@openclaw/codex 2026.10.5-beta.1 → 2026.10.5-beta.3

package/dist/.setup/{thread-lifecycle-run-CfP4PnEf.mjs → thread-lifecycle-run-CxVfnkG-.mjs}

@@ -5,7 +5,7 @@ import { l as fingerprintCodexPolicy } from "./config-security-clxAZYWX.mjs";
 import { f as resolveCodexPluginsPolicy } from "./config-parsing-DsWSCPHO.mjs";
 import { n as resolveCodexAppServerLocalHomeDir, t as resolveCodexAppServerHomeDir } from "./auth-start-options-BPIPeEX8.mjs";
 import { d as readCodexEffectiveConfig, s as assertCodexModelBackedReviewerEffectiveConfig, u as CODEX_SESSION_OVERRIDABLE_LAYER_TYPES } from "./config-options-DDzeNQ8m.mjs";
-import { S as retainSharedCodexAppServerClientByInstanceId, d as getCurrentSharedClientEntry } from "./auth-cache-key-DyfUvsSa.mjs";
+import { S as retainSharedCodexAppServerClientByInstanceId, d as getCurrentSharedClientEntry } from "./auth-cache-key-BzYrcgwJ.mjs";
 import { t as withCodexAppServerThreadMutation } from "./thread-ownership-queue-CeyYScUC.mjs";
 import { o as isCodexAppServerOverloadError, r as CodexAppServerRpcError, s as isCodexThreadReadMissingError } from "./rpc-error-C98SHchT.mjs";
 import { t as codexCatalogHomeId } from "./session-catalog-home-id-vlih0B_g.mjs";
@@ -18,22 +18,22 @@ import { c as resolveRecoverableCodexPluginConfigKeys } from "./plugin-inventory
 import "./config-C1YVVLEA.mjs";
 import { c as resolveCodexContextEngineProjectionMaxChars } from "./context-engine-projection-ps-yn_ci.mjs";
 import { n as normalizeCodexAppServerBindingModelProvider } from "./auth-profile-CgHQ8Vot.mjs";
-import { A as bindCodexInferenceThread, B as isCodexAppServerClientRuntimeLive, C as CodexThreadBindingConflictError, F as consumeCodexAppServerLiveThread, G as releaseCodexAppServerLiveThread, J as unsubscribeCodexAppServerLiveThread, M as getCodexInferenceThreadQualification, N as prepareCodexInferenceThreadConfig, Q as createCodexEphemeralThreadPolicy, S as CodexAdoptedThreadActiveError, T as CodexThreadStartRequestError, V as isCodexAppServerLiveThreadClaimed, j as getCodexInferenceThread, k as assertCodexInferenceRouteConfig, n as captureCodexAppServerClientLifetime, w as CodexThreadClientReplacementError, z as hasCodexAppServerSiblingThreadWork } from "./shared-client-ByIwuAC-.mjs";
-import { C as resolveCodexThreadRolloutPath, F as getCodexAppServerClientInstanceId, L as resolveCodexAppServerClientInstanceId, S as readSupervisionResponseThreadId, c as isCodexAppServerRequestTimeoutError, g as assertCodexThreadStartResponse, m as assertCodexThreadForkResponse, p as assertCodexThreadAcceptsDirectInput, v as assertExactSupervisionModelSelection } from "./client-y7nO6X9c.mjs";
-import { r as hasCodexAppServerSiblingRouteWork } from "./turn-router-DKDAziUW.mjs";
-import { f as unsubscribeCodexThreadBestEffort, l as retireUnsafeCodexTurnClientBestEffort, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, o as closeCodexStartupClientBestEffort, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-t-kd_1ys.mjs";
+import { $ as createCodexEphemeralThreadPolicy, A as bindCodexInferenceThread, B as isCodexAppServerClientRuntimeLive, C as CodexThreadBindingConflictError, F as consumeCodexAppServerLiveThread, H as isCodexAppServerLiveThreadProtected, K as releaseCodexAppServerLiveThread, M as getCodexInferenceThreadQualification, N as prepareCodexInferenceThreadConfig, S as CodexAdoptedThreadActiveError, T as CodexThreadStartRequestError, V as isCodexAppServerLiveThreadClaimed, Y as unsubscribeCodexAppServerLiveThread, j as getCodexInferenceThread, k as assertCodexInferenceRouteConfig, n as captureCodexAppServerClientLifetime, w as CodexThreadClientReplacementError, z as hasCodexAppServerSiblingThreadWork } from "./shared-client-CCz9ldpr.mjs";
+import { C as resolveCodexThreadRolloutPath, F as getCodexAppServerClientInstanceId, L as resolveCodexAppServerClientInstanceId, S as readSupervisionResponseThreadId, c as isCodexAppServerRequestTimeoutError, g as assertCodexThreadStartResponse, m as assertCodexThreadForkResponse, p as assertCodexThreadAcceptsDirectInput, v as assertExactSupervisionModelSelection } from "./client-aPKNc4Ii.mjs";
+import { r as hasCodexAppServerSiblingRouteWork } from "./turn-router-CSJl3yYQ.mjs";
+import { f as unsubscribeCodexThreadBestEffort, l as retireUnsafeCodexTurnClientBestEffort, n as CODEX_APP_SERVER_UNSUBSCRIBE_TIMEOUT_MS, o as closeCodexStartupClientBestEffort, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-D3YvP0N7.mjs";
 import { a as buildCodexPluginThreadConfigInputFingerprint, c as buildPluginAppPolicyContext, d as mergeCodexThreadConfigs, i as buildCodexPluginThreadConfig, l as disableUnlistedCodexApps, m as buildCodexAppApprovalOverrides, n as mergeCodexNativeProjectDocThreadConfig, o as buildCodexPluginThreadConfigTimeoutFallback, p as shouldBuildCodexPluginThreadConfig, r as buildCodexPluginAppsConfigPatchFromPolicyContext, u as isCodexPluginThreadBindingStale } from "./project-doc-thread-config-BVcvnps8.mjs";
 import { A as isTransientWebSearchRestriction, C as fingerprintEnvironmentSelection, D as readActiveCodexTurnIdsFromResume, E as legacyFingerprintUserMcpServersConfigPatch, I as isMessageOnlyCodexSourceReply, L as isSystemAgentOnlyCodexDynamicToolAllowlist, M as shouldRotateCodexAppServerBindingForRuntime, N as shouldRotateCodexGpt56MultiAgentBinding, O as shouldStartTransientNoToolThread, S as fingerprintCodexThreadConfig, T as fingerprintUserMcpServersConfigPatch, _ as buildDeveloperInstructions, b as codexDynamicToolsFingerprint, c as codexThreadSandboxOrPermissions, d as readCodexManagedRequirementsFingerprint, f as resolveCodexThreadApprovalsReviewer, g as mergeCodexNativeShellEnvironment, h as resolveCodexWebSearchPlan, i as buildCodexRuntimeThreadConfigForRun, j as shouldRecheckRecoverablePluginBinding, n as buildCodexRingZeroThreadConfigPatch, o as buildThreadResumeParams, p as attestCodexRestrictedToolSurfaceMcpServersDisabled, s as buildThreadStartParams, t as assertCodexManagedRequirementsDoNotOverrideToolPolicy, u as readCodexInheritedMcpServerNames, v as areCodexDynamicToolFingerprintsCompatible, w as fingerprintJsonObject, x as codexLegacyDynamicToolsFingerprint, y as areUserMcpServersFingerprintsCompatible } from "./thread-requests-BgzJwJtS.mjs";
 import { i as resolveCodexSessionBinding, o as hashCodexAppServerBindingFingerprint } from "./session-binding-JEHNMPsr.mjs";
 import { i as resolveCodexAppServerThreadModelSelection, n as resolveCodexAppServerModelProvider } from "./thread-model-selection-DcVebr8N.mjs";
-import { c as withExclusiveCodexAppServerThread, r as retainCodexAppServerBindingSubscription, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-Be53aiaG.mjs";
-import { a as refreshCodexThreadInstructions, i as assertCodexSupervisionThreadLineage, n as CodexThreadPolicyHandoffError, o as refreshCodexThreadPolicy, r as assertAdoptedCodexThreadResumeAllowed, t as CodexIncognitoPolicyChangeError } from "./thread-policy-CHgY-KNl.mjs";
-import { t as resumeCodexAppServerThread } from "./thread-resume-B2EmMcgE.mjs";
+import { c as withExclusiveCodexAppServerThread, r as retainCodexAppServerBindingSubscription, t as isSameCodexAppServerThreadOwner } from "./thread-ownership-_2e1sjfi.mjs";
+import { a as refreshCodexThreadInstructions, i as assertCodexSupervisionThreadLineage, n as CodexThreadPolicyHandoffError, o as refreshCodexThreadPolicy, r as assertAdoptedCodexThreadResumeAllowed, t as CodexIncognitoPolicyChangeError } from "./thread-policy-CLTwg3ZA.mjs";
+import { t as resumeCodexAppServerThread } from "./thread-resume-C6qsk8_o.mjs";
 import { r as readCodexMcpToolConnectorId } from "./mcp-tool-metadata-DW41snf3.mjs";
-import { n as disableCodexPluginThreadConfig } from "./dynamic-tool-build-D731PCdv.mjs";
-import { n as CodexManagedHooksOnlyError, r as assertCodexNativeHookRelayAllowed } from "./native-hook-relay-BUWIOrSr.mjs";
+import { n as disableCodexPluginThreadConfig } from "./dynamic-tool-build-DKko0Jjw.mjs";
+import { n as CodexManagedHooksOnlyError, r as assertCodexNativeHookRelayAllowed } from "./native-hook-relay-DQzvuJ-W.mjs";
 import { t as defaultCodexPluginMetadataCache } from "./plugin-metadata-cache-Bi8TAPwX.mjs";
-import { a as discardUnattestedCodexPluginThread, i as checkCodexThreadAppAvailability, n as resolveCodexNativeSkillIsolation, o as hasCodexNativeToolCatalog, r as attestCodexThreadToolSurface, s as loadCodexNativeToolCatalog, t as applyCodexNativeSkillIsolation } from "./native-skill-isolation-UMVoNjZz.mjs";
+import { a as discardUnattestedCodexPluginThread, i as checkCodexThreadAppAvailability, n as resolveCodexNativeSkillIsolation, o as hasCodexNativeToolCatalog, r as attestCodexThreadToolSurface, s as loadCodexNativeToolCatalog, t as applyCodexNativeSkillIsolation } from "./native-skill-isolation-DoRxgQPX.mjs";
 import { asOptionalRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import crypto from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
@@ -1220,7 +1220,7 @@ async function releaseCodexBoundLiveThread(options) {
 	if (changedClient && !previous) return false;
 	const client = previous?.client ?? options.client;
 	try {
-		if (isCodexAppServerLiveThreadClaimed(client, options.threadId)) throw new Error(`Codex thread ${options.threadId} is claimed by active work; stop it first.`);
+		if (isCodexAppServerLiveThreadClaimed(client, options.threadId) || isCodexAppServerLiveThreadProtected(client, options.threadId)) throw new Error(`Codex thread ${options.threadId} is claimed by active work; stop it first.`);
 		return await releaseCodexRetainedLiveThread({
 			...options,
 			client,
@@ -1232,7 +1232,7 @@ async function releaseCodexBoundLiveThread(options) {
 			} : void 0
 		});
 	} finally {
-		const retiredExit = previous?.release(!isCodexAppServerLiveThreadClaimed(client, options.threadId));
+		const retiredExit = previous?.release(!isCodexAppServerLiveThreadClaimed(client, options.threadId) && !isCodexAppServerLiveThreadProtected(client, options.threadId));
 		if (retiredExit) await racePromiseWithAbortSignal(retiredExit, options.signal, codexThreadLifecycleAbortError);
 	}
 }
@@ -1276,6 +1276,33 @@ async function tryReuseCodexLiveThread(options) {
 	let ownershipTransferred = false;
 	let preserveSubscription = false;
 	let nativeThread;
+	const cleanup = async (retainSubscription, ownership = retainedThread) => {
+		let failure;
+		try {
+			let pendingRetention;
+			if (retainSubscription) {
+				const retain = () => {
+					assertWarmOwner();
+					if (isSameCodexAppServerThreadOwner(params.bindingStore.read(bindingIdentity), binding)) pendingRetention = retainCodexAppServerBindingSubscription(params.client, binding.threadId, ownership);
+				};
+				try {
+					if (params.authority) await params.authority.withCurrent(retain);
+					else retain();
+				} catch {}
+			}
+			if (pendingRetention) {
+				if (!await pendingRetention) failure = { cause: /* @__PURE__ */ new Error("Codex live thread ownership could not be returned to its session") };
+			} else await retainedThread.release(binding.threadId);
+		} catch (cause) {
+			failure = { cause };
+		}
+		if (failure) await abandonCodexLiveThreadRelease({
+			client: params.client,
+			abandonClient: params.abandonClient,
+			lifecycleTiming,
+			threadId: binding.threadId
+		}, failure.cause);
+	};
 	try {
 		assertWarmOwner();
 		if (binding.preserveNativeModel || binding.connectionScope === "supervision") {
@@ -1294,7 +1321,10 @@ async function tryReuseCodexLiveThread(options) {
 		}
 		const pluginThreadConfig = await options.buildLoadedPluginThreadConfig(binding);
 		assertWarmOwner();
-		if (pluginThreadConfig && pluginThreadConfig.fingerprint !== binding.pluginAppsFingerprint) return { kind: "rotate" };
+		if (pluginThreadConfig && pluginThreadConfig.fingerprint !== binding.pluginAppsFingerprint) {
+			preserveSubscription = true;
+			return { kind: "rotate" };
+		}
 		const prebuiltFinalConfigPatch = await prepareCodexThreadFinalConfigPatch(params, options.nativeModelInputTools, binding);
 		const pluginAppsConfigPatch = pluginThreadConfig?.configPatch ?? (params.pluginThreadConfig?.enabled && binding.pluginAppPolicyContext ? buildCodexPluginAppsConfigPatchFromPolicyContext(binding.pluginAppPolicyContext) : void 0);
 		const resumeAuthProfileId = binding.connectionScope === "supervision" ? void 0 : params.params.authProfileId ?? binding.authProfileId;
@@ -1369,50 +1399,30 @@ async function tryReuseCodexLiveThread(options) {
 			threadId: binding.threadId,
 			action: "resumed"
 		});
+		const liveThreadEphemeralPolicy = ephemeralPolicy && {
+			...ephemeralPolicy,
+			refreshableInstructions: params.refreshableInstructions
+		};
 		ownershipTransferred = true;
 		return {
 			kind: "ready",
+			cleanupOnFailure: () => cleanup(isCodexAppServerLiveThreadProtected(params.client, binding.threadId), {
+				...retainedThread,
+				configFingerprint: liveThreadConfigFingerprint,
+				ephemeralPolicy: liveThreadEphemeralPolicy
+			}),
 			binding: {
 				...binding,
 				...!incognito ? bindingPatch : {},
 				liveThreadConfigFingerprint,
-				liveThreadEphemeralPolicy: ephemeralPolicy && {
-					...ephemeralPolicy,
-					refreshableInstructions: params.refreshableInstructions
-				},
+				liveThreadEphemeralPolicy,
 				liveThreadOwnership: retainedThread,
 				...!incognito && retainedThread.serviceTier && resumeParams.serviceTier === void 0 ? { clearInheritedServiceTier: true } : {},
 				lifecycle: { action: "resumed" }
 			}
 		};
 	} finally {
-		if (!ownershipTransferred) {
-			let failure;
-			try {
-				let pendingRetention;
-				if (preserveSubscription) {
-					const retain = () => {
-						assertWarmOwner();
-						if (isSameCodexAppServerThreadOwner(params.bindingStore.read(bindingIdentity), binding)) pendingRetention = retainCodexAppServerBindingSubscription(params.client, binding.threadId, retainedThread);
-					};
-					try {
-						if (params.authority) await params.authority.withCurrent(retain);
-						else retain();
-					} catch {}
-				}
-				if (pendingRetention) {
-					if (!await pendingRetention) failure = { cause: /* @__PURE__ */ new Error("Codex live thread ownership could not be returned to its session") };
-				} else await retainedThread.release(binding.threadId);
-			} catch (cause) {
-				failure = { cause };
-			}
-			if (failure) await abandonCodexLiveThreadRelease({
-				client: params.client,
-				abandonClient: params.abandonClient,
-				lifecycleTiming,
-				threadId: binding.threadId
-			}, failure.cause);
-		}
+		if (!ownershipTransferred) await cleanup(preserveSubscription);
 	}
 }
 //#endregion
@@ -1879,7 +1889,8 @@ async function recoverPendingSupervisionArtifacts(params, pending) {
 async function startOrResumeThread(input) {
 	const incognito = isIncognitoSessionKey(input.params.sessionKey);
 	const clientId = resolveCodexAppServerClientInstanceId(input.client);
-	return await withCodexThreadLifecycleBinding(input, async (bindingIdentity, saved, authority) => {
+	let cleanupWarmBinding;
+	const prep = withCodexThreadLifecycleBinding(input, async (bindingIdentity, saved, authority) => {
 		const assert = authority.assertCurrent;
 		const params = {
 			...input,
@@ -2143,7 +2154,10 @@ async function startOrResumeThread(input) {
 					clientId,
 					buildLoadedPluginThreadConfig
 				});
-				if (warmReuse.kind === "ready") return publishCodexThreadInferenceBinding(params, warmReuse.binding, true);
+				if (warmReuse.kind === "ready") {
+					cleanupWarmBinding = warmReuse.cleanupOnFailure;
+					return publishCodexThreadInferenceBinding(params, warmReuse.binding, true);
+				}
 				if (incognito || warmReuse.kind === "rotate") {
 					throwIfAborted();
 					stageBindingReplacement(incognito ? "rotating an unavailable ephemeral thread binding" : "rotating a stale plugin app binding");
@@ -2178,6 +2192,16 @@ async function startOrResumeThread(input) {
 		if (replacementPredecessor && !preserveExistingBinding && configuredMcpOwnershipChanged) await releaseRetainedThread(replacementPredecessor.threadId, replacementPredecessor.clientId);
 		return publishCodexThreadInferenceBinding(params, started);
 	});
+	try {
+		return await prep;
+	} catch (error) {
+		if (cleanupWarmBinding) try {
+			await cleanupWarmBinding();
+		} catch (releaseError) {
+			throw new AggregateError([error, releaseError], "Codex warm thread preparation and subscription cleanup failed", { cause: releaseError });
+		}
+		throw error;
+	}
 }
 //#endregion
 export { prepareCodexPluginThreadConfigStartupProvider as a, buildLegacyScheduledCodexAppRecoveryPrompt as c, resolveScheduledCodexAppCreatorCaptureDecision as d, isContextEngineBindingCompatible as i, buildScheduledCodexAppServerConnectionIdentity as l, isCodexAppServerProfilerEnabled as n, resolveCodexPluginThreadConfigStartupPolicy as o, buildContextEngineBinding as r, assertScheduledCodexAppAuthorityRuntime as s, startOrResumeThread as t, captureScheduledCodexAppAuthority as u };

package/dist/.setup/{thread-ownership-Be53aiaG.mjs → thread-ownership-_2e1sjfi.mjs}

@@ -1,7 +1,7 @@
-import { S as retainSharedCodexAppServerClientByInstanceId } from "./auth-cache-key-DyfUvsSa.mjs";
+import { S as retainSharedCodexAppServerClientByInstanceId } from "./auth-cache-key-BzYrcgwJ.mjs";
 import { t as withCodexAppServerThreadMutation } from "./thread-ownership-queue-CeyYScUC.mjs";
-import { G as releaseCodexAppServerLiveThread, K as retainCodexAppServerLiveThread, V as isCodexAppServerLiveThreadClaimed } from "./shared-client-ByIwuAC-.mjs";
-import { f as unsubscribeCodexThreadBestEffort, o as closeCodexStartupClientBestEffort, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-t-kd_1ys.mjs";
+import { K as releaseCodexAppServerLiveThread, V as isCodexAppServerLiveThreadClaimed, q as retainCodexAppServerLiveThread } from "./shared-client-CCz9ldpr.mjs";
+import { f as unsubscribeCodexThreadBestEffort, o as closeCodexStartupClientBestEffort, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-D3YvP0N7.mjs";
 import { t as __exportAll } from "./session-binding-sidecars-DD-enC8w.mjs";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";
 import { runWithAsyncWorkResources } from "openclaw/plugin-sdk/agent-harness-tool-runtime";

package/dist/.setup/{thread-policy-CHgY-KNl.mjs → thread-policy-CLTwg3ZA.mjs}

@@ -1,7 +1,7 @@
 import { i as CodexAppServerScopedRequestRejectedError, o as isCodexAppServerOverloadError } from "./rpc-error-C98SHchT.mjs";
-import { n as requestCodexAppServerClientJson } from "./request-Y8dmbqZ3.mjs";
-import { S as CodexAdoptedThreadActiveError } from "./shared-client-ByIwuAC-.mjs";
-import { p as assertCodexThreadAcceptsDirectInput, s as isCodexAppServerPrewriteRequestCancellationError } from "./client-y7nO6X9c.mjs";
+import { n as requestCodexAppServerClientJson } from "./request-DInueZ2q.mjs";
+import { S as CodexAdoptedThreadActiveError } from "./shared-client-CCz9ldpr.mjs";
+import { p as assertCodexThreadAcceptsDirectInput, s as isCodexAppServerPrewriteRequestCancellationError } from "./client-aPKNc4Ii.mjs";
 import { AgentHarnessPreflightError, embeddedAgentLog, formatErrorMessage } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/thread-policy.ts
 /** A refusal, not a failed native write: the ephemeral conversation must stay alive. */

package/dist/.setup/{thread-resume-B2EmMcgE.mjs → thread-resume-C6qsk8_o.mjs}

@@ -1,8 +1,8 @@
 import { i as CodexAppServerScopedRequestRejectedError, o as isCodexAppServerOverloadError, r as CodexAppServerRpcError } from "./rpc-error-C98SHchT.mjs";
-import { r as publishCodexCatalogResume } from "./session-catalog-events-DzFlXNUe.mjs";
-import { L as forgetCodexWorkspaceReferences, ft as isCodexAppServerStartupError, u as isCodexAppServerStartSelectionChangedError } from "./shared-client-ByIwuAC-.mjs";
-import { h as assertCodexThreadResumeResponse, s as isCodexAppServerPrewriteRequestCancellationError } from "./client-y7nO6X9c.mjs";
-import { f as unsubscribeCodexThreadBestEffort, i as assertCodexThreadResumeSubscription, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-t-kd_1ys.mjs";
+import { r as publishCodexCatalogResume } from "./session-catalog-events-DujfzcAY.mjs";
+import { L as forgetCodexWorkspaceReferences, pt as isCodexAppServerStartupError, u as isCodexAppServerStartSelectionChangedError } from "./shared-client-CCz9ldpr.mjs";
+import { h as assertCodexThreadResumeResponse, s as isCodexAppServerPrewriteRequestCancellationError } from "./client-aPKNc4Ii.mjs";
+import { f as unsubscribeCodexThreadBestEffort, i as assertCodexThreadResumeSubscription, r as CodexAppServerUnsafeSubscriptionError } from "./attempt-client-cleanup-D3YvP0N7.mjs";
 import { sanitizeTerminalText } from "openclaw/plugin-sdk/text-chunking";
 //#region extensions/codex/src/app-server/thread-resume.ts
 /** Owns Codex thread/resume subscription safety. */

package/dist/.setup/{turn-router-DKDAziUW.mjs → turn-router-CSJl3yYQ.mjs}

@@ -1,6 +1,6 @@
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
 import { n as waitForPromiseOrAbort, t as abortReason } from "./timeout-D0mEWSGG.mjs";
-import { x as readCodexTurnCompletedNotification } from "./client-y7nO6X9c.mjs";
+import { x as readCodexTurnCompletedNotification } from "./client-aPKNc4Ii.mjs";
 import { normalizeOptionalString, readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { AsyncResource } from "node:async_hooks";
 import { createDeferred } from "openclaw/plugin-sdk/extension-shared";

package/dist/.setup/{upstream-session-fork-Djp_yssT.mjs → upstream-session-fork-BC45E4Pe.mjs}

@@ -9,22 +9,22 @@ import { r as projectCodexUserItemText } from "./transcript-history-projection-D
 import { n as codexUpstreamBaseline, t as codexLastTerminalTurnId } from "./session-upstream-marker-D15C9NHp.mjs";
 import { r as buildCodexPluginAppCacheKey } from "./plugin-app-cache-key-Bg9DbDI6.mjs";
 import { n as readCodexSessionMeta } from "./session-catalog-provenance-CmsOE5mh.mjs";
-import "./request-Y8dmbqZ3.mjs";
+import "./request-DInueZ2q.mjs";
 import { r as resolveOpenClawExecPolicyForCodexAppServer } from "./config-C1YVVLEA.mjs";
 import { r as resolveCodexSupervisionAppServerRuntimeOptions } from "./config-runtime-DWzK-k0n.mjs";
 import { l as readCodexMirrorSourceFingerprint, o as fingerprintCodexMirrorSourceMessage } from "./transcript-mirror-attestation-BzUXnrvv.mjs";
-import { P as claimCodexAppServerLiveThread, R as hasCodexAppServerLiveThread, f as readCodexAppServerClientDesktopGenerationFingerprint } from "./shared-client-ByIwuAC-.mjs";
-import { m as assertCodexThreadForkResponse, p as assertCodexThreadAcceptsDirectInput, s as isCodexAppServerPrewriteRequestCancellationError } from "./client-y7nO6X9c.mjs";
+import { P as claimCodexAppServerLiveThread, R as hasCodexAppServerLiveThread, f as readCodexAppServerClientDesktopGenerationFingerprint } from "./shared-client-CCz9ldpr.mjs";
+import { m as assertCodexThreadForkResponse, p as assertCodexThreadAcceptsDirectInput, s as isCodexAppServerPrewriteRequestCancellationError } from "./client-aPKNc4Ii.mjs";
 import { d as mergeCodexThreadConfigs, i as buildCodexPluginThreadConfig, p as shouldBuildCodexPluginThreadConfig } from "./project-doc-thread-config-BVcvnps8.mjs";
 import { T as fingerprintUserMcpServersConfigPatch, _ as buildDeveloperInstructions, a as buildCodexThreadConfiguration, b as codexDynamicToolsFingerprint, h as resolveCodexWebSearchPlan, w as fingerprintJsonObject } from "./thread-requests-BgzJwJtS.mjs";
 import "./session-binding-JEHNMPsr.mjs";
-import "./thread-ownership-Be53aiaG.mjs";
+import "./thread-ownership-_2e1sjfi.mjs";
 import { n as resolveCodexNativeExecutionPolicy } from "./native-execution-policy-MXEe7PB3.mjs";
-import { n as CodexThreadPolicyHandoffError, o as refreshCodexThreadPolicy } from "./thread-policy-CHgY-KNl.mjs";
-import { b as isCodexDynamicToolExcluded, f as codexNativeHookRemoteCredentialPath, i as buildCodexNativeHookRelayConfig, l as resolveCodexNativeHookRelayEvents, o as buildCodexNativeHookRelayId, r as assertCodexNativeHookRelayAllowed } from "./native-hook-relay-BUWIOrSr.mjs";
-import { c as parseCodexNativeToolCatalog, i as checkCodexThreadAppAvailability, n as resolveCodexNativeSkillIsolation, t as applyCodexNativeSkillIsolation } from "./native-skill-isolation-UMVoNjZz.mjs";
+import { n as CodexThreadPolicyHandoffError, o as refreshCodexThreadPolicy } from "./thread-policy-CLTwg3ZA.mjs";
+import { b as isCodexDynamicToolExcluded, f as codexNativeHookRemoteCredentialPath, i as buildCodexNativeHookRelayConfig, l as resolveCodexNativeHookRelayEvents, o as buildCodexNativeHookRelayId, r as assertCodexNativeHookRelayAllowed } from "./native-hook-relay-DQzvuJ-W.mjs";
+import { c as parseCodexNativeToolCatalog, i as checkCodexThreadAppAvailability, n as resolveCodexNativeSkillIsolation, t as applyCodexNativeSkillIsolation } from "./native-skill-isolation-DoRxgQPX.mjs";
 import { c as prepareCodexWorkspaceDeveloperInstructions } from "./attempt-workspace-context-CcwP3DA3.mjs";
-import { n as resolveCodexProviderWebSearchSupportForClient } from "./provider-capabilities-CjRaV3bx.mjs";
+import { n as resolveCodexProviderWebSearchSupportForClient } from "./provider-capabilities-DWH29sy3.mjs";
 import { n as prepareCodexSessionInitialization } from "./session-initialization-Bi_2DKhc.mjs";
 import { createImportedCodexSession } from "./session-history-import-CaO8s6ta.mjs";
 import { isRecord, normalizeOptionalString, readNonBlankString } from "openclaw/plugin-sdk/string-coerce-runtime";

package/dist/.setup/{usage-DQA-peQC.mjs → usage-1eNaNDM2.mjs}

@@ -1,5 +1,5 @@
 import { t as buildCodexAppServerUsageSnapshot } from "./rate-limits-CI8pTPqL.mjs";
-import { t as readCodexAppServerUsage } from "./request-Y8dmbqZ3.mjs";
+import { t as readCodexAppServerUsage } from "./request-DInueZ2q.mjs";
 import "./config-C1YVVLEA.mjs";
 import { n as resolveCodexAppServerRuntimeOptions } from "./config-runtime-DWzK-k0n.mjs";
 import { CODEX_APP_SERVER_AUTH_MARKER } from "openclaw/plugin-sdk/agent-runtime";

package/dist/.setup/{usage-limit-error-2t3KBqiX.mjs → usage-limit-error-CJoJ_F8V.mjs}

@@ -1,7 +1,7 @@
 import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
 import { a as shouldRefreshCodexRateLimitsForUsageLimitMessage, i as resolveCodexUsageLimitResetAtMs, n as formatCodexUsageLimitErrorMessage } from "./rate-limits-CI8pTPqL.mjs";
 import { t as CODEX_CONTROL_METHODS } from "./capabilities-DbOzOglY.mjs";
-import { X as readRecentCodexRateLimits, Y as readCodexRateLimitsRevision, Z as rememberCodexRateLimitsRead } from "./shared-client-ByIwuAC-.mjs";
+import { Q as rememberCodexRateLimitsRead, X as readCodexRateLimitsRevision, Z as readRecentCodexRateLimits } from "./shared-client-CCz9ldpr.mjs";
 import { readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { markAuthProfileBlockedUntil } from "openclaw/plugin-sdk/agent-runtime";
 import { embeddedAgentLog, formatErrorMessage } from "openclaw/plugin-sdk/agent-harness-runtime";

package/dist/.setup/{web-search-provider.runtime-BsuCMNix.mjs → web-search-provider.runtime-Qq_wUrvv.mjs}

@@ -1,5 +1,5 @@
 import { m as buildCodexNativeWebSearchThreadConfig } from "./thread-requests-BgzJwJtS.mjs";
-import { runBoundedCodexAppServerTurn } from "./bounded-turn-CyQVQwGe.mjs";
+import { runBoundedCodexAppServerTurn } from "./bounded-turn-BmChqNaK.mjs";
 import { t as projectCodexWebSearchItem } from "./web-search-item-CvokaZOo.mjs";
 import { readStringParam, resolveSearchTimeoutSeconds, wrapWebContent } from "openclaw/plugin-sdk/provider-web-search";
 //#region extensions/codex/src/web-search-provider.runtime.ts

package/dist/catalog-page.worker.js

@@ -1,4 +1,4 @@
-import { t as createCodexCatalogDecoder } from "./.setup/client-catalog-response-DsbEAtpd.mjs";
+import { t as createCodexCatalogDecoder } from "./.setup/client-catalog-response-Du2GmrOV.mjs";
 import { serveWorkerTasks } from "openclaw/plugin-sdk/worker-task-server";
 //#region extensions/codex/catalog-page.worker.ts
 const decode = createCodexCatalogDecoder();

package/dist/harness.js

@@ -1,7 +1,7 @@
 import { CODEX_NATIVE_TOOL_REQUIREMENTS, CODEX_TOOL_POLICY_SAFE_DENY_NAMES } from "./native-tool-policy.js";
 import { n as readCodexRuntimeModelId } from "./.setup/model-runtime-BdqzOMkU.mjs";
 import { m as sessionBindingIdentity } from "./.setup/session-binding-record-DU_0biMD.mjs";
-import { t as codexBuildSymbol } from "./.setup/build-state-CzLMy1S9.mjs";
+import { t as codexBuildSymbol } from "./.setup/build-state-sjOWPg_o.mjs";
 import { resolvePluginConfigObject } from "openclaw/plugin-sdk/plugin-config-runtime";
 import { asOptionalRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 //#region extensions/codex/harness.ts
@@ -93,7 +93,7 @@ function createCodexAppServerAgentHarness(options) {
 			executionEnvironment: "host-only",
 			upstreamKinds: ["codex-app-server"],
 			fork: async (params) => {
-				const { forkCodexUpstreamSession } = await import("./.setup/upstream-session-fork-Djp_yssT.mjs");
+				const { forkCodexUpstreamSession } = await import("./.setup/upstream-session-fork-BC45E4Pe.mjs");
 				return await forkCodexUpstreamSession(params, {
 					bindingStore: options.bindingStore,
 					controlFactory: sessionCatalogControlFactory,
@@ -115,11 +115,11 @@ function createCodexAppServerAgentHarness(options) {
 			return validateCodexAppServerRuntimeArtifact(binding, void 0, resolveCodexAppServerRuntimeOptions({ pluginConfig: resolveAttemptPluginConfig(options.resolveConfig?.()) }).start);
 		} },
 		fetchUsageSnapshot: async (ctx) => {
-			const { fetchCodexAppServerUsageSnapshot } = await import("./.setup/usage-DQA-peQC.mjs");
+			const { fetchCodexAppServerUsageSnapshot } = await import("./.setup/usage-1eNaNDM2.mjs");
 			return await fetchCodexAppServerUsageSnapshot(ctx, { pluginConfig: options?.resolvePluginConfig?.() ?? options?.pluginConfig });
 		},
 		loadModelCatalog: async (params) => {
-			const { createCodexAppServerModelCatalog } = await import("./.setup/model-catalog-B227ST3D.mjs");
+			const { createCodexAppServerModelCatalog } = await import("./.setup/model-catalog-Ben3FsFp.mjs");
 			if (disposed) return { entries: [] };
 			modelCatalog ??= createCodexAppServerModelCatalog(harnessRuntimeId);
 			return { entries: await modelCatalog.load(params, resolveAttemptPluginConfig(params.config)) };
@@ -129,7 +129,7 @@ function createCodexAppServerAgentHarness(options) {
 			return asOptionalRecord(asOptionalRecord(resolveAttemptPluginConfig(config))?.appServer)?.enableUltrafast === false ? serviceTiers.filter((tier) => tier !== "ultrafast") : serviceTiers;
 		},
 		acquireMcpAppRuntime: async (params) => {
-			const { acquireCodexMcpAppRuntime } = await import("./.setup/effective-mcp-catalog-1hWFKghy.mjs");
+			const { acquireCodexMcpAppRuntime } = await import("./.setup/effective-mcp-catalog-uIZ4w7Nh.mjs");
 			if (disposed) return;
 			params.assertCurrent();
 			return await acquireCodexMcpAppRuntime(params, {
@@ -138,7 +138,7 @@ function createCodexAppServerAgentHarness(options) {
 			});
 		},
 		loadMcpToolCatalog: async (params) => {
-			const { loadCodexEffectiveMcpCatalog } = await import("./.setup/effective-mcp-catalog-1hWFKghy.mjs");
+			const { loadCodexEffectiveMcpCatalog } = await import("./.setup/effective-mcp-catalog-uIZ4w7Nh.mjs");
 			return await loadCodexEffectiveMcpCatalog(params, { bindingStore: options.bindingStore });
 		},
 		supports: (ctx) => {
@@ -170,7 +170,7 @@ function createCodexAppServerAgentHarness(options) {
 			};
 		},
 		runAttempt: async (params) => {
-			const { runCodexAppServerAttempt } = await import("./.setup/run-attempt-Dx7a4Mfm.mjs");
+			const { runCodexAppServerAttempt } = await import("./.setup/run-attempt-BN-0TO0P.mjs");
 			const { planCodexCyberEscalation, readCodexCyberAttemptVerdict, recordCodexCyberTargetUnavailable, reserveCodexCyberProbe, resolveCodexCyberFailoverConfig } = await import("./.setup/cyber-failover-D4dgNfFf.mjs");
 			const { emitCodexCyberNotice } = await import("./.setup/cyber-failover-notice-ljgGGL0s.mjs");
 			const pluginConfig = resolveAttemptPluginConfig(params.config);
@@ -236,7 +236,7 @@ function createCodexAppServerAgentHarness(options) {
 				const { runHostPreparedIsolatedCompletion } = await import("openclaw/plugin-sdk/simple-completion-runtime");
 				return runHostPreparedIsolatedCompletion(params);
 			}
-			const { runCodexIsolatedCompletion } = await import("./.setup/isolated-completion-Bhqd2yBq.mjs");
+			const { runCodexIsolatedCompletion } = await import("./.setup/isolated-completion-BWEjVHBf.mjs");
 			return runCodexIsolatedCompletion(params, { pluginConfig: options?.resolvePluginConfig?.() ?? options?.pluginConfig });
 		},
 		runIsolatedCompletion: async (params) => {
@@ -252,11 +252,11 @@ function createCodexAppServerAgentHarness(options) {
 			});
 		},
 		finalizeSettledTurn: async (params) => {
-			const { runCodexSettledTurnFinalization } = await import("./.setup/settled-turn-finalizer-X-Fylp-u.mjs");
+			const { runCodexSettledTurnFinalization } = await import("./.setup/settled-turn-finalizer-C6tjH8RJ.mjs");
 			return runCodexSettledTurnFinalization(params, { pluginConfig: options?.resolvePluginConfig?.() ?? options?.pluginConfig });
 		},
 		runSideQuestion: async (params) => {
-			const { runCodexAppServerSideQuestion } = await import("./.setup/side-question-BDUdozFy.mjs");
+			const { runCodexAppServerSideQuestion } = await import("./.setup/side-question-COaYBoON.mjs");
 			return runCodexAppServerSideQuestion(params, {
 				bindingStore: options.bindingStore,
 				pluginConfig: options?.resolvePluginConfig?.() ?? options?.pluginConfig,
@@ -267,25 +267,25 @@ function createCodexAppServerAgentHarness(options) {
 		},
 		compact: async (params) => {
 			const admittedParams = requireCodexCompactionCapabilities(params);
-			const { maybeCompactCodexAppServerSession } = await import("./.setup/compact-CD8xJxXS.mjs");
+			const { maybeCompactCodexAppServerSession } = await import("./.setup/compact-BCCjM_cb.mjs");
 			return maybeCompactCodexAppServerSession(admittedParams, {
 				bindingStore: options.bindingStore,
 				pluginConfig: options?.resolvePluginConfig?.() ?? options?.pluginConfig
 			});
 		},
 		withSessionDeletion: async (params, run) => {
-			const { withCodexAppServerSessionDeletion } = await import("./.setup/session-retirement-IoS3zr17.mjs");
+			const { withCodexAppServerSessionDeletion } = await import("./.setup/session-retirement-CIDqLMII.mjs");
 			params.assertCurrent();
 			return withCodexAppServerSessionDeletion(options.bindingStore, params, run);
 		},
 		withSessionContextReset: async (params, run) => {
-			const { withCodexAppServerSessionContextReset } = await import("./.setup/session-retirement-IoS3zr17.mjs");
+			const { withCodexAppServerSessionContextReset } = await import("./.setup/session-retirement-CIDqLMII.mjs");
 			params.assertCurrent();
 			return withCodexAppServerSessionContextReset(options.bindingStore, params, run);
 		},
 		reset: async (params) => {
 			if (params.sessionId && params.reason !== "deleted") {
-				const [{ reclaimCurrentCodexSessionGeneration }, { retireCodexAppServerSessionGeneration }] = await Promise.all([import("./.setup/session-binding-JEHNMPsr.mjs").then((n) => n.a), import("./.setup/session-retirement-IoS3zr17.mjs")]);
+				const [{ reclaimCurrentCodexSessionGeneration }, { retireCodexAppServerSessionGeneration }] = await Promise.all([import("./.setup/session-binding-JEHNMPsr.mjs").then((n) => n.a), import("./.setup/session-retirement-CIDqLMII.mjs")]);
 				const identity = sessionBindingIdentity({
 					agentId: params.agentId,
 					sessionId: params.sessionId,
@@ -318,7 +318,7 @@ function createCodexAppServerAgentHarness(options) {
 function createCodexAppServerNativeCompaction(options) {
 	return async (params) => {
 		const admittedParams = requireCodexCompactionCapabilities(params);
-		const { maybeCompactCodexAppServerSession } = await import("./.setup/compact-CD8xJxXS.mjs");
+		const { maybeCompactCodexAppServerSession } = await import("./.setup/compact-BCCjM_cb.mjs");
 		return maybeCompactCodexAppServerSession(admittedParams, {
 			bindingStore: options.bindingStore,
 			pluginConfig: options.resolvePluginConfig?.() ?? options.pluginConfig,