  logger.info(LogEvent.PROVIDER_READINESS_CHECKED, {
+    component: JOB_PROVIDER_BINDING_COMPONENT,
+    jobId,
+    provider: gate.provider,
+    readinessState: gate.state,
+    commandSource: gate.commandSource ?? "",
+    commandPersisted: String(gate.commandPersisted),
+    recoveryAction: gate.recoveryAction,
+    ...logFieldExtras({
+      checkpoint: gate.ready ? "provider_ready" : "provider_not_ready",
+      outcome: gate.ready ? "success" : "failed",
+      transport: "local",
+      eventFamily: "dispatch"
+    })
+  });
+}
+function logJobProviderBound(jobId, provider, bindingSource, gate) {
+  logger.info(LogEvent.JOB_PROVIDER_BOUND, {
+    component: JOB_PROVIDER_BINDING_COMPONENT,
+    jobId,
+    provider,
+    bindingSource,
+    readinessState: gate.state,
+    commandSource: gate.commandSource ?? "",
+    ...logFieldExtras({
+      checkpoint: "job_provider_bound",
+      outcome: "success",
+      transport: "local",
+      eventFamily: "dispatch"
+    })
+  });
+}
+function resolveAiProviderForDispatch(options) {
+  const env = options.env ?? process.env;
+  const jobId = normalizeOptionalJobId2(options.jobId);
+  return resolveDispatchProvider(
+    options,
+    (provider) => bindDispatchProviderIfNeeded(options.store, jobId, env, provider)
+  );
+}
+async function resolveAiProviderForDispatchWithReadiness(options) {
+  const env = options.env ?? process.env;
+  const jobId = normalizeOptionalJobId2(options.jobId);
+  if (!jobId || options.store.getJobProviderBinding(jobId)) {
+    return resolveAiProviderForDispatch(options);
+  }
+  const candidate = resolveDispatchProvider(options, (provider) => provider);
+  if (candidate !== "codex") {
+    return resolveAiProviderForDispatch(options);
+  }
+  let gate = options.readiness ? await ensureProviderReadyForBinding({
+    provider: candidate,
+    store: options.store,
+    env,
+    platform: options.platform,
+    readiness: options.readiness
+  }) : cachedProviderReadinessGate(candidate, env);
+  if (!gate) {
+    gate = await ensureProviderReadyForBinding({
+      provider: candidate,
+      store: options.store,
+      env,
+      platform: options.platform
+    });
+  }
+  logProviderReadinessChecked(jobId, gate);
+  if (!gate.ready) {
+    throw new ProviderNotReadyError(candidate, gate);
+  }
+  return resolveDispatchProvider(
+    options,
+    (provider) => bindDispatchProviderIfNeeded(options.store, jobId, env, provider, true)
+  );
+}
+function cachedProviderReadinessGate(provider, env) {
+  if (provider !== "codex") {
+    return notRequiredReadinessGate(provider);
+  }
+  const cached = readCachedCodexReadiness({ env });
+  return cached ? readinessGateFromResult(cached) : null;
+}
+function assertCodexBindingPermitted(store, input) {
+  if (input.provider !== "codex" || input.readinessVerified) {
+    return;
+  }
+  if (store.getJobProviderBinding?.(input.jobId)) {
+    return;
+  }
+  const cached = readCachedCodexReadiness({ env: input.env ?? process.env });
+  if (cached?.ready) {
+    return;
+  }
+  throw new ProviderNotReadyError(
+    input.provider,
+    cached ? readinessGateFromResult(cached) : unverifiedCodexReadinessGate()
+  );
+}
+function unverifiedCodexReadinessGate() {
+  return {
+    provider: "codex",
+    ready: false,
+    state: "probe_failed",
+    commandSource: null,
+    commandPersisted: false,
+    recoveryAction: "run_setup",
+    recoveryGuidance: "Codex readiness has not been verified for this job, so the binding was refused rather than pinned to a provider that may not be able to run. Run `okx-a2a setup --json` to verify Codex."
+  };
+}
+function readinessGateFromResult(result) {
+  return {
+    provider: result.provider,
+    ready: result.ready,
+    state: result.state,
+    commandSource: result.commandSource,
+    commandPersisted: result.commandPersisted,
+    recoveryAction: result.recoveryAction,
+    recoveryGuidance: result.recoveryGuidance
+  };
+}
+function resolveDispatchProvider(options, bind) {
+  const env = options.env ?? process.env;
+  const commandExists2 = options.commandExists ?? commandExists;
+  const detection = withStoredCodexAvailability(
+    detectAiProviders(commandExists2, env),
+    options.store,
+    commandExists2,
+    env
+  );
+  const jobId = normalizeOptionalJobId2(options.jobId);
+  if (jobId) {
+    const binding = options.store.getJobProviderBinding(jobId);
+    if (binding) {
+      assertInstalled(binding.provider, detection);
+      return binding.provider;
+    }
+  }
+  if (env.OKX_AGENT_TASK_AI_CLI) {
+    const provider = normalizeAiProvider(env.OKX_AGENT_TASK_AI_CLI);
+    assertInstalled(provider, detection);
+    return bind(provider);
+  }
+  if (env.OKX_A2A_AI_PROVIDER) {
+    const provider = normalizeAiProvider(env.OKX_A2A_AI_PROVIDER);
+    assertInstalled(provider, detection);
+    return bind(provider);
+  }
+  if (jobId) {
+    const stored2 = options.store.getDefaultAiProvider();
+    if (stored2) {
+      assertInstalled(stored2, detection);
+      return bind(stored2);
+    }
+  }
+  const current = detectCurrentAiProvider(env);
+  if (current && isInstalled(current, detection)) {
+    return bind(current);
+  }
+  if (options.sessionKey) {
+    const existing = options.store.listAiSessions(options.sessionKey).map((session) => session.provider).filter((provider) => isInstalled(provider, detection));
+    const unique = [...new Set(existing)];
+    if (unique.length === 1) {
+      return bind(unique[0]);
+    }
+  }
+  const stored = options.store.getDefaultAiProvider();
+  if (stored) {
+    assertInstalled(stored, detection);
+    return bind(stored);
+  }
+  if (detection.available.length === 1) {
+    return bind(detection.available[0]);
+  }
+  if (detection.available.length > 1) {
+    throw new Error(
+      `Multiple AI CLIs are installed (${detection.available.join(", ")}) but no current AI environment was detected. Set OKX_A2A_AI_PROVIDER or pass --provider/--ai-provider for this run.`
+    );
+  }
+  throw new Error(`No supported AI CLI found. Install one of: ${AI_PROVIDERS.join(", ")}.`);
+}
+function bindDispatchProviderIfNeeded(store, jobId, env, provider, readinessVerified = false) {
+  if (!jobId) {
+    return provider;
+  }
+  return bindJobProviderWithRouteIfAvailable(store, { jobId, provider, env, readinessVerified }).binding.provider;
+}
+function withStoredCodexAvailability(detection, store, commandExists2, env = process.env, platform = process.platform) {
+  if (detection.codex) {
+    return detection;
+  }
+  const command = store.getAiProviderCommand("codex");
+  if (command && commandExists2(command)) {
+    return withCodexAvailable(detection);
+  }
+  for (const candidate of collectCodexAppBundledCandidates(env, platform)) {
+    if (commandExists2(candidate)) {
+      return withCodexAvailable(detection);
+    }
+  }
+  return detection;
+}
+function withCodexAvailable(detection) {
+  return {
+    ...detection,
+    codex: true,
+    available: detection.available.includes("codex") ? detection.available : ["codex", ...detection.available]
+  };
+}
+function bindJobProviderWithRouteIfAvailable(store, input) {
+  assertCodexBindingPermitted(store, input);
+  const result = store.bindJobProviderIfMissing({
+    jobId: input.jobId,
+    provider: input.provider
+  });
+  const routed = bindHermesJobRouteFromEnvIfAvailable(store, {
+    jobId: input.jobId,
+    provider: result.binding.provider,
+    env: input.env
+  });
+  return routed ? { ...result, binding: routed } : result;
+}
+function bindHermesJobRouteFromEnvIfAvailable(store, input) {
+  if (input.provider !== "hermes" || typeof store.upsertJobGatewayRoute !== "function") {
+    return null;
+  }
+  const route = currentHermesGatewayRouteFromEnv(input.env ?? process.env);
+  if (!route) {
+    return null;
+  }
+  return store.upsertJobGatewayRoute({
+    jobId: input.jobId,
+    provider: "hermes",
+    route
+  });
+}
+function currentHermesGatewayRouteFromEnv(env) {
+  const platform = normalizeOptionalText(env.OKX_A2A_CURRENT_GATEWAY_PLATFORM);
+  const chatId = normalizeOptionalText(env.OKX_A2A_CURRENT_GATEWAY_CHAT_ID);
+  const envGatewaySessionKey = normalizeOptionalText(env.OKX_A2A_CURRENT_GATEWAY_SESSION_KEY);
+  const parsedGatewaySession = parseHermesGatewaySessionKey(envGatewaySessionKey);
+  if (platform && chatId) {
+    const threadId = normalizeOptionalText(env.OKX_A2A_CURRENT_GATEWAY_THREAD_ID) ?? matchingParsedThreadId(parsedGatewaySession, { platform, chatId });
+    return buildHermesGatewayRoute({
+      platform,
+      chatId,
+      threadId,
+      sessionKey: envGatewaySessionKey
+    });
+  }
+  const sessionRoute = routeFromHermesSessionKey(env.HERMES_SESSION_KEY);
+  return sessionRoute ? buildHermesGatewayRoute(sessionRoute) : null;
+}
+function buildHermesGatewayRoute(input) {
+  const threadId = normalizeOptionalText(input.threadId) ?? "";
+  const sessionKey = normalizeOptionalText(input.sessionKey) ?? (threadId ? hermesThreadSessionKey(input.platform, input.chatId, threadId) : `agent:main:${input.platform}:dm:${encodeURIComponent(input.chatId)}`);
+  return {
+    platform: input.platform,
+    chatId: input.chatId,
+    chatName: "",
+    chatType: threadId ? "thread" : "dm",
+    threadId,
+    userId: "",
+    userName: "",
+    sessionKey,
+    gatewaySessionKey: sessionKey
+  };
+}
+function hermesThreadSessionKey(platform, chatId, threadId) {
+  const encodedChatId = encodeURIComponent(chatId);
+  const encodedThreadId = encodeURIComponent(threadId);
+  return platform === "telegram" ? `agent:main:${platform}:dm:${encodedChatId}:${encodedThreadId}` : `agent:main:${platform}:thread:${encodedChatId}:${encodedThreadId}`;
+}
+function routeFromHermesSessionKey(value) {
+  const sessionKey = normalizeOptionalText(value);
+  if (!sessionKey) {
+    return null;
+  }
+  const parsed = parseHermesGatewaySessionKey(sessionKey);
+  return parsed ? { ...parsed, sessionKey } : null;
+}
+function parseHermesGatewaySessionKey(sessionKey) {
+  const normalized = normalizeOptionalText(sessionKey);
+  if (!normalized) {
+    return null;
+  }
+  const parts = normalized.startsWith("agent:") ? normalized.split(":").slice(2) : normalized.split(":");
+  if (parts.length < 3) {
+    return null;
+  }
+  const [platform, scope, ...rest] = parts;
+  if (!platform || platform === "okx-a2a" || platform === "backup" || platform === "job") {
+    return null;
+  }
+  if (scope === "dm" && rest[0]) {
+    return {
+      platform,
+      chatId: safeDecodeURIComponent2(rest[0]),
+      ...platform === "telegram" && rest[1] ? { threadId: safeDecodeURIComponent2(rest.slice(1).join(":")) } : {}
+    };
+  }
+  if (scope === "thread" && rest[0] && rest[1]) {
+    return {
+      platform,
+      chatId: safeDecodeURIComponent2(rest[0]),
+      threadId: safeDecodeURIComponent2(rest.slice(1).join(":"))
+    };
+  }
+  return null;
+}
+function matchingParsedThreadId(parsed, expected) {
+  if (!parsed?.threadId) {
+    return null;
+  }
+  return parsed.platform === expected.platform && parsed.chatId === expected.chatId ? parsed.threadId : null;
+}
+function safeDecodeURIComponent2(value) {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return value;
+  }
+}
+function normalizeOptionalJobId2(value) {
+  const normalized = value?.trim();
+  return normalized ? normalized : null;
+}
+function normalizeOptionalText(value) {
+  const normalized = value?.trim();
+  return normalized ? normalized : null;
+}
+function isInstalled(provider, detection) {
+  return detection.available.includes(provider);
+}
+function assertInstalled(provider, detection) {
+  if (!isInstalled(provider, detection)) {
+    throw new Error(`AI provider "${provider}" is not installed or not on PATH.`);
+  }
+}
+function readProviderCommand(provider, env) {
+  return env[`OKX_A2A_AI_${provider.toUpperCase()}_COMMAND`] ?? provider;
+}
+async function promptForAiProvider(options) {
+  const stdin = options.stdin ?? process.stdin;
+  const stdout = options.stdout ?? process.stdout;
+  if (!stdin.isTTY || !stdout.isTTY) {
+    throw new Error(
+      `No AI provider is configured. Run \`okx-a2a daemon start --ai-provider <${AI_PROVIDERS.join("|")}>\` or set OKX_A2A_AI_PROVIDER.`
+    );
+  }
+  stdout.write("AI provider is required before starting okx-a2a.\n");
+  stdout.write("Tip: if the selected AI provider is unavailable, task processing cannot proceed.\n\n");
+  if (options.currentProvider) {
+    stdout.write(`Current AI provider: ${options.currentProvider}
+
+`);
+  }
+  if (options.detection.available.length === 0) {
+    stdout.write("Supported AI providers:\n");
+    AI_PROVIDERS.forEach((provider, index2) => {
+      const status = isInstalled(provider, options.detection) ? "installed" : "not found on PATH";
+      stdout.write(`  ${index2 + 1}. ${provider} (${status})
+`);
+    });
+    stdout.write("\n");
+    throw new Error(`No supported AI CLI found. Install one of: ${AI_PROVIDERS.join(", ")}.`);
+  }
+  if (typeof stdin.setRawMode === "function") {
+    return promptForAiProviderWithArrows({
+      detection: options.detection,
+      stdin,
+      stdout,
+      currentProvider: options.currentProvider
+    });
+  }
+  stdout.write("Supported AI providers:\n");
+  AI_PROVIDERS.forEach((provider, index2) => {
+    const status = isInstalled(provider, options.detection) ? "installed" : "not found on PATH";
+    stdout.write(`  ${index2 + 1}. ${provider} (${status})
+`);
+  });
+  stdout.write("\n");
+  const rl = (0, import_promises6.createInterface)({ input: stdin, output: stdout });
+  try {
+    while (true) {
+      const answer = (await rl.question("Choose an installed AI provider by number or name: ")).trim();
+      const provider = parseProviderChoice(answer);
+      if (!provider) {
+        stdout.write(`Invalid choice. Use one of: ${AI_PROVIDERS.join(", ")}.
+`);
+        continue;
+      }
+      if (!isInstalled(provider, options.detection)) {
+        stdout.write(`"${provider}" is not installed or not on PATH. Choose an installed provider.
+`);
+        continue;
       }
-      flush() {
-        while (this.buffer.length > 0) {
-          const entry = this.buffer.shift();
-          if (entry.level === "info") {
-            this.captureInfo(entry.message, entry.extra ?? {});
-          } else {
-            this.captureError(entry.message, entry.error, entry.extra ?? {});
-          }
-        }
+      return provider;
+    }
+  } finally {
+    rl.close();
+  }
+}
+async function promptForAiProviderWithArrows(options) {
+  let selectedIndex = AI_PROVIDERS.findIndex((provider) => provider === options.currentProvider && isInstalled(provider, options.detection));
+  if (selectedIndex < 0) {
+    selectedIndex = AI_PROVIDERS.findIndex((provider) => isInstalled(provider, options.detection));
+  }
+  if (selectedIndex < 0) {
+    selectedIndex = 0;
+  }
+  let renderedLines = 0;
+  const render = (message) => {
+    if (renderedLines > 0) {
+      (0, import_node_readline.moveCursor)(options.stdout, 0, -renderedLines);
+      (0, import_node_readline.cursorTo)(options.stdout, 0);
+      (0, import_node_readline.clearScreenDown)(options.stdout);
+    }
+    const lines = [
+      "Use \u2191/\u2193 to move, Enter to confirm.",
+      "",
+      ...AI_PROVIDERS.map((provider, index2) => {
+        const selected = index2 === selectedIndex ? "\u276F" : " ";
+        const status = isInstalled(provider, options.detection) ? "installed" : "not found on PATH";
+        const current = provider === options.currentProvider ? ", current" : "";
+        return `${selected} ${provider} (${status}${current})`;
+      }),
+      ...message ? ["", message] : []
+    ];
+    options.stdout.write(`${lines.join("\n")}
+`);
+    renderedLines = lines.length;
+  };
+  (0, import_node_readline.emitKeypressEvents)(options.stdin);
+  options.stdin.setRawMode(true);
+  options.stdin.resume();
+  options.stdout.write("\x1B[?25l");
+  render();
+  return await new Promise((resolve11, reject) => {
+    const cleanup = () => {
+      options.stdin.off("keypress", onKeypress);
+      options.stdin.setRawMode(false);
+      options.stdin.pause();
+      options.stdout.write("\x1B[?25h");
+    };
+    const clearRendered = () => {
+      if (renderedLines > 0) {
+        (0, import_node_readline.moveCursor)(options.stdout, 0, -renderedLines);
+        (0, import_node_readline.cursorTo)(options.stdout, 0);
+        (0, import_node_readline.clearScreenDown)(options.stdout);
       }
-      static sanitizeExtra(extra) {
-        return Object.fromEntries(
-          Object.entries(extra).filter(([, value]) => value !== void 0).filter(([key]) => !_SentryLogger.isBlockedExtraKey(key)).map(([key, value]) => [key, _SentryLogger.safeValueForKey(key, value)])
+    };
+    const finish = (provider) => {
+      cleanup();
+      clearRendered();
+      options.stdout.write(`Selected AI provider: ${provider}
+`);
+      resolve11(provider);
+    };
+    const onKeypress = (_str, key) => {
+      if (key.ctrl && key.name === "c") {
+        cleanup();
+        clearRendered();
+        options.stdout.write(
+          options.currentProvider ? `AI provider selection cancelled. Keeping current provider: ${options.currentProvider}
+` : "AI provider selection cancelled. No provider was configured.\n"
         );
+        reject(new UserCancelledAiProviderSelectionError());
+        return;
       }
-      static isBlockedExtraKey(key) {
-        const lower = key.toLowerCase();
-        const normalized = _SentryLogger.normalizeSensitiveKey(key);
-        if (SENTRY_EXTRA_BLOCKLIST.has(lower) || SENTRY_EXTRA_BLOCKLIST.has(normalized)) {
-          return true;
-        }
-        if (_SentryLogger.isSafeMetricKey(normalized)) {
-          return false;
-        }
-        return SENTRY_EXTRA_BLOCKED_KEY_PARTS.some((needle) => normalized.includes(needle));
-      }
-      static isSafeMetricKey(normalized) {
-        return /(bytes|count|length|ms|size)$/.test(normalized);
-      }
-      static safeValueForKey(key, value) {
-        if (typeof value === "string" && SENTRY_FULL_STRING_EXTRA_KEYS.has(_SentryLogger.normalizeSensitiveKey(key))) {
-          return value;
-        }
-        return _SentryLogger.safeValue(value);
-      }
-      static normalizeSensitiveKey(key) {
-        return key.toLowerCase().replace(/[^a-z0-9]/g, "");
-      }
-      static safeValue(value) {
-        if (typeof value === "string") {
-          return value.length <= MAX_EXTRA_STRING_LENGTH ? value : `${value.slice(0, MAX_EXTRA_STRING_LENGTH)}...`;
-        }
-        if (value === null || value === void 0 || typeof value === "number" || typeof value === "boolean") {
-          return value;
-        }
-        if (typeof value === "bigint") {
-          return value.toString();
-        }
-        if (value instanceof Error) {
-          return {
-            name: value.name,
-            messageLength: value.message.length
-          };
-        }
-        if (Array.isArray(value)) {
-          return value.slice(0, 20).map((item) => _SentryLogger.safeValue(item));
-        }
-        if (typeof value === "object") {
-          return Object.fromEntries(
-            Object.entries(value).slice(0, 50).filter(([, item]) => item !== void 0).filter(([key]) => !_SentryLogger.isBlockedExtraKey(key)).map(([key, item]) => [key, _SentryLogger.safeValueForKey(key, item)])
-          );
-        }
-        const text = String(value);
-        return text.length <= MAX_EXTRA_STRING_LENGTH ? text : `${text.slice(0, MAX_EXTRA_STRING_LENGTH)}...`;
-      }
-      static tagValue(value) {
-        const text = String(value);
-        return text.length <= MAX_TAG_VALUE_LENGTH ? text : `${text.slice(0, MAX_TAG_VALUE_LENGTH)}...`;
+      if (key.name === "up") {
+        selectedIndex = (selectedIndex + AI_PROVIDERS.length - 1) % AI_PROVIDERS.length;
+        render();
+        return;
       }
-      static normalizeTagKey(key) {
-        return key.replace(/[^A-Za-z0-9_.:-]+/g, "_").slice(0, 32) || "unknown";
+      if (key.name === "down") {
+        selectedIndex = (selectedIndex + 1) % AI_PROVIDERS.length;
+        render();
+        return;
       }
-      static applyDiagnostics(scope, eventName, extra) {
-        const enriched = { eventName, ...extra };
-        for (const [key, value] of Object.entries(enriched)) {
-          if (!SENTRY_TAG_KEYS.has(key)) {
-            continue;
-          }
-          scope.setTag(_SentryLogger.normalizeTagKey(key), _SentryLogger.tagValue(value));
-        }
-        const fingerprint = ["a2a", eventName];
-        for (const key of SENTRY_FINGERPRINT_KEYS) {
-          const value = enriched[key];
-          if (value) {
-            fingerprint.push(`${key}:${_SentryLogger.tagValue(value)}`);
-          }
+      if (key.name === "return" || key.name === "enter") {
+        const provider = AI_PROVIDERS[selectedIndex];
+        if (!isInstalled(provider, options.detection)) {
+          render(`"${provider}" is not installed or not on PATH. Choose an installed provider.`);
+          return;
         }
-        scope.setFingerprint(fingerprint);
-      }
-      static toPascalCase(str) {
-        return str.split(/[\s:]+/).filter(Boolean).map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join("");
-      }
-      static createSentryEvent(eventName) {
-        const err = new Error(eventName);
-        err.name = _SentryLogger.toPascalCase(eventName);
-        err.stack = `${err.name}: ${eventName}`;
-        return err;
+        finish(provider);
       }
     };
-    logger = SentryLogger.getInstance();
-    initLogger = (config) => {
-      return logger.init(config);
+    options.stdin.on("keypress", onKeypress);
+  });
+}
+function parseProviderChoice(answer) {
+  if (!answer) {
+    return null;
+  }
+  const number = Number(answer);
+  if (Number.isInteger(number) && number >= 1 && number <= AI_PROVIDERS.length) {
+    return AI_PROVIDERS[number - 1];
+  }
+  try {
+    return normalizeAiProvider(answer);
+  } catch {
+    return null;
+  }
+}
+var import_node_child_process5, import_promises6, import_node_readline, AI_PROVIDERS, UserCancelledAiProviderSelectionError, JOB_PROVIDER_BINDING_COMPONENT, ProviderNotReadyError;
+var init_ai_provider = __esm({
+  "src/ai-provider.ts"() {
+    "use strict";
+    import_node_child_process5 = require("node:child_process");
+    import_promises6 = require("node:readline/promises");
+    import_node_readline = require("node:readline");
+    init_ai_command();
+    init_codex_readiness();
+    init_sentry_logger();
+    init_log_fields();
+    init_win_spawn();
+    AI_PROVIDERS = ["codex", "claude", "hermes", "openclaw"];
+    UserCancelledAiProviderSelectionError = class extends Error {
+      constructor() {
+        super("AI provider selection cancelled by user.");
+        this.name = "UserCancelledAiProviderSelectionError";
+      }
     };
-    shutdown = () => {
-      return logger.shutdown();
+    JOB_PROVIDER_BINDING_COMPONENT = "node_job_provider_binding";
+    ProviderNotReadyError = class extends Error {
+      provider;
+      readinessState;
+      recoveryAction;
+      commandSource;
+      constructor(provider, gate) {
+        super(`AI provider "${provider}" is not ready (${gate.state}). ${gate.recoveryGuidance}`.trim());
+        this.name = "ProviderNotReadyError";
+        this.provider = provider;
+        this.readinessState = gate.state;
+        this.recoveryAction = gate.recoveryAction;
+        this.commandSource = gate.commandSource;
+      }
     };
-    UNKNOWN_FIELD = "unknown";
   }
 });
 
@@ -31149,7 +32104,7 @@ var init_sentry_config = __esm({
     environment = process.env.SENTRY_ENV === "dev" ? "dev" : "prod";
     SENTRY_CONFIG = {
       projectName: "okx/openclaw-okx-a2a-extension",
-      release: "0.2.2",
+      release: "0.2.3-beta-6f2a8ec2c7-260810184309",
       environment,
       runtimeContainer: normalizeRuntimeContainer(process.env.OKX_A2A_RUNTIME_CONTAINER)
     };
@@ -31362,6 +32317,7 @@ var init_win_native_launcher = __esm({
 var update_cli_exports = {};
 __export(update_cli_exports, {
   assertHermesSetupSupportedOnPlatform: () => assertHermesSetupSupportedOnPlatform,
+  authStatusFromReason: () => authStatusFromReason,
   buildExternalCommandInvocation: () => buildExternalCommandInvocation,
   buildNpmPackageSpec: () => buildNpmPackageSpec,
   buildProviderMismatchWarning: () => buildProviderMismatchWarning,
@@ -31881,7 +32837,7 @@ function authStatusFromReason(reason) {
   if (reason === "provider_cli_login_failed") {
     return "login_failed";
   }
-  if (reason === "provider_cli_login_timeout") {
+  if (reason === "provider_cli_login_timeout" || reason === "provider_cli_auth_status_timeout") {
     return "login_timeout";
   }
   return "blocked";
@@ -31980,8 +32936,13 @@ function quoteUserFacingCommandPath(commandPath) {
   }
   return `"${commandPath}"`;
 }
-async function checkClaudeCliAuthStatus(command) {
-  const result = await runCommandCaptureStatus(command, ["auth", "status", "--json"]);
+async function checkClaudeCliAuthStatus(command, options = {}) {
+  const result = await runCommandCaptureStatus(command, ["auth", "status", "--json"], {
+    timeoutMs: options.timeoutMs ?? PROVIDER_CLI_AUTH_PROBE_TIMEOUT_MS
+  });
+  if (result.errorCode === "ETIMEDOUT") {
+    return { ok: false, reason: "provider_cli_auth_status_timeout", detail: result.detail };
+  }
   if (result.errorCode === "ENOENT") {
     return { ok: false, reason: "provider_cli_missing", detail: result.detail };
   }
@@ -32000,8 +32961,13 @@ async function checkClaudeCliAuthStatus(command) {
 ${result.stdout}`.trim() };
   }
 }
-async function checkCodexCliAuthStatus(command) {
-  const result = await runCommandCaptureStatus(command, ["login", "status"]);
+async function checkCodexCliAuthStatus(command, options = {}) {
+  const result = await runCommandCaptureStatus(command, ["login", "status"], {
+    timeoutMs: options.timeoutMs ?? PROVIDER_CLI_AUTH_PROBE_TIMEOUT_MS
+  });
+  if (result.errorCode === "ETIMEDOUT") {
+    return { ok: false, reason: "provider_cli_auth_status_timeout", detail: result.detail };
+  }
   if (result.errorCode === "ENOENT") {
     return { ok: false, reason: "provider_cli_missing", detail: result.detail };
   }
@@ -32079,7 +33045,7 @@ async function getCurrentNodeCliVersion() {
   return await getGlobalNpmPackageVersion(UPDATE_PACKAGES.node) ?? getBundledNodeCliVersion();
 }
 function getBundledNodeCliVersion() {
-  return true ? "0.2.2" : null;
+  return true ? "0.2.3-beta-6f2a8ec2c7-260810184309" : null;
 }
 function readConfiguredAiProvider() {
   const explicit = process.env.OKX_A2A_AI_PROVIDER || process.env.OKX_AGENT_TASK_AI_CLI;
@@ -32289,7 +33255,7 @@ async function updateHermes(release, options) {
   }
 }
 async function installGatewayPluginForDoctor(target) {
-  const release = isPrereleaseVersion("0.2.2") ? "beta" : "latest";
+  const release = isPrereleaseVersion("0.2.3-beta-6f2a8ec2c7-260810184309") ? "beta" : "latest";
   const insideTargetGateway = detectGatewayInvocation() === target;
   const options = {
     restart: !insideTargetGateway,
@@ -32970,7 +33936,7 @@ async function runCommandCaptureOptional(command, args) {
     });
   });
 }
-async function runCommandCaptureStatus(command, args) {
+async function runCommandCaptureStatus(command, args, options = {}) {
   return await new Promise((resolvePromise) => {
     const invocation = buildExternalCommandInvocation(command, args);
     const child = (0, import_node_child_process8.spawn)(invocation.command, invocation.args, {
@@ -32979,6 +33945,18 @@ async function runCommandCaptureStatus(command, args) {
     });
     let stdout = "";
     let stderr = "";
+    let settled = false;
+    let timeout = null;
+    const settle = (result) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      if (timeout) {
+        clearTimeout(timeout);
+      }
+      resolvePromise(result);
+    };
     child.stdout.setEncoding("utf8");
     child.stderr.setEncoding("utf8");
     child.stdout.on("data", (chunk) => {
@@ -32987,9 +33965,28 @@ async function runCommandCaptureStatus(command, args) {
     child.stderr.on("data", (chunk) => {
       stderr += chunk;
     });
+    if (options.timeoutMs && options.timeoutMs > 0) {
+      const timeoutMs = options.timeoutMs;
+      timeout = setTimeout(() => {
+        killProcessTree(child, "SIGTERM");
+        setTimeout(() => {
+          if (!child.killed || child.exitCode === null) {
+            killProcessTree(child, "SIGKILL");
+          }
+        }, 5e3).unref();
+        settle({
+          code: null,
+          stdout,
+          stderr,
+          detail: `timed out after ${timeoutMs}ms`,
+          errorCode: "ETIMEDOUT"
+        });
+      }, timeoutMs);
+      timeout.unref();
+    }
     child.on("error", (error) => {
       const detail = error.message;
-      resolvePromise({
+      settle({
         code: null,
         stdout,
         stderr,
@@ -33000,7 +33997,7 @@ async function runCommandCaptureStatus(command, args) {
     child.on("close", (code, signal) => {
       const signalDetail = signal ? `signal=${signal}` : "";
       const detail = [stderr.trim(), stdout.trim(), signalDetail].filter(Boolean).join("\n");
-      resolvePromise({
+      settle({
         code,
         stdout,
         stderr,
@@ -33015,7 +34012,7 @@ function buildExternalCommandInvocation(command, args, platform = process.platfo
 function formatExternalCommand(command, args) {
   return [command, ...args].join(" ");
 }
-var import_node_child_process8, import_node_fs22, import_promises11, import_node_os11, import_node_path28, UPDATE_PACKAGES, CODEX_NPM_PACKAGE, OPENCLAW_FORCE_INSTALL_FLAG, OPENCLAW_UNSAFE_INSTALL_FLAG, OKX_A2A_PLUGIN_ID, OPENCLAW_SESSION_DM_SCOPE_CONFIG_PATH, OPENCLAW_SESSION_DM_SCOPE_CONFIG_VALUE, OPENCLAW_PLUGIN_ALLOW_CONFIG_PATH, OPENCLAW_OKX_A2A_CONVERSATION_HOOK_ACCESS_CONFIG_PATH, DEFAULT_AI_PROVIDER_LOGIN_TIMEOUT_MS, SetupBlockedError, redirectCommandStdoutToStderr;
+var import_node_child_process8, import_node_fs22, import_promises11, import_node_os11, import_node_path28, UPDATE_PACKAGES, CODEX_NPM_PACKAGE, OPENCLAW_FORCE_INSTALL_FLAG, OPENCLAW_UNSAFE_INSTALL_FLAG, OKX_A2A_PLUGIN_ID, OPENCLAW_SESSION_DM_SCOPE_CONFIG_PATH, OPENCLAW_SESSION_DM_SCOPE_CONFIG_VALUE, OPENCLAW_PLUGIN_ALLOW_CONFIG_PATH, OPENCLAW_OKX_A2A_CONVERSATION_HOOK_ACCESS_CONFIG_PATH, DEFAULT_AI_PROVIDER_LOGIN_TIMEOUT_MS, PROVIDER_CLI_AUTH_PROBE_TIMEOUT_MS, SetupBlockedError, redirectCommandStdoutToStderr;
 var init_update_cli = __esm({
   "src/update-cli.ts"() {
     "use strict";
@@ -33042,6 +34039,7 @@ var init_update_cli = __esm({
     OPENCLAW_PLUGIN_ALLOW_CONFIG_PATH = "plugins.allow";
     OPENCLAW_OKX_A2A_CONVERSATION_HOOK_ACCESS_CONFIG_PATH = "plugins.entries.okx-a2a.hooks.allowConversationAccess";
     DEFAULT_AI_PROVIDER_LOGIN_TIMEOUT_MS = 3 * 60 * 1e3;
+    PROVIDER_CLI_AUTH_PROBE_TIMEOUT_MS = CODEX_PROBE_TIMEOUT_MS;
     SetupBlockedError = class extends Error {
       result;
       constructor(result) {
@@ -42950,6 +43948,13 @@ __export(index_exports, {
   AgentMessageDirection: () => AgentMessageDirection,
   AiRunner: () => AiRunner,
   BACKUP_JOB_ID: () => BACKUP_JOB_ID,
+  CODEX_APP_DIRS_ENV: () => CODEX_APP_DIRS_ENV,
+  CODEX_AUTH_PROBE_TIMEOUT_MS: () => CODEX_AUTH_PROBE_TIMEOUT_MS,
+  CODEX_COMMAND_SOURCES: () => CODEX_COMMAND_SOURCES,
+  CODEX_PROBE_TIMEOUT_MS: () => CODEX_PROBE_TIMEOUT_MS,
+  CODEX_READINESS_CACHE_TTL_MS: () => CODEX_READINESS_CACHE_TTL_MS,
+  CODEX_READINESS_STATES: () => CODEX_READINESS_STATES,
+  CODEX_RECOVERY_ACTIONS: () => CODEX_RECOVERY_ACTIONS,
   CommandStore: () => CommandStore,
   DEFAULT_AI_PERMISSION_PRESET: () => DEFAULT_AI_PERMISSION_PRESET,
   DEFAULT_OFFLINE_REPLAY_INTERVAL_SEC: () => DEFAULT_OFFLINE_REPLAY_INTERVAL_SEC,
@@ -42959,10 +43964,13 @@ __export(index_exports, {
   HEARTBEAT_GATEWAY_CHECK_TIMEOUT_MS: () => HEARTBEAT_GATEWAY_CHECK_TIMEOUT_MS,
   InboundReplayGate: () => InboundReplayGate,
   InvalidXmtpMessageStore: () => InvalidXmtpMessageStore,
+  JOB_PROVIDER_BINDING_SOURCES: () => JOB_PROVIDER_BINDING_SOURCES,
+  LogEvent: () => LogEvent,
   MESSAGE_ELIGIBLE_OFFLINE_REPLAY_FLAG: () => MESSAGE_ELIGIBLE_OFFLINE_REPLAY_FLAG,
   MESSAGE_ELIGIBLE_OFFLINE_REPLAY_HELP_TOKEN: () => MESSAGE_ELIGIBLE_OFFLINE_REPLAY_HELP_TOKEN,
   NATIVE_LAUNCHER_EXE_NAME: () => NATIVE_LAUNCHER_EXE_NAME,
   OPENCLAW_GATEWAY_ROUTE_GROUP_ID: () => OPENCLAW_GATEWAY_ROUTE_GROUP_ID,
+  ProviderNotReadyError: () => ProviderNotReadyError,
   SYSTEM_NOTIFICATION_SESSION_KEY: () => SYSTEM_NOTIFICATION_SESSION_KEY,
   SessionBusyTracker: () => SessionBusyTracker,
   SessionStore: () => SessionStore,
@@ -42983,15 +43991,20 @@ __export(index_exports, {
   activeDaemonPointerPath: () => activeDaemonPointerPath,
   aiRunSentryExtra: () => aiRunSentryExtra,
   assertHermesSetupSupportedOnPlatform: () => assertHermesSetupSupportedOnPlatform,
+  authStatusFromReason: () => authStatusFromReason,
   bindJobProviderToCurrentDefaultIfMissing: () => bindJobProviderToCurrentDefaultIfMissing,
+  bindJobProviderToCurrentDefaultIfReady: () => bindJobProviderToCurrentDefaultIfReady,
   bindJobProviderToCurrentRuntimeIfMissing: () => bindJobProviderToCurrentRuntimeIfMissing,
+  bindJobProviderToCurrentRuntimeIfReady: () => bindJobProviderToCurrentRuntimeIfReady,
   bindMessageJobProviderToCurrentDefault: () => bindMessageJobProviderToCurrentDefault,
+  bindNewJobProviderIfReady: () => bindNewJobProviderIfReady,
   bindOpenClawGatewayRouteFromEnv: () => bindOpenClawGatewayRouteFromEnv,
   buildAgentMessageNotice: () => buildAgentMessageNotice,
   buildAiAdapterCommand: () => buildAiAdapterCommand,
   buildAiProviderEnv: () => buildAiProviderEnv,
   buildAutostartVbs: () => buildAutostartVbs,
   buildBackupJobSessionKey: () => buildBackupJobSessionKey,
+  buildCodexRecoveryGuidance: () => buildCodexRecoveryGuidance,
   buildDispatchSessionKey: () => buildDispatchSessionKey,
   buildDoctorSentryExtra: () => buildDoctorSentryExtra,
   buildExternalCommandInvocation: () => buildExternalCommandInvocation,
@@ -43020,7 +44033,15 @@ __export(index_exports, {
   callSessionsCreate: () => callSessionsCreate,
   callSessionsDelete: () => callSessionsDelete,
   callSessionsSend: () => callSessionsSend,
+  checkClaudeCliAuthStatus: () => checkClaudeCliAuthStatus,
+  checkCodexCliAuthStatus: () => checkCodexCliAuthStatus,
+  checkCodexReadiness: () => checkCodexReadiness,
   claimActiveDaemon: () => claimActiveDaemon,
+  classifyJobBindingSource: () => classifyJobBindingSource,
+  clearCodexReadinessCache: () => clearCodexReadinessCache,
+  codexCommandResolvesWithoutOverride: () => codexCommandResolvesWithoutOverride,
+  codexReadinessCacheKey: () => codexReadinessCacheKey,
+  collectCodexAppBundledCandidates: () => collectCodexAppBundledCandidates,
   collectCodexCommandCandidates: () => collectCodexCommandCandidates,
   commandExists: () => commandExists,
   createAiToolFailureTracker: () => createAiToolFailureTracker,
@@ -43036,6 +44057,7 @@ __export(index_exports, {
   ensureDaemonReady: () => ensureDaemonReady,
   ensureDefaultAiProvider: () => ensureDefaultAiProvider,
   ensureOpenClawOkxA2aPluginConfig: () => ensureOpenClawOkxA2aPluginConfig,
+  ensureProviderReadyForBinding: () => ensureProviderReadyForBinding,
   ensureWindowsNativeLauncher: () => ensureWindowsNativeLauncher,
   evictPid: () => evictPid,
   exportDiagnosticLogs: () => exportDiagnosticLogs,
@@ -43063,6 +44085,7 @@ __export(index_exports, {
   isDefaultTaskHome: () => isDefaultTaskHome,
   isGatewayAvailableForHeartbeat: () => isGatewayAvailableForHeartbeat,
   isHermesGatewayPluginEnabled: () => isHermesGatewayPluginEnabled,
+  isInfoEventAllowlisted: () => isInfoEventAllowlisted,
   isOfflineReplayForTrigger: () => isOfflineReplayForTrigger,
   isOpenClawA2aPluginAvailable: () => isOpenClawA2aPluginAvailable,
   isOpenClawGatewayAvailable: () => isOpenClawGatewayAvailable,
@@ -43088,11 +44111,15 @@ __export(index_exports, {
   parsePluginYamlVersion: () => parsePluginYamlVersion,
   parseWindowsParentProcessJson: () => parseWindowsParentProcessJson,
   performRuntimeSwitch: () => performRuntimeSwitch,
+  persistCurrentRuntimeSelectionForNewJob: () => persistCurrentRuntimeSelectionForNewJob,
   pickOnchainosWin32Candidate: () => pickOnchainosWin32Candidate,
+  prepareAndBindCurrentRuntimeForNewJob: () => prepareAndBindCurrentRuntimeForNewJob,
   printLogsExportUsage: () => printLogsExportUsage,
   printXmtpTestUsage: () => printXmtpTestUsage,
+  probeCodexAuthStatus: () => probeCodexAuthStatus,
   processFileMessage: () => processFileMessage,
   readAiProviderTimeoutMs: () => readAiProviderTimeoutMs,
+  readCachedCodexReadiness: () => readCachedCodexReadiness,
   readLastLines: () => readLastLines,
   readParentProcessCommandForPlatform: () => readParentProcessCommandForPlatform,
   readUserAttentionWatcherEvent: () => readUserAttentionWatcherEvent,
@@ -43100,14 +44127,19 @@ __export(index_exports, {
   registerUserAttentionWatcher: () => registerUserAttentionWatcher,
   releaseActiveDaemon: () => releaseActiveDaemon,
   removeUserAttentionWatcher: () => removeUserAttentionWatcher,
+  replayScanBackoffMs: () => replayScanBackoffMs,
   reportDoctorRunToSentry: () => reportDoctorRunToSentry,
   reportUserNotificationFailure: () => reportUserNotificationFailure,
   resetMessageEligibleOfflineReplayCapabilityForTests: () => resetMessageEligibleOfflineReplayCapabilityForTests,
   resetResolvedOnchainosBinForTests: () => resetResolvedOnchainosBinForTests,
   resolveAiPermissionPreset: () => resolveAiPermissionPreset,
   resolveAiProviderCommand: () => resolveAiProviderCommand,
+  resolveAiProviderCommandWithSource: () => resolveAiProviderCommandWithSource,
   resolveAiProviderForDispatch: () => resolveAiProviderForDispatch,
+  resolveAiProviderForDispatchWithReadiness: () => resolveAiProviderForDispatchWithReadiness,
+  resolveCodexCommandCandidates: () => resolveCodexCommandCandidates,
   resolveCodexCommandPath: () => resolveCodexCommandPath,
+  resolveCodexCommandSource: () => resolveCodexCommandSource,
   resolveConfiguredAiProvider: () => resolveConfiguredAiProvider,
   resolveConfiguredAiProviderForJob: () => resolveConfiguredAiProviderForJob,
   resolveDirectCommunicationSessionTarget: () => resolveDirectCommunicationSessionTarget,
@@ -43119,6 +44151,7 @@ __export(index_exports, {
   resolveOpenClawGatewayConfig: () => resolveOpenClawGatewayConfig,
   resolveOpenClawGatewayRoute: () => resolveOpenClawGatewayRoute,
   resolveOpenClawGatewayRoutes: () => resolveOpenClawGatewayRoutes,
+  resolveProviderCommandWithSelfHeal: () => resolveProviderCommandWithSelfHeal,
   resolveSystemNotificationTargets: () => resolveSystemNotificationTargets,
   resolveTaskConfigPath: () => resolveTaskConfigPath,
   resolveTaskHome: () => resolveTaskHome,
@@ -43146,6 +44179,8 @@ __export(index_exports, {
   subscribeUserAttentionEvents: () => subscribeUserAttentionEvents,
   summarizeXmtpTestEvents: () => summarizeXmtpTestEvents,
   switchProvider: () => switchProvider,
+  switchProviderWithReadinessGate: () => switchProviderWithReadinessGate,
+  switchProviderWithReadinessGateCore: () => switchProviderWithReadinessGateCore,
   systemdUnitHasCurrentRestartPolicy: () => systemdUnitHasCurrentRestartPolicy,
   toOpenClawGatewaySessionKey: () => toOpenClawGatewaySessionKey,
   toWindowsInvocation: () => toWindowsInvocation,
@@ -43455,8 +44490,8 @@ init_paths();
 init_session_store();
 
 // src/task-config.ts
-var import_node_fs8 = require("node:fs");
-var import_node_path12 = require("node:path");
+var import_node_fs9 = require("node:fs");
+var import_node_path13 = require("node:path");
 init_paths();
 var AI_PERMISSION_PRESETS = ["bypass", "auto"];
 var DEFAULT_AI_PERMISSION_PRESET = "bypass";
@@ -43472,23 +44507,23 @@ function resolveAiPermissionPreset(options = {}) {
 }
 function readAiPermissionPresetFromConfig(homeDir) {
   const configPath = resolveTaskConfigPath(homeDir);
-  if (!(0, import_node_fs8.existsSync)(configPath)) {
+  if (!(0, import_node_fs9.existsSync)(configPath)) {
     return null;
   }
-  const raw = readSimpleTomlStringValue((0, import_node_fs8.readFileSync)(configPath, "utf8"), "ai.permissions", "preset");
+  const raw = readSimpleTomlStringValue((0, import_node_fs9.readFileSync)(configPath, "utf8"), "ai.permissions", "preset");
   return raw ? normalizeAiPermissionPreset(raw, configPath) : null;
 }
 function writeAiPermissionPresetToConfig(homeDir, preset) {
   const normalized = normalizeAiPermissionPreset(preset, "permission preset");
   ensureTaskDir(homeDir);
   const configPath = resolveTaskConfigPath(homeDir);
-  const current = (0, import_node_fs8.existsSync)(configPath) ? (0, import_node_fs8.readFileSync)(configPath, "utf8") : "";
+  const current = (0, import_node_fs9.existsSync)(configPath) ? (0, import_node_fs9.readFileSync)(configPath, "utf8") : "";
   const next = upsertSimpleTomlStringValue(current, "ai.permissions", "preset", normalized);
-  (0, import_node_fs8.writeFileSync)(configPath, next, "utf8");
+  (0, import_node_fs9.writeFileSync)(configPath, next, "utf8");
   return normalized;
 }
 function resolveTaskConfigPath(homeDir) {
-  return (0, import_node_path12.join)(homeDir, "config.toml");
+  return (0, import_node_path13.join)(homeDir, "config.toml");
 }
 function normalizeAiPermissionPreset(value, source) {
   const normalized = value.trim().toLowerCase();
@@ -43598,11 +44633,14 @@ function buildCodexPermissionPrefix(homeDir, cwd, env = process.env, permissionP
     cwd
   ];
 }
+function resolveAdapterProviderCommand(options, homeDir) {
+  const storedCommand = options.provider === "codex" && options.homeDir ? readStoredAiProviderCommand(options.provider, homeDir) : null;
+  return resolveAiProviderCommandWithSource(options.provider, options.env ?? process.env, storedCommand);
+}
 function buildAiAdapterCommand(options) {
   const env = options.env ?? process.env;
   const homeDir = options.homeDir ?? resolveTaskPaths().homeDir;
-  const storedCommand = options.provider === "codex" && options.homeDir ? readStoredAiProviderCommand(options.provider, homeDir) : null;
-  const command = resolveAiProviderCommand(options.provider, env, storedCommand);
+  const { command } = resolveAdapterProviderCommand(options, homeDir);
   const template = readAdapterArgsTemplate(options.provider, !!options.sessionId, env);
   if (template) {
     return {
@@ -43774,6 +44812,7 @@ async function runAiAdapter(options) {
   );
   if (timedOut || exitCode !== 0 || !sessionId) {
     const reason = timedOut ? "timeout" : !sessionId ? "missing_ai_session_id" : "non_zero_exit";
+    const { source: commandSource } = resolveAdapterProviderCommand({ ...options, homeDir }, homeDir);
     logger.error(
       timedOut ? LogEvent.AI_RUN_TIMEOUT : LogEvent.AI_RUN_FAILED,
       new Error(`${options.provider} AI adapter failed: ${reason}`),
@@ -43783,6 +44822,8 @@ async function runAiAdapter(options) {
         provider: options.provider,
         stage: "run_adapter",
         reason,
+        // Category only — never the resolved command, its path or its arguments.
+        commandSource: commandSource ?? "",
         sessionKey: options.sessionKey ?? "",
         timeoutMs: timeoutMs === null ? "" : String(timeoutMs),
         exitCode: exitCode === null ? "null" : String(exitCode),
@@ -44171,6 +45212,10 @@ function aiRunSentryExtra(input) {
     stage: input.stage ?? "",
     checkpoint: input.checkpoint ?? "",
     outcome: input.outcome ?? "",
+    commandSource: input.commandSource ?? "",
+    jobBindingSource: input.jobBindingSource ?? "",
+    recoveryAction: input.recoveryAction ?? "",
+    readinessState: input.readinessState ?? "",
     mode: input.mode ?? "",
     pid: input.pid ?? "",
     runAttempt: input.runAttempt ?? "",
@@ -44206,6 +45251,15 @@ function aiRunDeliveryId(input) {
     sessionKey: input.sessionKey
   });
 }
+function resolveProviderCommandWithSelfHeal(options) {
+  const env = options.env ?? process.env;
+  const storedCommand = options.provider === "codex" ? options.store.getAiProviderCommand(options.provider) : null;
+  const resolved = resolveAiProviderCommandWithSource(options.provider, env, storedCommand, options.platform);
+  if (options.provider === "codex" && resolved.source !== "explicit_override" && resolved.command !== storedCommand && (0, import_node_path16.isAbsolute)(resolved.command)) {
+    options.store.setAiProviderCommand(options.provider, resolved.command);
+  }
+  return { command: resolved.command, commandSource: resolved.source };
+}
 var AiRunner = class {
   homeDir;
   logsDir;
@@ -44351,11 +45405,41 @@ var AiRunner = class {
       storeReadMs = storeReadEndedAt - storeReadStartedAt;
     }
     const resolveStartedAt = Date.now();
-    const provider = resolveAiProviderForDispatch({
-      store: this.sessionStore,
-      sessionKey: request.sessionKey,
-      jobId: request.jobId
-    });
+    const jobBinding = this.readJobProviderBindingForTelemetry(request.jobId);
+    let provider;
+    try {
+      provider = await resolveAiProviderForDispatchWithReadiness({
+        store: this.sessionStore,
+        sessionKey: request.sessionKey,
+        jobId: request.jobId
+      });
+    } catch (err) {
+      const notReady = err instanceof ProviderNotReadyError ? err : null;
+      logger.error(
+        LogEvent.AI_RUN_FAILED,
+        err instanceof Error ? err : new Error(String(err)),
+        aiRunSentryExtra({
+          source: request.source,
+          sessionKey: request.sessionKey,
+          jobId: request.jobId,
+          agentId: request.agentId,
+          messageId: request.messageId,
+          deliveryId,
+          provider: notReady?.provider ?? jobBinding.provider ?? "unknown",
+          stage: "resolve_provider",
+          reason: "provider_not_ready",
+          checkpoint: "ai_run/provider_not_ready",
+          outcome: "failed",
+          runAttempt,
+          jobBindingSource: jobBinding.bindingSource,
+          // Categories only — never the resolved command or its path (NFR-3).
+          readinessState: notReady?.readinessState ?? null,
+          commandSource: notReady?.commandSource ?? null,
+          recoveryAction: notReady?.recoveryAction ?? "run_setup"
+        })
+      );
+      throw err;
+    }
     const sessionMeta = this.sessionStore.getSession(request.sessionKey);
     const existingAiSessionId = this.readRunAiSessionId(provider, request, existing, sessionMeta);
     const runMode = existingAiSessionId ? "resume" : "new";
@@ -44425,7 +45509,7 @@ var AiRunner = class {
         }
       }
     };
-    const command = this.resolveProviderCommand(provider);
+    const { command, commandSource } = this.resolveProviderCommand(provider);
     let stderrText = "";
     let timedOut = false;
     const timeoutMs = readAiProviderTimeoutMs();
@@ -44488,6 +45572,8 @@ var AiRunner = class {
         provider,
         checkpoint: "ai_run/started",
         outcome: "pending",
+        commandSource,
+        jobBindingSource: jobBinding.bindingSource,
         mode: runMode,
         pid: child.pid ?? null,
         runAttempt,
@@ -44601,6 +45687,11 @@ var AiRunner = class {
       stage: "run_ai",
       checkpoint: overrides?.checkpoint ?? "ai_run/failed",
       outcome: overrides?.outcome ?? "failed",
+      // Which tier produced the binary that failed, and how the job picked this
+      // provider — the two dimensions that separate "GUI-only Codex was never
+      // discovered" from "the CLI itself is broken".
+      commandSource,
+      jobBindingSource: jobBinding.bindingSource,
       runAttempt,
       timeoutMs,
       exitCode,
@@ -44946,8 +46037,32 @@ var AiRunner = class {
     return extractAiSessionId(provider, line);
   }
   resolveProviderCommand(provider) {
-    const storedCommand = provider === "codex" ? this.sessionStore.getAiProviderCommand(provider) : null;
-    return resolveAiProviderCommand(provider, process.env, storedCommand);
+    return resolveProviderCommandWithSelfHeal({
+      provider,
+      store: this.sessionStore,
+      env: process.env
+    });
+  }
+  /**
+   * Telemetry-only view of how this run's provider was decided. Never throws: a
+   * store read that fails must not replace the error we are already reporting.
+   */
+  readJobProviderBindingForTelemetry(jobId) {
+    const normalizedJobId = normalizeOptionalText2(jobId);
+    if (normalizedJobId) {
+      try {
+        const bound = this.sessionStore.getJobProviderBinding(normalizedJobId);
+        if (bound) {
+          return { provider: bound.provider, bindingSource: "existing_binding" };
+        }
+      } catch {
+      }
+    }
+    try {
+      return { provider: this.sessionStore.getDefaultAiProvider(), bindingSource: "default_provider" };
+    } catch {
+      return { provider: null, bindingSource: "default_provider" };
+    }
   }
   formatRunTarget(request) {
     if (request.source === "job-dispatch") {
@@ -54754,6 +55869,8 @@ function compareTimestamp(a, b) {
 var DEFAULT_DATA_DIR = resolveA2aTaskPaths().xmtpDir;
 var XMTP_INSTALLATION_WARNING_THRESHOLD = 2;
 var XMTP_INSTALLATION_NEAR_LIMIT_THRESHOLD = 8;
+var REPLAY_SCAN_INITIAL_BACKOFF_MS = 3e4;
+var REPLAY_SCAN_MAX_BACKOFF_MS = 5 * 6e4;
 function cachePath(dataDir, fileName) {
   return (0, import_node_path21.join)(dataDir, fileName);
 }
@@ -55238,6 +56355,13 @@ function parseGroupPayload(content) {
     return null;
   }
 }
+function replayScanBackoffMs(consecutiveFailures) {
+  const exponent = Math.max(0, Math.floor(consecutiveFailures) - 1);
+  return Math.min(
+    REPLAY_SCAN_INITIAL_BACKOFF_MS * 2 ** exponent,
+    REPLAY_SCAN_MAX_BACKOFF_MS
+  );
+}
 function isOfflineReplayForTrigger(trigger) {
   return trigger === "startup";
 }
@@ -55273,6 +56397,11 @@ var XmtpService = class _XmtpService {
   dataDir = DEFAULT_DATA_DIR;
   syncByAddress = /* @__PURE__ */ new Map();
   offlineReplaySingleFlight = new KeyedSingleFlight();
+  replayScanFailuresByAddress = /* @__PURE__ */ new Map();
+  replayScanRetryByAddress = /* @__PURE__ */ new Map();
+  replayScanNowMs = () => Date.now();
+  replayScanSetTimeout = (callback, delayMs) => setTimeout(callback, delayMs);
+  replayScanClearTimeout = (timer) => clearTimeout(timer);
   inboundReplayGates = /* @__PURE__ */ new Map();
   streamRecoveryCleanupByAddress = /* @__PURE__ */ new Map();
   nextClientGeneration = 1;
@@ -55751,6 +56880,8 @@ var XmtpService = class _XmtpService {
         }
         this.clients.delete(address);
         this.inboundReplayGates.delete(address.toLowerCase());
+        this.replayScanFailuresByAddress.delete(address.toLowerCase());
+        this.clearReplayScanRetry(address);
         logger.info(LogEvent.AGENT_CLIENT_REMOVED, {
           ...agentExtras({
             walletAddress: address,
@@ -55965,6 +57096,8 @@ var XmtpService = class _XmtpService {
         await Promise.resolve(oldClient.stop());
         this.clients.delete(address);
         this.inboundReplayGates.delete(addressKey);
+        this.replayScanFailuresByAddress.delete(addressKey);
+        this.clearReplayScanRetry(address);
         logWithTimestamp(
           `[xmtp-sdk] recycle: stopped client: ${address} (agentId=${agentInfo.agentId})`
         );
@@ -56514,6 +57647,60 @@ var XmtpService = class _XmtpService {
     this.clientGenerationByClient.set(client, generation);
     return generation;
   }
+  clearReplayScanRetry(address) {
+    const addressKey = address.toLowerCase();
+    const scheduled = this.replayScanRetryByAddress.get(addressKey);
+    if (!scheduled) {
+      return;
+    }
+    this.replayScanRetryByAddress.delete(addressKey);
+    this.replayScanClearTimeout(scheduled.timer);
+  }
+  scheduleReplayScanRetry(address, expectedClient, clientGeneration, retryTrigger, delayMs) {
+    const addressKey = address.toLowerCase();
+    const scheduled = this.replayScanRetryByAddress.get(addressKey);
+    if (scheduled?.clientGeneration === clientGeneration) {
+      return;
+    }
+    if (scheduled) {
+      this.clearReplayScanRetry(address);
+    }
+    const timer = this.replayScanSetTimeout(() => {
+      const current = this.replayScanRetryByAddress.get(addressKey);
+      if (current?.timer !== timer) {
+        return;
+      }
+      this.replayScanRetryByAddress.delete(addressKey);
+      if (this.clients.get(address) !== expectedClient || this.stoppedAddresses.has(addressKey)) {
+        return;
+      }
+      void this.replayOfflineMessagesForAddressSingleFlight(
+        address,
+        retryTrigger,
+        void 0,
+        expectedClient
+      ).catch((err) => {
+        logWithTimestamp(
+          `[xmtp-sdk:replay:${address}] scheduled replay scan retry failed:`,
+          err
+        );
+        logger.error(
+          LogEvent.OFFLINE_REPLAY_FAILED,
+          err instanceof Error ? err : new Error(String(err)),
+          {
+            walletAddress: address,
+            stage: "offlineReplay/scheduledRetry",
+            outcome: "failed"
+          }
+        );
+      });
+    }, Math.max(0, delayMs));
+    timer.unref?.();
+    this.replayScanRetryByAddress.set(addressKey, {
+      clientGeneration,
+      timer
+    });
+  }
   notifyAgentsWakeupAfterReplay() {
     const notifyAgentsWakeup2 = this.tools.notifyAgentsWakeup;
     const agentIds = this.allAgents.map((agent) => agent.agentId);
@@ -56752,7 +57939,7 @@ var XmtpService = class _XmtpService {
                 String(recovery.recoverySequence),
                 agent
               );
-              if (!recoveryDisposed && this.clients.get(address) === agent) {
+              if (summary.outcome === "completed" && !recoveryDisposed && this.clients.get(address) === agent) {
                 logger.info(LogEvent.AGENT_STREAM_RECOVERY_REPLAY_COMPLETED, {
                   ...agentExtras(identity),
                   clientGeneration: String(clientGeneration),
@@ -56760,7 +57947,9 @@ var XmtpService = class _XmtpService {
                   replayed: String(summary.replayed),
                   skipped: String(summary.skipped),
                   conversationCount: String(summary.conversations),
-                  replayDurationMs: String(summary.durationMs)
+                  replayDurationMs: String(summary.durationMs),
+                  outcome: "success",
+                  replayOutcome: summary.outcome
                 });
               }
             } catch (err) {
@@ -56826,10 +58015,6 @@ var XmtpService = class _XmtpService {
       summary.durationMs = Date.now() - addressReplayStartedAt;
       return summary;
     }
-    const sentAfterNs = BigInt(lastSyncMs) * 1000000n;
-    logWithTimestamp(
-      `${tag} offline_replay_start agentId=${this.getAgentByAddress(address)?.agentId ?? ""} address=${address} since=${formatLogTimestamp2(lastSyncMs)} sinceMs=${lastSyncMs}`
-    );
     const myInboxId = agent.client.inboxId;
     const handlerDeps = {
       myXmtpAddress: address,
@@ -56844,7 +58029,87 @@ var XmtpService = class _XmtpService {
       summary.durationMs = Date.now() - addressReplayStartedAt;
       return summary;
     }
+    const addressKey = address.toLowerCase();
+    const clientGeneration = this.getClientGeneration(agent);
+    const attemptNowMs = this.replayScanNowMs();
+    let priorFailure = this.replayScanFailuresByAddress.get(addressKey);
+    if (priorFailure && priorFailure.clientGeneration !== clientGeneration) {
+      this.replayScanFailuresByAddress.delete(addressKey);
+      this.clearReplayScanRetry(address);
+      priorFailure = void 0;
+    }
+    if (priorFailure && attemptNowMs < priorFailure.nextAttemptAtMs) {
+      priorFailure.suppressedAttempts++;
+      summary.outcome = "suppressed_backoff";
+      summary.failureStage = priorFailure.lastFailureStage;
+      summary.consecutiveFailures = priorFailure.consecutiveFailures;
+      summary.backoffMs = priorFailure.nextAttemptAtMs - attemptNowMs;
+      summary.suppressedAttempts = priorFailure.suppressedAttempts;
+      if (priorFailure.suppressedAttempts === 1) {
+        logWithTimestamp(
+          `${tag} replay scan suppressed stage=${priorFailure.lastFailureStage} consecutiveFailures=${priorFailure.consecutiveFailures} retryInMs=${summary.backoffMs}`
+        );
+      }
+      this.scheduleReplayScanRetry(
+        address,
+        agent,
+        clientGeneration,
+        priorFailure.retryTrigger,
+        summary.backoffMs
+      );
+      summary.durationMs = Date.now() - addressReplayStartedAt;
+      return summary;
+    }
+    const sentAfterNs = BigInt(lastSyncMs) * 1000000n;
+    logWithTimestamp(
+      `${tag} offline_replay_start agentId=${this.getAgentByAddress(address)?.agentId ?? ""} address=${address} since=${formatLogTimestamp2(lastSyncMs)} sinceMs=${lastSyncMs}`
+    );
     let conversations;
+    const recordScanFailure = (stage, err) => {
+      const previous = this.replayScanFailuresByAddress.get(addressKey);
+      const consecutiveFailures = (previous?.consecutiveFailures ?? 0) + 1;
+      const backoffMs = replayScanBackoffMs(consecutiveFailures);
+      const suppressedAttempts = previous?.suppressedAttempts ?? 0;
+      const failureNowMs = this.replayScanNowMs();
+      const retryTrigger = isOfflineReplayForTrigger(trigger) ? "startup" : "periodic_repair";
+      this.replayScanFailuresByAddress.set(addressKey, {
+        clientGeneration,
+        consecutiveFailures,
+        nextAttemptAtMs: failureNowMs + backoffMs,
+        retryTrigger,
+        suppressedAttempts: 0,
+        lastFailureStage: stage
+      });
+      this.scheduleReplayScanRetry(
+        address,
+        agent,
+        clientGeneration,
+        retryTrigger,
+        backoffMs
+      );
+      summary.outcome = stage === "syncAll" ? "sync_failed" : "list_failed";
+      summary.failureStage = stage;
+      summary.consecutiveFailures = consecutiveFailures;
+      summary.backoffMs = backoffMs;
+      summary.suppressedAttempts = suppressedAttempts;
+      logWithTimestamp(`${tag} conversation ${stage} failed, backing off:`, err);
+      logger.error(
+        LogEvent.OFFLINE_REPLAY_FAILED,
+        err instanceof Error ? err : void 0,
+        {
+          walletAddress: address,
+          stage: `offlineReplay/${stage}`,
+          trigger,
+          outcome: "failed",
+          replayOutcome: summary.outcome,
+          consecutiveFailures: String(consecutiveFailures),
+          backoffMs: String(backoffMs),
+          suppressedAttempts: String(suppressedAttempts)
+        }
+      );
+      summary.durationMs = Date.now() - addressReplayStartedAt;
+      return summary;
+    };
     try {
       const syncAllStartedAt = Date.now();
       await agent.client.conversations.syncAll([
@@ -56852,6 +58117,10 @@ var XmtpService = class _XmtpService {
         import_node_bindings2.ConsentState.Unknown
       ]);
       summary.syncAllMs = Date.now() - syncAllStartedAt;
+    } catch (err) {
+      return recordScanFailure("syncAll", err);
+    }
+    try {
       const listStartedAt = Date.now();
       conversations = await agent.client.conversations.list({
         consentStates: [import_node_bindings2.ConsentState.Allowed, import_node_bindings2.ConsentState.Unknown]
@@ -56859,18 +58128,11 @@ var XmtpService = class _XmtpService {
       summary.listMs = Date.now() - listStartedAt;
       summary.conversations = conversations.length;
     } catch (err) {
-      logWithTimestamp(`${tag} conversation sync/list failed, skipping:`, err);
-      logger.error(
-        LogEvent.OFFLINE_REPLAY_FAILED,
-        err instanceof Error ? err : void 0,
-        {
-          walletAddress: address,
-          stage: "syncAll/list"
-        }
-      );
-      summary.durationMs = Date.now() - addressReplayStartedAt;
-      return summary;
+      return recordScanFailure("list", err);
     }
+    const recoveredFailure = this.replayScanFailuresByAddress.get(addressKey);
+    this.replayScanFailuresByAddress.delete(addressKey);
+    this.clearReplayScanRetry(address);
     for (const conv of conversations) {
       try {
         const messagesStartedAt = Date.now();
@@ -57012,8 +58274,15 @@ var XmtpService = class _XmtpService {
       replayed: String(summary.replayed),
       skipped: String(summary.skipped),
       conversationCount: String(summary.conversations),
-      durationMs: String(Date.now() - addressReplayStartedAt)
+      durationMs: String(Date.now() - addressReplayStartedAt),
+      outcome: "success",
+      replayOutcome: "completed",
+      recoveredAfterFailures: String(recoveredFailure?.consecutiveFailures ?? 0),
+      suppressedAttempts: String(recoveredFailure?.suppressedAttempts ?? 0)
     });
+    summary.outcome = "completed";
+    summary.consecutiveFailures = recoveredFailure?.consecutiveFailures;
+    summary.suppressedAttempts = recoveredFailure?.suppressedAttempts;
     summary.durationMs = Date.now() - addressReplayStartedAt;
     const newestSyncMs = this.syncByAddress.get(address) ?? lastSyncMs;
     logWithTimestamp(
@@ -57080,6 +58349,7 @@ var XmtpService = class _XmtpService {
 function createOfflineReplayAddressSummary(address) {
   return {
     address,
+    outcome: "skipped",
     replayed: 0,
     skipped: 0,
     conversations: 0,
@@ -58911,7 +60181,7 @@ function buildConnectParams(config, instanceId, protocolVersion) {
     client: {
       id: "gateway-client",
       displayName: "okx-a2a-node",
-      version: "0.2.2",
+      version: "0.2.3-beta-6f2a8ec2c7-260810184309",
       platform: "node",
       mode: "backend",
       instanceId
@@ -58922,7 +60192,7 @@ function buildConnectParams(config, instanceId, protocolVersion) {
     commands: [],
     permissions: {},
     locale: Intl.DateTimeFormat().resolvedOptions().locale || "en-US",
-    userAgent: `okx-a2a-node/${"0.2.2"}`,
+    userAgent: `okx-a2a-node/${"0.2.3-beta-6f2a8ec2c7-260810184309"}`,
     auth: {
       ...config.token ? { token: config.token } : {},
       ...config.password ? { password: config.password } : {}
@@ -60519,15 +61789,21 @@ async function createGroupForAddress(params) {
     { groupName: params.groupName }
   );
 }
-function bindOutboundJobProviderToCurrentDefault(sessionStore, jobId) {
+async function bindOutboundJobProviderToCurrentDefault(sessionStore, jobId) {
   if (!jobId || jobId === BACKUP_JOB_ID) {
     return;
   }
   try {
-    const result = bindJobProviderToCurrentDefaultIfMissing({
+    const result = await bindNewJobProviderIfReady({
       store: sessionStore,
       jobId
     });
+    if (result?.degraded) {
+      logWithTimestamp(
+        `[okx-agent-task] job provider not ready from outbound-xmtp: job=${jobId} state=${result.readiness?.state ?? "not_required"} recovery=${result.readiness?.recoveryAction ?? "none"}; binding deferred`
+      );
+      return;
+    }
     if (result?.created) {
       logWithTimestamp(`[okx-agent-task] job provider bound from outbound-xmtp: job=${jobId} provider=${result.provider}`);
     }
@@ -61251,7 +62527,7 @@ async function handleXmtpSendCommand(params) {
     const ownedStore2 = params.sessionStore ? null : new SessionStore();
     const sessionStore2 = params.sessionStore ?? ownedStore2;
     try {
-      bindOutboundJobProviderToCurrentDefault(sessionStore2, command.jobId);
+      await bindOutboundJobProviderToCurrentDefault(sessionStore2, command.jobId);
       bindOutboundOpenClawRouteIfCurrent(sessionStore2, command.jobId, command.gatewaySessionKeys);
       return await handleSqliteGroupSendCommand({
         command,
@@ -61265,7 +62541,7 @@ async function handleXmtpSendCommand(params) {
   const ownedStore = params.sessionStore ? null : new SessionStore();
   const sessionStore = params.sessionStore ?? ownedStore;
   try {
-    bindOutboundJobProviderToCurrentDefault(sessionStore, command.jobId);
+    await bindOutboundJobProviderToCurrentDefault(sessionStore, command.jobId);
     bindOutboundOpenClawRouteIfCurrent(sessionStore, command.jobId, command.gatewaySessionKeys);
     const { file, sessionAgentId } = await readFileForSend({
       command,
@@ -63050,41 +64326,76 @@ function upsertDirectCommunicationSession(deps, target) {
     toAgentXmtpAddress: remoteAgent?.communicationAddress ?? null
   });
 }
-function bindMessageJobProviderToCurrentDefault(deps, jobId, stage = "inbound-xmtp") {
+function neutralProviderGateResult(currentProvider) {
+  return {
+    allowed: true,
+    created: false,
+    provider: null,
+    currentProvider,
+    degraded: false,
+    bindingSource: null,
+    readinessState: "not_required",
+    recoveryAction: "none"
+  };
+}
+async function bindMessageJobProviderToCurrentDefault(deps, jobId, stage = "inbound-xmtp", options = {}) {
   const currentProvider = deps.sessionStore?.getDefaultAiProvider() ?? null;
   if (!jobId || jobId === BACKUP_JOB_ID) {
-    return { allowed: true, created: false, provider: null, currentProvider };
+    return neutralProviderGateResult(currentProvider);
   }
   try {
-    const result = bindJobProviderToCurrentDefaultIfMissing({
+    const result = await bindNewJobProviderIfReady({
       store: deps.sessionStore,
-      jobId
+      jobId,
+      env: options.env,
+      platform: options.platform,
+      readiness: options.readiness
     });
     if (!result) {
-      return { allowed: true, created: false, provider: null, currentProvider };
+      return neutralProviderGateResult(currentProvider);
     }
-    if (result?.created) {
+    if (result.degraded) {
+      logWithTimestamp(
+        `[okx-agent-task:${deps.myXmtpAddress}] job provider not ready at ${stage}: job=${shortenLogValue(jobId)} state=${result.readiness?.state ?? "not_required"} recovery=${result.readiness?.recoveryAction ?? "none"}; binding deferred, message still processed`
+      );
+      return {
+        allowed: true,
+        created: false,
+        provider: null,
+        currentProvider,
+        degraded: true,
+        bindingSource: null,
+        readinessState: result.readiness?.state ?? "not_required",
+        recoveryAction: result.readiness?.recoveryAction ?? "none"
+      };
+    }
+    const boundProvider = result.provider ? normalizeAiProvider(result.provider) : null;
+    if (result.created) {
       logWithTimestamp(
-        `[okx-agent-task:${deps.myXmtpAddress}] job provider bound from ${stage}: job=${shortenLogValue(jobId)} provider=${result.provider}`
+        `[okx-agent-task:${deps.myXmtpAddress}] job provider bound from ${stage}: job=${shortenLogValue(jobId)} provider=${boundProvider}`
       );
     }
-    if (currentProvider && result.provider !== currentProvider) {
+    if (currentProvider && boundProvider !== currentProvider) {
       logWithTimestamp(
-        `[okx-agent-task:${deps.myXmtpAddress}] job provider owner differs from default at ${stage}: job=${shortenLogValue(jobId)} owner=${result.provider} default=${currentProvider}; dispatch will use owner binding`
+        `[okx-agent-task:${deps.myXmtpAddress}] job provider owner differs from default at ${stage}: job=${shortenLogValue(jobId)} owner=${boundProvider} default=${currentProvider}; dispatch will use owner binding`
       );
     }
     return {
       allowed: true,
       created: result.created,
-      provider: result.provider,
-      currentProvider
+      provider: boundProvider,
+      currentProvider,
+      degraded: false,
+      bindingSource: result.bindingSource,
+      readinessState: result.readiness?.state ?? "not_required",
+      recoveryAction: result.readiness?.recoveryAction ?? "none"
     };
   } catch (err) {
     logWithTimestamp(
       `[okx-agent-task:${deps.myXmtpAddress}] job provider bind failed from ${stage}: job=${shortenLogValue(jobId)}`,
       err
     );
-    return { allowed: true, created: false, provider: null, currentProvider };
+    return neutralProviderGateResult(currentProvider);
   }
 }
 function isCanonicalJobPeerSessionKey(sessionKey) {
@@ -63366,7 +64677,7 @@ async function dispatchDirectToUserNotification(params) {
     ...extra
   });
   const providerBindStartedAt = Date.now();
-  const providerGate = bindMessageJobProviderToCurrentDefault(deps, notification.jobId, "direct-to-user");
+  const providerGate = await bindMessageJobProviderToCurrentDefault(deps, notification.jobId, "direct-to-user");
   timing.mark("providerBind", providerBindStartedAt);
   logger.info(LogEvent.SYSTEM_NOTIFICATION_RECEIVED, commonExtras({
     ...inboundStageExtras("inbound/direct_to_user_received", "success"),
@@ -63880,7 +65191,7 @@ async function processFileMessage(ctx, deps, options = {}) {
       return true;
     }
     const providerBindStartedAt = Date.now();
-    const providerGate = bindMessageJobProviderToCurrentDefault(deps, systemNotification.jobId, "system-notification");
+    const providerGate = await bindMessageJobProviderToCurrentDefault(deps, systemNotification.jobId, "system-notification");
     timing.mark("providerBind", providerBindStartedAt);
     if (!providerGate.allowed) {
       logger.info(LogEvent.INBOUND_IGNORED_NON_BUSINESS, timing.extras({
@@ -64001,7 +65312,7 @@ async function processFileMessage(ctx, deps, options = {}) {
   timing.mark("routeResolve", routeStartedAt);
   if (route.route === "job") {
     const providerBindStartedAt = Date.now();
-    const providerGate = bindMessageJobProviderToCurrentDefault(deps, route.jobId, "inbound-xmtp");
+    const providerGate = await bindMessageJobProviderToCurrentDefault(deps, route.jobId, "inbound-xmtp");
     timing.mark("providerBind", providerBindStartedAt);
     if (!providerGate.allowed) {
       logger.info(LogEvent.INBOUND_IGNORED_NON_BUSINESS, timing.extras({
@@ -64920,12 +66231,12 @@ async function runListenerWithLock(options, paths) {
       });
     }
   });
-  service.setPluginVersion("0.2.2");
+  service.setPluginVersion("0.2.3-beta-6f2a8ec2c7-260810184309");
   await service.init();
   const pluginVersionStatus = service.pluginVersionStatus;
   if (pluginVersionStatus.unavailable) {
     throw new Error(
-      `@okxweb3/a2a-node v${"0.2.2"} is below the required minimum v${pluginVersionStatus.minVersion}`
+      `@okxweb3/a2a-node v${"0.2.3-beta-6f2a8ec2c7-260810184309"} is below the required minimum v${pluginVersionStatus.minVersion}`
     );
   }
   const systemConfig = service.getSystemConfig();
@@ -64943,7 +66254,7 @@ async function runListenerWithLock(options, paths) {
       onchainosAgentId: "*",
       reason: "system-config missing sentryDsn",
       pluginId: "@okxweb3/a2a-node",
-      pluginVersion: "0.2.2"
+      pluginVersion: "0.2.3-beta-6f2a8ec2c7-260810184309"
     });
   }
   logWithTimestamp(
@@ -66210,6 +67521,32 @@ function validTimestamp(value) {
 init_session_store();
 init_ai_provider();
 init_ai_command();
+init_codex_readiness();
+
+// src/codex-readiness-types.ts
+var CODEX_COMMAND_SOURCES = [
+  "explicit_override",
+  "persisted",
+  "path",
+  "app_bundled"
+];
+var CODEX_READINESS_STATES = [
+  "ready",
+  "not_installed",
+  "not_authenticated",
+  "probe_timeout",
+  "probe_failed"
+];
+var CODEX_RECOVERY_ACTIONS = ["none", "run_setup", "run_login", "install_cli"];
+var JOB_PROVIDER_BINDING_SOURCES = [
+  "existing_binding",
+  "current_runtime",
+  "default_provider",
+  "explicit_env"
+];
+
+// src/index.ts
+init_sentry_logger();
 init_update_cli();
 init_win_spawn();
 
@@ -67563,7 +68900,7 @@ async function exportDiagnosticLogs(options) {
     node: process.version,
     platform: process.platform,
     arch: process.arch,
-    packageVersion: true ? "0.2.2" : "unknown",
+    packageVersion: true ? "0.2.3-beta-6f2a8ec2c7-260810184309" : "unknown",
     sensitiveContentIncluded: options.includeSensitiveContent,
     listenerAndLlmContentIncluded: true,
     credentialsAlwaysRedacted: true,
@@ -68432,6 +69769,7 @@ init_log();
 init_win_compat();
 init_ai_command();
 init_ai_provider();
+init_codex_readiness();
 init_autostart();
 init_autostart_windows();
 init_daemon();
@@ -68465,11 +69803,70 @@ async function refreshAgentsAndWait(timeoutMs = 6e4) {
 
 // src/runtime-switch.ts
 init_ai_provider();
-async function performRuntimeSwitch(store) {
-  const result = switchProvider({ store, env: process.env });
+init_sentry_logger();
+init_log_fields();
+var RUNTIME_SWITCH_COMPONENT = "node_runtime_switch";
+async function performRuntimeSwitch(store, options = {}) {
+  const result = await switchProviderWithReadinessGate({
+    store,
+    env: options.env ?? process.env,
+    platform: options.platform,
+    readiness: options.readiness
+  });
   await dispatchRuntimeSwitchUserMessage(store, result);
   return result;
 }
+async function switchProviderWithReadinessGate(options) {
+  const gated = await switchProviderWithReadinessGateCore(options);
+  emitRuntimeSwitchCheckpoints(gated);
+  return gated.result;
+}
+function emitRuntimeSwitchCheckpoints(gated) {
+  const { result, runtime, readiness } = gated;
+  logger.info(LogEvent.RUNTIME_DETECTED, {
+    component: RUNTIME_SWITCH_COMPONENT,
+    provider: runtime,
+    detectedProvider: runtime,
+    ...logFieldExtras({
+      checkpoint: "runtime_detected",
+      outcome: runtime === "unknown" ? "ignored" : "success",
+      transport: "cli",
+      eventFamily: "lifecycle"
+    })
+  });
+  if (readiness) {
+    logger.info(LogEvent.PROVIDER_READINESS_CHECKED, {
+      component: RUNTIME_SWITCH_COMPONENT,
+      provider: readiness.provider,
+      readinessState: readiness.state,
+      commandSource: readiness.commandSource ?? "",
+      commandPersisted: String(readiness.commandPersisted),
+      recoveryAction: readiness.recoveryAction,
+      ...logFieldExtras({
+        checkpoint: readiness.ready ? "provider_ready" : "provider_not_ready",
+        outcome: readiness.ready ? "success" : "failed",
+        transport: "cli",
+        eventFamily: "lifecycle"
+      })
+    });
+  }
+  if (result.ok && result.action === "switched") {
+    logger.info(LogEvent.PROVIDER_SWITCHED, {
+      component: RUNTIME_SWITCH_COMPONENT,
+      provider: result.provider,
+      previousProvider: result.previousProvider ?? "",
+      changed: String(result.changed),
+      readinessState: result.readinessState ?? "not_required",
+      commandSource: result.commandSource ?? "",
+      ...logFieldExtras({
+        checkpoint: "provider_switched",
+        outcome: "success",
+        transport: "cli",
+        eventFamily: "lifecycle"
+      })
+    });
+  }
+}
 async function dispatchRuntimeSwitchUserMessage(store, result) {
   if (!result.ok || !result.changed || !result.userMessage) {
     return;
@@ -68803,20 +70200,34 @@ var providerBindingChecker = {
     }
   }
 };
+function resolveProviderCliTarget(env, store) {
+  const runtime = detectRuntime(env);
+  if (runtime === "codex" || runtime === "claude") {
+    return runtime;
+  }
+  if (runtime !== "unknown") {
+    return null;
+  }
+  const storedDefault = store.getDefaultAiProvider();
+  return storedDefault === "codex" || storedDefault === "claude" ? storedDefault : null;
+}
+function readProviderCliTarget(env) {
+  const store = new SessionStore();
+  try {
+    const provider = resolveProviderCliTarget(env, store);
+    return {
+      provider,
+      storedCommand: provider ? store.getAiProviderCommand(provider) : null
+    };
+  } finally {
+    store.close();
+  }
+}
 var providerCliChecker = {
   id: "provider_cli",
   title: "AI provider CLI",
   run: async (ctx) => {
-    const store = new SessionStore();
-    let provider;
-    let storedCommand;
-    try {
-      provider = store.getDefaultAiProvider();
-      provider = provider === "codex" || provider === "claude" ? provider : null;
-      storedCommand = provider ? store.getAiProviderCommand(provider) : null;
-    } finally {
-      store.close();
-    }
+    const { provider, storedCommand } = readProviderCliTarget(ctx.env);
     if (!provider) {
       return null;
     }
@@ -68839,12 +70250,29 @@ var providerCliChecker = {
     }
     const auth = provider === "codex" ? await checkCodexCliAuthStatus(resolved) : await checkClaudeCliAuthStatus(resolved);
     if (auth.ok) {
+      if (provider === "codex" && ctx.env.OKX_A2A_AI_CODEX_COMMAND && storedCommand !== resolved) {
+        return {
+          id: "provider_cli",
+          title: "AI provider CLI",
+          status: "fail",
+          severity: "required",
+          detail: "codex CLI is authenticated but its command is not persisted for the background daemon",
+          fix: {
+            kind: "auto",
+            description: "Persist the validated Codex command for background daemon use."
+          },
+          data: { provider }
+        };
+      }
       return {
         id: "provider_cli",
         title: "AI provider CLI",
         status: "pass",
         severity: "required",
-        detail: `${provider} CLI at ${resolved} is logged in`,
+        // `detail` is forwarded to Sentry (doctor-sentry.ts), so it carries no
+        // resolved path or arguments. The exact command stays in `data`, which is
+        // local report output only.
+        detail: `${provider} CLI is installed and logged in`,
         data: { provider, command: resolved }
       };
     }
@@ -68855,7 +70283,8 @@ var providerCliChecker = {
       title: "AI provider CLI",
       status: "fail",
       severity: "required",
-      detail: `${provider} CLI at ${resolved} is not logged in (${auth.reason})`,
+      // No resolved path in `detail`: it is forwarded to Sentry.
+      detail: `${provider} CLI is installed but not logged in (${auth.reason})`,
       // Logging in needs a human (device/browser auth). In --non-interactive
       // mode never launch it — degrade to a manual instruction so unattended
       // callers (install scripts) cannot hang waiting on stdin.
@@ -68872,18 +70301,9 @@ var providerCliChecker = {
     };
   },
   applyFix: async (ctx) => {
-    const store = new SessionStore();
-    let provider;
-    let storedCommand;
-    try {
-      provider = store.getDefaultAiProvider();
-      provider = provider === "codex" || provider === "claude" ? provider : null;
-      storedCommand = provider ? store.getAiProviderCommand(provider) : null;
-    } finally {
-      store.close();
-    }
+    const { provider, storedCommand } = readProviderCliTarget(ctx.env);
     if (!provider) {
-      throw new Error("no codex/claude provider bound");
+      throw new Error("no codex/claude runtime detected and no codex/claude provider bound");
     }
     const resolveCli = () => provider === "codex" ? resolveCodexCommandPath(ctx.env, storedCommand, ctx.platform) : resolveCommandPath(resolveAiProviderCommand(provider, ctx.env, storedCommand, ctx.platform), ctx.env, ctx.platform);
     let resolved = resolveCli();
@@ -68918,6 +70338,28 @@ var providerCliChecker = {
       }
       steps.push("completed interactive login");
     }
+    if (provider === "codex") {
+      const store = new SessionStore();
+      try {
+        const readiness = await checkCodexReadiness({
+          store,
+          env: ctx.env,
+          platform: ctx.platform,
+          forceRefresh: true,
+          persistOverrideCommand: true
+        });
+        if (!readiness.ready) {
+          throw new Error(
+            `codex readiness could not be confirmed (${readiness.state}); ${readiness.recoveryGuidance}`.trim()
+          );
+        }
+        if (readiness.commandPersisted) {
+          steps.push("persisted the validated codex command");
+        }
+      } finally {
+        store.close();
+      }
+    }
     return steps.length > 0 ? steps.join("; ") : "CLI already installed and logged in";
   }
 };
@@ -69274,8 +70716,14 @@ var CHECKERS = [
   npmChecker,
   cliVersionChecker,
   windowsNativeLauncherChecker,
-  providerBindingChecker,
+  // provider_cli BEFORE provider_binding, deliberately: the intended runtime has
+  // to be installed, authenticated and durably persisted before the binding fixer
+  // attempts its readiness-gated runtime switch. In the other order the switch
+  // fails on a not-ready Codex, preserves the stale default, and the CLI checker
+  // then inspects that stale provider instead of the detected one — so Codex is
+  // never repaired and the run never converges.
   providerCliChecker,
+  providerBindingChecker,
   gatewayPluginChecker,
   gatewayConfigChecker,
   autostartChecker,
@@ -69288,7 +70736,7 @@ async function runDoctor(options = {}) {
     platform: options.platform ?? process.platform,
     env: options.env ?? process.env,
     target: options.target ?? resolveDoctorTarget(options.env ?? process.env),
-    cliVersion: options.cliVersion ?? (true ? "0.2.2" : "0.0.0"),
+    cliVersion: options.cliVersion ?? (true ? "0.2.3-beta-6f2a8ec2c7-260810184309" : "0.0.0"),
     fixMode: options.fix === true,
     nonInteractive: options.nonInteractive === true,
     packageChanged: false,
@@ -69513,6 +70961,13 @@ init_autostart_windows();
   AgentMessageDirection,
   AiRunner,
   BACKUP_JOB_ID,
+  CODEX_APP_DIRS_ENV,
+  CODEX_AUTH_PROBE_TIMEOUT_MS,
+  CODEX_COMMAND_SOURCES,
+  CODEX_PROBE_TIMEOUT_MS,
+  CODEX_READINESS_CACHE_TTL_MS,
+  CODEX_READINESS_STATES,
+  CODEX_RECOVERY_ACTIONS,
   CommandStore,
   DEFAULT_AI_PERMISSION_PRESET,
   DEFAULT_OFFLINE_REPLAY_INTERVAL_SEC,
@@ -69522,10 +70977,13 @@ init_autostart_windows();
   HEARTBEAT_GATEWAY_CHECK_TIMEOUT_MS,
   InboundReplayGate,
   InvalidXmtpMessageStore,
+  JOB_PROVIDER_BINDING_SOURCES,
+  LogEvent,
   MESSAGE_ELIGIBLE_OFFLINE_REPLAY_FLAG,
   MESSAGE_ELIGIBLE_OFFLINE_REPLAY_HELP_TOKEN,
   NATIVE_LAUNCHER_EXE_NAME,
   OPENCLAW_GATEWAY_ROUTE_GROUP_ID,
+  ProviderNotReadyError,
   SYSTEM_NOTIFICATION_SESSION_KEY,
   SessionBusyTracker,
   SessionStore,
@@ -69546,15 +71004,20 @@ init_autostart_windows();
   activeDaemonPointerPath,
   aiRunSentryExtra,
   assertHermesSetupSupportedOnPlatform,
+  authStatusFromReason,
   bindJobProviderToCurrentDefaultIfMissing,
+  bindJobProviderToCurrentDefaultIfReady,
   bindJobProviderToCurrentRuntimeIfMissing,
+  bindJobProviderToCurrentRuntimeIfReady,
   bindMessageJobProviderToCurrentDefault,
+  bindNewJobProviderIfReady,
   bindOpenClawGatewayRouteFromEnv,
   buildAgentMessageNotice,
   buildAiAdapterCommand,
   buildAiProviderEnv,
   buildAutostartVbs,
   buildBackupJobSessionKey,
+  buildCodexRecoveryGuidance,
   buildDispatchSessionKey,
   buildDoctorSentryExtra,
   buildExternalCommandInvocation,
@@ -69583,7 +71046,15 @@ init_autostart_windows();
   callSessionsCreate,
   callSessionsDelete,
   callSessionsSend,
+  checkClaudeCliAuthStatus,
+  checkCodexCliAuthStatus,
+  checkCodexReadiness,
   claimActiveDaemon,
+  classifyJobBindingSource,
+  clearCodexReadinessCache,
+  codexCommandResolvesWithoutOverride,
+  codexReadinessCacheKey,
+  collectCodexAppBundledCandidates,
   collectCodexCommandCandidates,
   commandExists,
   createAiToolFailureTracker,
@@ -69599,6 +71070,7 @@ init_autostart_windows();
   ensureDaemonReady,
   ensureDefaultAiProvider,
   ensureOpenClawOkxA2aPluginConfig,
+  ensureProviderReadyForBinding,
   ensureWindowsNativeLauncher,
   evictPid,
   exportDiagnosticLogs,
@@ -69626,6 +71098,7 @@ init_autostart_windows();
   isDefaultTaskHome,
   isGatewayAvailableForHeartbeat,
   isHermesGatewayPluginEnabled,
+  isInfoEventAllowlisted,
   isOfflineReplayForTrigger,
   isOpenClawA2aPluginAvailable,
   isOpenClawGatewayAvailable,
@@ -69651,11 +71124,15 @@ init_autostart_windows();
   parsePluginYamlVersion,
   parseWindowsParentProcessJson,
   performRuntimeSwitch,
+  persistCurrentRuntimeSelectionForNewJob,
   pickOnchainosWin32Candidate,
+  prepareAndBindCurrentRuntimeForNewJob,
   printLogsExportUsage,
   printXmtpTestUsage,
+  probeCodexAuthStatus,
   processFileMessage,
   readAiProviderTimeoutMs,
+  readCachedCodexReadiness,
   readLastLines,
   readParentProcessCommandForPlatform,
   readUserAttentionWatcherEvent,
@@ -69663,14 +71140,19 @@ init_autostart_windows();
   registerUserAttentionWatcher,
   releaseActiveDaemon,
   removeUserAttentionWatcher,
+  replayScanBackoffMs,
   reportDoctorRunToSentry,
   reportUserNotificationFailure,
   resetMessageEligibleOfflineReplayCapabilityForTests,
   resetResolvedOnchainosBinForTests,
   resolveAiPermissionPreset,
   resolveAiProviderCommand,
+  resolveAiProviderCommandWithSource,
   resolveAiProviderForDispatch,
+  resolveAiProviderForDispatchWithReadiness,
+  resolveCodexCommandCandidates,
   resolveCodexCommandPath,
+  resolveCodexCommandSource,
   resolveConfiguredAiProvider,
   resolveConfiguredAiProviderForJob,
   resolveDirectCommunicationSessionTarget,
@@ -69682,6 +71164,7 @@ init_autostart_windows();
   resolveOpenClawGatewayConfig,
   resolveOpenClawGatewayRoute,
   resolveOpenClawGatewayRoutes,
+  resolveProviderCommandWithSelfHeal,
   resolveSystemNotificationTargets,
   resolveTaskConfigPath,
   resolveTaskHome,
@@ -69709,6 +71192,8 @@ init_autostart_windows();
   subscribeUserAttentionEvents,
   summarizeXmtpTestEvents,
   switchProvider,
+  switchProviderWithReadinessGate,
+  switchProviderWithReadinessGateCore,
   systemdUnitHasCurrentRestartPolicy,
   toOpenClawGatewaySessionKey,
   toWindowsInvocation,