@openclaw/codex 2026.10.1-beta.2 → 2026.10.5-beta.1

package/dist/.setup/{account-usage-runtime-DGqFpAud.mjs → account-usage-runtime-QBZsvZS8.mjs}

@@ -1,8 +1,8 @@
 import { n as isCodexAppServerProxyLaunch } from "./launch-args-DbFCehO7.mjs";
-import { t as buildCodexAppServerUsageSnapshot } from "./rate-limits-CMPy24F5.mjs";
-import { t as readCodexAppServerUsage } from "./request-jSbhc1sg.mjs";
-import "./config-0Gxk3_eq.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-cUYrqu_a.mjs";
+import { t as buildCodexAppServerUsageSnapshot } from "./rate-limits-CI8pTPqL.mjs";
+import { t as readCodexAppServerUsage } from "./request-Y8dmbqZ3.mjs";
+import "./config-C1YVVLEA.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-DWzK-k0n.mjs";
 import { a as resolveCodexAppServerAuthProfileStore } from "./auth-profile-CgHQ8Vot.mjs";
 import { isDeepStrictEqual } from "node:util";
 import { listAgentIds, resolveAgentDir } from "openclaw/plugin-sdk/agent-scope-runtime";
@@ -14,15 +14,16 @@ const paramsSchema = z.object({
 	profileId: z.string().min(1)
 }).strict();
 async function handleCodexAccountUsage({ params, respond, context, signal, hasCurrentClientAuthority }) {
+	const invalid = (message) => respond(false, void 0, errorShape(ErrorCodes.INVALID_REQUEST, message));
 	const parsed = paramsSchema.safeParse(params);
 	if (!parsed.success) {
-		respond(false, void 0, errorShape(ErrorCodes.INVALID_REQUEST, "Expected agentId and profileId."));
+		invalid("Expected agentId and profileId.");
 		return;
 	}
 	const { agentId, profileId } = parsed.data;
 	const config = context.getRuntimeConfig();
 	if (!listAgentIds(config).includes(agentId)) {
-		respond(false, void 0, errorShape(ErrorCodes.INVALID_REQUEST, "Unknown agent."));
+		invalid("Unknown agent.");
 		return;
 	}
 	try {
@@ -35,7 +36,7 @@ async function handleCodexAccountUsage({ params, respond, context, signal, hasCu
 		const store = structuredClone(readStore());
 		const credential = store.profiles[profileId];
 		if (!credential || credential.provider !== "openai" || credential.type === "api_key") {
-			respond(false, void 0, errorShape(ErrorCodes.INVALID_REQUEST, "Select a saved Codex subscription login."));
+			invalid("Select a saved Codex subscription login.");
 			return;
 		}
 		const assertCurrent = () => {

package/dist/.setup/{app-server-policy-Bg4FZw1f.mjs → app-server-policy-D_zv8J7V.mjs}

@@ -1,7 +1,7 @@
-import { n as canUseCodexModelBackedApprovalsReviewerForModel } from "./config-0Gxk3_eq.mjs";
+import { n as canUseCodexModelBackedApprovalsReviewerForModel } from "./config-C1YVVLEA.mjs";
 //#region extensions/codex/src/app-server/app-server-policy.ts
 function resolveCodexAppServerForModelProvider(params) {
-	if (params.appServer.approvalsReviewer === "user" || canUseCodexModelBackedApprovalsReviewerForModel({
+	return params.appServer.approvalsReviewer === "user" || canUseCodexModelBackedApprovalsReviewerForModel({
 		modelProvider: params.provider,
 		model: params.model,
 		config: params.config,
@@ -13,8 +13,7 @@ function resolveCodexAppServerForModelProvider(params) {
 		codexConfigToml: params.codexConfigToml,
 		homeScope: params.appServer.start.homeScope,
 		codexArgs: params.appServer.start.args
-	})) return params.appServer;
-	return {
+	}) ? params.appServer : {
 		...params.appServer,
 		approvalsReviewer: "user"
 	};

package/dist/.setup/{apply-CXTudl9p.mjs → apply-CBMV8LN0.mjs}

@@ -1,14 +1,13 @@
-import { d as readCodexPluginConfig } from "./config-parsing-BQq-CHTF.mjs";
-import { s as resolveCodexAppServerFallbackApiKeyCacheKey } from "./auth-cache-key-CGm0UJOr.mjs";
-import { a as defaultCodexAppInventoryCache, r as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-BW8rd98k.mjs";
-import { r as requestCodexAppServerJson } from "./request-jSbhc1sg.mjs";
-import { l as CODEX_PLUGINS_MARKETPLACE_NAME, n as isOpenAiCuratedMarketplaceName } from "./plugin-inventory-Bf0_piTw.mjs";
-import "./config-0Gxk3_eq.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-cUYrqu_a.mjs";
+import { s as resolveCodexAppServerFallbackApiKeyCacheKey } from "./auth-cache-key-DyfUvsSa.mjs";
+import { a as defaultCodexAppInventoryCache, r as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-Bg9DbDI6.mjs";
+import { r as requestCodexAppServerJson } from "./request-Y8dmbqZ3.mjs";
+import { r as isOpenAiCuratedMarketplaceName, u as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-CYgdo14P.mjs";
+import "./config-C1YVVLEA.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-DWzK-k0n.mjs";
 import { i as resolveCodexAppServerAuthProfileIdForAgent } from "./auth-profile-CgHQ8Vot.mjs";
-import { c as getLeasedSharedCodexAppServerClient, et as resolveCodexAppServerAuthAccountCacheKey, h as releaseLeasedSharedCodexAppServerClient, o as clearSharedCodexAppServerClientIfCurrentAndWait } from "./shared-client-qhyYWbew.mjs";
-import { t as ensureCodexPluginActivation } from "./plugin-activation-BcyBv8PG.mjs";
-import { CODEX_PLUGIN_CONFIG_PATH, buildCodexMigrationPlan, buildCodexPluginsConfigValue, hasCodexPluginConfigConflict, n as resolveCodexConfigPatchMode, readCodexPluginMigrationConfigEntry, t as createCodexAuthItemApplier } from "./plan-BJ37d2Og.mjs";
+import { c as getLeasedSharedCodexAppServerClient, et as resolveCodexAppServerAuthAccountCacheKey, h as releaseLeasedSharedCodexAppServerClient, o as clearSharedCodexAppServerClientIfCurrentAndWait } from "./shared-client-ByIwuAC-.mjs";
+import { t as ensureCodexPluginActivation } from "./plugin-activation-D7WkJMvU.mjs";
+import { CODEX_PLUGIN_CONFIG_PATH, buildCodexMigrationPlan, buildCodexPluginsConfigValue, hasCodexPluginConfigConflict, n as resolveCodexConfigPatchMode, readCodexPluginMigrationConfigEntry, t as createCodexAuthItemApplier } from "./plan-C_F3aio0.mjs";
 import { uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { parseStrictNonNegativeInteger } from "openclaw/plugin-sdk/number-runtime";
 import path from "node:path";
@@ -67,17 +66,14 @@ var CodexPluginConfigConflictError = class extends Error {
 function prepareTargetCodexAppServer(ctx) {
 	const appServer = resolveTargetCodexAppServer(ctx);
 	const targets = resolvePlannedMigrationTargets(ctx);
-	let warmedClient;
 	const ready = getLeasedSharedCodexAppServerClient({
 		startOptions: appServer.start,
 		timeoutMs: 6e4,
 		agentDir: targets.agentDir,
 		config: ctx.config
-	}).then((client) => {
-		warmedClient = client;
-	}, () => void 0);
+	}).catch(() => void 0);
 	return { async dispose() {
-		await ready;
+		const warmedClient = await ready;
 		if (warmedClient) releaseLeasedSharedCodexAppServerClient(warmedClient);
 		await clearSharedCodexAppServerClientIfCurrentAndWait(warmedClient, {
 			exitTimeoutMs: 2e3,
@@ -163,49 +159,42 @@ async function applyCodexPluginInstallItem(ctx, item) {
 			appCache: defaultCodexAppInventoryCache,
 			appCacheKey
 		});
-		const baseDetails = {
-			...item.details,
-			code: result.reason,
-			activationReason: result.reason,
-			...PLUGIN_ACTIVATION_REPORT_STATE[result.reason],
-			installAttempted: result.installAttempted,
-			diagnostics: result.diagnostics.map((diagnostic) => diagnostic.message)
-		};
-		if (result.ok) return {
-			...item,
-			status: "migrated",
-			...result.reason === "already_active" ? { reason: "already active" } : {},
-			details: baseDetails
-		};
-		if (result.reason === CODEX_PLUGIN_AUTH_REQUIRED_REASON) return {
+		const applied = {
 			...item,
-			status: "skipped",
-			reason: CODEX_PLUGIN_AUTH_REQUIRED_REASON,
+			status: result.ok ? "migrated" : "error",
 			details: {
-				...baseDetails,
+				...item.details,
+				code: result.reason,
+				activationReason: result.reason,
+				...PLUGIN_ACTIVATION_REPORT_STATE[result.reason],
+				installAttempted: result.installAttempted,
+				diagnostics: result.diagnostics.map((diagnostic) => diagnostic.message)
+			}
+		};
+		if (result.ok) {
+			if (result.reason === "already_active") applied.reason = "already active";
+			return applied;
+		}
+		applied.reason = result.reason;
+		if (result.reason === CODEX_PLUGIN_AUTH_REQUIRED_REASON) {
+			applied.status = "skipped";
+			applied.details = {
+				...applied.details,
 				appsNeedingAuth: (result.installResponse?.appsNeedingAuth ?? []).map(({ id, name }) => ({
 					id,
 					name,
 					needsAuth: true
 				}))
-			}
-		};
-		if (result.reason === "plugin_missing" || result.reason === "marketplace_missing") return {
-			...item,
-			status: "warning",
-			reason: result.reason,
-			message: `Codex plugin "${policy.pluginName}" could not be migrated automatically`,
-			details: {
-				...baseDetails,
+			};
+		} else if (result.reason === "plugin_missing" || result.reason === "marketplace_missing") {
+			applied.status = "warning";
+			applied.message = `Codex plugin "${policy.pluginName}" could not be migrated automatically`;
+			applied.details = {
+				...applied.details,
 				warningReason: CODEX_PLUGIN_LOAD_WARNING
-			}
-		};
-		return {
-			...item,
-			status: "error",
-			reason: result.reason,
-			details: baseDetails
-		};
+			};
+		}
+		return applied;
 	} catch (error) {
 		if (coerceErrorMessage(error).includes("codex app-server plugin/list timed out")) return {
 			...item,
@@ -231,7 +220,7 @@ async function applyCodexPluginInstallItem(ctx, item) {
 	}
 }
 function resolveTargetCodexAppServer(ctx) {
-	return resolveCodexAppServerRuntimeOptions({ pluginConfig: readCodexPluginConfig(ctx.config) });
+	return resolveCodexAppServerRuntimeOptions({ pluginConfig: ctx.config.plugins?.entries?.codex?.config });
 }
 async function requestTargetCodexAppServerJson(params) {
 	if (params.method !== "plugin/list") return await requestCodexAppServerJson(params);

package/dist/.setup/{attempt-client-cleanup-BH0hW2xU.mjs → attempt-client-cleanup-t-kd_1ys.mjs}

@@ -1,9 +1,9 @@
-import { w as retireSharedCodexAppServerClientIfCurrent } from "./auth-cache-key-CGm0UJOr.mjs";
-import { a as codexPrewriteRejectionCause, o as isCodexAppServerOverloadError, r as CodexAppServerRpcError } from "./rpc-error-hmWM21RB.mjs";
-import { J as unsubscribeCodexAppServerLiveThread, ft as isCodexAppServerStartupError, u as isCodexAppServerStartSelectionChangedError } from "./shared-client-qhyYWbew.mjs";
-import { V as isCodexAppServerBrokenPipeError, c as isCodexAppServerRequestTimeoutError } from "./client-C8lgBOoO.mjs";
-import { n as getCodexAppServerTurnRouter } from "./turn-router-sS69wYnI.mjs";
-import { t as __exportAll } from "./session-binding-sidecars-BrdV95Fg.mjs";
+import { w as retireSharedCodexAppServerClientIfCurrent } from "./auth-cache-key-DyfUvsSa.mjs";
+import { a as codexPrewriteRejectionCause, o as isCodexAppServerOverloadError, r as CodexAppServerRpcError } from "./rpc-error-C98SHchT.mjs";
+import { J as unsubscribeCodexAppServerLiveThread, ft as isCodexAppServerStartupError, u as isCodexAppServerStartSelectionChangedError } from "./shared-client-ByIwuAC-.mjs";
+import { I as isCodexAppServerBrokenPipeError, c as isCodexAppServerRequestTimeoutError } from "./client-y7nO6X9c.mjs";
+import { n as getCodexAppServerTurnRouter } from "./turn-router-DKDAziUW.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-DD-enC8w.mjs";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
 import { AgentHarnessPreflightError, embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/attempt-client-cleanup.ts

package/dist/.setup/attempt-terminal-jO5IMj9K.mjs

@@ -0,0 +1,2 @@
+import { agentHarnessAttemptTerminal as attemptTerminal } from "openclaw/plugin-sdk/agent-harness-runtime";
+export { attemptTerminal as t };

package/dist/.setup/{attempt-workspace-context-BY0jprWJ.mjs → attempt-workspace-context-CcwP3DA3.mjs}

@@ -1,5 +1,5 @@
 import { r as flattenCodexDynamicToolFunctions } from "./protocol-CANUwXJ3.mjs";
-import { ut as isMessageOnlyCodexSourceReply } from "./thread-requests-CL1e8Wmx.mjs";
+import { I as isMessageOnlyCodexSourceReply } from "./thread-requests-BgzJwJtS.mjs";
 import { normalizeLowercaseStringOrEmpty } from "openclaw/plugin-sdk/string-coerce-runtime";
 import path from "node:path";
 import { buildAgentWorkspaceInstructionSnapshot, buildBootstrapContextForFiles, embeddedAgentLog, prepareAgentWorkspaceContext } from "openclaw/plugin-sdk/agent-harness-runtime";
@@ -102,31 +102,34 @@ async function buildCodexWorkspaceBootstrapContext(params) {
 }
 function renderCodexWorkspaceBootstrapPromptContext(contextFiles) {
 	if (contextFiles.length === 0) return;
-	const lines = [
+	return [
 		"OpenClaw loaded these user-editable workspace files for the current turn. Codex loads project-local AGENTS.md natively. When execution uses another folder, OpenClaw supplies the agent workspace AGENTS.md as thread-level developer instructions. SOUL.md, IDENTITY.md, and USER.md are prepared separately from user input and are not repeated here.",
 		"",
 		"# Project Context",
 		"",
 		"The following project context files have been loaded:",
-		""
-	];
-	for (const file of contextFiles) lines.push(`## ${file.path}`, "", file.content, "");
-	return lines.join("\n").trim();
-}
-function renderCodexWorkspaceMemoryReference(params) {
-	if (params.files.length === 0) return;
-	const lines = [
-		"## OpenClaw Workspace Memory",
 		"",
-		`MEMORY.md exists in the active agent workspace as a memory file, not an instruction file. OpenClaw does not paste its contents into native Codex turns; use ${(params.toolNames?.length ? params.toolNames : Array.from(CODEX_MEMORY_TOOL_NAMES)).join(" or ")} when durable memory is relevant and the tools are available.`,
-		""
-	];
-	for (const file of params.files) lines.push(`- ${file.path}`);
-	return lines.join("\n").trim();
+		...contextFiles.flatMap((file) => [
+			`## ${file.path}`,
+			"",
+			file.content,
+			""
+		])
+	].join("\n").trim();
 }
 function renderCodexWorkspaceMemoryInstructions(params) {
-	const sections = [params.memoryRecallInstructions ? [params.memoryRecallInstructions, renderCodexMemoryToolSearchBridge(params.toolNames)].filter(isNonEmptyString).join("\n").trim() : void 0, renderCodexWorkspaceMemoryReference(params)].filter(isNonEmptyString);
-	return sections.length > 0 ? sections.join("\n\n") : void 0;
+	const sections = [params.memoryRecallInstructions ? [params.memoryRecallInstructions, renderCodexMemoryToolSearchBridge(params.toolNames)].filter(isNonEmptyString).join("\n").trim() : void 0];
+	if (params.files.length > 0) {
+		const toolNames = params.toolNames.length ? params.toolNames : Array.from(CODEX_MEMORY_TOOL_NAMES);
+		sections.push([
+			"## OpenClaw Workspace Memory",
+			"",
+			`MEMORY.md exists in the active agent workspace as a memory file, not an instruction file. OpenClaw does not paste its contents into native Codex turns; use ${toolNames.join(" or ")} when durable memory is relevant and the tools are available.`,
+			"",
+			...params.files.map((file) => `- ${file.path}`)
+		].join("\n").trim());
+	}
+	return sections.filter(isNonEmptyString).join("\n\n") || void 0;
 }
 function renderCodexMemoryToolSearchBridge(toolNames) {
 	const memoryToolNames = toolNames.map(normalizeLowercaseStringOrEmpty).filter((name) => CODEX_MEMORY_TOOL_NAMES.has(name)).toSorted();

package/dist/.setup/{auth-binding-BoMwpuPN.mjs → auth-binding-BaxlhaNx.mjs}

@@ -1,7 +1,7 @@
 import { i as isCodexResponsesOAuthCredential, o as resolveCodexResponsesOAuthProfileFingerprint } from "./responses-oauth-twnuTaAa.mjs";
-import { t as __exportAll } from "./session-binding-sidecars-BrdV95Fg.mjs";
-import { fingerprintResolvedAuthProfileCredential } from "openclaw/plugin-sdk/agent-harness-runtime";
+import { t as __exportAll } from "./session-binding-sidecars-DD-enC8w.mjs";
 import { resolveApiKeyForProfile } from "openclaw/plugin-sdk/agent-runtime";
+import { fingerprintResolvedAuthProfileCredential } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { resolveOpenAICodexAuthIdentity } from "openclaw/plugin-sdk/provider-auth";
 //#region extensions/codex/src/app-server/auth-binding.ts
 var auth_binding_exports = /* @__PURE__ */ __exportAll({

package/dist/.setup/{auth-cache-key-CGm0UJOr.mjs → auth-cache-key-DyfUvsSa.mjs}

@@ -1,6 +1,6 @@
-import { n as defineCodexBuildState } from "./build-state-CqQnsg7T.mjs";
-import { u as resolveMacOSDesktopCodexAppPathCandidates } from "./managed-binary-C1VFoVPf.mjs";
-import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-a0HDa2Mj.mjs";
+import { n as defineCodexBuildState } from "./build-state-CzLMy1S9.mjs";
+import { u as resolveMacOSDesktopCodexAppPathCandidates } from "./managed-binary-BtIjV7yN.mjs";
+import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-CRWTkKOn.mjs";
 import { isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash } from "node:crypto";
 import fs, { constants, existsSync, watch } from "node:fs";
@@ -52,18 +52,14 @@ function resolveComputerUseArtifactRoots(candidate) {
 }
 /** Stable roots that cover bundle replacement and recursive artifact updates. */
 function resolveMacOSDesktopGenerationWatchPaths(candidates = resolveMacOSDesktopCodexAppPathCandidates("darwin")) {
-	const watched = /* @__PURE__ */ new Set(["/Applications"]);
-	for (const candidate of candidates) watched.add(candidate.appBundlePath);
-	return [...watched];
+	return [.../* @__PURE__ */ new Set(["/Applications", ...candidates.map((candidate) => candidate.appBundlePath)])];
 }
 async function readCodexDesktopArtifactTreeFingerprint(root) {
 	let rootStat;
 	try {
 		rootStat = await fs$1.lstat(root, { bigint: true });
 	} catch (error) {
-		const code = extractErrorCode(error);
-		if (code === "ENOENT" || code === "ENOTDIR") return "missing";
-		throw error;
+		return missingFingerprint(error);
 	}
 	if (!rootStat.isDirectory()) return statFingerprint(root);
 	let entryCount = 0;
@@ -100,9 +96,7 @@ async function statFingerprint(filePath) {
 		const content = target.isFile() ? await readFileFingerprint(filePath, target, true) : "";
 		return `${type}:${own}:${link}:${realPath}:${statTuple(target)}:${content}`;
 	} catch (error) {
-		const code = extractErrorCode(error);
-		if (code === "ENOENT" || code === "ENOTDIR") return "missing";
-		throw error;
+		return missingFingerprint(error);
 	}
 }
 async function readFileFingerprint(filePath, expected, followsSymlink) {
@@ -132,6 +126,11 @@ function statTuple(stat) {
 		stat.ctimeNs
 	].join(":");
 }
+function missingFingerprint(error) {
+	const code = extractErrorCode(error);
+	if (code === "ENOENT" || code === "ENOTDIR") return "missing";
+	throw error;
+}
 //#endregion
 //#region extensions/codex/src/app-server/desktop-generation-owner.ts
 const SETTLE_DELAY_MS = 1e3;
@@ -139,11 +138,10 @@ const SETTLE_DELAY_MS = 1e3;
 function createCodexDesktopGenerationOwner(params) {
 	let generation = params.initialGeneration;
 	let invalidation = 0;
-	let dirty = false;
+	let settledInvalidation = 0;
 	let refresh;
 	const markDirty = () => {
 		invalidation += 1;
-		dirty = true;
 	};
 	const reconcile = () => {
 		if (refresh) return refresh;
@@ -162,7 +160,7 @@ function createCodexDesktopGenerationOwner(params) {
 					epoch: (previous?.epoch ?? 0) + 1,
 					fingerprint: second
 				};
-				dirty = false;
+				settledInvalidation = invalidation;
 				if (previous && generation !== previous) params.onGenerationChange?.(generation);
 				return generation;
 			}
@@ -174,12 +172,12 @@ function createCodexDesktopGenerationOwner(params) {
 	return {
 		read: () => generation,
 		markDirty,
-		wait: () => dirty ? reconcile() : Promise.resolve(generation),
+		wait: () => settledInvalidation !== invalidation ? reconcile() : Promise.resolve(generation),
 		refresh: () => {
 			markDirty();
 			return reconcile();
 		},
-		isCurrent: (candidate) => Boolean(candidate && !params.signal.aborted && !dirty && generation && candidate.epoch === generation.epoch && candidate.fingerprint === generation.fingerprint),
+		isCurrent: (candidate) => Boolean(candidate && !params.signal.aborted && settledInvalidation === invalidation && generation && candidate.epoch === generation.epoch && candidate.fingerprint === generation.fingerprint),
 		waitForIdle: async () => {
 			await refresh?.catch(() => {});
 		}
@@ -229,7 +227,6 @@ function createCodexDesktopGenerationService(params, runtime = {
 			scheduler?.beginClose();
 			current.lastGeneration = current.owner?.read() ?? current.lastGeneration;
 			current.owner = void 0;
-			current.armEpoch = (current.armEpoch ?? 0) + 1;
 			current.context = void 0;
 			current.runtime = void 0;
 			current.watchHealthy = void 0;
@@ -244,8 +241,6 @@ function armWatchers(current) {
 	const owner = current.owner;
 	const runtime = current.runtime;
 	if (!owner || !runtime || current.watchers) return false;
-	const armEpoch = (current.armEpoch ?? 0) + 1;
-	current.armEpoch = armEpoch;
 	const watchers = /* @__PURE__ */ new Set();
 	current.watchers = watchers;
 	const candidateNames = new Set(resolveMacOSDesktopCodexAppPathCandidates("darwin").map((candidate) => candidate.appName));
@@ -254,14 +249,14 @@ function armWatchers(current) {
 		if (!runtime.pathExists(watchedPath)) continue;
 		try {
 			const watcher = runtime.watchPath(watchedPath, { recursive: watchedPath !== APPLICATIONS_PATH }, (_eventType, filename) => {
-				if (!isCurrentArm(current, owner, watchers, armEpoch)) return;
+				if (!isCurrentArm(current, owner, watchers)) return;
 				if (watchedPath === APPLICATIONS_PATH && filename && !candidateNames.has(filename.toString().split(path.sep)[0] ?? "")) return;
 				owner.markDirty();
 				scheduleRearm(current, owner);
 			});
 			watchers.add(watcher);
 			watcher.on("error", (error) => {
-				if (!isCurrentArm(current, owner, watchers, armEpoch)) return;
+				if (!isCurrentArm(current, owner, watchers)) return;
 				reportWatcherFailure(current, owner, error);
 				scheduleRearm(current, owner);
 			});
@@ -282,8 +277,8 @@ function reportWatcherFailure(current, owner, error) {
 	current.context?.serviceHealth?.reportFailure(error);
 	current.context?.logger.warn(`codex desktop generation watcher failed: ${String(error)}`);
 }
-function isCurrentArm(current, owner, watchers, armEpoch) {
-	return current.owner === owner && !current.context?.scheduler.signal.aborted && current.watchers === watchers && current.armEpoch === armEpoch;
+function isCurrentArm(current, owner, watchers) {
+	return isCurrentOwner(current, owner) && current.watchers === watchers;
 }
 function scheduleRearm(current, owner) {
 	if (current.rearmPending && current.watchHealthy === false) return;
@@ -295,7 +290,7 @@ function scheduleRearm(current, owner) {
 		delayMs,
 		run: async () => {
 			current.rearmPending = false;
-			if (current.owner !== owner || current.context?.scheduler.signal.aborted) return;
+			if (!isCurrentOwner(current, owner)) return;
 			const wasUnhealthy = current.watchHealthy === false;
 			closeWatchers(current);
 			if (!armWatchers(current) || wasUnhealthy) owner.markDirty();
@@ -305,9 +300,9 @@ function scheduleRearm(current, owner) {
 }
 function refreshGeneration(current, owner, refresh) {
 	return refresh.then(() => {
-		if (current.owner === owner && !current.context?.scheduler.signal.aborted && current.watchHealthy) current.context?.serviceHealth?.clearFailure();
+		if (isCurrentOwner(current, owner) && current.watchHealthy) current.context?.serviceHealth?.clearFailure();
 	}).catch((error) => {
-		if (current.owner !== owner || current.context?.scheduler.signal.aborted) return;
+		if (!isCurrentOwner(current, owner)) return;
 		current.context?.serviceHealth?.reportFailure(error);
 		current.context?.logger.warn(`codex desktop generation refresh failed: ${String(error)}`);
 	});
@@ -317,6 +312,9 @@ function closeWatchers(current) {
 	current.watchers = void 0;
 	for (const watcher of watchers ?? []) watcher.close();
 }
+function isCurrentOwner(current, owner) {
+	return current.owner === owner && !current.context?.scheduler.signal.aborted;
+}
 //#endregion
 //#region extensions/codex/src/app-server/shared-client-lifecycle.ts
 /** Client ownership and synchronous retirement, independent of startup/auth execution. */
@@ -453,7 +451,6 @@ function retirePendingSharedClientEntryIfUnclaimed(entry) {
 	entry.closeWhenIdle = true;
 	const state = getSharedCodexAppServerClientState();
 	if (state.clients.get(entry.key) === entry) state.clients.delete(entry.key);
-	if (!entry.client) return;
 	closeRetiredSharedClientEntry(entry);
 }
 /** Failed final claimants join physical cleanup; healthy peers keep their startup. */
@@ -512,9 +509,6 @@ function releaseSharedClientEntry(entry, counter) {
 //#endregion
 //#region extensions/codex/src/app-server/auth-cache-key.ts
 /** Auth cache identity and native CLI credential reads, without login or refresh. */
-const CODEX_HOME_ENV_VAR = "CODEX_HOME";
-const HOME_ENV_VAR = "HOME";
-const CODEX_HOME_DIRNAME = ".codex";
 const CODEX_AUTH_JSON_FILENAME = "auth.json";
 const CODEX_APP_SERVER_API_KEY_ENV_VARS = ["CODEX_API_KEY", "OPENAI_API_KEY"];
 function resolveCodexAppServerFallbackApiKeyCacheKey(params) {
@@ -538,17 +532,12 @@ function fingerprintAuthCacheKey(prefix, domain, ...parts) {
 	return `${prefix}:sha256:${createHash("sha256").update(`openclaw:codex:app-server-${domain}:v1\0`).update(parts.join("\0")).digest("hex")}`;
 }
 function resolveCodexCliAuthFilePath(env) {
-	const configuredCodexHome = env[CODEX_HOME_ENV_VAR]?.trim();
-	if (configuredCodexHome) return path.join(resolveHomeRelativePath(configuredCodexHome, env), CODEX_AUTH_JSON_FILENAME);
-	const home = env[HOME_ENV_VAR]?.trim() || env.USERPROFILE?.trim() || os.homedir();
-	return path.join(home, CODEX_HOME_DIRNAME, CODEX_AUTH_JSON_FILENAME);
-}
-function resolveHomeRelativePath(value, env) {
-	if (value === "~" || value.startsWith("~/") || value.startsWith("~\\")) {
-		const home = env[HOME_ENV_VAR]?.trim() || env.USERPROFILE?.trim() || os.homedir();
-		return path.join(home, value.slice(value === "~" ? 1 : 2));
+	const codexHome = env.CODEX_HOME?.trim() || "~/.codex";
+	if (codexHome === "~" || codexHome.startsWith("~/") || codexHome.startsWith("~\\")) {
+		const home = env.HOME?.trim() || env.USERPROFILE?.trim() || os.homedir();
+		return path.join(home, codexHome.slice(codexHome === "~" ? 1 : 2), CODEX_AUTH_JSON_FILENAME);
 	}
-	return value;
+	return path.join(codexHome, CODEX_AUTH_JSON_FILENAME);
 }
 function parseCodexCliAuthFileApiKey(raw) {
 	let parsed;

package/dist/.setup/{binding-connection-C-08ez1w.mjs → binding-connection-B7HAAZSI.mjs}

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "./session-binding-sidecars-BrdV95Fg.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-DD-enC8w.mjs";
 import { AgentHarnessPreflightError } from "openclaw/plugin-sdk/agent-harness-registration";
 import { createPluginRuntimeStore } from "openclaw/plugin-sdk/runtime-store";
 //#region extensions/codex/src/app-server/binding-connection.ts
@@ -44,7 +44,7 @@ function requireCodexSupervisionModelSelection(binding) {
 }
 /** Registration publishes the resolver; connection policy loads only for an actual request. */
 async function resolveCodexBindingAppServerConnection(params) {
-	return (await import("./binding-connection.runtime-Dn2p-fdy.mjs")).resolveCodexBindingAppServerConnection(params, catalogHomes.tryGetRuntime());
+	return (await import("./binding-connection.runtime-DAXn7iFl.mjs")).resolveCodexBindingAppServerConnection(params, catalogHomes.tryGetRuntime());
 }
 //#endregion
 export { setCodexCatalogConnectionHomeResolver as a, resolveCodexBindingAppServerConnection as i, binding_connection_exports as n, requireCodexSupervisionModelSelection as r, assertCodexSessionRuntimeOwnership as t };

package/dist/.setup/{binding-connection.runtime-Dn2p-fdy.mjs → binding-connection.runtime-DAXn7iFl.mjs}

@@ -1,7 +1,7 @@
-import { d as readCodexPluginConfig } from "./config-parsing-BQq-CHTF.mjs";
+import { d as readCodexPluginConfig } from "./config-parsing-DsWSCPHO.mjs";
 import { n as resolveCodexAppServerLocalHomeDir } from "./auth-start-options-BPIPeEX8.mjs";
-import { t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-BW8rd98k.mjs";
-import { n as resolveCodexAppServerRuntimeOptions, r as resolveCodexSupervisionAppServerRuntimeOptions } from "./config-runtime-cUYrqu_a.mjs";
+import { t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-Bg9DbDI6.mjs";
+import { n as resolveCodexAppServerRuntimeOptions, r as resolveCodexSupervisionAppServerRuntimeOptions } from "./config-runtime-DWzK-k0n.mjs";
 //#region extensions/codex/src/app-server/binding-connection.runtime.ts
 /** Resolves connection and auth ownership exclusively from the private thread binding. */
 async function resolveCodexBindingAppServerConnection(params, discoverHomes) {
@@ -13,7 +13,8 @@ async function resolveCodexBindingAppServerConnection(params, discoverHomes) {
 	let appServer = resolveRuntimeOptions(runtimeParams);
 	if (usesSupervisionConnection) {
 		const persistedFingerprint = binding.pendingSupervisionBranch?.connectionFingerprint ?? binding.appServerRuntimeFingerprint;
-		let currentFingerprint = buildCodexAppServerConnectionFingerprint(appServer, runtimeParams.agentDir);
+		const fingerprint = () => buildCodexAppServerConnectionFingerprint(appServer, runtimeParams.agentDir);
+		let currentFingerprint = fingerprint();
 		if (persistedFingerprint && currentFingerprint !== persistedFingerprint && runtimeParams.agentDir) {
 			const home = (await discoverHomes?.(runtimeParams.agentDir))?.find((source) => source.appServer.start.transport === "stdio" && buildCodexAppServerConnectionFingerprint(source.appServer, source.agentDir) === persistedFingerprint);
 			if (home) {
@@ -31,7 +32,7 @@ async function resolveCodexBindingAppServerConnection(params, discoverHomes) {
 						}
 					}
 				};
-				currentFingerprint = buildCodexAppServerConnectionFingerprint(appServer, runtimeParams.agentDir);
+				currentFingerprint = fingerprint();
 			}
 		}
 		if (!persistedFingerprint || persistedFingerprint !== currentFingerprint) throw new Error("Codex supervision connection changed; refusing to operate on its bound native thread");

package/dist/.setup/{bounded-turn-pGsfXcmH.mjs → bounded-turn-CyQVQwGe.mjs}

@@ -1,17 +1,18 @@
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
 import { a as resolveCodexPrivateLauncher, i as readCodexAppServerConfigOptions } from "./launch-args-DbFCehO7.mjs";
-import { d as readCodexEffectiveConfig } from "./config-options-HG_Rr3W_.mjs";
-import { a as codexPrewriteRejectionCause } from "./rpc-error-hmWM21RB.mjs";
-import "./config-0Gxk3_eq.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-cUYrqu_a.mjs";
-import { u as isCodexAppServerStartSelectionChangedError } from "./shared-client-qhyYWbew.mjs";
-import { _ as assertCodexTurnStartResponse, b as readCodexErrorNotification, g as assertCodexThreadStartResponse, w as createCodexElicitationResponse } from "./client-C8lgBOoO.mjs";
-import { o as closeCodexStartupClientBestEffort, s as interruptCodexTurnAndWaitBestEffort, t as CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS } from "./attempt-client-cleanup-BH0hW2xU.mjs";
-import { t as CodexEphemeralTurn } from "./ephemeral-turn-D8VcDTNo.mjs";
-import { i as readModelListResult } from "./models-DSseKSMg.mjs";
-import { Ct as mergeCodexThreadConfigs, n as buildCodexRingZeroThreadConfigPatch, r as buildCodexRuntimeThreadConfig, t as assertCodexManagedRequirementsDoNotOverrideToolPolicy, u as readCodexInheritedMcpServerNames, z as attestCodexRestrictedToolSurfaceMcpServersDisabled } from "./thread-requests-CL1e8Wmx.mjs";
-import { b as resolveCodexAppServerReasoningEffort } from "./thread-lifecycle-Cbz_7ySv.mjs";
-import { a as resolveCodexPromptError } from "./usage-limit-error-GbT-5NcW.mjs";
+import { d as readCodexEffectiveConfig } from "./config-options-DDzeNQ8m.mjs";
+import { a as codexPrewriteRejectionCause } from "./rpc-error-C98SHchT.mjs";
+import "./config-C1YVVLEA.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-DWzK-k0n.mjs";
+import { u as isCodexAppServerStartSelectionChangedError } from "./shared-client-ByIwuAC-.mjs";
+import { _ as assertCodexTurnStartResponse, b as readCodexErrorNotification, g as assertCodexThreadStartResponse, w as createCodexElicitationResponse } from "./client-y7nO6X9c.mjs";
+import { o as closeCodexStartupClientBestEffort, s as interruptCodexTurnAndWaitBestEffort, t as CODEX_APP_SERVER_INTERRUPT_TIMEOUT_MS } from "./attempt-client-cleanup-t-kd_1ys.mjs";
+import { t as CodexEphemeralTurn } from "./ephemeral-turn-Cphy5Qr_.mjs";
+import { i as readModelListResult } from "./models-DdRyi93L.mjs";
+import { d as mergeCodexThreadConfigs } from "./project-doc-thread-config-BVcvnps8.mjs";
+import { n as resolveCodexAppServerReasoningEffort } from "./reasoning-effort-CS9kKWB9.mjs";
+import { n as buildCodexRingZeroThreadConfigPatch, p as attestCodexRestrictedToolSurfaceMcpServersDisabled, r as buildCodexRuntimeThreadConfig, t as assertCodexManagedRequirementsDoNotOverrideToolPolicy, u as readCodexInheritedMcpServerNames } from "./thread-requests-BgzJwJtS.mjs";
+import { a as resolveCodexPromptError } from "./usage-limit-error-2t3KBqiX.mjs";
 import { resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
 import { parse } from "smol-toml";
 import path from "node:path";
@@ -145,7 +146,7 @@ async function runBoundedCodexAppServerTurnInWorkspace(params, appServer, worksp
 		assertCurrent: params.assertCurrent,
 		...params.signal ? { abandonSignal: params.signal } : {}
 	};
-	const client = params.options.clientFactory ? await params.options.clientFactory(clientOptions) : await import("./shared-client-qhyYWbew.mjs").then((n) => n.v).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
+	const client = params.options.clientFactory ? await params.options.clientFactory(clientOptions) : await import("./shared-client-ByIwuAC-.mjs").then((n) => n.v).then(({ createIsolatedCodexAppServerClient }) => createIsolatedCodexAppServerClient({
 		...clientOptions,
 		authProfileStore: params.authProfileStore
 	}));
@@ -285,10 +286,13 @@ async function runBoundedCodexAppServerTurnInWorkspace(params, appServer, worksp
 	});
 }
 function resolveBoundedThreadConfig(params, workspace, inheritedMcpServerNames, enableManagedHooks) {
-	const boundedConfig = mergeCodexThreadConfigs(CODEX_BOUNDED_THREAD_CONFIG, params.threadConfig) ?? CODEX_BOUNDED_THREAD_CONFIG;
-	const privateConfig = workspace.codexHome ? mergeCodexThreadConfigs(boundedConfig, CODEX_PRIVATE_BOUNDED_THREAD_CONFIG) ?? boundedConfig : boundedConfig;
-	if (!params.requireNoExternalCapabilities) return privateConfig;
-	return mergeCodexThreadConfigs(privateConfig, CODEX_SETTLED_FINALIZER_THREAD_CONFIG, buildCodexRingZeroThreadConfigPatch({ toolsAllow: ["openclaw"] }, true, inheritedMcpServerNames), enableManagedHooks ? { "features.hooks": true } : void 0) ?? privateConfig;
+	const configs = [
+		CODEX_BOUNDED_THREAD_CONFIG,
+		params.threadConfig,
+		workspace.codexHome ? CODEX_PRIVATE_BOUNDED_THREAD_CONFIG : void 0
+	];
+	if (params.requireNoExternalCapabilities) configs.push(CODEX_SETTLED_FINALIZER_THREAD_CONFIG, buildCodexRingZeroThreadConfigPatch({ toolsAllow: ["openclaw"] }, true, inheritedMcpServerNames), enableManagedHooks ? { "features.hooks": true } : void 0);
+	return mergeCodexThreadConfigs(...configs) ?? CODEX_BOUNDED_THREAD_CONFIG;
 }
 function buildPrivateCodexAppServerStartOptions(start, codexHome, cwd, inspectManagedHooks) {
 	const launchCwd = start.cwd ?? process.cwd();

package/dist/.setup/{bounded-turn-isolation-DklXNk3k.mjs → bounded-turn-isolation-BfDAo-qZ.mjs}

@@ -1,8 +1,8 @@
-import { d as readCodexPluginConfig } from "./config-parsing-BQq-CHTF.mjs";
+import { d as readCodexPluginConfig } from "./config-parsing-DsWSCPHO.mjs";
 import { n as isCodexAppServerProxyLaunch } from "./launch-args-DbFCehO7.mjs";
-import { i as resolveCodexAppServerHomeScope } from "./config-options-HG_Rr3W_.mjs";
-import "./config-0Gxk3_eq.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-cUYrqu_a.mjs";
+import { i as resolveCodexAppServerHomeScope } from "./config-options-DDzeNQ8m.mjs";
+import "./config-C1YVVLEA.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-DWzK-k0n.mjs";
 //#region extensions/codex/src/app-server/bounded-turn-isolation.ts
 function resolveCodexBoundedTurnIsolation(options) {
 	const pluginConfig = readCodexPluginConfig(options.pluginConfig);

package/dist/.setup/{build-state-CqQnsg7T.mjs → build-state-CzLMy1S9.mjs}

@@ -1,5 +1,5 @@
 //#region extensions/codex/package.json
-var version = "2026.10.1-beta.2";
+var version = "2026.10.5-beta.1";
 //#endregion
 //#region extensions/codex/src/build-state.ts
 /**

package/dist/.setup/{capabilities-kQntafj_.mjs → capabilities-DbOzOglY.mjs}

@@ -1,4 +1,4 @@
-import { r as CodexAppServerRpcError } from "./rpc-error-hmWM21RB.mjs";
+import { r as CodexAppServerRpcError } from "./rpc-error-C98SHchT.mjs";
 //#region extensions/codex/src/app-server/capabilities.ts
 const CODEX_CONTROL_METHODS = {
 	account: "account/read",