@openclaw/codex 2026.10.2 → 2026.10.5-beta.2

package/dist/.setup/{shared-client-5NUq43f3.mjs → shared-client-BjiqpbC5.mjs}

@@ -1,24 +1,24 @@
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
-import { n as defineCodexBuildState, t as codexBuildSymbol } from "./build-state-LS-A65iX.mjs";
+import { n as defineCodexBuildState, t as codexBuildSymbol } from "./build-state-CMYRQ_We.mjs";
 import { t as CODEX_APP_SERVER_AUTH_PROVIDER } from "./auth-profile-selection-hr8ocLtz.mjs";
 import { n as isCodexAppServerProxyLaunch } from "./launch-args-DbFCehO7.mjs";
 import { a as withEphemeralCodexAuthStore, i as withClearedEnvironmentVariables, n as resolveCodexAppServerLocalHomeDir, r as resolveCodexAppServerUserHomeDir, t as resolveCodexAppServerHomeDir } from "./auth-start-options-BPIPeEX8.mjs";
-import { a as resolveCodexAppServerStartOptionsForAgent, d as readCodexEffectiveConfig, o as resolveCodexComputerUseConfig, t as codexAppServerStartOptionsKey, u as CODEX_SESSION_OVERRIDABLE_LAYER_TYPES } from "./config-options-HG_Rr3W_.mjs";
-import { d as resolveMacOSDesktopCodexBundledMarketplaceCandidates, f as resolveMacOSDesktopCodexComputerUseServiceAppCandidates, i as resolveManagedCodexNativeCommand, l as resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath, r as resolveManagedCodexAppServerStartOptions, t as isManagedCodexDesktopCommand, u as resolveMacOSDesktopCodexAppPathCandidates } from "./managed-binary-C1VFoVPf.mjs";
-import { A as waitForCodexDesktopGeneration, C as retirePendingSharedClientEntryIfUnclaimed, D as waitForUnclaimedSharedClientStartup, _ as observeSharedClientAcquire, a as readCodexCliAuthFileApiKey, b as releaseSharedClientEntry, c as resolveCodexAppServerPreparedApiKeyCacheKey, d as getCurrentSharedClientEntry, f as getOrCreateSharedClientEntry, g as observeAcquire, h as notifyDesktopGenerationDrainChecks, i as fingerprintTokenAuthProfileCacheKey, j as readCodexDesktopArtifactTreeFingerprint, k as isCodexDesktopGenerationCurrent, l as closeSharedClientEntryIfUnclaimed, n as CODEX_AUTH_JSON_FILENAME, o as readFirstNonEmptyEnv, p as getSharedCodexAppServerClientState, r as fingerprintApiKeyAuthProfileCacheKey, s as resolveCodexAppServerFallbackApiKeyCacheKey, t as CODEX_APP_SERVER_API_KEY_ENV_VARS, u as createCodexAppServerStartupLifetime, v as ownCodexStartup, w as retireSharedCodexAppServerClientIfCurrent, x as retainSharedClientEntry, y as recordSharedClientAcquireBoundary } from "./auth-cache-key-BE1HXsNo.mjs";
-import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-a0HDa2Mj.mjs";
+import { a as resolveCodexAppServerStartOptionsForAgent, d as readCodexEffectiveConfig, o as resolveCodexComputerUseConfig, t as codexAppServerStartOptionsKey, u as CODEX_SESSION_OVERRIDABLE_LAYER_TYPES } from "./config-options-DDzeNQ8m.mjs";
+import { d as resolveMacOSDesktopCodexBundledMarketplaceCandidates, f as resolveMacOSDesktopCodexComputerUseServiceAppCandidates, i as resolveManagedCodexNativeCommand, l as resolveFirstExistingMacOSDesktopCodexBundledMarketplacePath, r as resolveManagedCodexAppServerStartOptions, t as isManagedCodexDesktopCommand, u as resolveMacOSDesktopCodexAppPathCandidates } from "./managed-binary-BtIjV7yN.mjs";
+import { A as waitForCodexDesktopGeneration, C as retirePendingSharedClientEntryIfUnclaimed, D as waitForUnclaimedSharedClientStartup, _ as observeSharedClientAcquire, a as readCodexCliAuthFileApiKey, b as releaseSharedClientEntry, c as resolveCodexAppServerPreparedApiKeyCacheKey, d as getCurrentSharedClientEntry, f as getOrCreateSharedClientEntry, g as observeAcquire, h as notifyDesktopGenerationDrainChecks, i as fingerprintTokenAuthProfileCacheKey, j as readCodexDesktopArtifactTreeFingerprint, k as isCodexDesktopGenerationCurrent, l as closeSharedClientEntryIfUnclaimed, n as CODEX_AUTH_JSON_FILENAME, o as readFirstNonEmptyEnv, p as getSharedCodexAppServerClientState, r as fingerprintApiKeyAuthProfileCacheKey, s as resolveCodexAppServerFallbackApiKeyCacheKey, t as CODEX_APP_SERVER_API_KEY_ENV_VARS, u as createCodexAppServerStartupLifetime, v as ownCodexStartup, w as retireSharedCodexAppServerClientIfCurrent, x as retainSharedClientEntry, y as recordSharedClientAcquireBoundary } from "./auth-cache-key-tENCQOub.mjs";
+import { n as resolveCodexAppServerSpawnEnv } from "./transport-stdio-CRWTkKOn.mjs";
 import { n as CodexAppServerAuthProfileUnavailableError, r as formatCodexAuthProfileUnavailableMessage } from "./auth-profile-recovery-BREezV0L.mjs";
-import { a as codexPrewriteRejectionCause } from "./rpc-error-hmWM21RB.mjs";
-import { i as withTimeout } from "./timeout-CXOfNoaX.mjs";
+import { a as codexPrewriteRejectionCause } from "./rpc-error-C98SHchT.mjs";
+import { i as withTimeout } from "./timeout-D0mEWSGG.mjs";
 import { n as readCodexSessionMeta } from "./session-catalog-provenance-CmsOE5mh.mjs";
-import { n as observeCodexCatalogClient } from "./session-catalog-events-Cj-b2FpC.mjs";
-import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-cUYrqu_a.mjs";
+import { n as observeCodexCatalogClient } from "./session-catalog-events-BziNSfLx.mjs";
+import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-DWzK-k0n.mjs";
 import { a as resolveCodexAppServerAuthProfileStore, i as resolveCodexAppServerAuthProfileIdForAgent, r as resolveCodexAppServerAuthProfileId, t as isCodexAppServerNativeAuthProfile } from "./auth-profile-CgHQ8Vot.mjs";
 import { i as isCodexResponsesOAuthCredential, n as createCodexResponsesOAuth, o as resolveCodexResponsesOAuthProfileFingerprint, r as isCodexResponsesOAuth, t as CODEX_RESPONSES_OAUTH_PROVIDER } from "./responses-oauth-twnuTaAa.mjs";
-import { R as isUnsupportedCodexAppServerVersionError, t as CodexAppServerClient } from "./client-ChJtGEdJ.mjs";
-import { n as isCodexWebSocketOpenFailure } from "./transport-websocket-zqJ0Cmtn.mjs";
-import { t as __exportAll } from "./session-binding-sidecars-BrdV95Fg.mjs";
-import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { N as isUnsupportedCodexAppServerVersionError, t as CodexAppServerClient } from "./client-zrCKOu_E.mjs";
+import { n as isCodexWebSocketOpenFailure } from "./transport-websocket-DIyPfkHo.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-DD-enC8w.mjs";
+import { asOptionalRecord, isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash, randomUUID } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
 import { AgentHarnessPreflightError, resolveDefaultAgentDir } from "openclaw/plugin-sdk/agent-harness-registration";
@@ -30,8 +30,8 @@ import path from "node:path";
 import fs$1 from "node:fs/promises";
 import { extractErrorCode } from "openclaw/plugin-sdk/error-runtime";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
-import { AgentHarnessPreflightError as AgentHarnessPreflightError$1, embeddedAgentLog as embeddedAgentLog$1, formatErrorMessage as formatErrorMessage$1 } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { ensureAuthProfileStore, findPersistedAuthProfileCredential, refreshOAuthCredentialForRuntime, resolveApiKeyForProfile, resolvePersistedAuthProfileOwnerAgentDir } from "openclaw/plugin-sdk/agent-runtime";
+import { AgentHarnessPreflightError as AgentHarnessPreflightError$1, embeddedAgentLog as embeddedAgentLog$1, formatErrorMessage as formatErrorMessage$1 } from "openclaw/plugin-sdk/agent-harness-runtime";
 import { hasUsableOAuthCredential, resolveOpenAICodexAuthIdentity } from "openclaw/plugin-sdk/provider-auth";
 import { assertDirectoryIdentitySync, readDirectoryIdentity } from "@openclaw/fs-safe/advanced";
 import { assertNoSymlinkParents, pathScope } from "openclaw/plugin-sdk/security-runtime";
@@ -63,10 +63,8 @@ async function withCodexStartupTimeout(params) {
 	try {
 		return await Promise.race([params.operation(), new Promise((_, reject) => {
 			const rejectOnce = (error) => {
-				if (timeout) {
-					clearTimeout(timeout);
-					timeout = void 0;
-				}
+				clearTimeout(timeout);
+				timeout = void 0;
 				reject(error);
 			};
 			timeout = setTimeout(() => {
@@ -87,7 +85,7 @@ async function withCodexStartupTimeout(params) {
 		}
 		throw error;
 	} finally {
-		if (timeout) clearTimeout(timeout);
+		clearTimeout(timeout);
 		abortCleanup?.();
 	}
 }
@@ -116,13 +114,7 @@ async function assertOwnedServicePath(params) {
 		allowMissing: true
 	});
 	assertPathAtOrInside(params.ownershipRoot, params.targetParent, "Computer Use service parent");
-	await assertNoSymlinkParents({
-		rootDir: params.ownershipRoot,
-		targetPath: params.targetParent,
-		allowMissing: true,
-		requireDirectories: true,
-		messagePrefix: "Computer Use service path"
-	});
+	await assertServicePathParents(params.ownershipRoot, params.targetParent, true);
 	await assertNotSymlink(params.targetPath, "Computer Use service target");
 }
 async function ensureOwnedCodexHome(codexHomeInput, ownershipRootInput = path.dirname(path.resolve(codexHomeInput))) {
@@ -147,13 +139,7 @@ async function ensureOwnedCodexHome(codexHomeInput, ownershipRootInput = path.di
 async function prepareOwnedServiceParent(params) {
 	await ensureOwnedCodexHome(params.codexHome, params.ownershipRoot);
 	await ensureRealDirectoryTree(params.ownershipRoot, params.targetParent, "Computer Use service parent");
-	await assertNoSymlinkParents({
-		rootDir: params.ownershipRoot,
-		targetPath: params.targetParent,
-		allowMissing: false,
-		requireDirectories: true,
-		messagePrefix: "Computer Use service path"
-	});
+	await assertServicePathParents(params.ownershipRoot, params.targetParent, false);
 	const [rootIdentity, parentIdentity] = await Promise.all([readRealDirectoryIdentity(params.ownershipRoot, "Computer Use ownership root"), readRealDirectoryIdentity(params.targetParent, "Computer Use service parent")]);
 	assertPathAtOrInside(rootIdentity.realPath, parentIdentity.realPath, "canonical Computer Use service parent");
 	return parentIdentity;
@@ -161,10 +147,13 @@ async function prepareOwnedServiceParent(params) {
 async function assertOwnedCodexHomePath(params) {
 	await readRealDirectoryIdentity(params.ownershipRoot, "Computer Use ownership root");
 	assertPathAtOrInside(params.ownershipRoot, params.codexHome, "isolated Codex home");
-	await assertNoSymlinkParents({
-		rootDir: params.ownershipRoot,
-		targetPath: params.codexHome,
-		allowMissing: params.allowMissing,
+	await assertServicePathParents(params.ownershipRoot, params.codexHome, params.allowMissing);
+}
+function assertServicePathParents(rootDir, targetPath, allowMissing) {
+	return assertNoSymlinkParents({
+		rootDir,
+		targetPath,
+		allowMissing,
 		requireDirectories: true,
 		messagePrefix: "Computer Use service path"
 	});
@@ -182,9 +171,6 @@ async function readRealDirectoryIdentity(directoryPath, label) {
 		throw new Error(`${label} must remain a real directory: ${logicalPath}`, { cause });
 	}
 }
-async function assertOwnedServiceParentStable(parent) {
-	await assertDirectoryIdentityStable(parent, "Computer Use service parent");
-}
 async function assertDirectoryIdentityStable(expected, label) {
 	if (!await directoryIdentityIsStable(expected)) throw new Error(`${label} changed during refresh; refusing to mutate the replacement path.`);
 }
@@ -401,15 +387,18 @@ async function resolveManagedCodexComputerUseConfig(config, marketplacePath) {
 }
 /** A native plugin disable veto must survive an automatic identity replacement. */
 function isLegacyCodexComputerUsePluginDisabled(config) {
-	const plugin = isRecord(config) && isRecord(config.plugins) ? config.plugins["computer-use@openai-bundled"] : void 0;
-	return isRecord(plugin) && plugin.enabled === false;
+	return readLegacyComputerUsePlugin(config)?.enabled === false;
 }
 /** Renaming a server must not discard an operator's legacy server or tool restrictions. */
 function hasLegacyCodexComputerUseMcpPolicy(config) {
 	if (!isRecord(config)) return false;
 	if (isRecord(config.mcp_servers) && Object.hasOwn(config.mcp_servers, "computer-use")) return true;
-	const plugin = isRecord(config.plugins) ? config.plugins["computer-use@openai-bundled"] : void 0;
-	return isRecord(plugin) && isRecord(plugin.mcp_servers) && Object.keys(plugin.mcp_servers).length > 0;
+	const servers = readLegacyComputerUsePlugin(config)?.mcp_servers;
+	return isRecord(servers) && Object.keys(servers).length > 0;
+}
+function readLegacyComputerUsePlugin(config) {
+	const plugins = asOptionalRecord(asOptionalRecord(config)?.plugins);
+	return asOptionalRecord(plugins?.["computer-use@openai-bundled"]);
 }
 async function readObject(file) {
 	try {
@@ -628,6 +617,7 @@ const CLIENT_BUNDLE_ID = "com.openai.sky.CUAService.cli";
 const OPENAI_TEAM_ID = "2DC432GLL2";
 const CLIENT_APP_RELATIVE_PATH = path.join("Contents", "SharedSupport", "SkyComputerUseClient.app");
 const CLIENT_RELATIVE_PATH = path.join(CLIENT_APP_RELATIVE_PATH, "Contents", "MacOS", "SkyComputerUseClient");
+const SERVICE_PARENT_LABEL = "Computer Use service parent";
 const COPY_TIMEOUT_MS = 12e4;
 const INSPECT_TIMEOUT_MS = 3e4;
 const activeInstalls = /* @__PURE__ */ new Map();
@@ -707,31 +697,31 @@ async function ensureCodexComputerUseServiceAppOnce(params) {
 	await assertNotSymlink(operationTargetPath, "Computer Use service target");
 	const initialTarget = await readServiceAppSnapshot(operationTargetPath, inspectServiceApp);
 	if (initialTarget.identity && identitiesMatch(initialTarget.identity, sourceIdentity)) return alreadyCurrent;
-	await assertOwnedServiceParentStable(ownedParent);
+	await assertDirectoryIdentityStable(ownedParent, SERVICE_PARENT_LABEL);
 	const stagingRoot = await fs$1.mkdtemp(path.join(ownedParent.realPath, ".service-app.staging-"));
 	const stagingRootIdentity = await readRealDirectoryIdentity(stagingRoot, "Computer Use service staging directory");
 	const stagedPath = path.join(stagingRoot, SERVICE_APP_NAME);
 	const backupPath = path.join(ownedParent.realPath, `.service-app.backup-${process.pid}-${Date.now()}`);
 	let backupCreated = false;
 	const restoreBackup = async () => {
-		await assertOwnedServiceParentStable(ownedParent);
+		await assertDirectoryIdentityStable(ownedParent, SERVICE_PARENT_LABEL);
 		await fs$1.rename(backupPath, operationTargetPath);
-		await assertOwnedServiceParentStable(ownedParent);
+		await assertDirectoryIdentityStable(ownedParent, SERVICE_PARENT_LABEL);
 		backupCreated = false;
 	};
 	const removeBackup = async () => {
-		await assertOwnedServiceParentStable(ownedParent);
+		await assertDirectoryIdentityStable(ownedParent, SERVICE_PARENT_LABEL);
 		await assertNotSymlink(backupPath, "Computer Use service backup");
 		await fs$1.rm(backupPath, {
 			recursive: true,
 			force: true
 		});
-		await assertOwnedServiceParentStable(ownedParent);
+		await assertDirectoryIdentityStable(ownedParent, SERVICE_PARENT_LABEL);
 		backupCreated = false;
 	};
 	try {
 		await (params.copyServiceApp ?? copyServiceAppWithDitto)(sourcePath, stagedPath);
-		await assertOwnedServiceParentStable(ownedParent);
+		await assertDirectoryIdentityStable(ownedParent, SERVICE_PARENT_LABEL);
 		await assertDirectoryIdentityStable(stagingRootIdentity, "Computer Use service staging directory");
 		await assertNotSymlink(stagedPath, "Copied Computer Use service app");
 		const stagedIdentity = await inspectServiceApp(stagedPath);
@@ -739,15 +729,15 @@ async function ensureCodexComputerUseServiceAppOnce(params) {
 		const stagedSnapshot = await readServiceAppSnapshot(stagedPath, inspectServiceApp);
 		const currentSourceIdentity = await inspectServiceApp(sourcePath);
 		await waitForCodexDesktopGeneration();
-		await assertOwnedServiceParentStable(ownedParent);
+		await assertDirectoryIdentityStable(ownedParent, SERVICE_PARENT_LABEL);
 		await assertDirectoryIdentityStable(stagingRootIdentity, "Computer Use service staging directory");
 		if (!currentSourceIdentity || !identitiesMatch(currentSourceIdentity, sourceIdentity)) throw new Error("Selected Computer Use service source changed during refresh.");
 		await assertNotSymlink(operationTargetPath, "Computer Use service target");
 		if (await pathExists$1(operationTargetPath)) {
-			await assertOwnedServiceParentStable(ownedParent);
+			await assertDirectoryIdentityStable(ownedParent, SERVICE_PARENT_LABEL);
 			params.assertCurrent?.();
 			await fs$1.rename(operationTargetPath, backupPath);
-			await assertOwnedServiceParentStable(ownedParent);
+			await assertDirectoryIdentityStable(ownedParent, SERVICE_PARENT_LABEL);
 			backupCreated = true;
 			const movedTarget = await readServiceAppSnapshot(backupPath, inspectServiceApp);
 			if (movedTarget.identity && identitiesMatch(movedTarget.identity, sourceIdentity)) {
@@ -760,12 +750,12 @@ async function ensureCodexComputerUseServiceAppOnce(params) {
 			}
 		}
 		try {
-			await assertOwnedServiceParentStable(ownedParent);
+			await assertDirectoryIdentityStable(ownedParent, SERVICE_PARENT_LABEL);
 			params.assertCurrent?.();
 			await fs$1.rename(stagedPath, operationTargetPath);
-			await assertOwnedServiceParentStable(ownedParent);
+			await assertDirectoryIdentityStable(ownedParent, SERVICE_PARENT_LABEL);
 		} catch (error) {
-			await assertOwnedServiceParentStable(ownedParent);
+			await assertDirectoryIdentityStable(ownedParent, SERVICE_PARENT_LABEL);
 			await assertNotSymlink(operationTargetPath, "Computer Use service target");
 			const winnerIdentity = await inspectServiceApp(operationTargetPath);
 			if (!winnerIdentity || !identitiesMatch(winnerIdentity, sourceIdentity)) {
@@ -779,15 +769,15 @@ async function ensureCodexComputerUseServiceAppOnce(params) {
 		const installedSnapshot = await readServiceAppSnapshot(operationTargetPath, inspectServiceApp);
 		if (!installedSnapshot.identity || !identitiesMatch(installedSnapshot.identity, sourceIdentity)) {
 			if (filesystemSnapshotsMatch(installedSnapshot, stagedSnapshot)) {
-				await assertOwnedServiceParentStable(ownedParent);
+				await assertDirectoryIdentityStable(ownedParent, SERVICE_PARENT_LABEL);
 				await fs$1.rm(operationTargetPath, {
 					recursive: true,
 					force: true
 				});
-				await assertOwnedServiceParentStable(ownedParent);
+				await assertDirectoryIdentityStable(ownedParent, SERVICE_PARENT_LABEL);
 				if (backupCreated) {
 					await fs$1.rename(backupPath, operationTargetPath);
-					await assertOwnedServiceParentStable(ownedParent);
+					await assertDirectoryIdentityStable(ownedParent, SERVICE_PARENT_LABEL);
 					backupCreated = false;
 				}
 			}
@@ -795,16 +785,14 @@ async function ensureCodexComputerUseServiceAppOnce(params) {
 		}
 		if (backupCreated) await removeBackup();
 		return {
+			...alreadyCurrent,
 			status: initialTarget.exists ? "refreshed" : "installed",
 			changed: true,
-			targetPath: params.targetPath,
-			sourcePath,
-			sourceBuild: sourceIdentity.build,
 			...initialTarget.identity ? { previousBuild: initialTarget.identity.build } : {}
 		};
 	} catch (error) {
 		if (backupCreated && await directoryIdentityIsStable(ownedParent) && !await pathExists$1(operationTargetPath)) {
-			await assertOwnedServiceParentStable(ownedParent);
+			await assertDirectoryIdentityStable(ownedParent, SERVICE_PARENT_LABEL);
 			await fs$1.rename(backupPath, operationTargetPath);
 			backupCreated = false;
 		}
@@ -842,7 +830,7 @@ async function readServiceAppFilesystemKey(appPath) {
 		path.join(appPath, "Contents", "Info.plist"),
 		path.join(appPath, CLIENT_RELATIVE_PATH)
 	];
-	return (await Promise.all(paths.map(async (entryPath) => await fs$1.stat(entryPath).then((stat) => `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeMs}`, () => "missing")))).join("|");
+	return (await Promise.all(paths.map((entryPath) => fs$1.stat(entryPath).then((stat) => `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeMs}`, () => "missing")))).join("|");
 }
 function snapshotsMatch(left, right) {
 	if (left.exists !== right.exists) return false;
@@ -852,7 +840,7 @@ function snapshotsMatch(left, right) {
 	return left.filesystemKey !== void 0 && left.filesystemKey === right.filesystemKey;
 }
 function filesystemSnapshotsMatch(left, right) {
-	return Boolean(left.exists && right.exists && left.filesystemKey && right.filesystemKey && left.filesystemKey === right.filesystemKey);
+	return Boolean(left.exists && right.exists && left.filesystemKey && left.filesystemKey === right.filesystemKey);
 }
 function identitiesMatch(left, right) {
 	return left.bundleId === right.bundleId && left.version === right.version && left.build === right.build && left.cdHash === right.cdHash && left.teamId === right.teamId && left.clientBundleId === right.clientBundleId && left.clientCdHash === right.clientCdHash && left.clientTeamId === right.clientTeamId;
@@ -956,12 +944,8 @@ async function copyServiceAppWithDitto(sourcePath, targetPath) {
 const OPENAI_CODEX_DEFAULT_PROFILE_ID = "openai:default";
 const CODEX_HOME_ENV_VAR = "CODEX_HOME";
 const HOME_ENV_VAR = "HOME";
-const CODEX_APP_SERVER_PREPARED_AUTH_ENV_VARS = [
-	"CODEX_API_KEY",
-	"OPENAI_API_KEY",
-	"CODEX_ACCESS_TOKEN"
-];
-const CODEX_APP_SERVER_HOME_ENV_VARS = [CODEX_HOME_ENV_VAR, HOME_ENV_VAR];
+const CODEX_APP_SERVER_PREPARED_AUTH_ENV_VARS = [...CODEX_APP_SERVER_API_KEY_ENV_VARS, "CODEX_ACCESS_TOKEN"];
+const CODEX_APP_SERVER_HOME_ENV_VARS = /* @__PURE__ */ new Set([CODEX_HOME_ENV_VAR, HOME_ENV_VAR]);
 const MAX_COMPUTER_USE_ARTIFACT_OWNERS = 128;
 const activeComputerUseArtifactReconciliations = /* @__PURE__ */ new Map();
 const scopedOAuthRefreshQueues = /* @__PURE__ */ new WeakMap();
@@ -1145,9 +1129,10 @@ async function withCodexHomeEnvironment(startOptions, agentDir) {
 			...nativeHome ? { [HOME_ENV_VAR]: nativeHome } : {}
 		}
 	};
-	const clearEnv = withoutClearedCodexHomeEnv(startOptions.clearEnv);
-	if (clearEnv) nextStartOptions.clearEnv = clearEnv;
-	else delete nextStartOptions.clearEnv;
+	if (startOptions.clearEnv) {
+		const filtered = startOptions.clearEnv.filter((envVar) => !CODEX_APP_SERVER_HOME_ENV_VARS.has(envVar.trim().toUpperCase()));
+		nextStartOptions.clearEnv = filtered.length === startOptions.clearEnv.length ? startOptions.clearEnv : filtered;
+	} else delete nextStartOptions.clearEnv;
 	return nextStartOptions;
 }
 /** Reconciles Computer Use artifacts for the exact managed command about to start. */
@@ -1156,16 +1141,12 @@ async function reconcileCodexComputerUseStartArtifacts(params) {
 	const codexHome = resolveCodexAppServerLocalHomeDir(params.startOptions, params.agentDir);
 	const key = path.resolve(codexHome);
 	let owner = activeComputerUseArtifactReconciliations.get(key);
-	if (!owner) {
-		owner = {
-			active: 0,
-			tail: Promise.resolve()
-		};
-		activeComputerUseArtifactReconciliations.set(key, owner);
-	} else {
-		activeComputerUseArtifactReconciliations.delete(key);
-		activeComputerUseArtifactReconciliations.set(key, owner);
-	}
+	if (!owner) owner = {
+		active: 0,
+		tail: Promise.resolve()
+	};
+	else activeComputerUseArtifactReconciliations.delete(key);
+	activeComputerUseArtifactReconciliations.set(key, owner);
 	owner.active += 1;
 	const epoch = params.desktopGeneration?.epoch;
 	if (epoch !== void 0 && (owner.latestEpoch === void 0 || epoch > owner.latestEpoch)) owner.latestEpoch = epoch;
@@ -1173,7 +1154,7 @@ async function reconcileCodexComputerUseStartArtifacts(params) {
 		params.assertCurrent?.();
 		if (epoch !== void 0 && owner.latestEpoch !== epoch) throw new Error("Codex Computer Use artifact reconciliation was superseded.");
 	};
-	const operation = owner.tail.catch(() => void 0).then(async () => {
+	const operation = owner.tail.then(async () => {
 		assertCurrent();
 		const appliedCacheBinding = await reconcileCodexComputerUseStartArtifactsOnce({
 			...params,
@@ -1184,7 +1165,7 @@ async function reconcileCodexComputerUseStartArtifacts(params) {
 		assertCurrent();
 		owner.appliedCacheBinding = appliedCacheBinding;
 	});
-	const settled = operation.then(() => void 0, () => void 0);
+	const settled = operation.catch(() => void 0);
 	owner.tail = settled;
 	try {
 		await operation;
@@ -1283,12 +1264,6 @@ var CodexComputerUseCandidateArtifactsUnavailableError = class extends Error {
 		this.name = "CodexComputerUseCandidateArtifactsUnavailableError";
 	}
 };
-function withoutClearedCodexHomeEnv(clearEnv) {
-	if (!clearEnv) return;
-	const reserved = new Set(CODEX_APP_SERVER_HOME_ENV_VARS);
-	const filtered = clearEnv.filter((envVar) => !reserved.has(envVar.trim().toUpperCase()));
-	return filtered.length === clearEnv.length ? clearEnv : filtered;
-}
 async function applyCodexAppServerAuthProfile(params) {
 	params.assertCurrent?.();
 	if (!params.preparedAuth && params.authProfileId === null) {
@@ -1356,7 +1331,7 @@ function createCodexAppServerAuthError(message) {
 async function refreshCodexAppServerAuthTokens(params) {
 	const previousAccountId = params.previousAccountId?.trim();
 	const handoffAccountId = params.authHandoff?.chatgptAccountId.trim();
-	if (previousAccountId && handoffAccountId && previousAccountId !== handoffAccountId) throw new Error("ChatGPT workspace changed before Codex token refresh. Retry to start a client for the selected workspace.");
+	if (previousAccountId && handoffAccountId && previousAccountId !== handoffAccountId) throw codexWorkspaceChangedError("before");
 	if (previousAccountId) {
 		const store = resolveCodexAppServerAuthProfileStore(params);
 		const profileId = resolveCodexAppServerAuthProfileId({
@@ -1365,14 +1340,14 @@ async function refreshCodexAppServerAuthTokens(params) {
 		});
 		const credential = profileId ? store.profiles[profileId] : void 0;
 		const selectedAccountId = credential ? resolveExplicitChatgptAccountId(credential) ?? (credential.type === "oauth" ? resolveOpenAICodexAuthIdentity({ access: credential.access }).accountId : void 0) : void 0;
-		if (selectedAccountId && selectedAccountId !== previousAccountId) throw new Error("ChatGPT workspace changed before Codex token refresh. Retry to start a client for the selected workspace.");
+		if (selectedAccountId && selectedAccountId !== previousAccountId) throw codexWorkspaceChangedError("before");
 	}
 	const loginParams = await resolveCodexAppServerAuthProfileLoginParamsInternal({
 		...params,
 		forceOAuthRefresh: true
 	});
 	if (!loginParams || loginParams.type !== "chatgptAuthTokens") throw new Error("Codex app-server ChatGPT token refresh requires an OAuth auth profile. Sign in with `openclaw models auth login --provider openai`, select that profile, then retry.");
-	if (previousAccountId && loginParams.chatgptAccountId !== previousAccountId || params.authHandoff && loginParams.chatgptAccountId !== params.authHandoff.chatgptAccountId) throw new Error("ChatGPT workspace changed during Codex token refresh. Retry to start a client for the selected workspace.");
+	if (previousAccountId && loginParams.chatgptAccountId !== previousAccountId || params.authHandoff && loginParams.chatgptAccountId !== params.authHandoff.chatgptAccountId) throw codexWorkspaceChangedError("during");
 	return {
 		accessToken: loginParams.accessToken,
 		chatgptAccountId: loginParams.chatgptAccountId,
@@ -1389,32 +1364,14 @@ async function resolveCodexAppServerAuthProfileLoginParamsInternal(params) {
 	const credential = store.profiles[profileId];
 	if (!credential) throw new CodexAppServerAuthProfileUnavailableError(formatCodexAuthProfileUnavailableMessage(profileId));
 	if (!isCodexAppServerAuthProvider(credential.provider)) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" must use the canonical OpenAI auth provider; run "openclaw doctor --fix" to migrate legacy provider IDs.`);
-	const loginParams = await resolveLoginParamsForCredential(profileId, credential, {
-		agentDir: params.agentDir,
-		store,
-		preferStoreCredential: Boolean(params.authProfileStore?.profiles[profileId]),
-		forceOAuthRefresh: params.forceOAuthRefresh === true,
-		authHandoff: params.authHandoff,
-		previousAccountId: params.previousAccountId,
-		config: params.config
-	});
-	if (!loginParams) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" does not contain usable credentials. Repair or replace the selected OpenAI credential, then retry.`);
-	return loginParams;
-}
-async function resolveCodexAppServerFallbackApiKeyLoginParams(params) {
-	const apiKey = readFirstNonEmptyEnv(params.env, CODEX_APP_SERVER_API_KEY_ENV_VARS) ?? await readCodexCliAuthFileApiKey(params.codexCliAuthEnv);
-	if (!apiKey) return;
-	if ((await params.client.request("account/read", { refreshToken: false }, { assertCurrent: params.assertCurrent })).account) return;
-	return {
-		type: "apiKey",
-		apiKey
-	};
-}
-async function resolveLoginParamsForCredential(profileId, credential, params) {
+	const preferStoreCredential = Boolean(params.authProfileStore?.profiles[profileId]);
+	let loginCredential = credential;
+	let value;
+	let useApiKey = false;
 	if (credential.type === "api_key" || credential.type === "token") {
-		const value = (await resolveApiKeyForProfile({
+		value = (await resolveApiKeyForProfile({
 			cfg: params.config,
-			store: params.preferStoreCredential ? params.store : ensureAuthProfileStore(params.agentDir, {
+			store: preferStoreCredential ? store : ensureAuthProfileStore(params.agentDir, {
 				allowKeychainPrompt: false,
 				profileId,
 				config: params.config
@@ -1422,23 +1379,30 @@ async function resolveLoginParamsForCredential(profileId, credential, params) {
 			profileId,
 			agentDir: params.agentDir
 		}))?.apiKey?.trim();
-		if (!value) return;
-		return credential.type === "api_key" ? {
-			type: "apiKey",
-			apiKey: value
-		} : buildChatgptAuthTokensParams(profileId, credential, value);
+		useApiKey = credential.type === "api_key";
+	} else {
+		loginCredential = await resolveOAuthCredentialForCodexAppServer(profileId, credential, {
+			...params,
+			store,
+			preferStoreCredential,
+			forceRefresh: params.forceOAuthRefresh === true
+		});
+		value = loginCredential.access?.trim();
 	}
-	const resolvedCredential = await resolveOAuthCredentialForCodexAppServer(profileId, credential, {
-		agentDir: params.agentDir,
-		store: params.store,
-		preferStoreCredential: params.preferStoreCredential,
-		forceRefresh: params.forceOAuthRefresh,
-		authHandoff: params.authHandoff,
-		previousAccountId: params.previousAccountId,
-		config: params.config
-	});
-	const accessToken = resolvedCredential.access?.trim();
-	return accessToken ? buildChatgptAuthTokensParams(profileId, resolvedCredential, accessToken) : void 0;
+	if (!value) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" does not contain usable credentials. Repair or replace the selected OpenAI credential, then retry.`);
+	return useApiKey ? {
+		type: "apiKey",
+		apiKey: value
+	} : buildChatgptAuthTokensParams(profileId, loginCredential, value);
+}
+async function resolveCodexAppServerFallbackApiKeyLoginParams(params) {
+	const apiKey = readFirstNonEmptyEnv(params.env, CODEX_APP_SERVER_API_KEY_ENV_VARS) ?? await readCodexCliAuthFileApiKey(params.codexCliAuthEnv);
+	if (!apiKey) return;
+	if ((await params.client.request("account/read", { refreshToken: false }, { assertCurrent: params.assertCurrent })).account) return;
+	return {
+		type: "apiKey",
+		apiKey
+	};
 }
 async function resolveOAuthCredentialForCodexAppServer(profileId, credential, params) {
 	const ownerAgentDir = resolvePersistedAuthProfileOwnerAgentDir({
@@ -1449,13 +1413,9 @@ async function resolveOAuthCredentialForCodexAppServer(profileId, credential, pa
 		agentDir: ownerAgentDir,
 		profileId
 	});
-	const useScopedCredential = params.preferStoreCredential && shouldUseScopedOAuthCredential({
-		store: params.store,
-		profileId,
-		persistedCredential,
-		suppliedCredential: credential
-	});
-	if (params.preferStoreCredential && params.store.runtimePersistedProfileIds?.includes(profileId) && (persistedCredential?.type !== "oauth" || !isCodexAppServerAuthProvider(persistedCredential.provider))) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" is no longer an OpenAI OAuth credential in its persisted OpenClaw store. Run "openclaw doctor" to inspect credential ownership, or select an existing OpenAI profile.`);
+	const persistedProfile = params.store.runtimePersistedProfileIds?.includes(profileId);
+	const useScopedCredential = params.preferStoreCredential && (!persistedProfile || persistedCredential?.type === "oauth" && isCodexAppServerAuthProvider(persistedCredential.provider) && !isDeepStrictEqual(persistedCredential, credential) && !hasMatchingOAuthIdentity(persistedCredential, credential));
+	if (params.preferStoreCredential && persistedProfile && (persistedCredential?.type !== "oauth" || !isCodexAppServerAuthProvider(persistedCredential.provider))) throw new CodexAppServerAuthProfileUnavailableError(`Codex app-server auth profile "${profileId}" is no longer an OpenAI OAuth credential in its persisted OpenClaw store. Run "openclaw doctor" to inspect credential ownership, or select an existing OpenAI profile.`);
 	const store = useScopedCredential ? params.store : resolveCodexAppServerAuthProfileStore({
 		agentDir: ownerAgentDir,
 		authProfileId: profileId,
@@ -1472,7 +1432,7 @@ async function resolveOAuthCredentialForCodexAppServer(profileId, credential, pa
 	});
 	const selectedAccountId = currentCredential ? resolveOpenAICodexAuthIdentity(currentCredential).accountId?.trim() : void 0;
 	const callbackAccountId = params.authHandoff?.chatgptAccountId.trim() ?? params.previousAccountId?.trim() ?? void 0;
-	if (callbackAccountId && selectedAccountId && callbackAccountId !== selectedAccountId) throw new Error("ChatGPT workspace changed before Codex token refresh. Retry to start a client for the selected workspace.");
+	if (callbackAccountId && selectedAccountId && callbackAccountId !== selectedAccountId) throw codexWorkspaceChangedError("before");
 	const expectedAccountId = callbackAccountId ?? selectedAccountId;
 	if (useScopedCredential && overlaidOAuthCredential) return await resolveScopedOAuthCredential({
 		store,
@@ -1483,7 +1443,6 @@ async function resolveOAuthCredentialForCodexAppServer(profileId, credential, pa
 		config: params.config
 	});
 	if (params.forceRefresh && !persistedOAuthCredential && overlaidOAuthCredential) {
-		if (reuseCompletedRotation) return overlaidOAuthCredential;
 		const refreshedRuntimeCredential = await refreshOAuthCredentialForRuntime({
 			credential: overlaidOAuthCredential,
 			cfg: params.config
@@ -1518,12 +1477,6 @@ function shouldReuseCompletedCodexOAuthRotation(params) {
 	const previousAccountId = params.previousAccountId?.trim();
 	return accountId === handoff.chatgptAccountId && (!previousAccountId || previousAccountId === handoff.chatgptAccountId);
 }
-function shouldUseScopedOAuthCredential(params) {
-	if (!params.store.runtimePersistedProfileIds?.includes(params.profileId)) return true;
-	const persisted = params.persistedCredential;
-	if (persisted?.type !== "oauth" || !isCodexAppServerAuthProvider(persisted.provider)) return false;
-	return !isDeepStrictEqual(persisted, params.suppliedCredential) && !hasMatchingOAuthIdentity(persisted, params.suppliedCredential);
-}
 function hasMatchingOAuthIdentity(persisted, supplied) {
 	const persistedAccountId = resolveOpenAICodexAuthIdentity(persisted).accountId?.trim();
 	const suppliedAccountId = resolveOpenAICodexAuthIdentity(supplied).accountId?.trim();
@@ -1563,9 +1516,12 @@ async function resolveScopedOAuthCredential(params) {
 		if (storeRefreshes.get(params.profileId) === refresh) storeRefreshes.delete(params.profileId);
 	}
 }
+function codexWorkspaceChangedError(phase) {
+	return /* @__PURE__ */ new Error(`ChatGPT workspace changed ${phase} Codex token refresh. Retry to start a client for the selected workspace.`);
+}
 function assertCodexOAuthRefreshWorkspace(profileId, credential, expectedAccountId) {
 	if (!expectedAccountId) return;
-	if (buildChatgptAuthTokensParams(profileId, credential, credential.access.trim()).chatgptAccountId !== expectedAccountId) throw new Error("ChatGPT workspace changed during Codex token refresh. Retry to start a client for the selected workspace.");
+	if (buildChatgptAuthTokensParams(profileId, credential, credential.access.trim()).chatgptAccountId !== expectedAccountId) throw codexWorkspaceChangedError("during");
 }
 function isCodexAppServerAuthProvider(provider) {
 	return provider.trim().toLowerCase() === CODEX_APP_SERVER_AUTH_PROVIDER;
@@ -1601,10 +1557,7 @@ function resolveStableChatgptAccountId(credential) {
 	return resolveExplicitChatgptAccountId(credential) ?? (credential.email?.trim() || void 0);
 }
 function resolveExplicitChatgptAccountId(credential) {
-	if ("accountId" in credential && typeof credential.accountId === "string") {
-		const accountId = credential.accountId.trim();
-		if (accountId) return accountId;
-	}
+	return "accountId" in credential && typeof credential.accountId === "string" ? credential.accountId.trim() || void 0 : void 0;
 }
 //#endregion
 //#region extensions/codex/src/app-server/client-thread-owner.ts
@@ -1793,12 +1746,19 @@ function readRecentCodexRateLimits(client, options) {
 }
 function mergeRateLimitUpdate(current, update) {
 	const currentEnvelope = isJsonObject(current) ? current : void 0;
-	const currentPrimary = currentEnvelope && isJsonObject(currentEnvelope.rateLimits) ? currentEnvelope.rateLimits : void 0;
-	const currentByLimitId = currentEnvelope && isJsonObject(currentEnvelope.rateLimitsByLimitId) ? currentEnvelope.rateLimitsByLimitId : void 0;
+	const currentPrimary = readObjectField(currentEnvelope, "rateLimits");
+	const currentByLimitId = readObjectField(currentEnvelope, "rateLimitsByLimitId");
 	const limitId = readLimitId(update);
 	const currentPrimaryLimitId = currentPrimary ? readLimitId(currentPrimary) : void 0;
-	const currentForLimit = (currentByLimitId && isJsonObject(currentByLimitId[limitId]) ? currentByLimitId[limitId] : void 0) ?? (currentPrimaryLimitId === limitId ? currentPrimary : void 0);
-	const merged = mergeSparseSnapshot(isJsonObject(currentForLimit) ? currentForLimit : void 0, currentPrimary, update, limitId);
+	const currentForLimit = readObjectField(currentByLimitId, limitId) ?? (currentPrimaryLimitId === limitId ? currentPrimary : void 0);
+	const merged = {
+		...update,
+		limitId
+	};
+	for (const key of SPARSE_ACCOUNT_METADATA_KEYS) {
+		const previous = currentForLimit?.[key] ?? currentPrimary?.[key];
+		if (merged[key] == null && previous != null) merged[key] = previous;
+	}
 	const nextPrimary = !currentPrimary || currentPrimaryLimitId === limitId ? merged : currentPrimary;
 	let nextByLimitId;
 	if (currentByLimitId) nextByLimitId = {
@@ -1825,24 +1785,20 @@ function readRateLimitIds(value) {
 	}
 	return [...ids];
 }
-function mergeSparseSnapshot(current, accountFallback, update, limitId) {
-	const merged = {
-		...update,
-		limitId
-	};
-	for (const key of SPARSE_ACCOUNT_METADATA_KEYS) {
-		const previous = current?.[key] ?? accountFallback?.[key];
-		if (merged[key] == null && previous != null) merged[key] = previous;
-	}
-	return merged;
-}
 function readLimitId(snapshot) {
 	const value = snapshot.limitId;
 	return typeof value === "string" && value.trim() ? value.trim() : "codex";
 }
+function readObjectField(value, key) {
+	return value && isJsonObject(value[key]) ? value[key] : void 0;
+}
 //#endregion
 //#region extensions/codex/src/app-server/client-runtime.ts
-/** Client-scoped Codex auth and account observers. */
+function defaultThreadRelease(client) {
+	return async (threadId, assertCurrent, withCurrent) => {
+		await unsubscribeCodexAppServerLiveThread(client, threadId, 5e3, assertCurrent, withCurrent);
+	};
+}
 /** Match Codex's native grace window without retaining inactive conversations indefinitely. */
 const CODEX_APP_SERVER_LIVE_THREAD_IDLE_TIMEOUT_MS = 18e5;
 /** Native-child parents are active ownership, so only otherwise-idle threads count against this cap. */
@@ -1899,10 +1855,8 @@ function ensureCodexAppServerClientRuntime(client, context) {
 	configuredClients.set(client, runtime);
 	client.addCloseHandler(() => {
 		runtime.closed = true;
-		if (runtime.evictionTimer) {
-			clearTimeout(runtime.evictionTimer);
-			runtime.evictionTimer = void 0;
-		}
+		clearTimeout(runtime.evictionTimer);
+		runtime.evictionTimer = void 0;
 		for (const threadId of /* @__PURE__ */ new Set([
 			...runtime.retainedThreads.keys(),
 			...runtime.claimedThreads.keys(),
@@ -1963,10 +1917,8 @@ function ensureCodexAppServerClientRuntime(client, context) {
 	});
 }
 function scheduleRetainedThreadEviction(client, runtime) {
-	if (runtime.evictionTimer) {
-		clearTimeout(runtime.evictionTimer);
-		runtime.evictionTimer = void 0;
-	}
+	clearTimeout(runtime.evictionTimer);
+	runtime.evictionTimer = void 0;
 	if (runtime.closed) return;
 	let expiresAt = Number.POSITIVE_INFINITY;
 	for (const [threadId, thread] of runtime.retainedThreads) if (!runtime.protectedThreads.has(threadId)) expiresAt = Math.min(expiresAt, thread.expiresAt);
@@ -2055,9 +2007,7 @@ async function retainCodexAppServerLiveThread(client, threadId, releaseThread, c
 		ephemeralPolicy,
 		serviceTier,
 		expiresAt: ephemeralPolicy === void 0 ? Date.now() + CODEX_APP_SERVER_LIVE_THREAD_IDLE_TIMEOUT_MS : Number.POSITIVE_INFINITY,
-		release: (releaseThread ? physicalThreadReleases.get(releaseThread) ?? releaseThread : void 0) ?? (async (releasedThreadId, assertCurrent, withCurrent) => {
-			await unsubscribeCodexAppServerLiveThread(client, releasedThreadId, 5e3, assertCurrent, withCurrent);
-		})
+		release: (releaseThread ? physicalThreadReleases.get(releaseThread) ?? releaseThread : void 0) ?? defaultThreadRelease(client)
 	};
 	runtime.retainedThreads.set(threadId, retained);
 	if (previousOwner !== ownerToken) previousOwner?.invalidate();
@@ -2101,9 +2051,7 @@ async function claimCodexAppServerLiveThread(client, threadId, onInvalidated) {
 	}
 	return claimCodexAppServerThreadOwnership(client, runtime, threadId, runtime.retainedThreads.get(threadId) ?? {
 		expiresAt: Date.now() + CODEX_APP_SERVER_LIVE_THREAD_IDLE_TIMEOUT_MS,
-		release: async (releasedThreadId, assertCurrent, withCurrent) => {
-			await unsubscribeCodexAppServerLiveThread(client, releasedThreadId, 5e3, assertCurrent, withCurrent);
-		}
+		release: defaultThreadRelease(client)
 	}, onInvalidated);
 }
 function claimCodexAppServerThreadOwnership(client, runtime, threadId, retained, onInvalidated) {
@@ -2318,15 +2266,13 @@ function supportsInferenceEnvironment(native) {
 		const lower = upper.toLowerCase();
 		if (native[upper] !== process.env[upper] || native[lower] !== process.env[lower] || native[upper] !== void 0 && native[lower] !== void 0 && native[upper] !== native[lower]) return false;
 	}
-	const value = (name) => (native[name] ?? native[name.toLowerCase()])?.trim() || void 0;
-	const http = value("HTTP_PROXY");
-	const https = value("HTTPS_PROXY");
-	const all = value("ALL_PROXY");
+	const value = (name) => native[name] ?? native[name.toLowerCase()];
+	const [http, https, all] = names.slice(0, 3).map((name) => value(name)?.trim() || void 0);
 	if (!http && !https && !all) return true;
 	const noProxy = native.NO_PROXY ?? native.no_proxy ?? "";
 	if (noProxy === "*") return true;
 	if (native.REQUEST_METHOD !== void 0 || names.slice(0, 3).some((name) => {
-		const raw = native[name] ?? native[name.toLowerCase()];
+		const raw = value(name);
 		return raw !== void 0 && raw !== raw.trim();
 	})) return false;
 	if ((https ?? all) !== (https ?? http ?? all)) return false;
@@ -2366,8 +2312,7 @@ function projectProviderRoutes(config, providers) {
 	return projected;
 }
 function readProviderBaseUrl(config, provider) {
-	if (provider === "openai") return config?.openai_base_url;
-	return readProviderField(config, provider, "base_url");
+	return provider === "openai" ? config?.openai_base_url : readProviderField(config, provider, "base_url");
 }
 function readProviderField(config, provider, field) {
 	const selected = (isJsonObject(config?.model_providers) ? config.model_providers : void 0)?.[provider];
@@ -2455,6 +2400,7 @@ async function prepareCodexInferenceRoute(params) {
 		...params.authority ? { withCurrent: params.authority.withCurrent } : {}
 	});
 	assertCurrent();
+	const feature = (name) => params.config?.[`features.${name}`] ?? (isJsonObject(params.config?.features) ? params.config.features[name] : void 0) ?? (isJsonObject(snapshot.config.features) ? snapshot.config.features[name] : void 0);
 	const unsupported = () => {
 		if (owner.oauth) throw new Error("ChatGPT subscription sharing requires the managed public Responses inference route.");
 	};
@@ -2473,7 +2419,7 @@ async function prepareCodexInferenceRoute(params) {
 		"ollama",
 		"lmstudio"
 	].includes(provider) || hasProviderAws(params.config, provider) || hasProviderAws(snapshot.config, provider) || wireApi != null && wireApi !== "responses")) return unsupported();
-	if ((params.config?.["features.respect_system_proxy"] ?? (isJsonObject(params.config?.features) ? params.config.features.respect_system_proxy : void 0) ?? (isJsonObject(snapshot.config.features) ? snapshot.config.features.respect_system_proxy : void 0)) === true) return unsupported();
+	if (feature("respect_system_proxy") === true) return unsupported();
 	const configured = customProvider ? providerField("base_url") : params.config?.openai_base_url ?? snapshot.config.openai_base_url;
 	if (configured != null && typeof configured !== "string") throw new Error("Codex inference upstream configuration is invalid");
 	if (typeof configured === "string" && (!configured.trim() || configured.includes("?") || configured.includes("#"))) return unsupported();
@@ -2512,7 +2458,7 @@ async function prepareCodexInferenceRoute(params) {
 		"windows.net/openai"
 	].some((marker) => nativeBaseUrl.includes(marker));
 	const preserveCodexBackendRoutes = nativeProviderName === "OpenAI" && (configured == null || configured.replace(/\/+$/, "").endsWith("/backend-api/codex"));
-	const memoryFeature = params.config?.["features.memories"] ?? (isJsonObject(params.config?.features) ? params.config.features.memories : void 0) ?? (isJsonObject(snapshot.config.features) ? snapshot.config.features.memories : void 0);
+	const memoryFeature = feature("memories");
 	const modelPolicyEnforced = params.modelPolicyEnforced !== false;
 	const key = JSON.stringify([
 		provider,
@@ -2534,9 +2480,9 @@ async function prepareCodexInferenceRoute(params) {
 				throw new Error("Codex inference route limit reached; start a fresh managed native connection before retrying.");
 			}
 			pending = Promise.all([
-				import("./inference-proxy-DUO5E2QQ.mjs"),
-				import("./native-subagent-monitor-wh_-K3Vo.mjs").then((n) => n.n),
-				import("./inference-dispatch-B5UKEUyC.mjs")
+				import("./inference-proxy-BDWV0djM.mjs"),
+				import("./native-subagent-monitor-D5O_o07p.mjs").then((n) => n.n),
+				import("./inference-dispatch-CO6tTs4q.mjs")
 			]).then(([{ createCodexInferenceProxy }, native, { createCodexInferenceModelBinding }]) => {
 				assertClient();
 				return createCodexInferenceProxy({
@@ -2760,22 +2706,17 @@ async function waitForPreviousFence(previous, options) {
 	}
 	await new Promise((resolve, reject) => {
 		let timeout;
-		const cleanup = () => {
-			if (timeout) {
-				clearTimeout(timeout);
-				timeout = void 0;
-			}
+		const settle = (error) => {
+			clearTimeout(timeout);
+			timeout = void 0;
 			options.signal?.removeEventListener("abort", onAbort);
+			return error ? reject(error) : resolve();
 		};
-		const settle = (run) => {
-			cleanup();
-			run();
-		};
-		const onAbort = () => settle(() => reject(new Error(options.abortMessage ?? "Codex native config fence aborted")));
-		previous.then(() => settle(resolve));
-		if (options.signal) options.signal.addEventListener("abort", onAbort, { once: true });
+		const onAbort = () => settle(new Error(options.abortMessage ?? "Codex native config fence aborted"));
+		previous.then(() => settle());
+		options.signal?.addEventListener("abort", onAbort, { once: true });
 		if (options.timeoutMs !== void 0) {
-			timeout = setTimeout(() => settle(() => reject(new Error(options.timeoutMessage ?? "Codex native config fence timed out"))), Math.max(1, options.timeoutMs));
+			timeout = setTimeout(() => settle(new Error(options.timeoutMessage ?? "Codex native config fence timed out")), Math.max(1, options.timeoutMs));
 			timeout.unref?.();
 		}
 	});
@@ -2808,7 +2749,7 @@ const nativeHookRelayUnregisterQueue = {
 			clearTimeout(entry.timeout);
 			entry.unregister();
 		}
-		while (closing.size > 0) await Promise.allSettled(closing);
+		await nativeHookRelayUnregisterQueue.clear();
 	},
 	async clear() {
 		for (const entry of pending) clearTimeout(entry.timeout);
@@ -3185,7 +3126,7 @@ async function acquireSharedCodexAppServerClient(options, leased = false) {
 		entry,
 		authProfileId: usesNativeAuth || preparedAuth?.kind === "api-key" ? null : authProfileId,
 		runtimeArtifactMode,
-		...options?.expectedRuntimeArtifact ? { expectedRuntimeArtifact: options.expectedRuntimeArtifact } : {},
+		expectedRuntimeArtifact: options?.expectedRuntimeArtifact,
 		abandonSignal: entry.startupAbort.signal,
 		config: options?.config
 	}));
@@ -3280,7 +3221,7 @@ async function createIsolatedCodexAppServerClient(options) {
 		lifetime,
 		authProfileId: usesNativeAuth || context.preparedAuth?.kind === "api-key" ? null : context.authProfileId,
 		runtimeArtifactMode: options?.runtimeArtifactMode ?? (options?.expectedRuntimeArtifact ? "capture" : void 0),
-		...options?.expectedRuntimeArtifact ? { expectedRuntimeArtifact: options.expectedRuntimeArtifact } : {},
+		expectedRuntimeArtifact: options?.expectedRuntimeArtifact,
 		config: options?.config,
 		timeoutMs: resolveRemainingAcquireTimeout(timeoutMs, startedAt),
 		abandonSignal,
@@ -3311,9 +3252,9 @@ async function startInitializedCodexAppServerClientOnce(params) {
 	const acquireStartedAt = performance.now();
 	const timeoutMs = params.timeoutMs ?? 0;
 	const abandonSignal = params.abandonSignal ? AbortSignal.any([params.lifetime.controller.signal, params.abandonSignal]) : params.lifetime.controller.signal;
-	const waitForStartup = (operation, timeoutMessage = CODEX_APP_SERVER_INITIALIZE_TIMEOUT_MESSAGE, timeoutErrorFactory) => {
+	const waitForStartup = (operation, timeoutErrorFactory) => {
 		if (abandonSignal.aborted) throw new CodexAppServerStartupError("aborted", "codex app-server initialize aborted");
-		return withCodexAppServerAcquireDeadline(resolveRemainingAcquireTimeout(timeoutMs, acquireStartedAt), ownCodexStartup(params.lifetime, operation()), abandonSignal, timeoutMessage, timeoutErrorFactory);
+		return withCodexAppServerAcquireDeadline(resolveRemainingAcquireTimeout(timeoutMs, acquireStartedAt), ownCodexStartup(params.lifetime, operation()), abandonSignal, CODEX_APP_SERVER_INITIALIZE_TIMEOUT_MESSAGE, timeoutErrorFactory);
 	};
 	const startOptionsCandidates = resolveManagedFallbackStartOptions(params.startOptions);
 	for (const [index, startOptions] of startOptionsCandidates.entries()) {
@@ -3355,7 +3296,7 @@ async function startInitializedCodexAppServerClientOnce(params) {
 		} finally {
 			artifactDrain?.cancel();
 		}
-		const runtimeArtifactModule = params.runtimeArtifactMode ? await import("./runtime-artifact-CUTOOnKw.mjs") : void 0;
+		const runtimeArtifactModule = params.runtimeArtifactMode ? await import("./runtime-artifact-C13pR7tD.mjs") : void 0;
 		const runtimeArtifactBeforeStart = runtimeArtifactModule ? await runtimeArtifactModule.captureCodexAppServerRuntimeArtifactBeforeStart({
 			startOptions,
 			spawnIdentity: resolveCodexAppServerSpawnIdentity(startOptions),
@@ -3402,7 +3343,7 @@ async function startInitializedCodexAppServerClientOnce(params) {
 			params.onStartedClient?.(client);
 			observeAcquire(params, { boundary: "initialize" });
 			try {
-				await waitForStartup(() => client.initialize(), CODEX_APP_SERVER_INITIALIZE_TIMEOUT_MESSAGE, () => buildCodexAppServerInitializeTimeoutError(client));
+				await waitForStartup(() => client.initialize(), () => buildCodexAppServerInitializeTimeoutError(client));
 			} catch (error) {
 				if (startOptions.commandSource === "resolved-managed" && index < startOptionsCandidates.length - 1 && isUnsupportedCodexAppServerVersionError(error)) continue;
 				throw error;
@@ -3503,12 +3444,12 @@ function resolveManagedFallbackStartOptions(startOptions) {
 	}
 	return candidates;
 }
+function detachCurrentSharedClient(client) {
+	const entry = client && getCurrentSharedClientEntry(client);
+	return Boolean(entry && getSharedCodexAppServerClientState().clients.delete(entry.key));
+}
 function clearSharedCodexAppServerClientIfCurrent(client) {
-	if (!client) return false;
-	const state = getSharedCodexAppServerClientState();
-	const entry = getCurrentSharedClientEntry(client);
-	if (!entry) return false;
-	state.clients.delete(entry.key);
+	if (!detachCurrentSharedClient(client)) return false;
 	client.close();
 	return true;
 }
@@ -3579,11 +3520,7 @@ function hasLiveOlderDesktopGenerationClient(params) {
 	return false;
 }
 async function clearSharedCodexAppServerClientIfCurrentAndWait(client, options) {
-	if (!client) return false;
-	const state = getSharedCodexAppServerClientState();
-	const entry = getCurrentSharedClientEntry(client);
-	if (!entry) return false;
-	state.clients.delete(entry.key);
+	if (!detachCurrentSharedClient(client)) return false;
 	await client.closeAndWait(options);
 	return true;
 }