@openclaw/codex 2026.10.5-beta.3 → 2026.10.10-beta.1

package/dist/.setup/{request-DInueZ2q.mjs → request-ePeNJrOd.mjs}

@@ -1,10 +1,10 @@
-import { i as CodexAppServerScopedRequestRejectedError, r as CodexAppServerRpcError } from "./rpc-error-C98SHchT.mjs";
-import { t as CODEX_CONTROL_METHODS } from "./capabilities-DbOzOglY.mjs";
+import { i as CodexAppServerScopedRequestRejectedError, r as CodexAppServerRpcError } from "./rpc-error-DemqqaxE.mjs";
+import { t as CODEX_CONTROL_METHODS } from "./capabilities-DAS-JX1z.mjs";
 import { i as withTimeout$1, r as withAbortableTimeout } from "./timeout-D0mEWSGG.mjs";
-import { t as __exportAll } from "./session-binding-sidecars-DD-enC8w.mjs";
+import { t as __exportAll } from "./session-binding-sidecars-BNSS6WL4.mjs";
 import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-registration";
-import { areDiagnosticsEnabledForProcess } from "openclaw/plugin-sdk/diagnostic-runtime";
 import { raceWithTimeout } from "openclaw/plugin-sdk/time-runtime";
+import { areDiagnosticsEnabledForProcess } from "openclaw/plugin-sdk/diagnostic-runtime";
 //#region extensions/codex/src/app-server/request-diagnostics.ts
 const DIAGNOSTIC_METHODS = /* @__PURE__ */ new Set([
 	...Object.values(CODEX_CONTROL_METHODS),
@@ -19,13 +19,6 @@ const DIAGNOSTIC_METHODS = /* @__PURE__ */ new Set([
 	"experimentalFeature/list"
 ]);
 const MAX_METHODS = 8;
-function readInitializeSnapshot(read, beforeClose = false) {
-	try {
-		return read?.(beforeClose);
-	} catch {
-		return;
-	}
-}
 /** Counts awaited APIs, not native execution or proof that a request was written. */
 function createCodexRequestTimeoutDiagnostics(timeoutMs) {
 	if (!areDiagnosticsEnabledForProcess() || !embeddedAgentLog.isEnabled("warn")) return;
@@ -50,8 +43,8 @@ function createCodexRequestTimeoutDiagnostics(timeoutMs) {
 					if (observation.boundary === "cleanup") {
 						if (current.acquireLastObservedBoundary !== "cleanup") {
 							current.acquireBoundaryBeforeCleanup = current.acquireLastObservedBoundary;
-							const snapshot = readInitializeSnapshot(current.initializeSnapshot);
-							current.initializeBeforeCleanup = snapshot?.clientClosed ? readInitializeSnapshot(current.initializeSnapshot, true) : snapshot;
+							const snapshot = current.initializeSnapshot?.();
+							current.initializeBeforeCleanup = snapshot?.clientClosed ? current.initializeSnapshot?.(true) : snapshot;
 							current.initializeBeforeCleanupSource = current.initializeBeforeCleanup ? snapshot?.clientClosed ? "before-client-close" : "at-cleanup" : void 0;
 						}
 					} else {
@@ -64,30 +57,18 @@ function createCodexRequestTimeoutDiagnostics(timeoutMs) {
 				},
 				onStartedClient(client) {
 					if (attempt !== current || current.phase !== "acquire-client") return;
-					current.lastStartedClientInstanceId = void 0;
-					current.lastStartedTransportIdentity = void 0;
-					current.initializeSnapshot = void 0;
 					current.initializeBeforeCleanup = void 0;
 					current.initializeBeforeCleanupSource = void 0;
-					try {
-						current.lastStartedClientInstanceId = client.getInstanceId();
-						current.initializeSnapshot = (beforeClose) => client.getInitializeDiagnostic(beforeClose);
-					} catch {}
-					try {
-						const identity = client.getRegisteredTransportIdentity();
-						current.lastStartedTransportIdentity = identity ? {
-							pid: identity.pid,
-							startedAt: identity.startedAt
-						} : void 0;
-					} catch {}
+					current.lastStartedClientInstanceId = client.getInstanceId();
+					current.initializeSnapshot = (beforeClose) => client.getInitializeDiagnostic(beforeClose);
+					const identity = client.getRegisteredTransportIdentity();
+					current.lastStartedTransportIdentity = identity;
 				}
 			};
 		},
 		acquired(client) {
 			attempt.phase = "callback";
-			try {
-				attempt.clientInstanceId = client.getInstanceId();
-			} catch {}
+			attempt.clientInstanceId = client.getInstanceId();
 		},
 		request(method) {
 			const current = attempt;
@@ -108,7 +89,7 @@ function createCodexRequestTimeoutDiagnostics(timeoutMs) {
 				if (!areDiagnosticsEnabledForProcess() || !embeddedAgentLog.isEnabled("warn")) return;
 				const methods = [...attempt.methods].toSorted(([a], [b]) => a.localeCompare(b));
 				const pending = methods.reduce((count, [, active]) => count + active, 0);
-				const initialize = readInitializeSnapshot(attempt.initializeSnapshot);
+				const initialize = attempt.initializeSnapshot?.();
 				embeddedAgentLog.warn("codex app-server scope timed out", {
 					phase: attempt.phase === "callback" && pending > 0 ? "client-request" : attempt.phase,
 					timeoutMs,
@@ -164,23 +145,34 @@ async function requestCodexAppServerClientJson(params) {
 	let phase = "prepare";
 	observeControl(params.controlObservation, phase);
 	try {
-		const { resolveCodexAppServerDirectSandboxBypassBlock } = await import("./sandbox-guard-DIImwCy1.mjs").then((n) => n.r);
-		const sandboxBlock = resolveCodexAppServerDirectSandboxBypassBlock(params);
-		if (sandboxBlock) throw new Error(sandboxBlock);
-		const timeoutMs = params.timeoutMs ?? 6e4;
-		const method = params.method;
-		const requestParams = params.requestParams;
-		const attemptWaiterFinished = method === "thread/list" ? params.controlObservation?.attemptWaiterFinished : void 0;
-		const options = {
-			timeoutMs,
-			signal: params.signal,
-			withCurrent: params.withCurrent,
-			assertCurrent: params.assertCurrent,
-			...attemptWaiterFinished ? { attemptWaiterFinished } : {}
-		};
-		phase = "client-request";
-		observeControl(params.controlObservation, phase);
-		return await withTimeout$1(params.client.request(method, requestParams, options), timeoutMs, `codex app-server ${params.method} timed out`);
+		const { prepareCodexAppServerDirectSandboxBypassBlock } = await import("./sandbox-guard-DneAfNye.mjs").then((n) => n.a);
+		const sandboxGuard = await prepareCodexAppServerDirectSandboxBypassBlock(params);
+		try {
+			if (sandboxGuard.block) throw new Error(sandboxGuard.block);
+			const timeoutMs = params.timeoutMs ?? 6e4;
+			const method = params.method;
+			const requestParams = params.requestParams;
+			const attemptWaiterFinished = method === "thread/list" ? params.controlObservation?.attemptWaiterFinished : void 0;
+			const options = {
+				timeoutMs,
+				signal: params.signal,
+				withCurrent: async (write) => {
+					await params.assertCurrentAsync?.();
+					await sandboxGuard.assertCurrent();
+					if (params.withCurrent) await params.withCurrent(write);
+					else write();
+				},
+				assertCurrent: () => {
+					params.assertCurrent?.();
+				},
+				...attemptWaiterFinished ? { attemptWaiterFinished } : {}
+			};
+			phase = "client-request";
+			observeControl(params.controlObservation, phase);
+			return await withTimeout$1(params.client.request(method, requestParams, options), timeoutMs, `codex app-server ${params.method} timed out`);
+		} finally {
+			sandboxGuard.release();
+		}
 	} catch (error) {
 		observeControl(params.controlObservation, phase, { error });
 		throw error;
@@ -188,16 +180,20 @@ async function requestCodexAppServerClientJson(params) {
 }
 async function requestCodexAppServerJson(params) {
 	observeControl(params.controlObservation, "prepare");
-	const { resolveCodexAppServerDirectSandboxBypassBlock } = await import("./sandbox-guard-DIImwCy1.mjs").then((n) => n.r);
-	const sandboxBlock = resolveCodexAppServerDirectSandboxBypassBlock(params);
-	if (sandboxBlock) throw new Error(sandboxBlock);
-	return await withCodexAppServerJsonClient({
-		...params,
-		timeoutMessage: `codex app-server ${params.method} timed out`
-	}, async (request) => await request({
-		method: params.method,
-		requestParams: params.requestParams
-	}));
+	const { prepareCodexAppServerDirectSandboxBypassBlock } = await import("./sandbox-guard-DneAfNye.mjs").then((n) => n.a);
+	const sandboxGuard = await prepareCodexAppServerDirectSandboxBypassBlock(params);
+	try {
+		if (sandboxGuard.block) throw new Error(sandboxGuard.block);
+		return await withCodexAppServerJsonClient({
+			...params,
+			timeoutMessage: `codex app-server ${params.method} timed out`
+		}, async (request) => await request({
+			method: params.method,
+			requestParams: params.requestParams
+		}));
+	} finally {
+		sandboxGuard.release();
+	}
 }
 function createScopeCleanupError(message) {
 	const stackTraceLimit = Error.stackTraceLimit;
@@ -292,51 +288,54 @@ async function withCodexAppServerJsonClient(params, run) {
 			timeoutMs,
 			timeoutMessage,
 			promise: (async () => {
-				const { resolveCodexAppServerDirectSandboxBypassBlock } = await import("./sandbox-guard-DIImwCy1.mjs").then((n) => n.r);
-				const { createIsolatedCodexAppServerClient, getLeasedSharedCodexAppServerClient, isCodexAppServerStartSelectionChangedError, releaseLeasedSharedCodexAppServerClient, retireSharedCodexAppServerClientIfCurrent } = await import("./shared-client-CCz9ldpr.mjs").then((n) => n.v);
-				for (let attempt = 0; attempt < 2; attempt += 1) {
-					errorPhase = void 0;
-					setPhase("prepare");
+				const { prepareCodexAppServerDirectSandboxBypassBlock } = await import("./sandbox-guard-DneAfNye.mjs").then((n) => n.a);
+				const { createIsolatedCodexAppServerClient, getLeasedSharedCodexAppServerClient, releaseLeasedSharedCodexAppServerClient } = await import("./shared-client-CE_uY0A1.mjs").then((n) => n.m);
+				errorPhase = void 0;
+				setPhase("prepare");
+				throwIfAbandoned();
+				const acquireClient = params.isolated ? createIsolatedCodexAppServerClient : getLeasedSharedCodexAppServerClient;
+				const acquireObservation = timeoutDiagnostics?.beginAttempt(1);
+				const acquireOptions = {
+					startOptions: params.startOptions,
+					pluginConfig: params.pluginConfig,
+					timeoutMs: remainingTimeoutMs(),
+					authProfileId: params.authProfileId,
+					authProfileStore: params.authProfileStore,
+					authBindingFingerprint: params.authBindingFingerprint,
+					preparedAuth: params.preparedAuth,
+					authRequirement: params.authRequirement,
+					agentDir: params.agentDir,
+					config: params.config,
+					abandonSignal: timeoutController.signal,
+					assertCurrent: params.assertCurrent,
+					assertCurrentAsync: params.assertCurrentAsync,
+					...acquireObservation
+				};
+				setPhase("acquire-client");
+				const client = await acquireClient(acquireOptions);
+				timeoutDiagnostics?.acquired(client);
+				let scopeActive = true;
+				const assertCurrent = () => {
 					throwIfAbandoned();
-					const acquireClient = params.isolated ? createIsolatedCodexAppServerClient : getLeasedSharedCodexAppServerClient;
-					const acquireObservation = timeoutDiagnostics?.beginAttempt(attempt + 1);
-					const acquireOptions = {
-						startOptions: params.startOptions,
-						pluginConfig: params.pluginConfig,
-						timeoutMs: remainingTimeoutMs(),
-						authProfileId: params.authProfileId,
-						authProfileStore: params.authProfileStore,
-						authBindingFingerprint: params.authBindingFingerprint,
-						preparedAuth: params.preparedAuth,
-						authRequirement: params.authRequirement,
-						agentDir: params.agentDir,
-						config: params.config,
-						abandonSignal: timeoutController.signal,
-						assertCurrent: params.assertCurrent,
-						...acquireObservation
-					};
-					setPhase("acquire-client");
-					const client = await acquireClient(acquireOptions);
-					timeoutDiagnostics?.acquired(client);
-					let scopeActive = true;
-					const assertCurrent = () => {
-						throwIfAbandoned();
-						if (!scopeActive) throw new CodexAppServerScopedRequestRejectedError("Codex app-server request scope is closed");
-						assertRequestOwnerCurrent(params.assertCurrent);
-					};
-					try {
+					if (!scopeActive) throw new CodexAppServerScopedRequestRejectedError("Codex app-server request scope is closed");
+					assertRequestOwnerCurrent(params.assertCurrent);
+				};
+				try {
+					setPhase("prepare");
+					assertCurrent();
+					const scopedRequest = async (request) => {
 						setPhase("prepare");
-						assertCurrent();
-						const scopedRequest = async (request) => {
-							setPhase("prepare");
-							const sandboxBlock = resolveCodexAppServerDirectSandboxBypassBlock({
-								method: request.method,
-								requestParams: request.requestParams,
-								config: params.config,
-								sessionKey: params.sessionKey,
-								sessionId: params.sessionId
-							});
-							if (sandboxBlock) throw new CodexAppServerScopedRequestRejectedError(sandboxBlock);
+						const sandboxGuard = await prepareCodexAppServerDirectSandboxBypassBlock({
+							method: request.method,
+							requestParams: request.requestParams,
+							config: params.config,
+							sessionKey: params.sessionKey,
+							sessionId: params.sessionId,
+							agentId: params.agentId,
+							storePath: params.storePath
+						});
+						try {
+							if (sandboxGuard.block) throw new CodexAppServerScopedRequestRejectedError(sandboxGuard.block);
 							assertCurrent();
 							const method = request.method;
 							const requestParams = request.requestParams;
@@ -353,6 +352,14 @@ async function withCodexAppServerJsonClient(params, run) {
 								assertCurrent: () => {
 									assertCurrent();
 									request.assertCurrent?.();
+								},
+								withCurrent: async (write) => {
+									await params.assertCurrentAsync?.();
+									await request.assertCurrentAsync?.();
+									await sandboxGuard.assertCurrent();
+									assertCurrent();
+									request.assertCurrent?.();
+									write();
 								}
 							};
 							setPhase("client-request");
@@ -362,43 +369,32 @@ async function withCodexAppServerJsonClient(params, run) {
 							} finally {
 								settled?.();
 							}
-						};
-						return await run(scopedRequest, client, {
-							assertCurrent,
-							abort: (reason) => {
-								if (scopeActive) timeoutController.abort(reason);
-							}
-						});
-					} catch (error) {
-						errorPhase = activePhase;
-						if (!isCodexAppServerStartSelectionChangedError(error) || attempt > 0) throw error;
-						errorPhase = void 0;
-						try {
-							if (!params.isolated) {
-								setPhase("release-client");
-								retireSharedCodexAppServerClientIfCurrent(client);
-							}
-							setPhase("prepare");
-							throwIfAbandoned();
-						} catch (retryError) {
-							errorPhase = activePhase;
-							throw retryError;
+						} finally {
+							sandboxGuard.release();
 						}
-					} finally {
-						scopeActive = false;
-						setPhase("release-client");
-						timeoutDiagnostics?.release();
-						const requestErrorPhase = errorPhase;
-						errorPhase = activePhase;
-						if (params.isolated) await client.closeAndWait({
-							exitTimeoutMs: params.isolatedShutdown?.exitTimeoutMs ?? 2e3,
-							forceKillDelayMs: params.isolatedShutdown?.forceKillDelayMs ?? 250
-						});
-						else releaseLeasedSharedCodexAppServerClient(client);
-						errorPhase = requestErrorPhase;
-					}
+					};
+					return await run(scopedRequest, client, {
+						assertCurrent,
+						abort: (reason) => {
+							if (scopeActive) timeoutController.abort(reason);
+						}
+					});
+				} catch (error) {
+					errorPhase = activePhase;
+					throw error;
+				} finally {
+					scopeActive = false;
+					setPhase("release-client");
+					timeoutDiagnostics?.release();
+					const requestErrorPhase = errorPhase;
+					errorPhase = activePhase;
+					if (params.isolated) await client.closeAndWait({
+						exitTimeoutMs: params.isolatedShutdown?.exitTimeoutMs ?? 2e3,
+						forceKillDelayMs: params.isolatedShutdown?.forceKillDelayMs ?? 250
+					});
+					else releaseLeasedSharedCodexAppServerClient(client);
+					errorPhase = requestErrorPhase;
 				}
-				throw new Error("Codex app-server selection retry loop exited unexpectedly");
 			})()
 		});
 	} catch (error) {

package/dist/.setup/{responses-oauth-twnuTaAa.mjs → responses-oauth-CCV7aVYF.mjs}

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { findPersistedAuthProfileCredential, isPendingOAuthRefreshFence, isSameOAuthRefreshGeneration, resolveApiKeyForProfile } from "openclaw/plugin-sdk/agent-runtime";
+import { findPersistedAuthProfileCredentialAsync, isPendingOAuthRefreshFence, isSameOAuthRefreshGeneration, resolveApiKeyForProfile } from "openclaw/plugin-sdk/agent-runtime";
 import { decodeOpenAICodexJwtPayload } from "openclaw/plugin-sdk/provider-auth";
 //#region extensions/codex/src/app-server/responses-oauth.ts
 const CODEX_RESPONSES_OAUTH_PROVIDER = "openclaw_token_sharing";
@@ -43,9 +43,8 @@ async function resolveCodexResponsesOAuthProfileFingerprint(params) {
 	return fingerprintCodexResponsesOAuth(credential);
 }
 /** Keep OAuth refresh and persisted grant ownership in OpenClaw, outside native Codex auth. */
-function createCodexResponsesOAuth(params) {
-	const persisted = Boolean(findPersistedAuthProfileCredential(params)) || params.store.runtimePersistedProfileIds?.includes(params.profileId) === true;
-	const readCredential = () => persisted ? findPersistedAuthProfileCredential(params) : params.store.profiles[params.profileId];
+async function createCodexResponsesOAuth(params) {
+	const persisted = Boolean(await findPersistedAuthProfileCredentialAsync(params)) || params.store.runtimePersistedProfileIds?.includes(params.profileId) === true;
 	const validate = (credential) => {
 		if (fingerprintCodexResponsesOAuth(credential) !== params.fingerprint) throw new Error("ChatGPT subscription sharing identity changed; reconnect before retrying.");
 	};
@@ -60,7 +59,7 @@ function createCodexResponsesOAuth(params) {
 		validate(credential);
 	};
 	return { async resolve(forceRefresh) {
-		const credential = readCredential();
+		const credential = persisted ? await findPersistedAuthProfileCredentialAsync(params) : params.store.profiles[params.profileId];
 		validateCurrent(credential, lastCredential);
 		const resolved = await resolveApiKeyForProfile({
 			cfg: params.config,
@@ -81,8 +80,9 @@ function createCodexResponsesOAuth(params) {
 		const resolvedCredential = resolved.credential;
 		validate(resolvedCredential);
 		lastCredential = resolvedCredential;
+		if (persisted && !resolved.readCurrentCredential) throw new Error("ChatGPT subscription sharing credential authority is unavailable.");
+		const readCredential = resolved.readCurrentCredential ?? (() => params.store.profiles[params.profileId]);
 		const assertCurrent = () => validateCurrent(readCredential(), resolvedCredential);
-		assertCurrent();
 		return {
 			token: resolved.apiKey,
 			assertCurrent

package/dist/.setup/{rpc-error-C98SHchT.mjs → rpc-error-DemqqaxE.mjs}

@@ -1,5 +1,5 @@
-import { i as isJsonObject } from "./protocol-CANUwXJ3.mjs";
-import { coerceErrorMessage } from "openclaw/plugin-sdk/error-runtime";
+import { r as isJsonObject } from "./protocol-CaPAVwe9.mjs";
+import { coerceErrorMessage, formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 //#region extensions/codex/src/app-server/rpc-error.ts
 const CODEX_APP_SERVER_OVERLOADED_ERROR_CODE = -32001;
 /** A scoped guard rejected the request before a physical write. */
@@ -50,5 +50,9 @@ var CodexAppServerLocalRequestCancellationError = class extends Error {
 function isCodexAppServerOverloadError(error) {
 	return error instanceof CodexAppServerRpcError && error.code === -32001;
 }
+function isMissingCodexParentThreadError(error) {
+	const message = formatErrorMessage(error);
+	return message.includes("no rollout found for thread id") || message.includes("includeTurns is unavailable before first user message");
+}
 //#endregion
-export { codexPrewriteRejectionCause as a, CodexAppServerScopedRequestRejectedError as i, CodexAppServerLocalRequestCancellationError as n, isCodexAppServerOverloadError as o, CodexAppServerRpcError as r, isCodexThreadReadMissingError as s, CODEX_APP_SERVER_OVERLOADED_ERROR_CODE as t };
+export { codexPrewriteRejectionCause as a, isMissingCodexParentThreadError as c, CodexAppServerScopedRequestRejectedError as i, CodexAppServerLocalRequestCancellationError as n, isCodexAppServerOverloadError as o, CodexAppServerRpcError as r, isCodexThreadReadMissingError as s, CODEX_APP_SERVER_OVERLOADED_ERROR_CODE as t };