@openclaw/codex 2026.10.5-beta.3 → 2026.10.10-beta.1

package/dist/.setup/{native-subagent-pending-assignments-DmVhedNs.mjs → native-subagent-pending-assignments-CTinVtjo.mjs}

@@ -1,4 +1,4 @@
-import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
+import { r as isJsonObject } from "./protocol-CaPAVwe9.mjs";
 import { asOptionalRecord, readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";

package/dist/.setup/{native-task-assignments-DimsQ9Qa.mjs → native-task-assignments-YJopbaVO.mjs}

@@ -1,4 +1,4 @@
-import { _ as readCodexNativeSubagentHistoryOwner, h as codexNativeSubagentHistoryConnectionFingerprint, r as readNativePendingAssignments, u as readCodexNativeSubagentRunId } from "./native-subagent-pending-assignments-DmVhedNs.mjs";
+import { _ as readCodexNativeSubagentHistoryOwner, h as codexNativeSubagentHistoryConnectionFingerprint, r as readNativePendingAssignments, u as readCodexNativeSubagentRunId } from "./native-subagent-pending-assignments-CTinVtjo.mjs";
 import { i as CODEX_APP_SERVER_BINDING_NAMESPACE, r as CODEX_APP_SERVER_BINDING_MAX_ENTRIES } from "./session-binding-meta-Lkm5Lpf4.mjs";
 import { isDeepStrictEqual } from "node:util";
 import { z } from "zod";
@@ -56,7 +56,7 @@ async function inspect(params) {
 		if (extractErrorCode(error) === "ENOENT") return [];
 		throw error;
 	}
-	const { bindingStoreKey, readStoredCodexAppServerBinding } = await import("./session-binding-record-DU_0biMD.mjs").then((n) => n.h);
+	const { bindingStoreKey, readStoredCodexAppServerBinding } = await import("./session-binding-record-C_THntMe.mjs").then((n) => n._);
 	const { executeSqliteQuerySync, getNodeSqliteKysely, openNodeSqliteDatabase, prepareSqliteReadOnlyLocation, tableExists } = await import("openclaw/plugin-sdk/sqlite-runtime");
 	const snapshot = await prepareSqliteReadOnlyLocation(source, { preserveSourceArtifacts: true });
 	try {
@@ -126,7 +126,7 @@ function prepareAssignment(task, stored, params, { getSessionEntry, resolveStore
 }
 async function settleHistoricalDelivery(task, key, observedBinding, params, sessionStore) {
 	const { executeSqliteQuerySync, getNodeSqliteKysely, openNodeSqliteDatabase, resolveExistingSqliteFileUri, runSqliteImmediateTransactionSync } = await import("openclaw/plugin-sdk/sqlite-runtime");
-	const { readStoredCodexAppServerBinding } = await import("./session-binding-record-DU_0biMD.mjs").then((n) => n.h);
+	const { readStoredCodexAppServerBinding } = await import("./session-binding-record-C_THntMe.mjs").then((n) => n._);
 	const db = openNodeSqliteDatabase(resolveExistingSqliteFileUri(databasePath(params)));
 	try {
 		const sql = getNodeSqliteKysely(db);
@@ -170,8 +170,12 @@ const codexNativeTaskAssignmentMigration = {
 			changes: [],
 			warnings
 		};
-		const { bindingStoreKey, readStoredCodexAppServerBinding } = await import("./session-binding-record-DU_0biMD.mjs").then((n) => n.h);
-		const sessionStore = await import("openclaw/plugin-sdk/session-store-runtime");
+		const { bindingStoreKey, readStoredCodexAppServerBinding } = await import("./session-binding-record-C_THntMe.mjs").then((n) => n._);
+		const { getSessionEntry, resolveStorePath } = await import("openclaw/plugin-sdk/session-store-runtime");
+		const sessionStore = {
+			getSessionEntry,
+			resolveStorePath
+		};
 		let imported = 0;
 		let settled = 0;
 		const store = params.context.openPluginStateKeyedStore({

package/dist/.setup/{node-cli-sessions-CzKg2nGq.mjs → node-cli-sessions-BuJnBnEq.mjs}

@@ -1,6 +1,6 @@
-import { A as unwrapNodeInvokePayload, x as readBoundedOptionalString } from "./session-catalog-parsing-DkeoVn60.mjs";
+import { A as unwrapNodeInvokePayload, x as readBoundedOptionalString } from "./session-catalog-parsing-V6jyFg9g.mjs";
 import { r as resolveCodexAppServerUserHomeDir } from "./auth-start-options-BPIPeEX8.mjs";
-import { o as formatCodexDisplayText } from "./command-formatters-xW9KpoSZ.mjs";
+import { o as formatCodexDisplayText } from "./command-formatters-B_7-QZ1c.mjs";
 import { t as codexCatalogHomeId } from "./session-catalog-home-id-vlih0B_g.mjs";
 import { asNonArrayRecord, isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { timestampMsToIsoString } from "openclaw/plugin-sdk/number-runtime";
@@ -196,8 +196,11 @@ async function resumeCodexCliSessionOnNode(params) {
 	let catalogAgentId;
 	let catalogHomeId;
 	if (params.sessionKey) {
-		const { adoptionSessionKeyRest, CODEX_NODE_SESSION_KEY_PREFIX, readNodeSessionMarker } = await import("./session-catalog-node-adoption-BdP9Zjqo.mjs");
-		const entry = params.runtime.agent.session.getSessionEntry({
+		const storePath = params.storePath ?? params.runtime.agent.session.resolveStorePath(void 0, { agentId: params.agentId });
+		const { adoptionSessionKeyRest, CODEX_NODE_SESSION_KEY_PREFIX, readNodeSessionMarker } = await import("./session-catalog-node-adoption-e9v8mGgx.mjs");
+		const entry = await params.runtime.agent.session.getSessionEntryAsync({
+			agentId: params.agentId,
+			storePath,
 			sessionKey: params.sessionKey,
 			readConsistency: "latest"
 		});

package/dist/.setup/{node-exec-server.runtime-BWkULhBM.mjs → node-exec-server.runtime-CP7RC1Nd.mjs}

@@ -1,5 +1,5 @@
-import { i as resolveManagedCodexNativeCommand, r as resolveManagedCodexAppServerStartOptions, t as isManagedCodexDesktopCommand } from "./managed-binary-BtIjV7yN.mjs";
-import { o as closeCodexAppServerTransportAndWait, t as createStdioTransport } from "./transport-stdio-CRWTkKOn.mjs";
+import { a as isManagedCodexDesktopCommand, f as resolveManagedCodexNativeCommand, u as resolveManagedCodexAppServerStartOptions } from "./managed-binary-DbKvGXKl.mjs";
+import { o as closeCodexAppServerTransportAndWait, t as createStdioTransport } from "./transport-stdio-Bq160Dhv.mjs";
 import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { stripVTControlCharacters } from "node:util";
 import { killProcessTree } from "openclaw/plugin-sdk/process-runtime";
@@ -144,7 +144,7 @@ async function runCodexNodeExecServer(params) {
 				"stdio"
 			],
 			headers: {}
-		});
+		}, { preferInstalled: false });
 		const native = resolveManagedCodexNativeCommand(resolved.command);
 		if (!native || isManagedCodexDesktopCommand(resolved.command)) throw new Error("Codex node exec-server requires the pinned managed package binary.");
 		const baseEnv = sanitizeEnvVars(process.env, {

package/dist/.setup/{plan-DFVngccH.mjs → plan-B4cHgqNv.mjs}

@@ -1,7 +1,8 @@
 import { t as isOnlyMigrationKind } from "./scope-DOC1Xjc8.mjs";
-import { u as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-CYgdo14P.mjs";
-import "./config-C1YVVLEA.mjs";
-import { i as hasCodexSource, n as defaultCodexHome, o as readJsonObject, r as discoverCodexSource, s as sanitizeName, t as codexPluginMigrationSubscriptionWarning } from "./source-DsubBCYm.mjs";
+import { u as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-DE9wcaeH.mjs";
+import "./config-BfrAlTMT.mjs";
+import { t as readCodexExperimentalFeature } from "./experimental-features-uGnVDtp-.mjs";
+import { i as hasCodexSource, n as defaultCodexHome, o as readJsonObject, r as discoverCodexSource, s as sanitizeName, t as codexPluginMigrationSubscriptionWarning } from "./source-uGKgKWm8.mjs";
 import { asBoolean, asOptionalRecord, isRecord, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash } from "node:crypto";
 import { runCommandBuffered } from "openclaw/plugin-sdk/process-runtime";
@@ -97,8 +98,8 @@ async function readCodexCliCredentialsAsync(options) {
 	options.signal?.throwIfAborted();
 	if (!options.allowKeychainPrompt) return;
 	const home = await fs.realpath(options.codexHome).catch(() => path.resolve(options.codexHome));
-	const { CodexAppServerClient } = await import("./client-aPKNc4Ii.mjs").then((n) => n.n);
-	const { resolveManagedCodexPackageEntrypoint, resolveManagedCodexNativeCommand } = await import("./managed-binary-BtIjV7yN.mjs").then((n) => n.n);
+	const { CodexAppServerClient } = await import("./client-BS8X7HmG.mjs").then((n) => n.n);
+	const { resolveManagedCodexPackageEntrypoint, resolveManagedCodexNativeCommand } = await import("./managed-binary-DbKvGXKl.mjs").then((n) => n.o);
 	const launcher = resolveManagedCodexPackageEntrypoint(path.dirname(fileURLToPath(import.meta.url)));
 	const command = launcher ? resolveManagedCodexNativeCommand(launcher) : void 0;
 	if (!command) return;
@@ -148,21 +149,7 @@ async function readNativeCredential(client, home, options, signal) {
 	let record;
 	if (mode === "file") record = await readAuthFile(home);
 	else if ((mode === "keyring" || mode === "auto") && process.platform === "darwin") {
-		let cursor;
-		let encrypted;
-		do {
-			const features = await client.request("experimentalFeature/list", {
-				limit: 100,
-				cursor
-			}, { signal });
-			const storage = features.data.find((feature) => feature.name === "secret_auth_storage");
-			if (storage) {
-				encrypted = storage.enabled;
-				break;
-			}
-			cursor = features.nextCursor ?? void 0;
-		} while (cursor);
-		if (encrypted !== false) return;
+		if (await readCodexExperimentalFeature((params) => client.request("experimentalFeature/list", params, { signal }), "secret_auth_storage") !== false) return;
 		record = await readDirectKeyring(home, signal);
 	}
 	signal.throwIfAborted();

package/dist/.setup/{plugin-activation-D7WkJMvU.mjs → plugin-activation-CXPWe-hl.mjs}

@@ -1,6 +1,6 @@
-import { r as CodexAppServerRpcError } from "./rpc-error-C98SHchT.mjs";
-import { i as listCodexPluginMetadata, n as findCodexMarketplacePluginSummary, o as pluginReadParams, r as isOpenAiCuratedMarketplaceName, t as createCodexAppInventoryRequest, u as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-CYgdo14P.mjs";
-import "./config-C1YVVLEA.mjs";
+import { r as CodexAppServerRpcError } from "./rpc-error-DemqqaxE.mjs";
+import { i as listCodexPluginMetadata, n as findCodexMarketplacePluginSummary, o as pluginReadParams, r as isOpenAiCuratedMarketplaceName, t as createCodexAppInventoryRequest, u as CODEX_PLUGINS_MARKETPLACE_NAME } from "./plugin-inventory-DE9wcaeH.mjs";
+import "./config-BfrAlTMT.mjs";
 import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 //#region extensions/codex/src/app-server/plugin-activation.ts
 /** Activates legacy curated plugins without granting install authority to other marketplaces. */
@@ -78,7 +78,7 @@ async function refreshCodexPluginRuntimeState(params) {
 }
 /** Refreshes hosted app tools without reloading unrelated active threads. */
 async function refreshCodexAppRuntimeState(params) {
-	params.appCache.invalidate(params.appCacheKey, "Codex plugin app inventory refresh requested", void 0, params.targetAppIds);
+	params.appCache.invalidate(params.appCacheKey, "Codex plugin app inventory refresh requested");
 	if (params.deferAppInventoryRefresh) return;
 	await params.appCache.refreshNow({
 		key: params.appCacheKey,

package/dist/.setup/{plugin-app-cache-key-Bg9DbDI6.mjs → plugin-app-cache-key-DRb-niJc.mjs}

@@ -30,7 +30,6 @@ var CodexAppInventoryCache = class {
 	constructor(options = {}) {
 		this.entries = /* @__PURE__ */ new Map();
 		this.inFlight = /* @__PURE__ */ new Map();
-		this.refreshTokens = /* @__PURE__ */ new Map();
 		this.diagnostics = /* @__PURE__ */ new Map();
 		this.revision = 0;
 		this.ttlMs = options.ttlMs ?? CODEX_APP_INVENTORY_CACHE_TTL_MS;
@@ -42,7 +41,7 @@ var CodexAppInventoryCache = class {
 		const refreshScheduled = (state === "missing" ? !params.suppressRefresh : state === "stale" || Boolean(params.forceRefetch)) && this.scheduleRefresh(params);
 		let snapshot;
 		if (entry) {
-			const { invalidated: _invalidated, invalidatedAppIds: _invalidatedAppIds, ...rest } = entry;
+			const { invalidated: _invalidated, ...rest } = entry;
 			snapshot = rest;
 		}
 		const diagnostic = entry ? entry.lastError : this.diagnostics.get(params.key);
@@ -55,25 +54,15 @@ var CodexAppInventoryCache = class {
 			...diagnostic ? { diagnostic } : {}
 		};
 	}
-	/**
-	* Marks a key stale and records the reason as a diagnostic. A scope names
-	* the app ids the invalidation concerns so a covering targeted refresh can
-	* clear it; without one, only a complete refresh revalidates the entry.
-	*/
-	invalidate(key, reason, nowMs = Date.now(), invalidatedAppIds) {
+	/** Marks a key stale until its next successful refresh. */
+	invalidate(key, reason, nowMs = Date.now()) {
 		this.revision += 1;
-		this.refreshTokens.delete(key);
-		this.inFlight.delete(key);
 		const diagnostic = {
 			message: reason,
 			atMs: nowMs
 		};
 		const entry = this.entries.get(key);
 		if (entry) {
-			const scope = invalidatedAppIds?.filter(Boolean).map(codexAppIdentityKey) ?? [];
-			if (!entry.invalidated) entry.invalidatedAppIds = scope.length ? [...scope].toSorted() : void 0;
-			else if (entry.invalidatedAppIds && scope.length) entry.invalidatedAppIds = Array.from(/* @__PURE__ */ new Set([...entry.invalidatedAppIds, ...scope])).toSorted();
-			else entry.invalidatedAppIds = void 0;
 			entry.invalidated = true;
 			entry.lastError = diagnostic;
 			entry.revision = this.revision;
@@ -83,7 +72,6 @@ var CodexAppInventoryCache = class {
 	clear() {
 		this.entries.clear();
 		this.inFlight.clear();
-		this.refreshTokens.clear();
 		this.diagnostics.clear();
 		this.revision = 0;
 	}
@@ -95,10 +83,8 @@ var CodexAppInventoryCache = class {
 	async refreshNow(params) {
 		const existing = this.inFlight.get(params.key);
 		if (existing && !params.forceRefetch && doesInFlightRefreshCover(existing, params)) return existing.promise;
-		const refreshToken = Symbol("app-inventory-refresh");
-		this.refreshTokens.set(params.key, refreshToken);
 		const previousRefresh = params.forceRefetch ? void 0 : existing?.promise;
-		const promise = this.refreshUncoalesced(params, refreshToken, previousRefresh);
+		const promise = this.refreshUncoalesced(params, previousRefresh);
 		const currentRefresh = {
 			promise,
 			targetAppIds: targetAppIdSet(params.targetAppIds)
@@ -110,7 +96,7 @@ var CodexAppInventoryCache = class {
 			if (this.inFlight.get(params.key) === currentRefresh) this.inFlight.delete(params.key);
 		}
 	}
-	async refreshUncoalesced(params, refreshToken, previousRefresh) {
+	async refreshUncoalesced(params, previousRefresh) {
 		const nowMs = resolveDateTimestampMs(params.nowMs);
 		try {
 			let previousRefreshSucceeded = false;
@@ -133,28 +119,20 @@ var CodexAppInventoryCache = class {
 				expiresAtMs,
 				revision: this.revision
 			};
-			if (this.refreshTokens.get(params.key) === refreshToken) {
-				const existingEntry = this.entries.get(params.key);
-				const published = resolvePublishedInventorySnapshot(existingEntry, snapshot, nowMs);
-				const remaining = resolveRemainingInvalidationScope(existingEntry, snapshot);
-				this.entries.set(params.key, {
-					...published,
-					...remaining,
-					...remaining.invalidated && existingEntry?.lastError ? { lastError: existingEntry.lastError } : {}
-				});
-				this.diagnostics.delete(params.key);
-			}
+			this.entries.set(params.key, {
+				...resolvePublishedInventorySnapshot(this.entries.get(params.key), snapshot, nowMs),
+				invalidated: false
+			});
+			this.diagnostics.delete(params.key);
 			return snapshot;
 		} catch (error) {
-			if (this.refreshTokens.get(params.key) === refreshToken) {
-				const diagnostic = {
-					message: sanitizeErrorMessage(error instanceof Error ? error.message : String(error)),
-					atMs: nowMs
-				};
-				this.diagnostics.set(params.key, diagnostic);
-				const entry = this.entries.get(params.key);
-				if (entry) entry.lastError = diagnostic;
-			}
+			const diagnostic = {
+				message: sanitizeErrorMessage(error instanceof Error ? error.message : String(error)),
+				atMs: nowMs
+			};
+			this.diagnostics.set(params.key, diagnostic);
+			const entry = this.entries.get(params.key);
+			if (entry) entry.lastError = diagnostic;
 			embeddedAgentLog.warn("codex app inventory refresh failed", {
 				forceRefetch: params.forceRefetch === true,
 				keyFingerprint: fingerprintInventoryCacheKey(params.key),
@@ -196,22 +174,6 @@ function mergeRefreshedRows(existingRows, refreshedRows, refreshedTargetIds) {
 		return refreshed ? [refreshed] : [];
 	}), ...refreshedRows.filter((row) => !existingIds.has(codexAppIdentityKey(row.id)))];
 }
-/**
-* A refresh retires exactly the invalidation scope it re-read: a complete
-* refresh clears everything; a targeted one subtracts its target ids so
-* separate covering refreshes accumulate until no scope remains. Unscoped
-* invalidations require a complete refresh.
-*/
-function resolveRemainingInvalidationScope(existing, snapshot) {
-	if (!existing?.invalidated || !snapshot.targetAppIds?.length) return { invalidated: false };
-	if (!existing.invalidatedAppIds) return { invalidated: true };
-	const refreshedTargetIds = new Set(snapshot.targetAppIds);
-	const remaining = existing.invalidatedAppIds.filter((appId) => !refreshedTargetIds.has(appId));
-	return remaining.length > 0 ? {
-		invalidated: true,
-		invalidatedAppIds: remaining
-	} : { invalidated: false };
-}
 function targetAppIdSet(appIds) {
 	return new Set(appIds?.filter(Boolean).map(codexAppIdentityKey) ?? []);
 }

package/dist/.setup/{plugin-approval-roundtrip-68FoMlaZ.mjs → plugin-approval-roundtrip-DIZHLbAM.mjs}

@@ -1,4 +1,4 @@
-import { mt as resolveCodexGatewayTimeoutWithGraceMs } from "./shared-client-CCz9ldpr.mjs";
+import { ut as resolveCodexGatewayTimeoutWithGraceMs } from "./shared-client-CE_uY0A1.mjs";
 import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import { isApprovalNotFoundError, toErrorObject } from "openclaw/plugin-sdk/error-runtime";
 import { racePromiseWithAbortSignal } from "openclaw/plugin-sdk/time-runtime";

package/dist/.setup/{plugin-inventory-CYgdo14P.mjs → plugin-inventory-DE9wcaeH.mjs}

@@ -1,5 +1,5 @@
-import { c as findCodexAppById } from "./plugin-app-cache-key-Bg9DbDI6.mjs";
-import "./config-C1YVVLEA.mjs";
+import { c as findCodexAppById } from "./plugin-app-cache-key-DRb-niJc.mjs";
+import "./config-BfrAlTMT.mjs";
 import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/config-contracts.ts
 const CODEX_PLUGINS_MARKETPLACE_NAME = "openai-curated";

package/dist/.setup/{plugin-metadata-cache-Bi8TAPwX.mjs → plugin-metadata-cache-BqC-a6Fb.mjs}

@@ -5,8 +5,6 @@ var CodexPluginMetadataCache = class {
 		this.nowMs = nowMs;
 		this.entries = /* @__PURE__ */ new Map();
 		this.inFlight = /* @__PURE__ */ new Map();
-		this.generations = /* @__PURE__ */ new Map();
-		this.clearGeneration = 0;
 	}
 	read(appCacheKey, queryKind, requestParams, catalogScope) {
 		const entryKey = buildMetadataCacheEntryKey(appCacheKey, queryKind, requestParams, catalogScope);
@@ -24,18 +22,11 @@ var CodexPluginMetadataCache = class {
 		const cached = this.read(params.appCacheKey, params.queryKind, params.requestParams, params.catalogScope);
 		if (cached) return cached;
 		const pending = this.inFlight.get(entryKey);
-		if (pending) try {
-			return await pending.promise;
-		} catch {
-			if (this.inFlight.get(entryKey) === pending) this.inFlight.delete(entryKey);
-			return await this.load(params);
-		}
-		const generation = this.generations.get(params.appCacheKey) ?? 0;
-		const clearGeneration = this.clearGeneration;
+		if (pending) return await pending.promise;
 		const promise = (async () => {
 			const method = params.queryKind === "installed" ? "plugin/installed" : "plugin/list";
 			const response = await params.request(method, params.requestParams);
-			if (generation === (this.generations.get(params.appCacheKey) ?? 0) && clearGeneration === this.clearGeneration && response.marketplaceLoadErrors.length === 0 && (params.cacheable?.(response) ?? true)) this.entries.set(entryKey, {
+			if (response.marketplaceLoadErrors.length === 0 && (params.cacheable?.(response) ?? true)) this.entries.set(entryKey, {
 				appCacheKey: params.appCacheKey,
 				response,
 				expiresAtMs: this.nowMs() + CODEX_PLUGIN_METADATA_CACHE_TTL_MS
@@ -53,13 +44,9 @@ var CodexPluginMetadataCache = class {
 		}
 	}
 	invalidate(appCacheKey) {
-		this.generations.set(appCacheKey, (this.generations.get(appCacheKey) ?? 0) + 1);
 		for (const cache of [this.entries, this.inFlight]) for (const [entryKey, entry] of cache) if (entry.appCacheKey === appCacheKey) cache.delete(entryKey);
 	}
-	/** Clears snapshots and prevents late in-flight loads from repopulating them. */
 	clear() {
-		this.clearGeneration += 1;
-		this.generations.clear();
 		this.entries.clear();
 		this.inFlight.clear();
 	}

package/dist/.setup/{project-doc-thread-config-BVcvnps8.mjs → project-doc-thread-config-B0UI3f1D.mjs}

@@ -1,11 +1,11 @@
-import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
+import { r as isJsonObject } from "./protocol-CaPAVwe9.mjs";
 import { l as fingerprintCodexPolicy } from "./config-security-clxAZYWX.mjs";
 import { f as resolveCodexPluginsPolicy } from "./config-parsing-DsWSCPHO.mjs";
-import { u as CODEX_SESSION_OVERRIDABLE_LAYER_TYPES } from "./config-options-DDzeNQ8m.mjs";
-import { a as defaultCodexAppInventoryCache, i as CodexAppInventoryCache, o as serializeCodexAppInventoryError, s as codexAppIdentityKey } from "./plugin-app-cache-key-Bg9DbDI6.mjs";
-import { l as toCodexPluginOwnedAccountApp, s as readCodexPluginInventory, t as createCodexAppInventoryRequest } from "./plugin-inventory-CYgdo14P.mjs";
-import "./config-C1YVVLEA.mjs";
-import { t as ensureCodexPluginActivation } from "./plugin-activation-D7WkJMvU.mjs";
+import { u as CODEX_SESSION_OVERRIDABLE_LAYER_TYPES } from "./config-options-DMFZkd3X.mjs";
+import { a as defaultCodexAppInventoryCache, i as CodexAppInventoryCache, o as serializeCodexAppInventoryError, s as codexAppIdentityKey } from "./plugin-app-cache-key-DRb-niJc.mjs";
+import { l as toCodexPluginOwnedAccountApp, s as readCodexPluginInventory, t as createCodexAppInventoryRequest } from "./plugin-inventory-DE9wcaeH.mjs";
+import "./config-BfrAlTMT.mjs";
+import { t as ensureCodexPluginActivation } from "./plugin-activation-CXPWe-hl.mjs";
 import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/codex/src/app-server/plugin-app-approval-overrides.ts
 /** Projects ask approvals into the native session layer without changing saved settings. */

package/dist/.setup/protocol-CaPAVwe9.mjs

@@ -0,0 +1,12 @@
+import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
+//#region extensions/codex/src/app-server/protocol.ts
+/** Namespace Codex keeps directly model-visible without exposing it to Code Mode guests. */
+const CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE = "openclaw_direct";
+function flattenCodexDynamicToolFunctions(tools) {
+	return (tools ?? []).flatMap((tool) => tool.type === "namespace" ? tool.tools : [tool]);
+}
+function isJsonObject(value) {
+	return isRecord(value);
+}
+//#endregion
+export { flattenCodexDynamicToolFunctions as n, isJsonObject as r, CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE as t };

package/dist/.setup/{provider-capabilities-DWH29sy3.mjs → provider-capabilities-DjcKunHS.mjs}

@@ -1,4 +1,4 @@
-import { h as releaseLeasedSharedCodexAppServerClient } from "./shared-client-CCz9ldpr.mjs";
+import { f as releaseLeasedSharedCodexAppServerClient } from "./shared-client-CE_uY0A1.mjs";
 //#region extensions/codex/src/app-server/provider-capabilities.ts
 function resolveOverriddenProviderWebSearchSupport(modelProviderOverride) {
 	const provider = modelProviderOverride?.trim().toLowerCase();

package/dist/.setup/{provider-BCXRBKEb.mjs → provider-wj_LFJH3.mjs}

@@ -11,7 +11,7 @@ function buildCodexMigrationProvider(params = {}) {
 		].join(" "),
 		supportedItemKinds: ["memory", "auth"],
 		async detect(ctx) {
-			const { discoverCodexSource, hasCodexSource } = await import("./source-DsubBCYm.mjs").then((n) => n.a);
+			const { discoverCodexSource, hasCodexSource } = await import("./source-uGKgKWm8.mjs").then((n) => n.a);
 			const memoryOnly = isOnlyMigrationKind(ctx, "memory");
 			const authOnly = isOnlyMigrationKind(ctx, "auth");
 			const source = await discoverCodexSource({
@@ -29,16 +29,16 @@ function buildCodexMigrationProvider(params = {}) {
 			};
 		},
 		async plan(ctx) {
-			const { buildCodexMigrationPlan } = await import("./plan-DFVngccH.mjs");
+			const { buildCodexMigrationPlan } = await import("./plan-B4cHgqNv.mjs");
 			return buildCodexMigrationPlan(ctx);
 		},
 		deferredApply: { retrySafe: true },
 		prepareApply(ctx) {
 			if (isOnlyMigrationKind(ctx, "memory") || isOnlyMigrationKind(ctx, "auth")) return;
-			return import("./apply-CfWD3Bk6.mjs").then(({ prepareTargetCodexAppServer }) => prepareTargetCodexAppServer(ctx));
+			return import("./apply-BVSXYkTV.mjs").then(({ prepareTargetCodexAppServer }) => prepareTargetCodexAppServer(ctx));
 		},
 		async apply(ctx, plan) {
-			const { applyCodexMigrationPlan } = await import("./apply-CfWD3Bk6.mjs");
+			const { applyCodexMigrationPlan } = await import("./apply-BVSXYkTV.mjs");
 			return await applyCodexMigrationPlan({
 				ctx,
 				plan,

package/dist/.setup/{rate-limits-CI8pTPqL.mjs → rate-limits-BpfURnuy.mjs}

@@ -1,4 +1,4 @@
-import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
+import { r as isJsonObject } from "./protocol-CaPAVwe9.mjs";
 import { normalizeOptionalString, parseStrictFiniteNumber } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { z } from "zod";
 import { MAX_DATE_TIMESTAMP_MS, resolveExpiresAtMsFromEpochSeconds } from "openclaw/plugin-sdk/number-runtime";