@openclaw/codex 2026.10.10-beta.3 → 2026.10.10-beta.4

package/dist/.setup/{effective-mcp-catalog-CvJiu5dn.mjs → effective-mcp-catalog-CQbEkKv_.mjs}

@@ -1,7 +1,7 @@
-import { g as sessionBindingIdentity } from "./session-binding-record-C_THntMe.mjs";
-import { T as retainSharedCodexAppServerClientByInstanceId } from "./auth-cache-key-aolg0chE.mjs";
-import { I as protectCodexAppServerLiveThread } from "./shared-client-B8v6e5D0.mjs";
-import "./session-binding-BgsWcbdY.mjs";
+import { g as sessionBindingIdentity } from "./session-binding-record-BpWF2Sus.mjs";
+import { T as retainSharedCodexAppServerClientByInstanceId } from "./auth-cache-key-Do2ZQrNP.mjs";
+import { I as protectCodexAppServerLiveThread } from "./shared-client-BelwlhWf.mjs";
+import "./session-binding-Dg0B6Zua.mjs";
 import { n as projectCodexMcpToolMetadata, t as projectCodexMcpServerMetadata } from "./mcp-tool-metadata-DW41snf3.mjs";
 import { asOptionalRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { assignMcpCatalogSafeServerNames } from "openclaw/plugin-sdk/agent-harness-runtime";
@@ -108,7 +108,7 @@ async function acquireCodexMcpAppRuntime(params, options) {
 	if (!retained && params.prepareSession) {
 		const preparation = await params.prepareSession();
 		params.assertCurrent();
-		const { prepareCodexMcpAppSession } = await import("./mcp-app-session-preparation-DtvMR_yX.mjs");
+		const { prepareCodexMcpAppSession } = await import("./mcp-app-session-preparation-CFbTbxia.mjs");
 		await prepareCodexMcpAppSession({
 			preparation,
 			bindingStore: options.bindingStore,
@@ -130,7 +130,7 @@ async function acquireCodexMcpAppRuntime(params, options) {
 		};
 		params.assertCurrent();
 		assertBinding();
-		const { createNativeMcpRuntime } = await import("./native-mcp-app-gkEJsgj2.mjs").then((n) => n.n);
+		const { createNativeMcpRuntime } = await import("./native-mcp-app-CFyl3R2g.mjs").then((n) => n.n);
 		params.assertCurrent();
 		const runtime = createNativeMcpRuntime({
 			client: retained.client,

package/dist/.setup/{ephemeral-turn-C9iVxYQi.mjs → ephemeral-turn-CNm9tN72.mjs}

@@ -1,6 +1,6 @@
 import { r as isJsonObject } from "./protocol-CaPAVwe9.mjs";
-import { b as readCodexTurnCompletedNotification } from "./client-CPPD2q0Z.mjs";
-import { n as getCodexAppServerTurnRouter } from "./turn-router-CaEj5E0i.mjs";
+import { b as readCodexTurnCompletedNotification } from "./client-Bxe8bl-K.mjs";
+import { n as getCodexAppServerTurnRouter } from "./turn-router-B62dF4CM.mjs";
 import { o as isTerminalTurnStatus, s as readCodexNotificationItem, t as CodexUsageProjection } from "./event-projector-usage-CBY0Hkga.mjs";
 import { readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { toStringifiedError } from "openclaw/plugin-sdk/error-runtime";

package/dist/.setup/{inference-context-BPwyk-Op.mjs → inference-context-DYpvCEF3.mjs}

@@ -1,5 +1,5 @@
 import { r as isJsonObject } from "./protocol-CaPAVwe9.mjs";
-import { n as defineCodexBuildState } from "./build-state-DswWyGqI.mjs";
+import { n as defineCodexBuildState } from "./build-state-CpGXWSN4.mjs";
 import { n as readCodexInferenceMetadata } from "./inference-metadata-CYFWLHVk.mjs";
 import { randomUUID } from "node:crypto";
 //#region extensions/codex/src/app-server/inference-context.ts

package/dist/.setup/{inference-proxy-iJoMVyEy.mjs → inference-proxy-e1Rg8kr_.mjs}

@@ -1,6 +1,6 @@
 import { t as codexWebSocketDataToBuffer } from "./websocket-data-XlRvt8Ys.mjs";
 import { CODEX_INFERENCE_TRANSPORT_FAILURE, authorizationFailure, createCodexInferenceDispatch, isTerminalResponse, n as createUploadAdmission, readProxyBody, t as MAX_BODY_BYTES } from "./inference-dispatch-C2zVSnrr.mjs";
-import { t as createCodexInferenceContext } from "./inference-context-BPwyk-Op.mjs";
+import { t as createCodexInferenceContext } from "./inference-context-DYpvCEF3.mjs";
 import { createDeferred, createPermitPool } from "openclaw/plugin-sdk/concurrency-runtime";
 import { Writable } from "node:stream";
 import { WebSocket, WebSocketServer, rejectWebSocketUpgrade } from "openclaw/plugin-sdk/websocket-runtime";

package/dist/.setup/{installed-probe-lVC1X5ve.mjs → installed-probe-yc_w-vom.mjs}

@@ -1,6 +1,6 @@
-import { n as INSTALLED_CODEX_PROBE_TIMEOUT_MS } from "./managed-binary-DbKvGXKl.mjs";
-import { n as resolveCodexAppServerSpawnEnv, r as resolveCodexAppServerSpawnInvocation } from "./transport-stdio-Bq160Dhv.mjs";
-import { n as buildCodexAppServerInitializeParams, o as readCodexVersionFromUserAgent } from "./client-initialize-CjgZcX61.mjs";
+import { n as INSTALLED_CODEX_PROBE_TIMEOUT_MS } from "./managed-binary-BwzkwiGo.mjs";
+import { n as resolveCodexAppServerSpawnEnv, r as resolveCodexAppServerSpawnInvocation } from "./transport-stdio-BVeWgcK6.mjs";
+import { n as buildCodexAppServerInitializeParams, o as readCodexVersionFromUserAgent } from "./client-initialize-CPNmLwhL.mjs";
 import { runUtf8CommandWithTimeout, signalProcessTree } from "openclaw/plugin-sdk/process-runtime";
 import path from "node:path";
 import { access, mkdtemp, rm } from "node:fs/promises";

package/dist/.setup/{isolated-completion-Bv8qIPw_.mjs → isolated-completion-B1mlyhKu.mjs}

@@ -1,10 +1,10 @@
 import { d as readCodexPluginConfig } from "./config-parsing-DsWSCPHO.mjs";
 import { i as resolveCodexAppServerHomeScope } from "./config-options-DMFZkd3X.mjs";
-import "./config-BfrAlTMT.mjs";
-import { et as resolveCodexAppServerPreparedAuthHandoff } from "./shared-client-B8v6e5D0.mjs";
-import { d as assertCodexPassiveTurnItems } from "./client-CPPD2q0Z.mjs";
-import { runBoundedCodexAppServerTurn } from "./bounded-turn-DJr0EXh7.mjs";
-import { t as resolveCodexBoundedTurnIsolation } from "./bounded-turn-isolation-D8CDrAVX.mjs";
+import "./config-BZYTxljj.mjs";
+import { tt as resolveCodexAppServerPreparedAuthHandoff } from "./shared-client-BelwlhWf.mjs";
+import { d as assertCodexPassiveTurnItems } from "./client-Bxe8bl-K.mjs";
+import { runBoundedCodexAppServerTurn } from "./bounded-turn-DnxnHHZP.mjs";
+import { t as resolveCodexBoundedTurnIsolation } from "./bounded-turn-isolation-Iz8EsqFg.mjs";
 import { a as createAttributedCodexAssistantMessage } from "./event-projector-assistant-message-ChOAY7rW.mjs";
 //#region extensions/codex/src/app-server/isolated-completion.ts
 /** Runs prompt-only Codex inference on an ephemeral, ring-zero native thread. */

package/dist/.setup/{managed-binary-DbKvGXKl.mjs → managed-binary-BwzkwiGo.mjs}

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "./session-binding-sidecars-BNSS6WL4.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-C9uEGpDX.mjs";
 import { createRequire } from "node:module";
 import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-registration";
 import { resolveGlobalSingleton } from "openclaw/plugin-sdk/global-singleton";
@@ -223,7 +223,7 @@ async function decideInstalledCodexAppServer(probes) {
 	if (handshakeTimeoutMs <= 0) return { reason: `installed ${found} selection timed out before the app-server handshake` };
 	let handshakeVersion;
 	try {
-		handshakeVersion = await (probes.probeHandshake ?? (async (command) => (await import("./installed-probe-lVC1X5ve.mjs")).probeCodexAppServerHandshake(command, handshakeTimeoutMs)))(launcher.command);
+		handshakeVersion = await (probes.probeHandshake ?? (async (command) => (await import("./installed-probe-yc_w-vom.mjs")).probeCodexAppServerHandshake(command, handshakeTimeoutMs)))(launcher.command);
 	} catch (error) {
 		return { reason: `installed ${found} ${version} failed the app-server handshake: ${coerceErrorMessage(error)}` };
 	}

package/dist/.setup/{mcp-app-session-preparation-DtvMR_yX.mjs → mcp-app-session-preparation-CFbTbxia.mjs}

@@ -1,17 +1,17 @@
-import { g as sessionBindingIdentity } from "./session-binding-record-C_THntMe.mjs";
+import { g as sessionBindingIdentity } from "./session-binding-record-BpWF2Sus.mjs";
 import { d as readCodexRequirementsToml } from "./config-security-clxAZYWX.mjs";
 import { d as readCodexPluginConfig } from "./config-parsing-DsWSCPHO.mjs";
 import { n as isCodexAppServerProxyLaunch } from "./launch-args-DbFCehO7.mjs";
-import { i as withCodexAppServerGitConfig } from "./transport-stdio-Bq160Dhv.mjs";
+import { i as withCodexAppServerGitConfig } from "./transport-stdio-BVeWgcK6.mjs";
 import { n as buildCodexAppServerRuntimeFingerprint, r as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-DRb-niJc.mjs";
-import { i as resolveCodexBindingAppServerConnection } from "./binding-connection-GTgUj9pi.mjs";
-import { r as resolveOpenClawExecPolicyForCodexAppServer } from "./config-BfrAlTMT.mjs";
+import { i as resolveCodexBindingAppServerConnection } from "./binding-connection-hJD5mFkM.mjs";
+import { r as resolveOpenClawExecPolicyForCodexAppServer } from "./config-BZYTxljj.mjs";
 import { r as resolveCodexAppServerAuthProfileId } from "./auth-profile-auwzSwwy.mjs";
-import { O as ensureCodexAppServerClientRuntime, f as releaseLeasedSharedCodexAppServerClient, o as getLeasedSharedCodexAppServerClient } from "./shared-client-B8v6e5D0.mjs";
-import { d as mergeCodexThreadConfigs } from "./project-doc-thread-config-B0UI3f1D.mjs";
-import { i as resolveCodexSessionBinding } from "./session-binding-BgsWcbdY.mjs";
-import { a as rollbackCodexAppServerBindingSubscription, r as retainCodexAppServerBindingSubscription, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-DJ8PPxRc.mjs";
-import { a as prepareCodexPluginThreadConfigStartupProvider, o as resolveCodexPluginThreadConfigStartupPolicy, t as startOrResumeThread } from "./thread-lifecycle-run-DOC2IWpW.mjs";
+import { O as ensureCodexAppServerClientRuntime, f as releaseLeasedSharedCodexAppServerClient, o as getLeasedSharedCodexAppServerClient } from "./shared-client-BelwlhWf.mjs";
+import { d as mergeCodexThreadConfigs } from "./project-doc-thread-config-Ds92xu17.mjs";
+import { i as resolveCodexSessionBinding } from "./session-binding-Dg0B6Zua.mjs";
+import { a as rollbackCodexAppServerBindingSubscription, r as retainCodexAppServerBindingSubscription, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-DxW6b6fR.mjs";
+import { a as prepareCodexPluginThreadConfigStartupProvider, o as resolveCodexPluginThreadConfigStartupPolicy, t as startOrResumeThread } from "./thread-lifecycle-run-aBfXzIGf.mjs";
 import { n as applyCodexSessionPermissionPolicy } from "./session-permission-policy-CD2MAWU8.mjs";
 import { z } from "zod";
 import { loadCodexBundleMcpThreadConfig } from "openclaw/plugin-sdk/agent-harness-runtime";

package/dist/.setup/{model-catalog-EWVLBn3F.mjs → model-catalog-BNSZklNP.mjs}

@@ -1,15 +1,15 @@
 import { t as buildCodexRuntimeModelParams } from "./model-runtime-BdqzOMkU.mjs";
 import { d as readCodexPluginConfig } from "./config-parsing-DsWSCPHO.mjs";
 import { n as isCodexAppServerProxyLaunch } from "./launch-args-DbFCehO7.mjs";
-import { D as retireSharedCodexAppServerClientIfCurrent } from "./auth-cache-key-aolg0chE.mjs";
-import { a as withCodexAppServerJsonClient } from "./request-DbU7VQMs.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-BZRizyuG.mjs";
+import { D as retireSharedCodexAppServerClientIfCurrent } from "./auth-cache-key-Do2ZQrNP.mjs";
+import { a as withCodexAppServerJsonClient } from "./request-DTgD_jsY.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-CqCrHEAU.mjs";
 import { a as resolveCodexAppServerAuthProfileStore, r as resolveCodexAppServerAuthProfileId } from "./auth-profile-auwzSwwy.mjs";
-import { n as captureSharedCodexAppServerCatalogLifetime } from "./shared-client-B8v6e5D0.mjs";
+import { n as captureSharedCodexAppServerCatalogLifetime } from "./shared-client-BelwlhWf.mjs";
 import { i as isCodexResponsesOAuthCredential } from "./responses-oauth-CCV7aVYF.mjs";
-import { i as isCodexAppServerIndeterminateRequestCancellationError } from "./client-CPPD2q0Z.mjs";
-import { n as listAllCodexAppServerModels } from "./models-Bc4yyUrk.mjs";
-import { probeCodexNativeAuth } from "./native-auth-DpZIaY8N.mjs";
+import { i as isCodexAppServerIndeterminateRequestCancellationError } from "./client-Bxe8bl-K.mjs";
+import { n as listAllCodexAppServerModels } from "./models-HgvyBseb.mjs";
+import { probeCodexNativeAuth } from "./native-auth-o_vw8KWa.mjs";
 //#region extensions/codex/src/app-server/model-catalog.ts
 const INPUT_TYPES = /* @__PURE__ */ new Set([
 	"text",

package/dist/.setup/{models-Bc4yyUrk.mjs → models-HgvyBseb.mjs}

@@ -1,4 +1,4 @@
-import { u as assertCodexModelListResponse } from "./client-CPPD2q0Z.mjs";
+import { u as assertCodexModelListResponse } from "./client-Bxe8bl-K.mjs";
 import { normalizeOptionalString, normalizeUniqueTrimmedStringList } from "openclaw/plugin-sdk/string-coerce-runtime";
 //#region extensions/codex/src/app-server/models.ts
 const DEFAULT_MODEL_DISCOVERY_TIMEOUT_MS = 1e4;
@@ -29,8 +29,8 @@ async function listAllCodexAppServerModels(options = {}) {
 async function withCodexAppServerModelRequest(options, run) {
 	if (options.request) return await run(options.request);
 	const timeoutMs = options.timeoutMs ?? 1e4;
-	const { getLeasedSharedCodexAppServerClient, releaseLeasedSharedCodexAppServerClient } = await import("./shared-client-B8v6e5D0.mjs").then((n) => n.m);
-	const { requestCodexAppServerClientJson } = await import("./request-DbU7VQMs.mjs").then((n) => n.i);
+	const { getLeasedSharedCodexAppServerClient, releaseLeasedSharedCodexAppServerClient } = await import("./shared-client-BelwlhWf.mjs").then((n) => n.m);
+	const { requestCodexAppServerClientJson } = await import("./request-DTgD_jsY.mjs").then((n) => n.i);
 	const client = await getLeasedSharedCodexAppServerClient({
 		startOptions: options.startOptions,
 		timeoutMs,

package/dist/.setup/native-assignment-repair-BsWKjUjZ.mjs

@@ -0,0 +1,162 @@
+import { c as readCodexNativeSubagentSubmissions, g as codexNativeSubagentHistoryConnectionFingerprint, l as codexNativeSubagentRunId, r as normalizeNativePendingAssignments } from "./native-subagent-pending-assignments-CX-LtYDX.mjs";
+import { a as readStoredCodexAppServerBinding } from "./session-binding-record-codec-DvmOI7g_.mjs";
+import { i as CODEX_APP_SERVER_BINDING_NAMESPACE } from "./session-binding-meta-Lkm5Lpf4.mjs";
+import { asOptionalRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { isDeepStrictEqual } from "node:util";
+//#region extensions/codex/src/migration/native-assignment-repair.ts
+async function normalizeRow(entry, params, warnings) {
+	const raw = asOptionalRecord(entry.value);
+	if (raw?.nativeSubagentAssignments === void 0) return;
+	const stored = readStoredCodexAppServerBinding(raw);
+	if (!stored) {
+		warnings.push(`Preserved Codex native assignments in ${entry.key}; the binding could not be decoded. Inspect it before retrying Doctor.`);
+		return;
+	}
+	if (stored.state !== "active") return;
+	let inventory;
+	try {
+		inventory = normalizeNativePendingAssignments(raw.nativeSubagentAssignments);
+	} catch {
+		warnings.push(`Preserved malformed Codex native assignments in ${entry.key}; inspect the binding before retrying Doctor.`);
+		return;
+	}
+	let assignments = inventory?.assignments ?? [];
+	const originalAssignments = assignments;
+	const identity = /^(session-key|session):([a-z0-9][a-z0-9_-]{0,63}):(.+)$/u.exec(entry.key);
+	const binding = asOptionalRecord(raw.binding);
+	const fingerprint = codexNativeSubagentHistoryConnectionFingerprint(stored.binding);
+	if (assignments.length > 0 && identity && stored.sessionId && binding && raw.retired === void 0 && (identity[1] === "session-key" ? /^[A-Za-z0-9_-]{43}$/u.test(identity[3]) : identity[3] === stored.sessionId) && binding.connectionScope === void 0 && binding.supervisionSourceThreadId === void 0 && binding.pendingSupervisionBranch === void 0 && (binding.authProfileId === void 0 || typeof binding.authProfileId === "string") && fingerprint && params.context.readSessionIdentityEvidenceBatch) try {
+		const agentId = identity[2];
+		const [evidence] = await params.context.readSessionIdentityEvidenceBatch([{
+			agentId,
+			sessionId: stored.sessionId
+		}]);
+		if (evidence?.state === "absent") assignments = [];
+		else if (evidence?.state === "current") {
+			const { getSessionEntryByIdAsync, resolveStorePath } = await import("openclaw/plugin-sdk/session-store-runtime");
+			const { bindingStoreKey } = await import("./session-binding-record-BpWF2Sus.mjs").then((n) => n._);
+			const current = await getSessionEntryByIdAsync({
+				agentId,
+				sessionId: stored.sessionId,
+				env: params.env,
+				storePath: resolveStorePath(params.config.session?.store, {
+					agentId,
+					env: params.env
+				}),
+				readConsistency: "latest"
+			});
+			if (!current || current.entry.sessionId !== stored.sessionId || current.sessionKey !== evidence.sessionKey) throw new Error("Requester ownership is unresolved");
+			const currentKey = bindingStoreKey({
+				kind: "session",
+				agentId,
+				sessionId: current.entry.sessionId,
+				...identity[1] === "session-key" ? { sessionKey: current.sessionKey } : {}
+			});
+			let unknownLifecycle = false;
+			assignments = assignments.filter((assignment) => {
+				if (currentKey !== entry.key || assignment.owner.sessionId !== current.entry.sessionId || assignment.owner.connectionFingerprint !== fingerprint) return false;
+				if (!assignment.owner.lifecycleRevision || !current.entry.lifecycleRevision) {
+					unknownLifecycle = true;
+					return true;
+				}
+				return assignment.owner.lifecycleRevision === current.entry.lifecycleRevision;
+			});
+			if (unknownLifecycle) warnings.push(`Preserved Codex assignments with unknown lifecycle evidence in ${entry.key}.`);
+		} else warnings.push(`Preserved Codex assignments with unknown requester evidence in ${entry.key}.`);
+	} catch {
+		warnings.push(`Could not establish requester ownership for Codex native assignments in ${entry.key}; preserved them for a later Doctor repair.`);
+	}
+	else if (assignments.length > 0) warnings.push(`Preserved Codex native assignments in ${entry.key}; ownership inspection prerequisites are incomplete. Inspect the binding before retrying Doctor.`);
+	const next = assignments.length ? {
+		version: 1,
+		assignments
+	} : void 0;
+	if (isDeepStrictEqual(next, raw.nativeSubagentAssignments)) return;
+	const { nativeSubagentAssignments: _previous, ...value } = raw;
+	const retired = originalAssignments.filter((assignment) => !assignments.includes(assignment));
+	if (retired.length) try {
+		const submissions = readCodexNativeSubagentSubmissions(raw.nativeSubagentSubmissions);
+		if (submissions) {
+			const receipts = submissions.receipts.filter((receipt) => !retired.some((assignment) => isDeepStrictEqual(submissions.owner, assignment.owner) && submissions.owner.parentThreadId === assignment.nativeParentThreadId && receipt.childThreadId === assignment.childThreadId && (receipt.submissionId === assignment.nativeTurnId || codexNativeSubagentRunId(receipt.childThreadId, receipt.submissionId) === assignment.runId) && (!assignment.submission || isDeepStrictEqual(receipt, assignment.submission))));
+			if (receipts.length !== submissions.receipts.length) {
+				delete value.nativeSubagentSubmissions;
+				if (receipts.length) value.nativeSubagentSubmissions = {
+					...submissions,
+					receipts
+				};
+			}
+		}
+	} catch {
+		warnings.push(`Preserved uncertain native submission receipts in ${entry.key}; inspect them before retrying Doctor.`);
+	}
+	return {
+		entry,
+		value: {
+			...value,
+			...next ? { nativeSubagentAssignments: next } : {}
+		}
+	};
+}
+async function* inspect(params) {
+	const read = params.context.readPluginStateEntriesInKeyRange;
+	if (!read) return;
+	let after;
+	while (true) {
+		const rows = read(CODEX_APP_SERVER_BINDING_NAMESPACE, {
+			prefix: "",
+			after,
+			limit: 512
+		});
+		const replacements = [];
+		const warnings = [];
+		for (const entry of rows) {
+			const replacement = await normalizeRow(entry, params, warnings);
+			if (replacement) replacements.push(replacement);
+		}
+		if (replacements.length || warnings.length) yield {
+			replacements,
+			warnings
+		};
+		if (rows.length < 512) return;
+		after = rows.at(-1)?.key;
+	}
+}
+const codexNativeAssignmentRepair = {
+	id: "codex-native-assignment-repair",
+	label: "Codex native pending assignment repair",
+	doctorOnly: true,
+	phase: "after-session-repair",
+	collectBackupResources: () => [],
+	async detectLegacyState(params) {
+		for await (const _ of inspect(params)) return { preview: ["- Repair duplicate or obsolete Codex native pending assignments"] };
+		return null;
+	},
+	async migrateLegacyState(params) {
+		const changes = [];
+		const warnings = [];
+		const repair = params.context.repairPluginStateEntries;
+		if (!repair) return {
+			changes,
+			warnings: ["Codex native assignment repair requires locked SQLite maintenance ownership"],
+			warningDisposition: "recoverable"
+		};
+		for await (const inspected of inspect(params)) {
+			warnings.push(...inspected.warnings);
+			if (!inspected.replacements.length) continue;
+			try {
+				const result = await repair(CODEX_APP_SERVER_BINDING_NAMESPACE, inspected.replacements);
+				changes.push(...result.changes, `Repaired native pending assignments in ${inspected.replacements.length} Codex binding(s)`);
+				warnings.push(...result.warnings);
+			} catch {
+				warnings.push("Codex native assignment bindings could not be repaired; preserved them for a later openclaw doctor --fix pass.");
+			}
+		}
+		return {
+			changes,
+			warnings,
+			...warnings.length ? { warningDisposition: "recoverable" } : {}
+		};
+	}
+};
+//#endregion
+export { codexNativeAssignmentRepair };

package/dist/.setup/{native-auth-DpZIaY8N.mjs → native-auth-o_vw8KWa.mjs}

@@ -1,8 +1,8 @@
 import { d as readCodexPluginConfig } from "./config-parsing-DsWSCPHO.mjs";
 import { n as isCodexAppServerProxyLaunch, t as buildCodexLoginStatusArgs } from "./launch-args-DbFCehO7.mjs";
-import { u as resolveManagedCodexAppServerStartOptions } from "./managed-binary-DbKvGXKl.mjs";
-import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-Bq160Dhv.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-BZRizyuG.mjs";
+import { u as resolveManagedCodexAppServerStartOptions } from "./managed-binary-BwzkwiGo.mjs";
+import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-BVeWgcK6.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-CqCrHEAU.mjs";
 import { materializeWindowsSpawnProgram, resolveWindowsSpawnProgram } from "openclaw/plugin-sdk/windows-spawn";
 import { runUtf8CommandWithTimeout } from "openclaw/plugin-sdk/process-runtime";
 //#region extensions/codex/src/app-server/native-auth.ts

package/dist/.setup/{native-hook-relay-DbNYjwuC.mjs → native-hook-relay-COcu2b4l.mjs}

@@ -1,9 +1,9 @@
 import { r as isJsonObject } from "./protocol-CaPAVwe9.mjs";
 import { l as fingerprintCodexPolicy } from "./config-security-clxAZYWX.mjs";
-import { b as nativeHookRelayUnregisterQueue } from "./shared-client-B8v6e5D0.mjs";
-import { O as resolveCodexToolAbortTerminalReason } from "./client-CPPD2q0Z.mjs";
-import { R as normalizeCodexDynamicToolName } from "./thread-requests-BjawdIVV.mjs";
-import { t as codexNativeSubagentMonitorRuntime } from "./native-subagent-monitor-D1pYkirc.mjs";
+import { b as nativeHookRelayUnregisterQueue } from "./shared-client-BelwlhWf.mjs";
+import { O as resolveCodexToolAbortTerminalReason } from "./client-Bxe8bl-K.mjs";
+import { R as normalizeCodexDynamicToolName } from "./thread-requests-6Dy8hyXF.mjs";
+import { t as codexNativeSubagentMonitorRuntime } from "./native-subagent-monitor-LJd5_D5F.mjs";
 import { createHash } from "node:crypto";
 import { addTimerTimeoutGraceMs, finiteSecondsToTimerSafeMilliseconds } from "openclaw/plugin-sdk/number-runtime";
 import { escapeRegExp } from "openclaw/plugin-sdk/text-utility-runtime";

package/dist/.setup/{native-mcp-app-gkEJsgj2.mjs → native-mcp-app-CFyl3R2g.mjs}

@@ -1,9 +1,9 @@
-import { I as protectCodexAppServerLiveThread, p as retainSharedCodexAppServerClientIfCurrent, t as captureCodexAppServerClientLifetime } from "./shared-client-B8v6e5D0.mjs";
-import { M as getCodexAppServerClientInstanceId } from "./client-CPPD2q0Z.mjs";
-import { n as getCodexAppServerTurnRouter } from "./turn-router-CaEj5E0i.mjs";
-import { a as requestPluginApprovalOutcome } from "./plugin-approval-roundtrip-BkiVPLuc.mjs";
+import { I as protectCodexAppServerLiveThread, p as retainSharedCodexAppServerClientIfCurrent, t as captureCodexAppServerClientLifetime } from "./shared-client-BelwlhWf.mjs";
+import { M as getCodexAppServerClientInstanceId } from "./client-Bxe8bl-K.mjs";
+import { n as getCodexAppServerTurnRouter } from "./turn-router-B62dF4CM.mjs";
+import { a as requestPluginApprovalOutcome } from "./plugin-approval-roundtrip-DEbTgtVQ.mjs";
 import { i as readCodexMcpToolUiVisibility, n as projectCodexMcpToolMetadata, r as readCodexMcpToolConnectorId, t as projectCodexMcpServerMetadata } from "./mcp-tool-metadata-DW41snf3.mjs";
-import { t as __exportAll } from "./session-binding-sidecars-BNSS6WL4.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-C9uEGpDX.mjs";
 import { asOptionalRecord, normalizeLowercaseStringOrEmpty, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { z } from "zod";
 import { loadAgentHarnessMcpConfig, prepareHarnessNativeMcpAppPreview } from "openclaw/plugin-sdk/agent-harness-runtime";

package/dist/.setup/{native-skill-isolation-Cja6Nv79.mjs → native-skill-isolation-B8cWhSFy.mjs}

@@ -1,9 +1,9 @@
 import { r as isJsonObject } from "./protocol-CaPAVwe9.mjs";
 import { n as resolveCodexAppServerLocalHomeDir } from "./auth-start-options-BPIPeEX8.mjs";
 import { t as buildCodexAppServerConnectionFingerprint } from "./plugin-app-cache-key-DRb-niJc.mjs";
-import { R as readCodexClientSessionMeta } from "./shared-client-B8v6e5D0.mjs";
-import { f as unsubscribeCodexThreadBestEffort, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS } from "./attempt-client-cleanup-BLp6z_DD.mjs";
-import { b as codexDynamicToolsFingerprint, p as attestCodexRestrictedToolSurfaceMcpServersDisabled } from "./thread-requests-BjawdIVV.mjs";
+import { R as readCodexClientSessionMeta } from "./shared-client-BelwlhWf.mjs";
+import { f as unsubscribeCodexThreadBestEffort, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS } from "./attempt-client-cleanup-Bj4T3tcX.mjs";
+import { b as codexDynamicToolsFingerprint, p as attestCodexRestrictedToolSurfaceMcpServersDisabled } from "./thread-requests-6Dy8hyXF.mjs";
 import path from "node:path";
 import os from "node:os";
 import fs from "node:fs/promises";