@openclaw/acpx 2026.9.1-beta.1 → 2026.9.2

package/dist/{service-PRlUtXMf.js → service-COMUTA5A.js}

@@ -1,7 +1,8 @@
-import { n as createLazyAcpRuntimeProxy } from "./register.runtime-Dj29TKFy.js";
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { n as createLazyAcpRuntimeProxy } from "./register.runtime-Ba7FPMGu.js";
 import "./config-schema-DN_uAi4R.js";
-import { _ as quoteCommandPart, a as createAcpxProcessLeaseStore, f as ACPX_GATEWAY_INSTANCE_KEY, g as normalizeAcpxGatewayInstanceRecord, l as openAcpxProcessLeaseStateStore, n as OPENCLAW_ACPX_LEASE_ID_ARG, p as ACPX_GATEWAY_INSTANCE_NAMESPACE, r as OPENCLAW_GATEWAY_INSTANCE_ID_ARG, v as splitCommandParts } from "./process-lease-Cwvj7WGe.js";
-import { a as resolveAcpxPluginConfig, c as CODEX_ACP_BIN, d as OPENCLAW_CODEX_CONFIG_ARG, i as reapStaleOpenClawOwnedAcpxOrphans, l as CODEX_ACP_PACKAGE, n as cleanupOpenClawOwnedAcpxProcessTree, o as resolveAcpxPluginRoot, s as toAcpMcpServers, t as cleanupOpenClawOwnedAcpxPendingLease, u as LEGACY_CODEX_ACP_PACKAGE } from "./process-reaper-DduWm_7N.js";
+import { _ as quoteCommandPart, a as createAcpxProcessLeaseStore, f as ACPX_GATEWAY_INSTANCE_KEY, g as normalizeAcpxGatewayInstanceRecord, l as openAcpxProcessLeaseStateStore, n as OPENCLAW_ACPX_LEASE_ID_ARG, p as ACPX_GATEWAY_INSTANCE_NAMESPACE, r as OPENCLAW_GATEWAY_INSTANCE_ID_ARG, u as readAcpxProcessLeaseIdentity, v as splitCommandParts } from "./process-lease-Cwvj7WGe.js";
+import { n as resolveAcpxPluginRoot, r as toAcpMcpServers, t as resolveAcpxPluginConfig } from "./config-v8M2tNu6.js";
 import { createRequire } from "node:module";
 import { finiteSecondsToTimerSafeMilliseconds } from "openclaw/plugin-sdk/number-runtime";
 import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
@@ -11,10 +12,335 @@ import os from "node:os";
 import path from "node:path";
 import fs$1 from "node:fs/promises";
 import { randomUUID } from "node:crypto";
+import { isPidAlive, runExec } from "openclaw/plugin-sdk/process-runtime";
 import { inspect } from "node:util";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { readJsonFileWithFallback } from "openclaw/plugin-sdk/json-store";
 import { parse, stringify } from "smol-toml";
+//#region extensions/acpx/src/codex-adapter.ts
+const CODEX_ACP_PACKAGE = "@agentclientprotocol/codex-acp";
+const CODEX_ACP_BIN = "codex-acp";
+const LEGACY_CODEX_ACP_PACKAGE = "@zed-industries/codex-acp";
+const OPENCLAW_CODEX_CONFIG_ARG = "--openclaw-codex-config";
+//#endregion
+//#region extensions/acpx/src/process-reaper.ts
+/**
+* ACPX process ownership checks and cleanup. The reaper only terminates
+* OpenClaw-owned wrapper trees after validating paths, packages, and lease ids.
+*/
+const requireFromHere$1 = createRequire(import.meta.url);
+const GENERATED_WRAPPER_BASENAMES = /* @__PURE__ */ new Set(["codex-acp-wrapper.mjs", "claude-agent-acp-wrapper.mjs"]);
+const OPENCLAW_PLUGIN_DEPS_MARKER = "/plugin-runtime-deps/";
+const ACPX_PROCESS_LIST_TIMEOUT_MS = 2e3;
+const OWNED_ACP_PACKAGE_NAMES = [
+	CODEX_ACP_PACKAGE,
+	LEGACY_CODEX_ACP_PACKAGE,
+	"@zed-industries/codex-acp-darwin-arm64",
+	"@zed-industries/codex-acp-darwin-x64",
+	"@zed-industries/codex-acp-linux-arm64",
+	"@zed-industries/codex-acp-linux-x64",
+	"@zed-industries/codex-acp-win32-arm64",
+	"@zed-industries/codex-acp-win32-x64",
+	"@agentclientprotocol/claude-agent-acp",
+	"acpx"
+];
+const PLUGIN_DEPS_CODEX_PACKAGE_NAMES = [
+	"@openai/codex",
+	"@openai/codex-darwin-arm64",
+	"@openai/codex-darwin-x64",
+	"@openai/codex-linux-arm64",
+	"@openai/codex-linux-x64",
+	"@openai/codex-win32-arm64",
+	"@openai/codex-win32-x64"
+];
+const ACP_PACKAGE_MARKERS = [
+	...OWNED_ACP_PACKAGE_NAMES.map((packageName) => `/node_modules/${packageName}/`),
+	...PLUGIN_DEPS_CODEX_PACKAGE_NAMES.map((packageName) => `/node_modules/${packageName}/`),
+	"/acpx/dist/"
+];
+function normalizePathLike(value) {
+	return value.replaceAll("\\", "/");
+}
+function resolvePackageRoot(packageName) {
+	try {
+		return normalizePathLike(path.dirname(requireFromHere$1.resolve(`${packageName}/package.json`)));
+	} catch {
+		return;
+	}
+}
+function resolveOpenClawInstallRoot(pluginRoot) {
+	if (path.basename(pluginRoot) === "acpx" && path.basename(path.dirname(pluginRoot)) === "extensions") {
+		const parent = path.dirname(path.dirname(pluginRoot));
+		return path.basename(parent) === "dist" ? path.dirname(parent) : parent;
+	}
+	return path.resolve(pluginRoot, "..");
+}
+function resolveOwnedAcpPackageRootCandidates(packageName) {
+	const pluginRoot = resolveAcpxPluginRoot(import.meta.url);
+	const openClawRoot = resolveOpenClawInstallRoot(pluginRoot);
+	return [
+		resolvePackageRoot(packageName),
+		path.join(pluginRoot, "node_modules", packageName),
+		path.join(openClawRoot, "node_modules", packageName)
+	].flatMap((root) => root ? [normalizePathLike(root)] : []);
+}
+const OWNED_ACP_PACKAGE_ROOTS = Array.from(new Set(OWNED_ACP_PACKAGE_NAMES.flatMap(resolveOwnedAcpPackageRootCandidates)));
+function commandBelongsToResolvedAcpPackage(command) {
+	return OWNED_ACP_PACKAGE_ROOTS.some((root) => command.includes(`${root}/`));
+}
+function commandMentionsGeneratedWrapper(command) {
+	return Array.from(GENERATED_WRAPPER_BASENAMES).some((basename) => command.includes(basename));
+}
+function commandWrapperBelongsToRoot(command, wrapperRoot) {
+	if (!wrapperRoot) return true;
+	const normalizedCommand = normalizePathLike(command);
+	const normalizedRoot = normalizePathLike(wrapperRoot).replace(/\/+$/, "");
+	return Array.from(GENERATED_WRAPPER_BASENAMES).some((basename) => normalizedCommand.includes(`${normalizedRoot}/${basename}`));
+}
+function commandContainsExactWrapperPath(command, wrapperPath) {
+	const expectedPath = normalizePathLike(wrapperPath);
+	return splitCommandParts(command).some((part) => normalizePathLike(part) === expectedPath);
+}
+function wrapperPathBelongsToRoot(wrapperPath, wrapperRoot) {
+	const normalizedPath = normalizePathLike(wrapperPath);
+	const normalizedRoot = normalizePathLike(wrapperRoot).replace(/\/+$/, "");
+	return GENERATED_WRAPPER_BASENAMES.has(path.posix.basename(normalizedPath)) && normalizedPath.startsWith(`${normalizedRoot}/`);
+}
+/** Check whether a command references an OpenClaw-generated ACPX wrapper path. */
+function isOpenClawLeaseAwareAcpxProcessCommand(params) {
+	const command = params.command?.trim();
+	if (!command) return false;
+	const normalized = normalizePathLike(command);
+	return commandMentionsGeneratedWrapper(normalized) && commandWrapperBelongsToRoot(normalized, params.wrapperRoot);
+}
+function commandsReferToSameRootCommand(liveCommand, storedCommand) {
+	if (!storedCommand?.trim()) return true;
+	return normalizePathLike(liveCommand).trim() === normalizePathLike(storedCommand).trim();
+}
+function commandOptionEquals(parts, option, expected) {
+	if (!expected) return true;
+	const index = parts.indexOf(option);
+	return index >= 0 && parts[index + 1] === expected;
+}
+function liveCommandMatchesLeaseIdentity(params) {
+	if (!params.expectedLeaseId && !params.expectedGatewayInstanceId) return true;
+	const parts = splitCommandParts(params.command ?? "");
+	return commandOptionEquals(parts, "--openclaw-acpx-lease-id", params.expectedLeaseId) && commandOptionEquals(parts, "--openclaw-gateway-instance-id", params.expectedGatewayInstanceId);
+}
+/** Check whether a command is owned by OpenClaw ACPX runtime packages or wrappers. */
+function isOpenClawOwnedAcpxProcessCommand(params) {
+	const command = params.command?.trim();
+	if (!command) return false;
+	const normalized = normalizePathLike(command);
+	if (isOpenClawLeaseAwareAcpxProcessCommand({
+		command: normalized,
+		wrapperRoot: params.wrapperRoot
+	})) return true;
+	if (commandBelongsToResolvedAcpPackage(normalized)) return true;
+	if (!normalized.includes(OPENCLAW_PLUGIN_DEPS_MARKER)) return false;
+	return ACP_PACKAGE_MARKERS.some((marker) => normalized.includes(marker));
+}
+function parseProcessList(stdout) {
+	const processes = [];
+	for (const line of stdout.split(/\r?\n/)) {
+		const match = /^\s*(?<pid>\d+)\s+(?<ppid>\d+)\s+(?<command>.+?)\s*$/.exec(line);
+		const pid = match?.groups?.pid;
+		const ppid = match?.groups?.ppid;
+		const command = match?.groups?.command;
+		if (!pid || !ppid || !command) continue;
+		processes.push({
+			pid: Number.parseInt(pid, 10),
+			ppid: Number.parseInt(ppid, 10),
+			command
+		});
+	}
+	return processes;
+}
+/** List host processes in the compact shape needed by ACPX cleanup. */
+async function listPlatformProcesses() {
+	if (process.platform === "win32") return [];
+	const { stdout } = await runExec("ps", ["-axo", "pid=,ppid=,command="], {
+		logOutput: false,
+		maxBuffer: 8388608,
+		timeoutMs: ACPX_PROCESS_LIST_TIMEOUT_MS
+	});
+	return parseProcessList(stdout);
+}
+function collectProcessTree(processes, rootPid) {
+	const childrenByParent = /* @__PURE__ */ new Map();
+	for (const processInfo of processes) {
+		const children = childrenByParent.get(processInfo.ppid) ?? [];
+		children.push(processInfo);
+		childrenByParent.set(processInfo.ppid, children);
+	}
+	const root = new Map(processes.map((processInfo) => [processInfo.pid, processInfo])).get(rootPid);
+	const collected = [];
+	if (root) collected.push(root);
+	const queue = [...childrenByParent.get(rootPid) ?? []];
+	while (queue.length > 0) {
+		const next = queue.shift();
+		if (!next || collected.some((processInfo) => processInfo.pid === next.pid)) continue;
+		collected.push(next);
+		queue.push(...childrenByParent.get(next.pid) ?? []);
+	}
+	return collected;
+}
+function uniquePids(processes) {
+	return Array.from(new Set(processes.map((processInfo) => processInfo.pid).filter((pid) => Number.isInteger(pid) && pid > 0 && pid !== process.pid)));
+}
+async function terminatePids(pids, deps) {
+	const killProcess = deps?.killProcess ?? ((pid, signal) => process.kill(pid, signal));
+	const sleep = deps?.sleep ?? ((ms) => new Promise((resolve) => {
+		setTimeout(resolve, ms);
+	}));
+	const terminated = [];
+	for (const pid of pids) try {
+		killProcess(pid, "SIGTERM");
+		terminated.push(pid);
+	} catch {}
+	if (terminated.length === 0) return terminated;
+	await sleep(750);
+	for (const pid of terminated) if (deps?.killProcess || isPidAlive(pid)) try {
+		killProcess(pid, "SIGKILL");
+	} catch {}
+	return terminated;
+}
+/** Terminate one validated OpenClaw-owned ACPX wrapper process tree. */
+async function cleanupOpenClawOwnedAcpxProcessTree(params) {
+	const rootPid = params.rootPid;
+	if (!rootPid || rootPid <= 0 || rootPid === process.pid) return {
+		inspectedPids: [],
+		terminatedPids: [],
+		skippedReason: "missing-root"
+	};
+	if ((params.deps?.platform ?? process.platform) === "win32") return {
+		inspectedPids: [],
+		terminatedPids: [],
+		skippedReason: "unsupported-platform"
+	};
+	let processes;
+	try {
+		processes = await (params.deps?.listProcesses ?? listPlatformProcesses)();
+	} catch {
+		return {
+			inspectedPids: [],
+			terminatedPids: [],
+			skippedReason: "process-list-unavailable"
+		};
+	}
+	const listedTree = collectProcessTree(processes, rootPid);
+	if (listedTree.length === 0) return {
+		inspectedPids: [],
+		terminatedPids: [],
+		skippedReason: "unverified-root"
+	};
+	const rootCommand = listedTree[0]?.command ?? params.rootCommand;
+	const liveCommandWasGeneratedWrapper = commandMentionsGeneratedWrapper(normalizePathLike(rootCommand ?? ""));
+	const storedCommandWasGeneratedWrapper = commandMentionsGeneratedWrapper(normalizePathLike(params.rootCommand ?? ""));
+	if (!liveCommandWasGeneratedWrapper && storedCommandWasGeneratedWrapper) return {
+		inspectedPids: listedTree.map((processInfo) => processInfo.pid),
+		terminatedPids: [],
+		skippedReason: "not-openclaw-owned"
+	};
+	if (!liveCommandWasGeneratedWrapper && !commandsReferToSameRootCommand(rootCommand ?? "", params.rootCommand)) return {
+		inspectedPids: listedTree.map((processInfo) => processInfo.pid),
+		terminatedPids: [],
+		skippedReason: "not-openclaw-owned"
+	};
+	if (!isOpenClawOwnedAcpxProcessCommand({
+		command: rootCommand,
+		wrapperRoot: params.wrapperRoot
+	})) return {
+		inspectedPids: listedTree.map((processInfo) => processInfo.pid),
+		terminatedPids: [],
+		skippedReason: "not-openclaw-owned"
+	};
+	if (!liveCommandMatchesLeaseIdentity({
+		command: rootCommand,
+		expectedLeaseId: params.expectedLeaseId,
+		expectedGatewayInstanceId: params.expectedGatewayInstanceId
+	})) return {
+		inspectedPids: listedTree.map((processInfo) => processInfo.pid),
+		terminatedPids: [],
+		skippedReason: "not-openclaw-owned"
+	};
+	const pids = uniquePids(listedTree.toReversed());
+	return {
+		inspectedPids: uniquePids(listedTree),
+		terminatedPids: await terminatePids(pids, params.deps)
+	};
+}
+/** Recover a pending lease by matching its exact live wrapper identity. */
+async function cleanupOpenClawOwnedAcpxPendingLease(params) {
+	if ((params.deps?.platform ?? process.platform) === "win32") return {
+		inspectedPids: [],
+		terminatedPids: [],
+		skippedReason: "unsupported-platform"
+	};
+	if (!params.wrapperPath || !wrapperPathBelongsToRoot(params.wrapperPath, params.wrapperRoot)) return {
+		inspectedPids: [],
+		terminatedPids: [],
+		skippedReason: "unverified-root"
+	};
+	let processes;
+	try {
+		processes = await (params.deps?.listProcesses ?? listPlatformProcesses)();
+	} catch {
+		return {
+			inspectedPids: [],
+			terminatedPids: [],
+			skippedReason: "process-list-unavailable"
+		};
+	}
+	const matchingRoots = processes.filter((processInfo) => commandContainsExactWrapperPath(processInfo.command, params.wrapperPath) && liveCommandMatchesLeaseIdentity({
+		command: processInfo.command,
+		expectedLeaseId: params.leaseId,
+		expectedGatewayInstanceId: params.gatewayInstanceId
+	}));
+	if (matchingRoots.length === 0) return {
+		inspectedPids: [],
+		terminatedPids: [],
+		skippedReason: "missing-root"
+	};
+	if (matchingRoots.length > 1) return {
+		inspectedPids: uniquePids(matchingRoots),
+		terminatedPids: [],
+		skippedReason: "ambiguous-root"
+	};
+	const listedTree = collectProcessTree(processes, matchingRoots[0].pid);
+	const pids = uniquePids(listedTree.toReversed());
+	return {
+		inspectedPids: uniquePids(listedTree),
+		terminatedPids: await terminatePids(pids, params.deps)
+	};
+}
+/** Reap orphaned OpenClaw-owned ACPX wrapper trees during runtime startup. */
+async function reapStaleOpenClawOwnedAcpxOrphans(params) {
+	if ((params.deps?.platform ?? process.platform) === "win32") return {
+		inspectedPids: [],
+		terminatedPids: [],
+		skippedReason: "unsupported-platform"
+	};
+	let processes;
+	try {
+		processes = await (params.deps?.listProcesses ?? listPlatformProcesses)();
+	} catch {
+		return {
+			inspectedPids: [],
+			terminatedPids: [],
+			skippedReason: "process-list-unavailable"
+		};
+	}
+	const orphanTrees = processes.filter((processInfo) => processInfo.ppid === 1 && !readAcpxProcessLeaseIdentity(processInfo.command) && isOpenClawOwnedAcpxProcessCommand({
+		command: processInfo.command,
+		wrapperRoot: params.wrapperRoot
+	})).map((orphan) => collectProcessTree(processes, orphan.pid));
+	return {
+		inspectedPids: uniquePids(orphanTrees.flat()),
+		terminatedPids: await terminatePids(uniquePids(orphanTrees.flatMap((tree) => tree.toReversed())), params.deps)
+	};
+}
+//#endregion
 //#region extensions/acpx/src/codex-trust-config.ts
 /**
 * Builds isolated Codex config for ACPX sessions. It preserves safe inherited
@@ -1019,9 +1345,13 @@ async function prepareAcpxCodexAuthConfig(params) {
 * ACPX plugin service lifecycle. It resolves config, prepares isolated adapter
 * wrappers, registers the ACP backend, and manages startup/cleanup probes.
 */
+var service_exports = /* @__PURE__ */ __exportAll({
+	createAcpxRuntimeService: () => createAcpxRuntimeService,
+	resolveAcpxTimerTimeoutMs: () => resolveAcpxTimerTimeoutMs
+});
 const ENABLE_STARTUP_PROBE_ENV = "OPENCLAW_ACPX_RUNTIME_STARTUP_PROBE";
 const SKIP_RUNTIME_PROBE_ENV = "OPENCLAW_SKIP_ACPX_RUNTIME_PROBE";
-const loadRuntimeModule = createLazyRuntimeModule(() => import("./runtime-BmOxa15I.js"));
+const loadRuntimeModule = createLazyRuntimeModule(() => import("./runtime-memQfUBo.js"));
 /** Convert ACPX timeout seconds into timer-safe milliseconds. */
 function resolveAcpxTimerTimeoutMs(timeoutSeconds) {
 	if (timeoutSeconds === void 0) return;
@@ -1032,9 +1362,20 @@ function createLazyDefaultRuntime(params) {
 	let runtimePromise = null;
 	async function resolveRuntime() {
 		if (runtime) return runtime;
-		runtimePromise ??= loadRuntimeModule().then((module) => {
+		runtimePromise ??= loadRuntimeModule().then(async (module) => {
+			const names = await fs$1.readdir(path.join(params.pluginConfig.stateDir, "sessions")).catch((error) => {
+				if (error instanceof Error && "code" in error && error.code === "ENOENT") return [];
+				throw error;
+			});
+			const legacyBareSessionKeys = /* @__PURE__ */ new Set();
+			for (const name of names) {
+				if (!name.endsWith(".json")) continue;
+				const recordId = decodeURIComponent(name.slice(0, -5));
+				if (!recordId.startsWith("agent:") && !recordId.startsWith(".openclaw-owner-") && !recordId.includes(":oneshot:")) legacyBareSessionKeys.add(recordId.toLowerCase());
+			}
 			runtime = new module.AcpxRuntime({
 				cwd: params.pluginConfig.cwd,
+				openclawLegacyBareSessionKeys: legacyBareSessionKeys,
 				openclawGatewayInstanceId: params.gatewayInstanceId,
 				openclawProcessLeaseStore: params.processLeaseStore,
 				openclawWrapperRoot: params.wrapperRoot,
@@ -1279,4 +1620,4 @@ function createAcpxRuntimeService(params) {
 	};
 }
 //#endregion
-export { createAcpxRuntimeService, resolveAcpxTimerTimeoutMs };
+export { CODEX_ACP_PACKAGE as a, createAcpxRuntimeService, isOpenClawLeaseAwareAcpxProcessCommand as i, cleanupOpenClawOwnedAcpxPendingLease as n, OPENCLAW_CODEX_CONFIG_ARG as o, cleanupOpenClawOwnedAcpxProcessTree as r, resolveAcpxTimerTimeoutMs, service_exports as t };

package/dist/session-owner-migration-CistlQKM.js

@@ -0,0 +1,200 @@
+import { l as openAcpxProcessLeaseStateStore, o as hashAcpxProcessCommand, s as normalizeAcpxProcessLease, u as readAcpxProcessLeaseIdentity } from "./process-lease-Cwvj7WGe.js";
+import { t as resolveAcpxPluginConfig } from "./config-v8M2tNu6.js";
+import path from "node:path";
+import fs from "node:fs/promises";
+import { archiveLegacyStateSource, asObjectRecord } from "openclaw/plugin-sdk/runtime-doctor-migrations";
+import { randomUUID } from "node:crypto";
+import { isDeepStrictEqual } from "node:util";
+//#region extensions/acpx/src/session-owner-migration.ts
+function sessionDirectory(input) {
+	if (!input.serviceWorkspaceDir) throw new Error("ACP ownership repair requires the Gateway service workspace; upgrade OpenClaw Doctor.");
+	return path.join(resolveAcpxPluginConfig({
+		rawConfig: input.config.plugins?.entries?.acpx?.config,
+		workspaceDir: input.serviceWorkspaceDir
+	}).stateDir, "sessions");
+}
+async function legacyRecords(input) {
+	const directory = sessionDirectory(input);
+	const ids = (await fs.readdir(directory).catch((error) => {
+		if (asObjectRecord(error)?.code === "ENOENT") return [];
+		throw error;
+	})).filter((name) => name.endsWith(".json")).map((name) => decodeURIComponent(name.slice(0, -5))).filter((id) => !id.startsWith("agent:") && !id.startsWith(".openclaw-owner-"));
+	if (ids.length === 0) return {
+		directory,
+		ids
+	};
+	const { resolveAcpxSessionResource } = await import("./session-resource-UWe7qD3m.js").then((n) => n.n);
+	const evidence = await input.context.inspectAcpSessionClaims?.();
+	const { decodeAcpxRuntimeHandleState } = await import("acpx/runtime");
+	return {
+		directory,
+		ids: ids.filter((id) => !evidence?.claims.some((claim) => {
+			const locator = decodeAcpxRuntimeHandleState(claim.meta.runtimeSessionName);
+			return evidence.incomplete.length === 0 && claim.meta.identity?.state === "resolved" && claim.meta.identity.acpxRecordId === id && locator?.acpxRecordId === id && locator.name === resolveAcpxSessionResource(claim);
+		})).filter((id) => !id.includes(":oneshot:") || evidence?.claims.some((claim) => {
+			const locator = decodeAcpxRuntimeHandleState(claim.meta.runtimeSessionName);
+			return claim.meta.identity?.acpxRecordId === id && locator?.name !== resolveAcpxSessionResource(claim);
+		})).toSorted()
+	};
+}
+function requireStoppedPid(pid) {
+	if (pid === void 0 || pid === null) return;
+	if (typeof pid !== "number" || !Number.isSafeInteger(pid) || pid <= 0) throw new Error("record process identity is uncertain");
+	try {
+		process.kill(pid, 0);
+	} catch (error) {
+		if (asObjectRecord(error)?.code === "ESRCH") return;
+		throw new Error("record process liveness cannot be verified", { cause: error });
+	}
+	throw new Error("record still has a live process; stop the harness before Doctor repair");
+}
+function recordPath(directory, recordId) {
+	return path.join(directory, `${encodeURIComponent(recordId)}.json`);
+}
+function matchesClaimRecord(claim, raw, oldId, resource, decode) {
+	const state = decode(claim.meta.runtimeSessionName);
+	const identity = claim.meta.identity;
+	if (!state || !identity || identity.state !== "resolved" || !identity.acpxSessionId && !identity.agentSessionId || state.mode !== claim.meta.mode) return false;
+	const recordId = claim.meta.mode === "oneshot" ? oldId : resource;
+	const oldLocator = state.name === raw.name && identity.acpxRecordId === oldId && state.acpxRecordId === oldId;
+	const newLocator = state.name === resource && identity.acpxRecordId === recordId && state.acpxRecordId === recordId;
+	return (oldLocator || newLocator) && state.agent === claim.meta.agent && (!identity.acpxSessionId || identity.acpxSessionId === raw.acp_session_id) && (!identity.agentSessionId || identity.agentSessionId === raw.agent_session_id) && (!state.backendSessionId || state.backendSessionId === raw.acp_session_id) && (!state.agentSessionId || state.agentSessionId === raw.agent_session_id);
+}
+async function migrateRecord(input, directory, oldId, claims, changes, warnings) {
+	const sourcePath = recordPath(directory, oldId);
+	const sourceBytes = await fs.readFile(sourcePath, "utf8");
+	const raw = asObjectRecord(JSON.parse(sourceBytes));
+	if (!raw || raw.acpx_record_id !== oldId || typeof raw.name !== "string" || !raw.name.trim() || raw.name !== oldId && !oldId.startsWith(`${raw.name}:oneshot:`)) throw new Error("record ID/name is not a recognized ACPX locator");
+	requireStoppedPid(raw.pid);
+	const { resolveAcpxSessionResource } = await import("./session-resource-UWe7qD3m.js").then((n) => n.n);
+	const { createFileSessionStore, decodeAcpxRuntimeHandleState, encodeAcpxRuntimeHandleState } = await import("acpx/runtime");
+	const candidates = claims.filter((claim) => matchesClaimRecord(claim, raw, oldId, resolveAcpxSessionResource(claim), decodeAcpxRuntimeHandleState));
+	if (candidates.length !== 1) throw new Error("exactly one current canonical owner claim is required");
+	const claim = candidates[0];
+	const resource = resolveAcpxSessionResource(claim);
+	const oneshot = claim.meta.mode === "oneshot";
+	if (oneshot !== (raw.name !== oldId)) throw new Error("canonical claim and backend record mode disagree");
+	if (!oneshot && oldId === resource) return;
+	const recordId = oneshot ? oldId : resource;
+	const leaseStore = openAcpxProcessLeaseStateStore(input.context.openPluginStateKeyedStore);
+	const leases = (await leaseStore.entries()).map((row) => ({
+		row,
+		lease: normalizeAcpxProcessLease(row.value)
+	}));
+	if (leases.some(({ lease }) => !lease)) throw new Error("process lease evidence is incomplete");
+	const commandIdentity = typeof raw.agent_command === "string" ? readAcpxProcessLeaseIdentity(raw.agent_command) : void 0;
+	const matchingLeases = leases.filter(({ lease }) => lease.sessionKey === raw.name || lease.sessionKey === resource);
+	for (const { lease } of matchingLeases) {
+		if (lease.state === "open" || lease.state === "closing") throw new Error("record has a live or uncertain process lease");
+		requireStoppedPid(lease.rootPid || void 0);
+		if (!commandIdentity || lease.leaseId !== commandIdentity.leaseId || lease.gatewayInstanceId !== commandIdentity.gatewayInstanceId || lease.commandHash !== hashAcpxProcessCommand(String(raw.agent_command))) throw new Error("record lease association does not match its persisted command");
+	}
+	const destinationPath = recordPath(directory, recordId);
+	const candidate = oneshot ? raw : {
+		...raw,
+		acpx_record_id: resource,
+		name: resource
+	};
+	const candidateBytes = `${JSON.stringify(candidate, null, 2)}\n`;
+	const store = createFileSessionStore({ stateDir: path.dirname(directory) });
+	const source = await store.load(oldId);
+	if (!source) throw new Error("pinned ACPX reader rejected the source record");
+	const temporaryId = `.openclaw-owner-${randomUUID()}`;
+	const temporaryPath = recordPath(directory, temporaryId);
+	const file = await fs.open(temporaryPath, "wx", 384);
+	try {
+		try {
+			await file.writeFile(candidateBytes);
+			await file.sync();
+		} finally {
+			await file.close();
+		}
+		const interpreted = await store.load(temporaryId);
+		if (!interpreted || !isDeepStrictEqual(interpreted, oneshot ? source : {
+			...source,
+			acpxRecordId: resource,
+			name: resource
+		})) throw new Error("rekey would alter interpreted history/event references; source retained");
+		const existing = await fs.readFile(destinationPath, "utf8").catch((error) => {
+			if (asObjectRecord(error)?.code === "ENOENT") return;
+			throw error;
+		});
+		const originalLocator = decodeAcpxRuntimeHandleState(claim.meta.runtimeSessionName);
+		if (!oneshot && originalLocator.name === resource && existing === void 0) throw new Error("migrated metadata has no published destination; source retained");
+		if (existing !== void 0 && !isDeepStrictEqual(JSON.parse(existing), candidate)) throw new Error("destination conflicts; no files were overwritten");
+		if (existing === void 0) await fs.link(temporaryPath, destinationPath);
+		const publicationDirectory = await fs.open(directory, "r");
+		try {
+			await publicationDirectory.sync();
+		} finally {
+			await publicationDirectory.close();
+		}
+		if (await fs.readFile(sourcePath, "utf8") !== sourceBytes) throw new Error("source changed during repair");
+		if (!isDeepStrictEqual(JSON.parse(await fs.readFile(destinationPath, "utf8")), candidate)) throw new Error("destination changed during repair");
+		for (const { row } of matchingLeases) {
+			if (!isDeepStrictEqual(await leaseStore.lookup(row.key), row.value)) throw new Error("lease changed during repair");
+			await leaseStore.register(row.key, {
+				...row.value,
+				sessionKey: resource
+			});
+		}
+		const state = decodeAcpxRuntimeHandleState(claim.meta.runtimeSessionName);
+		input.context.updateAcpSessionIdentity({
+			claim,
+			runtimeSessionName: encodeAcpxRuntimeHandleState({
+				...state,
+				name: resource,
+				acpxRecordId: recordId
+			}),
+			acpxRecordId: recordId
+		});
+		const verified = await input.context.inspectAcpSessionClaims();
+		if (verified.incomplete.length || !verified.claims.some((item) => item.agentId === claim.agentId && item.sessionKey === claim.sessionKey && item.meta.identity?.acpxRecordId === recordId && isDeepStrictEqual(item.binding, claim.binding))) throw new Error("canonical metadata verification failed; source retained for rerun");
+		changes.push(`Migrated ACP backend history for ${claim.agentId}/${claim.sessionKey} to its owner-qualified resource.`);
+		if (!oneshot) await archiveLegacyStateSource({
+			filePath: sourcePath,
+			label: "ACP owner record",
+			changes,
+			warnings
+		});
+	} finally {
+		await fs.rm(temporaryPath, { force: true });
+	}
+}
+const acpxSessionOwnerMigration = {
+	id: "acpx-session-owner-resources",
+	label: "ACP session owners",
+	doctorOnly: true,
+	phase: "after-session-repair",
+	async detectLegacyState(input) {
+		const { ids } = await legacyRecords(input);
+		return ids.length ? { preview: [`ACP backend has ${ids.length} unqualified record(s). Stop the Gateway and run openclaw doctor --fix; ambiguous histories remain intact.`] } : null;
+	},
+	async migrateLegacyState(input) {
+		const changes = [];
+		const warnings = [];
+		if (!input.context.inspectAcpSessionClaims || !input.context.updateAcpSessionIdentity) return {
+			changes,
+			warnings: ["ACP owner repair requires current offline Doctor maintenance authority."]
+		};
+		const { directory, ids } = await legacyRecords(input);
+		const evidence = await input.context.inspectAcpSessionClaims();
+		if (evidence.incomplete.length) return {
+			changes,
+			warnings: [`ACP owner evidence is incomplete; all records retained: ${evidence.incomplete.join("; ")}`]
+		};
+		for (const oldId of ids) try {
+			const current = await input.context.inspectAcpSessionClaims();
+			if (current.incomplete.length) throw new Error("canonical ownership evidence became incomplete");
+			await migrateRecord(input, directory, oldId, current.claims, changes, warnings);
+		} catch (error) {
+			warnings.push(`ACP record ${oldId} retained: ${String(error)}`);
+		}
+		return {
+			changes,
+			warnings
+		};
+	}
+};
+//#endregion
+export { acpxSessionOwnerMigration };

package/dist/session-resource-UWe7qD3m.js

@@ -0,0 +1,17 @@
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { AcpRuntimeError } from "./runtime-api.js";
+import { createHash } from "node:crypto";
+import { normalizeAgentId, parseAgentSessionKey } from "openclaw/plugin-sdk/routing";
+//#region extensions/acpx/src/session-resource.ts
+var session_resource_exports = /* @__PURE__ */ __exportAll({ resolveAcpxSessionResource: () => resolveAcpxSessionResource });
+/** Logical OpenClaw keys stay intact; only bare backend resource names need a namespace. */
+function resolveAcpxSessionResource(target) {
+	const sessionKey = target.sessionKey.trim().toLowerCase();
+	const encodedOwner = parseAgentSessionKey(sessionKey)?.agentId;
+	const agentId = target.agentId?.trim() ? normalizeAgentId(target.agentId) : encodedOwner;
+	if (!sessionKey || encodedOwner && agentId !== encodedOwner || !encodedOwner && !agentId) throw new AcpRuntimeError("ACP_SESSION_INIT_FAILED", "ACP session owner is missing or disagrees with its logical key. Pass the OpenClaw agentId that owns this session.", { detailCode: "SESSION_OWNER_UNSUPPORTED" });
+	if (encodedOwner) return sessionKey;
+	return `openclaw-owner-v1-${createHash("sha256").update(JSON.stringify([agentId, sessionKey])).digest("hex")}`;
+}
+//#endregion
+export { session_resource_exports as n, resolveAcpxSessionResource as t };

package/openclaw.plugin.json

@@ -1,5 +1,17 @@
 {
   "id": "acpx",
+  "backupResources": [
+    {
+      "disposition": "regenerable",
+      "scope": "state",
+      "relativePath": "acpx/codex-home/tmp/arg0"
+    },
+    {
+      "disposition": "regenerable",
+      "scope": "state",
+      "relativePath": "acpx/codex-home/.tmp/plugins"
+    }
+  ],
   "doctorContract": {
     "configRepair": true,
     "stateMigrations": true

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/acpx",
-  "version": "2026.9.1-beta.1",
+  "version": "2026.9.2",
   "description": "OpenClaw ACP runtime backend with plugin-owned session and transport management.",
   "repository": {
     "type": "git",
@@ -9,7 +9,7 @@
   "type": "module",
   "dependencies": {
     "@agentclientprotocol/claude-agent-acp": "0.70.0",
-    "@agentclientprotocol/codex-acp": "1.6.0",
+    "@agentclientprotocol/codex-acp": "1.6.2",
     "acpx": "0.13.1",
     "smol-toml": "1.8.0",
     "zod": "4.4.3"
@@ -43,10 +43,10 @@
       ]
     },
     "compat": {
-      "pluginApi": ">=2026.9.1-beta.1"
+      "pluginApi": ">=2026.9.2"
     },
     "build": {
-      "openclawVersion": "2026.9.1-beta.1",
+      "openclawVersion": "2026.9.2",
       "staticAssets": [
         {
           "source": "./src/runtime-internals/mcp-proxy.mjs",
@@ -74,7 +74,7 @@
     "skills/**"
   ],
   "peerDependencies": {
-    "openclaw": ">=2026.9.1-beta.1"
+    "openclaw": ">=2026.9.2"
   },
   "peerDependenciesMeta": {
     "openclaw": {

package/skills/acp-router/SKILL.md

@@ -210,7 +210,7 @@ Defaults are:
 
 - `openclaw -> openclaw acp`
 - `claude -> bundled @agentclientprotocol/claude-agent-acp@0.70.0`
-- `codex -> bundled @agentclientprotocol/codex-acp@1.6.0 through OpenClaw's isolated CODEX_HOME wrapper`
+- `codex -> bundled @agentclientprotocol/codex-acp@1.6.2 through OpenClaw's isolated CODEX_HOME wrapper`
 - `copilot -> copilot --acp --stdio`
 - `cursor -> cursor-agent acp`
 - `droid -> droid exec --output-format acp`